Trojan.Generic.12136312_dcba2ed4ac – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Generic.12136312 (AdAware), Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, GenericPhysicalDrive0.YR, TrojanFlyStudio.YR, BankerGeneric.YR (Lavasoft MAS)Behaviour: Banker, Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: dcba2ed4acce13ede72346bfd6b6558e

SHA1: 74fcbb4743600290e03cecfc5a57fe0c5fd4b148

SHA256: c67b0905e27498d2cd1a3090a606d7895f8c9c125b1e34531c05ef46d791bbf6

SSDeep: 98304:bMwIhogt3IY3SNK/G9tFhy5aMPyxksSV41AynV0QZ7WZGOOBgF:SKNK8OFPfJ YQFWZGOOSF

Size: 3518464 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6, ACProtect141

Company: Slsysernaint

Created at: 2014-11-11 18:06:18

Analyzed on: WindowsXPESX SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:1328

Mutexes

The following mutexes were created/opened:

!IETld!MutexZonesLockedCacheCounterMutexZoneAttributeCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexWininetConnectionMutexWininetProxyRegistryMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_CTF.TimListCache.FMPDefaultS-1-5-21-796845957-1563985344-1801674531-1003MUTEX.DefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.TMD.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003RasPbFileShimCacheMutex

File activity

The process %original file name%.exe:1328 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\EV1E2DS7.txt (104 bytes)
C:\PEAS.dll (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\7cd4bb31f0c2d21481f1a7cd[1].htm (2794 bytes)

Registry activity

The process %original file name%.exe:1328 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 8B DE 69 21 2C CA FA B0 0D 73 29 09 50 E8 03"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1176x885x32(BGR 0)" = "31,31,31,31"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
dcb43d7518b4ee8eee47eb561ce50020	c:\PEAS.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\EV1E2DS7.txt (104 bytes)
C:\PEAS.dll (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\7cd4bb31f0c2d21481f1a7cd[1].htm (2794 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ????????
Product Version: 2.1.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.1.0.0
File Description: ????????
Comments: ????????
Language: Language Neutral

Company Name: Product Name: ????????Product Version: 2.1.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 2.1.0.0File Description: ????????Comments: ????????Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1050582	1052672	5.05155	48b2c204d7e66cde2e112499efb71d1d
.rdata	1056768	2240132	2240512	4.51283	1d620ba686b855a2c7e178ff275a1659
.data	3297280	369194	94208	4.55022	0467840c3f6ed0e092ef611f581e7757
.rsrc	3670016	126064	126976	3.56433	4307ca1b105428f2737ddd7b37cd3482

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://hi.n.shifen.com/vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd
hxxp://www.peasyun.com/Api-V1-gettime	61.160.224.238
hxxp://www.peasyun.com/Api-V1-setup	61.160.224.238
hxxp://www.peasyun.com/Api-V1-info	61.160.224.238
hxxp://hi.baidu.com/vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd	180.76.2.41

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /Api-V1-gettime HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31

Accept: */*

Host: VVV.peasyun.com

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Dec 2014 00:32:40 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Vary: Accept-Encoding

X-Powered-By: PHP/5.4.24

Set-Cookie: PHPSESSID=2911vrfkq2eevmclfcgdusu7p4; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: loingran=NZKOMy; path=/

6..NZKOMy..0......

POST /Api-V1-setup HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31

Accept: */*

Host: VVV.peasyun.com

Content-Length: 118

Cookie: PHPSESSID=2911vrfkq2eevmclfcgdusu7p4; loingran=NZKOMy; path=/

Content-Type: application/x-www-form-urlencoded

Cache-Control: no-cache

mac=45254AF5E44F9BEDB2240FE25FE113D7&api_version=1.0&appid=1645499&appkey=78848E165471ACDBAF6F54C52EE9196A&version=3.6

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Dec 2014 00:32:41 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Vary: Accept-Encoding

X-Powered-By: PHP/5.4.24

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: gettim=1418862761; path=/

Set-Cookie: mac=45254AF5E44F9BEDB2240FE25FE113D7; path=/

Set-Cookie: appid=1645499; path=/

Set-Cookie: appkey=78848E165471ACDBAF6F54C52EE9196A; path=/

Set-Cookie: version=3.6; path=/

1..1..0......

GET /Api-V1-gettime HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31

Accept: */*

Host: VVV.peasyun.com

Cookie: PHPSESSID=2911vrfkq2eevmclfcgdusu7p4; loingran=NZKOMy; gettim=1418862761; mac=45254AF5E44F9BEDB2240FE25FE113D7; appid=1645499; appkey=78848E165471ACDBAF6F54C52EE9196A; version=3.6; path=/

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Dec 2014 00:32:41 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Vary: Accept-Encoding

X-Powered-By: PHP/5.4.24

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

6..NZKOMy..0......

POST /Api-V1-info HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31

Accept: */*

Host: VVV.peasyun.com

Content-Length: 118

Cookie: PHPSESSID=2911vrfkq2eevmclfcgdusu7p4; loingran=NZKOMy; gettim=1418862761; mac=45254AF5E44F9BEDB2240FE25FE113D7; appid=1645499; appkey=78848E165471ACDBAF6F54C52EE9196A; version=3.6; path=/

Content-Type: application/x-www-form-urlencoded

Cache-Control: no-cache

mac=45254AF5E44F9BEDB2240FE25FE113D7&api_version=1.0&appid=1645499&appkey=78848E165471ACDBAF6F54C52EE9196A&version=3.6

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Dec 2014 00:32:41 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Vary: Accept-Encoding

X-Powered-By: PHP/5.4.24

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: mac=45254AF5E44F9BEDB2240FE25FE113D7; path=/

Set-Cookie: appid=1645499; path=/

Set-Cookie: appkey=78848E165471ACDBAF6F54C52EE9196A; path=/

Set-Cookie: version=3.6; path=/

4d...........-.........::4.1::......hXXp://url.cn/XWl1Qb............::::1::220::0..0..

GET /vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd HTTP/1.1

Referer: hXXp://hi.baidu.com/vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: hi.baidu.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Set-Cookie: BAIDUID=E2AECF08AD89E76E3264D70A9F6316EB:FG=1; max-age=31536000; expires=Fri, 18-Dec-15 00:32:37 GMT; domain=.baidu.com; path=/; version=1

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Set-Cookie: CANAL=101; path=/; domain=.hi.baidu.com

Content-type: text/html

Transfer-Encoding: chunked

Connection: close

Date: Thu, 18 Dec 2014 00:32:38 GMT

Server: apache

fe7.. <!DOCTYPE html><html id="customDoc"> <head> <meta http-equiv=Content-Type content="text/html; charset=utf-8"> <title> ............1_....................._............</title> <link rel="shortcut icon" href="hXXp://hi.bdimg.com/static/qbase/img/mod/16_favicon.ico?v=116ba471.ico" type=image/x-icon> <meta name=keywords content="............1,"> <meta name=description content=",............1"><script>window.wpo={start:new Date*1,pid:109,page:'qing'}</script><script>window.qDomain={"qing":"hXXp://hi.baidu.com","static":"hXXp://hi.bdimg.com","passport":"hXXps://passport.baidu.com","portrait":"hXXp://tx.bdimg.com","hiup":"hXXp://hi.baidu.com","photo":"hXXp://hiphotos.baidu.com","message":"hXXp://msg.baidu.com","friend":"hXXp://frd.baidu.com","mp3":"hXXp://mp3.baidu.com","ting":"hXXp://ting.baidu.com","image":"http://img.baidu.com","qup":"hXXp://upload.hi.baidu.com","www":"hXXp://VVV.baidu.com"};window.qUserInfo={"userName":"............","nickname":"............","portrait":"c222766c74676d777964696e6261627871274f","qingUrl":"\/vltgmwydinbabxq","spaceName":".....................","right

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1328:

.text

.rdata

@.data

.rsrc

t%SVh

t$(SSh

~%UVW

u$SShe

PEAS.dll

wininet.dll

ole32.dll

kernel32.dll

shlwapi.dll

rasapi32.dll

ADVAPI32.DLL

advapi32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

MsgWaitForMultipleObjects

&password=

/PEAS.dll

`.rdata

@.reloc

SSShl

.QZ^&

~$)~()|$

SSSSh

t'SShl

j%XtL9E

FtPW

SSh@B

FTCP

tAHt.HHt

@ SSHPWj

tWSShW

tl9_ tgSSh

CNotSupportedException

%s (%s:%d)

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

KERNEL32.DLL

%s%s.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

lX-X-x-XX-XXXXXX

RegOpenKeyTransactedA

Advapi32.dll

RegCreateKeyTransactedA

RegDeleteKeyTransactedA

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

comctl32.dll

comdlg32.dll

shell32.dll

CCmdTarget

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl

RegDeleteKeyExA

lXXxXXXXXXXX

Shell32.dll

%s:%x:%x:%x:%x

user32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

commctrl_DragListMsg

CMDITabProxyWnd

CMDIChildWndEx

CMDIFrameWndEx

%sMFCToolBar-%d%x

%sMFCToolBar-%d

%sMFCToolBarParameters

TOOLBAR_RESETKEYBAORD

KeyboardManager

MSG_CHECKEMPTYMINIFRAME

%sDockingManager-%d

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

CMDIChildWnd

CMDIFrameWnd

&%d %s

CMDIClientAreaWnd

%sMDIClientArea-%d

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp

%sBasePane-%d%x

%sBasePane-%d

%sPane-%d%x

%sPane-%d

windows

ShowCmd

Hex={X,X,X}

%sMFCOutlookBar-%d%x

%sMFCOutlookBar-%d

MFCLink_UrlPrefix

MFCLink_Url

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

%c%d%c%s

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp

%sDockablePaneAdapter-%d%x

%sDockablePaneAdapter-%d

ENABLE_KEYS

KEYS_MENU

KEYS

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp

CMFCToolBarsKeyboardPropertyPage

RGB(%d, %d, %d)

%sMFCTasksPane-%d%x

%sMFCTasksPane-%d

operator

GetProcessWindowStation

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31

HTTP/1.1 302 Found

Set-Cookie: %s

HaiOu ProxyHttp

HTTP/1.1

Host: %s

CPUID:%s

DISK:%s

MAC:%s

MD5:%s

hXXp://VVV.peasyun.com/Api-V1-gettime

hXXp://VVV.peasyun.com/Api-V1-

appkey

%s%s%s

mac=%s&api_version=%s&appid=%s&appkey=%s&version=%s

: this object doesn't support resynchronization

StreamTransformation: this object doesn't support random access

XXXXXX

: this object does't support a special last block

: this object doesn't support multiple channels

is not a valid key length

?#%X.y

E:\Visual Studio 2010\Projects\AuthorAPI\Release\PEAS.pdb

GetCPInfo

GetWindowsDirectoryA

KERNEL32.dll

UnhookWindowsHookEx

GetKeyState

SetWindowsHookExA

GetAsyncKeyState

MapVirtualKeyA

GetKeyboardLayout

GetKeyboardState

CreateDialogIndirectParamA

GetKeyNameTextA

MapVirtualKeyExA

USER32.dll

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportOrgEx

GDI32.dll

MSIMG32.dll

COMDLG32.dll

WINSPOOL.DRV

RegOpenKeyExA

RegCloseKey

RegEnumKeyA

RegCreateKeyExA

RegDeleteKeyA

RegEnumKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

COMCTL32.dll

UrlUnescapeA

SHLWAPI.dll

OLEAUT32.dll

NETAPI32.dll

HttpAddRequestHeadersA

HttpSendRequestExA

HttpEndRequestA

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

GdiplusShutdown

gdiplus.dll

OLEACC.dll

IMM32.dll

WINMM.dll

.PAVCOleException@@

.PAVCException@@

.PAVCObject@@

.PAVCMemoryException@@

.PAVCSimpleException@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.?AVCCmdTarget@@

.PAVCArchiveException@@

.PAVCFileException@@

.?AVCCmdUI@@

.PAVCResourceException@@

.PAVCUserException@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDV12@PBD@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCDocument@@PAV3@@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD_N_N@@

.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@

.?AVCTestCmdUI@@

.?AVCMDITabProxyWnd@@

.?AVCMDIChildWndEx@@

.?AVCMDIChildWnd@@

.?AVCMDIFrameWndEx@@

.?AVCMDIFrameWnd@@

.?AVCMFCToolBarCmdUI@@

.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@

.?AVCMDIClientAreaWnd@@

.?AVCMFCRibbonCmdUI@@

.?AVCMFCCmdUsageCount@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCObList@@PAV3@@@

.?AVCMFCColorBarCmdUI@@

.?AV?$CMap@KKV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@

.?AVCMFCAcceleratorKey@@

.?AVCMFCRibbonKeyTip@@

.?AVCMFCToolBarsKeyboardPropertyPage@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDHH@@

.?AVCMFCTasksPaneToolBarCmdUI@@

.?AVCMFCAcceleratorKeyAssignCtrl@@

zcÃ

.?AVHexEncoder@CryptoPP@@

.?AV?$VariableKeyLength@$0BA@$0BA@$0CA@$07$03$0A@@CryptoPP@@

.?AVSimpleKeyingInterface@CryptoPP@@

.?AV?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@

.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@

.PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@

.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@

.?AVInvalidKeyLength@CryptoPP@@

truePPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING

6(636_6~6

8"9(92989

4#4 4>425`5

7)7.737=7^7

3%4S4[4

%0H0{0A1V1=3

8-9K9Y9}9

6.646

9%9u9

01171>1|1

3=3}3

7#7'7 7/737

2&3.363>3~3

6 6$686

> >$>(>,>

1 1$1(1,101

:(:0:<:>

4 4(404

1$10141

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

https

hXXps://

hXXp://

Adodb.Stream

meilishuo.com

hXXp://VVV.meilishuo.com/user/login

hXXp://VVV.meilishuo.com/aj/doota/cart_number

login_name=

hXXps://account.meilishuo.com/aw/user/logon

MEILISHUO_GLOBAL_KEY=

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

hXXp://order.meilishuo.com/aj/doota/address_add

hXXp://order.meilishuo.com/address/

rs.goods = {"id" : "

hXXp://order.meilishuo.com/coupon/

&shop_coupon[0][coupon_id]=

&shop_coupon[0][shop_id]=

&amount=1&color=Ã©Â¢Å“Ã¨â€°Â²__

.zz.6__0.1.1.3.r_hdtpairbuy.t_shop.abtest_1.ot_

&weixin_coupon=0&source=4-0.0.1&goods_pid=pc.

hXXp://order.meilishuo.com/order/create/

&color=Ã©Â¢Å“Ã¨â€°Â²__

.zz.&goods_id=

hXXp://order.meilishuo.com/order/weixin_pay/?order_id=

Referer: hXXp://order.meilishuo.com/order/init/?goods_pid=pc.

hXXp://order.meilishuo.com/order/detail/?order_id=

VVV.baidu.com

hXXp://order.meilishuo.com/cart

hXXp://order.meilishuo.com/cart/del/

source=5-0.0.1&goods_pid=wap.

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A405 Safari/8536.25

hXXp://m.meilishuo.com/aw/doota/addToCarts

hXXp://order.meilishuo.com/order?status=1

%du2$"

.unOZ

hXXp://hi.baidu.com/vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd

1645499

hXXp://VVV.meilishuo.com/share/item/

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

MSVCRT.dll

MSVFW32.dll

SkinH_EL.dll

hXXp://VVV.ip138.com

\Microsoft\Network\Connections\pbk\rasphone.pbk

@PEAS.dll

112891406)

112891406

2014-09-09 01:12

140909612861

Adobe Photoshop CS4 Windows

2014:09:09 01:08:18

urlTEXT

MsgeTEXT

-hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?>

IEC hXXp://VVV.iec.ch

.IEC 61966-2.1 Default RGB colour space - sRGB

CRT curv

>1.2.18

%*.*f

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

MSWHEEL_ROLLMSG

__MSVCRT_HEAP_SELECT

RASAPI32.dll

AVIFIL32.dll

iphlpapi.dll

MPR.dll

WS2_32.dll

VERSION.dll

GetProcessHeap

WinExec

WLDAP32.dll

(*.prn)|*.prn|

(*.*)|*.*||

Mpr.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

\\.\Scsi0:

\\.\PhysicalDrive0

%s:%d

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

(*.avi)|*.avi

1.2.18

WPFT532.CNV

WPFT632.CNV

EXCEL32.CNV

write32.wpc

Windows Write

mswrd632.wpc

Word for Windows 6.0

wword5.cnv

Word for Windows 5.0

mswrd832.cnv

mswrd632.cnv

Word 6.0/95 for Windows & Macintosh

html32.cnv

1.1.3

NULL row buffer for row %ld, pass %d

libpng error: %s

libpng error: %s, offset=%d

libpng error no. %s: %s

libpng warning: %s

libpng warning no. %s: %s

keywords

Unknown zTXt compression type %d

Incomplete compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

gamma = (%d/100000)

gx=%f, gy=%f, bx=%f, by=%f

wx=%f, wy=%f, rx=%f, ry=%f

incorrect gamma=(%d/100000)

iTXt chunk not supported.

VVV.dywt.com.cn

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

SHELL32.DLL

dwmapi.dll

UxTheme.dll

accKeyboardShortcut

hhctrl.ocx

USER32.DLL

RICHED20.DLL

ekernel32.dll

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

(*.*)

1, 0, 6, 6

- Skin.dll

(*.*)

2.1.0.0

%original file name%.exe_1328_rwx_00401000_00101000:

t%SVh

t$(SSh

~%UVW

u$SShe

%original file name%.exe_1328_rwx_10000000_0003E000:

`.rsrc

L$(h%f

SSh0j

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ã

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1, 0, 6, 6

- Skin.dll