Gen:Variant.Zusy.123384 (B) (Emsisoft), Gen:Variant.Zusy.123384 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, GenericPhysicalDrive0.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 2e4f4894272d6140620fe8929bdc909f
SHA1: 78e6eecaf7e501f89750670bb41cd55131299fdc
SHA256: cbbf3115a335eb41df51f676e54ca44c488d21e33e66de0784675f0d45292074
SSDeep: 24576:ljKgI4op5LEBmbTpWW7uRIKhrbmhTZaqdiXSp0c02uFG6dAk3CM5uIG3z95:lTmbD03hOhTZaqdwk0c05HGi5uIe5
Size: 2080768 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: ??? ??????????
Created at: 2015-04-25 16:38:19
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-PSW. Trojan program intended for stealing users passwords.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:464
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:464 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo2[1].gif (390 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
C:\SkinH_EL.dll (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\waplogin[1].htm (2 bytes)
Registry activity
The process %original file name%.exe:464 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1429969099"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 BB 83 0D E0 26 65 91 25 56 F4 44 E9 B2 3D B6"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
147127382e001f495d1842ee7a9e7912 | c:\SkinH_EL.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo2[1].gif (390 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
C:\SkinH_EL.dll (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\waplogin[1].htm (2 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: ?????
Product Name: 58????????
Product Version: 6.1.0.0
Legal Copyright: ???????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 6.1.0.0
File Description: 58???????
Comments: QQ:1076080880
Language: Language Neutral
Company Name: ?????Product Name: 58????????Product Version: 6.1.0.0Legal Copyright: ???????Legal Trademarks: Original Filename: Internal Name: File Version: 6.1.0.0File Description: 58???????Comments: QQ:1076080880Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 879318 | 880640 | 4.46773 | d0581a2460b6b2a788b5498b64c0c587 |
.rdata | 884736 | 1000370 | 1003520 | 5.33148 | 528ec81e81892499d244dd5596736cca |
.data | 1888256 | 375466 | 98304 | 3.77968 | bcca99e2d83cbc4d72ae2250df548f50 |
.rsrc | 2265088 | 93888 | 94208 | 2.4393 | 043538e2426f1b2e5888f1699059fdf6 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://passport.58.com/pso/waplogin | 211.151.163.197 |
hxxp://yunpan.cn/cAGw8vFbtpPbZ | 58.68.151.135 |
hxxp://l-bjcc.yunpan.cn/lk/cAGw8vFbtpPbZ | |
hxxp://wuba.xdwscache.glb0.lxdns.com/wap/logo2.gif | |
hxxp://3843a4.l12.yunpan.cn/lk/cAGw8vFbtpPbZ | 111.206.65.252 |
img.58cdn.com.cn | 203.130.61.92 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /pso/waplogin HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: passport.58.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Tue, 23 Jun 2015 13:53:30 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
Content-Encoding: gzip
Vary: Accept-Encoding
4e2.............V[o.D.~...a..<....I.^.IW ..."@...=.5.=...nX.@.(mZRDAT..J4......M..g.......v.t7.@.|.9.w.s...6..\..K.P[.......o.!...Aa....<.........P3.^h..{.!..;....~..n..v.*.Z....I.M....8.TMa....Tc.=.......T*%.D.Q....................V.$YK.]&(.....c/........\..FF.U......*.h. d....R.......P,9..@...0.u..K}d.......V.{......,...6uN#.m..v...Q.. !.l....cJ....(k3.S...-. .*>5M.k......O....l..>.y`...q.U.-..}...s.2....\!..U......P...`...|..........,.T..Cy. .....K!wl... .....N..V.;...T.U...O...........Q........8. ..\...9...Zc1..J..i4....Gb^..........'xa. ..PH... 5...c........8..F.|...t.y.../g.'.1I.U.Ij..0K.ez..A^..fO._...(.D.........,O.1T........3...>.x....1...?.4..f...OV%....I5w.......Y...7....yIy'...#o.....A.......H..3. ....\%q......dU.'....0 ....?j...LQ5.Kp....Q....=..... .....-.......x^m..&.*......<M{..P;...tuu<......5M.......>...`..&.>J.h....ftgst......._........\.).=....OG..F......#"..!...d.D..%S...919.....F0:...a...'..Um.....h...@..BT.1.....E.t..........f.S.....n\..8..} E.{)..;..0.%.5..rp.0.P..g..%........_.H.C......].?.....pm..$g#..........ep.Z......7...>I._..T*3...>.A.obRf%...R.'.......w...j3..........a..T.SqV...S...._..X....mm.............../G../@.X8........g..T(z.@.c-W..O.;............<....v......;..W....o.;k..Z.'i..g.w.?........O...X.....0..
<<< skipped >>>
GET /lk/cAGw8vFbtpPbZ HTTP/1.1
Referer: hXXp://yunpan.cn/cAGw8vFbtpPbZ
Accept: */*
Accept-Language: zh-cn
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Connection: Keep-Alive
Host: 3843a4.l12.yunpan.cn
HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Tue, 23 Jun 2015 13:53:34 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-control: private
1c33..<!DOCTYPE html>.<html >.<head>.<meta charset="utf-8">.<meta http-equiv="Content-Type" content="text/html; charset=utf-8">.<meta name="renderer" content="webkit">.<link rel="icon" href="/favicon-16.ico" sizes="16x16">.<link rel="icon" href="/favicon-32.ico" sizes="32x32">.. <meta name="Keywords" content="...... ...fastcatzq,5250520zz,zhu@qaz@123,seemefly,cc520,may67702730,yw15821119785,yang752238...,............,............,...............,............,............,360......,360......">. <meta name="Description" content="...... ...fastcatzq,5250520zz,zhu@qaz@123,seemefly,cc520,may67702730,yw15821119785,yang752238.........................................................................................................360......................................................">...<title>.................. - 360......</title>.<script>var G_start_time = new Date;</script>.. <!--[if (lt IE 8.0)]><link type="text/css" rel="stylesheet" href="hXXp://s7.qhimg.com/static/1334fbb3cb4b3f9a/link/share-extract.css"><![endif]--><!--[if (!IE)|(gte IE 8.0)]><!--><link type="text/css" rel="stylesheet" href="hXXp://s6.qhimg.com/static/109aeacdfd137f48/link/share-extract_datauri.css"><!--<![endif]-->...<script type="text/javascript" src="hXXp://s6.qhimg.com/static/b33bb71cd5f0896e/components/1141.js" ></script>..<!--[if lt IE 9]>.<script type="text/javascript">(funct
<<< skipped >>>
GET /cAGw8vFbtpPbZ HTTP/1.1
Referer: hXXp://yunpan.cn/cAGw8vFbtpPbZ
Accept: */*
Accept-Language: zh-cn
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Host: yunpan.cn
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Server: nginx/1.6.2
Date: Tue, 23 Jun 2015 13:53:32 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Location: hXXp://3843a4.l12.yunpan.cn/lk/cAGw8vFbtpPbZ
0..HTTP/1.1 302 Moved Temporarily..Server: nginx/1.6.2..Date: Tue, 23 Jun 2015 13:53:32 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Location: hXXp://3843a4.l12.yunpan.cn/lk/cAGw8vFbtpPbZ..0..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_464:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
t.It It
t.It It
u$SShe
u$SShe
SkinH_EL.dll
SkinH_EL.dll
ole32.dll
ole32.dll
wininet.dll
wininet.dll
user32.dll
user32.dll
kernel32.dll
kernel32.dll
advapi32.dll
advapi32.dll
shlwapi.dll
shlwapi.dll
OLEACC.DLL
OLEACC.DLL
gdiplus.dll
gdiplus.dll
gdi32.dll
gdi32.dll
ExitWindowsEx
ExitWindowsEx
EnumWindows
EnumWindows
SetWindowsHookExA
SetWindowsHookExA
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
GdiplusShutdown
GdiplusShutdown
RegCreateKeyA
RegCreateKeyA
RegOpenKeyA
RegOpenKeyA
RegEnumKeyA
RegEnumKeyA
RegCloseKey
RegCloseKey
RegFlushKey
RegFlushKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyA
STR_UINTIP=1;STR_QLOGIN_VERSION_ERR=2;STR_NO_UIN=3;STR_NO_PWD=4;STR_NO_VCODE=5;STR_INV_UIN=6;STR_INV_VCODE=7;STR_UIN=8;STR_PWD=9;STR_VCODE=10;STR_VCODE_TIP=11;STR_CHANGE_VCODE=12;STR_REMEMBER_PWD=13;STR_1_DAY=14;STR_1_WEEK=15;STR_1_MONTH=16;STR_HALF_YEAR=17;STR_1_YEAR=18;STR_FORGET_PWD=19;STR_LOGIN=20;STR_RESET=21;STR_SWITCH_QLOGIN=22;STR_LOGIN_TITLE=23;STR_QLOGIN_INTRO=24;STR_QLOGINING=25;STR_QLOGIN_HELP=26;STR_SWITCH_NORMAL=27;STR_QLOGIN=28;STR_QLOGIN_BUSY=29;STR_QLOGIN_OFFLINE=30;STR_QLOGIN_OTHER_ERR=31;STR_BACK=32;STR_RETRY=33;function ptui_str(A){A-=1;if(A>=0&&A0.1){return }url="hXXp://isdspeed.qq.com/cgi-bin/r.cgi?flag1=6000&flag2=1&flag3=1";for(var A=0;A0){width=obj.offsetWidth}if(obj.offsetHeight>0){height=obj.offsetHeight}parent.ptlogin2_onResize(width,height)}}}catch(A){}}function ptui_notifyClose(){try{if(parent.ptlogin2_onClose){parent.ptlogin2_onClose()}else{if(top==this){window.close()}}}catch(A){window.close()}}function ptui_setUinColor(D,B,A){var C=document.getElementById(D);if(ptui_str(STR_UINTIP)==C.value){C.style.color=A}else{C.style.color=B}}function ptui_onEnableLLogin(B){var A=B.low_login_enable;var C=B.low_login_hour;if(A!=null&&C!=null){C.disabled=!A.checked}}function ptui_changeImgEx(D,C,F,E){var A=document.getElementById("imgVerify");if(A!=null){A.src=E "?aid=" C "&" Math.random();var B=document.getElementById("verifycode");if(B!=null&&B.disabled==false&&F){B.focus();B.select()}}}function ptui_changeImg(B,A,C){ptui_changeImgEx(B,A,C,"hXXp://ptlogin2." B "/getimage")}function ptui_changeImgHttps(B,A,C){ptui_changeImgEx(B,A,C,"./getimage")}function ptui_checkQQUin(qquin){if(qquin.length==0){return false}if(!(new RegExp(/^\w ((-\w )|(\.\w ))*\@[A-Za-z0-9] ((\.|-)[A-Za-z0-9] )*\.[A-Za-z0-9] $/).test(qquin))){if(qquin.length12||parseInt(qquin)=16){return false}return true}function ptui_onLogin(A){try{if(parent.ptlogin2_onLogin){if(!parent.ptlogin2_onLogin()){return false}}if(parent.ptlogin2_onLoginEx){var D=A.u.value;var B=A.verifycode.value;if(ptui_str(STR_UINTIP)==D){D=""}if(!parent.ptlogin2_onLoginEx(D,B)){return false}}}catch(C){}return ptui_checkValidate(A)}function ptui_onLoginEx(B,C){if(ptui_onLogin(B)){var A=new Date();A.setHours(A.getHours() 24*30);setCookie("ptui_loginuin",B.u.value,A,"/","ui.ptlogin2." C);return true}return false}function ptui_setDefUin(B,A){if(A==""||A==null){A=getCookie("ptui_loginuin")}if(A!=""&&A!=null){B.u.value=A}}function ptui_onReset(A){try{if(parent.ptlogin2_onReset){if(!parent.ptlogin2_onReset()){return false}}}catch(B){}return true}function ptui_initFocus(B){try{var A=B.u;var D=B.p;var E=B.verifycode;if(A.value==""||ptui_str(STR_UINTIP)==A.value){A.focus();return }if(D.value==""){D.focus();return }if(E.value==""){E.focus()}}catch(C){}}function ptui_checkValidate(B){var A=B.u;var C=B.p;var D=B.verifycode;if(A.value==""||ptui_str(STR_UINTIP)==A.value){alert(ptui_str(STR_NO_UIN));A.focus();return false}if(C.value==""){alert(ptui_str(STR_NO_PWD));C.focus();return false}if(D.value==""){alert(ptui_str(STR_NO_VCODE));D.focus();return false}if(!ptui_checkQQUin(A.value)){alert(ptui_str(STR_INV_UIN));A.focus();A.select();return false}if(D.value.length!=4){alert(ptui_str(STR_INV_VCODE));D.focus();D.select();return false}C.setAttribute("maxlength","32");preprocess(B);return true}function getCookieVal(B){var A=document.cookie.indexOf(";",B);if(A==-1){A=document.cookie.length}return unescape(document.cookie.substring(B,A))}function getCookie(D){var B=D "=";var F=B.length;var A=document.cookie.length;var E=0;while(E>5]|=128>>9)16){E=core_md5(E,C.length*chrsz)}var A=Array(16),D=Array(16);for(var B=0;B>16) (D>>16) (C>>16);return(B>>(32-B))}function str2binl(D){var C=Array();var A=(1>5]|=(D.charCodeAt(B/chrsz)&A)>5]>>>(B2))&A)}return D}function binl2hex(C){var B=hexcase?"0123456789ABCDEF":"0123456789abcdef";var D="";for(var A=0;A>2]>>((A%4)*8 4))&15) B.charAt((C[A>>2]>>((A%4)*8))&15)}return D}function binl2b64(D){var C="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /";var F="";for(var B=0;B>2]>>8*(B%4))&255)>2]>>8*((B 1)%4))&255)>2]>>8*((B 2)%4))&255);for(var A=0;AD.length*32){F =b64pad}else{F =C.charAt((E>>6*(3-A))&63)}}}return F};/* |xGv00|ccbfd68b5fceb62707a9e4ce87b8c813 */
STR_UINTIP=1;STR_QLOGIN_VERSION_ERR=2;STR_NO_UIN=3;STR_NO_PWD=4;STR_NO_VCODE=5;STR_INV_UIN=6;STR_INV_VCODE=7;STR_UIN=8;STR_PWD=9;STR_VCODE=10;STR_VCODE_TIP=11;STR_CHANGE_VCODE=12;STR_REMEMBER_PWD=13;STR_1_DAY=14;STR_1_WEEK=15;STR_1_MONTH=16;STR_HALF_YEAR=17;STR_1_YEAR=18;STR_FORGET_PWD=19;STR_LOGIN=20;STR_RESET=21;STR_SWITCH_QLOGIN=22;STR_LOGIN_TITLE=23;STR_QLOGIN_INTRO=24;STR_QLOGINING=25;STR_QLOGIN_HELP=26;STR_SWITCH_NORMAL=27;STR_QLOGIN=28;STR_QLOGIN_BUSY=29;STR_QLOGIN_OFFLINE=30;STR_QLOGIN_OTHER_ERR=31;STR_BACK=32;STR_RETRY=33;function ptui_str(A){A-=1;if(A>=0&&A0.1){return }url="hXXp://isdspeed.qq.com/cgi-bin/r.cgi?flag1=6000&flag2=1&flag3=1";for(var A=0;A0){width=obj.offsetWidth}if(obj.offsetHeight>0){height=obj.offsetHeight}parent.ptlogin2_onResize(width,height)}}}catch(A){}}function ptui_notifyClose(){try{if(parent.ptlogin2_onClose){parent.ptlogin2_onClose()}else{if(top==this){window.close()}}}catch(A){window.close()}}function ptui_setUinColor(D,B,A){var C=document.getElementById(D);if(ptui_str(STR_UINTIP)==C.value){C.style.color=A}else{C.style.color=B}}function ptui_onEnableLLogin(B){var A=B.low_login_enable;var C=B.low_login_hour;if(A!=null&&C!=null){C.disabled=!A.checked}}function ptui_changeImgEx(D,C,F,E){var A=document.getElementById("imgVerify");if(A!=null){A.src=E "?aid=" C "&" Math.random();var B=document.getElementById("verifycode");if(B!=null&&B.disabled==false&&F){B.focus();B.select()}}}function ptui_changeImg(B,A,C){ptui_changeImgEx(B,A,C,"hXXp://ptlogin2." B "/getimage")}function ptui_changeImgHttps(B,A,C){ptui_changeImgEx(B,A,C,"./getimage")}function ptui_checkQQUin(qquin){if(qquin.length==0){return false}if(!(new RegExp(/^\w ((-\w )|(\.\w ))*\@[A-Za-z0-9] ((\.|-)[A-Za-z0-9] )*\.[A-Za-z0-9] $/).test(qquin))){if(qquin.length12||parseInt(qquin)=16){return false}return true}function ptui_onLogin(A){try{if(parent.ptlogin2_onLogin){if(!parent.ptlogin2_onLogin()){return false}}if(parent.ptlogin2_onLoginEx){var D=A.u.value;var B=A.verifycode.value;if(ptui_str(STR_UINTIP)==D){D=""}if(!parent.ptlogin2_onLoginEx(D,B)){return false}}}catch(C){}return ptui_checkValidate(A)}function ptui_onLoginEx(B,C){if(ptui_onLogin(B)){var A=new Date();A.setHours(A.getHours() 24*30);setCookie("ptui_loginuin",B.u.value,A,"/","ui.ptlogin2." C);return true}return false}function ptui_setDefUin(B,A){if(A==""||A==null){A=getCookie("ptui_loginuin")}if(A!=""&&A!=null){B.u.value=A}}function ptui_onReset(A){try{if(parent.ptlogin2_onReset){if(!parent.ptlogin2_onReset()){return false}}}catch(B){}return true}function ptui_initFocus(B){try{var A=B.u;var D=B.p;var E=B.verifycode;if(A.value==""||ptui_str(STR_UINTIP)==A.value){A.focus();return }if(D.value==""){D.focus();return }if(E.value==""){E.focus()}}catch(C){}}function ptui_checkValidate(B){var A=B.u;var C=B.p;var D=B.verifycode;if(A.value==""||ptui_str(STR_UINTIP)==A.value){alert(ptui_str(STR_NO_UIN));A.focus();return false}if(C.value==""){alert(ptui_str(STR_NO_PWD));C.focus();return false}if(D.value==""){alert(ptui_str(STR_NO_VCODE));D.focus();return false}if(!ptui_checkQQUin(A.value)){alert(ptui_str(STR_INV_UIN));A.focus();A.select();return false}if(D.value.length!=4){alert(ptui_str(STR_INV_VCODE));D.focus();D.select();return false}C.setAttribute("maxlength","32");preprocess(B);return true}function getCookieVal(B){var A=document.cookie.indexOf(";",B);if(A==-1){A=document.cookie.length}return unescape(document.cookie.substring(B,A))}function getCookie(D){var B=D "=";var F=B.length;var A=document.cookie.length;var E=0;while(E>5]|=128>>9)16){E=core_md5(E,C.length*chrsz)}var A=Array(16),D=Array(16);for(var B=0;B>16) (D>>16) (C>>16);return(B>>(32-B))}function str2binl(D){var C=Array();var A=(1>5]|=(D.charCodeAt(B/chrsz)&A)>5]>>>(B2))&A)}return D}function binl2hex(C){var B=hexcase?"0123456789ABCDEF":"0123456789abcdef";var D="";for(var A=0;A>2]>>((A%4)*8 4))&15) B.charAt((C[A>>2]>>((A%4)*8))&15)}return D}function binl2b64(D){var C="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /";var F="";for(var B=0;B>2]>>8*(B%4))&255)>2]>>8*((B 1)%4))&255)>2]>>8*((B 2)%4))&255);for(var A=0;AD.length*32){F =b64pad}else{F =C.charAt((E>>6*(3-A))&63)}}}return F};/* |xGv00|ccbfd68b5fceb62707a9e4ce87b8c813 */
1076080880
1076080880
hXXp://yunpan.cn/cAGw8vFbtpPbZ
hXXp://yunpan.cn/cAGw8vFbtpPbZ
86265112
86265112
fJ.WM_
fJ.WM_
CX%xm
CX%xm
Õ6m*
Õ6m*
n.BjCw
n.BjCw
%s;7*
%s;7*
0%x@w
0%x@w
%C^L:
%C^L:
%s T5
%s T5
]E4%F(
]E4%F(
.Funr
.Funr
k%UPp
k%UPp
fg.VG
fg.VG
%C',@
%C',@
>Ùd
>Ùd
0'.Ll
0'.Ll
[I(3/#N0.bd
[I(3/#N0.bd
j"%u=w
j"%u=w
q%Xn`
q%Xn`
@|H.NI
@|H.NI
.wdd!
.wdd!
S|%u4
S|%u4
*.Ea]S
*.Ea]S
Q.CGo
Q.CGo
fTpe
fTpe
.LLbX
.LLbX
-.Mdl
-.Mdl
\-A}=3K
\-A}=3K
Y:.akpS
Y:.akpS
$.Zcqn
$.Zcqn
.WE= T!N
.WE= T!N
#?%s(C(
#?%s(C(
u.Jck~
u.Jck~
zx/%FN[
zx/%FN[
%s=\RI
%s=\RI
}j%c%Y)
}j%c%Y)
Rx.GR
Rx.GR
4o#.dM
4o#.dM
IeS`%C
IeS`%C
[n 4\.UY
[n 4\.UY
,4.qO,
,4.qO,
gQ'.Io
gQ'.Io
%cLur?
%cLur?
s%DHB
s%DHB
]I%%X
]I%%X
5r.US
5r.US
:mD].tB
:mD].tB
f%fUZ
f%fUZ
.fOuV12
.fOuV12
*_.dC
*_.dC
&-N}
&-N}
({?.cQm
({?.cQm
.Cqx~c
.Cqx~c
.`.Qw
.`.Qw
**.dU
**.dU
!n]%x
!n]%x
%X,Cr
%X,Cr
&.PFy{xh
&.PFy{xh
.um ZZE7L
.um ZZE7L
/^p%u$
/^p%u$
I.NoQY
I.NoQY
zu.ew
zu.ew
D/.nT
D/.nT
b\SkinH_EL.dll
b\SkinH_EL.dll
C$%cmb
C$%cmb
.ppM|
.ppM|
aZ.mO
aZ.mO
%-^
%-^
.hk;~
.hk;~
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
USER32.dll
USER32.dll
WinHttp.WinHttpRequest.5.1
WinHttp.WinHttpRequest.5.1
MSXML2.ServerXMLHTTP.6.0
MSXML2.ServerXMLHTTP.6.0
MSXML2.ServerXMLHTTP.5.0
MSXML2.ServerXMLHTTP.5.0
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
hXXp://
hXXp://
hXXps://
hXXps://
Adodb.Stream
Adodb.Stream
hXXp://open.baidu.com/special/time/
hXXp://open.baidu.com/special/time/
window.baidu_time(
window.baidu_time(
PRTG Enterprise Console.exe
PRTG Enterprise Console.exe
HttpAnalyzerStdV7.exe
HttpAnalyzerStdV7.exe
WSExplorer1.3.exe
WSExplorer1.3.exe
WinPcap_4_1_3.exe
WinPcap_4_1_3.exe
Wireshark.exe
Wireshark.exe
IceSword.exe
IceSword.exe
Ollydbg.exe
Ollydbg.exe
loaddll.exe
loaddll.exe
hXXp://m.m.58.com/infoall/?path=/infoall/
hXXp://m.m.58.com/infoall/?path=/infoall/
&password=
hXXps://passport.58.com/pso/domclientunionlogin
hXXps://passport.58.com/pso/domclientunionlogin
hXXp://my.58.com/xinxiguanli
hXXp://my.58.com/xinxiguanli
&LV=
&LV=
&UN=
&UN=
<=
<=
&SK=
&SK=
&PPT=
&PPT=
&PPK=
&PPK=
&PPU=UID=
&PPU=UID=
hXXp://m.webapp.58.com/refresh/step1?
hXXp://m.webapp.58.com/refresh/step1?
hXXp://m.webapp.58.com/refresh/step2?
hXXp://m.webapp.58.com/refresh/step2?
72709396
72709396
1005----
1005----
1016----
1016----
1029----
1029----
1039----
1039----
1057----
1057----
1067----
1067----
1078----
1078----
1086----
1086----
1096----
1096----
1734----
1734----
2015----
2015----
2032----
2032----
2036----
2036----
2038----
2038----
2039----
2039----
2040----
2040----
2041----
2041----
2042----
2042----
2043----
2043----
2044----
2044----
2045----
2045----
2046----
2046----
2047----
2047----
2049----
2049----
2050----
2050----
2051----
2051----
2052----
2052----
2053----
2053----
2054----
2054----
2055----
2055----
2192----
2192----
2247----
2247----
2236----
2236----
2258----
2258----
2284----
2284----
2292----
2292----
2296----
2296----
2299----
2299----
2302----
2302----
2303----
2303----
2307----
2307----
2315----
2315----
2319----
2319----
2323----
2323----
2325----
2325----
2328----
2328----
2329----
2329----
2335----
2335----
2336----
2336----
2340----
2340----
2342----
2342----
2344----
2344----
2346----
2346----
2347----
2347----
2350----
2350----
2354----
2354----
2360----
2360----
2363----
2363----
2364----
2364----
2361----
2361----
2362----
2362----
2368----
2368----
2380----
2380----
2381----
2381----
2389----
2389----
2390----
2390----
2392----
2392----
2393----
2393----
2394----
2394----
2395----
2395----
2397----
2397----
2398----
2398----
2404----
2404----
2408----
2408----
2421----
2421----
2422----
2422----
2429----
2429----
2501----
2501----
3157----
3157----
3163----
3163----
3177----
3177----
3184----
3184----
3198----
3198----
3209----
3209----
3222----
3222----
3236----
3236----
3251----
3251----
3266----
3266----
3279----
3279----
3306----
3306----
3328----
3328----
3350----
3350----
3359----
3359----
3434----
3434----
3445----
3445----
3453----
3453----
3470----
3470----
3479----
3479----
3369----
3369----
5632----
5632----
5633----
5633----
5653----
5653----
5669----
5669----
5695----
5695----
5709----
5709----
5722----
5722----
5733----
5733----
5756----
5756----
5772----
5772----
5845----
5845----
5853----
5853----
5898----
5898----
5918----
5918----
5928----
5928----
5942----
5942----
6700----
6700----
6718----
6718----
6729----
6729----
6745----
6745----
6752----
6752----
6760----
6760----
6770----
6770----
6776----
6776----
6788----
6788----
6793----
6793----
6803----
6803----
6921----
6921----
6964----
6964----
7112----
7112----
7133----
7133----
7154----
7154----
7289----
7289----
7303----
7303----
7428----
7428----
7452----
7452----
7453----
7453----
7458----
7458----
7624----
7624----
7923----
7923----
7969----
7969----
8408----
8408----
8467----
8467----
8470----
8470----
8531----
8531----
8556----
8556----
8572----
8572----
8658----
8658----
8672----
8672----
8684----
8684----
8694----
8694----
8738----
8738----
8832----
8832----
8951----
8951----
9026----
9026----
9039----
9039----
9101----
9101----
9124----
9124----
9179----
9179----
9303----
9303----
9311----
9311----
9329----
9329----
9342----
9342----
9336----
9336----
9364----
9364----
9384----
9384----
9394----
9394----
9407----
9407----
9417----
9417----
9422----
9422----
9429----
9429----
9441----
9441----
9452----
9452----
9455----
9455----
9464----
9464----
9465----
9465----
9475----
9475----
9366----
9366----
9510----
9510----
9527----
9527----
9533----
9533----
9539----
9539----
9545----
9545----
9556----
9556----
9563----
9563----
9564----
9564----
9578----
9578----
9587----
9587----
9597----
9597----
9616----
9616----
9625----
9625----
9630----
9630----
9635----
9635----
9636----
9636----
9655----
9655----
9676----
9676----
9686----
9686----
9695----
9695----
9702----
9702----
9704----
9704----
9715----
9715----
9723----
9723----
9751----
9751----
9760----
9760----
9765----
9765----
9799----
9799----
9808----
9808----
9814----
9814----
9829----
9829----
9836----
9836----
9846----
9846----
9851----
9851----
9858----
9858----
9869----
9869----
9875----
9875----
9886----
9886----
9894----
9894----
9896----
9896----
9905----
9905----
9921----
9921----
9934----
9934----
9940----
9940----
9936----
9936----
9949----
9949----
9959----
9959----
9967----
9967----
9983----
9983----
9998----
9998----
10012----
10012----
10035----
10035----
10063----
10063----
10078----
10078----
10083----
10083----
10093----
10093----
10102----
10102----
10111----
10111----
10116----
10116----
10138----
10138----
10157----
10157----
10167----
10167----
10177----
10177----
10193----
10193----
10214----
10214----
10224----
10224----
10254----
10254----
10260----
10260----
10279----
10279----
10285----
10285----
10307----
10307----
10320----
10320----
10336----
10336----
10356----
10356----
10381----
10381----
10419----
10419----
10430----
10430----
10441----
10441----
10443----
10443----
10449----
10449----
10456----
10456----
10462----
10462----
10470----
10470----
10500----
10500----
10506----
10506----
10510----
10510----
10514----
10514----
10530----
10530----
10541----
10541----
10549----
10549----
10553----
10553----
10567----
10567----
10736----
10736----
10868----
10868----
10884----
10884----
11053----
11053----
11176----
11176----
11201----
11201----
11238----
11238----
11254----
11254----
11271----
11271----
11313----
11313----
12221----
12221----
df365ed","apn":"WIFI","lat":""}&shoujishipai=
df365ed","apn":"WIFI","lat":""}&shoujishipai=
c-b128-4c25-b24f-bee0
c-b128-4c25-b24f-bee0
","X-Wap-Proxy-Cookie":"none","uuid":"89418d
","X-Wap-Proxy-Cookie":"none","uuid":"89418d
"channelid":"3","version":"5.7.3.0","productorid":"1","ua":"GT-N
"channelid":"3","version":"5.7.3.0","productorid":"1","ua":"GT-N
","PPU":"UID=
","PPU":"UID=
","cid":"
","cid":"
","maptype":"
","maptype":"
","platform":"android","os":"android","lon":"","locationstate":"0","location":",,","osv":"2.3.4","imei":"
","platform":"android","os":"android","lon":"","locationstate":"0","location":",,","osv":"2.3.4","imei":"
&category=%E4%BA%8C%E6%89%8B%E6%89%8B%E6%9C%BA&ObjectType=%E8%8B%B9%E6%9E%9C&xinghao=iPhone5s&shoujineicun=16GB&formatsource=mypublish&headerData={"uid":"
&category=%E4%BA%8C%E6%89%8B%E6%89%8B%E6%9C%BA&ObjectType=%E8%8B%B9%E6%9E%9C&xinghao=iPhone5s&shoujineicun=16GB&formatsource=mypublish&headerData={"uid":"
&IM=1076080880&gobquzhi=Content=
&IM=1076080880&gobquzhi=Content=
hXXp://p.webapp.58.com/
hXXp://p.webapp.58.com/
","13941
","13941
%Documents and Settings%\Administrator\Local Settings\Temporary Internet Files
%Documents and Settings%\Administrator\Local Settings\Temporary Internet Files
Referer: hXXp://pic2.58.com/ui7/post/PictureUpload_zip_s1.swf
Referer: hXXp://pic2.58.com/ui7/post/PictureUpload_zip_s1.swf
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; EmbeddedWB 14.52 from: hXXp://VVV.bsalsa.com/ EmbeddedWB 14.52; .NET CLR 2.0.50727)
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; EmbeddedWB 14.52 from: hXXp://VVV.bsalsa.com/ EmbeddedWB 14.52; .NET CLR 2.0.50727)
Host: pic.kuche.com
Host: pic.kuche.com
hXXp://pic.kuche.com/postpic/upload?flash=1/
hXXp://pic.kuche.com/postpic/upload?flash=1/
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\cookies
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\cookies
\*.txt
\*.txt
hXXp://passport.58.com/pso/waplogin
hXXp://passport.58.com/pso/waplogin
hXXp://m.m.58.com/infoall/?path=/infoall
hXXp://m.m.58.com/infoall/?path=/infoall
hXXps://passport.58.com/reg/
hXXps://passport.58.com/reg/
@163.com
@163.com
&cpassword=
&cpassword=
&mobile=&mobilecode=&password=
&mobile=&mobilecode=&password=
&nickName=
&nickName=
hXXps://passport.58.com/doregister
hXXps://passport.58.com/doregister
*.txt
*.txt
|*.txt
|*.txt
]]>
]]>
basicresume
basicresume
Referer: hXXp://qy.webapp.58.com/addenterprise?s5&t=1&topcate=job&id=9224¤tcate=job&localid=2&location=&geotype=baidu&geoia=undefined&formatsource=home&os=android
Referer: hXXp://qy.webapp.58.com/addenterprise?s5&t=1&topcate=job&id=9224¤tcate=job&localid=2&location=&geotype=baidu&geoia=undefined&formatsource=home&os=android
User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.4; zh-cn; GT-N7000 Build/GRJ22) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.4; zh-cn; GT-N7000 Build/GRJ22) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
hXXp://qy.webapp.58.com/ajax/addenterprise
hXXp://qy.webapp.58.com/ajax/addenterprise
hXXp://verifycode.58.com/img/get?num=
hXXp://verifycode.58.com/img/get?num=
]]>1
]]>1
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
function time(){return Math.random()}
function time(){return Math.random()}
hXXp://qy.m.58.com/m_company
hXXp://qy.m.58.com/m_company
58.com
58.com
.58.com/
.58.com/
hXXp://qy.58.com/(.*?)/
hXXp://qy.58.com/(.*?)/
hXXp://qy.58.com/
hXXp://qy.58.com/
VBScript.RegExp
VBScript.RegExp
javascript:document.onsdragstart=document.onselectstart=document.oncontextmenu=function(){return true}
javascript:document.onsdragstart=document.onselectstart=document.oncontextmenu=function(){return true}
javascript:document.onselectstart = document.oncontextmenu = document.onmousedown = document.onkeydown = function(){return true;};
javascript:document.onselectstart = document.oncontextmenu = document.onmousedown = document.onkeydown = function(){return true;};
window.location.reload()
window.location.reload()
var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');
var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');
text|password|file
text|password|file
comdlg32.dll
comdlg32.dll
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
WarnOnHTTPSToHTTPRedirect
WarnOnHTTPSToHTTPRedirect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
09408590
09408590
1076080880@qq.com
1076080880@qq.com
192.168.1.1
192.168.1.1
1076080880
1076080880
hXXp://mltv.taobao.com
hXXp://mltv.taobao.com
1.2.18
1.2.18
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WINMM.dll
WINMM.dll
WS2_32.dll
WS2_32.dll
VERSION.dll
VERSION.dll
AVIFIL32.dll
AVIFIL32.dll
RASAPI32.dll
RASAPI32.dll
GetProcessHeap
GetProcessHeap
WinExec
WinExec
GetCPInfo
GetCPInfo
KERNEL32.dll
KERNEL32.dll
GetKeyState
GetKeyState
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
GetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
WINSPOOL.DRV
WINSPOOL.DRV
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
OLEAUT32.dll
OLEAUT32.dll
oledlg.dll
oledlg.dll
WSOCK32.dll
WSOCK32.dll
DeleteUrlCacheEntry
DeleteUrlCacheEntry
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
WININET.dll
WININET.dll
.PAVCException@@
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
\\.\Scsi0:
\\.\Scsi0:
\\.\PhysicalDrive0
\\.\PhysicalDrive0
%s:%d
%s:%d
windows
windows
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
VVV.dywt.com.cn
VVV.dywt.com.cn
index.dat
index.dat
desktop.ini
desktop.ini
x86 Family %s Model %s Stepping %s
x86 Family %s Model %s Stepping %s
X-X-X-X
X-X-X-X
(*.avi)|*.avi
(*.avi)|*.avi
RICHED32.DLL
RICHED32.DLL
RICHED20.DLL
RICHED20.DLL
WPFT532.CNV
WPFT532.CNV
WPFT632.CNV
WPFT632.CNV
EXCEL32.CNV
EXCEL32.CNV
write32.wpc
write32.wpc
Windows Write
Windows Write
mswrd632.wpc
mswrd632.wpc
Word for Windows 6.0
Word for Windows 6.0
wword5.cnv
wword5.cnv
Word for Windows 5.0
Word for Windows 5.0
mswrd832.cnv
mswrd832.cnv
mswrd632.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
Word 6.0/95 for Windows & Macintosh
html32.cnv
html32.cnv
operator
operator
keywords
keywords
glViewport
glViewport
glTexEnvfv
glTexEnvfv
glTexEnvf
glTexEnvf
\glu32.dll
\glu32.dll
\Opengl32.dll
\Opengl32.dll
glPassThrough
glPassThrough
msscript.ocx
msscript.ocx
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
.PAVCOleException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
yunpan.cn
yunpan.cn
c:\%original file name%.exe
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
1, 0, 6, 6
1, 0, 6, 6
(*.*)
(*.*)
6.1.0.0
6.1.0.0
%original file name%.exe_464_rwx_10001000_00039000:
L$(h%f
L$(h%f
SSh0j
SSh0j
msctls_hotkey32
msctls_hotkey32
TVCLHotKey
TVCLHotKey
THotKey
THotKey
\skinh.she
\skinh.she
}uo,x6l5k%x-l h
}uo,x6l5k%x-l h
9p%s m)t4`#b
9p%s m)t4`#b
e"m?c&y1`Ã
e"m?c&y1`Ã
SetViewportOrgEx
SetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
EnumThreadWindows
EnumThreadWindows
EnumChildWindows
EnumChildWindows
`c%US.4/
`c%US.4/
!#$
!#$
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.UPX0
@.UPX0
`.UPX1
`.UPX1
`.reloc
`.reloc