Trojan.Win32.FlyStudio_a7b84d2f32 – Adaware

Gen:Heur.PWSIME.2 (B) (Emsisoft), Gen:Heur.PWSIME.2 (AdAware), GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: a7b84d2f327af8ad33412beaeda61c16

SHA1: f3a5b0414eb35f0453fd2089ee945ac604d23134

SHA256: 1643fc40d180d079df992e6a67d50bb3e1860a6876cac6ba8b441bfbef35ab7f

SSDeep: 12288:Vyzq6/u4z0DwKCxrCkGxUWxrVvLSnIscv:VyvpOwKCxrCkqUWxrViI/

Size: 496351 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: MEW11SEv12, MEW11SEv11, UPolyXv05_v6, Mew11SEv12Eng

Company: no certificate found

Created at: 1970-01-01 03:00:00

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:1564

File activity

The process %original file name%.exe:1564 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pixel[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[1].aspx (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\eca1e2f901a17103ab05f7b46c358f6e[1].jpg (5889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bd5463690a93c57a1039c47e11ab0f97[1].jpg (5512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\22759138[1].htm (1305 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\level_MIN_12.02[1].css (387 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[2].aspx (372 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[2].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA5K8Z5X.htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\AClick[1].aspx (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\button_old_170[1].gif (749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1013v1395126094590286213[1].jpg (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6[1] (24397 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA1QKA6Z.htm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\22759138[1] (4450 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\spacegif[1].gif (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2013.11.261[1].gif (6852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.myzwqwe12[1].txt (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jump[2].htm (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\level_MIN_12.02[1].css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jump[1].html (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (802 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1013v1399877732267347087[1].jpg (3601 bytes)
%System%\drivers\etc\hosts (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1013v1399981006909062820[1].jpg (916 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qunge[2].txt (1684 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1013v1399900572153141167[1].jpg (5444 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[3].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\AClick[1].aspx (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button_old_170[1].gif (749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\6[1].htm (15899 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAW3W1GN.htm (7 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qunge[1].txt (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\firstpay[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\button_old_170[1].gif (749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (802 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.cfmogu[1].txt (963 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[2].txt (406 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[4].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\idx_share_mood_v1[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b744ef7cf7616402b9cd75cd3b296755[1].jpg (2876 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\dd4a181d99e9ef08ab7d0a6475f7d97f[1].jpg (8051 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.myzwqwe12[2].txt (447 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\close[1].png (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAOR8DQF.htm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1013v1400493293416348850[1].jpg (916 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@shrek.6[2].txt (154 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.qunge[1].txt (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\9aabf98b73[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@z.myzwqwe12[1].txt (312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\spacegif[1].gif (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ab7b8d4601229526cb46e315af28c9db[1].jpg (3988 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAMRCLE3.htm (7 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.cfmogu[2].txt (321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\975b51f2ce89d444e33414de976c88a0[1].jpg (1075 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (28048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\135960371121375988[1].jpg (1152 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@z.myzwqwe12[2].txt (167 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\106a779a3e729c20d3b927873b6bdc5b[1].jpg (2034 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@shrek.6[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[1].aspx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[2].aspx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[2].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\AClick[1].aspx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\button_old_170[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button_old_170[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\22759138[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\index_MIN_11.97[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.myzwqwe12[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\level_MIN_12.02[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jump[1].html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\106a779a3e729c20d3b927873b6bdc5b[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA1QKA6Z.htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\AClick[1].aspx (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qunge[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pic1[1].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.cfmogu[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qunge[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.myzwqwe12[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\22759138[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAOR8DQF.htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@z.myzwqwe12[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\spacegif[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2013.11.261[1].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.cfmogu[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@z.myzwqwe12[2].txt (0 bytes)

Registry activity

The process %original file name%.exe:1564 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 25 31 1A AC FB 95 B0 60 0C 5E 07 8C 6D 6E C6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\MediaPlayer\Health\{141B2550-F8ED-4370-8AA3-F27478BDE31D}]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 1248 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	www.cfyuanji.com
127.0.0.1	www.cfyuanji.net
127.0.0.1	www.cfyuanji.cc
127.0.0.1	cfyuanji.com
127.0.0.1	cfyuanji.net
127.0.0.1	cfyuanji.cc
127.0.0.1	www.cfyalan.com
127.0.0.1	www.cfyalan.net
127.0.0.1	www.cfyalan.cc
127.0.0.1	yy.cfyalan.com
127.0.0.1	cc.cfyalan.com
127.0.0.1	cfyalan.com
127.0.0.1	cfyalan.net
127.0.0.1	cfyalan.cc
127.0.0.1	www.cftianyue.com
127.0.0.1	www.cftianyue.net
127.0.0.1	www.cftianyue.cc
127.0.0.1	cftianyue.com
127.0.0.1	cftianyue.net

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pixel[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[1].aspx (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\eca1e2f901a17103ab05f7b46c358f6e[1].jpg (5889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bd5463690a93c57a1039c47e11ab0f97[1].jpg (5512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\22759138[1].htm (1305 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\level_MIN_12.02[1].css (387 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[2].aspx (372 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[2].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA5K8Z5X.htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\AClick[1].aspx (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\button_old_170[1].gif (749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1013v1395126094590286213[1].jpg (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6[1] (24397 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA1QKA6Z.htm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\spacegif[1].gif (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2013.11.261[1].gif (6852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.myzwqwe12[1].txt (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jump[2].htm (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\level_MIN_12.02[1].css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jump[1].html (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (802 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1013v1399877732267347087[1].jpg (3601 bytes)
%System%\drivers\etc\hosts (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1013v1399981006909062820[1].jpg (916 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qunge[2].txt (1684 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1013v1399900572153141167[1].jpg (5444 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[3].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\AClick[1].aspx (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button_old_170[1].gif (749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\6[1].htm (15899 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAW3W1GN.htm (7 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qunge[1].txt (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\firstpay[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\button_old_170[1].gif (749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (802 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.cfmogu[1].txt (963 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[2].txt (406 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[4].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\idx_share_mood_v1[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b744ef7cf7616402b9cd75cd3b296755[1].jpg (2876 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\dd4a181d99e9ef08ab7d0a6475f7d97f[1].jpg (8051 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.myzwqwe12[2].txt (447 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\close[1].png (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAOR8DQF.htm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1013v1400493293416348850[1].jpg (916 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@shrek.6[2].txt (154 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.qunge[1].txt (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\9aabf98b73[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@z.myzwqwe12[1].txt (312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\spacegif[1].gif (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ab7b8d4601229526cb46e315af28c9db[1].jpg (3988 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAMRCLE3.htm (7 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.cfmogu[2].txt (321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\975b51f2ce89d444e33414de976c88a0[1].jpg (1075 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (28048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\135960371121375988[1].jpg (1152 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@z.myzwqwe12[2].txt (167 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\106a779a3e729c20d3b927873b6bdc5b[1].jpg (2034 bytes)
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
MEW	4096	1908736	0	0	d41d8cd98f00b204e9800998ecf8427e

19128325570564958395.323216415dbbcdd6f25b64fd4603891de73d1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://42.156.140.11/core.php?web_id=4693566&show=pic1&t=z
hxxp://42.156.140.23/stat.htm?id=4693566&r=&lg=en-us&ntime=1400856660&repeatip=2&rtime=0&cnzz_eid=781320698-1400856660-&showp=1024x768&st=-17545&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=1061278162
hxxp://61.146.152.57/csjs/_/girlfall_5.js
hxxp://119.254.26.35/site/images/new_main/fkr_v2.png
hxxp://119.254.26.35/site/images/ico/icon_dbt.gif
hxxp://14.17.101.18/jump.html?p=20111931&from=offsite&wp=1&sid=214516
hxxp://119.254.26.36/common/hf/arc.png
hxxp://27.195.145.37/live/59/50/80e7dec180.jpg
hxxp://27.195.145.37/live/2014/04/06/05/1003v1396734606998730081.jpg
hxxp://59.151.16.173/hotel_fekit/prd/scripts/home@c95ec58e5b2667785393d0b74bf47d61.js
hxxp://1st.xdwscache.glb0.lxdns.com/mhjh/42/images/bg1.swf
hxxp://1st.xdwscache.glb0.lxdns.com/stat.js
hxxp://101.226.244.212/Scripts/JScript.js
hxxp://cc00013.h.cncssr.chinacache.net/imges/live2013/base_head_v24.png
hxxp://cc00013.h.cncssr.chinacache.net/imges/live/CSSIMG/base_head_search.png
hxxp://119.254.26.35/hotel/aprice/service_24.png
hxxp://119.254.26.36/common/hf/24h.png
hxxp://119.254.26.35/site/images/n/qn_hotel_home_li.gif
hxxp://42.156.140.23/stat.htm?id=4693566&r=&lg=en-us&ntime=1400856660&repeatip=1&rtime=0&cnzz_eid=781320698-1400856660-&showp=1024x768&st=-17545&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=28790409
hxxp://61.146.152.57/js/jquery-1.8.2_v4.js
hxxp://cc00013.h.cncssr.chinacache.net/live/82/93/88f9034248.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/mhjh/42/images/reg.swf
hxxp://icon.cnzz.com/img/pic1.gif
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=755500343
hxxp://115.236.19.58/xm/2013.11.261.gif
hxxp://27.195.145.37/3a/fb/u327191383286771.png
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=838325880
hxxp://1st.xdwscache.glb0.lxdns.com/adstat.php?wsite=snsfun&lq_aid=1398&lq_placeid=14516
hxxp://cc00013.h.cncssr.chinacache.net/f2/9a/v627061383118550.png
hxxp://cc00013.h.cncssr.chinacache.net/b9/f4/9aabf98b73.jpg
hxxp://js.tuigoo.com/pic/spacegif.gif
hxxp://101.226.244.212/iframe/web/images/btn_a.jpg
hxxp://61.146.152.57/js/s/iwt-min.js
hxxp://61.146.152.57/js/s/e6u5-min.js?101016
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1478286576
hxxp://js.tuigoo.com/AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F473308619960F4DD5DF43D646EA00369C4C5BA9CA51D1ADDFAE2099A3&Url=&referer=http://www.cfmogu.com/
hxxp://119.254.26.35/site/images/wns/childrenDay_120x20.gif
hxxp://js.tuigoo.com/showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.com/CPVClick.aspx?AID=1805&PID=9756&Auth=6848383803FF6A60EEF8E83EE457E3DE64592E31F17EDD9090B4CE01E7410865&Url=http%3a%2f%2fv.6.cn%2fevent%2fpromimg%2f%3fsrc%3dpming393
hxxp://www.gm2468.com/68503.html?sid=14516
hxxp://183.60.205.125/Ãƒâ€žÃ‚Â¢Ã‚Â¹Ã‚Â½ÃƒÂÃ‚Â¼Ãƒâ€ Ã‚Â¬.gif
hxxp://pcookie.split.cnzz.com/app.gif?&cna=Vk4GDC1h3hcCAbhrJiY/l3vv
hxxp://61.146.152.57/event/promimg/proLiveInfo.php
hxxp://1st.xdwscache.glb0.lxdns.com/mhjh/42/images/ren01.swf
hxxp://119.254.26.35/qui/common/search_sug3.png
hxxp://pcookie.split.cnzz.com/app.gif?&cna=V04GDKPz9hYCAbhrJiat7STg
hxxp://tips.qunar.com/ugcApi/hotel/homepageRecommend.json?callback=_callback&_=1400839117274
hxxp://211.151.112.21/hotelHot.jsp?city=Ã¥Å’â€”Ã¤ÂºÂ¬
hxxp://119.254.26.35/site/images/2011/icon_calendar.gif
hxxp://61.146.152.57/js/s/login_3.js
hxxp://61.146.152.57/js/mootools_MIN_1.4.5.js
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1355798310
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1549908153
hxxp://tuan.qunar.com/api/indextuan_v4.php?callback=jQuery1830349364145548212_1400839115462&_=1400839117962
hxxp://c.split.cnzz.com/stat.php?id=2157618&web_id=2157618
hxxp://61.146.152.57/js/z_MIN_14.68.js
hxxp://42.156.140.23/stat.htm?id=4693566&r=&lg=en-us&ntime=1400856660&repeatip=3&rtime=0&cnzz_eid=781320698-1400856660-&showp=1024x768&st=-17542&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=1185980821
hxxp://irs01.net/MTFlashStore.swf
hxxp://pcookie.split.cnzz.com/app.gif?&cna=V04GDN84LS4CAbhrJiazs4pP
hxxp://cc00013.h.cncssr.chinacache.net/live/44/92/93dd3c8238e709a50436a93813334360.jpg
hxxp://27.195.145.37/live/87/77/c4e56405381405cf666068f90ee21405.jpg
hxxp://42.156.140.23/stat.htm?id=4693566&r=&lg=en-us&ntime=1400856660&repeatip=4&rtime=0&cnzz_eid=781320698-1400856660-&showp=1024x768&st=-17541&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=1234893777
hxxp://61.146.152.57/event/promimg/?src=pming393
hxxp://61.146.152.57/api/liveInfoCk.php
hxxp://42.156.140.11/core.php?web_id=2157618&t=z
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/05/15/22/1003v1400164908911825873.jpg
hxxp://myconf6room.dtwscache.glb0.lxdns.com/?src=tuiga834
hxxp://101.226.244.212/iframe/web/images/right_bg.jpg
hxxp://z12.cnzz.com/stat.htm?id=2157618&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=1831153373-1400856664-&showp=1024x768&st=0&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefined&rnd=38415145
hxxp://101.226.244.212/iframe/web/images/p1_bg.png
hxxp://enop007.tlgslb.com/live.6.cn/e6u2/r.php?location=v.6.cn/event/promimg/?src=pming393&referer=&browser=mozilla/4.0 (compatible; msie 6.0; windows nt 5.1; sv1; .net clr 2.0.50727; .net clr 3.0.04506.648; .net clr 3.5.21022; .net4.0c)&flash=10.0&msr=1024,768&uid=0&pro=4&stamp=1400839118009
hxxp://cc00013.h.cncssr.chinacache.net/live/09/70/0c975ca66621d39583489482d041ee1f.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/28/40/700d9d36f15a76d00706af5830588487.jpg
hxxp://cc00013.h.cncssr.chinacache.net/imges/live/IMGSRC/logo_foot_v1.png
hxxp://cc00013.h.cncssr.chinacache.net/live/62/11/bac3177e34cf864ef0a77c8ca27f43ff.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/20/75/bc01b4cd6153ceccfb52087c4063fdc8.jpg
hxxp://history.qunar.com/history/newhistory.html?v=20121012
hxxp://1st.xdwscache.glb0.lxdns.com/mhjh/wm/mhjh_42.flv
hxxp://101.226.244.212/iframe/web/images/p2_bg.png
hxxp://qhs.qunar.com/collect?&QHFP=&QHP=ZSI0A8280375&ex_track=auto_533a6e98&http_referer=
hxxp://cc00013.h.cncssr.chinacache.net/imges/live2013/logo.jpg
hxxp://7.ecoma.glb0.lxdns.com/p/20111931?from=offsite&sid=214516&wp=1&cps=&r=9120
hxxp://tuan.qunar.com/tuijian/index.html?v=1400839120055
hxxp://7.ecoma.glb0.lxdns.com/jump.html?p=50110004&from=offsite&wp=1&sid=14516
hxxp://www.qunar.com/twell/cookie/allocateCookie.jsp
hxxp://history.qunar.com/ips.jcp?callback=QNR.ips.callback&_=1400839119962
hxxp://119.254.26.35/hotel/ugc/user_spic.png
hxxp://119.254.26.35/hotel/hotel_default_77_77.jpg
hxxp://cc00013.h.cncssr.chinacache.net/b7/aa/h199941397100951.jpg
hxxp://history.qunar.com/avatar/vmlINR4GkJKFO_VZj.png?l
hxxp://27.195.145.11/Mediafile/webgame/Flvs/20140519/438300.flv
hxxp://userimg.qunar.ccgslb.net/hotel/city_guid/jt_h.png
hxxp://userimg.qunar.ccgslb.net/site/images/new_main/m_loading.gif
hxxp://cc00013.h.cncssr.chinacache.net/live/07/01/106a779a3e729c20d3b927873b6bdc5b.jpg
hxxp://userimg.qunar.ccgslb.net/imgs/201404/23/QvMa33SoHnO-fFKZ576.jpg
hxxp://7.ecoma.glb0.lxdns.com/9120?p=20111931
hxxp://userimg.qunar.ccgslb.net/site/images/2011/QN1HP2.png
hxxp://userimg.qunar.ccgslb.net/hotel/ugc/review_titlebg.png
hxxp://irs01.com/irt?_iwt_UA=UA-6cn-000001&p=value1,value2&jsonp=_3SHB9
hxxp://userimg.qunar.ccgslb.net/hotel/ugc/review_homev3.png
hxxp://userimg.qunar.ccgslb.net/hotel/aprice/icon_weih.png
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=homeadSy
hxxp://xnop012.tlgslb.com/tuan/team/2013/0716/3_13739689082565_index.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2013/1108/3_13839002496162_index.jpg
hxxp://myconf6room.dtwscache.glb0.lxdns.com/css/level_MIN_12.02.css
hxxp://xnop012.tlgslb.com/tuan/team/2012/0327/3_13328131311111_index.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2014/0401/3_13963288578315_index.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/05/19/17/1013v1400493293416348850.jpg
hxxp://myconf6room.dtwscache.glb0.lxdns.com/css/index_MIN_11.97.css
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/05/12/21/1013v1399900572153141167.jpg
hxxp://cc00013.h.cncssr.chinacache.net/imges/live/index/firstpay.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/05/12/14/1013v1399877732267347087.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/03/18/15/1013v1395126094590286213.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/15/38/975b51f2ce89d444e33414de976c88a0.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/63/67/b744ef7cf7616402b9cd75cd3b296755.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/69/59/eca1e2f901a17103ab05f7b46c358f6e.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/33/84/bd5463690a93c57a1039c47e11ab0f97.jpg
hxxp://7.ecoma.glb0.lxdns.com/p/50110004?from=offsite&sid=14516&wp=1&cps=&r=22759138
hxxp://cc00013.h.cncssr.chinacache.net/live/50/05/ab7b8d4601229526cb46e315af28c9db.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/05/13/19/1013v1399981006909062820.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2012/0507/3_13363693818011_index.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2012/1218/3_13558027643047_index.jpg
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=hotel_active_dynamic
hxxp://xnop012.tlgslb.com/tuan/team/2013/1101/3_13832759326386_index.jpg
hxxp://webproxy-sz.qplus.com/pa?p=1:1305643224:17
hxxp://webproxy-sz.qplus.com/pa?p=1:494666586:17
hxxp://xnop012.tlgslb.com/tuan/team/2012/0702/3_13412052702424_index.jpg
hxxp://cc00013.h.cncssr.chinacache.net/imges/live2013/idx_share_mood_v1.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/74/92/dd4a181d99e9ef08ab7d0a6475f7d97f.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2013/0816/3_13766448177438_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/script/static/xiu/v5/main_play_v.7.js?20140515
hxxp://xnop012.tlgslb.com/tuan/team/2013/0724/3_13746619079861_index.jpg
hxxp://myconf6room.dtwscache.glb0.lxdns.com/event/promimg/proLiveInfo.php
hxxp://webproxy-sz.qplus.com/pa?p=1:2473590371:17
hxxp://xnop012.tlgslb.com/tuan/team/2013/0609/3_13707460758353_index.jpg
hxxp://webproxy-sz.qplus.com/pa?p=1:1712482633:17
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/lib/jquery/jquery-1.4.4.min.js
hxxp://7.ecoma.glb0.lxdns.com/play/22759138?p=50110004
hxxp://enop007.tlgslb.com/live.6.cn/e6u2/r.php?location=v.6.cn/event/promimg/?src=pming393&referer=www.cfmogu.com/&browser=mozilla/4.0 (compatible; msie 6.0; windows nt 5.1; sv1; .net clr 2.0.50727; .net clr 3.0.04506.648; .net clr 3.5.21022; .net4.0c)&flash=10.0&msr=1024,768&uid=0&pro=4&stamp=1400839124071
hxxp://xnop012.tlgslb.com/tuan/team/2013/1128/3_13856334572103_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/public_v.1.js?20140212v1
hxxp://ssd.tcdn.qq.com/qconn/wpa/button/button_old_170.gif
hxxp://xnop012.tlgslb.com/tuan/team/2014/0219/3_13927960623356_index.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/59/88/135960371121375988.jpg
hxxp://myconf6room.dtwscache.glb0.lxdns.com/api/liveInfoCk.php
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/sns_v.5.js?20131231
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/base/v1/css/common_v.1.css
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/base/v1/css/gift_v.1.css?20130918v1
hxxp://xnop012.tlgslb.com/tuan/team/2013/0427/3_13670378697730_index.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2012/1106/3_13521927362776_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/game_v.5.js?20131104v2
hxxp://xnop012.tlgslb.com/tuan/team/2013/1105/3_13836364398589_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/xiu_base_v.2.css?2012v5
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/sub/xiu_guide_v.8.css?v20140224
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/common.js?20140417
hxxp://xnop012.tlgslb.com/tuan/team/2013/0805/3_13756834771498_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/global.js?2013v6
hxxp://xnop012.tlgslb.com/tuan/team/2013/0923/3_13799281774557_index.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2013/1219/3_13874395125075_index.jpg
hxxp://a.qunar.com/vataplan?framId=rightMiddleAd_QAD&adposition=QNR_Yw==_CN&tag=1&rows=10&cur_page_num=0&rep=1&f=s&callback=QNR._AD.rightMiddleAd_QAD&tile=140083911550977635&city=Ã¥Å’â€”Ã¤ÂºÂ¬
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=couplet_load
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/sub/xiu_login_v.2.css?20131212
hxxp://59.151.16.173/jquery/prd/jquery-1.7.2.min.js
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/swfobject.js
hxxp://xnop012.tlgslb.com/tuan/team/2014/0108/3_13891704116644_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/xiu_v.12.css?20140312
hxxp://xnop012.tlgslb.com/tuan/team/2014/0107/3_13890927387789_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/sub/xiu_sns_v.1.css?20140415
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/shafa_v_1.js?v=201311v1
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/play_flv_v.8.js?20140421
hxxp://xnop012.tlgslb.com/tuan/team/2012/1012/3_13500402225397_index.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2012/1213/3_13553713466676_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/topic/xiu_activity.css?v20140429
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=leftMiddleAd
hxxp://qhs.qunar.com/render/googlesem.jsp?lable=iV1oCMbP0AUQ-vPg1wM&params={"AccessPage":"home"}&referer=
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=leftMiddleAd2
hxxp://xnop012.tlgslb.com/tuan/team/2014/0107/3_13890853993991_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/hd.js?v20140515
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/liver.js?2012v1
hxxp://xnop012.tlgslb.com/ucenter/portrait/201405/16/12d8a69d8cbdb8d0811889c4.png_r_150x150_1d6667f5.png
hxxp://a.qunar.com/js.ng/framId=homeadSy&chan=hotel&pg=home&pos=right_top&site=qunar&size=230x200&type=Tear_angle&tile=140083911550977635&city=Ã¥Å’â€”Ã¤ÂºÂ¬
hxxp://xnop012.tlgslb.com/tuan/team/2014/0506/13993458443799.jpeg
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/broadcast_v.1.js?20131107v1
hxxp://a.qunar.com/js.ng/framId=hotel_active_dynamic&chan=hotel&pg=home&site=qunar&type=dynamic_skinned&tile=140083911550977635&city=Ã¥Å’â€”Ã¤ÂºÂ¬
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/park.js?201311v1
hxxp://userimg.qunar.ccgslb.net/imgs/201111/22/OSh_kbSQcSLTtsuEOnormal.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2014/0522/14007330351187.jpeg
hxxp://a.qunar.com/js.ng/framId=couplet_load&chan=hotel&pg=home&pos=right&site=qunar&size=120x300&type=couplet&TransactionID=2698212&tile=140083911550977635&city=Ã¥Å’â€”Ã¤ÂºÂ¬
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/lothario_v.1.js?20140425
hxxp://xnop012.tlgslb.com/tuan/team/2014/0519/14004736313837.jpeg
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/signin_v.1.js?2014v6
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=leftBottomAd
hxxp://xnop012.tlgslb.com/tuan/team/2014/0520/14005843779565.jpeg
hxxp://a.qunar.com/js.ng/framId=leftMiddleAd&chan=hotel&pg=home&pos=top&site=qunar&size=728x90&tile=140083911550977635&city=Ã¥Å’â€”Ã¤ÂºÂ¬
hxxp://a.qunar.com/js.ng/framId=leftMiddleAd2&chan=hotel&pg=home&pos=left_mid&site=qunar&size=728x90&tile=140083911550977635&city=Ã¥Å’â€”Ã¤ÂºÂ¬
hxxp://pagead.l.doubleclick.net/pagead/conversion.js
hxxp://stats.l.doubleclick.net/dc.js
hxxp://xnop012.tlgslb.com/tuan/team/2014/0421/13980791694562.jpeg
hxxp://stats.l.doubleclick.net/__utm.gif?utmwv=5.5.1dc&utms=1&utmn=1290891466&utmhn=hotel.qunar.com&utme=8(AccessPage)9(home)&utmcs=utf-8&utmsr=1024x768&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmhid=1444891789&utmr=-&utmp=/render/googlesem.jsp?lable=iV1oCMbP0AUQ-vPg1wM&params=%257B%2522AccessPage%2522%253A%2522home%2522%257D&referer=&utmht=1400839129524&utmac=UA-33334231-1&utmcc=__utma=183398822.1637817787.1400839129.1400839129.1400839129.1;+__utmz=183398822.1400839129.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmu=qRAAAAAAC~
hxxp://history.qunar.com/h?utmwv=0.1&t=0.31577474853062076&utmsr=1024*740&utmr=-1&utmp=http://hotel.qunar.com/?ex_track=auto_533a6e98&utmhn=hotel.qunar.com&s=167
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=rightTopAd
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=rightMiddleBottomAd
hxxp://a.qunar.com/js.ng/framId=leftBottomAd&chan=hotel&pg=home&pos=bottom&site=qunar&size=728x90&tile=140083911550977635&city=Ã¥Å’â€”Ã¤ÂºÂ¬
hxxp://xnop012.tlgslb.com/tuan/team/2014/0507/13994555365849.jpeg
hxxp://pagead.l.doubleclick.net/pagead/conversion/989346298/?random=1400839129696&cv=7&fst=1400839129696&num=1&fmt=3&value=0&label=iV1oCMbP0AUQ-vPg1wM&bg=ffffff&hl=en&guid=ON&u_h=768&u_w=1024&u_ah=740&u_aw=1024&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=1&url=http://hotel.qunar.com/?ex_track=auto_533a6e98&ref=http://hotel.qunar.com/?ex_track=auto_533a6e98
hxxp://dart.l.doubleclick.net/adj/N9447.138294QUNAR.COM/B8124379.108774938;sz=728x90;ord=[timestamp]?
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/989346298/?random=881729412&cv=7&fst=1400839129696&num=1&fmt=3&value=0&label=iV1oCMbP0AUQ-vPg1wM&bg=ffffff&hl=en&guid=ON&u_h=768&u_w=1024&u_ah=740&u_aw=1024&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=1&url=http://hotel.qunar.com/?ex_track=auto_533a6e98&ref=http://hotel.qunar.com/?ex_track=auto_533a6e98&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
hxxp://userimg.qunar.ccgslb.net/site/images/wns/20140521_allban_black_4661_728x90.jpg
hxxp://www.google.com/ads/user-lists/989346298/?label=iV1oCMbP0AUQ-vPg1wM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=1&url=http://hotel.qunar.com/?ex_track=auto_533a6e98&ref=http://hotel.qunar.com/?ex_track=auto_533a6e98&random=921560081
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=rightBottomAd
hxxp://xnop012.tlgslb.com/qs/201405/23/e0c5f8ee69806b626886324a.png
hxxp://a.qunar.com/js.ng/framId=rightTopAd&chan=hotel&pg=home&pos=top&site=qunar&size=230x200&tile=140083911550977635&city=Ã¥Å’â€”Ã¤ÂºÂ¬
hxxp://www.google.ca/ads/user-lists/989346298/?label=iV1oCMbP0AUQ-vPg1wM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=1&url=http://hotel.qunar.com/?ex_track=auto_533a6e98&ref=http://hotel.qunar.com/?ex_track=auto_533a6e98&random=921560081&ipr=y
hxxp://a.qunar.com/js.ng/framId=rightMiddleBottomAd&chan=hotel&pg=home&pos=top&site=qunar&size=230x90&tile=140083911550977635&city=Ã¥Å’â€”Ã¤ÂºÂ¬
hxxp://userimg.qunar.ccgslb.net/site/images/zhuanti/131122/s.gif
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/activity/newie/n5_ledbean.png
hxxp://a.qunar.com/qadjs8.nghtml?framId=rightBottomAd&chan=hotel&pg=home&pos=right_bottom&site=qunar&qnum=8&qtype=js&type=textlink&tile=140083911550977635&city=Ã¥Å’â€”Ã¤ÂºÂ¬
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_h.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/rev_marquee.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/lnt_bg1.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/topic/Satyr_Game/Satyr_Game_icon.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/rev_light_on.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg.png?v=0531
hxxp://qhs.qunar.com/timetrack.htm?action=HH\|load\|21.188&t=1400839131000
hxxp://1st.xdwscache.glb0.lxdns.com/photo/10/60/shiang2345_56.com_.jpg?134?t=2014052322
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/icon/face_vip_static.png
hxxp://1st.xdwscache.glb0.lxdns.com/photo/4/3/lili1987422_b_56.com_.jpg?052322
hxxp://1st.xdwscache.glb0.lxdns.com/photo/72/26/taihang330_56.com_.jpg?789?t=2014052322
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/sub/ph_flower.png?v=0910
hxxp://1st.xdwscache.glb0.lxdns.com/photo/9/14/qq-zxltfiqayy_56.com_.jpg?653?t=2014052322
hxxp://xnop012.tlgslb.com/huodong/29/27/channel_20140504104628_44039.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/photo/48/85/shiang245_56.com_.jpg?433?t=2014052322
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/sub/ph_flower.png
hxxp://08913.xdwscache.glb0.lxdns.com/flashApp/vshow/seabed_treasure.11.07.29.a.swf
hxxp://08913.xdwscache.glb0.lxdns.com/flashApp/vshow_player_woxiu.14.04.24.a.swf
hxxp://1st.xdwscache.glb0.lxdns.com/photo/66/84/qq-rnskajoctj_56.com_.jpg?377?t=2014052322
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/woxiu_logo_play.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_icon.png
hxxp://1st.xdwscache.glb0.lxdns.com/admin/images/no_userhead_s.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/rev_icon_h.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/icon_mm.png?v=0821
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/icon_mm.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_sprite.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg_white.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/gift_small_v_1.png?v=1226
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/h_gift_small_v_1.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/gift/gs_v_2.png?v=07012
hxxp://xiu.stat.corp.v-56.com/play_conn?room_user_id=lili1987422&user_id=&ts=8275&try=1&cdn=ws
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_gift.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_sprite.png?v=0930
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/ug/icon_user_v_3.png?v=1130
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/tmp/gift_star_bg.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/ico_sp.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/gift_big_v_1.png?v=0902
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/icon/face_static.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/col/peihua.png?v=0813
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/bg_car.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/car_ivaca.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/player_woxiu.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/col/peihua.png
hxxp://08913.xdwscache.glb0.lxdns.com/flashApp/vshow/gift_shape/gift.13.10.18.a.swf
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_uhd.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/airing_sprite.gif
hxxp://xiu.stat.corp.v-56.com/jump1stat?roomid=lili1987422&pid=20111931&sid=214516&uuid=83915535286571
hxxp://7.ecoma.glb0.lxdns.com/index.php?action=Game/Lothario&do=Init&room_user_id=lili1987422&t=0.2922568222814131
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/base/v1/img/gift/game_icon/lock.gif
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/topic/Satyr_Game/timer_bg.gif

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1564:

t$(SSh

~%UVW

u$SShe

kernel32.dll

user32.dll

imm32.dll

imedllhost09.ime

GetAsyncKeyState

EnumWindows

UnloadKeyboardLayout

RegOpenKeyExA

RegCloseKey

API.dll

.text

`.rdata

@.data

.rsrc

@.reloc

winmm.dll

crossfire.exe

cfmogu@163.com

www.cfmogu.com

smtp.126.com

cfmogu@126.com

http://open.baidu.com/special/time/

window.baidu_time(

?user32.dll

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

iphlpapi.dll

SHLWAPI.dll

MPR.dll

WINMM.dll

WS2_32.dll

VERSION.dll

RASAPI32.dll

GetProcessHeap

WinExec

GetWindowsDirectoryA

KERNEL32.dll

GetKeyState

USER32.dll

GetViewportOrgEx

GDI32.dll

WINSPOOL.DRV

RegDeleteKeyA

RegCreateKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

COMCTL32.dll

WSOCK32.dll

HttpQueryInfoA

HttpSendRequestA

HttpOpenRequestA

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

GetCPInfo

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

HELO %s

SMTP

AUTH LOGIN

AUTH=LOGIN

EHLO %s

Content-Type: application/octet-stream; name=%s

Content-Disposition: attachment; filename=%s

MAIL FROM:<%s>

RCPT TO:<%s>

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÁ

#include "l.chs\afxres.rc" // Standard components

9 9Ÿ9K9s9

= =$=(=,=0=4=8=

3 4$4(4,404

4"565=5}5

4$4(4,4044484<4@4

;$<)<6<?<[<`<</pre><pre>http://www.cfmogu.com/index.html</pre><pre>www.cfmogu.cc</pre><pre>Y@http://www.cfmogu.com/0.htm</pre><pre>%System%\drivers\etc\hosts</pre><pre>127.0.0.1 www.cfyuanji.com</pre><pre>127.0.0.1 www.cfyuanji.net</pre><pre>127.0.0.1 www.cfyuanji.cc</pre><pre>127.0.0.1 cfyuanji.com</pre><pre>127.0.0.1 cfyuanji.net</pre><pre>127.0.0.1 cfyuanji.cc</pre><pre>127.0.0.1 www.cfyalan.com</pre><pre>127.0.0.1 www.cfyalan.net</pre><pre>127.0.0.1 www.cfyalan.cc</pre><pre>127.0.0.1 yy.cfyalan.com</pre><pre>127.0.0.1 cc.cfyalan.com</pre><pre>127.0.0.1 cfyalan.com</pre><pre>127.0.0.1 cfyalan.net</pre><pre>127.0.0.1 cfyalan.cc</pre><pre>127.0.0.1 www.cftianyue.com</pre><pre>127.0.0.1 www.cftianyue.net</pre><pre>127.0.0.1 www.cftianyue.cc</pre><pre>127.0.0.1 cftianyue.com</pre><pre>127.0.0.1 cftianyue.net</pre><pre>127.0.0.1 cftianyue.cc</pre><pre>%System%\drivers\etc\</pre><pre>^}•D</pre><pre>IMM32.dll</pre><pre>imehost.dll</pre><pre>ImeProcessKey</pre><pre>Windows</pre><pre>:):3:9:|:</pre><pre>? ?$?(?,?</pre><pre>Keyboard Layout\Preload\</pre><pre>Keyboard Layout\Preload\1</pre><pre>Keyboard Layout\Preload\2</pre><pre>Keyboard Layout\Preload\3</pre><pre>Keyboard Layout\Preload\4</pre><pre>Keyboard Layout\Preload\5</pre><pre>Keyboard Layout\Preload\6</pre><pre>Keyboard Layout\Preload\7</pre><pre>Keyboard Layout\Preload\8</pre><pre>Keyboard Layout\Preload\9</pre><pre>Keyboard Layout\Preload\10</pre><pre>Keyboard Layout\Preload\11</pre><pre>Keyboard Layout\Preload\12</pre><pre>Keyboard Layout\Preload\13</pre><pre>Keyboard Layout\Preload\14</pre><pre>Keyboard Layout\Preload\15</pre><pre>Keyboard Layout\Preload\16</pre><pre>Keyboard Layout\Preload\17</pre><pre>Keyboard Layout\Preload\18</pre><pre>Keyboard Layout\Preload\19</pre><pre>Keyboard Layout\Preload\20</pre><pre>%*.*f</pre><pre>www.dywt.com.cn</pre><pre>(*.htm;*.html)|*.htm;*.html</pre><pre>.PAVCOleException@@</pre><pre>.PAVCOleDispatchException@@</pre><pre>c:\%original file name%.exe</pre><pre>RegCreateKeyA</pre><pre>oledlg.dll</pre><pre>L.DRV</pre><pre>%&.VlG</pre><pre>.Gy$o</pre><pre>M3.fg</pre><pre>.Ghkc</pre><pre>1f.Xp</pre><pre>S;.aJ</pre><pre>.WRCub)</pre><pre>%sA#e</pre><pre>YW?D%Sp</pre><pre>t.GYeA</pre><pre>4.mn}l</pre><pre><.sQK</pre><pre>V-r}g</pre><pre>%uvCz</pre><pre>z.pKun</pre><pre>awU.Wr</pre><pre>.bv$P</pre><pre>.isW,~</pre><pre>Z*>*%D&</pre><pre>k}.te</pre><pre>4.Fb"</pre><pre>.wW*)</pre><pre>%SE9K</pre><pre>$^|';58<</pre><pre>?.Tkzza</pre><pre>Wj%fZ7</pre><pre>B`F%c</pre><pre>>^"%X</pre><pre>$U%x9</pre><pre>p=ü</pre><pre>?.SX_</pre><pre>:Ur=b%S)</pre><pre>%fuXg</pre><pre>%_.XE</pre><pre>3%%d|</pre><pre>%D[,:</pre><pre>W.lLj</pre><pre>.sbSP</pre><pre>-vadh}</pre><pre>:3-h}</pre><pre>][.Xt</pre><pre>(õ'</pre><pre>(*.*)</pre><pre>1.0.0.0</pre><pre>(http://www.eyuyan.com)</pre><pre>1, 0, 0, 1</pre><b>iexplore.exe_1860:</b><pre>%?9-*09,*19}*09</pre><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>msvcrt.dll</pre><pre>KERNEL32.dll</pre><pre>NTDLL.DLL</pre><pre>USER32.dll</pre><pre>SHLWAPI.dll</pre><pre>SHDOCVW.dll</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess</pre><pre>IE-X-X</pre><pre>rsabase.dll</pre><pre>System\CurrentControlSet\Control\Windows</pre><pre>dw15 -x -s %u</pre><pre>watson.microsoft.com</pre><pre>IEWatsonURL</pre><pre>%s -h %u</pre><pre>iedw.exe</pre><pre>Iexplore.XPExceptionFilter</pre><pre>jscript.DLL</pre><pre>mshtml.dll</pre><pre>mlang.dll</pre><pre>urlmon.dll</pre><pre>wininet.dll</pre><pre>shdocvw.DLL</pre><pre>browseui.DLL</pre><pre>comctl32.DLL</pre><pre>IEXPLORE.EXE</pre><pre>iexplore.pdb</pre><pre>ADVAPI32.dll</pre><pre>MsgWaitForMultipleObjects</pre><pre>IExplorer.EXE</pre><pre>IIIIIB(II<.Fg</pre><pre>7?_____ZZSSH%</pre><pre>)z.UUUUUUUU</pre><pre>,....Qym</pre><pre>````2```</pre><pre>{.QLQIIIKGKGKGKGKGKG</pre><pre>;33;33;0</pre><pre>8888880</pre><pre>8887080</pre><pre>browseui.dll</pre><pre>shdocvw.dll</pre><pre>6.00.2900.5512 (xpsp.080413-2105)</pre><pre>Windows</pre><pre>Operating System</pre><pre>6.00.2900.5512</pre></pre>