Trojan.Win32.Swrort.3_e2283248bc – Adaware

Trojan-Dropper.Win32.Injector.kgev (Kaspersky), Trojan.Win32.Swrort.3.FD, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: e2283248bc603682c1bb43d5d0a813f4

SHA1: d83f67484c1143242202f8d7371f85df9932d08c

SHA256: 6b6f554e690f2fa9e1f472e8514c4539d879c387962de01f7bc538fc7402aeb7

SSDeep: 49152:hKh 0Q3ZBgM7D5EGoe17N/FT /hOl8B4TTGfBVwPilxScSqmfZT89To apSb8GP5:x0Q3DDDCeTN JO2B1v35Fhxx

Size: 3819928 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: ????????????

Created at: 2014-07-03 16:08:15

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1196

The Trojan injects its code into the following process(es):

Explorer.EXE:1684

Mutexes

The following mutexes were created/opened:

RasPbFileWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!_!MSFTHISTORY!_c:!documents and settings!adm!local settings!temporary internet files!content.ie5!ShimCacheMutexadm_Pcmaster_LunarCalendarZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutex

File activity

The process %original file name%.exe:1196 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\plugins\weathericon\default.icn (125 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\101010100[1].shtml (6697 bytes)
C:\config\mytime\2014.xml (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ip.qq[1].htm (6289 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\mytime[1].xml (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ip.qq[1].txt (138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\101010100[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\alert[1].xml (11942 bytes)
C:\config\mytime\weatherlist.xml (6768 bytes)
C:\config\mytime\1.tmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\101010100[1].html (793 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
C:\plugins\mytime.dll (108 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
C:\config\mytime\mytimeset.cfg (8259 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\101010100[1].htm (5181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

C:\mytime.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\101010100[1].shtml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\mytime[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\101010100[1].html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAZ6GZR1.htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\101010100[1].htm (0 bytes)

Registry activity

The process %original file name%.exe:1196 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\RuanMei\MagicTray]
"PluginsPath" = "c:\plugins"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\RuanMei\MagicTray]
"ConfigPathNew" = "c:\config\mytime"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\RuanMei\PCMaster]
"AppStart" = "4294967295"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B D7 6B 1A 84 FC D8 BE 03 BB A4 4F 64 F9 0F 25"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"mytime" = "c:\%original file name%.exe"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
12c6bcfe58fa75d712c3fad06ebae410	c:\plugins\mytime.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Static Analysis

VersionInfo

Company Name: ????????????
Product Name: ????
Product Version: 3.0.0.58
Legal Copyright: ????
Legal Trademarks:
Original Filename: mytime.exe
Internal Name: mytime
File Version: 3.0.0.58
File Description: ????
Comments:
Language: English (United States)

Company Name: ????????????Product Name: ????Product Version: 3.0.0.58Legal Copyright: ????Legal Trademarks: Original Filename: mytime.exeInternal Name: mytimeFile Version: 3.0.0.58File Description: ????Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1123296	1123328	4.45208	a892fb4492f6881b2ecaf807f5830dd3
.rdata	1130496	239420	239616	3.70315	33e844d0758dfa445131d73dd7280e6a
.data	1372160	30892	16384	3.46195	1020b6d81ccca183548dd1d3e38191f2
.tls	1404928	9	512	0	bf619eac0cdf3f68d496ea9344137e8b
.rsrc	1409024	2362140	2362368	4.94083	2c1fcc27d0d4078941d6ec1c0be05e0e
.reloc	3772416	70828	71168	4.37359	380bd4caf1cf41cefab3413361bc5113

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://117.181.newidc2.cn/pcmaster/mytime.xml?r=1372562
hxxp://search.weather.com.cn/static/xxfb/rss/alert.xml?a=13725621372562	61.4.185.16
hxxp://ip.qq.com/	112.90.83.44
hxxp://117.181.newidc2.cn/api/xzs/aqi/citys/.json?t=1390843
hxxp://www.weather.com.cn/data/sk/101010100.html?_=1394656?t=13946561394656	61.4.185.205
hxxp://m.weather.com.cn/data/101010100.html?_=1395734	113.108.239.114
hxxp://www.weather.com.cn/weather/101010100.shtml?_=1396812	61.4.185.205
hxxp://dat.ruanmei.com/pcmaster/mytime.xml?r=1372562	122.225.117.181
hxxp://api.ruanmei.com/api/xzs/aqi/citys/.json?t=1390843	122.225.117.181

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /data/sk/101010100.html?_=1394656?t=13946561394656 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Host: VVV.weather.com.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache/2.2.0

Date: Thu, 31 Jul 2014 04:55:40 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: BIGipServerwww_pool=79234109.20480.0000; path=/

ab..{"weatherinfo":{"city":"......","cityid":"101010100","temp":"29","WD":"......","WS":"2...","SD":"64%","WSE":"2","time":"12:40","isRadar":"1","Radar":"JC_RADAR_AZ9010_JB"}}..0......

GET /weather/101010100.shtml?_=1396812 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.weather.com.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.0

Date: Thu, 31 Jul 2014 04:55:39 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip

Set-Cookie: BIGipServerwww_pool=45679677.20480.0000; path=/

600a..............ys...(..\...C...3&...JQ."A....<~..e23)...$l...P..T%.Zm..l.."[....,K..U......_...s..}ooh..,y '.....g?..{{....5.....P....._.1l.[...{.T.P.........B.8Sl....9..m`..X..FK..vUS#..|$_..~..FN...j.bc..bcf0=.D._..`q.bi...l..(V....Z(.(y.m.@....Ep.Z......0.R.\.1..]].K..z..{......k...O...y..q..~...........G...X/.~.....fE.v...K......>,.Z...u.|..8.....g..F.`..T....}..........WD ..P..k..F.Z....O..'.....C. w......W.o.W...Z...'.R.V_\1....W..0.?2/_k}..{98 !.. ..{I.O.EY...h.8g.<..."..............3...O.c../..m.~c.5c...uu.j{....y....L..D..d..|.z@o..uX.q...y.@........Zw..............|..?...?.h@.C.D.....v...6&LKKK..b.1W.1..V.K.h.R(....D.@J.....v`..........p@.K3...$%F..i...p@...b%...l..n....S88s.\m.ec..E7$o..Y3..x........,.(.......#X....SM.....G...7.|.......s.b..w....g. D.........=.E.)2S...@.V-..S.i....n.....J...... ........I0g.0o...D....bM..v(.z.PTr.F)_.*3.j.~.)....[i6.#Z{K.V\(...7....O.....:...[...P./.....k.)..."~....%.......XYf\.u0X........\......|.i&-...`..A..a.i_....Z....L`.lOW...L................j.Z.........S..........1H..U...\y y.T,..5....\a..}..-....._..n]*..sC....h.....r.|.6[......T...Hii.<S...C5......Z.[........z.1...[#t>..i...x7.CDN.Z).i..;..`.q%..m....\z [w.G......"\..J}!W........2l..x..ziwq.,].U....P .....G......fh...X....`..,A.....X...F....w...#B..r......!`l....u. 1.C..K.S..Ju..]C...(..i0..0..ra ...\.. .......R.8.8.....j..qx..x.9..6b_....:..\.#0......SS.V.s,.d2...6.%8..Ab...q4@.......@.X...VA.....d.<.bm.fP..r..l..>......Z.D...!...I*.!.ET.8.). .&e..&..3kl%3X...ri.^.3Z$S.2..\..5.X..V[..

<<< skipped >>>

GET /data/101010100.html?_=1395734 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: m.weather.com.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Thu, 31 Jul 2014 04:57:04 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Content-Encoding: gzip

319............u..R.@...%..CH@..|....i.v$.t.....E.........SD.:U..w..%|. t...%...l~.....5,J...9......ibQ....iB".}..JO.....=..gFa.....k..L.*.:Wh..../...`-..s....m..V.P.;;.H...:.4>%.'....^..2wk..1..z09.*...#. R..S.....`:.I.9...t\.[./'..4|{.&Q.#....,z....O).8......../ J.z..(.s.|..=.>...4y.UE.j..T.....N....Y.0..v....,.w.&....6V.0..1f.0&.....0q. ..0.D(..$...E.",`^..WC3.3...@R..T.$.. o2\.?.....Q....~......O.->...........X.. Y0..,Ac...Tc).:.;....ZD?...8.H..$........A.$JB.\)R!.G..r.e[.....<.."&'...(b.....#hV/a/.;.z.7.@.7..|.g....M.\[n.....f...:.;..q_^....f.t...m....@.vN..f.T.... .....t. ....... ..C*... ..7..e.=...../R..`_...FHS3aq...2..sMa}L.....qN......@.9i?*....BNh...x.$..EG.h.^.....'.^..E.R."......k...9...................\4q].....S..K.a......M\...7.c/.v..<<CR.r#\?_.L.,...)....=.%[.....I.P.......0..

GET /api/xzs/aqi/citys/.json?t=1390843 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.ruanmei.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Content-Type: text/html

Server: Microsoft-IIS/8.5

X-Powered-By: ASP.NET

Date: Thu, 31 Jul 2014 04:56:51 GMT

Content-Length: 1163

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=gb2312"/>..<title>404 - ..................</title>..<style type="text/css">....</style>..</head>..<body>..<div id="header"><h1>..........</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - ..................</h2>.. <h3>......................................................</h3>.. </fieldset></div>..</div>..</body>..</html>..HTTP/1.1 404 Not Found..Content-Type: text/html..Server: Microsoft-IIS/8.5..X-Powered-By: ASP.NET..Date: Thu, 31 Jul 2014 04:56:51 GMT..Content-Length: 1163..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Stric

<<< skipped >>>

GET / HTTP/1.1

User-Agent: GetWeb

Host: ip.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 31 Jul 2014 04:56:49 GMT

Server: Apache/2.4.2 (Unix)

Cache-Control: max-age=0, must-revalidate

Set-Cookie: ipqqcom_user_id=609573; Domain=ip.qq.com; Expires=Fri, 01 Aug 2014 04:56:49 GMT; Path=/; HTTPOnly

Keep-Alive: timeout=15, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html

f4c..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=7">..<link rel="stylesheet" type="text/css" href="/css/global.css"/>..<link rel="stylesheet" type="text/css" href="/css/ip.css"/>..<link rel="stylesheet" href="/css/thickbox.css" type="text/css" media="screen" />..<link href="/css/help.css" rel="stylesheet" type="text/css" />..<title>....IP........_IP....</title>..<script src="/js/prototype.js"></script>..<script language="JavaScript" type="text/javascript" src="/js/showlayer.js"></script>..<script language="JavaScript" type="text/javascript" src="/js/public.js"></script>..<script language="JavaScript" type="text/javascript" src="/js/geo.js"></script>..<script language="JavaScript" type="text/javascript" src="/js/jquery.js"></script>..<script language="JavaScript" type="text/javascript" src="/js/iplist_thickbox.js"></script>..</head>..<body onload="setup();Change_Hide_bak(1);login_in(0);status();preselect('');ShowIndex();">..<div class="header">.. <div class="padder"> <a class="logo" title="...." style="background-image:url(/img/logo.jpg); width: 300px; height: 72px;"> </a>.. <div class="l

<<< skipped >>>

GET /static/xxfb/rss/alert.xml?a=13725621372562 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: search.weather.com.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache/2.2.6 (Unix) DAV/2 SVN/1.4.6 mod_jk/1.2.26

Date: Thu, 31 Jul 2014 04:55:20 GMT

Content-Type: text/xml; charset=utf-8

Content-Length: 54060

Last-Modified: Thu, 31 Jul 2014 02:57:28 GMT

Connection: keep-alive

Accept-Ranges: bytes

<?xml version="1.0" encoding="utf-8"?>.<rss version="2.0" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:content="hXXp://purl.org/rss/1.0/modules/content/"><channel><title>..................</title><link>hXXp://VVV.weather.com.cn/alarm/newalarmlist.shtml</link><language>zh</language><item><title>...................................................</title><link>hXXp://VVV.weather.com.cn/alarm/newalarmcontent.shtml?file=1011101-20140731104110-0703.html</link><atype>......</atype><alevel>......</alevel><astatus>.........</astatus><img>hXXp://VVV.weather.com.cn/m2/i/alarm_s/0703.gif</img><description><![CDATA[..................2014...7...31...10...30......................................................24....................................37..........................................]]></description><pubDate>2014-07-31 10:41:10</pubDate></item><item><title>...............................................................</title><link>hXXp://VVV.weather.com.cn/alarm/newalarmcontent.shtml?file=1013003-20140731103959-0703.html</link><atype>......</atype><alevel>......</alevel><astatus>.........</astatus><img>hXXp://VVV.weather.com.cn/m2/i/alarm_s/0703.gif</img><description><![CDA.....................</title><link>hXXp://VVV.weather.com.cn/alarm/newalarmcon

<<< skipped >>>

GET /pcmaster/mytime.xml?r=1372562 HTTP/1.1

Host: dat.ruanmei.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/xml

Last-Modified: Mon, 28 Jul 2014 07:30:49 GMT

Accept-Ranges: bytes

ETag: "809a54da35aacf1:0"

Server: Microsoft-IIS/8.5

X-Powered-By: ASP.NET

Date: Thu, 31 Jul 2014 04:56:32 GMT

Content-Length: 1712

....A.nr3$..L:.......#.?...#.U.B...Ve...B.....Ru&q|...@ .IK.K.I.H.....dY......Vo&.A.......5{.z&N..."....r6w"!!?.T%.5).._6x:..d<.....t"....|\Q..y.t%>wq..Q...\~...5.......[.|;.D*....fl..]:%..}U......>...K/P.....4...O#.X........0|.*.........M.1.)...dJ...........l<.Qn...p......-.}Q.@...KJ...Q.W...x.....p./.u.W...3.(..=h......6Z.2...q.....2...k@.l...b...........@..}....20.O[......l...s......t...Ns.[.@......Jn....?.........x.j....Y.E.....@..$..J...v.O./.<'..hQ....~..z.,.M.D:.H)..pl....nVHm...O..;\.[....ni....Y.E.tv<%...0i.....>.>..Q...5..=\~F.....&...8.\..T.7F.y...R...X....^.lz.......*............"w-..4,....Ce......Iz.......|..,..rt.r.y..M0...G1S&J...Me.'.,...q.np.s.f5.`.ax<....9.w....i.K....NWy.e."x=?j...\R.,........z.,.M.D.).S......jee8..Ex.G...Y-..Y.....KW.N..IH....s.*.|..L.nVG...X..`....W./.>..%OY...9....KZH.........=\~F..5..W..#>.z.....)....w....qQ....:.Qe[.1..t.1..e...b;.Z?Q......9..1 .l.JC.....GM......zw)Y.3m..Z.Um....O...#e....08...pd'.a.....w7G.Q........!.....k......a_..q....6.p...... >....u..xH!e.3).J....J6.m&.q..6.p....S~3._'..Ex.G...Yy...........nVHm.R.{P_s..y.]D.....0..z.............Zx.....m......Iz.....].0..i1....w........{.<...IN$K&.x\o.@0.S.....c..Y......[.9..Fa4..Y1.z....|..L.nV.f:&. &.-m7}.U...7.9...#-.....`5.YK.f=......../a\..oeM.*........:D.M.Y..m.8.D.A=...)...CR.....`..imG....M.6j3.Gib.....y......i...F..T.......zw)Y...x...t.y...R..X...8. .Gk*....X....Nq...]..;...8.......Z..hJ9sP.?)..aH.......j...<.R..@LCFYi..b......E*.i="w..W..B.!...........LCFYi..bH.Iq..

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1196:

.text

`.rdata

@.data

.rsrc

@.reloc

SSSSh

SSShp

SSShT

t;SSSh

SSShx

SSShh

SSSh@

RSShx

xSSSh

FTPjKS

FtPj;S

C.PjRV

<4,$?7/'

(3-!0,1'8"5.*2$

&#xX;

%s="%s"

%s='%s'

<![CDATA[%s]]>

version="%s"

encoding="%s"

standalone="%s"

-NHS}Y

MSXML2.XMLHTTP

USER32.dll

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

operator

GetProcessWindowStation

`'\%D,3

dwmapi.dll

UxTheme.dll

1.2.5

D:\TFS_New2013\MagicTray2013\MagicTray\Bin\Release\mytime.pdb

SetWindowsHookExW

EnumChildWindows

GetKeyState

KERNEL32.dll

GDI32.dll

COMDLG32.dll

RegOpenKeyExW

RegCloseKey

RegFlushKey

RegCreateKeyExW

RegEnumKeyExW

ADVAPI32.dll

ShellExecuteExW

ShellExecuteW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

gdiplus.dll

VERSION.dll

URLDownloadToFileW

urlmon.dll

InternetOpenUrlW

HttpEndRequestW

HttpSendRequestExW

HttpOpenRequestW

HttpQueryInfoW

WININET.dll

IPHLPAPI.DLL

WINMM.dll

dbghelp.dll

GetProcessHeap

GetCPInfo

COMCTL32.dll

GdiplusShutdown

GdipSetImageAttributesColorKeys

.?AVCHttpFile@@

.?AVCUIWebBrowser@meiui@@

.?AVCActiveXEnum@meiui@@

zcÁ

\rm_pcmaster.config##p

c:\%original file name%.exe

j%uP/

T.WH\

r%S[Y

G#.kt

m%XbA

%2xF4T-

ru.pC

-\%DOmk7|

.Gpu'!

,%ukZ<</pre><pre>"=.Dx</pre><pre>D}/d%X</pre><pre>.FF [</pre><pre>.UW<[</pre><pre>(Y.Uh</pre><pre>.DfkS</pre><pre>i.si.</pre><pre>c.oQ0</pre><pre>dwmapi.xTh"</pre><pre>.win;@</pre><pre>td.pdb</pre><pre>.if$$</pre><pre><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></pre><pre>KERNEL32.DLL</pre><pre>countdown.dll</pre><pre>http://www.usertrust.com1</pre><pre>1http://crl.usertrust.com/UTN-USERFirst-Object.crl05</pre><pre>http://ocsp.usertrust.com0</pre><pre>2Terms of use at https://www.verisign.com/rpa (c)101.0,</pre><pre>jOôA</pre><pre>/http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D</pre><pre>https://www.verisign.com/rpa0</pre><pre>http://ocsp.verisign.com0;</pre><pre>/http://csc3-2010-aia.verisign.com/CSC3-2010.cer0</pre><pre><VeriSign Class 3="3" Public Primary Certification Authority - G50><pre>https://www.verisign.com/cps0*</pre><pre>#http://logo.verisign.com/vslogo.gif04</pre><pre>#http://crl.verisign.com/pca3-g5.crl04</pre><pre>http://ocsp.verisign.com0</pre><pre>_ry.WM</pre><pre>M.tgE#</pre><pre>H.ht.</pre><pre>(!%Uj</pre><pre>l.jE/=0</pre><pre>;1B%sP</pre><pre>4]F%d</pre><pre>={E%Sb</pre><pre>%2%Sr</pre><pre>a/.Xp</pre><pre>ru.pCK</pre><pre>-\=wGo</pre><pre>.Gpu'</pre><pre>@2.SX</pre><pre>t%SZ"</pre><pre>XQ-5r}</pre><pre>@.SNO</pre><pre>@.ZXK</pre><pre>'.Wjl</pre><pre>.ZNu<]</pre><pre>(tv%f</pre><pre>FTp85X-</pre><pre>Kso%u</pre><pre>USER32.dll</pre><pre>X10`.KI</pre><pre>i.UNrqIn</pre><pre>?dwmapi.xThf</pre><pre>flf 1.2.5</pre><pre>H.hKd</pre><pre>Key^;1</pre><pre>L9.Rjb</pre><pre>WebBr</pre><pre>.QUH"</pre><pre>em.hover"</pre><pre>!.fSH</pre><pre>[urRjc'&%Xh(T</pre><pre>.rc[R?t</pre><pre>P#=.Ck|QU</pre><pre>?%D*S</pre><pre>remind.dll</pre><pre>.pdata</pre><pre>@.rsrc</pre><pre>8%u&H</pre><pre>RegOpenKeyTransactedW</pre><pre>RegCreateKeyTransactedW</pre><pre>RegDeleteKeyTransactedW</pre><pre>FRegDeleteKeyExW</pre><pre>RegDeleteKeyW</pre><pre>RegQueryInfoKeyW</pre><pre><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="amd64" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></pre><pre>P.sO|</pre><pre>r%f;A</pre><pre>D:\TFS_New2013\MagicTray2013\MagicTray\Bin\Release\mytime_x64.pdb</pre><pre>fWk%D/</pre><pre>.WVQC,</pre><pre>.ANN2` </pre><pre>@.lp.</pre><pre>8ËW</pre><pre>A;.oq</pre><pre>^`.Zm</pre><pre>&.QPWu</pre><pre>Y.o%uYF</pre><pre>p%4X A</pre><pre>vY.EN28</pre><pre>USER32.dsi</pre><pre>!"#$%&'()* ,-./0123456789:;<=>?</pre><pre>1.2.5</pre><pre>;.wog</pre><pre>.com/z</pre><pre>.TBm"a#I</pre><pre>dQ-iJ}k</pre><pre>DBKeyb</pre><pre>.%c_T</pre><pre>#v`.rd</pre><pre><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></pre><pre>0.png</pre><pre>1.png</pre><pre>10.png</pre><pre>11.png</pre><pre>`.Acc#]oG/</pre><pre>.UpYz</pre><pre>12.png</pre><pre>13.png</pre><pre>14.png</pre><pre>15.png</pre><pre>16.png</pre><pre>17.png</pre><pre>18.png</pre><pre>19.png</pre><pre>2.png</pre><pre>20.png</pre><pre>21.png</pre><pre>.jkkM</pre><pre>22.png</pre><pre>23.png</pre><pre>24.png</pre><pre>25.png</pre><pre>26.png</pre><pre>27.png</pre><pre>28.png</pre><pre>29.png</pre><pre>3.png</pre><pre>30.png</pre><pre>@9%u{</pre><pre>31.png</pre><pre>4.png</pre><pre>5.png</pre><pre>53.png</pre><pre>6.png</pre><pre>7.png}VgPSY</pre><pre>8.png</pre><pre>9.png</pre><pre>7.png</pre><pre>images/calendar/calendarfootball.png</pre><pre>images/calendar/calendartip_bg.png</pre><pre>images/calendar/datebg1.png</pre><pre>images/calendar/datebg2.png</pre><pre>images/calendar/day.png</pre><pre>images/calendar/hover.png</pre><pre>images/calendar/NationalHolidays.png</pre><pre>images/calendar/NationalHolidays_DayOff.png</pre><pre>images/calendar/NationalHolidays_piao.png</pre><pre>-wfV}</pre><pre>images/calendar/NationalHolidays_qiu(0).png</pre><pre>images/calendar/NationalHolidays_qiu.png}Ryh</pre><pre>images/calendar/next_mon.png</pre><pre>images/calendar/pre_mon.png</pre><pre>images/calendar/sel.png</pre><pre>images/calendar/split.png</pre><pre>images/calendar/today.png</pre><pre>images/calendar/weather_6day.png</pre><pre>images/calendar/weekbg_blue.png</pre><pre>images/calendar/weekbg_red.png</pre><pre>images/common/button.png</pre><pre>images/common/combo.png</pre><pre>images/common/combo2.png</pre><pre>images/common/comboitembg.png</pre><pre>images/common/common_edit.png</pre><pre>images/common/dropbox_bg.png</pre><pre>images/common/item.hover.png</pre><pre>images/common/item.normal.png</pre><pre>images/common/item.pushed.png</pre><pre>images/common/scrollbar.png</pre><pre>images/common/setlabelbg.png</pre><pre>%frOY</pre><pre>images/common/vscrollbar.png</pre><pre>images/common/vscrollbar1.png</pre><pre>images/dynamicweather/cloudy.jpg</pre><pre>]?.wsPJ</pre><pre>>T-t}vlLA=B{</pre><pre>.djU'\</pre><pre>q!%ua1)</pre><pre> .VJM</pre><pre>images/dynamicweather/dust.jpg</pre><pre> .PU)</pre><pre>j0G%U</pre><pre>images/dynamicweather/fog.jpg</pre><pre>images/dynamicweather/rain_big.jpg</pre><pre>images/dynamicweather/rain_mid.jpg</pre><pre>t^Yõ</pre><pre>images/dynamicweather/rain_small.jpg</pre><pre>images/dynamicweather/RemindNotice_Bg.png</pre><pre>images/dynamicweather/snow.jpg</pre><pre>.FH-}</pre><pre>9m.iS</pre><pre>.mR-k</pre><pre>.Lv_I</pre><pre>images/dynamicweather/suncloud.jpg</pre><pre>3Y.KS</pre><pre>%C'dga</pre><pre>ZnH.HP</pre><pre>5 R6.Dk</pre><pre>-o}SS3</pre><pre>images/dynamicweather/sunshine.jpg</pre><pre>qf:.vz</pre><pre>images/flowwindow/flowwindow_dateicon.png</pre><pre>images/flowwindow/flowwindow_itembg.png</pre><pre>images/flowwindow/flowwindow_itembtn.pngm</pre><pre>images/flowwindow/flowwindow_timeicon.png</pre><pre>images/flowwindow/flowwindow_weathericon.png</pre><pre>images/flowwindow/num_big_0.png</pre><pre>images/flowwindow/num_big_1.png</pre><pre>images/flowwindow/num_big_2.png</pre><pre>images/flowwindow/num_big_3.png</pre><pre>images/flowwindow/num_big_4.png</pre><pre>images/flowwindow/num_big_5.png</pre><pre>images/flowwindow/num_big_6.png</pre><pre>images/flowwindow/num_big_7.png</pre><pre>images/flowwindow/num_big_8.png</pre><pre>images/flowwindow/num_big_9.png</pre><pre>H#Y{.dR</pre><pre>images/flowwindow/num_big_below.png</pre><pre>images/flowwindow/num_big_celsius.png</pre><pre>images/flowwindow/num_big_point.png</pre><pre>images/flowwindow/num_big_point2.png</pre><pre>images/flowwindow/num_small_0.png</pre><pre>images/flowwindow/num_small_1.png</pre><pre>images/flowwindow/num_small_2.png</pre><pre>images/flowwindow/num_small_3.png</pre><pre>images/flowwindow/num_small_4.png</pre><pre>images/flowwindow/num_small_5.png</pre><pre>images/flowwindow/num_small_6.png</pre><pre>images/flowwindow/num_small_7.png</pre><pre>images/flowwindow/num_small_8.png</pre><pre>images/flowwindow/num_small_9.png</pre><pre>images/flowwindow/weatherremind_blue.png}S]H</pre><pre>images/flowwindow/weatherremind_orange.png}S[H</pre><pre>images/flowwindow/weatherremind_red.png</pre><pre>images/flowwindow/weatherremind_yellow.png}S]H</pre><pre>7{O .GR</pre><pre>images/main/aero.png</pre><pre>images/main/aero_left.png</pre><pre>images/main/aero_right.png</pre><pre>images/main/chkbox.png</pre><pre>images/main/close.png</pre><pre>images/main/max.png</pre><pre>images/main/menu.png</pre><pre>images/main/min.png</pre><pre>images/main/mytime.png</pre><pre>images/main/radio.png}R</pre><pre>%S!!Ql</pre><pre>images/main/remindbg.png</pre><pre>images/main/restore.png</pre><pre>images/main/skin.png</pre><pre>images/main/switch.png</pre><pre>*!X%Xi</pre><pre>images/plugins/alarmclock.png}S</pre><pre>images/plugins/notepad.png}S</pre><pre>images/plugins/plugins_bg.png</pre><pre>images/plugins/tipbg.png</pre><pre>.Xs:6</pre><pre>images/timemanage/addicn.png</pre><pre>images/timemanage/countdown_add.png</pre><pre>images/timemanage/countdown_bg0.png</pre><pre>images/timemanage/countdown_bg1.png</pre><pre>images/timemanage/countdown_cancle.png</pre><pre>images/timemanage/itemdel.png</pre><pre>images/timemanage/stopwatch_bg.png</pre><pre>SFTp</pre><pre>images/timemanage/stopwatch_btn.png</pre><pre>images/timemanage/time_label.png}S</pre><pre>images/timemanage/worldtime_clockbg.png</pre><pre>images/timemanage/worldtime_hour.png</pre><pre>images/timemanage/worldtime_minute.png</pre><pre>resources.xml</pre><pre>xmls/about.xml</pre><pre>xmls/calendar.xml</pre><pre>xmls/calendartip.xml</pre><pre>xmls/citylist_item.xml</pre><pre>xmls/flowwindow.xml</pre><pre>%cWU4</pre><pre>.SIT$</pre><pre>xmls/mainframe.xml</pre><pre>xmls/pluginsmanager.xml</pre><pre>xmls/pluginstip.xmlU</pre><pre>xmls/set.xml</pre><pre>xmls/timemanage.xml</pre><pre>xmls/timemanage_countdown_item.xml</pre><pre>xmls/timemanage_stopwatch_item.xml</pre><pre>xmls/timemanage_worldtime_item.xml</pre><pre>xmls/weather.xml</pre><pre>xmls/weatherremind.xml</pre><pre>xmls/worldcup.xml</pre><pre>images/calendar/NationalHolidays_qiu.png</pre><pre>images/flowwindow/flowwindow_itembtn.png</pre><pre>images/flowwindow/weatherremind_blue.png</pre><pre>images/flowwindow/weatherremind_orange.png</pre><pre>images/flowwindow/weatherremind_yellow.png</pre><pre>images/main/radio.png</pre><pre>images/plugins/alarmclock.png</pre><pre>images/plugins/notepad.png</pre><pre>images/timemanage/time_label.png</pre><pre>xmls/pluginstip.xml</pre><pre>keY<h><pre>0Q0b0p0</pre><pre><%<3<8<@<_><pre>2-3:3?3[3</pre><pre>6-7G7x7}7</pre><pre>4 4$4(4,4044484<4</pre><pre>0 0$0(0,0</pre><pre>< <$<(<,<0<</pre><pre>= =$=(=,=0=4=8=<=</pre><pre>6 6$6(6,6064686<6</pre><pre>? ?$?(?,?</pre><pre>: :$:(:,:0:4:8:<:@:</pre><pre>1(141<1\1</pre><pre>4 4$4(4,404</pre><pre>ntdll.dll</pre><pre>xx</pre><pre>\StringFileInfo\%s\ProductName</pre><pre>\StringFileInfo\%s\FileDescription</pre><pre>\StringFileInfo\%s\FileVersion</pre><pre>\StringFileInfo\%s\ProductVersion</pre><pre>\StringFileInfo\%s\OriginalFilename</pre><pre>\StringFileInfo\%s\LegalCopyright</pre><pre>\StringFileInfo\%s\InternalName</pre><pre>\StringFileInfo\%s\CompanyName</pre><pre>%d.%d.%d.%d</pre><pre>explorer.exe /e,/select,"</pre><pre>explorer.exe /e,/select,</pre><pre>%%X%%X</pre><pre>%s.bak%I64dd</pre><pre>%%X</pre><pre>%%X%%X%%X</pre><pre>.%d.tmp</pre><pre>Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice</pre><pre>Software\Classes\http\shell\open\command</pre><pre>pcmaster.exe</pre><pre>saayaa.exe</pre><pre>cooldock.exe</pre><pre>explorer.exe</pre><pre>OpenUrlWithSaayaa</pre><pre>Internet Explorer\iexplore.exe</pre><pre>http://dat.ruanmei.com/pcmaster/upgrade6.xml</pre><pre>%s?r=%d</pre><pre>rmup.exe</pre><pre>http://down.ruanmei.com/%s?skq=%d</pre><pre>\\.\PhysicalDrive%d</pre><pre>Internet open url failed! error code</pre><pre>\sfc_os.dll</pre><pre>takeown /f %s</pre><pre>icacls %s /grant</pre><pre>%username%:F</pre><pre>icacls %s /grant *S-1-1-0:(F)</pre><pre>.old.tweakcube</pre><pre>.temp.tweakcube</pre><pre>%u.%u.%u.%u</pre><pre>http://www.6655.com/?f=sh</pre><pre>=============SendData:version:%d----%d==%s==%d==%s=</pre><pre>http://www.hao123.com/?tn=12092018_15_hao_pg</pre><pre>http://www.duba.com/?un_383619_1</pre><pre>http://www.2345.com/?11319</pre><pre>^(http://)?(www\.)?hao123\.com(/?(\?tn=. )?)?$</pre><pre>^(http://)?(www\.)?duba\.com(/?(\?.)?)?$</pre><pre>winguard.dll</pre><pre>^(http://)?(www\.)?2345\.com(/?(\?\d )?)?$</pre><pre>http://www.google.com.hk/search?ie=utf-8&oe=utf-8&hl=zh-cn&q={searchterms}</pre><pre>http://www.google.com/favicon.ico</pre><pre>winguard.exe</pre><pre>winguard_x64.dll</pre><pre>winguard_x64.exe</pre><pre>{DAFC3089-C966-4796-BF72-E6BB9C4BB8E5}</pre><pre>http://www.bing.com/search?q={searchTerms}</pre><pre>http://www.bing.com/favicon.ico</pre><pre>{0633EE93-D776-472f-A0FF-E1416B8B2E3A}</pre><pre>http://www.baidu.com/s?tn=mswin_oem_dg&ie=utf-8&word={searchTerms}</pre><pre>http://www.baidu.com/favicon.ico</pre><pre>http://suggestion.baidu.com/su?wd={searchTerms}&action=opensearch&ie={inputEncoding}&from=ie8</pre><pre>{0E7B197B-A3DE-4FD4-A19A-1EECF791D16F}</pre><pre>mshtml.dll</pre><pre>%s\log\winguard-d-d-d-d-d-d.log</pre><pre>MoveFile Faild === [%s] [%s] [%d]</pre><pre>IE.AssocFile.HTM</pre><pre>.html</pre><pre>IE.AssocFile.URL</pre><pre>IE.AssocFile.MHT</pre><pre>.mhtml</pre><pre>.shtm</pre><pre>.shtml</pre><pre>Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32</pre><pre>https</pre><pre>Software\Classes\%s\shell</pre><pre>Software\Classes\%s\shell\%s\command</pre><pre>IE.HTTP</pre><pre>IE.HTTPS</pre><pre>HTTPS</pre><pre>IE.FTP</pre><pre>%s.HTTP</pre><pre>%s.AssocFile.HTM</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\</pre><pre>IEXPLORE.EXE</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE</pre><pre>Software\Microsoft\Windows\Shell\Associations\UrlAssociations\</pre><pre>%s.%s</pre><pre>Kernel32.dll</pre><pre>%c:%I64d~%I64d</pre><pre>%dx%d</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion</pre><pre>6.3.9600</pre><pre>%d.%d.%d</pre><pre>360tray.exe</pre><pre>zhudongfangyu.exe</pre><pre>360sd.exe</pre><pre>360rp.exe</pre><pre>ksafetray.exe</pre><pre>ksafesvc.exe</pre><pre>kscan.exe</pre><pre>kxetray.exe</pre><pre>qqpctray.exe</pre><pre>qqpcwebshield.exe</pre><pre>qqpcrtp.exe</pre><pre>avgnt.exe</pre><pre>avcenter.exe</pre><pre>egui.exe</pre><pre>ekrn.exe</pre><pre>rstray.exe</pre><pre>ravmond.exe</pre><pre>avp.exe</pre><pre>msmpeng.exe</pre><pre>ccsvchst.exe</pre><pre>bdagent.exe</pre><pre>kvmonxp.exe</pre><pre>kvsrvxp.exe</pre><pre>uiseagnt.exe</pre><pre>coreframeworkhost.exe</pre><pre>coreserviceshell.exe</pre><pre>uiwatchdog.exe</pre><pre>mcshield.exe</pre><pre>cfp.exe</pre><pre>baidusd.exe</pre><pre>baidusdsvc.exe</pre><pre>baidusdtray.exe</pre><pre>baiduantray.exe</pre><pre>baiduan.exe</pre><pre>baiduansvc.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>version:%s;business:magictray;setup:%s;cpu:%s;memory:%s;disk:%s;partition:%s;resolution:%s;mac:%s;os:%s;ie:%s;process:%d;autorun:%d;browser:%d;defaultbrowser:%d;</pre><pre>http://union.ruanmei.com/receive/postdata.aspx?uid=</pre><pre>http://union.ruanmei.com/receive/install.aspx?uninstall=1&uid=</pre><pre>http://union.ruanmei.com/receive/install.aspx?uid=</pre><pre>&r=%d</pre><pre>drivers\ANDROIDUSB.sys</pre><pre>&t2=%d</pre><pre>0126|0208|0504|0928|1011</pre><pre>%s %s</pre><pre>hd32-d-d-d-d-d-d-%s.</pre><pre>Last Error: %d, HRESULT %d, File: %s</pre><pre>.zip&v=</pre><pre>union.ruanmei.com</pre><pre>/receive/errorlog.aspx?p=mytime&f=</pre><pre>rkernel32.dll</pre><pre>d-d-d d-d</pre><pre>mytime.exe</pre><pre>mytime.pdb</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>Windows:</pre><pre>%d.%d.%d, SP %d.%d</pre><pre>EIP: X EFlags: X</pre><pre>ESI: X EDI: X ESP: X EBP: X</pre><pre>EAX: X EBX: X ECX: X EDX: X</pre><pre>X,</pre><pre>Operation:</pre><pre>[0xX] Cannot %s.</pre><pre>0xX</pre><pre>d/d/%d</pre><pre>[ExeFileInfo]</pre><pre>d-d-d d:d:d</pre><pre>(%X, %X, %X, %X, %X)</pre><pre> X</pre><pre>%sX %s</pre><pre>so.6655.com</pre><pre>http://so.6655.com/favicon.ico</pre><pre>{C30DAF89-C966-4796-F7B2-EC4BB8E6BB95}</pre><pre>http://so.6655.com/?s_type=1&k1={searchTerms}</pre><pre>souxia.com</pre><pre>http://www.souxia.com/favicon.ico</pre><pre>{EE930633-72f4-76D7-A0FF-142E3A16EB8C}</pre><pre>http://www.souxia.com/search.aspx?wd={searchTerms}&ie=utf-8</pre><pre>sogou.com</pre><pre>http://www.sogou.com/favicon.ico</pre><pre>{EE930633-72f4-76D7-A0FF-142E3A16EB8B}</pre><pre>http://www.sogou.com/sogou?query={searchTerms}&ie=utf8&pid=sogou-clse-c07d4fe1bad8cc10</pre><pre>baidu.com</pre><pre>http://www.SoSo.com/favicon.ico</pre><pre>{EE930633-72f4-76D7-A0FF-142E3A16EB8D}</pre><pre>http://www.soso.com/q?w={searchTerms}&unc=s400021_4&cid=union.s.wh&ie=utf-8</pre><pre>http://www.google.com.hk/search?client=aff-6655&forid=1&ie=utf-8&oe=UTF-8&hl=zh-CN&q={searchTerms}</pre><pre>%sX</pre><pre>http://dat.ruanmei.com/pcmaster/mytime.xml</pre><pre>mytime.cfg</pre><pre>default.icn</pre><pre>default.snd</pre><pre>I_RuanmeiTime_%dd</pre><pre>http://www.12306.cn/mormhweb/</pre><pre>dd</pre><pre>%s\%d.xml</pre><pre>MSXML2.MXXMLWriter</pre><pre>MSXML2.SAXXMLReader</pre><pre>%s %s %s</pre><pre>%s %s%s</pre><pre>%c%c%c</pre><pre>ddd</pre><pre>worldcup_match%d</pre><pre>res='%s' corner='4,4,4,4'</pre><pre>mainframe.birthdayIcon</pre><pre>mainframe.remindIcon</pre><pre>res='%s' corner='2,2,2,2'</pre><pre>\mytime.txt</pre><pre>kernel32.dll</pre><pre>%d:d</pre><pre>%s %s PM2.5</pre><pre>IDB_DynamicWeather_%d</pre><pre>dest='%d,%d,%d,%d'</pre><pre>%s\mytimeset.cfg</pre><pre>%s\weatherlist.xml</pre><pre>%s\weathericon\default.icn</pre><pre>%s\mytimeinj.exe</pre><pre>%s\mytime.dll</pre><pre>\mytime.dll</pre><pre>\mytimeinj.exe</pre><pre>%Y-%m-%d</pre><pre>\TrayClock.xml</pre><pre>\sound\default.snd</pre><pre>upgrade\default.snd</pre><pre>1230.wav</pre><pre>d30.wav</pre><pre>12.wav</pre><pre>%s.wav</pre><pre>d.wav</pre><pre>%d-d-d d:d</pre><pre>d,</pre><pre>%d-d-d</pre><pre>weathericon_%s_png</pre><pre>%s.png</pre><pre>http://go.ruanmei.com/url.aspx?linkid=155</pre><pre>http://xzs.ithome.com</pre><pre>/select,%s</pre><pre>Rundll32.exe</pre><pre>Shell32.dll,Control_RunDLL timedate.cpl</pre><pre>\rmup.exe</pre><pre>plugins\sound\default.snd</pre><pre>http://bbs.ithome.com/thread-466493-1-1.html</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones</pre><pre>b%s?r=%d</pre><pre>IDB_countdown_bg%d</pre><pre>\worldtime.xml</pre><pre>%d-d-d d:d:d</pre><pre>d:d:d</pre><pre>d:d</pre><pre>%s,%s,%s,%s|</pre><pre>%s %s</pre><pre>http://search.weather.com.cn/static/xxfb/rss/alert.xml?a=%d%d</pre><pre>101010100</pre><pre>http://ip.qq.com</pre><pre>http://api.ruanmei.com/api/xzs/aqi/citys/</pre><pre>.json</pre><pre>?t=%d</pre><pre>http://www.weather.com.cn/data/sk/%s.html?_=%d</pre><pre>http://www.weather.com.cn/data/ks/%s.html?_=%d</pre><pre>GetWeb</pre><pre>H?t=%d%d</pre><pre>Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)</pre><pre>Holiday%d</pre><pre># d</pre><pre>%d-d-d d:d:d</pre><pre>\countdown.xml</pre><pre>%d.d.d %s</pre><pre>http://m.weather.com.cn/data/</pre><pre>?_=%d</pre><pre> %s</pre><pre>http://www.weather.com.cn/weather/</pre><pre>http://php.weather.sina.com.cn/xml.php?city=</pre><pre>&password=DJOYnieT8234jlsK&day=</pre><pre>&_=%d</pre><pre>%d-d-d d-d-d</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\%s</pre><pre>%s~%s</pre><pre>windowshow</pre><pre>windowsized</pre><pre>msimg32.dll</pre><pre>Software\Microsoft\Windows\DWM</pre><pre>Jdest='%d,%d,%d,%d' source='%d,%d,%d,%d'</pre><pre>pagebtn_group_%d</pre><pre>Jsource='%d,%d,%d,%d'</pre><pre>keyboard</pre><pre>User32.dll</pre><pre><%s>%s</pre><pre></pre></pre></_></pre></h></pre></VeriSign></pre>