Gen.Variant.Strictor.10499_3e1728ecf3

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

ping.exe:1976
LMIns.exe:340
ÖñÓ°LOL»»·ôÊÓ¾à.exe:224
%original file name%.exe:320

The Trojan injects its code into the following process(es):

Explorer.EXE:1572

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process LMIns.exe:340 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%WinDir%\Setupsti.log (14023 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%WinDir%\inf\oem10.inf (2 bytes)
%WinDir%\setupapi.log (3392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P5X9PT08\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_lm_delself_.bat (101 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\39HFPMMG\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AZWHE3OF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3N5HN08H\desktop.ini (67 bytes)
%WinDir%\inf\oem10.PNF (11641 bytes)
%WinDir%\hllog.txt (36 bytes)
%WinDir%\_ntdll.bak (4545 bytes)
%System%\drivers\SET3.tmp (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (1176 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl (0 bytes)
%System%\drivers\SET3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (0 bytes)

The process %original file name%.exe:320 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\E_4\krnln.fnr (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LMIns.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ÖñÓ°LOL»»·ôÊÓ¾à.exe (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\shell.fne (57 bytes)

Registry activity

The process ping.exe:1976 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 B8 A3 2C 90 25 00 FE 7E 5D DA EF 2C 1D 26 2A"

The process LMIns.exe:340 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"FSFilter Activity Monitor" = "04 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Services\Mslmedia]
"DebugFlags" = "0"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"_lm_delself_.bat" = "_lm_delself_"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SYSTEM\LastKnownGoodRecovery\LastGood]
"INF/oem10.inf" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SYSTEM\LastKnownGoodRecovery\LastGood]
"INF/oem10.PNF" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 8F 5C 83 06 7C EA 66 B6 A8 BF 8C E8 80 36 A3"

[HKLM\System\CurrentControlSet\Services\Mslmedia\Instances]
"DefaultInstance" = "Mslmedia Instance"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\System\CurrentControlSet\Services\Mslmedia\Instances\Mslmedia Instance]
"Altitude" = "370030"
"Flags" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process ÖñÓ°LOL»»·ôÊÓ¾à.exe:224 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD BF A5 06 6B 95 E9 9B 4B A4 D6 F7 73 B4 5E 82"

The process %original file name%.exe:320 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 73 B0 21 34 2D 80 0A 50 DE 33 9B A5 18 34 3E"

Dropped PE files

MD5	File path
97c8fe752e354b2945e4c593a87e4a8b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E_4\krnln.fnr
d63851f89c7ad4615565ca300e8b8e27	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E_4\shell.fne
ac0f04b85a1cfd50dbac571e6efe7fea	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ÖñÓ°LOL»»·ôÊÓ¾à.exe
27d9ed8cb8b62d1e0a8e5ace6cf52e2f	c:\WINDOWS\_ntdll.bak
325bb26842fc7ccc1fcce2c457317f3e	c:\WINDOWS\system32\drivers\Mslmedia.sys
325bb26842fc7ccc1fcce2c457317f3e	c:\WINDOWS\system32\drivers\msjclock.sys

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "%System%\DRIVERS\Mslmedia.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):

   ping.exe:1976
   LMIns.exe:340
   ÖñÓ°LOL»»·ôÊÓ¾à.exe:224
   %original file name%.exe:320
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %WinDir%\Setupsti.log (14023 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %WinDir%\inf\oem10.inf (2 bytes)
   %WinDir%\setupapi.log (3392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P5X9PT08\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_lm_delself_.bat (101 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\39HFPMMG\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AZWHE3OF\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3N5HN08H\desktop.ini (67 bytes)
   %WinDir%\inf\oem10.PNF (11641 bytes)
   %WinDir%\hllog.txt (36 bytes)
   %WinDir%\_ntdll.bak (4545 bytes)
   %System%\drivers\SET3.tmp (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (1176 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\E_4\krnln.fnr (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\LMIns.exe (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ÖñÓ°LOL»»·ôÊÓ¾à.exe (7972 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\E_4\shell.fne (57 bytes)

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	19868	20480	4.51528	15c1f09b5a84212473d3312136f61984
.rdata	24576	2634	4096	2.46987	c3a429c9401d144a06bbf6c66f26e739
.data	28672	8024	8192	1.98312	391dfe9979de8fe0fe40df3f14303242
.ecode	36864	4096	4096	3.11561	dd0555631ceaf30c86b63ebb73afd81f
.rsrc	40960	928	4096	1.37632	ba4c9b6b5ffe780d4a1a650201700687

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://hlsys.oss-cn-shenzhen.aliyuncs.com/updatever1.rar
hxxp://hlsys.oss-cn-shenzhen.aliyuncs.com/wkmde.rar
hxxp://hlupdate.liu1xia.com/updatever1.rar	120.25.112.8
hxxp://hlupdate.liu1xia.com/wkmde.rar	120.25.112.8
hlsoft7.liu1xia.com	120.25.122.145

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /updatever1.rar HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36

Host: hlupdate.liu1xia.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: AliyunOSS

Date: Fri, 17 Jun 2016 11:16:28 GMT

Content-Type: application/octet-stream

Content-Length: 42921

Connection: keep-alive

x-oss-request-id: 5763DC0C7FBF6737C73B68D5

x-oss-bucket-storage-type: standard

Accept-Ranges: bytes

ETag: "18642651E2C0B6D82D7577994400BB41"

Last-Modified: Tue, 17 May 2016 11:20:22 GMT

x-oss-object-type: Normal

x-oss-server-time: 1

x...}xSU.8|.....r....@.(.A......B.........:...........F.n...x/..{u..z....Q.3.i.MAF.~..V..]S.....=.Z.$iaf.....{......g......k............SU.k.........~.f.a....?.l.-...U.{.Z6o.t......}.O..I..x.e..S..?...p[...n.....k...y.s.......O.....X................Y....Y...}..[..\.....[\,\y..>.wu.]N.[.K.._Z.M..p)3...p.......Y..c|....)........u.y.I)..U2....{..[..4Y.....:.e..Aj#...w..D..4.~.t...<i.......;t"N.Q.,.w..-.......?..=.~.\Y..-.....,.......tW.....u......cfH2.......7A.m.5.pf$...[.......s..Vc..kW...9.d5.UVSkFk....*....v.[.P....Y........x.g.BcoQ..)....*q\..'{...zM..[.:...{.......r.0xrj.0|.....F.........A..@l...k.&.).... ]j....PGt[zu.=...ag..^2l.....Q..._....:................)...aK.m.t#Q...g.X.%~aX.L.Y-.....u...&....(,._.o...t.@...^...=6x.N.)X|....6..e......#..k5../[.|.....@e...*`=....x..VSN..P.."5...D.....7../. .8"*_ }*=.kqt.J7Dm..E].d...p..b.\..K.!......V '_O...Q...U.TiJ.....?N.n..Z..e..sH......%..?.M..?m..!..V.|..g.h8.$...G....H.:.........M.Z...\s..Gai.kLW..i5..Y...2.W........"H$...l.|O#Gy........_,G.l.........l..5(.N.'.=.............e.....{1.....3.....S...L.$..u*..r.m..x.EHw.Y...s........$..@. )...htU....%....;A...Fc.ff.H..1.t....T....d...g....8.... ..P...../.3.Jw....%.$.2.tk......../{=..d....`3k..@..0....X...!UP.. ou!)........J.mdc3.-x...........n.7...?x.K......5x9........p.F..:.H:.5:.Rbti.J.Z.....J(.R:y...,.I..Z[g\^..h.......e).=.D.......*iK A:...............VT^d....f.nTe@........Z.p....su...#d.Z[.......~.N..qM..v..<.ap..X.....*..R......`.....'.wfO,.f... .z.G.....<..d...7.D..q....Wz..........|!..N`M.H.%...j

<<< skipped >>>

GET /wkmde.rar HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36

Host: hlupdate.liu1xia.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: AliyunOSS

Date: Fri, 17 Jun 2016 11:16:30 GMT

Content-Type: application/octet-stream

Content-Length: 370936

Connection: keep-alive

x-oss-request-id: 5763DC0E7FBF6737C73B6A74

x-oss-bucket-storage-type: standard

Accept-Ranges: bytes

ETag: "6425654B78B76B36BB26D98E1643C16F"

Last-Modified: Tue, 17 May 2016 11:20:23 GMT

x-oss-object-type: Normal

x-oss-server-time: 1

.*`....p..0P/....0.P`..0.p......P..`..@.......0....0`..@.0..p.......p..M!x...a.h..0....r....!>..D.R.0".~..N.4..`...U..]Z.0..`.. c..k...(.......h.FN.M.DX. .........hV...Y.'.bY........4.g.....t..Q^.SI.H.A.....8..e.........w...@...p0@..u. ..%....f. .p@......1.QI0.j........0.GM.p.....`!@.P.0....@B... @.......Pp.@.P..B.04.../2`..... .` ..P@... ..0P..... `....P.0.....` ..@......0@.`. `.`0 ....PpP.@..0...A.,...@.p.P...PP.0.`pP . ..pp. ....P.0 P.@...0.P.p.. ...`.@..`..`0.0P0P.0.0.P .t.8....P.1.0...p..@... ..pp.p..p. .....n".1.Q.... p...p.b.0.....`0P.@........@.....apP.(.....Q..d.@.@........0...@...@....Rc@`......`..0r p.$... ....@... 0..P`........rw...`aP...0.V....P ...@0...P...`pp.P.... `...@ @`p... . .ppP.`p..P.P.P.p..`0..P.@0....@.@..p. ....`..........P.``P...@.....@.....0..p. @.... ....@0.@....0..0..`.....00@.... ....P.. . @.pP..@....P.. @.. .....`....p..p.@......p.................@...`..p.0....@p.@ ....p..p.. .Pp. ..p...@p....@.. ..p . . . ..@.PP....@...0P.P.P.0...`P...@@p......`.P..`.p...@... . p.p.....`p. [."...<.\<<..,\.H.....|.\\L.....k!C.l..|L.,....LK..$S.x..../5.....<..\.l.<..L.L...4.(...W.V.`.......x...{..."..~. {'....p\l...|L.L.|..$6K.Tt. .!LT.!.............k8......`1",@..B.@.......\\...<..X;.ap.!P.@..AH.!.c.......#...P{4...@Ho.0..g....1..X8..D.7.p/a..p....@.....0...,..._[..tTI......#...t.....l..\......G.......q...X.60...D v..D.../x{..@d......V...A...@.4.X.........8.V..!.......PG.t..ppP...5....8~.0.c.d..<`....v@p.pp..t0.._O......`.......p..P)...lr..\,........L4......G.a..T......

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

ÖñÓ°LOL»»·ôÊÓ¾à.exe_224:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

hCrT

hCrT

3hCrT

3hCrT

t$(SSh

t$(SSh

~%UVW

~%UVW

u$SShe

u$SShe

kernel32.dll

kernel32.dll

shlwapi.dll

shlwapi.dll

dbghelp.dll

dbghelp.dll

advapi32.dll

advapi32.dll

RegCloseKey

RegCloseKey

RegCreateKeyA

RegCreateKeyA

RegOpenKeyA

RegOpenKeyA

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyA

RegEnumKeyA

\Game\hid.dll

\Game\hid.dll

@.reloc

@.reloc

user32.dll

user32.dll

GetAsyncKeyState

GetAsyncKeyState

League of Legends.exe

League of Legends.exe

TenRpcs.dll

TenRpcs.dll

\Air\assets\images\champions\*.jpg

\Air\assets\images\champions\*.jpg

%d&&'

%d&&'

123456789

123456789

00003333

00003333

deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

inflate 1.1.3 Copyright 1995-1998 Mark Adler

inflate 1.1.3 Copyright 1995-1998 Mark Adler

%*.*f

%*.*f

CNotSupportedException

CNotSupportedException

commctrl_DragListMsg

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

Afx:%x:%x

COMCTL32.DLL

COMCTL32.DLL

CCmdTarget

CCmdTarget

__MSVCRT_HEAP_SELECT

__MSVCRT_HEAP_SELECT

Broken pipe

Broken pipe

Inappropriate I/O control operation

Inappropriate I/O control operation

Operation not permitted

Operation not permitted

iphlpapi.dll

iphlpapi.dll

SHLWAPI.dll

SHLWAPI.dll

MPR.dll

MPR.dll

WINMM.dll

WINMM.dll

WS2_32.dll

WS2_32.dll

VERSION.dll

VERSION.dll

GetProcessHeap

GetProcessHeap

WinExec

WinExec

KERNEL32.dll

KERNEL32.dll

GetKeyState

GetKeyState

RegisterHotKey

RegisterHotKey

UnregisterHotKey

UnregisterHotKey

USER32.dll

USER32.dll

GetViewportOrgEx

GetViewportOrgEx

GDI32.dll

GDI32.dll

WINSPOOL.DRV

WINSPOOL.DRV

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyExA

RegCreateKeyExA

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

COMCTL32.dll

COMCTL32.dll

WININET.dll

WININET.dll

GetCPInfo

GetCPInfo

CreateDialogIndirectParamA

CreateDialogIndirectParamA

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExA

SetWindowsHookExA

SetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

SetViewportExtEx

ScaleViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

GetViewportExtEx

comdlg32.dll

comdlg32.dll

HID.dll

HID.dll

Shell32.dll

Shell32.dll

Mpr.dll

Mpr.dll

Advapi32.dll

Advapi32.dll

User32.dll

User32.dll

Gdi32.dll

Gdi32.dll

Kernel32.dll

Kernel32.dll

.PAVCException@@

.PAVCException@@

(&07-034/)7 '

(&07-034/)7 '

?? / %d]

?? / %d]

%d / %d]

%d / %d]

.PAVCFileException@@

.PAVCFileException@@

: %d]

: %d]

(*.*)|*.*||

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

(*.CUR)|*.CUR|

%s:%d

%s:%d

windows

windows

.PAVCNotSupportedException@@

.PAVCNotSupportedException@@

out.prn

out.prn

(*.prn)|*.prn|

(*.prn)|*.prn|

%d.%d

%d.%d

%d/%d

%d/%d

1.6.9

1.6.9

unsupported zlib version

unsupported zlib version

png_read_image: unsupported transformation

png_read_image: unsupported transformation

%d / %d

%d / %d

Bogus message code %d

Bogus message code %d

libpng error: %s

libpng error: %s

libpng warning: %s

libpng warning: %s

1.1.3

1.1.3

bad keyword

bad keyword

libpng does not support gamma background rgb_to_gray

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

Palette is NULL in indexed image

(%d-%d):

(%d-%d):

%ld%c

%ld%c

%d%d%d

%d%d%d

rundll32.exe shell32.dll,

rundll32.exe shell32.dll,

.PAVCObject@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCResourceException@@

.PAVCUserException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

.PAVCArchiveException@@

zcÁ

zcÁ

#include "l.chs\afxres.rc" // Standard components

#include "l.chs\afxres.rc" // Standard components

PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX

PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX

:";6;=;};

:";6;=;};

>">)>2>8>

>">)>2>8>

0 0$0(0,0

0 0$0(0,0

=,>0>4>8>

=,>0>4>8>

$0(0,0004080

$0(0,0004080

= =$=(=,=0=4=8=

= =$=(=,=0=4=8=

? ?$?(?,?

? ?$?(?,?

:$:*:0:6:

:$:*:0:6:

5%6U6~6

5%6U6~6

0 111=1]1

0 111=1]1

8$8,828?8|8

8$8,828?8|8

;,

;,

: :$:,:0:4:8:<:>

: :$:,:0:4:8:<:>

?(?4?8?@?`?

?(?4?8?@?`?

HKEY_CURRENT_USER\Software\Tencent\LOL

HKEY_CURRENT_USER\Software\Tencent\LOL

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_USERS

F%*.*f

F%*.*f

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

(*.*)

(*.*)

1.0.0.0

1.0.0.0

(hXXp://VVV.eyuyan.com)

(hXXp://VVV.eyuyan.com)

Explorer.EXE_1572_rwx_01E20000_00001000:

PID=1956(0)=1=0.0.0,0_0x0_0x0-0x0-ITS:0_0_0,fg=1,rmv=0/0 %WinDir%\Explorer.EXE

PID=1956(0)=1=0.0.0,0_0x0_0x0-0x0-ITS:0_0_0,fg=1,rmv=0/0 %WinDir%\Explorer.EXE

Explorer.EXE_1572_rwx_01EA0000_0007A000:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

tGHt.Ht&

tGHt.Ht&

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

1.2.3

1.2.3

inflate 1.2.3 Copyright 1995-2005 Mark Adler

inflate 1.2.3 Copyright 1995-2005 Mark Adler

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

operator

operator

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

error in ReadProcessMemory , RVA=X sizeread=%d ret=%d Error=#%ld

error in ReadProcessMemory , RVA=X sizeread=%d ret=%d Error=#%ld

error in WriteProcessMemory , sizewrite=%d ret=%d RVA=%I64X Error=#%ld

error in WriteProcessMemory , sizewrite=%d ret=%d RVA=%I64X Error=#%ld

error in VirtualAllocEx , size=%d Error=#%ld

error in VirtualAllocEx , size=%d Error=#%ld

kernel32.dll

kernel32.dll

actth3.0.1

actth3.0.1