Trojan.GenericKD.1971331_0c623ba5af – Adaware

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:1636

Mutexes

The following mutexes were created/opened:

c:!documents and settings!adm!userdata!{1B655094-FE2A-433c-A877-FF9793445069}__DDrawCheckExclMode____DDrawExclMode__DDrawDriverObjectListMutexDDrawWindowListMutexCTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_RasPbFileShimCacheMutex

File activity

The process %original file name%.exe:1636 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\huid.ad.360[1].htm (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\so[1].htm (3109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\so[1].htm (3065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sed_api_weather_info[1].php (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\app.Skin[1].js (20 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@so[1].txt (218 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\so_weather[1].xml (534 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\app.skin.localStorage[1].js (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\v3203[1].js (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\t014987b2ab2e751b14[1].png (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\t018466f960e62c9c3d[1].png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\GetRemindMessage[1] (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1-33[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\t01bc32feb0bbb5c4e0[1].png (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\t01a54bac9a6570884f[1].png (517 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\main[1].js (1654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\app[1].js (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.so[2].txt (3311 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CALC0NX5.gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.so[1].txt (4249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\weather[1].js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\t01a88a878a4852d46c[1].png (188 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@360[1].txt (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sed_api_weather_info[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery,require[1].js (6660 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (12532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\home[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\t01f9ee1b0873023e36[1].jpg (25232 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@www.so[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\so[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.so[2].txt (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sed_api_weather_info[1].php (0 bytes)

Registry activity

The process %original file name%.exe:1636 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 14 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1395579352"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 AA 64 65 DA C6 8C FD E9 D7 90 4B AA 5F 03 79"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\huid.ad.360[1].htm (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\so[1].htm (3109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\so[1].htm (3065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sed_api_weather_info[1].php (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\app.Skin[1].js (20 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@so[1].txt (218 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\so_weather[1].xml (534 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\app.skin.localStorage[1].js (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\v3203[1].js (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\t014987b2ab2e751b14[1].png (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\t018466f960e62c9c3d[1].png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\GetRemindMessage[1] (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1-33[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\t01bc32feb0bbb5c4e0[1].png (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\t01a54bac9a6570884f[1].png (517 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\main[1].js (1654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\app[1].js (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.so[2].txt (3311 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CALC0NX5.gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.so[1].txt (4249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\weather[1].js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\t01a88a878a4852d46c[1].png (188 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@360[1].txt (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sed_api_weather_info[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery,require[1].js (6660 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (12532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\home[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\t01f9ee1b0873023e36[1].jpg (25232 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: ??
Product Name: Hongtumoju
Product Version: 9.4.5.2032
Legal Copyright: ???? ???? ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 9.4.5.2032
File Description: ??????????
Comments: ??????????????
Language: Chinese (Simplified, PRC)

Company Name: ??Product Name: HongtumojuProduct Version: 9.4.5.2032Legal Copyright: ???? ???? ????Legal Trademarks: Original Filename: Internal Name: File Version: 9.4.5.2032File Description: ??????????Comments: ??????????????Language: Chinese (Simplified, PRC)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	609950	610304	5.1523	30793e4fb959a0a79ca8e7e7bad7ee51
.rdata	614400	271872	274432	4.34407	7fca0684ca841af9b9228fbb7aa76ee9
.data	888832	291850	65536	4.19572	55eedb58cd74963b961f3291014fd9c5
.rsrc	1183744	145808	147456	4.21695	ff91142690ff5f699b2092ac7862c7cd

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://d5aarrlse7gau.cloudfront.net/d/inn/774669ac/t01bc32feb0bbb5c4e0.png
hxxp://d3q2juhbboaxe.cloudfront.net/t018466f960e62c9c3d.png
hxxp://d3gixb0cp5yznh.cloudfront.net/t01a88a878a4852d46c.png
hxxp://360.xdwscache.glb0.lxdns.com/dm/20_20_80/t014987b2ab2e751b14.png
hxxp://d3gixb0cp5yznh.cloudfront.net/t01a54bac9a6570884f.png
hxxp://106.120.160.134/resource/js/jquery,require.js
hxxp://d3rsere53q73yw.cloudfront.net/static/6481a2c59ad67282/home/app.js
hxxp://d35lc0g891lqw8.cloudfront.net/t01f9ee1b0873023e36.jpg
hxxp://106.120.160.134/resource/js/home/main.js
hxxp://d3rsere53q73yw.cloudfront.net/static/9bda36b777f73b49/home/app.Skin.js
hxxp://106.120.160.134/resource/js/home/app.skin.localStorage.js
hxxp://106.120.160.134/resource/js/v3203.js
hxxp://huid-b.ad.360.cn/?api=set&cb=So.web.midhuid.set
hxxp://106.120.160.134/resource/js/weather.js
hxxp://rec.api.qh-lb.com/mod_recommend_search/GetRemindMessage?from=so_home&callback=So.web.card.setData&count=0&start=0&mid=&guid=10O6rJjFz/p6YH8MVNOgwLYVLm1RbYStawnPyJ04G4X/0=&qid=&_=1418883337315
hxxp://weather-b.hao.360.cn/sed_api_weather_info.php?_jsonp=jQuery110201546839535308559_1418883337316&app=search&code=&so_nc=1&_=1418883337317
hxxp://s-b.qhupdate.com/sou/home.gif?p=&u=http://www.so.com/&id=15484592.752027968357827800.1418883337831.3481&guid=15484592.752027968357827800.1418883337831.3481&v2014=so&brw=ie6&pro=so&pid=home&mod=&abv=d&src=&ref=&gid=&hid=&login=0&t=1418883339722
hxxp://s-b.qhupdate.com/sou/wpo.gif?p=&u=http://www.so.com/&id=15484592.752027968357827800.1418883337831.3481&guid=15484592.752027968357827800.1418883337831.3481&v2014=so&brw=ie6&_perf=0&pro=so&pid=home&type=page&d_jquery=1375&d_main=1781&d_card=31&r_card=5031&r_end=5422&r_load=5797&t=1418883340128
hxxp://d3q2juhbboaxe.cloudfront.net/d/inn/9371c065/weather/bg-w/1-33.png
hxxp://p8.qhimg.com/t01f9ee1b0873023e36.jpg	54.230.37.214
hxxp://p2.qhimg.com/t01a54bac9a6570884f.png	54.230.38.148
hxxp://www.so.com/resource/js/home/app.skin.localStorage.js
hxxp://www.so.com/resource/js/v3203.js
hxxp://www.so.com/resource/js/jquery,require.js
hxxp://p7.qhimg.com/d/inn/774669ac/t01bc32feb0bbb5c4e0.png	54.230.39.43
hxxp://p0.qhimg.com/t018466f960e62c9c3d.png	54.230.38.121
hxxp://p4.qhimg.com/t01a88a878a4852d46c.png	54.230.37.206
hxxp://weather.hao.360.cn/sed_api_weather_info.php?_jsonp=jQuery110201546839535308559_1418883337316&app=search&code=&so_nc=1&_=1418883337317	220.181.158.235
hxxp://s1.qhimg.com/static/9bda36b777f73b49/home/app.Skin.js	54.230.36.29
hxxp://www.so.com/resource/js/home/main.js
hxxp://p0.qhimg.com/d/inn/9371c065/weather/bg-w/1-33.png	54.230.38.121
hxxp://quc.qhimg.com/dm/20_20_80/t014987b2ab2e751b14.png	8.37.231.19
hxxp://rec.api.so.com/mod_recommend_search/GetRemindMessage?from=so_home&callback=So.web.card.setData&count=0&start=0&mid=&guid=10O6rJjFz/p6YH8MVNOgwLYVLm1RbYStawnPyJ04G4X/0=&qid=&_=1418883337315	106.38.184.60
hxxp://s.qhupdate.com/sou/home.gif?p=&u=http://www.so.com/&id=15484592.752027968357827800.1418883337831.3481&guid=15484592.752027968357827800.1418883337831.3481&v2014=so&brw=ie6&pro=so&pid=home&mod=&abv=d&src=&ref=&gid=&hid=&login=0&t=1418883339722	106.38.184.212
hxxp://s1.qhimg.com/static/6481a2c59ad67282/home/app.js	54.230.36.29
hxxp://huid.ad.360.cn/?api=set&cb=So.web.midhuid.set	218.30.118.216
hxxp://www.so.com/resource/js/weather.js

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /t018466f960e62c9c3d.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p0.qhimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 5165

Connection: keep-alive

Server: nginx

Date: Tue, 16 Dec 2014 16:53:48 GMT

X-Powered-By: PHP/5.4.25

Last-Modified: Tue, 04 Nov 2014 04:10:16 GMT

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Accept-Ranges: bytes

X-Varnish: 839929399 159340900

X-Varnish-Hits: 1176

X-Varnish-Cache: HIT

Age: 3827669

X-Cache: Hit from cloudfront

Via: 1.1 d83cac86d20d2b04ec6dae513de4a538.cloudfront.net (CloudFront)

X-Amz-Cf-Id: hjpP2bv2aRlsVvq8ry3l6hJ_OhW8DhQpNwIJkC9-XFOLGx5hPO8Vgw==

.PNG........IHDR...f...k.....s..N....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:21E9CFD60D9D11E483E2D3B3173DF993" xmpMM:DocumentID="xmp.did:21E9CFD70D9D11E483E2D3B3173DF993"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:21E9CFD40D9D11E483E2D3B3173DF993" stRef:documentID="xmp.did:21E9CFD50D9D11E483E2D3B3173DF993"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.y......PLTE...>.M......R. ~.lQ.cN./...............}.l.........u..W.ec.s<....|S.fG.X...:........E.V~..?.N...Q.....=.Lq.....a.FU.h.........F.W......o.Nb.::....q<..P..o.Zg.tp.Z.........T.gb.l.........;.....O..|.a..............r.........q.zP.\Q.]..._.G............P./...9.G.........R.d_.9@.P......;..=..<..>....................;...................q..q......T.gG.XQ.d@........H.Y@.OV.iS. <..>........P..O....tRNS................................................................................................................................8.Kg....IDATx....W.K...!. $*.." ........7.

<<< skipped >>>

GET /d/inn/9371c065/weather/bg-w/1-33.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p0.qhimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 1008

Connection: keep-alive

Server: nginx

Date: Wed, 17 Dec 2014 10:57:25 GMT

X-Powered-By: PHP/5.4.25

Last-Modified: Wed, 17 Dec 2014 09:43:19 GMT

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Accept-Ranges: bytes

X-Varnish: 2263615363 2261854961

X-Varnish-Hits: 51

X-Varnish-Cache: HIT

Age: 92494

X-Cache: Hit from cloudfront

Via: 1.1 d83cac86d20d2b04ec6dae513de4a538.cloudfront.net (CloudFront)

X-Amz-Cf-Id: U2r4OpoiCHYGkl_E9c4uSSA6KXqcBZIDIkK4GZd2djFzqOL7NOCQIA==

.PNG........IHDR...*...*.......9i....gAMA......a.....PLTE................................................................................................................................................................................................................................................................................................................................................................................................................O.....StRNS...It.zS.F..P0..9;.L.Q.<$....yYMp{_#5.."/.j..N.........Xe.2...U.3.6DC......................IDAT8....S.Q...sD...b......;6.(..1.......-.Y....!m%.lt...O..<.s.;sV.?.....V7......i][...S......N....z6.<>..l\.n.........Hz.V.......Z9.4...;w...W.Y...{.... ....e.....r.....<t..dmq^MT..H.......8^&7.&.pLD$..[..w...,..8."'`.)-.....b"0.w..#.q.N...[Z.xy..AD...-df*.,D..,<Y.....M.).O...pZ`...|i.&!*g`4.~....o.09..DZ:`!Q_~....4.?......#"".......J.\.T.........\k..:{.W.KUo...r%r........}.w*...z...<P}X9.k..!...._|4...>...8.l.......en....W.hn........IEND.B`...

<<< skipped >>>

GET /sou/home.gif?p=&u=http://VVV.so.com/&id=15484592.752027968357827800.1418883337831.3481&guid=15484592.752027968357827800.1418883337831.3481&v2014=so&brw=ie6&pro=so&pid=home&mod=&abv=d&src=&ref=&gid=&hid=&login=0&t=1418883339722 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s.qhupdate.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.7.7

Date: Thu, 18 Dec 2014 11:24:53 GMT

Content-Type: image/gif

Content-Length: 43

Connection: close

Accept-Ranges: bytes

GIF89a.............!.......,..........

GET /static/6481a2c59ad67282/home/app.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s1.qhimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 1208

Connection: keep-alive

Server: nginx

Date: Sun, 07 Dec 2014 08:48:07 GMT

Last-Modified: Thu, 27 Nov 2014 06:36:52 GMT

ETag: "5476c684-4b8"

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Content-Encoding: gzip

X-QSTATIC-HIT: 1

Access-Control-Allow-Origin: *

Accept-Ranges: bytes

Vary: Accept-Encoding

Age: 959800

X-Cache: Hit from cloudfront

Via: 1.1 e68f38f4baa27abc5230ccd771b6deec.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZZCuA4upZbhp4rZGseFwJsvR0NjHO6X5m_Nyj-pChej900JDPeow-A==

......vT...VQo.8.. .6.6.:N.&.S.p...r...{Z.@.e[."k...H......Iz.=....H.....4.Yq.....V.....?.....\....'..8..Y<....4........R..'...!?......t.....n.....\..!..........e..h......C...0=..%..oo...M....S4g.V.p..J.f.......p....X.....@nKY...5.|....YBu...k.%..5U ..e../e....c.[..p_.u. ..&..c.8..O..).......O. ....S/E...J.nm......O(.....Fc_..O.ey._.S.e..!....v.G.|(.......$..s.:$.<y".f.[..V....v.Z.&s[DQ..Sw..R..88a/.7..>.TT2A\.....M.......O.....u\t|b.v....0....>..?....E...Ue......A....u.A.Y....P.h.l.)y.....Rj...k......z{..^.*hD....)....WG..i.M{.T...@8V.....DS...=KDB...0g.5pz6.|f.....x.r.....]k.p.(.@q....=..c..8..A.\.1..\j...K.....:...n.....n..k...jv.n.7........6...#.c.P.k.n.B.]...A...R.......f.B...d...].....C.^..........#...D.=.........-.A^c>..........)..... ...x#n]....Rm......e.^..v_....h5...1.*......BE.....<...*..W56-..&......p.8l.t......(..5E.f.x..*....Piy....j&.g......q.........|j.sTco.....ti.A..r6~...O..A.W..q...\....1..|...N...x[..`x.p.sw'..c...}J].......NO..9.....q.......c....u.....O.#..!0.......A..S..jq...hR...5zY..5.1..^G..c-.m..*..y.6)j....#R....d)..N... ..>...<j.. .Z........v6!*.@.~.....l&.E~....]$2...z..... ....\u....0l...JQ..z.....K]I|.4iD.&w..............!..^h.0...}x."....`T...........${.........

<<< skipped >>>

GET /static/9bda36b777f73b49/home/app.Skin.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s1.qhimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 6129

Connection: keep-alive

Server: nginx

Date: Tue, 02 Dec 2014 15:02:08 GMT

Last-Modified: Thu, 27 Nov 2014 06:36:54 GMT

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Content-Encoding: gzip

X-QSTATIC-HIT: 1

Access-Control-Allow-Origin: *

Accept-Ranges: bytes

Vary: Accept-Encoding

Age: 1369358

X-Cache: Hit from cloudfront

Via: 1.1 e68f38f4baa27abc5230ccd771b6deec.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vAnOzoepZffS28ETSfr-O290wNyNbJwkX41gmIv7QhDhZvoUuIXtWw==

......vT...<is.F...j.$`...$.2(X.8.JR..T...-........h.>.....^.h......~.E....}4C...n..y..X.....(q.t..o.4..8;...p.e.*.4.....d..O.8v._w..b...*M....?8..> .".r...E..........."-...,.E.%..g.EV.`c?q2w......;.....g^....02..D.|...hm..3..<y(6...:.,9f....Y...06.}....</x..=N.g.9[%....t....7f.dE..|...>.s..|.6)a..6U...I:/........Yx.t...u.<...LBBC...t;.../.......].o,.l.......7..U.v. [H.|.xW....\o.l...P.'(<D.~.....x.}9..n..7W.!sh'..5G..E.'.....n.f.e`....>7.C$.[.P..F...`;...^.L.M....v`..^...?~.#.=......Ar[h.s...F...$...y..h.`..6S........k.-...9....>......A..`....."`F>R.o@...w..n..z.<z..X.Y..s5..m.=.h.I..?vq.......U...e.&..c.p.fI..$.Tr.N2.._6Q..D....m._ ...8ZA.3.u..Yu.Qr.dY...E..(J......'C........1....x5.0u..J.X.$..} ........? xVb..%.......D.&.O2p...=....A..Y&..r.@..SfuZ|.).K.-...gZm...)...~.~0....E....*....p..................v0..........I..X~..:...c.={......8z...a/..!|...#;....-.?vp..A.-{qpv.GJjR2.O-&N....zq...wy...".S..I1.(.....[........8.s.......enP...P.\.Y.l.. .Oj.....^...._.@.......5..l ...>8.._}.].kWXd.H{..1....W@...5....u....?.....@....\_Fn...Q...b/...r. 2g.Kx.gY....y....b<Y.....z.z..j.-...}.r<z.:d...$..H..G.E...Wc>.....o..2Z...d<...W.....'......}.....y...h6...A\r...N. ..L)IhQ...X......w.m..5x..rQ...6*r...h.....X..30....a....>...h..W.N..b.bG.nyR............}.......V1..u..... 1.s.e.d.....N..C.%...<...0...2..A.....-...}8.......6.:.Sf?>vwM...U.vA.c&.O...n.7...7tR.#*.y.:..(,.h?._..c.F....../.*...F ..j4...2p.@.D...y.7...6...AV.%...*..j....^......\...<..[...........&l

<<< skipped >>>

GET /sed_api_weather_info.php?_jsonp=jQuery110201546839535308559_1418883337316&app=search&code=&so_nc=1&_=1418883337317 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weather.hao.360.cn

Connection: Keep-Alive

Cookie: __huid=10O6rJjFz/p6YH8MVNOgwLYVLm1RbYStawnPyJ04G4X/0=; huid_is_new=1

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Thu, 18 Dec 2014 11:24:53 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: close

Cache-Control: max-age=3600

Expires: Thu, 18 Dec 2014 12:24:53 GMT

Content-Encoding: gzip

428.............V.n.6...@....|6I..K....1.=H[I<.....b.=U....L.@`..4..........%?.h....I..[oU.>....1Zk......i~..5.I.....1....M._..a......S...].^.k..Tw{...s.t....s7.O.......JG....cw.......m..`3.<.v.....{.m.ux.r.../.s...oN...o...T.)...4.......3<.u..........]....8.N8...H........I&..5.....[a..K.x.YF.r..V=...C2i....vk...FXr..K..._Bp...`.e..f....l..x...v.yx..c..g...mg.=....D...#b.....OB...b.....b......!r..!.H.c.X.*..2..H.n....B.......=....h........$MP.$.)....Iq..$..%6h....9.%^..h.^'.ig.P@..r.4.i..D.z..FX.g-N#.X.Hg.b4.h...ALR.Ft.a..H....wO..._.........u...1.6ZD.`.....Scq..@.....;&.m.C.3.u..7...XM$).S.:..Z...C.......Z.#.}!.....c.........PC..........\.(H......'.?.....D....]Q..k'.X.E.&.....r..!.-...}.....'Kf..?...<.c.P.M........97...K.. s......p..hS.gf"......k..9$VIBb.F(....23.qe....... ..>.].*...*.>...$..e$...Ckp....yY..T..'....m....8..tA.(..u..'Y.7A..Z.z.G..X8#ct./.E.N.ku..h.1M.b,r.8"......m..v..U.........]6l......=T.fD.:T|..0.Dh.C.8.J".Q.....Q...y..yv..-"S......_@m?....F.l..?.x..:..SUu.EU'..Q.....E.U.d...p!><...{p...'A....|g..k...o........fW....._].......f..i,.....0..

GET /t01a88a878a4852d46c.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p4.qhimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 188

Connection: keep-alive

Server: nginx

Date: Sun, 07 Dec 2014 03:26:45 GMT

X-Powered-By: PHP/5.4.25

Last-Modified: Tue, 04 Nov 2014 03:52:15 GMT

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Accept-Ranges: bytes

X-Varnish: 2439773831 2141028478

X-Varnish-Hits: 490

X-Varnish-Cache: HIT

Age: 3828751

X-Cache: Hit from cloudfront

Via: 1.1 070f600a6802e1c4140992090fd80863.cloudfront.net (CloudFront)

X-Amz-Cf-Id: KsEkgUdbSzT5AA6i19BfqgcbBFijtGC7WbusLcPlo2JHiApDqxI4rQ==

.PNG........IHDR... .........D..v....gAMA......a.....PLTE.........V.ifff.'Ql....tRNS.@..f...KIDAT..c`....`..%.0.l.....X..............3)...1...'L..,....XT......U.n...&.......~T.....IEND.B`...

GET /resource/js/jquery,require.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.so.com

Connection: Keep-Alive

Cookie: GUID=D6GSGG2Kzob4wyqYY/ZjTc3QLTfJ7TTANsYTw2HnqlBAiVD0Cp9KgShLuqbtXISBZAUykRgloHrSVpQLlow=|a|1418901882.6904; _S=gjr680gn9t9ok4q1vrfp6m1va7; QiHooGUID=AB07EC1F91655B6DFA07CA13879ABF9F.1418901882693

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 11:24:47 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 17 Dec 2014 05:20:42 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Sun, 13 Dec 2015 11:24:47 GMT

Cache-Control: max-age=31104000

Content-Encoding: gzip

600a..............i..Gv..>...82 6)R.'...nY.....x.....B...4.-&...\.s....Pv../n'#....k9u...........7.....?z.z....z..y.r..........jt.X\.....7.=.O..qW.>.....p..........y.|n.~../<.^.............{.Q....r2.-...P..;..`g....v...bV.\..3......7..vx........;..?....C....U...qo1l.....c....G..?.....^s...5...X.n......W=>........e1.......C......l...r.}9.L_s..{...L.....u:..;w.........l.{.X.&.\./5..i.xz.Z..../v.......g.......SNv..wi|.j|_.N....w.....esxp.[..r.Z.N..l.....tr..=|.*.U.%.0)fE..)G.]&..........[>.c.....K-...5{7-z,T.y1...<.3.a{X............1...j.;:.....s.~......;3Vd..}EX.....\4..x..':...X.\O..L.o^,...^{.Y.....?...].f1.....l.n2.^.ki$.W./.....Qv/.T..ZO6..p2...I.......C..5...Q2..=K?..V1...V1.D..szj.x5.?..4'......X.ns........,.c^....[.6..y..s.=#....(.<..ig.oq...>...\k.~k.w.....{Z....3..n[..r...u.....N.....K0..{.&..z..E.O.I-t<f.<]..9N.y/X....._..E...h...k?.../...Y.... ..pgv.8-..5.Iww...:........W.-...z.N.e1...y..-Al...j........-..|y}=.-...'~.V......PM7....mz..S?....(..........7.&.......6.]..................f./.......R~v.H:.7..[.V.m,f.aC...F..\.G~.17....7.k4h2..........U.v....:.Z..;...6o....F...nH.;...]...j9..Y.....A..]P.a..P......VK...,..)....DL.{.>..M......@.wG........bNP.....W.'...p...e...W.N....!.pq..vx.N....(..a..t!.x...H...4E....Zf4.s... .4..xV.[|h..h.....v..a.......E\...g....F.x1d#..U...{u..!`.4..5....Q...C.J.R.?...%..j...............=.....s"L...-l9V.H......W..I5..ot.k..~.9.~c.{9.6 .L%........Z..|...6..Y......7......u.X....6Z..P..A....g..JL_O..8......v.g..za.C..:B.#..A.$b3.n......k.k.y.".

<<< skipped >>>

GET /resource/js/home/main.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.so.com

Connection: Keep-Alive

Cookie: GUID=D6GSGG2Kzob4wyqYY/ZjTc3QLTfJ7TTANsYTw2HnqlBAiVD0Cp9KgShLuqbtXISBZAUykRgloHrSVpQLlow=|a|1418901882.6904; _S=gjr680gn9t9ok4q1vrfp6m1va7; QiHooGUID=AB07EC1F91655B6DFA07CA13879ABF9F.1418901882693

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 11:24:48 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 17 Dec 2014 05:20:42 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Sun, 13 Dec 2015 11:24:48 GMT

Cache-Control: max-age=31104000

Content-Encoding: gzip

259d.............].w.F..W(.C.!...e;. >_I<...9.}K.z .$....C.......n..B.3of....F...u|U._.I.<..`!.y.M.0.l.fn.._....e...o.....Z.b..,7...&LD.:......%a......."@.^....BD..F3q....~:...r..n..>.Aq|.......(....~gA...?....:.?...=S....#L..4.h:!^...P-..$q.s.{.......r]z..x..........6.......\.`6{).Xu...731..U..-~.d........qvn*...S:.U.......a*...._~..,..E8..3...s[Q.\.c>x..m&....P.R..[r.$)B_..M.So.0.Vq0.S............P....#q.z.....x....Z.N...o.?}"N.......:.....p-0.n...r.h$f.HnWF....?..Ddy..2M...m.$.. t.@...3x.......a....n.G%....^..H....8..>.. (..P.n.d.%h.G...j.B%b._..Vr. ........"B..8...Av.`..r..\e...'{1......no.."...Xa..>...y...'..if....w#&8...N..^..:.q.A...:&...9N.| .L....Y...!...........G....{.X.I....7...J!....z'.........,..D..]..l.....]|#.W...q.~nH.j....1YW.Y....7.`*.......68.......;....e.e.....,:_3.>.*'.D. 1.....].f"..H.....P..A....,..K~.. .;.6v...J~.g&wJ......._..o .%..7K....F....s...`.......&........a.h!O.{..........m.ck.QK8.../M.J.l.4...a.ng^...'.......1I. .....H......\..... .|.(Qv.G.......G.0.........nZ../]............a."I..r....C.%pv....a*.hd.._.M..,].:,.BT..s(....f.........r..B........tv.........;.v..._.._....f.qt)...nY..b.J....:|..7qD..9...:.5..t.....q..V.....p..W.....{.q......m...-..c.{.ax..c.....Q.......c(.5K..qFy$.i..v6._..5..|B.w,..(.%I.jW..J..'".(..@.^X@...r.C...;......1}5..c'#k.%.....?..^kg..M"...D;........$.P......IMp6....&1.x...S....M.E..d.A ......e....2.J.}O.:..<.......?. ..`.,.........l........@.Zwl-.i"....x.....S..m..........#NV3...7...1..C..]../.....W1`..L6..L....D.. /..Ad..I..x.

<<< skipped >>>

GET /resource/js/v3203.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.so.com

Connection: Keep-Alive

Cookie: GUID=D6GSGG2Kzob4wyqYY/ZjTc3QLTfJ7TTANsYTw2HnqlBAiVD0Cp9KgShLuqbtXISBZAUykRgloHrSVpQLlow=|a|1418901882.6904; _S=gjr680gn9t9ok4q1vrfp6m1va7; QiHooGUID=AB07EC1F91655B6DFA07CA13879ABF9F.1418901882693; __guid=15484592.752027968357827800.1418883337831.3481; count=1

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 11:24:50 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 17 Dec 2014 05:20:42 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Sun, 13 Dec 2015 11:24:50 GMT

Cache-Control: max-age=31104000

Content-Encoding: gzip

1db9.............\.w.... 2..KV4%.])..y.M7i.8..w%... .5E*$..J......C...{.nOj. .....o..e..~..]...U.L. O........I(.4.. ..Y.O.c......>...E.."<.Do..x3!_.b!..?....~.....0...r...~...u..U..y....w.......3/..L....^... ...hx4.[.....Yn...Q.-.T.a.{.\\....\.en9O... ...2].........w.y..<..3/L.....^w.G>X..g.2:...D..j.%n&fn.).I.^.......\L...."=.b.ND...V'.X.........[/Lh6......sc.J.,e8....aO..t...............k.. .nn6$.._1d.{...Y...5OsYI.^...![.G.......$.I....8X.}._v..."..o9...4r..s....[!...Zz...~..{.M?._...}.*..7K..g.L.k{...mz>..........E...H....&...#.m.X.Y.?G.4.......J..y.$.|S$.0.g.b......8W..".D..r....e.I.ZC'L..........;w.....*.L....O&...q.~0.......=......[...^:n<\...@xg....d....;.......i.......i2.cf...,,..B;.W..b..zi...2...P....u...4.V4...$..2....$Z.WD.4...|....._e"N...T..u:K..?.....%D.oY..@....f...[.....oA.iMr*.Y...#z......,.j..%...}...2.@QB_.>....=Z...k.I:.~..z.......Q..#..O.8v.!&/.4(byzAC.\~.y.......s>U...4<..5..r.&.Z...33E..l.c.. #....q|...z.....$...F.?...L!.)..~..&i.#.7b ..A..a...........B..4...]keD..[.e9.5.%.-...tR...Z@........Up.9b1{_.sN`./y..D....Xae74.w..fG...~.\P.0.....<J.u&..[/.d=.d...D,..hV......?..s.2..I a......`...........k..6R.W..f.~....sT<8........S........x<.....~......]l.\...[.C.a.mZ`..a.F..5...........<L..H.L..XL......'..4Roi..f..../....6!..%!:.!./|ug...2....y..zG._......z.^...Z?...........Z.Y. .........-2|_..6H<.V......x.Z.......C......'..C.58..w.^.n.n.....:....#(..I1.U*d../6.l.X...x...0.d9.g...Sj...(.:y...G.[ ..1..a...#..@e....b .Rxoa...B...-<.T~C)l[R[%[F....Z...

<<< skipped >>>

GET /t01a54bac9a6570884f.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p2.qhimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 6650

Connection: keep-alive

Server: nginx

Date: Thu, 18 Dec 2014 08:49:38 GMT

X-Powered-By: PHP/5.4.25

Last-Modified: Tue, 04 Nov 2014 03:06:14 GMT

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Accept-Ranges: bytes

X-Varnish: 1678487118 1095984729

X-Varnish-Hits: 974

X-Varnish-Cache: HIT

Age: 3831512

X-Cache: Hit from cloudfront

Via: 1.1 e50f6e2cb0faa5bbde111f3c7b34fcdd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GYv5TCEtUL8nHMvvnAwBidBWWalO-COj2ZtsFtluUtWvsYHcJzOtEA==

.PNG........IHDR....... ........]....gAMA......a.....IDATx..].X.G...r/...@pC../Yd4F.....e..IL..F}&.9qIL...O....<pC..$.w.F..DQ\..q.. ....qe...~4mw.n........G...SU..g.S.:]u......\.z5...G.%(.{*''.a..T...t.cqqqT....u.k\7T.Mu..O_q.**........p.F..T...]...};....)......'t...0...n..B^^.B\7Y}.b..@x...7.h]o..YW....b.. .o4.W.\q.7..['...jh..........iw.....hw...........t......b..I[?I.....K..........h...'.:.qqq.;w.t.{.......F[.Z..f[_[.">>....J.c.v...6....C2.6...;%%..&...6.k.m.Sc..|.PZa..G..fff...................f.....X.E..Z.t@.l.. ......8H.._......e..^.x......w.*.s...>..QK?,.....@.N%.w...N....M|.. .)%....s.....3..{........(.o..zFFFG..R x.K..R......./.XS...^......*Z..........Z...z.......4.h#...A=J..v...?f.'.]/............c.K..........1Y1..c0.:B?..U..4.3..$..Sc .....2e....*.y...n...J.^l..h.X..~.........!4.hk...A.2`m.Y.d..\..........g....CO..k...9.@........o.n..}.H}..w.KJ........x;.D.J..2...............Gl...}......2w..&$$t&..B..|rCI..~..q..!.#.5....0&w.....E.....h[...........o.8h.&..[.nN...\....G....=.R...!i...t......vE......e.....?......V._.~phhh{....>*.Am&........%...:.g..-...0.y~.:th.0...g..=;P...X{.Q..P..=..b..=k...P....MYYY_.2.III=Y..o ...(q..f.l%0g.f....3....../...#.M....E...a.. 8....G.p..*....^33..l.M...>}?..c 6.N,F...^..g......)>>..]M...wy.P.A.&.8^..:6............w...oaI..u...P......b..w....#....|.t..{wHzz.l.is.........=.a..2.j=....L.19|.S.5~...eZT......h.....f5V$....n?.....#G........0 ).tC.(...^...k.`.....Y..N2m.." %../..j..|...*e...V.H.....@.........s~P`!.3...'.....^..:.L.....;v..@...FGG.V4.. 8.

<<< skipped >>>

GET /dm/20_20_80/t014987b2ab2e751b14.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: quc.qhimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 08 Dec 2024 15:04:03 GMT

Date: Thu, 11 Dec 2014 15:04:03 GMT

Server: nginx

Content-Type: image/png

Content-Length: 232

X-Powered-By: PHP/5.4.25

Last-Modified: Fri, 28 Nov 2014 00:22:44 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Accept-Ranges: bytes

X-Varnish: 1048254673 850090342

Via: 1.1 varnish

X-Varnish-Hits: 456

X-Varnish-Cache: HIT

Age: 1

X-Cache: HIT from cache.51cdn.com

X-Via: 1.1 lasi18:9 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR...............B.....gAMA......a.....IDAT....A..0......3L...s..o.........([%.].....9=..L......%.|Bk.J.k.?...3....s..Mk.y&.].".#E.......\..........*.ssda.h.X..KS.F...J.. ~.jC.....HP.c.b......;.......s..dj]....IEND.B`...

GET /?api=set&cb=So.web.midhuid.set HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: huid.ad.360.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Dec 2014 11:24:50 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.8

P3P: CP=.

Set-Cookie: huid_is_new=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=360.cn

Set-Cookie: __huid=10O6rJjFz/p6YH8MVNOgwLYVLm1RbYStawnPyJ04G4X/0=; expires=Sat, 10-Dec-2044 11:24:50 GMT; path=/; domain=360.cn

Set-Cookie: huid_is_new=1; path=/; domain=360.cn

Content-Encoding: gzip

68............S... OM...L.(.L. N-..V..JV.:J !% %C...".,......H...0?..r..0.\..........J/..w...}.[.ZM..R&JX.....0..

GET /resource/js/home/app.skin.localStorage.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.so.com

Connection: Keep-Alive

Cookie: GUID=D6GSGG2Kzob4wyqYY/ZjTc3QLTfJ7TTANsYTw2HnqlBAiVD0Cp9KgShLuqbtXISBZAUykRgloHrSVpQLlow=|a|1418901882.6904; _S=gjr680gn9t9ok4q1vrfp6m1va7; QiHooGUID=AB07EC1F91655B6DFA07CA13879ABF9F.1418901882693

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 11:24:48 GMT

Content-Type: application/x-javascript

Content-Length: 166

Last-Modified: Wed, 17 Dec 2014 05:20:42 GMT

Connection: keep-alive

ETag: "549112aa-a6"

Expires: Sun, 13 Dec 2015 11:24:48 GMT

Cache-Control: max-age=31104000

Accept-Ranges: bytes

(function(e,t){typeof exports=="object"?module.exports=t():typeof define=="function"&&define.amd?define([],t):e.MODULE_A=t()})(this,function(){return So.web.storage})....

GET /resource/js/weather.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.so.com

Connection: Keep-Alive

Cookie: GUID=D6GSGG2Kzob4wyqYY/ZjTc3QLTfJ7TTANsYTw2HnqlBAiVD0Cp9KgShLuqbtXISBZAUykRgloHrSVpQLlow=|a|1418901882.6904; _S=gjr680gn9t9ok4q1vrfp6m1va7; QiHooGUID=AB07EC1F91655B6DFA07CA13879ABF9F.1418901882693; __guid=15484592.752027968357827800.1418883337831.3481; count=2

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 11:24:50 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 17 Dec 2014 05:20:42 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Sun, 13 Dec 2015 11:24:50 GMT

Cache-Control: max-age=31104000

Content-Encoding: gzip

e18.............Z[o...~.....%U.M]H]i.H[4h.-.Y..1.#.PbB../v.......^-.N./E..:..~g.pF....\....2q...?.L,..t.H.^.[I_d..Q..c.............]....b._LQ .......]..fX...v.m..X....m.e.....E.x.V...6.7.H..Y.......\&..~.....8]..i.....z..%H......g..DA......8...nE..N..R=s.Qh.G.uw.....s..^v...5.."M.m-..ru...)Of".55.f%........&.w...N&......:..W..S>...Sn.G...v....(H5.gA.J.c....M<...s...S....J."*......K..R|.."u.`.-.Z....h..G..Sn....P .2D*C...........I|.D....Zx|..d.......pM.......%|.gY......j.[......?a]HT....a.4...4....2.;W.V......X........<,.............o..#...8.......[SSi..N....2..-..'...6.-w.....g`...W..Jk....8o{..%......Ki.I2.~/#.....x..;.........e.......... P.........g..3...\..z.........Oj.PS. ...p....p......F.._...U../.Z..,)p...PRk.5.(.<.....bA.9)..h..F..;.=.3..../.......D..[.!.;..e..?.m./..",#X.$=i.......a...$.!..-I........8:.....rH...Gb...GM[.2...d.g.F.~k./.{.!..!.G............. .cuO...r.Q....s..O...j..{r!u\....>.%......4.p).?..s.5.]W.iK.3idP..13.8...qe........).F.].........r..)......$....y.....A.........c.b,.9."\...<... Rw8.@.t...M...........6......O...I...tjD.fKp.h.....m..{................(.m.....)).7.@.z..ns...$.}.#.)Y7"............N....)...}.....<Ik.q~....LX...}...'.....r..@.F!.6.....................Fk!.=[..l-S#.VU.h..F......C$ gd^..3.....G'h; (.U..T.1..w....)....>.7zn ^0.G............&y..!../Y.3..)RO.....m1k0(...r...)..........W. {F...C....a.:@.h.....,....m...so.........."....x:tM..(v_.7...pb.....|.....p2.i.|@1...>........U.<.Q.^.........f..l..4...Z.S .2.W.t...7;O....[.}..s...(........>..

<<< skipped >>>

GET /d/inn/774669ac/t01bc32feb0bbb5c4e0.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p7.qhimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 34364

Connection: keep-alive

Server: nginx

Date: Thu, 04 Dec 2014 11:26:35 GMT

X-Powered-By: PHP/5.4.25

Last-Modified: Tue, 04 Nov 2014 03:49:01 GMT

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Accept-Ranges: bytes

X-Varnish: 527293823 759625852

X-Varnish-Hits: 912

X-Varnish-Cache: HIT

Age: 3828945

X-Cache: Hit from cloudfront

Via: 1.1 2b0986af7f8d32d3d4b4cf9330702abf.cloudfront.net (CloudFront)

X-Amz-Cf-Id: LVwhtw0MHRK41aVb5UnGZ8A1vaiCHnXcBj7Vu5tAYLBp0mmfzQpwMg==

.PNG........IHDR.......D.....l..{....gAMA......a.....IDATx..}.....>,.. e....{ro"..\..bnn.&1X..D.......k4.d-QLL.h.F....(..... * U.7............g........~.of.r.s..........]O<...K.R.A..A.I..M..T*.&.m....R.0. .. .$.....=.B.P(..%.(.QM.A.P(.....B.P(.....B.P(.....B.P(.....B.P($.$....B.PH8(...B..pP(...B!. ..P(...B.A.P(.....B.P(.....B.P(.....B.P(.......B.P($....B.PH8(...B..p.pP(...B!..P(...B.A.P(...B.A.P(.....B.P(.......B.P(.....B.P($....B.PH8H8(...B..pP(...B!..P(...B!..P(...B.A.P(.......B.P(.....B.P(.....B.P($.$....B.PH8(...B..pP(...B..pP(...B!..P(...B.A.A.P(.....B.P(.J.#.Ov.DN".. ..H......:.7.c.o.A..A..#.F:.... .. ..H.n..q.G..6..K!.. ..........B.P(..%k!..P(...B.A.P(......8...A..A..... .. H8.. .. . .. .. . .. .... .. .r$.I.T.m.v.y..}.(...B.$.6q ....c)o..B.P(.,.G.^*.U...B.Pr .....VQ(...B!..P(...B.A.P(.......B.P(.....B.P(.....B.P(.....B.P($....B.PH8H8(...B..pP(...B!..P(...B.A.A.P(.....B.P(.....B.P(.....B.P(.....B.P($.$....B.PH8(...B..pP(...B!. ..P(...B.A.P(.....B.P(.....B.P(.....B.P(.......B.P($....B.PH8(...B..p.pP(...B!..P(...B.A.P(...B.A.P(.....B.P(.......B.P(.....B.P($....B.P($....B.PH8(...B..pP(...B..pP(...B)#..}..Ox.(...B...p..3..!..x.(...B...p..hPc.. .. ."...T.%..8...,. .. ."&..*.....B.P(.....B.P(.....B.P(.VB8..D..A....x... .. . .. .... .f..Ou. .....@.eL....A.A.$.$..A.p...7...`.A...%. .B.o...m.....[.|.>c;..Qr.....fB..!d#.H...A...].c..../.>..Y.... . b....$..A..ve@3.J......~.............X.'. .`.^....D..y.....Z..[....f....o.u... .U.!...<#Z......)..Y(.n..08\m...b...G.(.x_.......V..7o.T...f[.......>[.l

<<< skipped >>>

GET /t01f9ee1b0873023e36.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p8.qhimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 120690

Connection: keep-alive

Server: nginx

Date: Mon, 15 Dec 2014 15:44:51 GMT

X-Powered-By: PHP/5.4.25

Last-Modified: Tue, 04 Nov 2014 04:57:46 GMT

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Accept-Ranges: bytes

X-Varnish: 2333160832 1472142231

X-Varnish-Hits: 983

X-Varnish-Cache: HIT

Age: 3824823

X-Cache: Hit from cloudfront

Via: 1.1 f519cbbbbf1657343dde8ed4d32a9966.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 18VQhz3HNMLQaZmfpqS-MqsmKs2ziWLSOyVdCytEmLC0Twh1FdWT9Q==

......JFIF.....d.d......Ducky.......K.....*hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC Macintosh" xmpMM:InstanceID="xmp.iid:6D2604E7E55811E3BAC2DBF19BF21405" xmpMM:DocumentID="xmp.did:6D2604E8E55811E3BAC2DBF19BF21405"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6D2604E5E55811E3BAC2DBF19BF21405" stRef:documentID="xmp.did:6D2604E6E55811E3BAC2DBF19BF21405"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................................@.....................................................................................!..1A.Qaq......"......2..BR#.b.r..3..CS$...45....................!..1A.a..Qq."..2.....B#..R..r3.b.C$.............?...A.C......k..[......%....ND.......W.........I.... ..<.URH...i.(9...V.u......^. ......J....Ye....M.U.. ..n..fcV..7..Q .d.:.....,...P._.p..R...k.A.~._y.U..J..`'...$....V..$..(&.Y.A]...#9R... ...`,...D........^..=..I.K.....$.K.qEN....d.{.......9.H$.A-nJ.2..2/d..{...dMz..

<<< skipped >>>

GET /mod_recommend_search/GetRemindMessage?from=so_home&callback=So.web.card.setData&count=0&start=0&mid=&guid=10O6rJjFz/p6YH8MVNOgwLYVLm1RbYStawnPyJ04G4X/0=&qid=&_=1418883337315 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.so.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: rec.api.so.com

Connection: Keep-Alive

Cookie: __huid=10O6rJjFz/p6YH8MVNOgwLYVLm1RbYStawnPyJ04G4X/0=

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Dec 2014 11:24:52 GMT

Content-Type: text/plain; charset=UTF-8

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

Content-Encoding: gzip

92............m....1.D.E.. .........d.-....y..............v..._....W...3....|1 #i.B?...$..X&...x.*.K..o{....&..K_..r[mB.XO5.....l)..Ryg %..to..ee......0..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1636:

.text

.rdata

@.data

.rsrc

t$(SSh

~%UVW

u$SShe

wininet.dll

user32.dll

kernel32.dll

ntdll.dll

OLEACC.DLL

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

MsgWaitForMultipleObjects

hXXp://VVV.so.com

VVV.so.com

QQ.exe

hXXp://pt.3g.qq.com/handleLogin?sid=

&submitlogin=Ã©Â©Â¬Ã¤Â¸Å Ã§â„¢Â»Ã¥Â½â€¢

&bid_code=qqchatLogin&bid=0&rip=

&hexp=true&auto=0&loginTitle=Ã¦â€°â€¹Ã¦Å“ÂºÃ¨â€¦Â¾Ã¨Â®Â¯Ã§Â½â€˜&q_from=&modifySKey=1&q_status=20&r=20849&loginType=3&login_url=http://pt.3g.qq.com/s?aid=nLoginAdv&extend=http://vc.gtimg.com/491X76ZK4SKZYDKBSJ7SJPNB1YYYYQXG&r_sid=

?Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

http=

HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Content-Type: application/x-www-form-urlencoded

hXXp://

hXXp://pt.3g.qq.com/s?aid=nLoginAdv/s?aid=nLoginAdv

hXXp://pt.3g.qq.com/handleLogin?aid=nLoginHandle&sid=

&loginType=3&modifySKey=1&loginsubmit=Ã§â„¢Â»Ã¥Â½â€¢

login_url=http://pt.3g.qq.com/s?aid=nLoginAdv&sidtype=1&q_from=&qq=

hXXp://VVV.raadc.com/ca.txt

Msg2.0.db

password

Adobe Photoshop CS5 Windows

2014:03:22 16:47:37

urlTEXT

MsgeTEXT

hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?>

2014:02:23 13:16:05

" id="W5M0MpCehiHzreSzNTczkc9d"?>

2014:02:23 13:15:33

" id="W5M0MpCehiHzreSzNTczkc9d"?>

2014:03:09 04:43:13

" id="W5M0MpCehiHzreSzNTczkc9d"?>

2014:03:03 09:16:25

`hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?>

2014.03.21

2014.03.20

2014:03:23 13:34:13

" id="W5M0MpCehiHzreSzNTczkc9d"?>

@E%UN^

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

ole32.dll

__MSVCRT_HEAP_SELECT

RASAPI32.dll

iphlpapi.dll

SHLWAPI.dll

MPR.dll

WINMM.dll

WS2_32.dll

VERSION.dll

GetProcessHeap

WinExec

KERNEL32.dll

GetKeyState

EnumWindows

USER32.dll

GetViewportOrgEx

GDI32.dll

WINSPOOL.DRV

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

OLEAUT32.dll

COMCTL32.dll

oledlg.dll

WSOCK32.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

GetCPInfo

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

(*.htm;*.html)|*.htm;*.html

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

VVV.dywt.com.cn

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

zcÃ

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

{{{90.90.90.90.90.90.90.90.90.90.101101101101101101101101101101101101101101101&%)NMN

sssh:'

1181532

20140309043727

(*.*)

9.4.5.2032

%original file name%.exe_1636_rwx_00401000_00095000:

t$(SSh

~%UVW

u$SShe

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps