Susp_Dropper (Kaspersky), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 10c0175a85a1e84515289d70c97f1adc
SHA1: 5b883018e75c8a07f035cfa154a3e0098a8337bd
SHA256: 50facb490c757217f8ef35219fd47f1fa0a6c7fdf37181a809acf10777f95065
SSDeep: 49152:wRsQbSKp ceZiBryJ z0kPBjLMJpjqFATZxuozsEKjmDkUcUiwH5 pG0CJZZ/ABT:AsQFXeZy2J z0kKJdqFQZxdrTcCJZZIx
Size: 3069952 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2016-04-29 20:40:48
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
| Behaviour | Description |
|---|---|
| EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):
cd.exe:1900
%original file name%.exe:1332
The Trojan injects its code into the following process(es):
ÌÚѶÄÚ²¿.exe:1936
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process cd.exe:1900 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\YDJDld4\Media\pby.exe.hsk (7386 bytes)
C:\YDJDld4\Media\seqgw290.exe (104 bytes)
%Program Files%\etauclt.exe (6395 bytes)
C:\YDJDld4\Media\etauclt.exe (6395 bytes)
C:\YDJDld4\Media\gzip.dll (30 bytes)
The process %original file name%.exe:1332 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ztj[1].htm (108 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ÌÚѶÄÚ²¿.exe (15801 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (203 bytes)
%Program Files%\Common Files\System\pzwj.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.qq5588[1].txt (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cd.exe (20507 bytes)
%Program Files%\Common Files\System\pzwj.txt (10 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2988 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416\index.dat (0 bytes)
Registry activity
The process ÌÚѶÄÚ²¿.exe:1936 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 0A 42 5D 33 BE D7 4E FC BE 79 AB C0 8B FC C0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process cd.exe:1900 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "87 73 E3 50 61 F8 83 A8 A7 56 8B D5 C7 5C 8F 6E"
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = "C:\YDJDld4\Media\seqgw290.exe"
The process %original file name%.exe:1332 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016060220160603]
"CacheRepair" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016060220160603]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016060220160603\"
"CachePrefix" = ":2016060220160603:"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016060220160603]
"CacheOptions" = "11"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 5C CE DE A8 D8 A5 C9 3D 78 5F B8 F5 C1 8B D3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016060220160603]
"CacheLimit" = "8192"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041520140416]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
| MD5 | File path |
|---|---|
| c5540fddfbd5cab971a752b82c24c60f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\cd.exe |
| f42c102998cc0964ec9df60612d3e931 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ÌÚѶÄÚ²¿.exe |
| 6ba4c0f515f7b7863be44bb13a2c1be7 | c:\Program Files\etauclt.exe |
| 6ba4c0f515f7b7863be44bb13a2c1be7 | c:\YDJDld4\Media\etauclt.exe |
| 8b3591965f623b219c0c528153746cab | c:\YDJDld4\Media\gzip.dll |
| 45ae1d3d1e2e2dd469707ade21e959b9 | c:\YDJDld4\Media\seqgw290.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
cd.exe:1900
%original file name%.exe:1332 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\YDJDld4\Media\pby.exe.hsk (7386 bytes)
C:\YDJDld4\Media\seqgw290.exe (104 bytes)
%Program Files%\etauclt.exe (6395 bytes)
C:\YDJDld4\Media\etauclt.exe (6395 bytes)
C:\YDJDld4\Media\gzip.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ztj[1].htm (108 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ÌÚѶÄÚ²¿.exe (15801 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (203 bytes)
%Program Files%\Common Files\System\pzwj.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.qq5588[1].txt (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cd.exe (20507 bytes)
%Program Files%\Common Files\System\pzwj.txt (10 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2988 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: English (United States)
Company Name: Product Name: ?????Product Version: 1.0.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ?????Comments: ??????????(http://www.eyuyan.com)Language: English (United States)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| UPX0 | 4096 | 3432448 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| UPX1 | 3436544 | 2998272 | 2996736 | 5.48773 | 09847b0e0818b7e0acb62b6325060f87 |
| .rsrc | 6434816 | 16384 | 14336 | 1.44054 | a43a9f2a675533ddf95f8a5410fc51a7 |
| .rmnet | 6451200 | 61440 | 57856 | 0.406724 | 0c7e414981424f0b66316275910215fb |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://www.qq5588.com/ztj.html?pan0501 | 183.61.164.113 |
| hxxp://www.qb34.com/hlb.txt | 23.234.14.135 |
| hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=1254180802&web_id=1254180802 | |
| hxxp://oz.cnzz.com/stat.htm?id=1254180802&r=&lg=en-us&ntime=none&cnzz_eid=622986580-1464889399-&showp=1276x846&t=&h=1&rnd=1782533034 | 198.11.132.200 |
| hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=1254180802&t=z | |
| hxxp://log.gds.mmstat.com/9.gif?abc=1&rnd=1264051581 | |
| hxxp://s11.cnzz.com/stat.php?id=1254180802&web_id=1254180802 | 1.99.192.16 |
| hxxp://c.cnzz.com/core.php?web_id=1254180802&t=z | 195.59.70.248 |
| hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1264051581 | 140.205.99.5 |
| pcookie.cnzz.com |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /ztj.html?pan0501 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qq5588.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 02 Jun 2016 19:22:43 GMT
Server: Apache
Last-Modified: Mon, 14 Sep 2015 05:47:25 GMT
ETag: "6c-51fae9994f540"
Accept-Ranges: bytes
Content-Length: 108
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
<script src="hXXp://s11.cnzz.com/stat.php?id=1254180802&web_id=1254180802" language="JavaScript"></script>..HTTP/1.1 200 OK..Date: Thu, 02 Jun 2016 19:22:43 GMT..Server: Apache..Last-Modified: Mon, 14 Sep 2015 05:47:25 GMT..ETag: "6c-51fae9994f540"..Accept-Ranges: bytes..Content-Length: 108..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: text/html..<script src="hXXp://s11.cnzz.com/stat.php?id=1254180802&web_id=1254180802" language="JavaScript"></script>....
GET /hlb.txt HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: VVV.qb34.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 02 Jun 2016 19:00:15 GMT
Content-Length: 11
Content-Type: text/plain
Content-Location: hXXp://VVV.qb34.com/hlb.txt
Last-Modified: Mon, 30 May 2016 14:24:08 GMT
Accept-Ranges: bytes
ETag: "668bc8ed7ebad11:1729"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
99Lover.exeHTTP/1.1 200 OK..Date: Thu, 02 Jun 2016 19:00:15 GMT..Content-Length: 11..Content-Type: text/plain..Content-Location: hXXp://VVV.qb34.com/hlb.txt..Last-Modified: Mon, 30 May 2016 14:24:08 GMT..Accept-Ranges: bytes..ETag: "668bc8ed7ebad11:1729"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..99Lover.exe..
GET /core.php?web_id=1254180802&t=z HTTP/1.1
Accept: */*
Referer: hXXp://VVV.qq5588.com/ztj.html?pan0501
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 764
Connection: keep-alive
Date: Thu, 02 Jun 2016 19:00:25 GMT
Last-Modified: Thu, 02 Jun 2016 19:00:25 GMT
Expires: Thu, 02 Jun 2016 19:15:25 GMT
Via: cache10.l2de1[301,200-0,M], cache63.l2de1[301,0], cache8.uk1[316,200-0,M], cache10.uk1[317,0]
X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2
X-Swift-SaveTime: Thu, 02 Jun 2016 19:00:25 GMT
X-Swift-CacheTime: 900
Timing-Allow-Origin: *
EagleId: c33b46d214648940251515662e
!function(){var p,q,r,a=encodeURIComponent,b="1254180802",c="",d="",e="online_v3.php",f="z13.cnzz.com",g="1",h="text",i="z",j="站长统计",k=window["_CNZZDbridge_" b]["bobject"],l="http:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k["callRequest"]([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k["createScriptIcon"](n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a href='" q "' target=_blank title='" j "'>" j "</a>",k["createIcon"]([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: application/javascript..Content-Length: 764..Connection: keep-alive..Date: Thu, 02 Jun 2016 19:00:25 GMT..Last-Modified: Thu, 02 Jun 2016 19:00:25 GMT..Expires: Thu, 02 Jun 2016 19:15:25 GMT..Via: cache10.l2de1[301,200-0,M], cache63.l2de1[301,0], cache8.uk1[316,200-0,M], cache10.uk1[317,0]..X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2..X-Swift-SaveTime: Thu, 02 Jun 2016 19:00:25 GMT..X-Swift-CacheTime: 900..Timing-Allow-Origin: *..EagleId: c33b46d214648940251515662e..!function(){var p,q,r,a=encodeURIComponent,b="1254180802",c="",d="",e="online_v3.php",f="z13.cnzz.com",g="1",h="text",i="z",j="站长统计",k=window["_CNZZDbridge_" b]["bobject"],l="http:",m="0",n=l "//on
<<< skipped >>>
GET /9.gif?abc=1&rnd=1264051581 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.qq5588.com/ztj.html?pan0501
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Server: Tengine
Date: Thu, 02 Jun 2016 19:00:26 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=SnDXDwRBEB8CAcLyYNpHhFqD; expires=Sun, 31-May-26 19:00:26 GMT; path=/; domain=.mmstat.com
Set-Cookie: sca=bfc42078; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=45baa14eb87f1be02bb95d26_1464894026; expires=Sun, 31-May-26 19:00:26 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=SnDXDwRBEB8CAcLyYNpHhFqD
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..
GET /stat.htm?id=1254180802&r=&lg=en-us&ntime=none&cnzz_eid=622986580-1464889399-&showp=1276x846&t=&h=1&rnd=1782533034 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.qq5588.com/ztj.html?pan0501
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: oz.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine/1.4.6
Date: Thu, 02 Jun 2016 19:00:25 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..
GET /stat.php?id=1254180802&web_id=1254180802 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.qq5588.com/ztj.html?pan0501
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s11.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 9941
Connection: keep-alive
Date: Thu, 02 Jun 2016 17:43:19 GMT
Last-Modified: Thu, 02 Jun 2016 17:43:19 GMT
Cache-Control: max-age=5400,s-maxage=5400
Via: cache46.l2de1[0,200-0,H], cache23.l2de1[0,0], cache8.uk1[0,200-0,H], cache8.uk1[0,0]
Age: 4625
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Thu, 02 Jun 2016 17:58:38 GMT
X-Swift-CacheTime: 4481
Timing-Allow-Origin: *
EagleId: c33b46d014648940246141741e
(function(){function k(){this.c="1254180802";this.R="z";this.N="";this.K="";this.M="";this.r="1464889399";this.P="oz.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=1254180802");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURIComponent,n=unescape;k.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),this.ga(),.this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.pa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},na:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},pa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if("[object
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
ÌÚѶÄÚ²¿.exe_1936:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t$(SSh
t$(SSh
~%UVW
~%UVW
u.hpXd
u.hpXd
u$SShe
u$SShe
wininet.dll
wininet.dll
shlwapi.dll
shlwapi.dll
kernel32.dll
kernel32.dll
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
GetWindowsDirectoryA
GetWindowsDirectoryA
hXXp://VVV.qb34.com/hlb/
hXXp://VVV.qb34.com/hlb/
%S4WD
%S4WD
hg%fpM
hg%fpM
S.Ac9SR
S.Ac9SR
0.I%3s
0.I%3s
,wAe.kI
,wAe.kI
aiUy'4xu
aiUy'4xu
%c*@j
%c*@j
.eH'y
.eH'y
{&%U)
{&%U)
lj%4U
lj%4U
xe%CNs
xe%CNs
9F.cLe
9F.cLe
hJK.ZH
hJK.ZH
O.qt0
O.qt0
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
USER32.dll
USER32.dll
SkinH_EL.dll
SkinH_EL.dll
?hXXp://VVV.qb34.com/hlb.txt
?hXXp://VVV.qb34.com/hlb.txt
k%UPp
k%UPp
fg.VG
fg.VG
%C',@
%C',@
>Ùd
>Ùd
wEBX
wEBX
.qpTT
.qpTT
B>U%f
B>U%f
.iqW>
.iqW>
"3/%F
"3/%F
5r.US
5r.US
:mD].tB
:mD].tB
!.qn%
!.qn%
X].XMgW
X].XMgW
.dq?]
.dq?]
L.qg6
L.qg6
&get_nick=1&_=
&get_nick=1&_=
hXXp://r.pengyou.com/fcg-bin/cgi_get_portrait.fcg?uins=
hXXp://r.pengyou.com/fcg-bin/cgi_get_portrait.fcg?uins=
&spec=100&url_enc=0&referer=bu_interface&term_type=PC
&spec=100&url_enc=0&referer=bu_interface&term_type=PC
hXXp://q2.qlogo.cn/headimg_dl?bs=
hXXp://q2.qlogo.cn/headimg_dl?bs=
1970-01-01 08:00:00
1970-01-01 08:00:00
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
http=
http=
https
https
HTTP/1.1
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
hXXps://
hXXps://
hXXp://
hXXp://
hXXp://VVV.qb34.com/txnb.txt
hXXp://VVV.qb34.com/txnb.txt
X.cc=
X.cc=
e%ct[
e%ct[
.bM:p
.bM:p
FTù1
FTù1
HT.FU
HT.FU
z===.UMW].
z===.UMW].
c:\1.png
c:\1.png
hXXp://VVV.2345.com/?k1742288
hXXp://VVV.2345.com/?k1742288
%Program Files%\Internet Explorer\IEXPLORE.EXE
%Program Files%\Internet Explorer\IEXPLORE.EXE
"f$E&_%C$
"f$E&_%C$
$\&.'>(
$\&.'>(
"s%f'
"s%f'
H%u0)-
H%u0)-
wshom.ocx
wshom.ocx
SHELL32.dll,4
SHELL32.dll,4
WindowStyle
WindowStyle
Hotkey
Hotkey
dbghelp.dll
dbghelp.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
hXXp://222.186.129.19/replay_18_22697
hXXp://222.186.129.19/replay_18_22697
hXXp://222.186.129.19
hXXp://222.186.129.19
C:\tmp\
C:\tmp\
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
%d&&'
%d&&'
123456789
123456789
00003333
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
user32.dll
user32.dll
GetProcessHeap
GetProcessHeap
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
GetKeyState
GetKeyState
GetViewportOrgEx
GetViewportOrgEx
WINMM.dll
WINMM.dll
WINSPOOL.DRV
WINSPOOL.DRV
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
WS2_32.dll
WS2_32.dll
GetCPInfo
GetCPInfo
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
comdlg32.dll
comdlg32.dll
RegCreateKeyExA
RegCreateKeyExA
.PAVCException@@
.PAVCException@@
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
.PAVCFileException@@
.PAVCFileException@@
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
1.1.3
1.1.3
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
C:\fff.exe
C:\fff.exe
C:\\fff.exe
C:\\fff.exe
@.vmp0
@.vmp0
`.vmp1
`.vmp1
.reloc
.reloc
&>.0 8(4
&>.0 8(4
$
$
$=-7'?/
$=-7'?/
*08 (6>&
*08 (6>&
)7?'/5=%
)7?'/5=%
4:8>
4:8>
p.sVwy
p.sVwy
Xj%F
Xj%F
?|>%F
?|>%F
?Ww
?Ww
E.LjH
E.LjH
.SG,\
.SG,\
%xK*Uxg
%xK*Uxg
%dKa^f
%dKa^f
JD.ggY
JD.ggY
P'.zP
P'.zP
c#{%cv
c#{%cv
^.QpN
^.QpN
.sR10
.sR10
.seHU
.seHU
.YB'nM
.YB'nM
}8%cMl
}8%cMl
9cMD`
9cMD`
%Wg6%dzp
%Wg6%dzp
%x 11
%x 11
8,.
8,.
hfRlbFJ.Xrrp
hfRlbFJ.Xrrp
z.nI:)
z.nI:)
zOLEAUT32.dll
zOLEAUT32.dll
C:\qq.exe
C:\qq.exe
C:\\qq.exe
C:\\qq.exe
VVV.qb123456.cc.
VVV.qb123456.cc.
99Lover.exe
99Lover.exe
pay.qq.com
pay.qq.com
(7),01444
(7),01444
'9=82<.342>
'9=82<.342>
1.2.18
1.2.18
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
AVIFIL32.dll
AVIFIL32.dll
RASAPI32.dll
RASAPI32.dll
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
VERSION.dll
VERSION.dll
RegCreateKeyA
RegCreateKeyA
oledlg.dll
oledlg.dll
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
WININET.dll
WININET.dll
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
(*.avi)|*.avi
(*.avi)|*.avi
WPFT532.CNV
WPFT532.CNV
WPFT632.CNV
WPFT632.CNV
EXCEL32.CNV
EXCEL32.CNV
write32.wpc
write32.wpc
Windows Write
Windows Write
mswrd632.wpc
mswrd632.wpc
Word for Windows 6.0
Word for Windows 6.0
wword5.cnv
wword5.cnv
Word for Windows 5.0
Word for Windows 5.0
mswrd832.cnv
mswrd832.cnv
mswrd632.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
Word 6.0/95 for Windows & Macintosh
html32.cnv
html32.cnv
operator
operator
keywords
keywords
KeyJOYBUTN12
KeyJOYBUTN12
KeyJOYBUTN11
KeyJOYBUTN11
KeyJOYBUTN10
KeyJOYBUTN10
KeyNUMKEYS
KeyNUMKEYS
KeyJOYBUTN9
KeyJOYBUTN9
KeyJOYBUTN8
KeyJOYBUTN8
KeyJOYBUTN7
KeyJOYBUTN7
KeyJOYBUTN6
KeyJOYBUTN6
KeyJOYBUTN5
KeyJOYBUTN5
KeyJOYBUTN4
KeyJOYBUTN4
KeyJOYBUTN3
KeyJOYBUTN3
KeyJOYBUTN2
KeyJOYBUTN2
KeyJOYBUTN1
KeyJOYBUTN1
KeyJOYBUTN0
KeyJOYBUTN0
KeyMOUSEBUTN4
KeyMOUSEBUTN4
KeyMOUSEMIDDLE
KeyMOUSEMIDDLE
KeyMOUSERIGHT
KeyMOUSERIGHT
KeyMOUSELEFT
KeyMOUSELEFT
KeyPAUSE
KeyPAUSE
KeyPRINTSCRN
KeyPRINTSCRN
KeySCROLLLOCK
KeySCROLLLOCK
KeyCAPSLOCK
KeyCAPSLOCK
KeyNUMLOCK
KeyNUMLOCK
KeyNUM9
KeyNUM9
KeyNUM8
KeyNUM8
KeyNUM7
KeyNUM7
KeyNUM6
KeyNUM6
KeyNUM5
KeyNUM5
KeyNUM4
KeyNUM4
KeyNUM3
KeyNUM3
KeyNUM2
KeyNUM2
KeyNUM1
KeyNUM1
KeyNUM0
KeyNUM0
KeyNUMPERIOD
KeyNUMPERIOD
KeyNUMENTER
KeyNUMENTER
KeyNUMPLUS
KeyNUMPLUS
KeyNUMMINUS
KeyNUMMINUS
KeyNUMSTAR
KeyNUMSTAR
KeyNUMSLASH
KeyNUMSLASH
KeyPGDN
KeyPGDN
KeyPGUP
KeyPGUP
KeyEND
KeyEND
KeyHOME
KeyHOME
KeyDEL
KeyDEL
KeyINS
KeyINS
KeyF12
KeyF12
KeyF11
KeyF11
KeyF10
KeyF10
KeyF9
KeyF9
KeyF8
KeyF8
KeyF7
KeyF7
KeyF6
KeyF6
KeyF5
KeyF5
KeyF4
KeyF4
KeyF3
KeyF3
KeyF2
KeyF2
KeyF1
KeyF1
KeyDOWNARROW
KeyDOWNARROW
KeyUPARROW
KeyUPARROW
KeyRIGHTARROW
KeyRIGHTARROW
KeyLEFTARROW
KeyLEFTARROW
KeyRIGHTALT
KeyRIGHTALT
KeyLEFTALT
KeyLEFTALT
KeyRIGHTCTRL
KeyRIGHTCTRL
KeyLEFTCTRL
KeyLEFTCTRL
KeyRIGHTSHIFT
KeyRIGHTSHIFT
KeyLEFTSHIFT
KeyLEFTSHIFT
KeyDELETE
KeyDELETE
KeyTILDA
KeyTILDA
KeyRCURLY
KeyRCURLY
KeyPIPE
KeyPIPE
KeyLCURLY
KeyLCURLY
KeyZ
KeyZ
KeyX
KeyX
KeyW
KeyW
KeyV
KeyV
KeyU
KeyU
KeyT
KeyT
KeyS
KeyS
KeyR
KeyR
KeyQ
KeyQ
KeyP
KeyP
KeyO
KeyO
KeyN
KeyN
KeyM
KeyM
KeyL
KeyL
KeyK
KeyK
KeyJ
KeyJ
KeyI
KeyI
KeyH
KeyH
KeyG
KeyG
KeyF
KeyF
KeyE
KeyE
KeyD
KeyD
KeyC
KeyC
KeyB
KeyB
KeyA
KeyA
KeyGRAVE
KeyGRAVE
KeyUNDERSCORE
KeyUNDERSCORE
KeyCARETE
KeyCARETE
KeyRBRACKET
KeyRBRACKET
KeyBACKSLASH
KeyBACKSLASH
KeyLBRACKET
KeyLBRACKET
KeyCZ
KeyCZ
KeyCY
KeyCY
KeyCX
KeyCX
KeyCW
KeyCW
KeyCV
KeyCV
KeyCU
KeyCU
KeyCT
KeyCT
KeyCS
KeyCS
KeyCR
KeyCR
KeyCQ
KeyCQ
KeyCP
KeyCP
KeyCO
KeyCO
KeyCN
KeyCN
KeyCM
KeyCM
KeyCL
KeyCL
KeyCK
KeyCK
KeyCJ
KeyCJ
KeyCI
KeyCI
KeyCH
KeyCH
KeyCG
KeyCG
KeyCF
KeyCF
KeyCE
KeyCE
KeyCD
KeyCD
KeyCC
KeyCC
KeyCB
KeyCB
KeyCA
KeyCA
KeyAT
KeyAT
KeyQMARK
KeyQMARK
KeyGREATERTHEN
KeyGREATERTHEN
KeyEQUALS
KeyEQUALS
KeyLESSTHEN
KeyLESSTHEN
KeySEMICOLON
KeySEMICOLON
KeyCOLON
KeyCOLON
KeySLASH
KeySLASH
KeyPERIOD
KeyPERIOD
KeyDASH
KeyDASH
KeyCOMMA
KeyCOMMA
KeyPLUS
KeyPLUS
KeyASTERISC
KeyASTERISC
KeyRBRACE
KeyRBRACE
KeyLBRACE
KeyLBRACE
KeyAMPERSAND
KeyAMPERSAND
KeyPERCENT
KeyPERCENT
KeyDOLLAR
KeyDOLLAR
KeyPOUND
KeyPOUND
KeyDQUOTE
KeyDQUOTE
KeyBANG
KeyBANG
KeySPACE
KeySPACE
KeyESCAPE
KeyESCAPE
KeyENTER
KeyENTER
KeyTAB
KeyTAB
KeyBACKSPACE
KeyBACKSPACE
\d3drm.dll
\d3drm.dll
\dplayx.dll
\dplayx.dll
\dsound.dll
\dsound.dll
\dinput.dll
\dinput.dll
\ddraw.dll
\ddraw.dll
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
.PAVCOleException@@
.PAVCOleException@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
1, 0, 6, 6
1, 0, 6, 6
- Skin.dll
- Skin.dll
"$,22761(030&
"$,22761(030&
/7-,-%,11.
/7-,-%,11.
*1531-(%$
*1531-(%$
,)'.-.))
,)'.-.))
(*.*)
(*.*)
ÌÚѶÄÚ²¿.exe_1936_rwx_10000000_0003E000:
`.rsrc
`.rsrc
L$(h%f
L$(h%f
SSh0j
SSh0j
msctls_hotkey32
msctls_hotkey32
TVCLHotKey
TVCLHotKey
THotKey
THotKey
\skinh.she
\skinh.she
}uo,x6l5k%x-l h
}uo,x6l5k%x-l h
9p%s m)t4`#b
9p%s m)t4`#b
e"m?c&y1`Ã
e"m?c&y1`Ã
SetViewportOrgEx
SetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
EnumThreadWindows
EnumThreadWindows
EnumChildWindows
EnumChildWindows
`c%US.4/
`c%US.4/
!#$
!#$
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.UPX0
@.UPX0
`.UPX1
`.UPX1
`.reloc
`.reloc
hJK.ZH
hJK.ZH
O.qt0
O.qt0
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
USER32.dll
USER32.dll
SkinH_EL.dll
SkinH_EL.dll
1, 0, 6, 6
1, 0, 6, 6
- Skin.dll
- Skin.dll