Trojan.GenericKD.2093398 (B) (Emsisoft), Trojan.GenericKD.2093398 (AdAware), GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 23fe953e009865f4eccebe75c5bf4fc0
SHA1: 9b7a70159fe26a15156de2f509a7e44db5eda682
SHA256: 98343a9966f28eadc9059860961b4cd56dabeb27b139bd4fe903448e5e5b5ac2
SSDeep: 24576:joxQwx5eff sVFr5hJWjZTZaqdiXSp0c02uFG6dAk3CMv:jZwx fjFzoTZaqdwk0c05HGiv
Size: 1802240 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2014-10-29 05:29:33
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:1252
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1252 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\SkinH_EL.dll (88 bytes)
Registry activity
The process %original file name%.exe:1252 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 20 B6 52 25 07 D3 F4 87 A2 97 32 E6 19 47 82"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
147127382e001f495d1842ee7a9e7912 | c:\SkinH_EL.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\SkinH_EL.dll (88 bytes)
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: ?????
Product Name: 58?????????
Product Version: 2.0.0.0
Legal Copyright: ???????????,????!
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.0.0.0
File Description: 58?????????
Comments: 58?????????
Language: Chinese (Simplified, PRC)
Company Name: ?????Product Name: 58?????????Product Version: 2.0.0.0Legal Copyright: ???????????,????!Legal Trademarks: Original Filename: Internal Name: File Version: 2.0.0.0File Description: 58?????????Comments: 58?????????Language: Chinese (Simplified, PRC)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 666906 | 667648 | 4.53518 | 272c205ddebc4f2211d83a6ab13e4d55 |
.rdata | 671744 | 983410 | 987136 | 5.37139 | c6c9febe44232bbe38c106b3bd54b4cc |
.data | 1658880 | 295370 | 69632 | 3.58637 | d16d253b093980708e4cd10904f5672f |
.rsrc | 1957888 | 71252 | 73728 | 2.22229 | 00449e63df09639ed5165b5f404f4e63 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://aladdin.a.shifen.com/special/time/ | |
hxxp://open.baidu.com/special/time/ | 123.125.114.102 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /special/time/ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: open.baidu.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Feb 2015 00:19:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.9
Vary: User-Agent
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
2065..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."hXXp://VVV.w3.org/TR/html4/loose.dtd">..<html>.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=gbk">.. <title>........_........</title>...<style type="text/css">..p,dl,dd,div,h1,h2,table,td,th,ul,ol,li,img,form{margin:0;padding:0;}div,ul{zoom:1;}a:link{color:#261cdc;}img{border:none;}body{margin:6px 0 0 0;background-color:#fff;color:#000;font-family:arial;}#head{margin-left:0px;width:670px;height:54px;}#head{padding-left:20px;font-size:12px}.fm{clear:both;position:relative;z-index:297}.nv a,.nv b,.btn,#page,#more{font-size:14px}.s_nav{height:45px}.s_nav .s_logo{margin-right:20px;float:left}.s_nav .s_logo img{border:0;display:block}.s_nav .s_tab{line-height:18px;padding:20px 0 0;float:left}.s_nav a{color:#0000cc;font-size:14px}.s_nav b{font-size:14px}.s_ipt_wr{width:533px;height:30px;display:inline-block;margin-right:5px;background:url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png) no-repeat -304px 0;border:1px solid #b6b6b6;border-color:#7b7b7b #b6b6b6 #b6b6b6 #7b7b7b;vertical-align:top}.s_ipt{width:520px;height:22px;font:16px/22px arial;margin:5px 0 0 7px;padding:0;background:#fff;border:0;outline:none;-webkit-appearance:none}.s_btn{width:95px;height:32px;padding-top:2px\9;font-size:14px;padding:0;background:#ddd url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png);border:0;cursor:pointer}.s_btn_h{background-position:-100px 0}.s_btn_wr{width:97px;height:34px;displ
<<< skipped >>>
GET /special/time/ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: open.baidu.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Feb 2015 00:19:27 GMT
Server: Apache
X-Powered-By: PHP/5.2.9
Vary: User-Agent
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
2065..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."hXXp://VVV.w3.org/TR/html4/loose.dtd">..<html>.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=gbk">.. <title>........_........</title>...<style type="text/css">..p,dl,dd,div,h1,h2,table,td,th,ul,ol,li,img,form{margin:0;padding:0;}div,ul{zoom:1;}a:link{color:#261cdc;}img{border:none;}body{margin:6px 0 0 0;background-color:#fff;color:#000;font-family:arial;}#head{margin-left:0px;width:670px;height:54px;}#head{padding-left:20px;font-size:12px}.fm{clear:both;position:relative;z-index:297}.nv a,.nv b,.btn,#page,#more{font-size:14px}.s_nav{height:45px}.s_nav .s_logo{margin-right:20px;float:left}.s_nav .s_logo img{border:0;display:block}.s_nav .s_tab{line-height:18px;padding:20px 0 0;float:left}.s_nav a{color:#0000cc;font-size:14px}.s_nav b{font-size:14px}.s_ipt_wr{width:533px;height:30px;display:inline-block;margin-right:5px;background:url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png) no-repeat -304px 0;border:1px solid #b6b6b6;border-color:#7b7b7b #b6b6b6 #b6b6b6 #7b7b7b;vertical-align:top}.s_ipt{width:520px;height:22px;font:16px/22px arial;margin:5px 0 0 7px;padding:0;background:#fff;border:0;outline:none;-webkit-appearance:none}.s_btn{width:95px;height:32px;padding-top:2px\9;font-size:14px;padding:0;background:#ddd url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png);border:0;cursor:pointer}.s_btn_h{background-position:-100px 0}.s_btn_wr{width:97px;height:34px;displ
<<< skipped >>>
GET /special/time/ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: open.baidu.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Feb 2015 00:19:28 GMT
Server: Apache
X-Powered-By: PHP/5.2.9
Vary: User-Agent
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
2065..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."hXXp://VVV.w3.org/TR/html4/loose.dtd">..<html>.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=gbk">.. <title>........_........</title>...<style type="text/css">..p,dl,dd,div,h1,h2,table,td,th,ul,ol,li,img,form{margin:0;padding:0;}div,ul{zoom:1;}a:link{color:#261cdc;}img{border:none;}body{margin:6px 0 0 0;background-color:#fff;color:#000;font-family:arial;}#head{margin-left:0px;width:670px;height:54px;}#head{padding-left:20px;font-size:12px}.fm{clear:both;position:relative;z-index:297}.nv a,.nv b,.btn,#page,#more{font-size:14px}.s_nav{height:45px}.s_nav .s_logo{margin-right:20px;float:left}.s_nav .s_logo img{border:0;display:block}.s_nav .s_tab{line-height:18px;padding:20px 0 0;float:left}.s_nav a{color:#0000cc;font-size:14px}.s_nav b{font-size:14px}.s_ipt_wr{width:533px;height:30px;display:inline-block;margin-right:5px;background:url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png) no-repeat -304px 0;border:1px solid #b6b6b6;border-color:#7b7b7b #b6b6b6 #b6b6b6 #7b7b7b;vertical-align:top}.s_ipt{width:520px;height:22px;font:16px/22px arial;margin:5px 0 0 7px;padding:0;background:#fff;border:0;outline:none;-webkit-appearance:none}.s_btn{width:95px;height:32px;padding-top:2px\9;font-size:14px;padding:0;background:#ddd url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png);border:0;cursor:pointer}.s_btn_h{background-position:-100px 0}.s_btn_wr{width:97px;height:34px;displ
<<< skipped >>>
GET /special/time/ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: open.baidu.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Feb 2015 00:19:28 GMT
Server: Apache
X-Powered-By: PHP/5.2.9
Vary: User-Agent
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
2065..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."hXXp://VVV.w3.org/TR/html4/loose.dtd">..<html>.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=gbk">.. <title>........_........</title>...<style type="text/css">..p,dl,dd,div,h1,h2,table,td,th,ul,ol,li,img,form{margin:0;padding:0;}div,ul{zoom:1;}a:link{color:#261cdc;}img{border:none;}body{margin:6px 0 0 0;background-color:#fff;color:#000;font-family:arial;}#head{margin-left:0px;width:670px;height:54px;}#head{padding-left:20px;font-size:12px}.fm{clear:both;position:relative;z-index:297}.nv a,.nv b,.btn,#page,#more{font-size:14px}.s_nav{height:45px}.s_nav .s_logo{margin-right:20px;float:left}.s_nav .s_logo img{border:0;display:block}.s_nav .s_tab{line-height:18px;padding:20px 0 0;float:left}.s_nav a{color:#0000cc;font-size:14px}.s_nav b{font-size:14px}.s_ipt_wr{width:533px;height:30px;display:inline-block;margin-right:5px;background:url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png) no-repeat -304px 0;border:1px solid #b6b6b6;border-color:#7b7b7b #b6b6b6 #b6b6b6 #7b7b7b;vertical-align:top}.s_ipt{width:520px;height:22px;font:16px/22px arial;margin:5px 0 0 7px;padding:0;background:#fff;border:0;outline:none;-webkit-appearance:none}.s_btn{width:95px;height:32px;padding-top:2px\9;font-size:14px;padding:0;background:#ddd url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png);border:0;cursor:pointer}.s_btn_h{background-position:-100px 0}.s_btn_wr{width:97px;height:34px;displ
<<< skipped >>>
GET /special/time/ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: open.baidu.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Feb 2015 00:19:29 GMT
Server: Apache
X-Powered-By: PHP/5.2.9
Vary: User-Agent
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
2065..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."hXXp://VVV.w3.org/TR/html4/loose.dtd">..<html>.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=gbk">.. <title>........_........</title>...<style type="text/css">..p,dl,dd,div,h1,h2,table,td,th,ul,ol,li,img,form{margin:0;padding:0;}div,ul{zoom:1;}a:link{color:#261cdc;}img{border:none;}body{margin:6px 0 0 0;background-color:#fff;color:#000;font-family:arial;}#head{margin-left:0px;width:670px;height:54px;}#head{padding-left:20px;font-size:12px}.fm{clear:both;position:relative;z-index:297}.nv a,.nv b,.btn,#page,#more{font-size:14px}.s_nav{height:45px}.s_nav .s_logo{margin-right:20px;float:left}.s_nav .s_logo img{border:0;display:block}.s_nav .s_tab{line-height:18px;padding:20px 0 0;float:left}.s_nav a{color:#0000cc;font-size:14px}.s_nav b{font-size:14px}.s_ipt_wr{width:533px;height:30px;display:inline-block;margin-right:5px;background:url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png) no-repeat -304px 0;border:1px solid #b6b6b6;border-color:#7b7b7b #b6b6b6 #b6b6b6 #7b7b7b;vertical-align:top}.s_ipt{width:520px;height:22px;font:16px/22px arial;margin:5px 0 0 7px;padding:0;background:#fff;border:0;outline:none;-webkit-appearance:none}.s_btn{width:95px;height:32px;padding-top:2px\9;font-size:14px;padding:0;background:#ddd url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png);border:0;cursor:pointer}.s_btn_h{background-position:-100px 0}.s_btn_wr{width:97px;height:34px;displ
<<< skipped >>>
GET /special/time/ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: open.baidu.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Feb 2015 00:19:30 GMT
Server: Apache
X-Powered-By: PHP/5.2.9
Vary: User-Agent
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
2065..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."hXXp://VVV.w3.org/TR/html4/loose.dtd">..<html>.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=gbk">.. <title>........_........</title>...<style type="text/css">..p,dl,dd,div,h1,h2,table,td,th,ul,ol,li,img,form{margin:0;padding:0;}div,ul{zoom:1;}a:link{color:#261cdc;}img{border:none;}body{margin:6px 0 0 0;background-color:#fff;color:#000;font-family:arial;}#head{margin-left:0px;width:670px;height:54px;}#head{padding-left:20px;font-size:12px}.fm{clear:both;position:relative;z-index:297}.nv a,.nv b,.btn,#page,#more{font-size:14px}.s_nav{height:45px}.s_nav .s_logo{margin-right:20px;float:left}.s_nav .s_logo img{border:0;display:block}.s_nav .s_tab{line-height:18px;padding:20px 0 0;float:left}.s_nav a{color:#0000cc;font-size:14px}.s_nav b{font-size:14px}.s_ipt_wr{width:533px;height:30px;display:inline-block;margin-right:5px;background:url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png) no-repeat -304px 0;border:1px solid #b6b6b6;border-color:#7b7b7b #b6b6b6 #b6b6b6 #7b7b7b;vertical-align:top}.s_ipt{width:520px;height:22px;font:16px/22px arial;margin:5px 0 0 7px;padding:0;background:#fff;border:0;outline:none;-webkit-appearance:none}.s_btn{width:95px;height:32px;padding-top:2px\9;font-size:14px;padding:0;background:#ddd url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png);border:0;cursor:pointer}.s_btn_h{background-position:-100px 0}.s_btn_wr{width:97px;height:34px;displ
<<< skipped >>>
GET /special/time/ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: open.baidu.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Feb 2015 00:19:31 GMT
Server: Apache
X-Powered-By: PHP/5.2.9
Vary: User-Agent
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
2065..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."hXXp://VVV.w3.org/TR/html4/loose.dtd">..<html>.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=gbk">.. <title>........_........</title>...<style type="text/css">..p,dl,dd,div,h1,h2,table,td,th,ul,ol,li,img,form{margin:0;padding:0;}div,ul{zoom:1;}a:link{color:#261cdc;}img{border:none;}body{margin:6px 0 0 0;background-color:#fff;color:#000;font-family:arial;}#head{margin-left:0px;width:670px;height:54px;}#head{padding-left:20px;font-size:12px}.fm{clear:both;position:relative;z-index:297}.nv a,.nv b,.btn,#page,#more{font-size:14px}.s_nav{height:45px}.s_nav .s_logo{margin-right:20px;float:left}.s_nav .s_logo img{border:0;display:block}.s_nav .s_tab{line-height:18px;padding:20px 0 0;float:left}.s_nav a{color:#0000cc;font-size:14px}.s_nav b{font-size:14px}.s_ipt_wr{width:533px;height:30px;display:inline-block;margin-right:5px;background:url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png) no-repeat -304px 0;border:1px solid #b6b6b6;border-color:#7b7b7b #b6b6b6 #b6b6b6 #7b7b7b;vertical-align:top}.s_ipt{width:520px;height:22px;font:16px/22px arial;margin:5px 0 0 7px;padding:0;background:#fff;border:0;outline:none;-webkit-appearance:none}.s_btn{width:95px;height:32px;padding-top:2px\9;font-size:14px;padding:0;background:#ddd url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png);border:0;cursor:pointer}.s_btn_h{background-position:-100px 0}.s_btn_wr{width:97px;height:34px;displ
<<< skipped >>>
GET /special/time/ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: open.baidu.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Feb 2015 00:19:32 GMT
Server: Apache
X-Powered-By: PHP/5.2.9
Vary: User-Agent
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
2065..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."hXXp://VVV.w3.org/TR/html4/loose.dtd">..<html>.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=gbk">.. <title>........_........</title>...<style type="text/css">..p,dl,dd,div,h1,h2,table,td,th,ul,ol,li,img,form{margin:0;padding:0;}div,ul{zoom:1;}a:link{color:#261cdc;}img{border:none;}body{margin:6px 0 0 0;background-color:#fff;color:#000;font-family:arial;}#head{margin-left:0px;width:670px;height:54px;}#head{padding-left:20px;font-size:12px}.fm{clear:both;position:relative;z-index:297}.nv a,.nv b,.btn,#page,#more{font-size:14px}.s_nav{height:45px}.s_nav .s_logo{margin-right:20px;float:left}.s_nav .s_logo img{border:0;display:block}.s_nav .s_tab{line-height:18px;padding:20px 0 0;float:left}.s_nav a{color:#0000cc;font-size:14px}.s_nav b{font-size:14px}.s_ipt_wr{width:533px;height:30px;display:inline-block;margin-right:5px;background:url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png) no-repeat -304px 0;border:1px solid #b6b6b6;border-color:#7b7b7b #b6b6b6 #b6b6b6 #7b7b7b;vertical-align:top}.s_ipt{width:520px;height:22px;font:16px/22px arial;margin:5px 0 0 7px;padding:0;background:#fff;border:0;outline:none;-webkit-appearance:none}.s_btn{width:95px;height:32px;padding-top:2px\9;font-size:14px;padding:0;background:#ddd url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png);border:0;cursor:pointer}.s_btn_h{background-position:-100px 0}.s_btn_wr{width:97px;height:34px;displ
<<< skipped >>>
GET /special/time/ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: open.baidu.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Feb 2015 00:19:32 GMT
Server: Apache
X-Powered-By: PHP/5.2.9
Vary: User-Agent
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
2065..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."hXXp://VVV.w3.org/TR/html4/loose.dtd">..<html>.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=gbk">.. <title>........_........</title>...<style type="text/css">..p,dl,dd,div,h1,h2,table,td,th,ul,ol,li,img,form{margin:0;padding:0;}div,ul{zoom:1;}a:link{color:#261cdc;}img{border:none;}body{margin:6px 0 0 0;background-color:#fff;color:#000;font-family:arial;}#head{margin-left:0px;width:670px;height:54px;}#head{padding-left:20px;font-size:12px}.fm{clear:both;position:relative;z-index:297}.nv a,.nv b,.btn,#page,#more{font-size:14px}.s_nav{height:45px}.s_nav .s_logo{margin-right:20px;float:left}.s_nav .s_logo img{border:0;display:block}.s_nav .s_tab{line-height:18px;padding:20px 0 0;float:left}.s_nav a{color:#0000cc;font-size:14px}.s_nav b{font-size:14px}.s_ipt_wr{width:533px;height:30px;display:inline-block;margin-right:5px;background:url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png) no-repeat -304px 0;border:1px solid #b6b6b6;border-color:#7b7b7b #b6b6b6 #b6b6b6 #7b7b7b;vertical-align:top}.s_ipt{width:520px;height:22px;font:16px/22px arial;margin:5px 0 0 7px;padding:0;background:#fff;border:0;outline:none;-webkit-appearance:none}.s_btn{width:95px;height:32px;padding-top:2px\9;font-size:14px;padding:0;background:#ddd url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png);border:0;cursor:pointer}.s_btn_h{background-position:-100px 0}.s_btn_wr{width:97px;height:34px;displ
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1252:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
t.It It
t.It It
u$SShe
u$SShe
Kernel32.dll
Kernel32.dll
ole32.dll
ole32.dll
wininet.dll
wininet.dll
kernel32.dll
kernel32.dll
advapi32.dll
advapi32.dll
SkinH_EL.dll
SkinH_EL.dll
user32.dll
user32.dll
EnumWindows
EnumWindows
1005----
1005----
1016----
1016----
1029----
1029----
1039----
1039----
1057----
1057----
1067----
1067----
1078----
1078----
1086----
1086----
1096----
1096----
1734----
1734----
2015----
2015----
2032----
2032----
2036----
2036----
2038----
2038----
2039----
2039----
2040----
2040----
2041----
2041----
2042----
2042----
2043----
2043----
2044----
2044----
2045----
2045----
2046----
2046----
2047----
2047----
2049----
2049----
2050----
2050----
2051----
2051----
2052----
2052----
2053----
2053----
2054----
2054----
2055----
2055----
2192----
2192----
2247----
2247----
2236----
2236----
2258----
2258----
2284----
2284----
2292----
2292----
2296----
2296----
2299----
2299----
2302----
2302----
2303----
2303----
2307----
2307----
2315----
2315----
2319----
2319----
2323----
2323----
2325----
2325----
2328----
2328----
2329----
2329----
2335----
2335----
2336----
2336----
2340----
2340----
2342----
2342----
2344----
2344----
2346----
2346----
2347----
2347----
2350----
2350----
2354----
2354----
2360----
2360----
2363----
2363----
2364----
2364----
2361----
2361----
2362----
2362----
2368----
2368----
2380----
2380----
2381----
2381----
2389----
2389----
2390----
2390----
2392----
2392----
2393----
2393----
2394----
2394----
2395----
2395----
2397----
2397----
2398----
2398----
2404----
2404----
2408----
2408----
2421----
2421----
2422----
2422----
2429----
2429----
2501----
2501----
3157----
3157----
3163----
3163----
3177----
3177----
3184----
3184----
3198----
3198----
3209----
3209----
3222----
3222----
3236----
3236----
3251----
3251----
3266----
3266----
3279----
3279----
3306----
3306----
3328----
3328----
3350----
3350----
3359----
3359----
3434----
3434----
3445----
3445----
3453----
3453----
3470----
3470----
3479----
3479----
3369----
3369----
5632----
5632----
5633----
5633----
5653----
5653----
5669----
5669----
5695----
5695----
5709----
5709----
5722----
5722----
5733----
5733----
5756----
5756----
5772----
5772----
5845----
5845----
5853----
5853----
5898----
5898----
5918----
5918----
5928----
5928----
5942----
5942----
6700----
6700----
6718----
6718----
6729----
6729----
6745----
6745----
6752----
6752----
6760----
6760----
6770----
6770----
6776----
6776----
6788----
6788----
6793----
6793----
6803----
6803----
6921----
6921----
6964----
6964----
7112----
7112----
7133----
7133----
7154----
7154----
7289----
7289----
7303----
7303----
7428----
7428----
7452----
7452----
7453----
7453----
7458----
7458----
7624----
7624----
7923----
7923----
7969----
7969----
8408----
8408----
8467----
8467----
8470----
8470----
8531----
8531----
8556----
8556----
8572----
8572----
8658----
8658----
8672----
8672----
8684----
8684----
8694----
8694----
8738----
8738----
8832----
8832----
8951----
8951----
9026----
9026----
9039----
9039----
9101----
9101----
9124----
9124----
9179----
9179----
9303----
9303----
9311----
9311----
9329----
9329----
9342----
9342----
9336----
9336----
9364----
9364----
9384----
9384----
9394----
9394----
9407----
9407----
9417----
9417----
9422----
9422----
9429----
9429----
9441----
9441----
9452----
9452----
9455----
9455----
9464----
9464----
9465----
9465----
9475----
9475----
9366----
9366----
9510----
9510----
9527----
9527----
9533----
9533----
9539----
9539----
9545----
9545----
9556----
9556----
9563----
9563----
9564----
9564----
9578----
9578----
9587----
9587----
9597----
9597----
9616----
9616----
9625----
9625----
9630----
9630----
9635----
9635----
9636----
9636----
9655----
9655----
9676----
9676----
9686----
9686----
9695----
9695----
9702----
9702----
9704----
9704----
9715----
9715----
9723----
9723----
9751----
9751----
9760----
9760----
9765----
9765----
9799----
9799----
9808----
9808----
9814----
9814----
9829----
9829----
9836----
9836----
9846----
9846----
9851----
9851----
9858----
9858----
9869----
9869----
9875----
9875----
9886----
9886----
9894----
9894----
9896----
9896----
9905----
9905----
9921----
9921----
9934----
9934----
9940----
9940----
9936----
9936----
9949----
9949----
9959----
9959----
9967----
9967----
9983----
9983----
9998----
9998----
10012----
10012----
10035----
10035----
10063----
10063----
10078----
10078----
10083----
10083----
10093----
10093----
10102----
10102----
10111----
10111----
10116----
10116----
10138----
10138----
10157----
10157----
10167----
10167----
10177----
10177----
10193----
10193----
10214----
10214----
10224----
10224----
10254----
10254----
10260----
10260----
10279----
10279----
10285----
10285----
10307----
10307----
10320----
10320----
10336----
10336----
10356----
10356----
10381----
10381----
10419----
10419----
10430----
10430----
10441----
10441----
10443----
10443----
10449----
10449----
10456----
10456----
10462----
10462----
10470----
10470----
10500----
10500----
10506----
10506----
10510----
10510----
10514----
10514----
10530----
10530----
10541----
10541----
10549----
10549----
10553----
10553----
10567----
10567----
10736----
10736----
10868----
10868----
10884----
10884----
11053----
11053----
11176----
11176----
11201----
11201----
11238----
11238----
11254----
11254----
11271----
11271----
11313----
11313----
12221----
12221----
"~(.*?)"
"~(.*?)"
"~411611"
"~411611"
"~411772"
"~411772"
"~412214"
"~412214"
"~411714"
"~411714"
"~412111"
"~412111"
"~411966"
"~411966"
"~411734"
"~411734"
3000"~412144"
3000"~412144"
"~411865"
"~411865"
"~411912"
"~411912"
"~412157"
"~412157"
"~412065"
"~412065"
"~411958"
"~411958"
"~411674"
"~411674"
"~411825"
"~411825"
"~666971"
"~666971"
"~411644"
"~411644"
)"~411862"
)"~411862"
)"~411698"
)"~411698"
"~412299"
"~412299"
"~666972"
"~666972"
"~412308"
"~412308"
"~668366"
"~668366"
"~410387"
"~410387"
"~410426"
"~410426"
"~410511"
"~410511"
"~410404"
"~410404"
"~410391"
"~410391"
"~410541"
"~410541"
"~656336"
"~656336"
"~410498"
"~410498"
"~410492"
"~410492"
"~667637"
"~667637"
"~410508"
"~410508"
"~410388"
"~410388"
"~410569"
"~410569"
"~410547"
"~410547"
"~410572"
"~410572"
"~553799"
"~553799"
)"~516017"
)"~516017"
"~410767"
"~410767"
"~410917"
"~410917"
"~410869"
"~410869"
"~410768"
"~410768"
"~410794"
"~410794"
"~553816"
"~553816"
"~410783"
"~410783"
"~410836"
"~410836"
"~410965"
"~410965"
"~610793"
"~610793"
"~412596"
"~412596"
"~412597"
"~412597"
"~412751"
"~412751"
"~412660"
"~412660"
"~412714"
"~412714"
"~412862"
"~412862"
"~412814"
"~412814"
"~412709"
"~412709"
"~668160"
"~668160"
"~412698"
"~412698"
)"~518708"
)"~518708"
"~412706"
"~412706"
)"~412984"
)"~412984"
"~678315"
"~678315"
"~413028"
"~413028"
)"~412925"
)"~412925"
"~413021"
"~413021"
"~413044"
"~413044"
)"~413003"
)"~413003"
"~413082"
"~413082"
"~413085"
"~413085"
"~413075"
"~413075"
"~420671"
"~420671"
"~551161"
"~551161"
"~553956"
"~553956"
"~431490"
"~431490"
"~606804"
"~606804"
86"~617190"
86"~617190"
"~418433"
"~418433"
"~420623"
"~420623"
"~420622"
"~420622"
2000"~418457"
2000"~418457"
"~418509"
"~418509"
"~418453"
"~418453"
"~416805"
"~416805"
"~417038"
"~417038"
"~416906"
"~416906"
"~416806"
"~416806"
"~416966"
"~416966"
"~417017"
"~417017"
"~416863"
"~416863"
"~416990"
"~416990"
"~416900"
"~416900"
)"~416961"
)"~416961"
"~417012"
"~417012"
)"~521093"
)"~521093"
"~416898"
"~416898"
)"~416843"
)"~416843"
"~417091"
"~417091"
)"~417085"
)"~417085"
"~417103"
"~417103"
"~417124"
"~417124"
"~417193"
"~417193"
"~417166"
"~417166"
"~417188"
"~417188"
"~417213"
"~417213"
"~417195"
"~417195"
"~431503"
"~431503"
"~431504"
"~431504"
"~431505"
"~431505"
"~416256"
"~416256"
"~416420"
"~416420"
"~416214"
"~416214"
6"~520870"
6"~520870"
1"~416314"
1"~416314"
3"~416455"
3"~416455"
5"~525216"
5"~525216"
7"~668142"
7"~668142"
"~416303"
"~416303"
"~416450"
"~416450"
"~416458"
"~416458"
5"~668144"
5"~668144"
"~409261"5
"~409261"5
"~409331"3
"~409331"3
"~409435"7
"~409435"7
"~409387"3
"~409387"3
)"~409283"5
)"~409283"5
)"~409262"5
)"~409262"5
"~409421"3
"~409421"3
"~661134"7
"~661134"7
"~418514"
"~418514"
"~418518"
"~418518"
"~418557"
"~418557"
"~418650"
"~418650"
"~554442"
"~554442"
"~418710"
"~418710"
"~418640"
"~418640"
"~418718"
"~418718"
"~661133"
"~661133"
"~418515"
"~418515"
"~617358"
"~617358"
"~418574"
"~418574"
"~668367"
"~668367"
"~418691"
"~418691"
"~418587"
"~418587"
"~418624"
"~418624"
"~553390"
"~553390"
"~418729"
"~418729"
)"~553429"
)"~553429"
"~418752"
"~418752"
"~660771"
"~660771"
"~418767"
"~418767"
"~418780"
"~418780"
"~418785"
"~418785"
100"~409041"
100"~409041"
200"~408851"
200"~408851"
"~415955"
"~415955"
6"~416015"
6"~416015"
3"~416001"
3"~416001"
323"~420630"
323"~420630"
)"~668136"
)"~668136"
2"~415974"
2"~415974"
"~415962"
"~415962"
"~520428"
"~520428"
"~520440"
"~520440"
5"~416063"
5"~416063"
8"~416068"
8"~416068"
)"~416067"
)"~416067"
"~413201"
"~413201"
"~413207"
"~413207"
"~413202"
"~413202"
"~413232"
"~413232"
"~413212"
"~413212"
"~517186"
"~517186"
"~420656"
"~420656"
"~420675"
"~420675"
"~661244"
"~661244"
"~550919"
"~550919"
"~550918"
"~550918"
"~668089"
"~668089"
"~668088"
"~668088"
"~668061"
"~668061"
"~410727"
"~410727"
"~415266"
"~415266"
"~415360"
"~415360"
"~415291"
"~415291"
"~415341"
"~415341"
"~415437"
"~415437"
"~415483"
"~415483"
"~415411"
"~415411"
"~415267"
"~415267"
"~415418"
"~415418"
"~415388"
"~415388"
"~520029"
"~520029"
"~415381"
"~415381"
"~420624"
"~420624"
"~520099"
"~520099"
"~668127"
"~668127"
"~420636"
"~420636"
"~415517"
"~415517"
"~415532"
"~415532"
"~668126"
"~668126"
"~415555"
"~415555"
"~418789"
"~418789"
"~418905"
"~418905"
"~418951"
"~418951"
"~661235"
"~661235"
"~418844"
"~418844"
"~418947"
"~418947"
"~419005"
"~419005"
"~420609"
"~420609"
"~414662"
"~414662"
"~414736"
"~414736"
"~414663"
"~414663"
"~414775"
"~414775"
"~414717"
"~414717"
"~417850"
"~417850"
"~417667"
"~417667"
"~417629"
"~417629"
"~414787"
"~414787"
"~414790"
"~414790"
"~410156"
"~410156"
"~515971"
"~515971"
)"~517680"
)"~517680"
"~410173"
"~410173"
"~410131"
"~410131"
"~515968"
"~515968"
)"~410169"
)"~410169"
"~550984"
"~550984"
"~550983"
"~550983"
"~550982"
"~550982"
"~420648"
"~420648"
"~411049"
"~411049"
"~411069"
"~411069"
"~411032"
"~411032"
"~411090"
"~411090"
"~668086"
"~668086"
"~668084"
"~668084"
"~411103"
"~411103"
"~516736"
"~516736"
"~420659"
"~420659"
"~420660"
"~420660"
"~420649"
"~420649"
"~666969"
"~666969"
"~666968"
"~666968"
"~666967"
"~666967"
"~660320"
"~660320"
2"~666966"
2"~666966"
"~667694"
"~667694"
"~413316"
"~413316"
"~413341"
"~413341"
"~413429"
"~413429"
"~413317"
"~413317"
"~413402"
"~413402"
"~413380"
"~413380"
"~413361"
"~413361"
)"~668371"
)"~668371"
"~553981"
"~553981"
)"~668370"
)"~668370"
"~668087"
"~668087"
"~413446"
"~413446"
"~660155"
"~660155"
"~668372"
"~668372"
"~413465"
"~413465"
"~617180"
"~617180"
"~413458"
"~413458"
"~413467"
"~413467"
"~431491"
"~431491"
"~419174"
"~419174"
"~419223"
"~419223"
"~419244"
"~419244"
"~419293"
"~419293"
"~419212"
"~419212"
"~419175"
"~419175"
"~419324"
"~419324"
"~419276"
"~419276"
"~419358"
"~419358"
"~419286"
"~419286"
"~419279"
"~419279"
"~419204"
"~419204"
"~419274"
"~419274"
"~419359"
"~419359"
)"~553330"
)"~553330"
"~678311"
"~678311"
"~420613"
"~420613"
"~419370"
"~419370"
"~414548"
"~414548"
"~414549"
"~414549"
"~414563"
"~414563"
"~420668"
"~420668"
"~420669"
"~420669"
"~414559"
"~414559"
"~431481"
"~431481"
"~668112"
"~668112"
"~416526"
"~416526"
"~416616"
"~416616"
"~416651"
"~416651"
"~416572"
"~416572"
"~416674"
"~416674"
"~416555"
"~416555"
"~416602"
"~416602"
"~520942"
"~520942"
"~416577"
"~416577"
"~416527"
"~416527"
"~416532"
"~416532"
"~520586"
"~520586"
"~416676"
"~416676"
"~416697"
"~416697"
"~416719"
"~416719"
)"~416688"
)"~416688"
"~416728"
"~416728"
"~416717"
"~416717"
"~416782"
"~416782"
"~416793"
"~416793"
"~416796"
"~416796"
"~416757"
"~416757"
"~412398"
"~412398"
"~412399"
"~412399"
"~412404"
"~412404"
"~412410"
"~412410"
"~518240"
"~518240"
"~420610"
"~420610"
"~412413"
"~412413"
"~518246"
"~518246"
"~518243"
"~518243"
"~518251"
"~518251"
"~420664"
"~420664"
"~507656"
"~507656"
"~507615"
"~507615"
"~507612"
"~507612"
"~661241"
"~661241"
"~507613"
"~507613"
"~550934"
"~550934"
"~550933"
"~550933"
"~550935"
"~550935"
"~550937"
"~550937"
"~550936"
"~550936"
"~550938"
"~550938"
"~414297"
"~414297"
"~414332"
"~414332"
"~414343"
"~414343"
"~414307"
"~414307"
"~414354"
"~414354"
"~414365"
"~414365"
"~414411"
"~414411"
"~414382"
"~414382"
"~414474"
"~414474"
"~511496"
"~511496"
"~511495"
"~511495"
"~550928"
"~550928"
"~550926"
"~550926"
"~550932"
"~550932"
"~550927"
"~550927"
"~550929"
"~550929"
"~550931"
"~550931"
"~550925"
"~550925"
"~511494"
"~511494"
"~511493"
"~511493"
"~550930"
"~550930"
"~431482"
"~431482"
"~410181"307
"~410181"307
)"~518138"207
)"~518138"207
"~410201"207
"~410201"207
)"~410384"4008"~524444"
)"~410384"4008"~524444"
"~431512"
"~431512"
"~414203"
"~414203"
"~414264"
"~414264"
)"~414286"
)"~414286"
"~414215"
"~414215"
"~414196"
"~414196"
"~414244"
"~414244"
"~414242"
"~414242"
"~668085"
"~668085"
"~414190"
"~414190"
"~412455"
"~412455"
"~657227"
"~657227"
"~553905"
"~553905"
"~553922"
"~553922"
"~420665"
"~420665"
"~412516"
"~412516"
"~419006"
"~419006"
"~554352"
"~554352"
"~419010"
"~419010"
"~419039"
"~419039"
"~419052"
"~419052"
"~420640"
"~420640"
"~419019"
"~419019"
"~419072"
"~419072"
"~419163"
"~419163"
"~419104"
"~419104"
"~420670"
"~420670"
"~668163"
"~668163"
"~678316"
"~678316"
"~419444"
"~419444"
"~419452"
"~419452"
"~419502"
"~419502"
"~419481"
"~419481"
"~419551"
"~419551"
"~420651"
"~420651"
"~511473"
"~511473"
"~511474"
"~511474"
"~413750"
"~413750"
"~413773"
"~413773"
"~413811"
"~413811"
"~413771"
"~413771"
"~420662"
"~420662"
"~420663"
"~420663"
"~420661"
"~420661"
"~660321"
"~660321"
"~668101"
"~668101"
"~668100"
"~668100"
"~668099"
"~668099"
"~413097"
"~413097"
"~413154"
"~413154"
"~676193"
"~676193"
"~413133"
"~413133"
"~413101"
"~413101"
"~413145"
"~413145"
"~413098"
"~413098"
500"~413148"
500"~413148"
"~611835"
"~611835"
"~413152"
"~413152"
"~413177"
"~413177"
"~518666"
"~518666"
"~413937"
"~413937"
"~414007"
"~414007"
323"~413951"
323"~413951"
"~413956"
"~413956"
"~413991"
"~413991"
"~413938"
"~413938"
3"~413984"
3"~413984"
"~518828"
"~518828"
"~524901"
"~524901"
"~413975"
"~413975"
"~414057"
"~414057"
"~414067"
"~414067"
"~414065"
"~414065"
"~657135"
"~657135"
"~657136"
"~657136"
"~657133"
"~657133"
"~657134"
"~657134"
"~657137"
"~657137"
"~411135"
"~411135"
"~411157"
"~411157"
"~516682"
"~516682"
"~411173"
"~411173"
"~411194"
"~411194"
"~411226"
"~411226"
"~411296"
"~411296"
"~420611"
"~420611"
"~411394"
"~411394"
"~411389"
"~411389"
"~516535"
"~516535"
"~411230"
"~411230"
"~516614"
"~516614"
"~656313"
"~656313"
"~431485"
"~431485"
3"~431483"
3"~431483"
5"~431484"
5"~431484"
"~413566"
"~413566"
"~413573"
"~413573"
"~413635"
"~413635"
"~413627"
"~413627"
"~413609"
"~413609"
"~413657"
"~413657"
"~413575"
"~413575"
"~413633"
"~413633"
"~413583"
"~413583"
"~413618"
"~413618"
"~413621"
"~413621"
"~413567"
"~413567"
"~420650"
"~420650"
"~419842"
"~419842"
"~419852"
"~419852"
"~419862"
"~419862"
"~419925"
"~419925"
"~431480"
"~431480"
"~417330"
"~417330"
"~417342"
"~417342"
"~417331"
"~417331"
)"~417393"
)"~417393"
"~417386"
"~417386"
)"~417357"
)"~417357"
"~668152"
"~668152"
"~417398"
"~417398"
"~417414"
"~417414"
"~521260"
"~521260"
"~417405"
"~417405"
"~417483"
"~417483"
"~417589"
"~417589"
"~511475"
"~511475"
"~417549"
"~417549"
"~417563"
"~417563"
"~418029"
"~418029"
"~418049"
"~418049"
"~418040"
"~418040"
"~418120"
"~418120"
"~667639"
"~667639"
"~418103"
"~418103"
"~418030"
"~418030"
"~418045"
"~418045"
"~667640"
"~667640"
"~667641"
"~667641"
"~415738"
"~415738"
"~415798"
"~415798"
3"~415756"
3"~415756"
"~415766"
"~415766"
"~415744"
"~415744"
"~415739"
"~415739"
2"~415783"
2"~415783"
"~414867"
"~414867"
"~414872"
"~414872"
"~414877"
"~414877"
"~667690"
"~667690"
"~414890"
"~414890"
"~414879"
"~414879"
"~414893"
"~414893"
"~414898"
"~414898"
"~414900"
"~414900"
"~414902"
"~414902"
"~414909"
"~414909"
"~416072"
"~416072"
"~416073"
"~416073"
"~416112"
"~416112"
"~416085"
"~416085"
"~668140"
"~668140"
"~416087"
"~416087"
"~416114"
"~416114"
"~416121"
"~416121"
"~668141"
"~668141"
"~418138"
"~418138"
"~418238"
"~418238"
"~420325"
"~420325"
"~520597"
"~520597"
"~420326"
"~420326"
"~431502"
"~431502"
"~411463"
"~411463"
"~411464"
"~411464"
"~411602"
"~411602"
"~411572"
"~411572"
"~411505"
"~411505"
"~411473"
"~411473"
"~411605"
"~411605"
"~431488"
"~431488"
"~431487"
"~431487"
"~518186"
"~518186"
)"~661308"
)"~661308"
"~554270"
"~554270"
"~554287"
"~554287"
"~554281"
"~554281"
"~554271"
"~554271"
"~554310"
"~554310"
"~420332"
"~420332"
"~420657"
"~420657"
"~420658"
"~420658"
"~525382"
"~525382"
"~606854"
"~606854"
"~660214"
"~660214"
"~660213"
"~660213"
"~420314"
"~420314"
"~517388"
"~517388"
"~417604"
"~417604"
"~661239"
"~661239"
"~525140"
"~525140"
"~420306"
"~420306"
"~420309"
"~420309"
"~420307"
"~420307"
"~420311"
"~420311"
"~420122"
"~420122"
"~668159"
"~668159"
"~420137"
"~420137"
"~420127"
"~420127"
"~420141"
"~420141"
"~656797"
"~656797"
"~414832"
"~414832"
"~414842"
"~414842"
"~414835"
"~414835"
"~414833"
"~414833"
"~668117"
"~668117"
"~417835"
"~417835"
"~417873"
"~417873"
"~417893"
"~417893"
"~420355"
"~420355"
"~420365"
"~420365"
"~420356"
"~420356"
"~420340"
"~420340"
"~415361"
"~415361"
"~415579"
"~415579"
"~415580"
"~415580"
"~415685"
"~415685"
"~415704"
"~415704"
"~420069"
"~420069"
"~420070"
"~420070"
"~420090"
"~420090"
"~420100"
"~420100"
"~420110"
"~420110"
"~420082"
"~420082"
"~431516"
"~431516"
"~420029"
"~420029"
"~419611"
"~419611"
"~419622"
"~419622"
2008"~419636"
2008"~419636"
5008"~419626"
5008"~419626"
"~419656"
"~419656"
"~419668"
"~419668"
"~414823"
"~414823"
"~516101"
"~516101"
"~411124"
"~411124"
"~411115"
"~411115"
"~411112"
"~411112"
"~666970"
"~666970"
"~511479"
"~511479"
"~550923"
"~550923"
"~550924"
"~550924"
"~420048"
"~420048"
"~420066"
"~420066"
"~414998"
"~414998"
"~525070"
"~525070"
"~415010"
"~415010"
"~414999"
"~414999"
"~415015"
"~415015"
"~415012"
"~415012"
"~415006"
"~415006"
"~415024"
"~415024"
"~550996"
"~550996"
"~415223"
"~415223"
"~419994"
"~419994"
"~419995"
"~419995"
"~420020"
"~420020"
"~420018"
"~420018"
"~419797"
"~419797"
6"~419798"
6"~419798"
"~419817"
"~419817"
"~419804"
"~419804"
"~419809"
"~419809"
"~517136"
"~517136"
"~431492"
"~431492"
"~431493"
"~431493"
"~431494"
"~431494"
"~419983"
"~419983"
"~419988"
"~419988"
"~419986"
"~419986"
"~419984"
"~419984"
"~419991"
"~419991"
"~420343"
"~420343"
"~420344"
"~420344"
"~420144"
"~420144"
"~660156"
"~660156"
"~420158"
"~420158"
"~660048"
"~660048"
"~415903"3200GT"~415924"COUPE"~415929"GranCabrio"~415922"GranSport"~415926"GranTurismo"~415918"Spyder"~415915"
"~415903"3200GT"~415924"COUPE"~415929"GranCabrio"~415922"GranSport"~415926"GranTurismo"~415918"Spyder"~415915"
"~420241"
"~420241"
"~420242"
"~420242"
"~417741"
"~417741"
"~417742"
"~417742"
"~417773"
"~417773"
"~521444"
"~521444"
"~417798"
"~417798"
"~417786"
"~417786"
"~417755"
"~417755"
"~417759"
"~417759"
"~420587"
"~420587"
630"~420588"
630"~420588"
"~420384"
"~420384"
"~418243"
"~418243"
"~412445"
"~412445"
"~420170"
"~420170"
"~420171"
"~420171"
"~420182"
"~420182"
"~420180"
"~420180"
"~420604"
"~420604"
"~420593"
"~420593"
"~420594"
"~420594"
"~420321"
"~420321"
"~420322"
"~420322"
"~420277"
"~420277"
"~420267"
"~420267"
"~420270"
"~420270"
"~419822"
"~419822"
"~419833"
"~419833"
"~419823"
"~419823"
"~420590"
"~420590"
"~420317"
"~420317"
"~420318"
"~420318"
"~420115"
"~420115"
"~420119"
"~420119"
"~420116"
"~420116"
"~551122"
"~551122"
"~551123"
"~551123"
"~551168"
"~551168"
"~656796"
"~656796"
"~550861"
"~550861"
"~550862"
"~550862"
"~550865"
"~550865"
"~551020"501
"~551020"501
"~551025"
"~551025"
"~551024"
"~551024"
"~551022"
"~551022"
"~551023"
"~551023"
"~551155"
"~551155"
"~551156"
"~551156"
"~550907"
"~550907"
"~550912"
"~550912"
"~660215"
"~660215"
"~550911"
"~550911"
"~550910"
"~550910"
"~550909"
"~550909"
"~551043"
"~551043"
"~551044"
"~551044"
"~550917"
"~550917"
"~550914"
"~550914"
"~550913"
"~550913"
"~550915"
"~550915"
"~550916"
"~550916"
"~550893"
"~550893"
"~507619"
"~507619"
"~507617"
"~507617"
"~550897"
"~550897"
"~550896"
"~550896"
"~507618"
"~507618"
"~550894"
"~550894"
"~550892"
"~550892"
"~511777"
"~511777"
"~550895"
"~550895"
"~507620"
"~507620"
"~551099"
"~551099"
"~551100"
"~551100"
"~551162"
"~551162"
"~551163"
"~551163"
"~511810"
"~511810"
"~511812"
"~511812"
"~511814"
"~511814"
"~511813"
"~511813"
"~511811"
"~511811"
"~550999"
"~550999"
"~551000"
"~551000"
"~551118"
"~551118"
"~551119"
"~551119"
"~551124"
"~551124"
"~551125"
"~551125"
"~507599"
"~507599"
"~507601"
"~507601"
"~551052"
"~551052"
"~616566"
"~616566"
"~616584"
"~616584"
"~616567"
"~616567"
"~616578"
"~616578"
"~616571"
"~616571"
"~616570"
"~616570"
"~616577"
"~616577"
"~616574"
"~616574"
"~616580"
"~616580"
"~616568"
"~616568"
"~616576"
"~616576"
"~616581"
"~616581"
"~616579"
"~616579"
"~616569"
"~616569"
"~616583"
"~616583"
"~616572"
"~616572"
"~616582"
"~616582"
"~616575"
"~616575"
"~616573"
"~616573"
"~511695"
"~511695"
"~551011"
"~551011"
"~551015"
"~551015"
"~551014"
"~551014"
"~551013"
"~551013"
"~551012"
"~551012"
"~551048"
"~551048"
"~551050"
"~551050"
"~551049"
"~551049"
"~551026"
"~551026"
"~551028"
"~551028"
"~551027"
"~551027"
"~667827"
"~667827"
"~667985"
"~667985"
"~667986"
"~667986"
"~612001"
"~612001"
205"~612002"
205"~612002"
306"~612003"
306"~612003"
307"~661131"
307"~661131"
"~524413"
"~524413"
"~617886"
"~617886"
"~550972"1041
"~550972"1041
"~550975"
"~550975"
"~550974"
"~550974"
"~550973"
"~550973"
"~550976"
"~550976"
"~550944"
"~550944"
"~551128"
"~551128"
"~551129"
"~551129"
"~551169"
"~551169"
"~551170"
"~551170"
"~511490"
"~511490"
"~511492"
"~511492"
"~511491"
"~511491"
"~550939"
"~550939"
"~550942"
"~550942"
"~550941"
"~550941"
"~550940"
"~550940"
"~550964"
"~550964"
"~550965"
"~550965"
"~550966"
"~550966"
"~611992"
"~611992"
"~611994"
"~611994"
"~611996"
"~611996"
"~668368"
"~668368"
"~661302"
"~661302"
"~661304"
"~661304"
"~661305"
"~661305"
"~551059"
"~551059"
"~616460"
"~616460"
"~616465"
"~616465"
"~616467"
"~616467"
"~616473"
"~616473"
"~616471"
"~616471"
"~616462"
"~616462"
"~616466"
"~616466"
"~616468"
"~616468"
"~616461"
"~616461"
"~616472"
"~616472"
"~616470"
"~616470"
"~616464"
"~616464"
"~616474"
"~616474"
"~616463"
"~616463"
"~616475"
"~616475"
"~616469"
"~616469"
"~616346"
"~616346"
"~616347"
"~616347"
"~616362"
"~616362"
"~616365"
"~616365"
"~616355"
"~616355"
"~616353"
"~616353"
"~666965"
"~666965"
"~616354"
"~616354"
"~616357"
"~616357"
"~616350"
"~616350"
"~616364"
"~616364"
"~616360"
"~616360"
"~616356"
"~616356"
"~616361"
"~616361"
"~616352"
"~616352"
"~616348"
"~616348"
"~616358"
"~616358"
"~616349"
"~616349"
"~616363"
"~616363"
"~616351"
"~616351"
"~616359"
"~616359"
"~551147"
"~551147"
"~551148"
"~551148"
"~551166"
"~551166"
"~551167"
"~551167"
"~420386"
"~420386"
"~420387"
"~420387"
"~551066"
"~551066"
"~551061"
"~551061"
"~551065"
"~551065"
"~551064"
"~551064"
"~551063"
"~551063"
"~551062"
"~551062"
"~551054"
"~551054"
"~551055"
"~551055"
"~551120"
"~551120"
"~551121"
"~551121"
"~550902"
"~550902"
"~550906"
"~550906"
"~550903"
"~550903"
"~551159"
"~551159"
"~551160"
"~551160"
"~661303"
"~661303"
"~507602"
"~507602"
"~551068"
"~551068"
"~551067"
"~551067"
"~551069"
"~551069"
"~551086"
"~551086"
"~551087"
"~551087"
"~551088"
"~551088"
"~551090"
"~551090"
"~551091"
"~551091"
"~551089"
"~551089"
"~551153"
"~551153"
"~551154"
"~551154"
"~551157"
"~551157"
"~551158"
"~551158"
"~668276"
"~668276"
"~668277"
"~668277"
"~661179"
"~661179"
"~661181"
"~661181"
"~661180"
"~661180"
"~661182"
"~661182"
"~661183"
"~661183"
"~411455"
"~411455"
"~411456"
"~411456"
"~616491"
"~616491"
"~616496"
"~616496"
"~616501"
"~616501"
"~616500"
"~616500"
"~616495"
"~616495"
"~616497"
"~616497"
"~616494"
"~616494"
"~616492"
"~616492"
"~616493"
"~616493"
"~616498"
"~616498"
"~616499"
"~616499"
"~551164"
"~551164"
"~551165"
"~551165"
"~550970"700
"~550970"700
"~550968"
"~550968"
"~551171"
"~551171"
"~551172"
"~551172"
"~550951"
"~550951"
"~550953"
"~550953"
"~550954"
"~550954"
"~550952"
"~550952"
"~551033"
"~551033"
"~551034"
"~551034"
"~551035"
"~551035"
"~551036"
"~551036"
"~551037"
"~551037"
"~661199"
"~661199"
"~551103"
"~551103"
"~551104"
"~551104"
"~551126"
"~551126"
"~551127"
"~551127"
"~616067"
"~616067"
"~616068"
"~616068"
"~616072"
"~616072"
"~616079"
"~616079"
"~668441"
"~668441"
"~616082"
"~616082"
"~616070"
"~616070"
"~616085"
"~616085"
"~616069"
"~616069"
"~616080"
"~616080"
"~616071"
"~616071"
"~616081"
"~616081"
"~616084"
"~616084"
"~616075"
"~616075"
"~616073"
"~616073"
"~616076"
"~616076"
"~616074"
"~616074"
"~616077"
"~616077"
"~616086"
"~616086"
"~616083"
"~616083"
"~616437"
"~616437"
"~616444"
"~616444"
"~616442"
"~616442"
"~616439"
"~616439"
"~616447"
"~616447"
"~616441"
"~616441"
"~616443"
"~616443"
"~616446"
"~616446"
"~616438"
"~616438"
"~616448"
"~616448"
"~616440"
"~616440"
"~616445"
"~616445"
"~667829"
"~667829"
4-4"~667988"
4-4"~667988"
"~550994"
"~550994"
"~550959"
"~550959"
"~550957"
"~550957"
"~550962"
"~550962"
"~550958"
"~550958"
"~507655"
"~507655"
"~550961"
"~550961"
"~550956"
"~550956"
"~656794"
"~656794"
"~656795"
"~656795"
"~550948"
"~550948"
"~616512"
"~616512"
"~616514"
"~616514"
"~616513"
"~616513"
"~616518"
"~616518"
"~616526"
"~616526"
"~616517"
"~616517"
"~616520"
"~616520"
"~616527"
"~616527"
"~616525"
"~616525"
"~616515"
"~616515"
"~616522"
"~616522"
"~616524"
"~616524"
"~616519"
"~616519"
"~616516"
"~616516"
"~616521"
"~616521"
"~616523"
"~616523"
"~551113"
"~551113"
"~551115"
"~551115"
"~551114"
"~551114"
"~552141"
"~552141"
"~552142"
"~552142"
"~552143"
"~552143"
"~552144"
"~552144"
800"~552146"
800"~552146"
"~552145"
"~552145"
"~616543"
"~616543"
"~616544"
"~616544"
"~616552"
"~616552"
"~616548"
"~616548"
"~616551"
"~616551"
"~616553"
"~616553"
"~616549"
"~616549"
"~616554"
"~616554"
"~616546"
"~616546"
"~616545"
"~616545"
"~616547"
"~616547"
"~616550"
"~616550"
"~668044"
"~668044"
"~507608"
"~507608"
"~551073"
"~551073"
"~551071"
"~551071"
"~551072"
"~551072"
"~551070"
"~551070"
"~507609"
"~507609"
"~507610"
"~507610"
"~611798"
"~611798"
"~611800"
"~611800"
"~667830"
"~667830"
"~616390"
"~616390"
"~616395"
"~616395"
"~616393"
"~616393"
"~616391"
"~616391"
"~616389"
"~616389"
"~616400"
"~616400"
"~616388"
"~616388"
"~616392"
"~616392"
"~616394"
"~616394"
"~616385"
"~616385"
"~616399"
"~616399"
"~616398"
"~616398"
"~616396"
"~616396"
"~616387"
"~616387"
"~551108"900
"~551108"900
"~551106"9300
"~551106"9300
"~551110"9600
"~551110"9600
"~551109"9800
"~551109"9800
"~551107"
"~551107"
"~661192"
"~661192"
3"~661193"
3"~661193"
"~616215"
"~616215"
"~616220"
"~616220"
"~616233"
"~616233"
"~616217"
"~616217"
"~616228"
"~616228"
"~616224"
"~616224"
"~616231"
"~616231"
"~616230"
"~616230"
"~616240"
"~616240"
"~616238"
"~616238"
"~616236"
"~616236"
"~616216"
"~616216"
"~616241"
"~616241"
"~616222"
"~616222"
"~616237"
"~616237"
"~616242"
"~616242"
"~616235"
"~616235"
"~616227"
"~616227"
"~551039"
"~551039"
"~551041"
"~551041"
"~551042"
"~551042"
"~551040"
"~551040"
"~667828"
"~667828"
"~550977"
"~550977"
"~550978"
"~550978"
"~551001"
"~551001"
"~551007"
"~551007"
"~551006"
"~551006"
"~551003"
"~551003"
"~551004"
"~551004"
"~551002"
"~551002"
"~551005"
"~551005"
"~551101"
"~551101"
"~551102"
"~551102"
"~551029"
"~551029"
"~551030"
"~551030"
"~551031"
"~551031"
"~551032"
"~551032"
"~551009"
"~551009"
"~551010"
"~551010"
"~660323"
"~660323"
"~660324"
"~660324"
"~660322"
"~660322"
"~660325"
"~660325"
"~660328"
"~660328"
"~660327"
"~660327"
"~660329"
"~660329"
"~660326"
"~660326"
"~660767"
"~660767"
"~660769"
"~660769"
"~660768"
"~660768"
"~550884"
"~550884"
"~550885"
"~550885"
"~550887"
"~550887"
"~550889"
"~550889"
"~550890"
"~550890"
"~550888"
"~550888"
"~550886"
"~550886"
"~551116"
"~551116"
"~551117"
"~551117"
"~551056"
"~551056"
"~551057"
"~551057"
"~551097"
"~551097"
"~551098"
"~551098"
"~612738"
"~612738"
"~612739"
"~612739"
-4ddebc152a9f","apn":"WIFI","lat":""}&shoujishipai=
-4ddebc152a9f","apn":"WIFI","lat":""}&shoujishipai=
","X-Wap-Proxy-Cookie":"none","uuid":"e963cc5c-
","X-Wap-Proxy-Cookie":"none","uuid":"e963cc5c-
","channelid":"3","version":"5.7.0.0","productorid":"1","ua":"GT-N
","channelid":"3","version":"5.7.0.0","productorid":"1","ua":"GT-N
&LV=
&LV=
&UN=
&UN=
<=
<=
&SK=
&SK=
&PPT=
&PPT=
&PPK=
&PPK=
","platform":"android","os":"android","lon":"","locationstate":"0","location":",,","osv":"2.3.4","imei":"727093967614219","maptype":"2","cid":"3","PPU":"UID=
","platform":"android","os":"android","lon":"","locationstate":"0","location":",,","osv":"2.3.4","imei":"727093967614219","maptype":"2","cid":"3","PPU":"UID=
&type=&formatsource=home&headerData={"uid":"
&type=&formatsource=home&headerData={"uid":"
%E5%B9%B4&Content=
%E5%B9%B4&Content=
&buytime=
&buytime=
&cheshenyanse=
&cheshenyanse=
&chexi=
&chexi=
&cspailiang=2.0&cjshijian=2016|4&qxshijian=2016|2&syshijian=2016|2&xinxibianhao=J1RV12&shangpainianyue=201602&cateapplyed=29&paifangbiaozhun=408&canjiapaimai=0&gobquzhi=brand=
&cspailiang=2.0&cjshijian=2016|4&qxshijian=2016|2&syshijian=2016|2&xinxibianhao=J1RV12&shangpainianyue=201602&cateapplyed=29&paifangbiaozhun=408&canjiapaimai=0&gobquzhi=brand=
","maptype":"2","cid":"342","PPU":"UID=
","maptype":"2","cid":"342","PPU":"UID=
","platform":"android","os":"android","lon":"","locationstate":"0","location":",,","osv":"2.3.4","imei":"72709
","platform":"android","os":"android","lon":"","locationstate":"0","location":",,","osv":"2.3.4","imei":"72709
&carchexing=2012%E6%AC%BE%202.0%20EX%20Navi&cheshenyanse=
&carchexing=2012%E6%AC%BE%202.0%20EX%20Navi&cheshenyanse=
&gobquzhi=brand=
&gobquzhi=brand=
hXXp://p.webapp.58.com/ajaxSendValidCode/?callback=jsonp_callback2&phone=
hXXp://p.webapp.58.com/ajaxSendValidCode/?callback=jsonp_callback2&phone=
hXXp://p.m.58.com/
hXXp://p.m.58.com/
PRTG Enterprise Console.exe
PRTG Enterprise Console.exe
HttpAnalyzerStdV7.exe
HttpAnalyzerStdV7.exe
WSExplorer1.3.exe
WSExplorer1.3.exe
WinPcap_4_1_3.exe
WinPcap_4_1_3.exe
Wireshark.exe
Wireshark.exe
IceSword.exe
IceSword.exe
Referer: hXXp://pic2.58.com/ui7/post/PictureUpload_zip_s1.swf
Referer: hXXp://pic2.58.com/ui7/post/PictureUpload_zip_s1.swf
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; EmbeddedWB 14.52 from: hXXp://VVV.bsalsa.com/ EmbeddedWB 14.52; .NET CLR 2.0.50727)
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; EmbeddedWB 14.52 from: hXXp://VVV.bsalsa.com/ EmbeddedWB 14.52; .NET CLR 2.0.50727)
Host: pic.kuche.com
Host: pic.kuche.com
hXXp://pic.kuche.com/postpic/upload?flash=1
hXXp://pic.kuche.com/postpic/upload?flash=1
WinHttp.WinHttpRequest.5.1
WinHttp.WinHttpRequest.5.1
MSXML2.ServerXMLHTTP.6.0
MSXML2.ServerXMLHTTP.6.0
MSXML2.ServerXMLHTTP.5.0
MSXML2.ServerXMLHTTP.5.0
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
hXXp://
hXXp://
hXXps://
hXXps://
Adodb.Stream
Adodb.Stream
@`~!@#$%^&*()-_= [{]};:'\|,<.>/?"
@`~!@#$%^&*()-_= [{]};:'\|,<.>/?"
&password=
&password=
hXXps://passport.58.com/pso/domclientunionlogin
hXXps://passport.58.com/pso/domclientunionlogin
hXXp://passport.58.com/pso/waplogin
hXXp://passport.58.com/pso/waplogin
*.txt
*.txt
|*.txt
|*.txt
STR_UINTIP=1;STR_QLOGIN_VERSION_ERR=2;STR_NO_UIN=3;STR_NO_PWD=4;STR_NO_VCODE=5;STR_INV_UIN=6;STR_INV_VCODE=7;STR_UIN=8;STR_PWD=9;STR_VCODE=10;STR_VCODE_TIP=11;STR_CHANGE_VCODE=12;STR_REMEMBER_PWD=13;STR_1_DAY=14;STR_1_WEEK=15;STR_1_MONTH=16;STR_HALF_YEAR=17;STR_1_YEAR=18;STR_FORGET_PWD=19;STR_LOGIN=20;STR_RESET=21;STR_SWITCH_QLOGIN=22;STR_LOGIN_TITLE=23;STR_QLOGIN_INTRO=24;STR_QLOGINING=25;STR_QLOGIN_HELP=26;STR_SWITCH_NORMAL=27;STR_QLOGIN=28;STR_QLOGIN_BUSY=29;STR_QLOGIN_OFFLINE=30;STR_QLOGIN_OTHER_ERR=31;STR_BACK=32;STR_RETRY=33;function ptui_str(A){A-=1;if(A>=0&&A0.1){return }url="hXXp://isdspeed.qq.com/cgi-bin/r.cgi?flag1=6000&flag2=1&flag3=1";for(var A=0;A0){width=obj.offsetWidth}if(obj.offsetHeight>0){height=obj.offsetHeight}parent.ptlogin2_onResize(width,height)}}}catch(A){}}function ptui_notifyClose(){try{if(parent.ptlogin2_onClose){parent.ptlogin2_onClose()}else{if(top==this){window.close()}}}catch(A){window.close()}}function ptui_setUinColor(D,B,A){var C=document.getElementById(D);if(ptui_str(STR_UINTIP)==C.value){C.style.color=A}else{C.style.color=B}}function ptui_onEnableLLogin(B){var A=B.low_login_enable;var C=B.low_login_hour;if(A!=null&&C!=null){C.disabled=!A.checked}}function ptui_changeImgEx(D,C,F,E){var A=document.getElementById("imgVerify");if(A!=null){A.src=E "?aid=" C "&" Math.random();var B=document.getElementById("verifycode");if(B!=null&&B.disabled==false&&F){B.focus();B.select()}}}function ptui_changeImg(B,A,C){ptui_changeImgEx(B,A,C,"hXXp://ptlogin2." B "/getimage")}function ptui_changeImgHttps(B,A,C){ptui_changeImgEx(B,A,C,"./getimage")}function ptui_checkQQUin(qquin){if(qquin.length==0){return false}if(!(new RegExp(/^\w ((-\w )|(\.\w ))*\@[A-Za-z0-9] ((\.|-)[A-Za-z0-9] )*\.[A-Za-z0-9] $/).test(qquin))){if(qquin.length12||parseInt(qquin)=16){return false}return true}function ptui_onLogin(A){try{if(parent.ptlogin2_onLogin){if(!parent.ptlogin2_onLogin()){return false}}if(parent.ptlogin2_onLoginEx){var D=A.u.value;var B=A.verifycode.value;if(ptui_str(STR_UINTIP)==D){D=""}if(!parent.ptlogin2_onLoginEx(D,B)){return false}}}catch(C){}return ptui_checkValidate(A)}function ptui_onLoginEx(B,C){if(ptui_onLogin(B)){var A=new Date();A.setHours(A.getHours() 24*30);setCookie("ptui_loginuin",B.u.value,A,"/","ui.ptlogin2." C);return true}return false}function ptui_setDefUin(B,A){if(A==""||A==null){A=getCookie("ptui_loginuin")}if(A!=""&&A!=null){B.u.value=A}}function ptui_onReset(A){try{if(parent.ptlogin2_onReset){if(!parent.ptlogin2_onReset()){return false}}}catch(B){}return true}function ptui_initFocus(B){try{var A=B.u;var D=B.p;var E=B.verifycode;if(A.value==""||ptui_str(STR_UINTIP)==A.value){A.focus();return }if(D.value==""){D.focus();return }if(E.value==""){E.focus()}}catch(C){}}function ptui_checkValidate(B){var A=B.u;var C=B.p;var D=B.verifycode;if(A.value==""||ptui_str(STR_UINTIP)==A.value){alert(ptui_str(STR_NO_UIN));A.focus();return false}if(C.value==""){alert(ptui_str(STR_NO_PWD));C.focus();return false}if(D.value==""){alert(ptui_str(STR_NO_VCODE));D.focus();return false}if(!ptui_checkQQUin(A.value)){alert(ptui_str(STR_INV_UIN));A.focus();A.select();return false}if(D.value.length!=4){alert(ptui_str(STR_INV_VCODE));D.focus();D.select();return false}C.setAttribute("maxlength","32");preprocess(B);return true}function getCookieVal(B){var A=document.cookie.indexOf(";",B);if(A==-1){A=document.cookie.length}return unescape(document.cookie.substring(B,A))}function getCookie(D){var B=D "=";var F=B.length;var A=document.cookie.length;var E=0;while(E>5]|=128>>9)16){E=core_md5(E,C.length*chrsz)}var A=Array(16),D=Array(16);for(var B=0;B>16) (D>>16) (C>>16);return(B>>(32-B))}function str2binl(D){var C=Array();var A=(1>5]|=(D.charCodeAt(B/chrsz)&A)>5]>>>(B2))&A)}return D}function binl2hex(C){var B=hexcase?"0123456789ABCDEF":"0123456789abcdef";var D="";for(var A=0;A>2]>>((A%4)*8 4))&15) B.charAt((C[A>>2]>>((A%4)*8))&15)}return D}function binl2b64(D){var C="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /";var F="";for(var B=0;B>2]>>8*(B%4))&255)>2]>>8*((B 1)%4))&255)>2]>>8*((B 2)%4))&255);for(var A=0;AD.length*32){F =b64pad}else{F =C.charAt((E>>6*(3-A))&63)}}}return F};/* |xGv00|ccbfd68b5fceb62707a9e4ce87b8c813 */
STR_UINTIP=1;STR_QLOGIN_VERSION_ERR=2;STR_NO_UIN=3;STR_NO_PWD=4;STR_NO_VCODE=5;STR_INV_UIN=6;STR_INV_VCODE=7;STR_UIN=8;STR_PWD=9;STR_VCODE=10;STR_VCODE_TIP=11;STR_CHANGE_VCODE=12;STR_REMEMBER_PWD=13;STR_1_DAY=14;STR_1_WEEK=15;STR_1_MONTH=16;STR_HALF_YEAR=17;STR_1_YEAR=18;STR_FORGET_PWD=19;STR_LOGIN=20;STR_RESET=21;STR_SWITCH_QLOGIN=22;STR_LOGIN_TITLE=23;STR_QLOGIN_INTRO=24;STR_QLOGINING=25;STR_QLOGIN_HELP=26;STR_SWITCH_NORMAL=27;STR_QLOGIN=28;STR_QLOGIN_BUSY=29;STR_QLOGIN_OFFLINE=30;STR_QLOGIN_OTHER_ERR=31;STR_BACK=32;STR_RETRY=33;function ptui_str(A){A-=1;if(A>=0&&A0.1){return }url="hXXp://isdspeed.qq.com/cgi-bin/r.cgi?flag1=6000&flag2=1&flag3=1";for(var A=0;A0){width=obj.offsetWidth}if(obj.offsetHeight>0){height=obj.offsetHeight}parent.ptlogin2_onResize(width,height)}}}catch(A){}}function ptui_notifyClose(){try{if(parent.ptlogin2_onClose){parent.ptlogin2_onClose()}else{if(top==this){window.close()}}}catch(A){window.close()}}function ptui_setUinColor(D,B,A){var C=document.getElementById(D);if(ptui_str(STR_UINTIP)==C.value){C.style.color=A}else{C.style.color=B}}function ptui_onEnableLLogin(B){var A=B.low_login_enable;var C=B.low_login_hour;if(A!=null&&C!=null){C.disabled=!A.checked}}function ptui_changeImgEx(D,C,F,E){var A=document.getElementById("imgVerify");if(A!=null){A.src=E "?aid=" C "&" Math.random();var B=document.getElementById("verifycode");if(B!=null&&B.disabled==false&&F){B.focus();B.select()}}}function ptui_changeImg(B,A,C){ptui_changeImgEx(B,A,C,"hXXp://ptlogin2." B "/getimage")}function ptui_changeImgHttps(B,A,C){ptui_changeImgEx(B,A,C,"./getimage")}function ptui_checkQQUin(qquin){if(qquin.length==0){return false}if(!(new RegExp(/^\w ((-\w )|(\.\w ))*\@[A-Za-z0-9] ((\.|-)[A-Za-z0-9] )*\.[A-Za-z0-9] $/).test(qquin))){if(qquin.length12||parseInt(qquin)=16){return false}return true}function ptui_onLogin(A){try{if(parent.ptlogin2_onLogin){if(!parent.ptlogin2_onLogin()){return false}}if(parent.ptlogin2_onLoginEx){var D=A.u.value;var B=A.verifycode.value;if(ptui_str(STR_UINTIP)==D){D=""}if(!parent.ptlogin2_onLoginEx(D,B)){return false}}}catch(C){}return ptui_checkValidate(A)}function ptui_onLoginEx(B,C){if(ptui_onLogin(B)){var A=new Date();A.setHours(A.getHours() 24*30);setCookie("ptui_loginuin",B.u.value,A,"/","ui.ptlogin2." C);return true}return false}function ptui_setDefUin(B,A){if(A==""||A==null){A=getCookie("ptui_loginuin")}if(A!=""&&A!=null){B.u.value=A}}function ptui_onReset(A){try{if(parent.ptlogin2_onReset){if(!parent.ptlogin2_onReset()){return false}}}catch(B){}return true}function ptui_initFocus(B){try{var A=B.u;var D=B.p;var E=B.verifycode;if(A.value==""||ptui_str(STR_UINTIP)==A.value){A.focus();return }if(D.value==""){D.focus();return }if(E.value==""){E.focus()}}catch(C){}}function ptui_checkValidate(B){var A=B.u;var C=B.p;var D=B.verifycode;if(A.value==""||ptui_str(STR_UINTIP)==A.value){alert(ptui_str(STR_NO_UIN));A.focus();return false}if(C.value==""){alert(ptui_str(STR_NO_PWD));C.focus();return false}if(D.value==""){alert(ptui_str(STR_NO_VCODE));D.focus();return false}if(!ptui_checkQQUin(A.value)){alert(ptui_str(STR_INV_UIN));A.focus();A.select();return false}if(D.value.length!=4){alert(ptui_str(STR_INV_VCODE));D.focus();D.select();return false}C.setAttribute("maxlength","32");preprocess(B);return true}function getCookieVal(B){var A=document.cookie.indexOf(";",B);if(A==-1){A=document.cookie.length}return unescape(document.cookie.substring(B,A))}function getCookie(D){var B=D "=";var F=B.length;var A=document.cookie.length;var E=0;while(E>5]|=128>>9)16){E=core_md5(E,C.length*chrsz)}var A=Array(16),D=Array(16);for(var B=0;B>16) (D>>16) (C>>16);return(B>>(32-B))}function str2binl(D){var C=Array();var A=(1>5]|=(D.charCodeAt(B/chrsz)&A)>5]>>>(B2))&A)}return D}function binl2hex(C){var B=hexcase?"0123456789ABCDEF":"0123456789abcdef";var D="";for(var A=0;A>2]>>((A%4)*8 4))&15) B.charAt((C[A>>2]>>((A%4)*8))&15)}return D}function binl2b64(D){var C="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /";var F="";for(var B=0;B>2]>>8*(B%4))&255)>2]>>8*((B 1)%4))&255)>2]>>8*((B 2)%4))&255);for(var A=0;AD.length*32){F =b64pad}else{F =C.charAt((E>>6*(3-A))&63)}}}return F};/* |xGv00|ccbfd68b5fceb62707a9e4ce87b8c813 */
86265112
86265112
fJ.WM_
fJ.WM_
CX%xm
CX%xm
Õ6m*
Õ6m*
n.BjCw
n.BjCw
%s;7*
%s;7*
0%x@w
0%x@w
%C^L:
%C^L:
%s T5
%s T5
]E4%F(
]E4%F(
.Funr
.Funr
k%UPp
k%UPp
fg.VG
fg.VG
%C',@
%C',@
>Ùd
>Ùd
0'.Ll
0'.Ll
[I(3/#N0.bd
[I(3/#N0.bd
j"%u=w
j"%u=w
q%Xn`
q%Xn`
@|H.NI
@|H.NI
.wdd!
.wdd!
S|%u4
S|%u4
*.Ea]S
*.Ea]S
Q.CGo
Q.CGo
fTpe
fTpe
.LLbX
.LLbX
-.Mdl
-.Mdl
\-A}=3K
\-A}=3K
Y:.akpS
Y:.akpS
$.Zcqn
$.Zcqn
.WE= T!N
.WE= T!N
#?%s(C(
#?%s(C(
u.Jck~
u.Jck~
zx/%FN[
zx/%FN[
%s=\RI
%s=\RI
}j%c%Y)
}j%c%Y)
Rx.GR
Rx.GR
4o#.dM
4o#.dM
IeS`%C
IeS`%C
[n 4\.UY
[n 4\.UY
,4.qO,
,4.qO,
gQ'.Io
gQ'.Io
%cLur?
%cLur?
s%DHB
s%DHB
]I%%X
]I%%X
5r.US
5r.US
:mD].tB
:mD].tB
f%fUZ
f%fUZ
.fOuV12
.fOuV12
*_.dC
*_.dC
&-N}
&-N}
({?.cQm
({?.cQm
.Cqx~c
.Cqx~c
.`.Qw
.`.Qw
**.dU
**.dU
!n]%x
!n]%x
%X,Cr
%X,Cr
&.PFy{xh
&.PFy{xh
.um ZZE7L
.um ZZE7L
/^p%u$
/^p%u$
I.NoQY
I.NoQY
zu.ew
zu.ew
D/.nT
D/.nT
b\SkinH_EL.dll
b\SkinH_EL.dll
C$%cmb
C$%cmb
.ppM|
.ppM|
aZ.mO
aZ.mO
%-^
%-^
.hk;~
.hk;~
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
USER32.dll
USER32.dll
1076080880
1076080880
hXXp://open.baidu.com/special/time/
hXXp://open.baidu.com/special/time/
window.baidu_time(
window.baidu_time(
VBScript.RegExp
VBScript.RegExp
13669806666
13669806666
:VVV.ysz5.com
:VVV.ysz5.com
VVV.ysz5.comt
VVV.ysz5.comt
192.168.1.1
192.168.1.1
F%*.*f
F%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
RASAPI32.dll
RASAPI32.dll
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WINMM.dll
WINMM.dll
WS2_32.dll
WS2_32.dll
VERSION.dll
VERSION.dll
GetProcessHeap
GetProcessHeap
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
GetKeyState
GetKeyState
GetViewportOrgEx
GetViewportOrgEx
WINSPOOL.DRV
WINSPOOL.DRV
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
OLEAUT32.dll
OLEAUT32.dll
oledlg.dll
oledlg.dll
WSOCK32.dll
WSOCK32.dll
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
WININET.dll
WININET.dll
GetCPInfo
GetCPInfo
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
comdlg32.dll
comdlg32.dll
.PAVCException@@
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
msscript.ocx
msscript.ocx
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
VVV.dywt.com.cn
VVV.dywt.com.cn
x86 Family %s Model %s Stepping %s
x86 Family %s Model %s Stepping %s
X-X-X-X
X-X-X-X
.PAVCOleException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
201502200819
201502200819
c:\%original file name%.exe
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
(){(){(){(){(){(){
(){(){(){(){(){(){
)(})(})(})(})(})(}
)(})(})(})(})(})(}
)(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(}
)(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(}
)(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(}
)(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(}
)(|)(|)(|)(|)(|)(|
)(|)(|)(|)(|)(|)(|
)'{)(|)(|)(|)(|)(|
)'{)(|)(|)(|)(|)(|
('{)(|)(|)(|)(|)(|('{
('{)(|)(|)(|)(|)(|('{
)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|
)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|)(|
()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}
()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}()}
)(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(|
)(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(})(|
1, 0, 6, 6
1, 0, 6, 6
(*.*)
(*.*)
2.0.0.0
2.0.0.0
%original file name%.exe_1252_rwx_10001000_00039000:
L$(h%f
L$(h%f
SSh0j
SSh0j
msctls_hotkey32
msctls_hotkey32
TVCLHotKey
TVCLHotKey
THotKey
THotKey
\skinh.she
\skinh.she
}uo,x6l5k%x-l h
}uo,x6l5k%x-l h
9p%s m)t4`#b
9p%s m)t4`#b
e"m?c&y1`Ã
e"m?c&y1`Ã
SetViewportOrgEx
SetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
EnumThreadWindows
EnumThreadWindows
EnumChildWindows
EnumChildWindows
`c%US.4/
`c%US.4/
!#$
!#$
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.UPX0
@.UPX0
`.UPX1
`.UPX1
`.reloc
`.reloc