Gen.Variant.Symmi.37703_a43066ec5a

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:684

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_RasPbFileShimCacheMutex

File activity

The process %original file name%.exe:684 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\favicon[1].ico (1 bytes)

Registry activity

The process %original file name%.exe:684 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1024x768x32(BGR 0)" = "31,31,31,31"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E8 B1 E3 C3 01 92 52 39 B3 E4 DD 03 43 4A B3 1F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\favicon[1].ico (1 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: ??????
Product Name: ????
Product Version: 2.2.12.17
Legal Copyright: ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.2.12.17
File Description: ????
Comments: bate
Language: Language Neutral

Company Name: ??????Product Name: ????Product Version: 2.2.12.17Legal Copyright: ???????? Legal Trademarks: Original Filename: Internal Name: File Version: 2.2.12.17File Description: ????Comments: bateLanguage: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	1802240	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	1806336	1568768	1566720	5.45442	8f19b5d9fa04707914cce70721068274
.rsrc	3375104	60537	21504	3.30759	cf3a2948be53a4d969d0c34e81510a7e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://180.178.42.44/up.txt
hxxp://www-b.360.cn/favicon.ico
hxxp://www.360.cn/favicon.ico	106.120.167.66
hxxp://api.soho1z.com/up.txt

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /favicon.ico HTTP/1.1

Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: hXXp://VVV.360.cn/favicon.ico

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: VVV.360.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Tue, 02 Dec 2014 02:10:15 GMT

Content-Type: image/x-icon

Content-Length: 1150

Last-Modified: Fri, 11 Jul 2014 04:58:04 GMT

Connection: close

Accept-Ranges: bytes

............ .h.......(....... ..... .....@.....................................X6.....p...s...y............23..........................G..c...U...b...s...t....X...........p.../...B...............M..h...i.... ...!...t.................$.../...".....N...........&...G...A..y%................................................9..I...h...-..............tD..qD............................3.............................Q...P...........................................................T...T...............................................zD..V...[...[...X...R...O...lD.........................*...P....}>..]...`...b...[...T...L...g>.........................Z...............Q....b...[......................................v...............o....^...Z.................................<....[.............

GET /up.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: api.soho1z.com

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Date: Tue, 02 Dec 2014 02:10:10 GMT

Server: Apache

Content-Length: 323

Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /up.txt was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>...

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_684:

`.rsrc

`.rsrc

K>%un

K>%un

t%SVh

t%SVh

t$(SSh

t$(SSh

~%UVW

~%UVW

u$SShe

u$SShe

kernel32.dll

kernel32.dll

wininet.dll

wininet.dll

gdiplus.dll

gdiplus.dll

ole32.dll

ole32.dll

user32.dll

user32.dll

advapi32.dll

advapi32.dll

GdiPlus.dll

GdiPlus.dll

Kernel32.dll

Kernel32.dll

Ole32.dll

Ole32.dll

User32.dll

User32.dll

Wininet.dll

Wininet.dll

gdi32.dll

gdi32.dll

Gdi32.dll

Gdi32.dll

dwmapi.dll

dwmapi.dll

Gdiplus.dll

Gdiplus.dll

imm32.dll

imm32.dll

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

HttpOpenRequestA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

GdiplusShutdown

GdiplusShutdown

ExitWindowsEx

ExitWindowsEx

EnumWindows

EnumWindows

InternetOpenUrlA

InternetOpenUrlA

GetKeyState

GetKeyState

GdipGetStringFormatHotkeyPrefix

GdipGetStringFormatHotkeyPrefix

GdipSetStringFormatHotkeyPrefix

GdipSetStringFormatHotkeyPrefix

{E5000198-4471-40e2-92BC-D0BA075BDBB2}

{E5000198-4471-40e2-92BC-D0BA075BDBB2}

.

.

.dbXM3

.dbXM3

Adobe Photoshop CS5 Windows

Adobe Photoshop CS5 Windows

2013:06:18 18:59:41

2013:06:18 18:59:41

/Vy.bs

/Vy.bs

urlTEXT

urlTEXT

MsgeTEXT

MsgeTEXT

hXXp://ns.adobe.com/xap/1.0/

hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

.ZGfg

.ZGfg

WMsG

WMsG

T 0.QQS

T 0.QQS

Y.wuG

Y.wuG

2013:06:21 21:17:29

2013:06:21 21:17:29

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

/.jG=

/.jG=

.zUI%C

.zUI%C

2013:10:19 16:11:49

2013:10:19 16:11:49

Cy-f}

Cy-f}

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

k.uYz

k.uYz

#4V%F

#4V%F

2013:06:21 21:19:02

2013:06:21 21:19:02

)hXXp://ns.adobe.com/xap/1.0/

)hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

2013:07:20 17:08:32

2013:07:20 17:08:32

m}.cYV

m}.cYV

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

a1$%CIia

a1$%CIia

U%S]W

U%S]W

2013:06:18 18:59:28

2013:06:18 18:59:28

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

k%ur=!

k%ur=!

2013:06:18 18:58:18

2013:06:18 18:58:18

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

2013:08:06 15:47:01

2013:08:06 15:47:01

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

IEC hXXp://VVV.iec.ch

IEC hXXp://VVV.iec.ch

.IEC 61966-2.1 Default RGB colour space - sRGB

.IEC 61966-2.1 Default RGB colour space - sRGB

CRT curv

CRT curv

/vipuser/index.php/User/verify

/vipuser/index.php/User/verify

hXXp://

hXXp://

hXXps://

hXXps://

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

http=

HTTP/1.1

HTTP/1.1

Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

{557CF400-1A04-11D3-9A73-0000F81EF32E}

{557CF400-1A04-11D3-9A73-0000F81EF32E}

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{557CF402-1A04-11D3-9A73-0000F81EF32E}

{557CF402-1A04-11D3-9A73-0000F81EF32E}

{557CF405-1A04-11D3-9A73-0000F81EF32E}

{557CF405-1A04-11D3-9A73-0000F81EF32E}

{557CF406-1A04-11D3-9A73-0000F81EF32E}

{557CF406-1A04-11D3-9A73-0000F81EF32E}

2013:06:18 18:57:54

2013:06:18 18:57:54

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

H.CU)4`

H.CU)4`

C:\Windows\sb250.jpgSoftware\Microsoft\Windows\CurrentVersion\Explorer\Logon User Name

C:\Windows\sb250.jpgSoftware\Microsoft\Windows\CurrentVersion\Explorer\Logon User Name

hXXp://VVV.360.cn/favicon.ico

hXXp://VVV.360.cn/favicon.ico

2013:06:15 18:05:08

2013:06:15 18:05:08

#hXXp://ns.adobe.com/xap/1.0/

#hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

%Fh[?753.

%Fh[?753.

2013:06:15 18:05:39

2013:06:15 18:05:39

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

VVV.meitu.com

VVV.meitu.com

.LofE

.LofE

,-ß

,-ß

:".Ll

:".Ll

.vkB5

.vkB5

&CRrtMbcs

&CRrtMbcs

/vipuser/index.php/User/userinfo

/vipuser/index.php/User/userinfo

2013:06:18 18:58:06

2013:06:18 18:58:06

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

].UW:

].UW:

hXXp://ka.soho1z.com

hXXp://ka.soho1z.com

hXXp://998pay.com/rh.php

hXXp://998pay.com/rh.php

/card/buy/result2.asp?num=

/card/buy/result2.asp?num=

/card/buy/AutoSendGoods.asp?OrderID=

/card/buy/AutoSendGoods.asp?OrderID=

/vipuser/index.php/User/index

/vipuser/index.php/User/index

&dianshu=提交点数

&dianshu=提交点数

Msg2.0.db

Msg2.0.db

hXXp://iframe.ip138.com/ic.asp

hXXp://iframe.ip138.com/ic.asp

hXXp://cgi.im.qq.com/cgi-bin/cgi_svrtime

hXXp://cgi.im.qq.com/cgi-bin/cgi_svrtime

2013:06:21 22:01:27

2013:06:21 22:01:27

" id="W5M0MpCehiHzreSzNTczkc9d"?>

xmp.did:6A115DEC74DAE211AC729AA23E2E7D90

" id="W5M0MpCehiHzreSzNTczkc9d"?>

xmp.did:6A115DEC74DAE211AC729AA23E2E7D90

2013:07:20 17:07:15

2013:07:20 17:07:15

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

2013:06:18 18:56:21

2013:06:18 18:56:21

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

/t.php?u=

/t.php?u=

hXXp://998pay.com/cw.php

hXXp://998pay.com/cw.php

/vipuser/index.php/User/register

/vipuser/index.php/User/register

&button=注册

&button=注册

&password=

&password=

hXXp://VVV.rdcnzz.com/v1/data/link_conv/rd_dispatcher.php?orig_link=

hXXp://VVV.rdcnzz.com/v1/data/link_conv/rd_dispatcher.php?orig_link=

&alias=&access_type=web

&alias=&access_type=web

hXXp://dwz.cn/create.php

hXXp://dwz.cn/create.php

http:\/\/dwz.cn\/

http:\/\/dwz.cn\/

hXXp://dwz.cn/

hXXp://dwz.cn/

hXXp://share.v.t.qq.com/index.php?c=share&a=index&title=&url=

hXXp://share.v.t.qq.com/index.php?c=share&a=index&title=&url=

"shorturl" value="

"shorturl" value="

hXXp://998pay.com/yx.php

hXXp://998pay.com/yx.php

2013:06:18 18:58:40

2013:06:18 18:58:40

v%8U=

v%8U=

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

n.zsL@

n.zsL@

hXXp://cfm4a3.com

hXXp://cfm4a3.com

VVV.3600gz.cn

VVV.3600gz.cn

ds=10&jiandianshu=减少点数

ds=10&jiandianshu=减少点数

10/05/12

10/05/12

\.YVV

\.YVV

Ï[H

Ï[H

L

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

/vipuser/index.php/User/login

2013:06:18 18:58:50

" id="W5M0MpCehiHzreSzNTczkc9d"?> 

2013:10:19 16:09:03

XhXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
 

N.nyD

X".eL 

2013:06:18 18:59:20

" id="W5M0MpCehiHzreSzNTczkc9d"?> 

2013:06:21 22:00:59

" id="W5M0MpCehiHzreSzNTczkc9d"?> 
xmp.did:6A115DEC74DAE211AC729AA23E2E7D90
 
 
 
 

j$r%s

Jr%xS-

@@x.tt

-6O}Y

2013:06:18 18:58:59

" id="W5M0MpCehiHzreSzNTczkc9d"?> 

!s6%C

u%Xv;RQ

q,LTE.KK

/card/buy/step3.asp

&button=ÏÂÒ»²½£¬ÑéÖ¤³äÖµÐÅÏ¢

result2.asp

hXXp://api.soho1z.com/gg.txt

hXXp://api.soho1z.com/up.txt

hXXp://api.soho1z.com/ma.txt

ohXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?> 

)-X}4*

Ex_DirectUI_MsgBox

07/08/13

09/27/12

360Tray.exe360

360sd.exe360

KSafeTray.exe

kxetray.exe

QQPCTray.exeQQ

C:\Windows\QQ.exe

C:\gx.tmp

baidu.com

vdisk.cn

User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)
\up.bat
2013:06:18 18:56:00
].VV6
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
ZS.Zw2
VBScript.RegExp
{6AEDBD6D-3FB5-418A-83A6-7F45229DC872}
bbs.52pk.com CF
hXXp://bbs.52pk.com/forum-1036-1.html
bbs.766.com 766
hXXp://bbs.766.com/forum.php?gid=1594
bbs.duowan.com
hXXp://bbs.duowan.com
bbs.houdao.com
hXXp://bbs.houdao.com
gamebbs.qq.com
hXXp://cf.gamebbs.qq.com/forum.php?mod=forumdisplay&fid=30503
tieba.baidu.com
hXXp://tieba.baidu.com/f?kw=cf
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
~@?)$ 4-|
@?)$ 4-|
~@?)$ 4-|}
2013:06:27 16:55:06
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
m2WWW.
2013:06:21 21:39:34
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
2013:06:12 21:04:24
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
2013:06:16 21:35:16
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
2013:06:16 19:35:28
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
2013:06:15 18:00:07
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
2013:06:15 18:00:30
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
2013:06:14 14:47:26
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
2013:06:14 14:47:52
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
2013:06:21 23:18:57
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
2013:06:21 23:19:12
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
%3Srs
1%XIo#
j-.uG
GWÍ
%DK(Jd
2013:06:12 20:16:00
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
xE,.Hy
.comment {color:green}
2013:06:14 18:04:26
DhXXp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
'.NvG
2013:06:13 11:15:42
~hXXp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
.KTV}
IdE%UI"
2013:06:12 20:20:04
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
2013:07:21 13:51:00
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
"Ig%F
zq.Xhi2
zq.FN
Z%Sl>~4
.oVl1m
.Yj'UOp
l$K(%F
D.Xp.Z
_.yxue9
.JKKBT
x.WXPZ
Z_]\%uU
9.Sq"4
%CZ@Z
Op.mh
2013:06:15 00:00:11
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
dCMdu
z%dV#
"
.Rv|c
O.HO.K
.RR.
 '.ZU
2013:06:14 23:09:22
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
.OV"]U
2013:06:14 14:39:31
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
2013:06:14 14:43:10
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
2013:06:25 23:09:05
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
.K.JZ
U:\or/n
P:\h['
~v.WQH
6GHWIP.EO
JC%S*-
.kJZ_R
.CbY(
F%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
iphlpapi.dll
SHLWAPI.dll
MPR.dll
VERSION.dll
WSOCK32.dll
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.*)|*.*||
Shell32.dll
Mpr.dll
Advapi32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
%d.%d
%d / %d
%d/%d
Bogus message code %d
(%d-%d):
%ld%c
Y%d
X%d
Height%d
Width%d
RECT(%d, %d)-(%d, %d)
Styles0xX
Control ID%d
Handle0xX
%s
burlywood
\winhlp32.exe
VVV.dywt.com.cn
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
%s 
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
The requested URL /up.txt was not found on this server.
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
GetWindowsDirectoryA
WinExec
GetProcessHeap
GetCPInfo
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyExA
RegCloseKey
GetViewportExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetViewportOrgEx
ShellExecuteA
SetWindowsHookExA
UnhookWindowsHookEx
CreateDialogIndirectParamA
InternetCanonicalizeUrlA
InternetCrackUrlA
.text
.rdata
@.data
ADVAPI32.dll
comdlg32.dll
OLEAUT32.dll
RASAPI32.dll
SHELL32.dll
WININET.dll
WINMM.dll
WINSPOOL.DRV
WS2_32.dll
1, 0, 6, 6
- Skin.dll
(*.*)
2.2.12.17
%original file name%.exe_684_rwx_00401000_00336000:
t%SVh
t$(SSh
~%UVW
u$SShe
kernel32.dll
wininet.dll
gdiplus.dll
ole32.dll
user32.dll
advapi32.dll
GdiPlus.dll
Kernel32.dll
Ole32.dll
User32.dll
Wininet.dll
gdi32.dll
Gdi32.dll
dwmapi.dll
Gdiplus.dll
imm32.dll
MsgWaitForMultipleObjects
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
GdiplusShutdown
ExitWindowsEx
EnumWindows
InternetOpenUrlA
GetKeyState
GdipGetStringFormatHotkeyPrefix
GdipSetStringFormatHotkeyPrefix
{E5000198-4471-40e2-92BC-D0BA075BDBB2}
.
.dbXM3
Adobe Photoshop CS5 Windows
2013:06:18 18:59:41
/Vy.bs
urlTEXT
MsgeTEXT
hXXp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
.ZGfg
 WMsG
T 0.QQS
Y.wuG
2013:06:21 21:17:29
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
/.jG=
.zUI%C
2013:10:19 16:11:49
Cy-f}
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
 
k.uYz
#4V%F
2013:06:21 21:19:02
)hXXp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
2013:07:20 17:08:32
m}.cYV
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
a1$%CIia
U%S]W
2013:06:18 18:59:28
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
k%ur=!
2013:06:18 18:58:18
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
2013:08:06 15:47:01
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
IEC hXXp://VVV.iec.ch
.IEC 61966-2.1 Default RGB colour space - sRGB
CRT curv
/vipuser/index.php/User/verify
hXXp://
hXXps://
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
http=
HTTP/1.1
Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Content-Type: application/x-www-form-urlencoded
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
2013:06:18 18:57:54
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
H.CU)4`
C:\Windows\sb250.jpgSoftware\Microsoft\Windows\CurrentVersion\Explorer\Logon User Name
hXXp://VVV.360.cn/favicon.ico
2013:06:15 18:05:08
#hXXp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
%Fh[?753.
2013:06:15 18:05:39
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
VVV.meitu.com
.LofE
,-ß
:".Ll
.vkB5
&CRrtMbcs
/vipuser/index.php/User/userinfo
2013:06:18 18:58:06
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
].UW:
hXXp://ka.soho1z.com
hXXp://998pay.com/rh.php
/card/buy/result2.asp?num=
/card/buy/AutoSendGoods.asp?OrderID=
/vipuser/index.php/User/index
&dianshu=提交点数
Msg2.0.db
hXXp://iframe.ip138.com/ic.asp
hXXp://cgi.im.qq.com/cgi-bin/cgi_svrtime
2013:06:21 22:01:27
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
xmp.did:6A115DEC74DAE211AC729AA23E2E7D90
 
 
 
 
2013:07:20 17:07:15
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
2013:06:18 18:56:21
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
/t.php?u=
hXXp://998pay.com/cw.php
/vipuser/index.php/User/register
&button=注册
&password=
hXXp://VVV.rdcnzz.com/v1/data/link_conv/rd_dispatcher.php?orig_link=
&alias=&access_type=web
hXXp://dwz.cn/create.php
http:\/\/dwz.cn\/
hXXp://dwz.cn/
hXXp://share.v.t.qq.com/index.php?c=share&a=index&title=&url=
"shorturl" value="
hXXp://998pay.com/yx.php
2013:06:18 18:58:40
v%8U=
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
n.zsL@
hXXp://cfm4a3.com
VVV.3600gz.cn
ds=10&jiandianshu=减少点数
10/05/12
\.YVV
Ï[H
L 
.rsrc
%S4WD
hg%fpM
S.Ac9SR
0.I%3s
,wAe.kI
aiUy'4xu
%c*@j
.eH'y
{&%U)
lj%4U
xe%CNs
9F.cLe
hJK.ZH
O.qt0
KERNEL32.DLL
COMCTL32.dll
GDI32.dll
MSIMG32.dll
MSVCRT.dll
MSVFW32.dll
USER32.dll
SkinH_EL.dll
/vipuser/index.php/User/login
2013:06:18 18:58:50
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
2013:10:19 16:09:03
XhXXp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
 
N.nyD
X".eL 
2013:06:18 18:59:20
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
2013:06:21 22:00:59
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
xmp.did:6A115DEC74DAE211AC729AA23E2E7D90
 
 
 
 
j$r%s
Jr%xS-
@@x.tt
-6O}Y
2013:06:18 18:58:59
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
!s6%C
u%Xv;RQ
q,LTE.KK
/card/buy/step3.asp
&button=ÏÂÒ»²½£¬ÑéÖ¤³äÖµÐÅÏ¢
result2.asp
hXXp://api.soho1z.com/gg.txt
hXXp://api.soho1z.com/up.txt
hXXp://api.soho1z.com/ma.txt
ohXXp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
)-X}4*
Ex_DirectUI_MsgBox
07/08/13
09/27/12
360Tray.exe360
360sd.exe360
KSafeTray.exe
kxetray.exe
QQPCTray.exeQQ
C:\Windows\QQ.exe
C:\gx.tmp
baidu.com
vdisk.cn
User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)
\up.bat
2013:06:18 18:56:00
].VV6
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
ZS.Zw2
VBScript.RegExp
{6AEDBD6D-3FB5-418A-83A6-7F45229DC872}
bbs.52pk.com CF
hXXp://bbs.52pk.com/forum-1036-1.html
bbs.766.com 766
hXXp://bbs.766.com/forum.php?gid=1594
bbs.duowan.com
hXXp://bbs.duowan.com
bbs.houdao.com
hXXp://bbs.houdao.com
gamebbs.qq.com
hXXp://cf.gamebbs.qq.com/forum.php?mod=forumdisplay&fid=30503
tieba.baidu.com
hXXp://tieba.baidu.com/f?kw=cf
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
~@?)$ 4-|
@?)$ 4-|
~@?)$ 4-|}
2013:06:27 16:55:06
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
m2WWW.
2013:06:21 21:39:34
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
2013:06:12 21:04:24
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
2013:06:16 21:35:16
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
2013:06:16 19:35:28
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
2013:06:15 18:00:07
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
2013:06:15 18:00:30
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
2013:06:14 14:47:26
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
2013:06:14 14:47:52
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
2013:06:21 23:18:57
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
2013:06:21 23:19:12
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
%3Srs
1%XIo#
j-.uG
GWÍ
%DK(Jd
2013:06:12 20:16:00
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
xE,.Hy
.comment {color:green}
2013:06:14 18:04:26
DhXXp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
'.NvG
2013:06:13 11:15:42
~hXXp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
.KTV}
IdE%UI"
2013:06:12 20:20:04
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
2013:07:21 13:51:00
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
"Ig%F
zq.Xhi2
zq.FN
Z%Sl>~4
.oVl1m
.Yj'UOp
l$K(%F
D.Xp.Z
_.yxue9
.JKKBT
x.WXPZ
Z_]\%uU
9.Sq"4
%CZ@Z
Op.mh
2013:06:15 00:00:11
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
 
 
dCMdu
z%dV#
"
.Rv|c
O.HO.K
.RR.
 '.ZU
2013:06:14 23:09:22
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
.OV"]U
2013:06:14 14:39:31
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
2013:06:14 14:43:10
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
 
2013:06:25 23:09:05
" id="W5M0MpCehiHzreSzNTczkc9d"?> 
.K.JZ
U:\or/n
P:\h['
~v.WQH
6GHWIP.EO
JC%S*-
.kJZ_R
.CbY(
F%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
iphlpapi.dll
SHLWAPI.dll
MPR.dll
VERSION.dll
WSOCK32.dll
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.*)|*.*||
Shell32.dll
Mpr.dll
Advapi32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
%d.%d
%d / %d
%d/%d
Bogus message code %d
(%d-%d):
%ld%c
Y%d
X%d
Height%d
Width%d
RECT(%d, %d)-(%d, %d)
Styles0xX
Control ID%d
Handle0xX
%s
burlywood
\winhlp32.exe
VVV.dywt.com.cn
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
%s 
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
The requested URL /up.txt was not found on this server.
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
GetWindowsDirectoryA
WinExec
GetProcessHeap
GetCPInfo
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyExA
RegCloseKey
GetViewportExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetViewportOrgEx
ShellExecuteA
SetWindowsHookExA
UnhookWindowsHookEx
CreateDialogIndirectParamA
InternetCanonicalizeUrlA
InternetCrackUrlA
.text
.rdata
@.data
1, 0, 6, 6
- Skin.dll
(*.*)
%original file name%.exe_684_rwx_10000000_0003E000:
`.rsrc
L$(h%f
SSh0j
msctls_hotkey32
TVCLHotKey
THotKey
\skinh.she
}uo,x6l5k%x-l h
9p%s m)t4`#b
e"m?c&y1`Ð
SetViewportOrgEx
SetViewportExtEx
SetWindowsHookExA
UnhookWindowsHookEx
EnumThreadWindows
EnumChildWindows
`c%US.4/
!#$
.text
`.rdata
@.data
.rsrc
@.UPX0
`.UPX1
`.reloc
hJK.ZH
O.qt0
KERNEL32.DLL
COMCTL32.dll
GDI32.dll
MSIMG32.dll
MSVCRT.dll
MSVFW32.dll
USER32.dll
SkinH_EL.dll
1, 0, 6, 6
- Skin.dll