Trojan.GenericKD.1829386_dd54f8e270 – Adaware

Trojan.GenericKD.1829386 (B) (Emsisoft), Trojan.GenericKD.1829386 (AdAware), Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, GenericPhysicalDrive0.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: dd54f8e270e881bf04af72b5afe817c2

SHA1: 538cbabb0daa0095f2e2c97d72faf4df240bdb65

SHA256: 2a4de17d7230960746de3bb8fe55e1c55b5b1c38c94f7703adab52f1d9f75793

SSDeep: 24576:vAnw/szg6Q8 VJQe40uOX4CoCic/JCYMI9bXS:v w0BQ8SS0uzWx5XS

Size: 1486848 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: AirInstaller

Created at: 2014-08-23 09:56:27

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:944

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_RasPbFileShimCacheMutex

File activity

The process %original file name%.exe:944 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXYB0TI7\124_qyg[1].txt (2096 bytes)
C:\Ãƒâ€¦ÃƒÂ¤Ãƒâ€“ÃƒÆ’.ini (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\BQCGFMNH\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SRCPULWB\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2JI36RMV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\BQCGFMNH\gg[1].txt (596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXYB0TI7\desktop.ini (67 bytes)

Registry activity

The process %original file name%.exe:944 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 07 20 7C C6 40 A6 F0 7A 27 F3 C9 05 37 FB 55"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXYB0TI7\124_qyg[1].txt (2096 bytes)
C:\Ãƒâ€¦ÃƒÂ¤Ãƒâ€“ÃƒÆ’.ini (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\BQCGFMNH\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SRCPULWB\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2JI36RMV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\BQCGFMNH\gg[1].txt (596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXYB0TI7\desktop.ini (67 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ??b2b?????
Product Version: 3.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3.0.0.0
File Description: ??b2b?????
Comments: ??????????(http://www.eyuyan.com)
Language: Language Neutral

Company Name: Product Name: ??b2b?????Product Version: 3.0.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 3.0.0.0File Description: ??b2b?????Comments: ??????????(http://www.eyuyan.com)Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	958282	958464	5.07576	de90a5dc281e6269e61952064c69cbd9
.rdata	962560	309834	311296	4.33895	329911aee4d2106060ed7ddbb1fab701
.data	1273856	466538	114688	4.39851	0ac878d506dbf2c7ab7b623b5eabad85
.rsrc	1740800	90620	94208	4.54445	35a79a45284e87aaf2b3bf3beae06ed1
.text	1835008	994	4096	1.76611	076b63e9791b3e9749fa9ceb6a2c24d1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.hge168.com/ruanjian/123.html	103.251.89.9
hxxp://www.linanxi.com/soft/124_qyg.txt	112.124.59.64
hxxp://www.linanxi.com/soft/gg.txt	112.124.59.64

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ruanjian/123.html HTTP/1.1

Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: hXXp://VVV.hge168.com/ruanjian/123.html

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.hge168.com

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Date: Fri, 05 Sep 2014 14:45:02 GMT

Server: Apache/2

X-Powered-By: PHP/5.2.17

X-Pingback: hXXp://VVV.hge168.com/xmlrpc.php

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Cache-Control: no-cache, must-revalidate, max-age=0

Pragma: no-cache

Vary: Accept-Encoding,User-Agent

Transfer-Encoding: chunked

Content-Type: text/html; charset=UTF-8

14a1..<!DOCTYPE HTML>..<html>..<head>..<meta charset="UTF-8">..<meta http-equiv="X-UA-Compatible" content="IE=10,IE=9,IE=8">..<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=0, minimum-scale=1.0, maximum-scale=1.0">..<title>............... – ............</title>..<script>..window._deel = {name: '............',url: 'hXXp://VVV.hge168.com/wp-content/themes/yusi1.0', ajaxpager: '', commenton: 0, roll: [1,2]}..</script>..<link rel='stylesheet' id='style-css' href='hXXp://VVV.hge168.com/wp-content/themes/yusi1.0/style.css?ver=1.0' type='text/css' media='all' />.<script type='text/javascript' src='//libs.baidu.com/jquery/1.8.3/jquery.min.js?ver=1.0'></script>.<script type='text/javascript' src='hXXp://VVV.hge168.com/wp-content/themes/yusi1.0/js/jquery.js?ver=1.0'></script>.<meta name="keywords" content="...............">.<meta name="description" content="............'...............'">...</head>..<body class="error404">..<header id="header" class="header">..<div class="container-inner">.. <div class="yusi-logo">.. <a href="/">.. <h1>.. <span class="yusi-mono">............</span>..

<<< skipped >>>

GET /ruanjian/123.html HTTP/1.1

Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: hXXp://VVV.hge168.com/ruanjian/123.html

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.hge168.com

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Date: Fri, 05 Sep 2014 14:45:05 GMT

Server: Apache/2

X-Powered-By: PHP/5.2.17

X-Pingback: hXXp://VVV.hge168.com/xmlrpc.php

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Cache-Control: no-cache, must-revalidate, max-age=0

Pragma: no-cache

Vary: Accept-Encoding,User-Agent

Transfer-Encoding: chunked

Content-Type: text/html; charset=UTF-8

<<< skipped >>>

GET /soft/124_qyg.txt HTTP/1.1

Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: hXXp://VVV.linanxi.com/soft/124_qyg.txt

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.linanxi.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 1856

Content-Type: text/plain

Last-Modified: Fri, 05 Sep 2014 09:33:58 GMT

Accept-Ranges: bytes

ETag: "39a7da84ecc8cf1:12b8"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Fri, 05 Sep 2014 14:41:28 GMT

jRlvNW1WTROQ1WFRXCy2uL8Wx2TRNWSPTRpWSPFRQCPCFP5RoWbPFR2WFPUL9WdP5RhWA2eL8WOP1RVWdPFR5C52tLtCz2uLaCz2uLtC2IggaGIJng9GKJrLwgnE2JxYsEtJjRzCOP1RVWdPFRQCW2jRrWqPdLbCo2FR5C52u3uBSKt3bBSKt35BKHD8qfsFb8CD8FSK28TDFFi8ufnFe8oDRFv83DOFkQSBqwlQaBnKc3iveKA3gvdwK7aBnKc3ivXKt31B9KT3XBoKT3XB1BKHQ8MDcHv82DlFT3RDTH88bf2Fv8KD3FkQSBdwK7aBnKc3iveKA3gvuwC7TvXCo2dLbCjP9L1C4262rL1Co2rL5Ct2oRgElIQgcEcI0gxCBJxggElJaYdE7J6gwEPJCglEFPUL4WcPlRXCo2dLbCjPvLPCFPtPBYrWo2dLbCjP9L1C42XLxC52dLxC124LCGJJUYvEnJ3gJEz2KgrEJJhgtGoJAgnEQJWgLENJkQSB5vdwmQaBnKc3iveKA3gv5wzQUvdwc3aBnKJQ4B4Ku3uBSKt3aBSK635BKHe8oDIFH8CDBNT3HDjF78x8ZDDF88bfJwV3uvxwzQovnKc3aBkwW3wBJwc3aBmwc31BoKrQOv1Kt3OvuKX34Brw63aB9K43pvOwmwNQ5BnKu3aBaCo2mRpWrPFR5C52tLbCz2uLaCz29LtC2IPgdEPJdY8Wx2dLbClPdLXCn2TRNWX2uLpR6C929LqW12dLtCu2ORlWlPOR4Co2tLbCn2dLTWrPNRhWA2eL8Wo2TRaCqPmR5Ct2NRuClPTRlWrPdLNRqW52uL1ClPXLlWNPpRaC92135B4Kd35BtKJQ4B4Ku3aBSKt3bBSKt3aBKHM8YDIFV7gvyKc3lvoKpwlQ4BuKOQtBmwrQmvTwc3qvrwt3XB4KqQuBOwTQOvoKX3uB1Kt3bB1K43iveKA3gvTwc39BoK93aBOvmwt3bBrwOQlvNwu3bBrw43rvXKqQpvpw534BlWu2mRbCTPcL6CjP9L1C42dLxC52dLxC121LCGdISJ2gxEuIygGEgJjRzCrPdL6Cn26LbClPpR1Cn2ORpWOPTRXCn2OR9CqP9LNWTPmR6C12rR9CqPdLqWaCt2FRQCW2jRaCo2dLTW42pR5CqPNRTWrPmRlWlPrRmWrPNR9C929Lqv1KlQpvnK93XBpwu35BOwJQ4BXB5Kc3yB5K63yB5K93BfQFG8YDmH63BDRFkQSBoKc3aBpwu3OvXKlQqvpwOQrvOwqQmvNwOQqvtKX363qv1KlQpvnK93XBpwu35BOwJQRBvKkQuBuKX34B6Ku3qv9K93tBTwc31BTwu3mvoKNPrRtC124L4C5Ct2TRTWNPORpWlPcLhW12uLXCo2rLXC12rLXCX2oRPEHJfgpGX2LgwEFPULtCt21L5C92tLpW626L1LpWo2tLpW42rRaCNPrRtC124L4C124LmWqPrRqWrPpRaCjPvLPCFP9LaCo2TR1C92TRtClPNRbCn2rP63qv

<<< skipped >>>

GET /soft/gg.txt HTTP/1.1

Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: hXXp://VVV.linanxi.com/soft/gg.txt

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.linanxi.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 554

Content-Type: text/plain

Last-Modified: Mon, 26 May 2014 07:39:37 GMT

Accept-Ranges: bytes

ETag: "544e1aa5b578cf1:12b8"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Fri, 05 Sep 2014 14:41:30 GMT

8WNwlPxQTRrPyRFRQCW28gwEcIhgBE5J9Y4G0J3gpGdIPggEeJZgHEPJKgrEEJMg7EmI6YqGuIdYeEtJdYskNKa7iDaHfFR81DAF08Bfxw4Q6vtwBQSByKuQbv9wU3zvywxQOvzwB7VvxKTQ1v1wV3XvTwuQuvyKzQOvzwmQovqvSK63uB5KU3UvawVQzveKA3EDRFL8ODdHX8nf1H67MjmH38uB5KY80DWFY8IDKNL8qD8Fb7KD0FH8S8KD3N883gREbJuYhEHJsmpG5IfgqEnIaYGEnI3gNE2ISR9WbP9RoCx2ULaW6PtRSC1PzR1WlPyRoWxPy2rRXWXPUL1WrPtRtWx2SRNWSPlRnWrPrL5C924LSCyP5RzW1PvLPCZJMgBElJ3guEbIzYeEMOUYCERE6J3grE7JLmBErJ0gtG3Fg8ADuFc7MjnHO8YDBNV7Xf6HO8nffFR81DAF08Bfxw4Q6vtwBQSByKuQuQbvxKUQVvzwqQXvcwSQzBOwyQSvyKxQqv9wbQSBxwqQXvqwC7qvSK63tBnKU3UvawVQzvHTTP/1.1 200 OK..Content-Length: 554..Content-Type: text/plain..Last-Modified: Mon, 26 May 2014 07:39:37 GMT..Accept-Ranges: bytes..ETag: "544e1aa5b578cf1:12b8"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Fri, 05 Sep 2014 14:41:30 GMT..8WNwlPxQTRrPyRFRQCW28gwEcIhgBE5J9Y4G0J3gpGdIPggEeJZgHEPJKgrEEJMg7EmI6YqGuIdYeEtJdYskNKa7iDaHfFR81DAF08Bfxw4Q6vtwBQSByKuQbv9wU3zvywxQOvzwB7VvxKTQ1v1wV3XvTwuQuvyKzQOvzwmQovqvSK63uB5KU3UvawVQzveKA3EDRFL8ODdHX8nf1H67MjmH38uB..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_944:

.text

.rdata

@.data

.rsrc

@.text

t%SVh

t$(SSh

~%UVW

u$SShe

Kernel32.dll

wininet.dll

kernel32.dll

user32.dll

advapi32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

EnumWindows

ShellExecuteA

MsgWaitForMultipleObjects

ExitWindowsEx

{E60056EA-07A8-4bf5-B6F0-DF05DE6FAE1F}

C$%cmb

.ppM|

aZ.mO

%-^

.hk;~

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

127.0.0.1 fbkc.net

127.0.0.1 down.gangguan.in

127.0.0.1 vip.gangguan.in

127.0.0.1 infofabu.com

127.0.0.1 caifub2b.com

127.0.0.1 tinajina.com

127.0.0.1 shyoybc.com

127.0.0.1 hd22010-3.org

127.0.0.1 hd22020-3.com

127.0.0.1 xing8sex.com

127.0.0.1 zitongpai.org

127.0.0.1 jshbggc.com

127.0.0.1 qianbanjg.com

127.0.0.1 15crmoggc.com

127.0.0.1 nm360nmgb.com

127.0.0.1 b2bfabu.com

127.0.0.1 lcsem.cn

127.0.0.1 schybxgb.com

127.0.0.1 odian.net

127.0.0.1 sdgjgg.com

127.0.0.1 stggc.com

127.0.0.1 baiqisou.cn

127.0.0.1 lcsbtjs.com

127.0.0.1 lczswz.com

127.0.0.1 51sdgg.com

127.0.0.1 51sdgc.com

127.0.0.1 sdxxjmgg.com

127.0.0.1 lcxzgc.com

127.0.0.1 lchfglc.com

127.0.0.1 wxgg518.com

127.0.0.1 sdxxfl.com

127.0.0.1 jinshan3.com

127.0.0.1 010amw.info

127.0.0.1 010gg.info

127.0.0.1 beijingam.info

127.0.0.1 bjsnam.info

127.0.0.1 bjsw.info

127.0.0.1 bjxx.info

127.0.0.1 bjsmamw.info

127.0.0.1 dpqscg.com

127.0.0.1 lchhdj.com

127.0.0.1 tjjxpipe.com

127.0.0.1 sdysjgg.com

127.0.0.1 lxbzfzc.com

127.0.0.1 lckmgg.com

127.0.0.1 sdwfgg1.com

127.0.0.1 wz-aowt.com

127.0.0.1 dxgc888.com

127.0.0.1 lcshtjs.com

127.0.0.1 tjxydgg.com

127.0.0.1 zhongduochun.com

127.0.0.1 haoyigg.com

127.0.0.1 syzczz.com

127.0.0.1 lswzmy.com

127.0.0.1 lchxgs.com

127.0.0.1 lcshygc.com

127.0.0.1 lchjgy.com

127.0.0.1 lcsxyjx.com

127.0.0.1 lcdyhgg.com

127.0.0.1 rfxjs.com

127.0.0.1 lcyqjmgg.com

127.0.0.1 sanlizc.com

127.0.0.1 wxxywz.com

127.0.0.1 lclsdy.com

127.0.0.1 jcwyggc.com

127.0.0.1 wxxkgg.com

127.0.0.1 renbenzc.com

127.0.0.1 yinhaizc.com

127.0.0.1 bxwfgg.com

127.0.0.1 nbgdzc.com

127.0.0.1 lclfh.com

127.0.0.1 lindabearing.com

127.0.0.1 sdlcjdgc.com

127.0.0.1 sdogdb.com

127.0.0.1 lcyfsy.com

127.0.0.1 lcpdgs.com

127.0.0.1 sdlclf.com

127.0.0.1 sdzlgg.com

127.0.0.1 wgsdzc.com

127.0.0.1 jinshan1.com

127.0.0.1 lchlxdgg.com

127.0.0.1 wuxijwj.com

127.0.0.1 flnyhz.com

127.0.0.1 hbhhzc.com

127.0.0.1 tjwjt.com

127.0.0.1 tjhlxd.com

127.0.0.1 sdlcrb.com

127.0.0.1 csjmggc.com

127.0.0.1 xjwfgw.com

127.0.0.1 xinjiexc.com

127.0.0.1 lcsrw.com

127.0.0.1 lchetong.com

127.0.0.1 lddianji.com

127.0.0.1 naimo-ban.com

127.0.0.1 beijinganm.info

127.0.0.1 shandonggangguanchang.com

127.0.0.1 xiyougangguan.com

127.0.0.1 158bxgb.com

127.0.0.1 sdssyj.com

127.0.0.1 lcsrdgc.com

127.0.0.1 l245gg.com

127.0.0.1 baiqizaixian.com

127.0.0.1 baiqiso.com

127.0.0.1 lchengyu.com

127.0.0.1 sdxhgt.com

127.0.0.1 wfggpf.com

127.0.0.1 316gangguan.com

127.0.0.1 51q345b.com

127.0.0.1 ld-motor88.com

127.0.0.1 jinshan2.com

127.0.0.1 buxiugangwfg.com

127.0.0.1 rdguancai.com

127.0.0.1 rdgangguan.com

127.0.0.1 xinzhegg.com

127.0.0.1 fyxwz.com

127.0.0.1 sdhlgt.com

127.0.0.1 gb8163.com

127.0.0.1 lcscdgg.com

127.0.0.1 lcjinyu.com

127.0.0.1 VVV.fbkc.net

127.0.0.1 VVV.down.gangguan.in

127.0.0.1 VVV.vip.gangguan.in

127.0.0.1 VVV.infofabu.com

127.0.0.1 VVV.caifub2b.com

127.0.0.1 VVV.tinajina.com

127.0.0.1 VVV.shyoybc.com

127.0.0.1 VVV.hd22010-3.org

127.0.0.1 VVV.hd22020-3.com

127.0.0.1 VVV.xing8sex.com

127.0.0.1 VVV.zitongpai.org

127.0.0.1 VVV.jshbggc.com

127.0.0.1 VVV.qianbanjg.com

127.0.0.1 VVV.15crmoggc.com

127.0.0.1 VVV.nm360nmgb.com

127.0.0.1 VVV.b2bfabu.com

127.0.0.1 VVV.lcsem.cn

127.0.0.1 VVV.schybxgb.com

127.0.0.1 VVV.odian.net

127.0.0.1 VVV.sdgjgg.com

127.0.0.1 VVV.stggc.com

127.0.0.1 VVV.baiqisou.cn

127.0.0.1 VVV.lcsbtjs.com

127.0.0.1 VVV.lczswz.com

127.0.0.1 VVV.51sdgg.com

127.0.0.1 VVV.51sdgc.com

127.0.0.1 VVV.sdxxjmgg.com

127.0.0.1 VVV.lcxzgc.com

127.0.0.1 VVV.lchfglc.com

127.0.0.1 VVV.wxgg518.com

127.0.0.1 VVV.sdxxfl.com

127.0.0.1 VVV.jinshan3.com

127.0.0.1 VVV.010amw.info

127.0.0.1 VVV.010gg.info

127.0.0.1 VVV.beijingam.info

127.0.0.1 VVV.bjsnam.info

127.0.0.1 VVV.bjsw.info

127.0.0.1 VVV.bjxx.info

127.0.0.1 VVV.bjsmamw.info

127.0.0.1 VVV.dpqscg.com

127.0.0.1 VVV.lchhdj.com

127.0.0.1 VVV.tjjxpipe.com

127.0.0.1 VVV.sdysjgg.com

127.0.0.1 VVV.lxbzfzc.com

127.0.0.1 VVV.lckmgg.com

127.0.0.1 VVV.sdwfgg1.com

127.0.0.1 VVV.wz-aowt.com

127.0.0.1 VVV.dxgc888.com

127.0.0.1 VVV.lcshtjs.com

127.0.0.1 VVV.tjxydgg.com

127.0.0.1 VVV.zhongduochun.com

127.0.0.1 VVV.haoyigg.com

127.0.0.1 VVV.syzczz.com

127.0.0.1 VVV.lswzmy.com

127.0.0.1 VVV.lchxgs.com

127.0.0.1 VVV.lcshygc.com

127.0.0.1 VVV.lchjgy.com

127.0.0.1 VVV.lcsxyjx.com

127.0.0.1 VVV.lcdyhgg.com

127.0.0.1 VVV.rfxjs.com

127.0.0.1 VVV.lcyqjmgg.com

127.0.0.1 VVV.sanlizc.com

127.0.0.1 VVV.wxxywz.com

127.0.0.1 VVV.lclsdy.com

127.0.0.1 VVV.jcwyggc.com

127.0.0.1 VVV.wxxkgg.com

127.0.0.1 VVV.renbenzc.com

127.0.0.1 VVV.yinhaizc.com

127.0.0.1 VVV.bxwfgg.com

127.0.0.1 VVV.nbgdzc.com

127.0.0.1 VVV.lclfh.com

127.0.0.1 VVV.lindabearing.com

127.0.0.1 VVV.sdlcjdgc.com

127.0.0.1 VVV.sdogdb.com

127.0.0.1 VVV.lcyfsy.com

127.0.0.1 VVV.lcpdgs.com

127.0.0.1 VVV.sdlclf.com

127.0.0.1 VVV.sdzlgg.com

127.0.0.1 VVV.wgsdzc.com

127.0.0.1 VVV.jinshan1.com

127.0.0.1 VVV.lchlxdgg.com

127.0.0.1 VVV.wuxijwj.com

127.0.0.1 VVV.flnyhz.com

127.0.0.1 VVV.hbhhzc.com

127.0.0.1 VVV.tjwjt.com

127.0.0.1 VVV.tjhlxd.com

127.0.0.1 VVV.sdlcrb.com

127.0.0.1 VVV.csjmggc.com

127.0.0.1 VVV.xjwfgw.com

127.0.0.1 VVV.xinjiexc.com

127.0.0.1 VVV.lcsrw.com

127.0.0.1 VVV.lchetong.com

127.0.0.1 VVV.lddianji.com

127.0.0.1 VVV.naimo-ban.com

127.0.0.1 VVV.beijinganm.info

127.0.0.1 VVV.shandonggangguanchang.com

127.0.0.1 VVV.xiyougangguan.com

127.0.0.1 VVV.158bxgb.com

127.0.0.1 VVV.sdssyj.com

127.0.0.1 VVV.lcsrdgc.com

127.0.0.1 VVV.l245gg.com

127.0.0.1 VVV.baiqizaixian.com

127.0.0.1 VVV.baiqiso.com

127.0.0.1 VVV.lchengyu.com

127.0.0.1 VVV.sdxhgt.com

127.0.0.1 VVV.wfggpf.com

127.0.0.1 VVV.316gangguan.com

127.0.0.1 VVV.51q345b.com

127.0.0.1 VVV.ld-motor88.com

127.0.0.1 VVV.jinshan2.com

127.0.0.1 VVV.buxiugangwfg.com

127.0.0.1 VVV.rdguancai.com

127.0.0.1 VVV.rdgangguan.com

127.0.0.1 VVV.xinzhegg.com

127.0.0.1 VVV.fyxwz.com

127.0.0.1 VVV.sdhlgt.com

127.0.0.1 VVV.gb8163.com

127.0.0.1 VVV.lcscdgg.com

127.0.0.1 VVV.lcjinyu.com

z>\TEMP.TMP

hXXp://VVV.hge168.com/ruanjian/123.html

hXXp://VVV.linanxi.com/soft/

hXXp://VVV.linanxi.com.cn/soft/

hXXp://VVV.linanxi.cn/soft/

hXXp://VVV.linanxi.net/soft/

hXXp://VVV.huguorong.com/soft/

hXXp://VVV.360kv.com/soft/

hXXp://

hXXps://

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

http=

HTTP/1.1

Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Content-Type: application/x-www-form-urlencoded

hXXp://VVV.zhan456.com/member/zabaa.php?mid=7&action=add

hXXp://VVV.wan-gou.com/member/WOfabu.php?mid=

hXXp://VVV.wan-gou.com/member/WOfabu.php?mid=22&action=add

hXXp://VVV.hqiye.com/api/captcha.png.php?action=image&refresh=0.

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

hXXp://VVV.qiyegu.com/member/my.php?mid=5&action=add

P@Excel.exe

config.ini

hXXp://VVV.qiyegu.com/member/my.php

&submit= æ äº¤

&post[elite]=

&post[mycatid]=

&post[days]=

&post[amount]=

&post[minamount]=

&post[price]=

&post[totime]=&post[unit]=

&post[thumb2]=

&post[thumb1]=

&post[thumb]=

&post[content]=

&post[brand]=

&post[standard]=

&post[model]=

&style=&post[catid]=

&post[title]=

action=add&mid=5&itemid=0&forward=http://VVV.qiyegu.com/member/&post[typeid]=

hXXp://open.baidu.com/special/time/

window.baidu_time(

`~!@#$%^&*()-_= [{]};:'\|,<.>/?"

hXXp://VVV.wan-gou.com/member/WOfabu.php

&submit= Ìá ½»

&post[pack]=

&post[totime]=&post[amount]=

&post_fields[buyname]=

action=add&mid=6&itemid=0&forward=http://VVV.wan-gou.com/member/WOfabu.php?mid=6&post[typeid]=

&post[tag]=

&post[fromurl]=

&post[copyfrom]=

&post[author]=

&post[introduce]=

&style=&post[content]=

action=add&mid=21&itemid=0&forward=http://VVV.wan-gou.com/member/WOfabu.php?mid=21&post[linkurl]=&post[catid]=

&style=&post[totime]=&post[content]=

action=add&mid=22&itemid=0&forward=http://VVV.wan-gou.com/member/WOfabu.php?mid=22&post[catid]=

hXXp://VVV.qiyegu.com/member/news.php

&post[typeid]=0&submit= ç¡® å®š

&post[addtime]=

&post[style]=&post[content]=

action=add&post[title]=

hXXp://VVV.qiyegu.com/ajax.php

hXXp://VVV.qiyegu.com/member/loginIUIU0O901018.php

&password=

forward=http://VVV.qiyegu.com/&option=username&username=

hXXp://VVV.qiyegu.com/member

&ct=0&ft=&q5=&q6=qiyegu.com&tn=baiduadv

hXXp://VVV.baidu.com/s?q1=&q2=

\*.jpg

\*.gif

&q3=&q4=&rn=10&lm=0&ct=0&ft=&q5=&q6=qiyegu.com&tn=baiduadv

&q3=&q4=&rn=10&lm=360&ct=0&ft=&q5=&q6=qiyegu.com&tn=baiduadv

&q3=&q4=&rn=10&lm=30&ct=0&ft=&q5=&q6=qiyegu.com&tn=baiduadv

&q3=&q4=&rn=10&lm=7&ct=0&ft=&q5=&q6=qiyegu.com&tn=baiduadv

&q3=&q4=&rn=10&lm=1&ct=0&ft=&q5=&q6=qiyegu.com&tn=baiduadv

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

https

.iqW>

"3/%F

%du2$"

.unOZ

\\.\PHYSICALDRIVE

\\.\SCSI

\\.\SMARTVSD

\\.\PhysicalDrive0

hXXp://VVV.qiyegu.com/member/my.php?mid=

hXXp://VVV.vooec.com/Member/loginout.asp

itemid[]=

hXXp://ping.baidu.com/ping/RPC2

.html

VVV.qiyegu.com/

weblogUpdates.ping

VVV.qiyegu.com/

$@Kernel32.dll

hXXp://VVV.linanxi.com

*.xls|*.xls

*.jpg|*.jpg|*.gif|*.gif

*.txt

|*.txt

>1.2.18

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

MSWHEEL_ROLLMSG

__MSVCRT_HEAP_SELECT

AVIFIL32.dll

iphlpapi.dll

SHLWAPI.dll

MPR.dll

WINMM.dll

WS2_32.dll

VERSION.dll

RASAPI32.dll

GetProcessHeap

WinExec

GetWindowsDirectoryA

GetCPInfo

KERNEL32.dll

GetKeyState

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

GetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

WINSPOOL.DRV

comdlg32.dll

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

\\.\Scsi0:

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

1.1.3

;3 #>6.&

'2, / 0&7!4-)1#

(*.avi)|*.avi

1.2.18

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

WPFT532.CNV

WPFT632.CNV

EXCEL32.CNV

write32.wpc

Windows Write

mswrd632.wpc

Word for Windows 6.0

wword5.cnv

Word for Windows 5.0

mswrd832.cnv

mswrd632.cnv

Word 6.0/95 for Windows & Macintosh

html32.cnv

NULL row buffer for row %ld, pass %d

libpng error: %s

libpng error: %s, offset=%d

libpng error no. %s: %s

libpng warning: %s

libpng warning no. %s: %s

operator

keywords

Unknown zTXt compression type %d

Incomplete compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

gamma = (%d/100000)

gx=%f, gy=%f, bx=%f, by=%f

wx=%f, wy=%f, rx=%f, ry=%f

incorrect gamma=(%d/100000)

iTXt chunk not supported.

VVV.dywt.com.cn

Excel.Application

HTTP/1.0

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

.PAVCOleDispatchException@@

zcÁ

soft/gg.txt

gg.txt

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

1, 0, 6, 6

(*.*)

3.0.0.0

(hXXp://VVV.eyuyan.com)

%original file name%.exe_944_rwx_00401000_000EA000:

t%SVh

t$(SSh

~%UVW

u$SShe

%original file name%.exe_944_rwx_10027000_00015000:

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ð

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

%-^

.hk;~