Trojan.Win32.FlyStudio_4d2bd8792b – Adaware

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:348

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:348 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (8 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.xfluoke[2].txt (451 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.xfluoke[1].xml (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (898 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tghh[1].txt (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\21[1].gif (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.xfluoke[1].txt (187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bt[1].txt (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tj[1].htm (726 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\banben[1].txt (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\uctc64[1].txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\zuidibanben[1].txt (4 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[2].js (21 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5012 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wz64[1].txt (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@www.xfluoke[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)

Registry activity

The process %original file name%.exe:348 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1024x768x32(BGR 0)" = "31,31,31,31"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CC 8F 01 C5 19 D9 54 C0 D1 EC F6 A4 49 63 D7 17"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (8 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.xfluoke[2].txt (451 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.xfluoke[1].xml (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (898 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tghh[1].txt (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\21[1].gif (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.xfluoke[1].txt (187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bt[1].txt (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tj[1].htm (726 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\banben[1].txt (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\uctc64[1].txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\zuidibanben[1].txt (4 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[2].js (21 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5012 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wz64[1].txt (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: ????????
Product Name: ????????
Product Version: 9.8.0.1
Legal Copyright: ????????
??:www.luokexf.com
??:admin@luokexf.com
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 9.8.0.1
File Description: www.luokexf.com
Comments: www.luokexf.com
Language: Language Neutral

Company Name: ????????Product Name: ????????Product Version: 9.8.0.1Legal Copyright: ??????????:www.luokexf.com??:admin@luokexf.comLegal Trademarks: Original Filename: Internal Name: File Version: 9.8.0.1File Description: www.luokexf.comComments: www.luokexf.comLanguage: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1675264	1675264	4.51404	42a638a1231f75fdc2ebbf13641d56fb
.rdata	1679360	964570	966656	4.27472	562ceb61e5a658233ce82a1cf3212a28
.data	2646016	333416	110592	3.80958	7a4af5380a97974862235e4cbdf8f654
.rsrc	2981888	61440	61440	4.21394	247373246633bbb5e4fe4f94ae4d4fe7

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.xfluoke.com/data/cs.txt	192.225.225.167
hxxp://www.xfluoke.com/data/tjrj/bt.txt	192.225.225.167
hxxp://www.xfluoke.com/data/tjrj/uctc64.txt	192.225.225.167
hxxp://www.xfluoke.com/data/tjrj/wz64.txt	192.225.225.167
hxxp://www.xfluoke.com/data/tjrj/tghh.txt	192.225.225.167
hxxp://www.xfluoke.com/data/tj.html?V9.8	192.225.225.167
hxxp://www.xfluoke.com/data/banben.txt	192.225.225.167
hxxp://www.xfluoke.com/data/zuidibanben.txt	192.225.225.167
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=4369261&web_id=4369261&show=pic1
hxxp://hm.e.shifen.com/h.js?4de4eadcf85ee6dc5ae83132e3429e3f
hxxp://hm.e.shifen.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=823678787&si=4de4eadcf85ee6dc5ae83132e3429e3f&st=1&v=1.1.2&lv=1
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=5931522
hxxp://static.n.shifen.com/hmt/icon/21.gif
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=5931522&t=z
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=574177603	42.120.219.171
hxxp://cnzz.mmstat.com/app.gif?&cna=lkxVDq3LIhwCAcLyYOPsHJRL	42.120.219.171
hxxp://hm.baidu.com/h.js?4de4eadcf85ee6dc5ae83132e3429e3f	220.181.7.190
hxxp://eiv.baidu.com/hmt/icon/21.gif	115.239.211.92
hxxp://s25.cnzz.com/stat.php?id=4369261&web_id=4369261&show=pic1	1.99.192.16
hxxp://s4.cnzz.com/stat.php?id=5931522	1.99.192.15
hxxp://c.cnzz.com/core.php?web_id=5931522&t=z	212.98.178.235
hxxp://pcookie.cnzz.com/app.gif?&cna=lkxVDq3LIhwCAcLyYOPsHJRL	42.120.219.171
hxxp://hm.baidu.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=823678787&si=4de4eadcf85ee6dc5ae83132e3429e3f&st=1&v=1.1.2&lv=1	220.181.7.190
17roco.qq.com
oz.cnzz.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /stat.php?id=4369261&web_id=4369261&show=pic1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s25.cnzz.com

Connection: Keep-Alive

HTTP/1.1 503 Service Temporarily Unavailable

Server: Tengine

Content-Length: 0

Connection: keep-alive

Via: cache20.l2de1[0,503-0,M], cache5.l2de1[1224,0], cache7.by1[1326,503-0,M], cache6.by1[1320,1327,502001]

Age: 0

X-Cache: MISS TCP_MISS dirn:-2:-2

X-Swift-SaveTime: Fri, 14 Aug 2015 21:32:50 GMT

X-Swift-CacheTime: 1

...

GET /app.gif?&cna=lkxVDq3LIhwCAcLyYOPsHJRL HTTP/1.1

Accept: */*

Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pcookie.cnzz.com

HTTP/1.1 200 OK

Server: Tengine

Date: Fri, 14 Aug 2015 21:33:14 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=lkxVDq3LIhwCAcLyYOPsHJRL; expires=Mon, 11-Aug-25 21:33:14 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache

GIF89a.............!.......,...........L..;..

GET /stat.php?id=5931522 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s4.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Date: Fri, 14 Aug 2015 21:33:05 GMT

Last-Modified: Fri, 14 Aug 2015 21:33:05 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache8.l2de1[679,200-0,M], cache52.l2de1[681,0], cache3.by1[809,200-0,M], cache4.by1[809,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:11:822725449

X-Swift-SaveTime: Fri, 14 Aug 2015 21:33:05 GMT

X-Swift-CacheTime: 5400

1f77..(function(){function k(){this.c="5931522";this.R="z";this.N="";this.K="";this.M="";this.r="1439587985";this.P="oz.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=5931522");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURIComponent,n=unescape;k.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),this.ga(),.this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.pa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},na:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},pa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if("[object

<<< skipped >>>

GET /hmt/icon/21.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: eiv.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=311040000

Content-Length: 1119

Content-Type: image/gif

Date: Fri, 14 Aug 2015 21:33:05 GMT

Etag: "762990053"

Expires: Sun, 22 Jun 2025 21:33:05 GMT

Last-Modified: Tue, 13 Apr 2010 09:38:40 GMT

Server: BWS/1.0

GIF89a........s..E.....M...................ZS.2-.YS.......2,.c[..D.......0'..:..0.&..]Z..8..>..D.TM.................C................._..^.....u..w........~........k.4......X..d.......=1.....a.c[.PH.h_.....b..........PH........A..9....h`..J..1.......g`..W........2........z.#...p..m....jd........*.............[Q...........6..G..............6..t............. ..TL.....!....$....."..;0.....h.7-..............Z.............%..:.....H@....^W.QJ..'. !..........70.._. %.'...T.0'..Q.G?.ws....-$........h.}w.....>...........L.....#.......:0.............\S.............*".....Q..............<..T.!...p.$...}........N..........d_...........j.......VN.....o.....e........[......................................................................................................................!.......,............u...,..>6.T.T..&T.".H. ....3^.PQ.G..:^..H.-.T....2#!........K..iP.&..03%X..x.P/^.$...`...G>Xd....!..d.T...j.,..fQ..8l<..U%..G|.h.......$p..f......R..b.....*R@W"2y..8..V3.LV`t.e..7.>.........\D..O.H.....$...^.]..).. ...9..E...d\...V.U1..i......B]......c.P<0.i...v.]D..G .?p-.CD.Fi;>..v....r`..&........./.dp....`.....;HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=311040000..Content-Length: 1119..Content-Type: image/gif..Date: Fri, 14 Aug 2015 21:33:05 GMT..Etag: "762990053"..Expires: Sun, 22 Jun 2025 21:33:05 GMT..Last-Modified: Tue, 13 Apr 2010 09:38:40 GMT..Server: BWS/1.0..GIF89a........s..E.....M...................ZS.2-.YS.......2,.c[..D.......0'..:..0.&..]Z..8..>..D.TM.........

<<< skipped >>>

GET /h.js?4de4eadcf85ee6dc5ae83132e3429e3f HTTP/1.1

Accept: */*

Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: HMACCOUNT=AD4692A2C64DD9D0

HTTP/1.1 200 OK

Cache-Control: max-age=0, must-revalidate

Content-Encoding: gzip

Content-Length: 8132

Content-Type: application/javascript

Date: Fri, 14 Aug 2015 21:32:59 GMT

Etag: 8b48cdb64fbfffc707d2e5f18c17239e

Server: apache

...............(function(){var h={},mt={},c={id:"4de4eadcf85ee6dc5ae83132e3429e3f",dm:["luokexf.com"],js:"tongji.baidu.com/hm-web/js/",etrk:[],icon:'/hmt/icon/21|gif|20|20',ctrk:false,align:-1,nv:-1,vdur:1800000,age:31536000000,rec:0,rp:[],trust:0,vcard:0,qiao:0,lxb:0,conv:0,comm:0,apps:''};.;kw..... h4 ..LI.....]....$.I..]Y..IHb..LR.]I.}g..%)...9......=.f.Sc..v.../....a..rk..6....;.(..a^..k....X..r3..`..$...H.&"..Z.%.,./c...w.y.~5.3_....^S...x...Q.Ut..U..&w..o{...,....Ec.!.b..........T.....|.^wi......T..i.....$}!...iN..`2.UdA...oV&rg...<Hb.3...Z..\[X.Z-.ubqg...`.N..D.t..n.6L....o..g. .M.......$.A< ..Z._t...8e..)N._9..5.b......`.....7.?.i.OLZl...i.... ........HW...)...b..~n.......8..O.......%....3..F...OG.[..V.......b...........>...^....j.....p.?.s.>.....t9.%..o._.V..@O....sa.`lr ...<...S...................69...t..gn#*(...e.q.P..|j.....m....I7.r...U.>..C..}rx...I..$..........]i.J......Xo...b ....p.&..q.....o.(\,...~.rZ*.d).3M.....I.c_.}..6a)..\..............D.P..8@.....>..,0.".(.1I..I.N..`........p...y!.....o...a"...K.H#...}49@.0mVv..0.0....\....Z..Ha...S5,jK...6..[..q.R...qn.X.t...(.Zn....S..;.d./Ua..}../.).l6., w..,.Am.d..v.)..f....v..K@...qP..\..>.!|....J#.... <...}!.|.6- ...lw..W..O..@...?..~FK...Bh....U.{..i..md."..4.=.@j..g ..<.?|.(...!.....vO..{.QG...l..............Y......r.....].../}...*/e..Zt....\.5..0.n.wA..k../...c.oC.-...8.x.-d..z.......sm.V....u.OF.s.....f...l....fJ....]_.#........f..w..F.>#......1."..8.A....U.......i1n... .r...@......].B..\.a..q.$.<......_I`....

<<< skipped >>>

GET /hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=823678787&si=4de4eadcf85ee6dc5ae83132e3429e3f&st=1&v=1.1.2&lv=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: HMACCOUNT=AD4692A2C64DD9D0

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Content-Length: 43

Content-Type: image/gif

Date: Fri, 14 Aug 2015 21:33:00 GMT

Pragma: no-cache

Server: apache

X-Content-Type-Options: nosniff

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Control: private, max-age=0, no-cache..Content-Length: 43..Content-Type: image/gif..Date: Fri, 14 Aug 2015 21:33:00 GMT..Pragma: no-cache..Server: apache..X-Content-Type-Options: nosniff..GIF89a.............!.......,...........L..;..

GET /9.gif?abc=1&rnd=574177603 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Fri, 14 Aug 2015 21:33:10 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=lkxVDq3LIhwCAcLyYOPsHJRL; expires=Mon, 11-Aug-25 21:33:10 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=e5eda8bb; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=6f4e345be57ddf80b14160e3_1439587990; expires=Mon, 11-Aug-25 21:33:10 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=lkxVDq3LIhwCAcLyYOPsHJRL

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache

GIF89a.............!.......,...........L..;..

GET /data/cs.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: VVV.xfluoke.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 1

Content-Type: text/plain

Last-Modified: Fri, 20 Jun 2014 18:23:20 GMT

Accept-Ranges: bytes

ETag: "6fa6a3b6b48ccf1:2970"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Fri, 14 Aug 2015 21:32:39 GMT

1....

GET /data/tjrj/bt.txt HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: hXXp://VVV.xfluoke.com/data/tjrj/bt.txt

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.xfluoke.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 42

Content-Type: text/plain

Last-Modified: Tue, 15 Apr 2014 22:41:15 GMT

Accept-Ranges: bytes

ETag: "c39032cffb58cf1:2970"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Fri, 14 Aug 2015 21:32:39 GMT

....2345..........2345......(............)....

GET /data/tjrj/uctc64.txt HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: hXXp://VVV.xfluoke.com/data/tjrj/uctc64.txt

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.xfluoke.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 1

Content-Type: text/plain

Last-Modified: Fri, 22 Aug 2014 20:04:39 GMT

Accept-Ranges: bytes

ETag: "a27cff4d44becf1:2970"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Fri, 14 Aug 2015 21:32:39 GMT

1....

GET /data/tjrj/wz64.txt HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: hXXp://VVV.xfluoke.com/data/tjrj/wz64.txt

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.xfluoke.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 69

Content-Type: text/plain

Last-Modified: Fri, 15 Aug 2014 02:41:57 GMT

Accept-Ranges: bytes

ETag: "83be827b32b8cf1:2970"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Fri, 14 Aug 2015 21:32:39 GMT

GET /data/tjrj/tghh.txt HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: hXXp://VVV.xfluoke.com/data/tjrj/tghh.txt

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.xfluoke.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 1

Content-Type: text/plain

Last-Modified: Wed, 20 Aug 2014 01:15:18 GMT

Accept-Ranges: bytes

ETag: "3fa1df3414bccf1:2970"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Fri, 14 Aug 2015 21:32:39 GMT

0....

GET /data/tj.html?V9.8 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.xfluoke.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 726

Content-Type: text/html

Last-Modified: Fri, 13 Jun 2014 21:45:01 GMT

Accept-Ranges: bytes

ETag: "86b972ba5087cf1:2970"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Fri, 14 Aug 2015 21:32:41 GMT

GET /data/zuidibanben.txt HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: hXXp://VVV.xfluoke.com/data/zuidibanben.txt

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.xfluoke.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 4

Content-Type: text/plain

Last-Modified: Sat, 25 Oct 2014 17:00:19 GMT

Accept-Ranges: bytes

ETag: "244c312875f0cf1:2970"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Fri, 14 Aug 2015 21:32:41 GMT

V2.9..

GET /core.php?web_id=5931522&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 760

Connection: keep-alive

Date: Fri, 14 Aug 2015 21:33:05 GMT

Last-Modified: Fri, 14 Aug 2015 21:33:05 GMT

Expires: Fri, 14 Aug 2015 21:48:05 GMT

Via: cache12.l2de1[324,200-0,M], cache61.l2de1[341,0], cache6.by1[395,200-0,M], cache3.by1[396,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:3:687567441

X-Swift-SaveTime: Fri, 14 Aug 2015 21:33:06 GMT

X-Swift-CacheTime: 899

!function(){var p,q,r,a=encodeURIComponent,b="5931522",c="",d="",e="online_v3.php",f="z3.cnzz.com",g="1",h="text",i="z",j="站长统计",k=window["_CNZZDbridge_" b]["bobject"],l="http:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k["callRequest"]([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k["createScriptIcon"](n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a href='" q "' target=_blank title='" j "'>" j "</a>",k["createIcon"]([p])))}();..

GET /data/banben.txt HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: hXXp://VVV.xfluoke.com/data/banben.txt

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.xfluoke.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 5

Content-Type: text/plain

Last-Modified: Fri, 14 Aug 2015 13:09:55 GMT

Accept-Ranges: bytes

ETag: "48f3b98392d6d01:2970"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Fri, 14 Aug 2015 21:32:41 GMT

V11.3..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_348:

.text

.rdata

@.data

.rsrc

t$(SSh

~%UVW

u.hpzg

u$SShe

ws2_32.dll

wininet.dll

shell32.dll

kernel32.dll

shlwapi.dll

ntdll.dll

OLEACC.DLL

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

MsgWaitForMultipleObjects

ShellExecuteA

DeleteUrlCacheEntry

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

EnumChildWindows

GetAsyncKeyState

{A068799B-7551-46b9-8CA8-EEF8357AFEA4}

00000000000

9527000000030004

hXXp://res.17roco.qq.com/res/

/scene.swf

hXXp://res.17roco.qq.com/res/scene/

hXXp://17roco.qq.com/cgi-bin/buy_items?id=

hXXp://web2.17roco.qq.com/fcgi-bin/login2

&skey=

&angel_key=

pskey=

z>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

http=

HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Content-Type: application/x-www-form-urlencoded

hXXp://

]]>

hXXp://17roco.qq.com/cgi-bin/lovely_ruila?cmd=1&uin=

9527000000120002

0000000000000033

9527000000120017

9527000000120406

9527000000120005

0000000000000034

9527000000120007

0000006600000000

9527000000032342

0000006700000000

9527000000032343

0000006800000000

0000006900000000

0000007000000000

0000007100000000

0000007200000000

0000007300000000

0000007400000000

0000007500000000

00000076000000020800

9527000000032340

00000031000000020800

9527000000032341

0000003200000000

9527000000032346

00000000000000020101

#hXXp://17roco.qq.com

hXXp://res.17roco.qq.com/swf/night.swf

hXXp://17roco.qq.com/cgi-bin/shadow?cmd=0&id=1

hXXp://17roco.qq.com/cgi-bin/shadow?cmd=2&id=

hXXp://17roco.qq.com/cgi-bin/shadow?cmd=3

hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=109&condition=1&type=1

0000003900000000

9527000000032191

9527000000032287

hXXp://17roco.qq.com/cgi-bin/vipweeklyaward?cmd=1

hXXp://17roco.qq.com/cgi-bin/vip_gift_of_month?cmd=0

hXXp://17roco.qq.com/cgi-bin/vip_gift_of_month?cmd=1

0000003000000000

hXXp://17roco.qq.com/cgi-bin/mining?cmd=2&type=

hXXp://17roco.qq.com/cgi-bin/hitmonster?cmd=0

hXXp://17roco.qq.com/cgi-bin/hitmonster?cmd=1

hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=

hXXp://17roco.qq.com/cgi-bin/career_work?cmd=1&type=

hXXp://17roco.qq.com/cgi-bin/weektaskwork?cmd=1&type=14

hXXp://17roco.qq.com/cgi-bin/experience_tree?cmd=2

hXXp://17roco.qq.com/cgi-bin/experience_tree?cmd=3

9527000000120404

hXXp://17roco.qq.com/cgi-bin/pet_training?cmd=2&type=

9527000000170004

00000034000000020801

00000034000000020800

9527000000170005

00000036000000020801

00000038000000020802

0000000000000000

9527000000120022

hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=133&condition=1&type=1

hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=134&condition=1&type=1

hXXp://17roco.qq.com/cgi-bin/samul_belt?cmd=2

hXXp://17roco.qq.com/cgi-bin/new_shoot_machine?cmd=1

hXXp://17roco.qq.com/cgi-bin/weektaskwork?cmd=3&type=86&step=0

hXXp://17roco.qq.com/cgi-bin/weektaskwork?cmd=3&type=86&step=1

hXXp://17roco.qq.com/cgi-bin/career_get?cmd=0

hXXp://17roco.qq.com/cgi-bin/career_get?cmd=1

hXXp://17roco.qq.com/cgi-bin/newhorizons?cmd=4

hXXp://17roco.qq.com/cgi-bin/newhorizons?cmd=2&ship=4

hXXp://17roco.qq.com/cgi-bin/newhorizons?cmd=3&ship=4&address=8

hXXp://17roco.qq.com/cgi-bin/roco_shortcut_fourth?cmd=1

hXXp://17roco.qq.com/cgi-bin/week_reward_3366?cmd=1&blue=1

hXXp://17roco.qq.com/cgi-bin/week_reward_3366?cmd=1&blue=0

hXXp://17roco.qq.com/cgi-bin/freedom_gift?cmd=1&src=0

hXXp://17roco.qq.com/cgi-bin/freedom_gift?cmd=1&src=1

0000002400000000

9527000000032231

hXXp://17roco.qq.com/cgi-bin/challenge_lewei?cmd=0

hXXp://17roco.qq.com/cgi-bin/daily_sales?cmd=1&item=50397209&num=2

00000000000000040000

9527000000030025

hXXp://17roco.qq.com/cgi-bin/lulumagiclampgame?cmd=0

hXXp://17roco.qq.com/cgi-bin/angel_stat?cmd=1&id=67

hXXp://17roco.qq.com/cgi-bin/lulumagiclampgame?cmd=1&score=1900

hXXp://17roco.qq.com/cgi-bin/normaldigtreasure?cmd=0

hXXp://17roco.qq.com/cgi-bin/normaldigtreasure?cmd=1&gamestr=

hXXp://17roco.qq.com/cgi-bin/digtreasuregeneral?cmd=0&type=1

hXXp://17roco.qq.com/cgi-bin/digtreasuregeneral?cmd=1&type=1&str=

hXXp://17roco.qq.com/cgi-bin/treasure_hunter?cmd=1

hXXp://17roco.qq.com/cgi-bin/treasure_hunter?cmd=3

hXXp://17roco.qq.com/cgi-bin/treasure_hunter?cmd=5&id=

hXXp://17roco.qq.com/

hXXp://17roco.qq.com/login.html

9527000000030005

hXXp://res.17roco.qq.com/res/item/

VVV.luokeby.com

hXXp://VVV.ucbug.com/

VVV.luokeby.com

hXXp://VVV.2345.com/?11054

data/tjrj/dz.txt

000000000000000907

02000000000001

00000000000000020201

000000000000000902

00000000000000010

9527000000030040

hXXp://17roco.qq.com/cgi-bin/hurdle_game_award?id=

@hXXp://17roco.qq.com/cgi-bin/god_of_cookery?cmd=2&win=0&score=5000&rabit=0

17170444

hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=0&type=1

hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=1&type=1&goodsid=16842756&goodsnum=

hXXp://17roco.qq.com/cgi-bin/buy_items?id=67305489&num=1&ran=0

hXXp://17roco.qq.com/cgi-bin/compound_game_award?gameId=4000&cmd=2&id=2

hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=1&type=2&goodsid=33751051&goodsnum=1

hXXp://17roco.qq.com/cgi-bin/run_cow?cmd=1&unkown=

hXXp://17roco.qq.com/cgi-bin/run_cow?cmd=2&game_time=15&unkown=

hXXp://17roco.qq.com/cgi-bin/run_cow?cmd=3&unkown=

9527000000030009

jy@luokexf.com

G|Z%d

user32.dll

GetKeyboardType,MessageBoxA,CharNextA

advapi32.dll

RegQueryValueExA,RegOpenKeyExA,RegCloseKey

hXXp://17roco.qq.com/cgi-bin/hero_treasure?cmd=0

hXXp://17roco.qq.com/cgi-bin/hero_treasure?cmd=2

jy@luokeby.com

00000000000000020

&time=&cmd=1&skey=

hXXp://17roco.qq.com/cgi-bin/go_super_man?skey=&angel_uin=

&time=&cmd=2&skey=

000000000000

9527000000030010

hXXp://17roco.qq.com/cgi-bin/run_baby?cmd=2&flag=3&unkown=

hXXp://17roco.qq.com/cgi-bin/run_baby?cmd=3&unkown=

0000002600000004

9527000000030015

hXXp://VVV.baidu.com/s?wd=flash

00000000000000050

9527000000030029

VVV.luokexf.com

hXXp://17roco.qq.com/cgi-bin/star_guide?cmd=2&step=

hXXp://17roco.qq.com/cgi-bin/buy_items?id=100728839&num=

9527000000120004

0000000000000001

9527000000120006

hXXp://17roco.qq.com/cgi-bin/digtreasure?cmd=1&gamestr=

hXXp://17roco.qq.com/cgi-bin/digtreasureinmine?cmd=1&gamestr=

hXXp://17roco.qq.com/cgi-bin/digtreasure?cmd=0

hXXp://17roco.qq.com/cgi-bin/digtreasureinmine?cmd=0

000000000000000901

(*.txt)|*.txt|

(*.*)|*.*

).txt

00000000000000090

0000000000000006010

0000000

0000000000000006020

hXXp://17roco.qq.com/cgi-bin/crazy_sale?cmd=1

hXXp://17roco.qq.com/cgi-bin/crazy_sale?cmd=3&npc=

hXXp://17roco.qq.com/cgi-bin/crazy_sale?cmd=4&npc=

0000000000000010

9527000000030018

hXXp://17roco.qq.com/cgi-bin/login

hXXp://17roco.qq.com/default.html

WS2_32.DLL

9527000100070001

9527000000030001

luokexf.com

GET /cgi-bin/reclaim_goods?cmd=1&

222.73.78.102

angel_key=

0000000000000044

9527000000070003

00000000000000

0000000000000002

9527000000030003

-.png

hXXp://res.17roco.qq.com/res/combat/icons/

00000069

00100001

9527000000030041

09000000000000010000

09000000000000001388

9527000000030011

8@030015

00000026000000

0000000000000017

0000000000000027

00030003

hXXp://17roco.qq.com/cgi-bin/discovery?cmd=1&page=

(1,3,1000)

jy@luokexf.com

hXXp://17roco.qq.com/cgi-bin/hurdle_game_award?id=2087&score=9000&type=2

hXXp://17roco.qq.com/cgi-bin/roco_legends?cmd=1&chapter=

hXXp://17roco.qq.com/cgi-bin/heaven_treasure?cmd=1&unkown=

) 9.VIP

?cmd=0&index=

hXXp://17roco.qq.com/cgi-bin/spirit_evo_

?cmd=1&index=

?cmd=2&index=

:VVV.luokexf.com

k%UPp

fg.VG

%C',@

>Ã™d

FpUdP

:t6.dB

s.ftlZ

Y.dlh

oLQP.xL

0244>" `

%U{&X

ComboLBox%SHE_

otkeyScrol;r[MDIClil

#3276870

l5k%x-l h

9p%s m)t4`#

&y1`Ã

f`c%US.

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

9527000000032282

0000003700000003

9527000000032283

0000002100000002

0000002200000000

0000002300000000

9527000000032281

hXXp://VVV.xfluoke.com/

data/cs.txt

hXXp://VVV.17luoke.com/

hXXp://VVV.luokexf.com/

data/tjrj/bt.txt

data/tjrj/uctc64.txt

data/tjrj/wz64.txt

data/tjrj/tghh.txt

data/tj.html?V

data/banben.txt

data/zuidibanben.txt

VVV.luokexf.com

data/bossyc.txt

data/llzyc.txt

data/gonggao/gglx.txt

data/gonggao/tcgg.txt

data/gonggao/wbgg.txt

! VVV.luokexf.com

data/gonggao/wygg.html

data/tjrj/bytsn.txt

VVV.luokexf.com

data/gengxinneirong.txt

data/zidonggengxin.txt

data/bdwjm.txt

hXXp://VVV.luokeby.com/

data/rj/banben.txt

data/rj/gxnr.txt

data/rj/zdgx.txt

00000087000000020801

9527000000032263

9527000000032264

0000003300000000

9527000000032268

0000003400000000

00000087000000020802

0000005600000005

0000003800000000

00000039000000020803

00000000000000020400

9527000000030023

9527000000032288

hXXp://17roco.qq.com/cgi-bin/dungeon?cmd=0

hXXp://17roco.qq.com/cgi-bin/dungeon?cmd=1

0000008600000000

00000000000000090200

hXXp://17roco.qq.com/cgi-bin/angel_befall?cmd=1&index=

hXXp://17roco.qq.com/cgi-bin/buy_items?id=67371070&num=1&ran=

hXXp://17roco.qq.com/cgi-bin/assemble_robot?cmd=0

hXXp://17roco.qq.com/cgi-bin/assemble_robot?cmd=1

hXXp://17roco.qq.com/cgi-bin/buy_items?id=67371073&num=1&ran=

hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=0&game=2085

hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=1&game=2085

hXXp://17roco.qq.com/cgi-bin/buy_items?id=67371096&num=1&ran=

hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=0&game=2110

hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=1&game=2110

hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=1&game=2116

data/zdgxMD5.txt

hXXp://VVV.luokeby.com/data/rj/md5.txt

VVV.xfluoke.com

admin@luokexf.com

hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=1&type=

0000006200000002

hXXp://res.17roco.qq.com/res/game/2051/game.swf

hXXp://17roco.qq.com/cgi-bin/weekend_exp?cmd=1&unkown=

hXXp://17roco.qq.com/cgi-bin/weekend_exp?cmd=2&exp=40000&diamondnum=0&unkown=

/game.swf

hXXp://res.17roco.qq.com/res/game/

VVV.luokeby.com

data/tikubanben.txt

data/tikugengxinneirong.txt

data/tikugengxindizhi.txt

hXXp://17roco.qq.com/cgi-bin/buy_items?id=67305517&num=1&ran=0

hXXp://17roco.qq.com/cgi-bin/alchemy?cmd=1&id=3&id0=67305517&count0=1&id1=67239970&count1=1&id2=67239975&count2=1

hXXp://17roco.qq.com/cgi-bin/alchemy?cmd=1&id=3&id0=67305517&count0=1&id1=67239960&count1=1&id2=67239974&count2=1

hXXp://17roco.qq.com/cgi-bin/alchemy?cmd=1&id=3&id0=67305517&count0=1&id1=67239962&count1=1&id2=67239970&count2=1

9527000000030033

hXXp://17roco.qq.com/creat.html

hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=3&id=

hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=9&id=

hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=4&id=

hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=10&id=

hXXp://17roco.qq.com/cgi-bin/ivincibel_boxer?cmd=3&level=

hXXp://17roco.qq.com/cgi-bin/gongfu_rabbit?cmd=7&skillId=

hXXp://17roco.qq.com/cgi-bin/gongfu_rabbit?cmd=8&skillId=

00000033000000020821

00000027000000020820

00000026000000021025

00000029000000021025

00000026000000021022

00000030000000021022

00000029000000020819

00000042000000020817

00000031000000021019

00000039000000021019

00000029000000020816

00000025000000020815

00000023000000021015

00000033000000020814

00000022000000021014

00000032000000021014

00000026000000020813

00000035000000020812

00000045000000020811

00000020000000020810

00000024000000021009

00000054000000021008

00000053000000021007

00000053000000021006

00000062000000021006

00000034000000021002

00000047000000021000

00000023000000020807

(642,538)

(565,442)

(454,66)

0000013300000000

9527000000032409

0000013400000000

0000013500000000

9527000000032408

0000013600000000

hXXp://17roco.qq.com/cgi-bin/roco_diamond_5_1?cmd=0&unkown=

hXXp://17roco.qq.com/cgi-bin/roco_diamond_5_1?cmd=1&unkown=

hXXp://17roco.qq.com/cgi-bin/roco_diamond_5_1?cmd=2&which_one=

00000035000000020049

hXXp://17roco.qq.com/cgi-bin/hurdle_game_award?id=2001&score=4000&type=2

hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=55&condition=1&type=1

hXXp://bangbang.qq.com/php/login?game=

luokexf.com(

anonymous@123.com

.exe|.rar|.zip|.gif|.jpg|.mp3|.rm

V9.8 VVV.luokexf.com

jy@xfluoke.com

Adobe Photoshop CS Windows

2014:05:31 01:19:52

urlTEXT

MsgeTEXT

4hXXp://ns.adobe.com/xap/1.0/

xmlns:exif='hXXp://ns.adobe.com/exif/1.0/'>

xmlns:pdf='hXXp://ns.adobe.com/pdf/1.3/'>

xmlns:photoshop='hXXp://ns.adobe.com/photoshop/1.0/'>

xmlns:tiff='hXXp://ns.adobe.com/tiff/1.0/'>

xmlns:xap='hXXp://ns.adobe.com/xap/1.0/'>

Adobe Photoshop CS Windows

xmlns:stRef='hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#'

xmlns:xapMM='hXXp://ns.adobe.com/xap/1.0/mm/'>

uuid:62daa5ef-e81e-11e3-9f80-e32458687af0

adobe:docid:photoshop:62daa5ee-e81e-11e3-9f80-e32458687af0

adobe:docid:photoshop:62daa5f2-e81e-11e3-9f80-e32458687af0

xmlns:dc='hXXp://purl.org/dc/elements/1.1/'>

IEC hXXp://VVV.iec.ch

.IEC 61966-2.1 Default RGB colour space - sRGB

CRT curv

s%5xH_

g.mk^Y2.

.rlE2

s.TkY

7.cS[

lT.uj

a6.jB

)_.Ps

A.sW8

ui%c(M

}GH.lnZ

,(.ob

AQ.ASk

c3A.DL

I.of]

u.wwD

4v%Su

jy@xfluoke.com

23:00-6:00

:100794372

1(12000)

:17039362

00000000

hXXp://17roco.qq.com/login.htmls

Ã»ZQ&

hXXp://VVV.xfluoke.com/webhtm/zdsc.htm

hXXp://bangbang.qq.com/php/login?game=roco&H#

123 / 999

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

ole32.dll

__MSVCRT_HEAP_SELECT

RASAPI32.dll

GetProcessHeap

WinExec

KERNEL32.dll

GetKeyState

RegisterHotKey

UnregisterHotKey

ExitWindowsEx

GetViewportOrgEx

WINMM.dll

WINSPOOL.DRV

RegCloseKey

RegOpenKeyExA

RegCreateKeyA

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

oledlg.dll

WS2_32.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

GetCPInfo

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

RegCreateKeyExA

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

(*.htm;*.html)|*.htm;*.html

1.0.6

\shell32.dll

%d%d%d

rundll32.exe shell32.dll,

[%s:%d]

Range: bytes=%s-

[%s:%d]

PASS %s

PASS ******

USER %s

E:\dev\e\static_link\static_libs\source\downlib\mystrlib.cpp

SIZE %s

PORT

User-Agent: %s

Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)

Referer: %s

Host: %s

GET %s HTTP/1.1

HTTP/1.0

Cookie: %s

%d, %s

\\192.168.0.129\TCP\1037

NSPlayer/9.0.0.2980; {%s}; Host: %s

rmff_fix_header: assuming data.size=%i

rmff_fix_header: assuming data.num_packets=%i

rmff_fix_header: assuming prop.num_packets=%i

rmff_fix_header: setting prop.data_offset from %i to %i

rmff_fix_header: correcting prop.num_streams from %i to %i

rmff_fix_header: correcting prop.size from %i to %i

%s %s %s

Session: %s

Cseq: %u

%*s %s

%*s %u

CSeq: %u

rtsp://%s:%i

rtsp://%s:%i/%s

ClientID: Linux_2.4_6.0.9.1235_play32_RN01_EN_586

GUID: 00000000-0000-0000-0000-000000000000

[%s:%d]

User-Agent: RealMedia Player Version 6.0.9.1235 (linux-2.0-libc6-i386-gcc2.95)

Range: npt=%s-

%s/streamid=1

%s/streamid=0

Transport: x-pn-tng/tcp;mode=play,rtp/avp/tcp;unicast;mode=play

If-Match: %s

RealChallenge2: %s, sd=%s

Title: %s

Copyright: %s

Author: %s

real: Content-length for description too big (> %uMB)!

Require: com.real.retain-entity-for-setup

SupportsMaximumASMBandwidth: 1

Bandwidth: %u

Challenge1: %s

hash output: %x %x %x %x

hash input: %x %x %x %x

stream=%u;rule=%u,

Illegal character '%c' in input.

1.1.3

;3 #>6.&

'2, / 0&7!4-)1#

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

Corrupt JPEG data: found marker 0xx instead of RST%d

Warning: unknown JFIF revision number %d.d

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Inconsistent progression sequence for component %d coefficient %d

Unknown Adobe color transform code %d

Obtained XMS handle %u

Freed XMS handle %u

Unrecognized component IDs %d %d %d, assuming YCbCr

JFIF extension marker: RGB thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

Opened temporary file %s

Closed temporary file %s

Ss=%d, Se=%d, Ah=%d, Al=%d

Component %d: dc=%d ac=%d

Start Of Scan: %d components

Component %d: %dhx%dv q=%d

Start Of Frame 0xx: width=%u, height=%u, components=%d

Smoothing not supported with nonstandard sampling ratios

RST%d

At marker 0xx, recovery action %d

Selected %d colors for quantization

Quantizing to %d colors

Quantizing to %d = %d*%d*%d colors

%4u %4u %4u %4u %4u %4u %4u %4u

Unexpected marker 0xx

Miscellaneous marker 0xx, length %u

with %d x %d thumbnail image

JFIF extension marker: type 0xx, length %u

Warning: thumbnail image size does not match data length %u

JFIF APP0 marker: version %d.d, density %dx%d %d

= = = = = = = =

Obtained EMS handle %u

Freed EMS handle %u

Define Restart Interval %u

Define Quantization Table %d precision %d

Define Huffman Table 0xx

Define Arithmetic Table 0xx: 0xx

Unknown APP14 marker (not Adobe), length %u

Unknown APP0 marker (not JFIF), length %u

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Unsupported marker type 0xx

Failed to create temporary file %s

Unsupported JPEG process: SOF type 0xx

Cannot quantize to more than %d colors

Cannot quantize to fewer than %d colors

Cannot quantize more than %d color components

Insufficient memory (case %d)

Not a JPEG file: starts with 0xx 0xx

Quantization table 0xx was not defined

Huffman table 0xx was not defined

Backing store not supported

Arithmetic table 0xx was not defined

Cannot transcode due to multiple use of quantization table %d

Maximum supported image dimension is %u pixels

Empty JPEG image (DNL not supported)

Bogus DQT index %d

Bogus DHT index %d

Bogus DAC value 0x%x

Bogus DAC index %d

Unsupported color conversion request

Too many color components: %d, max %d

Buffer passed to JPEG library is too small

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

Improper call to JPEG library in state %d

Invalid scan script at entry %d

Invalid progressive parameters at scan script entry %d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Unsupported JPEG data precision %d

Invalid memory pool code %d

Wrong JPEG library version: library is %d, caller expects %d

Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c

DCT scaled block size %dx%d not supported

Invalid component ID %d in SOS

NULL row buffer for row %ld, pass %d

libpng error: %s

libpng warning: %s

Unknown zTXt compression type %d

gamma = (%d/100000)

gx=%f, gy=%f, bx=%f, by=%f

wx=%f, wy=%f, rx=%f, ry=%f

incorrect gamma=(%d/100000)

%s: Cannot open

%s: Write error at scanline %lu

%s: Seek error at scanline %lu

%u: Sample out of range, max %u

%s: Cannot modify tag "%s" while writing

%s: Unknown %stag %u

%f: Bad value for "%s"

%s: Invalid %stag "%s" (not supported by codec)

TIFFVSetField ... pass by value not imp.

%ld: Bad value for "%s"

%d: Bad value for "%s"

Nonstandard tile length %d, convert file

Nonstandard tile width %d, convert file

Bad value %ld for "%s" tag ignored

%s: Invalid InkNames value; expecting %d names, found %d

TIFFVGetField ... pass by value not imp.

Sorry, can not handle images with %d-bit samples

Sorry, can not handle LogLuv images with %s=%d

Sorry, LogLuv data must have %s=%d or %d

Sorry, can not handle image with %s=%d

Sorry, LogL data must have %s=%d

Sorry, can not handle separated image with %s=%d

Sorry, can not handle RGB image with %s=%d

Sorry, can not handle YCbCr images with %s=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d

Missing needed %s tag

Sorry, can not image with %d-bit samples

"%s": Bad mode

Not a TIFF file, bad version number %d (0x%x)

Not a TIFF file, bad magic number %d (0x%x)

%s: Out of memory (TIFF structure)

Sample %d out of range, max %u

Internal error, unknown tag 0x%x

Tag %d

%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu

%s: Read error at scanline %lu; got %lu bytes, expected %lu

%s: Seek error at scanline %lu, strip %lu

%s: Data buffer too small to hold strip %lu

%s: Read error on strip %lu; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu

%s: Seek error at row %ld, col %ld, tile %ld

%s: Data buffer too small to hold tile %ld

%s: No space for data buffer at scanline %ld

Compression scheme %u %s encoding is not implemented

%s %s encoding is not implemented

%s %s encoding is no longer implemented due to Unisys patent enforcement

Compression scheme %u %s decoding is not implemented

%s %s decoding is not implemented

Compression algorithm does not support random access

Bogus "%s" field, ignoring and calculating from imagelength

TIFF directory is missing required "%s" field, calculating from imagelength

wrong data type %d for "%s"; tag ignored

unknown field with tag %d (0x%x) encountered

No space %s

TIFF directory is missing required "%s" field

incorrect count for field "%s" (%lu, expecting %lu); tag ignored

Error fetching data for field "%s"

%s: Rational with zero denominator (num = %lu)

Cannot handle different per-sample values for field "%s"

cannot read TIFF_ANY type %d for field "%s"

"%s": Information lost writing value (%g) as (unsigned) RATIONAL

Error writing data for field "%s"

%s: Error writing SubIFD directory link

%s compression support is not configured

?%s: No space for LogLuv state block

Inappropriate photometric interpretation %d for SGILog compression; %s

LogL16Decode: Not enough data at row %d (short %d pixels)

LogLuvDecode24: Not enough data at row %d (short %d pixels)

LogLuvDecode32: Not enough data at row %d (short %d pixels)

%s: No space for SGILog translation buffer

No support for converting user data format to LogL

No support for converting user data format to LogLuv

SGILog compression supported only for %s, or raw data

Unknown data format %d for LogLuv compression

Unknown encoding %d for LogLuv compression

%s: No space for state block

%s: Bad code word at scanline %d (x %lu)

%s: %s at scanline %d (got %lu, expected %lu)

%s: Premature EOF at scanline %d (x %lu)

%s: No space for Group 3/4 reference line

%s: No space for Group 3/4 run arrays

%s: Uncompressed data (not supported) at scanline %d (x %lu)

Fax SubAddress: %s

(%u = 0x%x)

%suncompressed data

%sEOL padding

%s2-d encoding

Improper JPEG sampling factors %d,%d

Apparently should be %d,%d,decompressor will try reading with sampling %d,%d

Improper JPEG strip/tile size, expected %dx%d, got %dx%d

RowsPerStrip must be multiple of %d for JPEG

JPEG tile width must be multiple of %d

JPEG tile height must be multiple of %d

BitsPerSample %d not allowed for JPEG

PhotometricInterpretation %d not allowed for JPEG

ThunderDecode: %s data at scanline %ld (%lu != %lu)

PackBitsDecode: discarding %d bytes to avoid buffer overrun

LZWDecode: Not enough data at scanline %d (short %d bytes)

LZWDecode: Strip %d not terminated with EOI code

LZWDecode: Bogus encoding, loop in the code table; scanline %d

LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)

DumpModeDecode: Not enough data for scanline %d

Horizontal differencing "Predictor" not supported with %d-bit samples

"Predictor" value %d not supported

%u (0x%x)

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

zcÃ

xfluoke.com

|Z|hXXp://VVV.ucbug.com|W|

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

_^$###!$'

.Zfggfghfg_!!!$UX_]0

123456789

1, 0, 6, 6

(*.*)

9.8.0.1

:admin@luokexf.com

%original file name%.exe_348_rwx_010A0000_0003D000:

`.rsrc

L$(h%f

SSh0j

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ã

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

f`c%US.

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1, 0, 6, 6

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps