HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.GenericKD.1656582 (B) (Emsisoft), Trojan.GenericKD.1656582 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: aebb3eb403015059ae8e54d50e9db966
SHA1: b72ca0e60edf4e485f1efac43906e38570aa20eb
SHA256: 0f730f83907ef81703ce4eff001a524deb493c387265adbd2ae72141a4e2d569
SSDeep: 98304:fG8cLz//gGYAfZhCA13s767eUsM6FQuhaV/ZTbFz2PX:O6oZ53syeUsVRaV/ZTbN2PX
Size: 4677632 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PolyEnE001byLennartHedlund, UPolyXv05_v6
Company: no certificate found
Created at: 2014-03-19 10:37:07
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
wuauclt.exe:1880
The Trojan injects its code into the following process(es):
%original file name%.exe:1412
File activity
The process wuauclt.exe:1880 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2448 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
The Trojan deletes the following file(s):
%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)
The process %original file name%.exe:1412 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\soso[1].htm (383 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\wy[1].jpg (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\ico_src[1].png (1534 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.soso[1].txt (189 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso[2].txt (330 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\xz2[1].png (5063 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\init.v.24[1].js (638 bytes)
%System%\Configuration file.ini (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\cft[1].jpg (4565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\jsanalyzexml.min.v.12[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\salelogo[1].png (8464 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\xz1[1].png (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\sale_bg[1].jpg (671 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\q[1].se&unc=&query=¾¢Îèææ (7770 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\init.v.24[2].js (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.sogou[1].txt (158 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\soso[1].png (618 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\dk[1].jpg (3015 bytes)
%System%\drivers\etc\hosts (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\logo130826[1].png (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\jsanalyzexml.min.v.12[2].js (4 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.hookbug[1].txt (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\soso[1] (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\jquery.form[1].js (5477 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\logo_index[1].png (1797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\ico_icp[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\year[2].jsp (22 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso[1].txt (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\sale_style[1].css (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (3361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\sale_search[1].gif (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\jquery.pngFix[1].js (73 bytes)
C:\¾¢Îèææ-Ψһ¹ÙÃÂø.url (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\z_stat[1].php (5067 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\button_10[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\jquery.1.3.2.pack[1].js (39083 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\q[1].htm (7142 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\admin_pub[1].js (2749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3.tmp (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\xiazai[1].htm (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\core[1].php (803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\sale_le[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\sale_btn1[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\fav[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (4545 bytes)
C:\ʹÓñؿ´.txt (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (10312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\year[1].jsp (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\icon_index[1].png (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\zfb[1].jpg (8286 bytes)
C:\VIPææ-¹ºÂòô½Ó.url (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\hookbug[1].htm (10776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\xz2[1].png (8820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\btn_del[1].gif (1 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\jsanalyzexml.min.v.12[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\xz2[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\year[1].jsp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\soso[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\init.v.24[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3.tmp (0 bytes)
Registry activity
The process %original file name%.exe:1412 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"
[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "%System%\oleacc.dll"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1395218227"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 5A 99 1C C6 11 7B 13 A2 9E DB 20 AA 42 96 7A"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 1110 bytes in size. The following strings are added to the hosts file listed below:
| 127.0.0.1 | www.t6t8.com |
| 127.0.0.1 | t6t8.com |
| 127.0.0.1 | www.jingwuwg.com |
| 127.0.0.1 | jingwuwg.com |
| 127.0.0.1 | www.52jwyy.com |
| 127.0.0.1 | 52jwyy.com |
| 127.0.0.1 | www.au2014.com |
| 127.0.0.1 | au2014.com |
| 127.0.0.1 | www.92ausf.com |
| 127.0.0.1 | 92ausf.com |
| 127.0.0.1 | 92jwyy.taobao.com |
| 127.0.0.1 | www.jwyywg.d131.tqxq.com |
| 127.0.0.1 | jwyywg.d131.tqxq.com |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
wuauclt.exe:1880
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2448 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\soso[1].htm (383 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\wy[1].jpg (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\ico_src[1].png (1534 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.soso[1].txt (189 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso[2].txt (330 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\xz2[1].png (5063 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\init.v.24[1].js (638 bytes)
%System%\Configuration file.ini (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\cft[1].jpg (4565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\jsanalyzexml.min.v.12[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\salelogo[1].png (8464 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\xz1[1].png (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\sale_bg[1].jpg (671 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\q[1].se&unc=&query=¾¢Îèææ (7770 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\init.v.24[2].js (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.sogou[1].txt (158 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\soso[1].png (618 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\dk[1].jpg (3015 bytes)
%System%\drivers\etc\hosts (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\logo130826[1].png (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\jsanalyzexml.min.v.12[2].js (4 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.hookbug[1].txt (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\jquery.form[1].js (5477 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\logo_index[1].png (1797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\ico_icp[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\year[2].jsp (22 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso[1].txt (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\sale_style[1].css (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (3361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\sale_search[1].gif (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\jquery.pngFix[1].js (73 bytes)
C:\¾¢Îèææ-Ψһ¹ÙÃÂø.url (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\z_stat[1].php (5067 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\button_10[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\jquery.1.3.2.pack[1].js (39083 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\q[1].htm (7142 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\admin_pub[1].js (2749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3.tmp (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\xiazai[1].htm (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\core[1].php (803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\sale_le[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\sale_btn1[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\fav[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (4545 bytes)
C:\ʹÓñؿ´.txt (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (10312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\year[1].jsp (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\icon_index[1].png (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\zfb[1].jpg (8286 bytes)
C:\VIPææ-¹ºÂòô½Ó.url (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\hookbug[1].htm (10776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\xz2[1].png (8820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\btn_del[1].gif (1 bytes) - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: WWW.52JWXX.COM
Product Name: ?????????
Product Version: 8.1.0.0
Legal Copyright: WWW.52JWXX.COM ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 8.1.0.0
File Description: ?????????
Comments:
Language: English (United States)
Company Name: WWW.52JWXX.COMProduct Name: ?????????Product Version: 8.1.0.0Legal Copyright: WWW.52JWXX.COM ????Legal Trademarks: Original Filename: Internal Name: File Version: 8.1.0.0File Description: ?????????Comments: Language: English (United States)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 989227 | 991232 | 5.10395 | 80d4d003e036043f6942eddd1201b82e |
| .rdata | 995328 | 3499198 | 3502080 | 5.15624 | 40a8e8ba3b524f5806f1697e3fecbaae |
| .data | 4497408 | 276266 | 73728 | 4.25974 | 801aa385f20f54de67ea0019344a207f |
| .rsrc | 4775936 | 106124 | 106496 | 2.40461 | de76147f68bae29242797b81d69fba4e |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://b.proxy.sogou.com/ | |
| hxxp://blogx.sina.com.cn/s/blog_b61e00f001016mtd.html | |
| hxxp://www.hixxg.com/xiazai.html | 183.60.204.213 |
| hxxp://b.proxy.sogou.com/soso/images/logo_index.png | |
| hxxp://ctc.a.proxy.sogou.com/websearch/features/year.jsp | |
| hxxp://b.proxy.sogou.com/soso/images/icon_index.png | |
| hxxp://b.proxy.sogou.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ | |
| hxxp://b.proxy.sogou.com/js/kmap/jsanalyzexml.min.v.12.js | |
| hxxp://b.proxy.sogou.com/images/btn_del.gif | |
| hxxp://ctc.a.proxy.sogou.com/images/logo/old/soso.png | |
| hxxp://b.proxy.sogou.com/images/ico_src.png | |
| hxxp://b.proxy.sogou.com/images/ico_icp.gif | |
| hxxp://ctc.a.proxy.sogou.com/img/fav.ico?99eab349-f602-4979-b97d-8aed9e7bfc0c | |
| hxxp://b.proxy.sogou.com/js/kmap/init.v.24.js | |
| hxxp://06811.xdwscache.glb0.lxdns.com/30d/img/web/logo130826.png | |
| hxxp://c.split.cnzz.com/z_stat.php?id=1000293249&show=pic1 | |
| hxxp://webproxy-sz.qplus.com/pa?p=2:1848168177:41 &r=0.6772223338484764 | |
| hxxp://z5.cnzz.com/stat.htm?id=1000293249&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=14837493-1399157467-&showp=1916x902&st=0&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=1949207463 | 42.156.140.18 |
| hxxp://c.split.cnzz.com/core.php?web_id=1000293249&show=pic1&t=z | |
| hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1542735406 | |
| hxxp://icon.cnzz.com/img/pic1.gif | 42.156.162.7 |
| hxxp://ssd.tcdn.qq.com/qconn/wpa/button/button_10.gif | |
| hxxp://pcookie.split.cnzz.com/app.gif?&cna=3GDsC2YZlx0CAcGK9Od5msQz | |
| hxxp://www.soso.com/js/kmap/init.v.24.js | 220.181.124.154 |
| hxxp://blog.sina.com.cn/s/blog_b61e00f001016mtd.html | 218.30.115.254 |
| hxxp://www.soso.com/ | 220.181.124.154 |
| hxxp://pcookie.cnzz.com/app.gif?&cna=3GDsC2YZlx0CAcGK9Od5msQz | 42.120.219.171 |
| hxxp://www.soso.com/soso/images/icon_index.png | 220.181.124.154 |
| hxxp://www.sogou.com/websearch/features/year.jsp | 218.30.103.177 |
| hxxp://www.soso.com/images/ico_src.png | 220.181.124.154 |
| hxxp://www.soso.com/js/kmap/jsanalyzexml.min.v.12.js | 220.181.124.154 |
| hxxp://wpa.qq.com/pa?p=2:1848168177:41 &r=0.6772223338484764 | 103.7.28.63 |
| hxxp://pub.idqqimg.com/qconn/wpa/button/button_10.gif | 103.7.30.59 |
| hxxp://www.soso.com/images/btn_del.gif | 220.181.124.154 |
| hxxp://c.cnzz.com/core.php?web_id=1000293249&show=pic1&t=z | 42.120.219.6 |
| hxxp://www.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ | 220.181.124.154 |
| hxxp://soso.qstatic.com/30d/img/web/logo130826.png | 220.162.97.165 |
| hxxp://s23.cnzz.com/z_stat.php?id=1000293249&show=pic1 | 1.99.192.16 |
| hxxp://www.soso.com/soso/images/logo_index.png | 220.181.124.154 |
| hxxp://www.sogou.com/img/fav.ico?99eab349-f602-4979-b97d-8aed9e7bfc0c | 218.30.103.177 |
| hxxp://www.sogou.com/images/logo/old/soso.png | 218.30.103.177 |
| hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1542735406 | 42.120.219.171 |
| hxxp://www.soso.com/images/ico_icp.gif | 220.181.124.154 |
| www.hookbug.com | 183.60.204.213 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /30d/img/web/logo130826.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: soso.qstatic.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Expires: Tue, 27 May 2014 03:00:51 GMT
Date: Sun, 27 Apr 2014 03:00:51 GMT
Content-Type: image/png
ETag: "52594142"
Accept-Ranges: bytes
Last-Modified: Mon, 26 Aug 2013 08:32:00 GMT
Cache-Control: max-age=2592000
Content-Length: 2443
Server: WS CDN Server
Age: 1
X-Via: 1.1 zjjx159:8105 (Cdn Cache Server V2.0), 1.1 qz163:5 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.............K-......PLTE...DDEffg...IIJ...QQRMMNFFG......[[\.....<.................Nxxy.jZ......e...............TC...........@.........^^_iij............KKL............B.....................O=........a............................F3...wwx.......^M...........a..u........]......E....Jy....Z......aaa......mmn..9~~...o...XXY.YH...........q..h.cS....L9[...............G4qqr..>K..........Ddde}}~......zz{.....G.........ttt.................T...........s.....q...WWX.....i....se................\K...t..........W...........y..............U...........................T.......e.....................__`..............R............ccd.....|..k...................J8............eef...||}..z....................'..........................}.oa......oop...uuv}..........u..gVVW..........`P....................E@.......tRNS.@..f...9IDATx^..c.,M..3..:.m...m..m..m....mk2..o.97b76.>?z:...DuVV..v....V...'.D.|....p...w~y)3<6.L....9I.K.......I..[....b.m.&.^.M.rC..@....A.k.HZ.9`..J...{YG......9.3@...C.\.1.....^.! ..$....8.$n|..|............S2'.X..".D`.~..bn...I.4-..4M.z.4rEfkZ..(F..#]....Jj9....8Q.....=By.-E.. ^..D.}u...vG.Q1.....X..VJ\>......e.pmXYYX...)...-.6|..!...q*4(.......s..Y(.$........X.. .Ll..V2..)Y..0...]...yt...R....a Y....PT.._.....N...v.w8(.......Q......z..~...M..l4.$?XB.w..g.... .....?.A..f...EJv.....o.,M.d....ns....w...U.5.K..i6...(.d.....K..L6...A.H.v...` .:2.-.......#.V.....a4..B..N.1...H>`......Ih.g"YLI..9VkO<f.[.D......l..Z....8......%eT[......z..~.F[`{.R.6 Uir...^..........u'(..$...w(z.`.1..
<<
<<< skipped >>>
GET /qconn/wpa/button/button_10.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: pub.idqqimg.com
HTTP/1.1 200 OK
Server: NWS_UGC_HY
Connection: keep-alive
Date: Sat, 03 May 2014 22:51:07 GMT
Cache-Control: max-age=2592000
Expires: Mon, 02 Jun 2014 22:51:07 GMT
Last-Modified: Mon, 08 Apr 2013 03:15:19 GMT
Content-Type: image/gif
Content-Length: 2997
X-Cache-Lookup: Hit From DiskCache
GIF89aM..........me.{l...............`u.jmt......n..sv|.i].c\.....n...?Xf......nqy~...rf..qSiv.......................t...............y|....@Yg.~t.....kv..efm.....................Nes......cdn)FVz.....s.......WQTV._\.i`......'EUdx.`bl*GW^t.dejcdj^`h......<Ve...............;Ud.........=We|..................2E............................................................>Wf.........w..(EV...............r...............................................[r........................V.mh......w{..~m.._......iei..~..s.qh.pn..U.....^...............udh.................................gini....x..~...........X......ebk..q.......ub.zh.......WX.......fa.ib.ed..p..w..q..e...sv....ty...[.....U.sj..j..v.mkhjs............sqv........^..k........a.k]...kn{..........................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E41382F2429BE211A018AF641D24CE9C" xmpMM:DocumentID="xmp.did:8AF3F4679FFA11E2AFECC3046E5C8B96" xmpMM:InstanceID="xmp.iid:8AF3F4669FFA11E2AFECC3046E5C8B96" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:25F0FBA9669BE211A0
<<
<<< skipped >>>
GET /9.gif?abc=1&rnd=1542735406 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Server: Tengine
Date: Sat, 03 May 2014 22:51:08 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=3GDsC2YZlx0CAcGK9Od5msQz; expires=Tue, 30-Apr-24 22:51:08 GMT; path=/; domain=.mmstat.com
Set-Cookie: sca=94af1fe3; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=626822c4dad17846cb82ce90_1399157468; expires=Tue, 30-Apr-24 22:51:08 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=3GDsC2YZlx0CAcGK9Od5msQz
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server: Tengine..Date: Sat, 03 May 2014 22:51:08 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=3GDsC2YZlx0CAcGK9Od5msQz; expires=Tue, 30-Apr-24 22:51:08 GMT; path=/; domain=.mmstat.com..Set-Cookie: sca=94af1fe3; path=/; domain=.cnzz.mmstat.com..Set-Cookie: atpsida=626822c4dad17846cb82ce90_1399157468; expires=Tue, 30-Apr-24 22:51:08 GMT; path=/; domain=.cnzz.mmstat.com..Location: http://pcookie.cnzz.com/app.gif?&cna=3GDsC2YZlx0CAcGK9Od5msQz..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..
GET /z_stat.php?id=1000293249&show=pic1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s23.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Date: Sat, 03 May 2014 22:51:07 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Sat, 03 May 2014 22:51:07 GMT
Expires: Sun, 04 May 2014 00:21:07 GMT
ef2..(function(){function l(){this.c="1000293249";this.R="z";this.N="pic1";this.K="";this.M="";this.o="1399157467";this.P="z5.cnzz.com";this.L="";this.s="CNZZDATA" this.c;this.r="_CNZZDbridge_" this.c;this.G="_cnzz_CV" this.c;this.u="0";this.B={};this.a={};this.la()}function g(a,b){try{var c=[];c.push("siteid=1000293249");.c.push("name=" d(a.name));c.push("msg=" d(a.message));c.push("r=" d(h.referrer));c.push("page=" d(f.location.href));c.push("agent=" d(f.navigator.userAgent));c.push("ex=" d(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(e){}}var h=document,f=window,d=encodeURIComponent,k=decodeURIComponent,p=unescape,r=escape,m="https:"===f.location.protocol?"https:":"http:",s=m "//c.cnzz.com/core.php";l.prototype={la:function(){try{this.U(),.this.J(),this.ia(),this.H(),this.m(),this.ga(),this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),f[this.r]=f[this.r]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:function(){try{var a=this;f._czc={push:function(){return a.C.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=f._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ){var c=a[b];switch(c[0]){case "_setAccount":f._cz_account="[object String]"===.{}.toString.call(c[1])?c[1]:String(c[1]);break;case "_setAutoPageview":"boolean"===typeof c[1]&&(f._cz_autoPageview=c[1])}}}catch(e){g(e,"cS failed")}},qa:function(){try{if("undefined"===typeof
<<
<<< skipped >>>
GET /s/blog_b61e00f001016mtd.html HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: blog.sina.com.cn
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.2.8
Date: Sat, 03 May 2014 22:50:51 GMT
Content-Type: text/html
Content-Length: 25757
Connection: keep-alive
Vary: Accept-Encoding
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Cache-Control: no-cache
Expires: Sat, 03 May 2014 22:50:50 GMT
Last-Modified: Sun, 04 May 2014 01:11:31 GMT 8
DPOOL_HEADER: 10.55.27.52
SINA-LB: aGwuOTAuc2c1LmphLmxiLnNpbmFub2RlLmNvbQ==
SINA-TS: YzVmOWU0Y2UgMCAwIDAgOCAxMDAK
Age: 20369
X-Cache: HIT from blog-front005.blog.ja.sinanode.com
X-debug: 218.30.115.254
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml">.<head>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.<title>.................._........._............</title>.<meta name="keywords" content=".................._........._............,.........,it" />.<meta name="description" content=".................._........._............,.........," />.<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />.<!...[if lte IE 6]>.<script type="text/javascript">.try{.document.execCommand("BackgroundImageCache", false, true);.}catch(e){}.</script>.<![endif]...>.<script type="text/javascript">.window.staticTime=new Date().getTime();.</script>.<link rel="pingback" href="hXXp://upload.move.blog.sina.com.cn/blog_rebuild/blog/xmlrpc.php" />.<link rel="EditURI" type="application/rsd xml" title="RSD" href="hXXp://upload.move.blog.sina.com.cn/blog_rebuild/blog/xmlrpc.php?rsd" />.<link href="hXXp://blog.sina.com.cn/blog_rebuild/blog/wlwmanifest.xml" type="application/wlwmanifest xml" rel="wlwmanifest" />.<link rel="alternate" type="application/rss xml" href="hXXp://blog.sina.com.cn/rss/3055419632.xml" title="RSS" />.<link href="hXXp://simg.sinajs.cn/blog7style/css/conf/blog/article.css" type="text/css" rel="stylesheet" /><link href="hXXp://simg.sinajs.cn/blog7style/css/commo
<<
<<< skipped >>>
GET /app.gif?&cna=3GDsC2YZlx0CAcGK9Od5msQz HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: pcookie.cnzz.com
HTTP/1.1 200 OK
Server: Tengine
Date: Sat, 03 May 2014 22:51:09 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=3GDsC2YZlx0CAcGK9Od5msQz; expires=Tue, 30-Apr-24 22:51:09 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Tengine..Date: Sat, 03 May 2014 22:51:09 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=3GDsC2YZlx0CAcGK9Od5msQz; expires=Tue, 30-Apr-24 22:51:09 GMT; path=/; domain=.cnzz.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..
GET /soso/images/icon_index.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:50:58 GMT
Content-Type: image/png
Content-Length: 3310
Connection: keep-alive
Last-Modified: Fri, 28 Mar 2014 08:08:00 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:50:58 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53352de0-cee"
Expires: Mon, 02 Jun 2014 22:50:58 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR...d...x.....3(......PLTE.......~.......E..v.....'...........S...............~..s..v.......L..f.......................M.....h.....&.....M..;...~..........m......x........|.P........N...z....A......}.^..U...........F...{................X......y...........}.....}.......]..G...y..........................|..........5..............0......|....5.........v...........z..............................................................|.>...........P................. ..........................-....................... ....................,........P......t...........z..|...........{........}..~..~..}..~.............[.........}.....~....$......|..~.,..v...}.P..:.........~.".........|.e..'..T..2......~..~.......@..3......}.........................H..............J......................................1.!.....tRNS.@..f....IDATx^..5.$I.E..........353.- z..,...U...%....4.l.6.c...P..m...pF.M.w..aK.z(.h.J.BH.!...B<..:.CC...C,....0.-3..e.......hA.P..ai..=P...?....:b[.j.y!a.........?>...T.3..E...nvpe.....k.........z......=.a(..-U..W.........z....}..P;..l.}..l^fY.G!..&C.Rp....W...9...QH s...].?....jU_)u.P.B.sBh.W/o......mUY..(.X......-.w.n....{."h..{.RhWJ.z..U....(....Y..!^..V..i'....&nhMN.K.|(.....a.G!..,..\j..{..{.}..C=..\...p.XN6/.....q)...x.....W.W...a..../..P.B,x .....I...._~.t.......mA..7..<..<..(D.. ....S..MF.....j4.Bh...`h..`...1.`G..M,....P.a.h..b...lA....@.l0o<.4.v.%.Yl4.5......9Vi ..0<e.B...DR...l..N..aK...X.........6...X.. ..<@......Uz....a...4?G..>L.F..%R\...*fMU5U.Hw.x.(.Ak.H.....7
<<
<<< skipped >>>
GET /js/kmap/jsanalyzexml.min.v.12.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1; SUV=1399157474856700; SNUID=4B5F216DACAF542D10F61563AC479AF4
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:51:00 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 30 Apr 2014 02:16:32 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:51:00 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Expires: Mon, 02 Jun 2014 22:51:00 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
830.............X.v.6.~....!"...&MC.>......u{....HPbL...Zv%...../......d9...G..`....7y.........../...G.............^=...Y...-. rln....%~8S......t......u....LP..HE1.-....H.,.AJ.@...#..{..t.s.8.)....D].#as?..(Q....-......V....K:z..S).r..)...{.r.O#O.4....A...^.kq.........VR.#.&.~.....b;I)`AJ..C.( .....". ..PV"..O...\z..D..7CE.>.6...i...7.......6.~..@9..$J#.i...F..f...C.g.R$$Ad.|...'.eI...n.d...............................?$........}.h.LP..N...k."Z.Q.N...XZx5.@.(.M..-......D~.*S..-U....!..Z.;.=.tw.=,..A..)#.OP....!uQ.%.Rp0.0..f.F.L..W.../..../...$e5..!^...6.%.....=....%O:..j;.....B..z%l...}.t....:...".zx.W&A..8....|..b.`]..O3Fa..n...Y.4....E....&.>...zmHX..~....a......AF....o..S.6<[K.]c..v.. .......d>.5|A..[..25.T.L..&.F.t.........b.!g......N.......7.v....J...^.""o..%d..1...R...c.U...b}..Bu..n.p.WFkc.n....Z'.j...Q.n_.Cq-..^....... ..............~....p[..5....._.M....>.4..R.r....=.T.2.....p.....@.".......%....%f?..r.......2ht..RD.....X.....I..H..i`...$...L..(..bm.".........Zh....[..ln.n@k.}..^y\.....=.i._.m.....Z.?.?w.....?up.iq8Cz_...$j\.x.....P.E..~.O}x..c.=..R..b?..GP'~.V@.....\.....)...l ........nA.|3.\.......CmN....>......oJ#$7....\%..q........vD.6.k^...Q..a.....0.......g...i.v&u...o...Y.....V ...7[a....E ......Za.J .$x..5..!..yg.vt..$....Fc.of....2..s%:d...R.ov........G-..S}....km..../..J&...u./Uz.(...5.....yU"...@*..... ...r.....d....@.9.^...#.....7..Q..o.c...6..'...J#.7...7.1X..^s....7....^...u.K..69.....>.q_2.Q..."D.f...;.............$0.l.!.y...[..f.T...z........%....#I.N7.........m.
<<
<<< skipped >>>
GET /images/ico_src.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1; SUV=1399157474856700; SNUID=4B5F216DACAF542D10F61563AC479AF4
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:51:01 GMT
Content-Type: image/png
Content-Length: 8524
Connection: keep-alive
Last-Modified: Fri, 28 Mar 2014 08:08:15 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:51:01 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53352def-214c"
Expires: Mon, 02 Jun 2014 22:51:01 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR...Y...t......9.G....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<
<<< skipped >>>
GET /websearch/features/year.jsp HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.sogou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:50:58 GMT
Content-Type: application/x-javascript; charset=gbk
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: ABTEST=5|1399157458|v17; expires=Mon, 02-Jun-14 22:50:58 GMT; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:50:58 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: SUID=E7F48AC11424900A00000000536572D2; expires=Fri, 28-Apr-34 22:50:58 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Expires: Sat, 03 May 2014 22:50:58 GMT
Cache-Control: max-age=0
Content-Encoding: gzip
30............J.O..M. . /.,I.P7204Q.........i.........0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 03 May 2014 22:50:58 GMT..Content-Type: application/x-javascript; charset=gbk..Transfer-Encoding: chunked..Connection: keep-alive..Set-Cookie: ABTEST=5|1399157458|v17; expires=Mon, 02-Jun-14 22:50:58 GMT; path=/..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:50:58 GMT; domain=.sogou.com; path=/..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Set-Cookie: SUID=E7F48AC11424900A00000000536572D2; expires=Fri, 28-Apr-34 22:50:58 GMT; domain=.sogou.com; path=/..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Expires: Sat, 03 May 2014 22:50:58 GMT..Cache-Control: max-age=0..Content-Encoding: gzip..30............J.O..M. . /.,I.P7204Q.........i.........0......
<<
<<< skipped >>>
GET /images/logo/old/soso.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.sogou.com
Connection: Keep-Alive
Cookie: ABTEST=5|1399157458|v17; IPLOC=UA; SUID=E7F48AC11424900A00000000536572D2
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:51:01 GMT
Content-Type: image/png
Content-Length: 2990
Connection: keep-alive
Last-Modified: Tue, 29 Apr 2014 05:49:24 GMT
ETag: "535f3d64-bae"
Expires: Mon, 02 Jun 2014 22:51:01 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR...P.........)$>^....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:2512D67CC6E611E3860CCB20D69AB655" xmpMM:DocumentID="xmp.did:2512D67DC6E611E3860CCB20D69AB655"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2512D67AC6E611E3860CCB20D69AB655" stRef:documentID="xmp.did:2512D67BC6E611E3860CCB20D69AB655"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>f.B....$IDATx..X.TSW...a_D...EA..D.cY-.E."..i..8 BG..:g.r,..2u....0...h.CEi V... (.l.&.vH...dy..$......qN..=...{.{......{.. ..d.g..S.......5..G....Lh`...&..=.H...I.Y.?.l.j....PU......b...QK..A.f...n.O'..=.=-..2.......Y...W......(.G.D.E.N%.a.....Y&..Dc.............2%...O..z.s.....4k...Po(/V....X..hi....-P_.e?...R.. .o.......,.....`C8.L.C.y.f.....y.p...).`B.i.|..[..Q6k.m..!..]."..j....dZ...n9..q$........j}..i.....\.M......m..db.....s.....#.....@...^.o..Pr}.]...{....z.3...O..m.|./.w..F>.L....K............[5..a........Rq.t)*.z..R.f.Y........V......s.ls.!.Q..`.v.....[".N...RPU#.~=..1"..[. ....
<<
<<< skipped >>>
GET /img/fav.ico?99eab349-f602-4979-b97d-8aed9e7bfc0c HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.sogou.com
Connection: Keep-Alive
Cookie: ABTEST=5|1399157458|v17; IPLOC=UA; SUID=E7F48AC11424900A00000000536572D2
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:51:01 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: nginx..Date: Sat, 03 May 2014 22:51:01 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT..GIF89a.............!.......,...........L..;..
GET /xiazai.html HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hixxg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 266
Content-Type: text/html
Last-Modified: Wed, 19 Mar 2014 08:51:53 GMT
Accept-Ranges: bytes
ETag: "80da62795043cf1:469"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 03 May 2014 22:48:38 GMT
<html>..<head>..<meta http-equiv="Content-Language" content="zh-CN">..<meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=gb2312">..<meta http-equiv="refresh" content="0.1;url=hXXp://VVV.hookbug.com:5151/">..<title></title>..</head>..<body>..</body>..</html>HTTP/1.1 200 OK..Content-Length: 266..Content-Type: text/html..Last-Modified: Wed, 19 Mar 2014 08:51:53 GMT..Accept-Ranges: bytes..ETag: "80da62795043cf1:469"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Sat, 03 May 2014 22:48:38 GMT..<html>..<head>..<meta http-equiv="Content-Language" content="zh-CN">..<meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=gb2312">..<meta http-equiv="refresh" content="0.1;url=hXXp://VVV.hookbug.com:5151/">..<title></title>..</head>..<body>..</body>..</html>..
GET /pa?p=2:1848168177:41 &r=0.6772223338484764 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wpa.qq.com
Connection: Keep-Alive
HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Location: hXXp://pub.idqqimg.com/qconn/wpa/button/button_10.gif
Pragma: no-cache
Connection: close
Cache-Control: no-cache; must-revalidate
Date: Sat, 03 May 2014 22:51:07 GMT
Content-Length: 0
GET /core.php?web_id=1000293249&show=pic1&t=z HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Date: Sat, 03 May 2014 22:51:08 GMT
Content-Type: application/javascript
Content-Length: 803
Connection: keep-alive
Last-Modified: Sat, 03 May 2014 22:51:08 GMT
Expires: Sat, 03 May 2014 23:06:08 GMT
!function(){var a,b,c,d=encodeURIComponent,e="1000293249",f="pic1",g="",h="online_v3.php",i="z5.cnzz.com",j="1",k="pic",l="z",m="站长统计",n=window["_CNZZDbridge_" e].bobject,o="https:"==document.location.protocol?"https:":"http:",p="0",q=o "//online.cnzz.com/online/" h,r=[];r.push("id=" e),r.push("h=" i),r.push("on=" d(g)),r.push("s=" d(f)),q ="?" r.join("&"),"0"===p&&n.callRequest([o "//cnzz.mmstat.com/9.gif?abc=1"]),j&&(""!==g?n.createScriptIcon(q,"utf-8"):(b="z"==l?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" e:"hXXp://quanjing.cnzz.com","pic"===k?(c=o "//icon.cnzz.com/img/" f ".gif",a="<a href='" b "' target=_blank title='" m "'><img border=0 hspace=0 vspace=0 src='" c "'></a>"):a="<a href='" b "' target=_blank title='" m "'>" m "</a>",n.createIcon([a])))}();...HTTP/1.1 200 OK..Server: Tengine..Date: Sat, 03 May 2014 22:51:08 GMT..Content-Type: application/javascript..Content-Length: 803..Connection: keep-alive..Last-Modified: Sat, 03 May 2014 22:51:08 GMT..Expires: Sat, 03 May 2014 23:06:08 GMT..!function(){var a,b,c,d=encodeURIComponent,e="1000293249",f="pic1",g="",h="online_v3.php",i="z5.cnzz.com",j="1",k="pic",l="z",m="站长统计",n=window["_CNZZDbridge_" e].bobject,o="https:"==document.location.protocol?"https:":"http:",p="0",q=o "//online.cnzz.com/online/" h,r=[];r.push("id=" e),r.push("h=" i),r.push("on=" d(g)),r.push("s=" d(f)),q ="?" r.join("&"),"0"===p&&n.callRequest([o "//cnzz.mmstat.com/9.gif?abc=1"]),j&&(""!==g?n.cre
<<
<<< skipped >>>
GET / HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:50:57 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Fri, 28 Mar 2014 08:08:00 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:50:57 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: SUID=E7F48AC11424900A00000000536572D1; expires=Fri, 28-Apr-34 22:50:57 GMT; domain=.soso.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Expires: Sat, 03 May 2014 22:50:57 GMT
Cache-Control: max-age=0
Content-Encoding: gzip
b2a.............Y[o$G.~v....r.g....{.......F..dw.(.......=]..j...<...H!..D....)..M$. .$.&.....s..6..m.U}..;.N.......g/o_.......>....O.Gj..o.<..s..H.....8..m.*.*..Q.)q.j@.?TMd..w....A....%M........n.../n......s.i.....u..k[.#...T5.\.\...S|...L|...N...Y.&..Ds......AF\.#.%.V.{=".x<...:...*I.H. .8h..AR`...D..e<n..F..9..<..]...1.}...S..\...K.[.....4... c.B.a(C.......g(...q Bn,"7"..})...8.~..{~,..t.......k..!Ql$..AX,.8..0.......N.J$.o.A..llvg...!.m|.....j._..{e,.[......../...\.QZ.P..FV..J.........Qm-.LS......... .....(s.#<.S.Y.I:.h..$...R..C.Ad.'O$Q..!"..XN ..J.3.,*.............9R)9..... ..F....~9....d..,.k...D.m......'..N..F...V)(......!.nUrQ.....a...$%".....,.(>.v..Nv........^n....d)........D..#.....v.K.Cm..3O..0.|..s.ge.Yhbz.T 2U....%.............Yy& r|..e.V2b..\...A.z..u....Y.sTx.pAIV.e.]..i....LdS..........aG._.o..G.)S..1.k..1RV......B...2r.8A.#).. ....6Z%.Z.Z[......._le.`...d4.G..VR.K... Fw,.(.A.....}....g.ny.>.|g...C..&k*5....Z.@..pY...1D0.9:..x..... ..V........d....j.&..2Mxv&.x......z.Awr. \t1..!.N..5..#......p.,g.......C....j.....dj_......J.....D..9;....M[..Qp.....V......>....3M[..f...5.a..6*/..|:...?S.y=.....e..S....}..Z......*...F...N.p...."...8..7..:.G/[..3.7.0.SY3.".$#C.g.`..........N"Z]...$.u..P..m..o.%=......$..3]..L.]..<...F.f.8..;...~.1..=}.Kcq.jK.R...~....k..;_........f..Wn .=....H....r.t.|8.8.v..F...]9.../..w..,.nf....n.|......7..J?.........5.P..O~}./.?..q....e...............W:wV'.3.&<....ej.mn..\Cn.~p.^.......0.. b..0.....-%.......o.|.8A..$)c......,.........>.
<<
<<< skipped >>>
GET /soso/images/logo_index.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:50:58 GMT
Content-Type: image/png
Content-Length: 5020
Connection: keep-alive
Last-Modified: Fri, 28 Mar 2014 08:08:00 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:50:58 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53352de0-139c"
Expires: Mon, 02 Jun 2014 22:50:58 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR.......1.....6.F.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:BA474413854011E2AD0991326E52ED8A" xmpMM:DocumentID="xmp.did:BA474414854011E2AD0991326E52ED8A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BA474411854011E2AD0991326E52ED8A" stRef:documentID="xmp.did:BA474412854011E2AD0991326E52ED8A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>c..{....PLTE...{{|....... ,......QQSFFI.....d.....n..2....tt...ggh:..K......OOZZ\...........w......B..E....0........L.....4.22...........Z........3........2........R..W.........^....N..............g...........]........PTTV]]_LLM..a........3....................2..S.....g..@.98..........AA..C......................78......^`b..........@?prsVVY.....i.........q..~.K..j..............ROOP.33.aa..=......G....IDATx....C.....>(..h-.. ..y*..y.ik......A*..R.9.....>.Iv..|........:3;.D....._Gy.I.\.......\..=.@ .....x@&..?..........._.5....7/.....//N..J.ooo..G.#...6d.W...h..\..\T......o..M=..*T^.v;m..
<<
<<< skipped >>>
GET /q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.soso.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:50:59 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: SNUID=4B5F216DACAF542D10F61563AC479AF4; expires=Tue, 13-May-14 22:50:59 GMT; path=/
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:50:59 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
set-cookie: ld=0aEjokllll2FBgaFlllllV2OtHGlllllZYr1iZllll9llllllZlll5@@@@@@@@@@; path=/; expires=Mon, 02 Jun 2014 22:50:59 GMT; domain=.sogou.com
Cache-Control: max-age=0
Expires: Sat, 03 May 2014 22:50:59 GMT
Content-Encoding: gzip
266.............S.k.@....?L.R..d...t..v..J..)..L..d.$.g^6]...A..7/.....O.K..g8I`).!^.<..........1~>.........tzvpr<B.!.....q0n..n........9...>......!UU... UB..$.L..!.fn.1.zu.XF...1...9.]..>~...;#...x(.F.......C.!..c...`V........E)U.._..y...k....RL.X.RAT....Q........,.Hf.g4a.l.H"EL&tZs\c0......\:M.!...`...?......o?..[^]_-[.....8.s..........#-.......T!.....z..Y....e.n. ..q.=...8.2..e*.@..G....$...L...ja.(B....I`<..yT....q.=1.'.......E......V.5#.#3....u;.,..{...ba`....*m..xD..itaE=.....f...f.......4...<g.....v7-\(....9... ..].3a...B..ov.F.r.C.8.N....H.x.i.N).I....U.......F.. ...wg.6i.0.........e.o.lW.V......i.........5af...Xm..F.. ..rv....g NU%..Jm.FQ U.i..^..Y.....3..f..S.X..0...<.<../D.A<k?.....j......t......%n..u,]sx.K.\..t...K....t.~....#,]..X.*...q.-..f.....3..A.?$%.;.....8y......9....D.......&|._=.....{O..........Q3.......u.t.vOog.......*\..O...w.w...n..CZ%N........?....C........G.......o./.....~../.~...r........7E..x...hB..`2.{.%...N.....e....M.o..\.0.......{Gd.\.....D..j.a;.J....*X.....E*..[9....z.?..........sX.....(......a.<:G..4v..p..%Q.S.Ecq@......Y!...2.'.Kx@...*`..en..i..[>..$J.3..p.../W.T..cna..zD...uLx. ...p..,.Z...:q.O$.(...H...F..1J~...P....C... .......".b(.r......,.s..Xj.........9.......q*@.7...}I.......{ge....<5.7....B.RN......e:T,........V~Rf.~... ........3.k2[..~..a.mk].Y..c4%...].d.va.......I..\.Y._.a].....7.7F.?....I.2....`)..iJI.=.?.`......v..R.....=.8L.v...i`.0.....:.... A^B ..A......."P.X/....I..k$....,.....{..`....*iy.b.M/@.....vvM...d...J...p"..Bsae
<<
<<< skipped >>>
GET /images/btn_del.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1; SUV=1399157474856700; SNUID=4B5F216DACAF542D10F61563AC479AF4
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:51:01 GMT
Content-Type: image/gif
Content-Length: 1286
Connection: keep-alive
Last-Modified: Fri, 28 Mar 2014 08:08:14 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:51:01 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53352dee-506"
Expires: Mon, 02 Jun 2014 22:51:01 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
GIF89a.......................................................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:0DC89FA742CA11E3911B860E70DCA297" xmpMM:DocumentID="xmp.did:0DC89FA842CA11E3911B860E70DCA297"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0DC89FA542CA11E3911B860E70DCA297" stRef:documentID="xmp.did:0DC89FA642CA11E3911B860E70DCA297"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,..........g.$JL.L..0c..0......0..=30C`.Z.......,.....k8.LG.v.Y#.mlp.........Q..L.n|.S .@.N...I.<=2#6.94.>4"%'.q,#!.;....
<<
<<< skipped >>>
GET /images/ico_icp.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1; SUV=1399157474856700; SNUID=4B5F216DACAF542D10F61563AC479AF4
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:51:01 GMT
Content-Type: image/gif
Content-Length: 1139
Connection: keep-alive
Last-Modified: Fri, 28 Mar 2014 08:08:14 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:51:01 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53352dee-473"
Expires: Mon, 02 Jun 2014 22:51:01 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
GIF89a...................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:29A259B042D711E3ABC99BBCDC02AA8E" xmpMM:DocumentID="xmp.did:29A259B142D711E3ABC99BBCDC02AA8E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:29A259AE42D711E3ABC99BBCDC02AA8E" stRef:documentID="xmp.did:29A259AF42D711E3ABC99BBCDC02AA8E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,..........(.."p..N.j..q.|e....L!......s...E..8vn.y..;....
<<
<<< skipped >>>
GET /js/kmap/init.v.24.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢Îèææ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1; SUV=1399157474856700; SNUID=4B5F216DACAF542D10F61563AC479AF4
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:51:01 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 01 May 2014 05:17:47 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:51:01 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Expires: Mon, 02 Jun 2014 22:51:01 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
27e...............o.0.....?..9...3..ss.].r.%.,.p.h...Ug.....0..........o...&~.8..~.....w.....`E... mF(...mnM.1W....(...V.[.oU..p....oK.w..........]r..W.......W. ..w%..$........5.x..*\....vJ.x[....KW..n.U.[.=...CdFX.N-)..T.lK6.E(n..t.\.EqDjAG..\..!...%..../,D...&....h.4..._....f.d.....w8.';..2?..n<.A...|0._....PC....9&i...y.....l(..J...@..2uTU3..p...\il...QF................"$...e.#br...zr........q..7.s......?...2.....pt.j...lM..._./.`c.7 ..z.Q\*.;KhI..t...2......./.....3.0.!K.....>h...../..>..p.i.7......'.=5..8H....._T..,).y..M.....3.(....a.......3?..t..K,.....q....d;E..C.\e.|......l.0.....!.Wkv.....gy^sqr...W..*..q.....D.<.......V.Z.....0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 03 May 2014 22:51:01 GMT..Content-Type: application/x-javascript..Transfer-Encoding: chunked..Connection: keep-alive..Last-Modified: Thu, 01 May 2014 05:17:47 GMT..Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:51:01 GMT; domain=.sogou.com; path=/..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Expires: Mon, 02 Jun 2014 22:51:01 GMT..Cache-Control: max-age=2592000..Content-Encoding: gzip..27e...............o.0.....?..9...3..ss.].r.%.,.p.h...Ug.....0..........o...&~.8..~.....w.....`E... mF(...mnM.1W....(...V.[.oU..p....oK.w..........]r..W.......W. ..w%..$........5.x..*\....vJ.x[....KW..n.U.[.=...CdFX.N-)..T.lK6.E(n..t.\.EqDjAG..\..!...%..../,D...&....h.4..._....f.d.....w8.';..2?..n<.A...|0._....PC....9&i...y.....l(..J...@..2uTU3..p...\il...QF................"$...e.#br...zr..
<<
<<< skipped >>>
GET /img/pic1.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: icon.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine/1.3.0
Date: Sat, 03 May 2014 22:51:08 GMT
Content-Type: image/gif
Content-Length: 428
Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Expires: Sun, 04 May 2014 22:51:08 GMT
Cache-Control: max-age=86400
Accept-Ranges: bytes
GIF89a.......f..3...33.......................................!..NETSCAPE2.0.....!..Powered by AFEI.!.......,.............I........08bX....d.n...CS.3......_..`..H..H\8....)...S.b.UX.....(...r.L....tb]&"......#...o.V.a..D..o.V.a..........D..o.V.a..........D...........!.......,.............I........08bX....d.n...CS.3......_..`..H..H\8....).:...@..z...x ..........D.| .#.u.a....n~D..[....n..........D..[...n..........D...........;HTTP/1.1 200 OK..Server: Tengine/1.3.0..Date: Sat, 03 May 2014 22:51:08 GMT..Content-Type: image/gif..Content-Length: 428..Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT..Connection: keep-alive..Keep-Alive: timeout=5..Expires: Sun, 04 May 2014 22:51:08 GMT..Cache-Control: max-age=86400..Accept-Ranges: bytes..GIF89a.......f..3...33.......................................!..NETSCAPE2.0.....!..Powered by AFEI.!.......,.............I........08bX....d.n...CS.3......_..`..H..H\8....)...S.b.UX.....(...r.L....tb]&"......#...o.V.a..D..o.V.a..........D..o.V.a..........D...........!.......,.............I........08bX....d.n...CS.3......_..`..H..H\8....).:...@..z...x ..........D.| .#.u.a....n~D..[....n..........D..[...n..........D...........;..
GET /stat.htm?id=1000293249&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=14837493-1399157467-&showp=1916x902&st=0&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=1949207463 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z5.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine/1.4.1
Date: Sat, 03 May 2014 22:51:07 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Tue, 28 May 2013 02:57:17 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..
Map
Strings from Dumps
%original file name%.exe_1412:
.text
.text
.rdata
.rdata
@.data
@.data
.rsrc
.rsrc
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
kernel32.dll
kernel32.dll
Kernel32.dll
Kernel32.dll
ntdll.dll
ntdll.dll
user32.dll
user32.dll
Shlwapi.dll
Shlwapi.dll
shlwapi.dll
shlwapi.dll
NTDLL.DLL
NTDLL.DLL
psapi.dll
psapi.dll
Ole32.dll
Ole32.dll
GdiPlus.dll
GdiPlus.dll
gdiplus.dll
gdiplus.dll
ole32.dll
ole32.dll
OLEACC.DLL
OLEACC.DLL
gdi32.dll
gdi32.dll
advapi32.dll
advapi32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
SetWindowsHookExA
SetWindowsHookExA
EnumWindows
EnumWindows
ShellExecuteA
ShellExecuteA
GdiplusShutdown
GdiplusShutdown
RegCreateKeyA
RegCreateKeyA
RegOpenKeyA
RegOpenKeyA
RegEnumKeyA
RegEnumKeyA
RegCloseKey
RegCloseKey
RegFlushKey
RegFlushKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyA
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
# 102.54.94.97 rhino.acme.com # source server
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
127.0.0.1 localhost
127.0.0.1 www.t6t8.com
127.0.0.1 www.t6t8.com
127.0.0.1 t6t8.com
127.0.0.1 t6t8.com
127.0.0.1 www.jingwuwg.com
127.0.0.1 www.jingwuwg.com
127.0.0.1 jingwuwg.com
127.0.0.1 jingwuwg.com
127.0.0.1 www.52jwyy.com
127.0.0.1 www.52jwyy.com
127.0.0.1 52jwyy.com
127.0.0.1 52jwyy.com
127.0.0.1 www.au2014.com
127.0.0.1 www.au2014.com
127.0.0.1 au2014.com
127.0.0.1 au2014.com
127.0.0.1 www.92ausf.com
127.0.0.1 www.92ausf.com
127.0.0.1 92ausf.com
127.0.0.1 92ausf.com
127.0.0.1 92jwyy.taobao.com
127.0.0.1 92jwyy.taobao.com
127.0.0.1 www.jwyywg.d131.tqxq.com
127.0.0.1 www.jwyywg.d131.tqxq.com
127.0.0.1 jwyywg.d131.tqxq.com
127.0.0.1 jwyywg.d131.tqxq.com
127.0.0.1 audition0538.i.sohu.com
127.0.0.1 audition0538.i.sohu.com
www.hixxg.com
www.hixxg.com
http://www.hookbug.com:5151/vip
http://www.hookbug.com:5151/vip
http://www.hixxg.com
http://www.hixxg.com
www.hixxg.com
www.hixxg.com
Result=MsgBox ("
Result=MsgBox ("
(*^__^*)
(*^__^*)
%System%\XXTS.vbs
%System%\XXTS.vbs
\UpData.exe
\UpData.exe
\unrar.dll
\unrar.dll
BASEURL
BASEURL
Hotkey
Hotkey
%System%\Configuration file.ini
%System%\Configuration file.ini
cg(.CU
cg(.CU
xÒB
xÒB
M.pib
M.pib
.oIZV
.oIZV
c).zI
c).zI
]-5}v
]-5}v
T:Q%u
T:Q%u
%x7El
%x7El
5/h%c
5/h%c
4.yHE
4.yHE
1z|;%u/
1z|;%u/
-TI}*
-TI}*
.xc3$C
.xc3$C
.FzlJ
.FzlJ
"-TD}
"-TD}
JCXm5Ftp5Q
JCXm5Ftp5Q
%Xqvh*O2%
%Xqvh*O2%
.FoZ?
.FoZ?
SL.Dce
SL.Dce
Q]%UZ
Q]%UZ
G.tQ`
G.tQ`
I.rvH
I.rvH
(F..hU
(F..hU
JmL%D#
JmL%D#
7I.ha
7I.ha
) (%S
) (%S
$A%*.xk
$A%*.xk
.rnu,[
.rnu,[
&1:kcwb%c\41H
&1:kcwb%c\41H
.aSab
.aSab
%s 7S
%s 7S
:|?%f
:|?%f
A.riM}_
A.riM}_
v.eLg
v.eLg
R.YGT
R.YGT
3`E3.gV
3`E3.gV
O/.BAF@
O/.BAF@
Jjg%x\
Jjg%x\
T%1UT
T%1UT
lm.Su
lm.Su
LEvo%f
LEvo%f
õfe9
õfe9
msGv8
msGv8
-URv}
-URv}
http://http://www.hookbug.com:5151/vip
http://http://www.hookbug.com:5151/vip
\QQShow.dll
\QQShow.dll
P@http://www.hookbug.com:5151/
P@http://www.hookbug.com:5151/
197774811
197774811
1848168177@qq.com
1848168177@qq.com
5B3838F5-0C81-46D9-A4C0-6EA28CA3E942_
5B3838F5-0C81-46D9-A4C0-6EA28CA3E942_
709847386
709847386
2286585953
2286585953
1149544
1149544
*.bak
*.bak
*.rar
*.rar
Vg0.yy?
Vg0.yy?
k.Lk&
k.Lk&
aRUU%UVVZc
aRUU%UVVZc
pT$%%U%&&
pT$%%U%&&
=.NJ7j
=.NJ7j
& ..In
& ..In
;888 000
;888 000
diTXtXML:com.adobe.xmp
diTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:89C7EFB1322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:89C7EFB0322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>=
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:89C7EFB1322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:89C7EFB0322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>=
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:89C7EFAD322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:89C7EFAC322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:89C7EFAD322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:89C7EFAC322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:89C7EFA9322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:89C7EFA8322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:89C7EFA9322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:89C7EFA8322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:87F6580E322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:87F6580D322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:87F6580E322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:87F6580D322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:87C0EED3322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:87C0EED2322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:87C0EED3322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:87C0EED2322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:894798D5322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:894798D4322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>8i
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:894798D5322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:894798D4322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>8i
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:894798D1322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:894798D0322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:894798D1322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:894798D0322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:890D2669322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:890D2668322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:890D2669322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:890D2668322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:88AE1404322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:88AE1403322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:88AE1404322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:88AE1403322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:884D05CF322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:884D05CE322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:884D05CF322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:884D05CE322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:884D05CB322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:884D05CA322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>_
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" xmpMM:DocumentID="xmp.did:884D05CB322611E18734B8809DA0889B" xmpMM:InstanceID="xmp.iid:884D05CA322611E18734B8809DA0889B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E36D3E991B32E111A539AB9B0DB664B8" stRef:documentID="xmp.did:3B85B863EB31E111A539AB9B0DB664B8" /> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>_
http://blog.sina.com.cn/s/blog_b61e00f001016mtd.html
http://blog.sina.com.cn/s/blog_b61e00f001016mtd.html
9.7.0.1
9.7.0.1
ÝIt
ÝIt
o.pMM
o.pMM
.AQ@9.
.AQ@9.
Zf.YB
Zf.YB
.nsp0
.nsp0
.nsp1
.nsp1
.nsp2
.nsp2
=f%7s
=f%7s
KERNEL32.DLL
KERNEL32.DLL
WINMM.DLL
WINMM.DLL
WS2_32.DLL
WS2_32.DLL
USER32.DLL
USER32.DLL
GDI32.DLL
GDI32.DLL
WINSPOOL.DRV
WINSPOOL.DRV
ADVAPI32.DLL
ADVAPI32.DLL
SHELL32.DLL
SHELL32.DLL
OLE32.DLL
OLE32.DLL
OLEAUT32.DLL
OLEAUT32.DLL
COMCTL32.DLL
COMCTL32.DLL
COMDLG32.DLL
COMDLG32.DLL
.tOwe
.tOwe
.ZGW)
.ZGW)
*;M%x
*;M%x
fv#}ET%D?
fv#}ET%D?
K.NV'
K.NV'
\a.RN
\a.RN
Tni%F
Tni%F
Q&.Hyt`
Q&.Hyt`
U.rR*
U.rR*
m=C3%s
m=C3%s
2.Cz=
2.Cz=
.Ly$_
.Ly$_
.UW^}
.UW^}
Nkl.KgpT
Nkl.KgpT
7.BN8
7.BN8
&l3%U
&l3%U
,E.XL&~
,E.XL&~
%d" {
%d" {
|.Rb&
|.Rb&
.yR#b
.yR#b
km6.Xh
km6.Xh
b_.HKOa
b_.HKOa
FTP>u
FTP>u
rF%x7
rF%x7
f.pzw}\
f.pzw}\
.data
.data
]W%sE
]W%sE
6mU%c\]
6mU%c\]
]W%sE6
]W%sE6
64n%c
64n%c
5!" 4eU%s
5!" 4eU%s
]ÁY
]ÁY
W%sEj
W%sEj
6dW%S
6dW%S
\XÏ
\XÏ
\XÏ2U
\XÏ2U
\X%SF
\X%SF
GetAsyncKeyState
GetAsyncKeyState
{B6F7542F-B8FE-46a8-9605-98856A687097}
{B6F7542F-B8FE-46a8-9605-98856A687097}
-Www.52jwxx.Com
-Www.52jwxx.Com
0000000000000000
0000000000000000
0000000
0000000
d-WWW.HIXXG.COM
d-WWW.HIXXG.COM
http://www.hookbug.com:5151/vip/
http://www.hookbug.com:5151/vip/
http://www.hookbug.com:5151/jiezhi/
http://www.hookbug.com:5151/jiezhi/
À-#R4d
À-#R4d
/'*w4l%X89
/'*w4l%X89
%s)l)*%
%s)l)*%
%d%V&
%d%V&
%U3e)
%U3e)
http://www.hookbug.com:5151
http://www.hookbug.com:5151
*.dll
*.dll
,50,100,150
,50,100,150
00 00 17 01
00 00 17 01
W WWW.52JWXX.COM
W WWW.52JWXX.COM
ws2_32.dll
ws2_32.dll
AKernel32.dll
AKernel32.dll
http://www.hookbug.com:5151/vip.rar
http://www.hookbug.com:5151/vip.rar
http://www.hixxg.com/xiazai.html
http://www.hixxg.com/xiazai.html
http://bbs.52jwxx.com/
http://bbs.52jwxx.com/
197774811
197774811
WWW.HIXXG.COM
WWW.HIXXG.COM
W www.hixxg.com
W www.hixxg.com
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
CCmdTarget
CCmdTarget
windows
windows
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WINMM.dll
WINMM.dll
WS2_32.dll
WS2_32.dll
VERSION.dll
VERSION.dll
RASAPI32.dll
RASAPI32.dll
GetProcessHeap
GetProcessHeap
WinExec
WinExec
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
GetKeyState
GetKeyState
UnhookWindowsHookEx
UnhookWindowsHookEx
EnumChildWindows
EnumChildWindows
USER32.dll
USER32.dll
GetViewportOrgEx
GetViewportOrgEx
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
OLEAUT32.dll
OLEAUT32.dll
COMCTL32.dll
COMCTL32.dll
oledlg.dll
oledlg.dll
WSOCK32.dll
WSOCK32.dll
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
WININET.dll
WININET.dll
GetCPInfo
GetCPInfo
CreateDialogIndirectParamA
CreateDialogIndirectParamA
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
comdlg32.dll
comdlg32.dll
Fuck_Au.dll
Fuck_Au.dll
.mkBT
.mkBT
.qc]b
.qc]b
.pK>NG`
.pK>NG`
P>f%S9e
P>f%S9e
.qn{\
.qn{\
_.Ry=
_.Ry=
\.Wzvv
\.Wzvv
1%%%u
1%%%u
q@http://www.hixxg.com/
q@http://www.hixxg.com/
http://
http://
javascript:document.onsdragstart=document.onselectstart=document.oncontextmenu=function(){return true}
javascript:document.onsdragstart=document.onselectstart=document.oncontextmenu=function(){return true}
javascript:document.onselectstart = document.oncontextmenu = document.onmousedown = document.onkeydown = function(){return true;};
javascript:document.onselectstart = document.oncontextmenu = document.onmousedown = document.onkeydown = function(){return true;};
var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');
var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');
text|password|file
text|password|file
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
WarnOnHTTPSToHTTPRedirect
WarnOnHTTPSToHTTPRedirect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
www.soso.com{
www.soso.com{
http://www.hixxg.com/xiazai.htmlr
http://www.hixxg.com/xiazai.htmlr
.PAVCException@@
.PAVCException@@
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
.PAVCFileException@@
.PAVCFileException@@
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
www.dywt.com.cn
www.dywt.com.cn
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s <%s>
%s <%s>
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
1.1.3
1.1.3
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
.PAVCOleException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÁ
zcÁ
c:\%original file name%.exe
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
1.0.0.0
1.0.0.0
{"{$|%~%
{"{$|%~%
DBUNg[yg
DBUNg[yg
00>BLTWebuk
00>BLTWebuk
%'%5%D%P%['d,l4r<wG><pre> y%r$i$^%U N.G4B7<;9<5<0;)5"0</pre><pre>g~\tPiD^9T.K%D</pre><pre>@"<)7,20 2$2</pre><pre>9$5)0, .$.</pre><pre>9"5'0 )."0</pre><pre>2$,%'' '</pre><pre>0",%')" </pre><pre>\e5.0\e.exe</pre><pre>(*.*)</pre><pre>8.1.0.0</pre><pre>WWW.52JWXX.COM</pre><pre>WWW.52JWXX.COM</pre><b>%original file name%.exe_1412_rwx_00401000_000F2000:</b><pre>t$(SSh</pre><pre>~%UVW</pre><pre>u$SShe</pre></wG>