Trojan.Win32.FlyStudio_f656204513

by malwarelabrobot on April 22nd, 2017 in Malware Descriptions.

Trojan.Generic.20569574 (BitDefender), HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan.Generic.20569574 (B) (Emsisoft), Artemis!F6562045135E (McAfee), SecurityRisk.gen1 (Symantec), Trojan.Generic.20569574 (FSecure), Win32/Blacked (AVG), Win32:Malware-gen (Avast), Trojan.Win32.FlyStudio.FD, GenericPhysicalDrive0.YR, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan, Malware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: f6562045135e331bd489614ee17fd83d
SHA1: 13e278a22667aa7799a0efe43c7a9215313b9959
SHA256: 4aaafd53159290d7119baee9906fe23248b865b6a7a3add6eaa2368c1f832ecd
SSDeep: 196608:9wFpnsi75TZBXQ3DskzDO1u5grXPb6G1NMYRnBEWc:Cvskl/XYDO1umrXPjX
Size: 9154560 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PolyEnE001byLennartHedlund, UPolyXv05_v6
Company: no certificate found
Created at: 2017-03-27 17:20:39
Analyzed on: Windows7 SP1 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:2712

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2712 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ÉñÏɽÙÅäÖÃ\t\¹ú¼Ò.bmp (284 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Ö÷ÏßÉÏÀ­Ìõ.bmp (292 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¾­Ñ鵤.bmp (356 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÓÒ·­Ò³2.bmp (404 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÊÀ½çBOSS-ÒÑ»÷ɱ.bmp (588 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹¥³ÇÂÔµØ-¹¥»÷2.bmp (464 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±ÕÉùÒô.bmp (320 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ2-1.bmp (292 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\µöÓã3.bmp (548 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\µöÓãÂú.bmp (284 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÆìÖÄ-À¶.bmp (236 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\µã»÷¼¤»î.bmp (212 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¸§ÇÙ.bmp (236 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-°×Òø1.bmp (572 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¶àÈ˸±±¾.bmp (468 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Éý¼¶-¾³½ç.bmp (628 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\÷»×Ó.bmp (308 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\½î¶·ÔÆ.bmp (212 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÁìÈ¡Íê±Ï.bmp (236 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ1.bmp (292 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Ϊ¿ªÆô1.bmp (236 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-»Æ½ð4.bmp (284 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Á·¹¦·¿.bmp (284 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Ö÷Ïß2.bmp (296 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¶¨Ê±»î¶¯1.bmp (260 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Áìȡٺ».bmp (464 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\î§Ë¯.bmp (260 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÉùÒô.bmp (324 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\µØͼ.bmp (308 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¶àÈ˸±±¾2.bmp (356 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦ÏäÆæÓö-È¥¼ñ¸ö±¦Ïä.bmp (620 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\µöÓã2.bmp (260 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ-Ê׳ä.bmp (376 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\´ò¹´.bmp (260 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Ö÷Ïß1.bmp (296 bytes)
C:\ÉñÏɽÙÅäÖÃ\Îļþ.zip (1 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\µöÓã-Éý¼¶.bmp (260 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÁìÈ¡×øÆï.bmp (968 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹¥³ÇÂÔµØ-±¦Ïä.bmp (836 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¿ªÆôÁÁ.bmp (260 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\t\QQµÇ¼.bmp (464 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\µöÓãÂܲ·3.bmp (196 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÆìÖÄ.bmp (236 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-»Æ½ð6.bmp (500 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦ÏäÆæÓö-³ÈÉ«.bmp (572 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¶¨Ê±»î¶¯3.bmp (248 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-»Æ½ð2.bmp (464 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÆÁ±Î.bmp (324 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\»î¶¯´óÌü.bmp (324 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¾«Ó¢-ÒѾ­»÷ɱ.bmp (452 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¾º¼¼³¡-Öмä.bmp (164 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÈÎÎñÀ¸ÏÔʾ.bmp (420 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¸ß¼¶BOSSÕÙ»½Áî.bmp (292 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-»Æ½ð5.bmp (484 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦ÏäÆæÓö-×ÏÉ«.bmp (320 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±³°ü.bmp (392 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-°×Òø3.bmp (572 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÈÙÒ«Õ½³¡2.bmp (428 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÇÕµã.bmp (308 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ-Ê׳ä2.bmp (348 bytes)
C:\ÉñÏɽÙÅäÖÃ\ƽ̨µØÖ·.txt (1 bytes)
C:\hrttp.dll (94 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÉèÖÃ.bmp (236 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¶¨Ê±»î¶¯2.bmp (320 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹¥³ÇÂÔµØ-¿ÉÒÔÌôÕ½.bmp (236 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\v5[1].htm (227 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¼¤Õ½BOSS2.bmp (548 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¿ªÆô¸ñ×Ó.bmp (748 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\µöÓãÂܲ·2.bmp (248 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ħ½çÃؾ³.bmp (292 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¶··¨Ì¨.bmp (356 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\µöÓãÂܲ·.bmp (356 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-°×Òø2.bmp (516 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¾º¼¼-ÅÅÃû½±Àø.bmp (392 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Ãâ·ÑÁìÈ¡.bmp (284 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-»Æ½ð1.bmp (432 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÈÎÎñ3.txt (17848 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Ï·Ë®.bmp (212 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\×ó·­Ò³1.bmp (284 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ºì°ü.bmp (236 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ-¹ú¼Ò2.bmp (324 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¸±±¾´óÌü2.bmp (392 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÈÙÒ«Õ½³¡.bmp (348 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¸£Àû´óÌü2.bmp (428 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\»î¶¯´óÌü2.bmp (320 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\t\QQ-ÏÂÀ­.bmp (260 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\²É¼¯ÖÐ1.bmp (356 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¼¤»î.bmp (580 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹ú¼ÒÕ½ÊÂ.bmp (380 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Ö÷Ïß3.bmp (248 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\æ϶ð.bmp (212 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Ϊ¿ªÆô2.bmp (1 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ-ºì°ü.bmp (284 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¼Ò×å.bmp (388 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ2.bmp (292 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÿÈÕ±Ø×ö1.bmp (464 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹¥³ÇÂÔµØ-Ç°ÍùÌôÕ½.bmp (292 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-°×Òø5.bmp (356 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹Ò»úÖÐ.bmp (284 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\µØͼ2.bmp (284 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ-¹ú¼Ò.bmp (284 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¼¤Õ½BOSS.bmp (452 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÈÎÎñ1.txt (17848 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÍË×é.bmp (356 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¶ÍÔì.bmp (236 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÈÎÎñ2.txt (16944 bytes)
C:\ÉñÏɽÙÅäÖÃ\dm.dll (1 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Ãؾ³-Ë¢ÐÂ.bmp (248 bytes)
C:\È«¾ÖÅäÖÃ.ini (23 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦ÏäÆæÓö-À¶É«.bmp (416 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÌØЧ.bmp (388 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\µöÓã1.bmp (356 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÏÉ×Ó.bmp (188 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÓÒ·­Ò³1.bmp (348 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹ú¼ÒÕ½ÊÂ2.bmp (608 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ħ½çÃؾ³2.bmp (284 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-°×Òø4.bmp (484 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÆìÖÄ-°×.bmp (236 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\×ó·­Ò³2.bmp (452 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÆìÖÄ-ºì.bmp (284 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\×é¶Ó.bmp (348 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\t\QQ-ÆäËûµÇ¼.bmp (464 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Çл».bmp (428 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1.she (26 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ-¾º¼¼.bmp (320 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-»Æ½ð7.bmp (544 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÖØÖÃ.bmp (380 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Õ½³¡´óÌü.bmp (324 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\²É¼¯ÖÐ2.bmp (356 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¸±±¾´óÌü3.bmp (380 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹¥³ÇÂÔµØ.bmp (324 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÓñÍÃ.bmp (208 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹¥³ÇÂÔµØ-¹¥»÷.bmp (392 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¸£Àû´óÌü.bmp (468 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\Í˳ö-BOSSµØͼ.bmp (388 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-»Æ½ð3.bmp (428 bytes)
C:\ÉñÏɽÙÅäÖÃ\°æ±¾ÐÅÏ¢.ini (24 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÿÈÕ±Ø×ö2.bmp (320 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\ÓÒÒƶ¯.bmp (356 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ-Ïɽ×.bmp (348 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¸±±¾´óÌü.bmp (356 bytes)
C:\ÉñÏɽÙÅäÖÃ\t\¸±±¾½áÊø.bmp (324 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\v5[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\337086\TemporaryFile (0 bytes)
C:\ÉñÏɽÙÅäÖÃ\Îļþ.zip (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\337086 (0 bytes)

Registry activity

The process %original file name%.exe:2712 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\f6562045135e331bd489614ee17fd83d_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\f6562045135e331bd489614ee17fd83d_RASAPI32]
"FileTracingMask" = "4294901760"
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\f6562045135e331bd489614ee17fd83d_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\f6562045135e331bd489614ee17fd83d_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\f6562045135e331bd489614ee17fd83d_RASMANCS]
"FileTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\f6562045135e331bd489614ee17fd83d_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\f6562045135e331bd489614ee17fd83d_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\f6562045135e331bd489614ee17fd83d_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\f6562045135e331bd489614ee17fd83d_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

[HKLM\SOFTWARE\Microsoft\Tracing\f6562045135e331bd489614ee17fd83d_RASAPI32]
"EnableConsoleTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

MD5 File path
2830671e3a788c69b2855d1803358091 c:\hrttp.dll
ba416feb72581d13ad184dc96f8e2767 c:\ÉñÏɽÙÅäÖÃ\dm.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.dywt.com.cn)
Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 1734214 0 0 d41d8cd98f00b204e9800998ecf8427e
.rdata 1740800 6079068 0 0 d41d8cd98f00b204e9800998ecf8427e
.data 7823360 294858 0 0 d41d8cd98f00b204e9800998ecf8427e
.vmp0 8118272 2590016 0 0 d41d8cd98f00b204e9800998ecf8427e
.vmp1 10711040 9133632 9134080 5.44919 266da7172df1d6a4acb8fa6adfcb138b
.rsrc 19845120 12305 16384 3.00781 afe8dabf6c1f303f8f86b469766e3407

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://vip1.110kk.com/v5/ 27.148.159.24
hxxp://vip2.110kk.com/v5/ 139.129.141.1
hxxp://vip3.110kk.com/v5/ 115.28.236.65


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /v5/ HTTP/1.1
Accept: */*
Referer: hXXp://vip1.110kk.com/v5/
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vip1.110kk.com
Content-Length: 56
Cache-Control: no-cache

G1tVnttauef/qlp/lozhqOzrULN2v oG05Uwom044AkJLLZnEvbA6PPS
HTTP/1.1 200 OK
Connection: close
Date: Thu, 20 Apr 2017 21:47:33 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-Powered-By: PHP/5.2.17
Content-type:text/html;charset=utf-8
mysql connect error!..



POST /v5/ HTTP/1.1
Accept: */*
Referer: hXXp://vip3.110kk.com/v5/
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vip3.110kk.com
Content-Length: 56
Cache-Control: no-cache

G1tVnttauef/qlp/lozhqOzrULN2v oG05Uwom044AkJLLZnEvbA6PPS
HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Thu, 20 Apr 2017 21:48:16 GMT
Content-Length: 187
t..t.....Y.K..m<.[8.y1.f.......# ..w......P:......I.|.Y.....9\f.W9.
~.zG.J.Y....?.bctEv...f.&..b.y.PH. ....C....&.K...V...".S.}.x]...OR..`
c.vZ...H...Hu^^m.W.......!zvTe4..0..o....@.I.....uHTTP/1.1 200 OK..Con
tent-Type: text/html;charset=utf-8..Server: Microsoft-IIS/7.0..X-Power
ed-By: ASP.NET..Date: Thu, 20 Apr 2017 21:48:16 GMT..Content-Length: 1
87..t..t.....Y.K..m<.[8.y1.f.......# ..w......P:......I.|.Y.....9\f
.W9.~.zG.J.Y....?.bctEv...f.&..b.y.PH. ....C....&.K...V...".S.}.x]...O
R..`c.vZ...H...Hu^^m.W.......!zvTe4..0..o....@.I.....u..



POST /v5/ HTTP/1.1
Accept: */*
Referer: hXXp://vip1.110kk.com/v5/
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vip1.110kk.com
Content-Length: 56
Cache-Control: no-cache

G1tVnttauef/qlp/lozhqOzrULN2v oG05Uwom044AkJLLZnEvbA6PPS
HTTP/1.1 200 OK
Connection: close
Date: Thu, 20 Apr 2017 21:47:34 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-Powered-By: PHP/5.2.17
Content-type:text/html;charset=utf-8
mysql connect error!..



POST /v5/ HTTP/1.1
Accept: */*
Referer: hXXp://vip2.110kk.com/v5/
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vip2.110kk.com
Content-Length: 56
Cache-Control: no-cache

G1tVnttauef/qlp/lozhqOzrULN2v oG05Uwom044AkJLLZnEvbA6PPS
HTTP/1.1 404 Not Found
Date: Thu, 20 Apr 2017 21:48:15 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 201
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>404 Not Found</title>.</head><
body>.<h1>Not Found</h1>.<p>The requested URL /v5
/ was not found on this server.</p>.</body></html>.H
TTP/1.1 404 Not Found..Date: Thu, 20 Apr 2017 21:48:15 GMT..Server: Ap
ache..Vary: Accept-Encoding..Content-Length: 201..Content-Type: text/h
tml; charset=iso-8859-1..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2
.0//EN">.<html><head>.<title>404 Not Found</ti
tle>.</head><body>.<h1>Not Found</h1>.<p
>The requested URL /v5/ was not found on this server.</p>.<
;/body></html>...

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_2712:

.text
`.rdata
@.data
.vmp0
.vmp1
.rsrc
t%SVh
t$(SSh
|$D.tm
FTPR
~%UVW
u$SShe
.fk*%
kernel32.dll
user32.dll
advapi32.dll
ntdll.dll
hrttp.dll
shlwapi.dll
dbghelp.dll
yfr.dll
ole32.dll
gdi32.dll
psapi.dll
shdocvw.dll
Kernel32.dll
Shell32.dll
User32.dll
winmm.dll
Winmm.dll
shell32.dll
imm32.dll
wininet.dll
Powrprof.dll
rasapi32.dll
ws2_32.dll
IPHLPAPI.DLL
ADVAPI32.DLL
OLEACC.DLL
oleaut32.dll
gdiplus.dll
MsgWaitForMultipleObjects
EnumChildWindows
ShellExecuteA
EnumWindows
UnregisterHotKey
RegisterHotKey
ExitWindowsEx
SHFileOperationA
GetWindowsDirectoryA
GetKeyboardLayout
GetKeyboardLayoutList
ActivateKeyboardLayout
GetProcessHeap
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
GetUrlCacheEntryInfoA
RegCloseKey
RegCreateKeyA
RegOpenKeyA
GdiplusShutdown
{B6F7542F-B8FE-46a8-9605-98856A687097}
`.reloc
@.rsrc
<4,$?7/'
(3-!0,1'8"5.*2$
t.It It
https
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
http=
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
hXXps://
hXXp://.
\kernel32.dll
.com/v5/
%d&&'
123456789
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
__MSVCRT_HEAP_SELECT
Broken pipe
Inappropriate I/O control operation
Operation not permitted
iphlpapi.dll
SHLWAPI.dll
MPR.dll
WINMM.dll
WS2_32.dll
VERSION.dll
WinExec
KERNEL32.dll
GetKeyState
USER32.dll
GetViewportOrgEx
GDI32.dll
WINSPOOL.DRV
RegOpenKeyExA
RegCreateKeyExA
ADVAPI32.dll
SHELL32.dll
OLEAUT32.dll
COMCTL32.dll
WININET.dll
GetCPInfo
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetWindowsHookExA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
comdlg32.dll
kk5.dll
.PAVCException@@
Mpr.dll
Advapi32.dll
Gdi32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
.PAVCFileException@@
: %d]
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
.PAVCNotSupportedException@@
out.prn
(*.prn)|*.prn|
%d.%d
%d/%d
1.6.9
unsupported zlib version
png_read_image: unsupported transformation
%d / %d
Bogus message code %d
libpng error: %s
libpng warning: %s
1.1.3
bad keyword
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
(%d-%d):
%ld%c
x86 Family %s Model %s Stepping %s
X-X-X-X
\\.\Smartvsd
\\.\PhysicalDrive%d
\\.\Scsi%d:
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
.pv 6
e%.dA !
=l%
.dquN
'T.Bd
p%cln
.dbxM
.KF&QLZI
4.bDT
.sru3
bz.pq
z.pUI
8(.Gs
uExe
0;l%f
"%c]R
.PoWw
KEy$Q
P%D%7
e9_s.tq9
?s.tB|J
L%S3 }
.PKhF
[.tg@
h.nPQV
M*.db
.IRv5{
.TF|b
TCP7n
2?3Q3d3
7(7-7H7d7q7}7
8&9:92;{;
3 3$3(3,30343
4#4*43484
8%8S8
<#<'< </<3<
7q7}7%8x8
< <$<(<,<0<4<
<,<4<:<@<
:%:2:7:=:
7(777<7_7}7
#include "l.chs\afxres.rc" // Standard components
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>
VVV.snlhk.cn
Software\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive0
Software\Microsoft\Windows\CurrentVersion\Themes\LastTheme\ThemeFileSoftware\Microsoft\Windows\CurrentVersion\Themes\CurrentTheme
themeui.dll,-2016
Win7.theme
; Windows Classic - IDS_THEME_DISPLAYNAME_CLASSIC
DisplayName=@%SystemRoot%\System32\themeui.dll,-2016
[CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon]
DefaultValue=%SystemRoot%\System32\imageres.dll,-109
[CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\DefaultIcon]
DefaultValue=%SystemRoot%\System32\imageres.dll,-123
[CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\DefaultIcon]
DefaultValue=%SystemRoot%\System32\imageres.dll,-25
[CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon]
Full=%SystemRoot%\System32\imageres.dll,-54
Empty=%SystemRoot%\System32\imageres.dll,-55
Crosshair=
DefaultValue=Windows default
DefaultValue.MUI=@themeui.dll,-2043
CaptionFont=@themeui.dll,-2037
SmCaptionFont=@themeui.dll,-2038
MenuFont=@themeui.dll,-2039
StatusFont=@themeui.dll,-2040
MessageFont=@themeui.dll,-2041
IconFont=@themeui.dll,-2042
ColorStyle=@themeui.dll,-854
Size=@themeui.dll,-2019
SCRNSAVE.EXE=
SchemeName=@%SystemRoot%\System32\mmres.dll,-800
WinXP.theme
DisplayName=@themeui.dll,-2016
DefaultValue=%WinDir%explorer.exe,0
[CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\DefaultIcon]
DefaultValue=%WinDir%SYSTEM32\mydocs.dll,0
[CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\DefaultIcon]
DefaultValue=%WinDir%SYSTEM32\shell32.dll,17
full=%WinDir%SYSTEM32\shell32.dll,32
empty=%WinDir%SYSTEM32\shell32.dll,31
SCRNSAVE.EXE=%WinDir%\System32\logon.scr
@\\.\\physicaldrive0
1.she
fJ.WM_
%s;7*
0%x@w
%C^L:
CX%xm
Õ6m*
n.BjCw
.TY3F
kEY94
.nyBK
wN%U/
4.Ky%t
.h.fO
.TK$N
%dRB:W
[I9%f
%s T5
]E4%F(
.Funr
.yyw'
%sX@:`
J|.jv
p4%xcEm
.Jr1Z
7.YT"
.Uf!0
!a%U}
0'.Ll
[I(3/#N0.bd
j"%u=w
q%Xn`
@|H.NI
.wdd!
S|%u4
-.Mdl
\-A}=3K
Y:.akpS
$.Zcqn
.WE= T!N
#?%s(C(
u.Jck~
zx/%FN[
LY.eo
%s=\RI
}j%c%Y)
Rx.GR
4o#.dM
IeS`%C
[n 4\.UY 
,4.qO,
gQ'.Io
%cLur?
s%DHB
]I%%X
I %d)
.aEd(
5r.US
:mD].tB
fTpe
.LLbX
f%fUZ
.fOuV12
*_.dC
&-N}<
({?.cQm
.Cqx~c
.`.Qw
.Onwj
Tn&.hL
**.dU
!n]%x
%X,Cr
/%c=M
<%C:,
?_.Cn
;{(W%f
*.Ea]S
Q.CGo
tn!ay%F
2.kKX
Avi.CT
xhZ_6%U
%SY!8i
&.PFy{xh
.um ZZE7L
/^p%u$
I.NoQY
zu.ew
D/.nT
R>o2.YN>
fb%FN
.QS.3
.FGtg
.nJ7O_
$JA.hy
k.KVp
]>.KrV
t.vim
.bmp}
F.JL2
.bmp]QAR
1.bmpe
2.bmp
1.bmp
3.bmp
.bmpe
1.txtDMDM
<%u5}
.hG[-
X3@%u
YuDp
.UnG0
u.rj#
5a.gY,
.MY (8
u!;.ms4
0BCb
QjW%S
o/%Snm
my.qu
SqL)e
Yv ~.Uo
D/j.q.mN
P%C'/
.Qf7k
%Ue*V
.YkUH
f.Rt6
X.srxv
u.RE.
.HQ/t
.UgXy9b!
oAy%c
YB3r%d
X.cp1
.hGV"
XK`~.JWX
X]TcP
G..Ij
m.veP
kG%0utY
_.KX-
m.kD&o!
S{.qn
^OR.tV
i%SRg
uk
RC@%U
%cR~ljpM#
`dþ
yI%U{
.DKd 
6H.iyC
2.txtDMDM
PW.QV
.YDW?
 EK.Uy
-E}& 
T%c"B
.vzRFIV
y;.dQ
5.xJM 
uR.hL
.uFq/>
4O.tD
S|.ME%/
KM.Nr
-JP5_.xi
&F,%S
0h.RO
Y%X8kW9
&B%XeY
8T.cak[
gZp.aw^
-6A.tv
.uI_MJ
/Imd%U
0%SZ^
lA.LR
aU.gI
S.Ne9
.jt<^
 x%u(5
!x%SE
.cVM|
.yjv~
3.txtDMDM
j.RAG
dMsG.
Lyh/%UW
-YS})
iS~%S_"l
%Xq]Q
F .xY
>.Ax[
id*(.SX
:%uX'G
7%X\m
.Sgl0
tCPUsG
?%dZx
=-TE}!s=
u%xF Z
8X&f-zV)2K%C
:s%d_r^
,.eopX
0%.IO
64.vX
p{2.xK
nXQ]
BÎ=Z
`Q.BC
j.zGc
P-.xi
64.aT
X.UG}
bFœ{
.TT@l
t D%X
eY.DK
/.Mis!
w|%cm
)o].to
%CP-G
%D|w(
zyD%d
-3}kf
%Dvk kX
QG.vg
}[`Exe
<.qAd
1g.Ut
.LCnB
Ey@%d
K.Vh7
l%fNa`#W^
%f's1z1-
.bmp]
2.bmpe
.bmpBM
2.bmp]
2-1.bmpm
.bmpBM2
.bmp]PAH
3.bmp]
1.bmp]
2.bmpm
.bmpBM6
2.bmp]P
1.bmpeO
2.bmpeP
3.bmpe
2.bmpu
3.bmpu
4.bmpm
5.bmp}
1.bmpm
3.bmp}
5.bmpu
6.bmpe
7.bmpe
.bmpBMv
.bmpePMH
.bmpeN
.bmpeO
2.bmp}
.bmpeO=K
.bmpeN=lAa
2.bmpePMK
BOSS.bmp]
BOSS2.bmpe
.bmp]NMK
.bmpBMz
0Om.Mk3Rp2QoÛ#B`
.bmp]P=HBQ
1.bmpu
.bmpu
.bmpm
.bmp]P?H
.bmpBM&
1.txt
2.txt
3.txt
2-1.bmp
4.bmp
5.bmp
6.bmp
7.bmp
BOSS.bmp
BOSS2.bmp
dm.dll
@uK95%u[
$%&'()) *
9=]%S@
RPe8=%u
,@0@0@0*
.xz(p
rv.cV^
2%Cii
,W-Q.Lr
%XTG4Vs/
d|%XHan
"tp%s
CmDDECF
y%DL_
u&.XN
i.iMjk
%x-%xTRE
$9dH.ve[H&B
<`2%S2|d\s
`W%d?VP
* ,-./0123456789:;<<
%u! (M
TCÜ.Ek
y.iip
c%CrD
ËQ)0W
judPy
J%u6G
.abRP0
%c@\P
L.Hx&
.Qxgl
%c{Rm
V.Go<\8X
T.plQpx
bKa.LsM\
8l%x)B
rrUrLLQ
ll.dl
%C-}M
i%cITsL
!.ZCc
KeybK'_
.fXpM
\.lpa,
,8Dx|x%xC
H0X%D%
g}.hw
F:k%s7
.fgtCG&
XR%S<
6.vpd
my%%x&
R(|.Hr
.Dcui
.B.rr
''''!"#$
`.BBC
late 1.2.3 Copyright
!p.xx
_99&'''999
2222<<<<
OFF.hW
rs when executed
MSG.b8`PN
^.%d\
=%d<?
x=%f,*
??keyw
n!n%d
^/VT%f
.jWiD
\Nsql
.RQi}i`4
Ai%fi
0.Ah-
R.Ld9
 %dh62
.Bx^pP
qSShD
^.jw]"
.PxoRX
.jBdnJ
,/h%d
h.TAQh
J@.BK
.jZr;J
.mcEG
Ir].sL.
o;.ouP
^!%Xq
7";h%U
>$!%x
5?.SM
nx5%X
.Rk%G!
%Ux~c5
}.VkAR2.]?
-Kbr}t
T.cp/
%xy,J|
.Ap$T
O.nSe
E%fpp
.JW|S
B.Md;*;^
7):-=24-^$
{43C6DBBB-BEAD-4DFB-B6D2-52C5CDB5B70A} = s 'Dm'
'Dm.EXE'
val AppID = s {43C6DBBB-BEAD-4DFB-B6D2-52C5CDB5B70A}
dm.dmsoft = s 'dm.dmsoft'
CLSID = s '{26037A0E-7CBD-4FFF-9C63-56F2D0770214}'
CurVer = s 'dm.dmsoft'
ForceRemove {26037A0E-7CBD-4FFF-9C63-56F2D0770214} = s 'dm.dmsoft'
ProgID = s 'dm.dmsoft'
stdole2.tlbWWWx-
~cmdWd
KeyPress
.aKeyDownWd
MKeyUpWWWd
ShowScrMsgWW
msgWd
SetShowErrorMsgW
>SGetWindowStateWW
U@SetWindowSizeWWWd
SetWindowStateWWd
iRSetKeypadDelayWWd
BkeypadWW
SetExportDictWWWd
keyWd
FindWindowSuperW
qHKeyDownCharW
pOkey_strWd
KeyUpCharWWWd
KeyPressChard
KeyPressStrWd
EnableKeypadPatchWWWd
=PEnableKeypadSyncd
EnableRealKeypadd
GetKeyStateWd
[.ReadFiled
WaitKeyW
!key_coded
joEnumWindowSuperW
urlW
=EnableKeypadMsgWd
EnableMouseMsgWWd
EnumIniKeyWWd
EnumIniKeyPwdWWWd
KERNEL32.DLL
IMM32.dll
MFC42.DLL
MSVCP60.dll
MSVCRT.dll
:!5%u~ja
[7 _}|>7
'=.zjp
|{I.Td_
7`L
5#%%U
*iB%c
.Yk'y='Q4
jvi%X
3.dl4
%d"H$
x.HKV
.wSnK.
EI*j*J.QQ*
<F.vy
%C'rz
J%.CS
ÁX*&
\(.PV@
r32%S3
ðI"
k.nY$
cg.Dd
@m%f/6
A.ZK 
\CrackCaptchaAPI.dll
F%G%c
PEJ%C,
%x>L$8
k.dH F
\.inn
.PJ8&
k\\%S7
=%,.XdQU
y.htb
.Be$>;
.Gf}Z!
.NH0v
R.NL<
#.Ptm|td
#|.Xy
C-%uTf
}DQW%dT;
Np&%X
">%cY
v[^_..Bh
5M*%.WI2W-
9f;SSHp
cY.LR$
NA%d(N
l.hUB
.jzvO
.btm-
NA .hA"
%3uj2
C.kwFt
`F%u$!
afT.Aga
?~et.dll
OLEACC.DLB[
n.age
\*.tx
*ng.FileSyK$
l.c%d}wf
'-?2&@=["
%src{
8HKEY_CURRENT_USER
.AK%?
(''&%$$#""!!
.wh#.(
OCmdT
~.INI
.MSVCRT
%S00P%W
TP.Pp
(&07-034/)7
)*$-2{  
%s:%d/
.Eh.dE7
_.CABAZ'\
W/ ".iBO
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/> </requestedPrivileges> </security></trustInfo></assembly>PAD
oledlg.dll
DeleteUrlCacheEntry
hXXp://wan.2345.com/sxj/wd/
hXXp://item.taobao.com/item.htm?scm=12306.300.0.0&id=543415475348
hXXps://953ka.net/9lBds.html
hXXps://953ka.net/9lBps.html
hXXp://VVV.tudou.com/programs/view/-gAR5m45gg0/
\data\setsoft.ini
16899199
\dm.dll
C:\Windows\System32\yfr.dll
@.reloc
MFC42u.DLL
FakeReg.dll
ZwQueryKey
ZwQueryValueKey
ZwOpenKeyEx
ZwOpenKey
\\.\%c%c%d
6|2|5|8|
.bmp|
50005000
2.bmp|
1.bmp|
0505005
1|2|3|4|5
0|2|3|4|5|6|7|8|9
222.bmp
windows2
C:\qj\Config.ini
1|2|3|4|5|6|7|8|9
3.bmp|
4.bmp|
5.bmp|
6.bmp|
7.bmp|
512103179
vK-l}
56828552828
time-a.timefreq.bldrdoc.gov
time-b.timefreq.bldrdoc.gov
time-c.timefreq.bldrdoc.gov
time-a.nist.gov
time-b.nist.gov
Your disk have a lock!Please input the unlock password!
Your disk have a lock!!!Please enter the unlock password
0'-?2&@=["
\hrttp.dll
=%f*b
05  %fQ
4].em$ (f<
$UDp0
QZ^&\key
%drmG
%Dx!\
g@Wp.cT
%xh`U0X
?hotkeyScrol;r[MD
%x-l h
9p%s m)t4`#
&y1`Ð<
`c%US.j
MSIMG32.dll
MSVFW32.dll
SkinH_EL.dll
scripting.FileSystemObject
00:00:00
cmd.exe /c del "
cmd.exe /c copy /y
cmd.exe /c move /y
@ping 127.0.0.1 -n 3 >nul
@ping 127.0.0.1 -n 1 >nul
del 123.bat
\123.bat
a.txt
a.txt"
\TEMP.TMP
\\.\PHYSICALDRIVE
\\.\SCSI
\\.\SMARTVSD
\\.\PhysicalDrive0
c:\windows\system32\drivers\etc\hosts
RunDll32.exe USER32.DLL,UpdatePerUserSystemParameters
VVV.baidu.com
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
rundll32.exe shell32.dll,Control_RunDLL
Shell.Application
0A\\.\PhysicalDrive
access.cpl
sysdm.cpl
rundll32.exe shell32.dll,SHHelpShortcuts_RunDLL AddPrinter
appwiz.cpl
rundll32.exe diskcopy.dll,DiskCopyRunDll
timedate.cpl
desk.cpl
joy.cpl
mlcfg32.cpl
wgpocpl.cpl
main.cpl
rundll32.exe shell32.dll,Control_RunDLL modem.cpl,,add
mmsys.cpl
rundll32.exe shell32.dll,Control_RunDLL netcpl.cpl
rundll32.exe shell32.dll,Control_RunDLL password.cpl
inetcpl.cpl
RunDLL32.exe Shell32.dll,Control_RunDLL StiCpl.cpl
ODBCCP32.CPL
RunDLL32.exe Shell32.dll,Control_RunDLL Telephon.cpl
PowerCfg.cpl
RunDLL32.exe Shell32.dll,Control_RunDLL BdeAdmin.CPL
rundll32.exe shell32.dll,Control_RunDLL
Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
wshom.ocx
HTTP\shell\
HTTP\shell\e\command\
https\shell\
https\shell\e\command\
cmd /c netsh interface ip set address
SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\000
x86 Family %d Model %d Stepping %d
Function Getcpuid()
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
getcpuid=cpu.ProcessorId
Getcpuid
.A\Microsoft\Network\Connections\pbk\rasphone.pbk
dm.dmsoft
xml.parste
SetShowErrorMsg
KeyDown
KeyUp
KeyDownChar
KeyUpChar
KeyPressChar
KeyPressStr
SetKeypadDelay
WaitKey
EnumWindowSuper
FindWindowSuper
GetWindowState
SetWindowSize
SetWindowState
EnumIniKey
EnumIniKeyPwd
EnableKeypadMsg
EnableMouseMsg
EnableKeypadPatch
EnableKeypadSync
EnableRealKeypad
\config.ini
hXXp://open.baidu.com/special/time/
window.baidu_time(
hXXp://
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
1970-01-01 08:00:00
1970-01-01 00:00:00
background(?:-image)?:.*?[\s]*?url[\s]*?\([#
']?(.*?)[#
onkeydown|
onkeyup|
onkeypress|
{0002DF05-0000-0000-C000-000000000046}
{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}
{6D5140C1-7436-11CE-8034-00AA006009FA}
text|password|file
?)-D%f`
location.reload()
window.location.href="
{25336920-03F9-11CF-8FD0-00AA00686F13}
hXXp://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
document.all.retjs.innerText=
javascript:document.body.contentEditable='true';document.designMode='on';void 0;
javascript:document.body.contentEditable='false';document.designMode='on';void 0;
javascript:document.onsdragstart=document.onselectstart=document.oncontextmenu=function(){return true}
javascript:document.onselectstart = document.oncontextmenu = document.onmousedown = document.onkeydown = function(){return true;};
WarnOnHTTPSToHTTPRedirect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
type=password
[password]
var jies = document.getElementsByTagName('object');for(var jie in jies){if(jies[jie].classid=='clsid:D27CDB6E-AE6D-11cf-96B8-444553540000'){jies[jie].removeNode(true);}}
user.qzone.qq.com
mail.qq.com
onkeyup
type='password'
type="password"
, 1, , ,
var jie = document.createStyleSheet();jie.addRule('html','
').value="
document.getElementById('
VBScript.RegExp
hXXp://VVV.ip138.com
Adodb.Stream
windows3
dx.graphic.2d.2
hXXp://vip.953ka.cn/list/7J2Us
hXXps://item.taobao.com/item.htm?id=542647524848
N.NFy
D&)`]l%F'
UN].eh
fLg%X
kiphlpapi.dll
\\.\Scsi0:
icmp.dll
VVV.dywt.com.cn
(*.htm;*.html)|*.htm;*.html
%d%d%d
rundll32.exe shell32.dll,
;3 #>6.&
'2, / 0&7!4-)1#
c:\%original file name%.exe
4^.fh0jxee
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
activation.php?code=
deactivation.php?hash=
.?AVIUrlBuilderSource@@
7? 06$"@
%.obP
?<.UR
r-%S/S
 $.QVM
.lz^OBK
A6%up
tx#.JG}
"-mdzHA}
g.hD?
.kxzb2
UDP<%VC
.eu@T
=-el}
ndX.fm
K'B%u
X!.KF
z)%f~a
.JW;5.
-r}xIk
|r(%d
}vc/%U
.}=
.qpzR
tA.vI*Q2k
q""b%U
.fk(]
,%S^,
b*%xHG
E.il=
Ca-t}
~D.bhZ
dM%FH
3/n%C
OF#.od
&.gng>6
C!.KDN
OF.vX_
0%Xzwr
P.Rr>
J.wxi
h.mbl
Xf.fk
y".tU
r|.mg
i.BNXl
.Sc/gj
xy.bi
A=.EL
%rd%F&H
.VX"w
k$.fm
ng'.sC
!X.fi>r}c
;.jh *
8'.uz
uMq(&H%X
%d@/t#
X.fjo]Q6DNj
3CO".CO|
w.lB"
.BtP[
%xu[/
%ch)%
.NNH~e7
.frPz
%%7sT'
.lWQd
GuP.bn(
=6.BU
Qjfk.bo
|!.Yofjq;2?
ocrT
f;3%x
B.fjV
S*%XK
O4|-%C
u.!.wz
.zk~)
.ou,$$
4xpE.Am>
J.Oaz
].vY!-_w
%S/Ss
5\.fh
D$0Mq!%f
*%xHG
.sx974B
.uy$naF0x
.BCPw
.zp87
mKw.%f
UX/%F
lD.bl%
.fk(5
..flf
>}0%C)
%uGfx
nc".fmC&
v%Sam
kW{".RCWU
eCV^.fhF0x
.boZ!
R..Jk
"}".PX
Wa-&%S
".fh2>v
6zm
*.Jqk
.uy6.
->A>%S
9.gIk
\.fi8A
%UIpQ
P%C@a
d|*.wz
j7:%D
Dv %x
nv%D.
%2x3S%
fk*%d
}%F&H
.tn7>i
FN.fm
f.wyXjg
b_A
ndX.fhk[
zs%sfp
.%dh /
h%cq!
k.fC[
8.qrj
.ULNfT
n".hX
S%SNy$
X.fnX
g.fkB
u.bkW
".fkB
=#.dn
O'e.UdmJ3Y
;.SMh
 .WgkzeZqk
>hÜ,
9`j".fh0
%dhz#/
7nd.kDCL
.CMmNi
.DnoOV
f`ÿ@!
/90%fl
t>.xQ
#.ofY
^S$.PY
%.Wy 
!12!9*2%
n&.QX
.yX.oh
~q".fm
g>5.wyL
w%uyo
vUDP
w,%s%0
)~%xQ
%xp91{7
PP.mo7
J|.aa
))?.wS
$O@%.YW
T%skV
G%cO!9
b.yo%
s.XRC
e.*%D
z!.XW6
wSHELL32.dll
-7}Qo
#fEXe
2.teG
4%.vI
U%s=\
.tSZl
K7)#k%Un
rk*5.Wu
k%Cw$_
>{.ci
~$a%.mM
=@.Mp
r%UN?5
%cV=.
"%DL\'
V=/.vn
1.lP:
u%f\,|2
%X3[Wrn
6X -h}f
bV.HqD
.yT])
.VX%6
D".RU
-1 :E2%F]3o^
T7vY%Xw
=msGz
.Im*{L
.^.lU
YM&%f
]\H%f
.qD=j|
.uU~A'
ZP%x8
ZC-Na}
'%UPXV
JSQ%C
`comdlg32.dll
-$.JZ
%%CiT
Lxfmsg
q1_[.Fs
.biG<
.la>v{:2
uI_j~CUSER32.dll
oYuser32.dll
.ud00
:5.UR
X.rZk\FU
yôd5
3C|%X
NC.EV
<%F#R2
%t.fP
.xPg)
%f&BF
n%F~2us=C
.fEUF
&%FwP
5.yO_
i03F%u
Iv6.Fb\
Fx.vC
2%FS'
.uFz*
N>.dk
%C@Og
"Hy.JZ
.wOrl
b.jFO#~4
F.PNX~
U%Fk#
.GVv^
.Fz*vW
Q/\%F"
Kø}
%uFV2p
e%D|A
aF-D}Y
`ð@
F/s^g.Soiu
|t.jJ
q%uFW&
%F?Rl
Nj(`=%SOP;M
eñz
Au.Vk
ZRLA?0
e.RL@&
Mj.HN|
9F.TCP
/u%s?
%fY(d^
Ff.Oy1A
F`,%u'p
;F%Ug
H.FzEa&
%FUWQ
FfEw 2.jdn
ux.cF
.Iomz
M0It/<
fE%DNI
T7þI1
?s^
-]TCPx
lF.uX
x.zFN
^.FXW3m9
F-w .bl
.lR/w1;
rm%u(
q/%uF
S.NGI
]?x%u
#%FU6
.JDQz
(L5%F
.jFfs
e-7}?
c{ TN%Ug3
%DyNM
.bGR%;
s'eü
.MSEKKZ
3}T
%fI vR
7L.ym
s~iMY
tF.fo
FTpK/w
{JUM%u;2
_A~.qWv
t.Fn'
t/<~
1?.KfF(
Iv.BR
)oú
t&.kuN]
o?NF%Ug
.FD05
Epû
F%\-S}
#H>sM%F!
Xq%u1[
\.IUY
ab%Fr
.nz&F
Xw%Fy
.en8F(7/u!
.Vk l
z.CFD#
%F.v5-eWL
Fq.Xd
uF%x O.D4
.wRAm
TukSD%s
np4%Fi-
F.WG\
7t.zFIYW
.cHi)
Fo%uZ
U.ZnH^
^j%FR
}L%9s
>~.RL
%sC6aM
%xAK)
:[.Fx
Zyj%u
_fa%FtcT
VQ8.JF
{.BNpR
7.Bx}
0%F@~
<%Fiw1
&-d}sC
.In'_
;.uBK
5].oDFR6
x.zFIYW
ZN.uRH
/wm%F
Cf.ORx
L%Fgi
.jngFJ
]'wN%u
l,%Fo
h6j.IO
q=}%C@
*`kU%f
o.FB;O
(.eF`
|z.ok
jp.eF
%f"|=
;jId'%u
ogF%u
w>;.hP
a%F&8@
cmdN
-yf.zF
.ge~V
']%F*
,w2)o%F]Kz
oey%F
s]6-z}
jcp.yV
GyF%X
r e%F
]%Fm3
Ln.XKF
U-.Fx8
[.ZNu
Kuß
nZ.lR
.UF$;
|%F,H^Bw
ðkKDH}
*Km%uF
.RhUQ>
f/q%D
O"-I}
O.pn x,^F*Nt
~.gFp
ze%XF
p.XG]
m8y@?
:úp
.JU*Nd=I
9R@.eZ
þTL!['
t.rtR
t.BkF
~x.rY?
?ow
(.Fndc
:%Fq]
>F.lh
RG%DR
n.hO!
.jfiGx
.TKF'
O%DH7
OÏL?)<3
VHóo
E.RuF8
Tcmd
^kú
.Lc -
vB.XRf
Fj%S<
Fe%x@P
MF.Dj
[.FvH(
\.NLT
<d.gj3*F
0p.VJ]?
;F%Do
 þ=K<
RN.jK
%x_x9
Q.ZBp
'.qLvhy
zqy]~%F
!F.dUN
@Fg.kl{
BI%X/
%u[R~woQ9
[.rkw
G.DVF
G]%Xn
T;<%F"
.nuLdZ
.nFa~
64?n
=%5S\
.FI'C
.Bh8{
uMR%8uO
g3k%F
#]%uF_
Ev.RBnp,
 F%se`
\RF%s
.ot;H
a$)%S
AL 9%u
%x["GY
k-R}3
ob]ø
F%Ug'
%C/Fq
I:L%X
T5.pqbF
0p.nz
v5.%FL
1.Fnv
v0%F-
].kXSF_
.kl{I
U~%Fq
]Gm
ek/b
r* %F
K]%Dv
.Nn,2:
j.oN;
5%Sq3
q.MxF3
. J%FgH4
[C%fZ
=2.kjLt$yF
MIg%F
-FTO}9
.zXFt
o7I%F
jôl
.xOiY
.Fr\ ]
6.xFNZ
O=&%F
7.FG~
}.JFhtn
=.OCuf"N
D.cUF
^.gcCRJ
.FL v
F^6.NX
.LG ~
x.vR:\
pN.Fm
1N.bU
].xFl
.to'R_
i%DKa
%FmoB
I%F:f
R÷c
r%FK$
F{.rX
[!I%FM
Fi;!]~.sTL
>7.pR
*n%F&
4PŒ
;o%xr
t^.fF
<%.kF
]%DiFW
'F(L>.zP
1.Fb0
.rFcC%
f[
%DOyu
<.nbF
|~e%F
N.Je{
"j.NnY
Â;uLF
nx.nP
&.fr/
X~G%U
mHú
}gB .ga
|19e.dF
|G%F`
L^N6.RW;
I9E?%F
.de!@_{
>.JRW
7G?%F
w]1%F
RB/-
N?.ns
F`4%uw
O%f&FK
.nrJw?I
NF.YW
WMROK%F"6
p.FY5
 %xFh|0
.FC~9<
Q%x<N]
O?AF%C
rQ%d 7}FP
_.vN3
Ttò<~
g~.rD
n.DLU
K.CZXF
Jhzg%F
$@e%C#
QF%uS
]'i%F
F9a%U
HA%FP
ýo};
.FPy%
.Frkc
.oFrn*
Lðh
K.Fk!
{k/%F
Rw4J%Fl
D.FJMo
6Iv.CF
%uJLB
?.Ept
DCOMCTL32.dll
m|hzOLEAUT32.dll
%4s`O
8sö
~#.YU
l.K%CY
.kxpyF
@n.yYn/M
ifZ.RW
E.GR!
q%SFk
Od.lL
|.pg]
Á;#
yXNB.EyU)
V%f&I-G%
P).LX
%Ud %
LXe.EI
`?.bX
=7.Rr
&b.%D
G*%x/
(%U=zHnP
%xM!h
?]N%f
#{.PO
VZ%xO{
.Rw~i
vcÝ2y
n&.Ke
.gda@!
%X;UK
.UE!}
.Xb/G>CS
_3.gh
PW;j.OSKTF
jb;.Nd
A~mJ%F
Qt.PM
F{%Ci
tLFn.zFU
Ki.KAF
cdF%DI
F:\A$
U0.Fu
GùB
~%8u*
\G?%u
!HP%Sy
FS.zt8
FS%6s
.FYlU6po
ku.DN
f%U-n
]=œ
W(?.FO
NP&%F!
FGZ%u$
?.JOq
)&.OY
.OUx:F
?(.GX6~
FfaG!t.VF
3.kIFZf
÷/J
SsHFk
Jf2%UF
NBb.jl
UK.Ll
|X%Fm
ó<P7
F%xHg
(F.Xk
D#.ne(
k}K%u
Fq%U -
Wx_.Nic
7 .Qd
/%F*z
.nxPR30{
%uV 5
.gOr$
V(%F:CG
.WZFl
Z.bj_
l>%F`
@J %x
wbm.zJR
%F,.7
.FJ,4
4 x.Ba
0]/%F
ZC%FW
.GY{UF-
PES%FJ8
.kF`pK
<x~%D
Ø~e
t2F%D
%XA,|
OF@.yP
Nw%Ueb
<K%UOF
Mw>%F
nFN.fb5
,ak"ô
.fS|K
er%Ft
%X&p:F
g^|%UeF
*FE8e.XS
/%FWp
Z'%FG9
R.BwM:
L%FKS
"Nn.vN
.WFL6de
Av%U)q
GRP.Lk
Qa%F 
8.qFZ
GR.bHI
kEy{F
'<?%syF"
Jø'
i&,o%F
.vjLgM
Fz.Nnc4
6z\%f
}k!fP%F
G>9%F
K.zMF
%7s'jV
.Ns2$J
.FvR<!"
-F%d[
KF.QE
Ze|f
b%Fj6
~Dy%SF
$.yFT
.RI6x
=;__%FR
Ko.FkU
j%d,L
^RT.mh
E8.EoyF
F3.TO0
=.FD9!{
_.vFU
%F'lBX
.KF<f
K}>ò
þ-UX
;.NOr
.rF,}
\%FjW
eXuRlWY
\.FA;
~>.uw
@u?a
{'Fj%d
|%us\
xW.VPF
~Fo.xY0
R.iUr7
.gRLc
.FRmi
 ;rQ.FLR
s$H%Fv
y5.WV<I
.KFL}
f~j%DYR*
GÕ3F\
.ijtF=X
,'}.FU
uRv%FN
.Fqhu
ntCrT6
>.Fmr{
`H,%F
o.Fo)@
%F IM
;kFL.Nj
RZ.rTo
L.st>
bo.xz
.E4Ÿ&F
_x4
.Qm6_P
.FT7*
_.iF:K
s%F&Q
FG.DnA4X
tcPA.
.bNKee6
%FWYv\@qP
{\.pK
%xgKF
B%F>.UN
nT%sH
.tP*&F
ly%FO
_>A.GLR
PIpE
PLZ%F
%F]rX
G@CZ%F
Jt%F.
u0kg%F
_?U%X
h%F>I
ô*2fhU
R:\6V
FvÂ=
E.qPWf
hÎf
:.nh_oF2
.fFQP4
vz!%F
%F$iK
Fq.jP
lCRT
%X6jt
OM-Slö
X.unR0FG
F.kM7_
F-io}!
>%x:>?
 [.vp
Igh
Eh.nq
Nb}%Uv
?%F[d
.FsWp
FX.ys
4Z.Ts'
XUO%u
%x"NV
mW%F J6
>s.mPD=
V^%5sD9F
L-.LVFIP
4.nMnq
M?IK.FuG
%do9>
vJbm.kF
%uZ\Q
<%FR9
%Fn$y
F.QH,v
@uf%F
A.Fs\
>nþ4
O .vX
4Pfo%F
}aFA.OV*
&%FhU
}.iQ 
U%skF
F}%u3
^.zK7
ÎgFj
,R.Gi
-`%F@
Aun%Fh
#SF<.or"
].YFI
:%xFjU9
).tFG
h.tF{
a=~%Ft
K"%Fys
v8F%Cn
mP%F)
F.etZ
]x/%F
Rv[.NT
3.mjrRMcN
URls{Kp
w(.PF
.FiON6~
~.HVC
H%X3F
.FÎ
"N.XJ
f.JaXF
.jkxF
.bX4o2w
t.eyA6F
__m7%FO
NQV%cR/
FTpi
fÉP
E/4%x
F%4.C
g_.Ft
Q%Fj3
]F5.ga1
F.tuG
fTpF
m%SVY7cFC
%0SnF
.Fnbv
.NKf$
F.Ndz
.KMDF
'm%XR:Q<
9%Scp
%Ft=@
%FLYq
.hFQY"
F.VcC
.FU<=
.FWZ]
qþJ
Kpa>.QK
(.LlFE
FK.TfQ
%s~zF
R8.jVAN
k%F#i
s:\NF
XSpk.iF
n.Fd"v
t%Fk9
.Fjv.
d%F[7
RCe.Vy
%FhEj
moEPj]*
Z.JxoqFA
.NOM>
$@/%u
Êzu
i>%Fr
Cbe2v%Fk
t.FL\
ý"t)
wY`%FQs
.sMFm
L%FI|!
.bFtR
oQ;~%F
-F;p%x
dN%Fx
ÈRy
-üN
3I.MFq
%F\}A#
QF`.Oj
/4,.LL
.Rn^u
QX!%f
%CYVF
.NFXj
F.GH %
cCRt\.
v[MrmnOy%F
Nvj.wB
F.Syl4
'.RXj
R%F)8
N[6.NC
opQ%F
r.FqN
Vu9*%F].
FJq^)6}1ý
Tcpw
%F'ml
F(P%d
.RLN 
L'Gh%F
=n.Fd
th.vk~
%9xsV*
7.AjNO
FM:.pg
Þ~1
H?@
.U%sK
6.MFU
1.Fg7
FEi%u
oz$Eý
{.KFm
.rZNKg
Yi9.FO
5f?%F$
KB`%U6
pv.UFJ
-FK%f
.FB-G
%FXQx
hp%6x
E^.Aw
.TF(r!
c%urT
v)Ï
r.qa#A
nNP.PM
P.Gj%
F.UC/kVd
wT.bJCFu*a>
3%F/O
 .RF]H
-%Fl6
1:.dF
>Z%x<
up,R.FT
g%F[xK
}//%Fu
KcP=.xL
f&.Fl
.EFAa
%F#E:
`CPcEX&.OFa
5g.FH9
Ut.NFv
V%uh]F
*FY.Iw
%FiX|T
K-o}F7(
KÞ2
_iS*FTpqD
R.uG<
.wXCRo
B%FWOr
c%FS:4
k.xF7
.FP!2
\F=b%d
i0F>%CT
=K.pIFk
7Ï-
kFN.ey
6.AbFR
.LwqF
%SAf=)vF
W4.Ro
o.lF&
zsH/].Fm
93[%F
/?-AFl}Tn:
]Q_%F
.UF O
FD~E^Rd
 W\H%x~
%fKVAF
<oi.GF
9H}%F
o.FP1
( %XF 
.oFj>
.auFiT
.LLh_
-tlF}X
R.Wqd
K.vc%
9x.FY
*.KF5PQ2An\=F
v0I%Fr/
d.mm,xFP
>'%FK5
d.FI:k
w]n#\/%FGJ)x
aB%Fw=`n
8.RrRK
KeYv
.pz1L
Ky .oF
fTm*.Ro
CFl%U
.IxR'
Í4F
jF%X02
.FyS0
*ß5
.nnkLqR
!8.vJ
A7%Fx
ùjtq
!.lFOe
FtpD
*&WU%s(F
Hf"vV>%FN
=;%Fu
g&ß
.EFod/
g?F%c
.pImF
)48r%xFKf
U%F}mo
pL]%F
.GV9"
v.HR.
ûoI
.OF,(
.WA 1>
.xt$J
2&~%F
6nõ
p.Fzr9C
%FL^m,
12T%F
.AF1,
q|j5.XvFw
QX%Fm
F{W%X.j
[L.EH
.sFvn
R.iQ,Y
.wxRGP
F .aU
LOX%1U
sQL;f(D
KF.CN`xD
.mF>s
i.rF%
.FwsV@W
Pq.Foe
v'3
FA%U-
OJ~;%FO
l*F&%fkEz
F.cp~
%Fz,L2
`%9SF
tBkP%F
.Fi 9\
*t%Fx
dMr%X
%sLK51
Gi.FJD
63[LJnmý
Þjpq
<*.Rn
FDi%c
6sõ,
;%FR!GQ
F!.cK
#[A%F=
;G.iR
X.wzi
9%FIcR|v
7:s%SF
RmT.wF
s.GF"
%S=F"
a;XG%F
.xPFCJ
<-DF}
s.sYW
7.kYp
3.aYO
xoe.WkF
.FVv^(
.rNn^
o{K%F
%FZj(
&~VTn.NO
Io%F\
.fJ=/
4%F:qw8
%F<ef*
2%FIR
(~F$D16!.AnFd
-XrQ}>
NO].CR
:\.TyP
/FØ
-R}odN
fPu%F
F3.IO
yEB%f
3Ev%snL
F|ü4
hFTpo
!.GFl
e].zzO
!]%fT
A.tSE
FS.WV
.lPkwrF
~p~uQKEY
.NKyjFI
(F8YW.aXqi
'Im%F
U.Fel
.XTOe
N.Ib[
R].keF
H?Y
_uo.GI
k%F-#q*
K(h.WO
-J.FC
F#V!.RQ
.GF\R
6%/.hF
?NNI.AB&
%FG0I
-Lj}F
%DLQ>B
L.eO-
p.Oj~
_9(
hL@{.rF>
m.OFh}DV
Lk.DF=
F .Oj!I
.Fj;#
3z.FlN
1F.Sov|
Uõ!K
.rN|Sn/
`/ô0^
.FT<a
:5.sF
#.ZFD
%Fu_:
F.Nj9
&f%Fq
T %F 
.WFjD
p.PU\m
~.HvNmK
ßXs
L-iZ_>_ý
]K.SeQt
I{ %F
Zk.XF\
Fj;.ZC
w.Nz&c
e&\.aN
j.DYO
iLl%1U~A
2c%FK
G{.FR7
ms.Qn
.xF4v
/ %Fu
[aFx.DT
9|8FM%S
.fcCdr
2%S#FE
x.QF 
%frvXj
^$.NdE
gBZF%U
E[.QW
\.rFq
S6ò/v,3:
x%F?KE|u
I/#F.kM%
.HOv5
UxLlB%F
JL.Qj#muF
d%uAR
".OUWaF
cX.lq
5 .vU
 2.Xk
NR:%CGF-
QB%F!
F%slZm:
Hpq%Fw
.KsN~
%x ;aF
Vm~%FYk
FY %f
nlUdP
[Lt%F/
.Fl/]
dF-Q}
t.xaF
%F(R0j
PW.HV
L{g.Fr8
3.QU~
A.NGT
.ag;F
.lOXOFPo6
%5Sk#WF
9RS/%F
.VkFL=e0
"fR%x1
ve%SF
[>J.TFdG
.LFlu?
[pv.CkL
YV.qfz
%uTH9
~.wRN
`,.FI2{
.FJoE
ZKF%u
%Fp6@
MpO.GF
Mcf%f
d.FknE
F.Bp'
Rr:~u.FP^&w"
<L.SvFV0_
&k%f.
NY}%Cr
?@F7.fx
.mmRs
F.fag
 }_%F
@CD%F
XQZ.zF"I
F\Ûl.
R"K.WF
.Fe5>
_?E%F
/þW
U.uF'
z7N%F
c,.gf
4<-0}
.QFqX0
>gC.Pl
J|.FT
FM.uY,
%su1o
n.AVF
P.CFI
#%F<V
_.EFT`
"ej%F
%FUeW
zx.AF
Fn#u%dIW
cp&K%x
<F6j%s
F.KWO
}øf]
<%SUFs[
ts.aS
Fp?&Gûc
F.mz3
lWweB
>c;Er%F
PUg".FLX?*
.OHZ{
Q%FPU#:
%0SrzI,
.nrR5P
.Os2F
sOS.ff@3L
Zoz.DD#C7
%F|"~
.FT-lQe
F%cRrP
`nicK
%D Cm
H.VI1
FD%XPR
.IHEE
ntZ_%F
.oLJ0K
>.nLF
O.FZq
xOj
.nC]O
.Fd4TDt
K}E%F
kL8e.oz
0N.RUM
Pj6Y%F
Y1.zRG
j(.OE
uRLv>5
0%sFR
?%FR1HZG
%FpZO
ý>3
"fE.MF
FVW%U
%D{Ae
WZv%X
.SF^T
P#\F%D
MsQl7}
÷}^
r.Ke`
E.eM|J7aul
</.NG
$?G%F
F%uvG.?
a0
Qjkn[ÿ<
t.FfYX
.RFn4
\.Fp[
D2%uR
NP%cO
S%fZN
R|qB\ÿ
xFAT.RV
FtP{(
^%F"_
0a]%F
P-RF}
v.rSR
%D,F?K
p.Cf[
.HkonF
.fF<6
=(.RHc^I
uß6A
Ew.Nq/l
S%Co,
ú2 A*8L
b~%Cr
E]V
F|anú
?ZO.zF"
EPFd.Ds
^m.%SV
vk%F~
'PgZ].rR0
KL;%F
0R-vM}
GKEY
? P
gO.XPG
%FO}U
R>?%FO
X%SmU
[UrLON
aO.efi|
7\.Nn
5q.Ff
t~PW%F
xnv.LH4
gs-FW}o
R@nM]%F
f5.Ft
.pLXH
nb.fn
KrV%U<t
2Bl<%X
J:.Oc
~ñE
.FTb9
hFr%X^F
x8_o%x
`F,%CT
.Ln;c
a%FN:!
CM!.ngm
B .BN
Q.fl5V
(*.*)
1.0.0.0
(hXXp://VVV.dywt.com.cn)
1, 0, 6, 6
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
mscoree.dll
Error at initialization of bundled DLL: %s
Error at hooking API "%S"
Dumping first %d bytes:

%original file name%.exe_2712_rwx_00BBE000_00279000:

4^.fh0jxee
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
activation.php?code=
deactivation.php?hash=
.?AVIUrlBuilderSource@@
c:\%original file name%.exe
7? 06$"@
%.obP
?<.UR
r-%S/S
 $.QVM
.lz^OBK
A6%up
tx#.JG}
"-mdzHA}
g.hD?
.kxzb2
UDP<%VC
.eu@T
=-el}
ndX.fm
K'B%u
X!.KF
z)%f~a
.JW;5.
-r}xIk
|r(%d
}vc/%U
.}=
.qpzR
tA.vI*Q2k
q""b%U
.fk(]
,%S^,
b*%xHG
E.il=
Ca-t}
~D.bhZ
dM%FH
3/n%C
OF#.od
&.gng>6
C!.KDN
OF.vX_
0%Xzwr
P.Rr>
J.wxi
h.mbl
Xf.fk
y".tU
r|.mg
i.BNXl
.Sc/gj
xy.bi
A=.EL
%rd%F&H
.VX"w
k$.fm
ng'.sC
!X.fi>r}c
;.jh *
8'.uz
uMq(&H%X
%d@/t#
X.fjo]Q6DNj
3CO".CO|
w.lB"
.BtP[
%xu[/
%ch)%
.NNH~e7
.frPz
%%7sT'
.lWQd
GuP.bn(
=6.BU
Qjfk.bo
|!.Yofjq;2?
ocrT
f;3%x
B.fjV
S*%XK
O4|-%C
u.!.wz
.zk~)
.ou,$$
4xpE.Am>
J.Oaz
].vY!-_w
%S/Ss
5\.fh
D$0Mq!%f
*%xHG
.sx974B
.uy$naF0x
.BCPw
.zp87
mKw.%f
UX/%F
lD.bl%
.fk(5
..flf
>}0%C)
%uGfx
nc".fmC&
v%Sam
kW{".RCWU
eCV^.fhF0x
.boZ!
R..Jk
"}".PX
Wa-&%S
".fh2>v
6zm
*.Jqk
.uy6.
->A>%S
9.gIk
\.fi8A
%UIpQ
P%C@a
d|*.wz
j7:%D
Dv %x
nv%D.
%2x3S%
fk*%d
}%F&H
.tn7>i
FN.fm
f.wyXjg
b_A
ndX.fhk[
zs%sfp
.%dh /
h%cq!
k.fC[
8.qrj
.ULNfT
n".hX
S%SNy$
X.fnX
g.fkB
u.bkW
".fkB
=#.dn
O'e.UdmJ3Y
;.SMh
 .WgkzeZqk
>hÜ,
9`j".fh0
%dhz#/
7nd.kDCL
.CMmNi
.DnoOV
f`ÿ@!
/90%fl
t>.xQ
#.ofY
^S$.PY
%.Wy 
!12!9*2%
n&.QX
.yX.oh
~q".fm
g>5.wyL
w%uyo
vUDP
w,%s%0
)~%xQ
%xp91{7
PP.mo7
J|.aa
))?.wS
$O@%.YW
T%skV
G%cO!9
KERNEL32.DLL
mscoree.dll
Error at initialization of bundled DLL: %s
Error at hooking API "%S"
Dumping first %d bytes:

%original file name%.exe_2712_rwx_00EDE000_00001000:

Lxfmsg

%original file name%.exe_2712_rwx_02B50000_0014B000:

.text
`.rdata
@.data
.vmp0
`.reloc
@.rsrc
<4,$?7/'
(3-!0,1'8"5.*2$
t%SVh
t$(SSh
~%UVW
t.It It
u$SShe
Jiu2.iu
Kernel32.dll
kernel32.dll
ntdll.dll
user32.dll
wininet.dll
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
https
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
http=
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
hXXps://
hXXp://.
\kernel32.dll
.com/v5/
%d&&'
123456789
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
__MSVCRT_HEAP_SELECT
Broken pipe
Inappropriate I/O control operation
Operation not permitted
iphlpapi.dll
SHLWAPI.dll
MPR.dll
WINMM.dll
WS2_32.dll
VERSION.dll
GetProcessHeap
WinExec
KERNEL32.dll
GetKeyState
USER32.dll
GetViewportOrgEx
GDI32.dll
WINSPOOL.DRV
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
COMCTL32.dll
WININET.dll
GetCPInfo
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetWindowsHookExA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
comdlg32.dll
kk5.dll
.PAVCException@@
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
.PAVCFileException@@
: %d]
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
.PAVCNotSupportedException@@
out.prn
(*.prn)|*.prn|
%d.%d
%d/%d
1.6.9
unsupported zlib version
png_read_image: unsupported transformation
%d / %d
Bogus message code %d
libpng error: %s
libpng warning: %s
1.1.3
bad keyword
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
(%d-%d):
%ld%c
x86 Family %s Model %s Stepping %s
X-X-X-X
\\.\Smartvsd
\\.\PhysicalDrive%d
\\.\Scsi%d:
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
c:\%original file name%.exe
.pv 6
e%.dA !
=l%
.dquN
'T.Bd
p%cln
.dbxM
.KF&QLZI
4.bDT
.sru3
bz.pq
z.pUI
8(.Gs
uExe
0;l%f
"%c]R
.PoWw
KEy$Q
P%D%7
e9_s.tq9
?s.tB|J
L%S3 }
.PKhF
[.tg@
h.nPQV
M*.db
.IRv5{
.TF|b
TCP7n
2?3Q3d3
7(7-7H7d7q7}7
8&9:92;{;
3 3$3(3,30343
4#4*43484
8%8S8
<#<'< </<3<
7q7}7%8x8
< <$<(<,<0<4<
<,<4<:<@<
:%:2:7:=:
7(777<7_7}7
#include "l.chs\afxres.rc" // Standard components
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>
(*.*)
1.0.0.0
(hXXp://VVV.dywt.com.cn)

%original file name%.exe_2712_rwx_10001000_00039000:

L$(h%f
SSh0j
hu2.iu
msctls_hotkey32
TVCLHotKey
THotKey
\skinh.she
}uo,x6l5k%x-l h
9p%s m)t4`#b
e"m?c&y1`Ð<
SetViewportOrgEx
SetViewportExtEx
SetWindowsHookExA
UnhookWindowsHookEx
EnumThreadWindows
EnumChildWindows
`c%US.4/
!#$<#$#=
.text
`.rdata
@.data
.rsrc
@.UPX0
`.UPX1
`.reloc


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\ÉñÏɽÙÅäÖÃ\t\¹ú¼Ò.bmp (284 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Ö÷ÏßÉÏÀ­Ìõ.bmp (292 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¾­Ñ鵤.bmp (356 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÓÒ·­Ò³2.bmp (404 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÊÀ½çBOSS-ÒÑ»÷ɱ.bmp (588 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹¥³ÇÂÔµØ-¹¥»÷2.bmp (464 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±ÕÉùÒô.bmp (320 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ2-1.bmp (292 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\µöÓã3.bmp (548 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\µöÓãÂú.bmp (284 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÆìÖÄ-À¶.bmp (236 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\µã»÷¼¤»î.bmp (212 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¸§ÇÙ.bmp (236 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-°×Òø1.bmp (572 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¶àÈ˸±±¾.bmp (468 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Éý¼¶-¾³½ç.bmp (628 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\÷»×Ó.bmp (308 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\½î¶·ÔÆ.bmp (212 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÁìÈ¡Íê±Ï.bmp (236 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ1.bmp (292 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Ϊ¿ªÆô1.bmp (236 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-»Æ½ð4.bmp (284 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Á·¹¦·¿.bmp (284 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Ö÷Ïß2.bmp (296 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¶¨Ê±»î¶¯1.bmp (260 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Áìȡٺ».bmp (464 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\î§Ë¯.bmp (260 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÉùÒô.bmp (324 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\µØͼ.bmp (308 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¶àÈ˸±±¾2.bmp (356 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦ÏäÆæÓö-È¥¼ñ¸ö±¦Ïä.bmp (620 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\µöÓã2.bmp (260 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ-Ê׳ä.bmp (376 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\´ò¹´.bmp (260 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Ö÷Ïß1.bmp (296 bytes)
    C:\ÉñÏɽÙÅäÖÃ\Îļþ.zip (1 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\µöÓã-Éý¼¶.bmp (260 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÁìÈ¡×øÆï.bmp (968 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹¥³ÇÂÔµØ-±¦Ïä.bmp (836 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¿ªÆôÁÁ.bmp (260 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\t\QQµÇ¼.bmp (464 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\µöÓãÂܲ·3.bmp (196 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÆìÖÄ.bmp (236 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-»Æ½ð6.bmp (500 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦ÏäÆæÓö-³ÈÉ«.bmp (572 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¶¨Ê±»î¶¯3.bmp (248 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-»Æ½ð2.bmp (464 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÆÁ±Î.bmp (324 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\»î¶¯´óÌü.bmp (324 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¾«Ó¢-ÒѾ­»÷ɱ.bmp (452 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¾º¼¼³¡-Öмä.bmp (164 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÈÎÎñÀ¸ÏÔʾ.bmp (420 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¸ß¼¶BOSSÕÙ»½Áî.bmp (292 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-»Æ½ð5.bmp (484 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦ÏäÆæÓö-×ÏÉ«.bmp (320 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±³°ü.bmp (392 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-°×Òø3.bmp (572 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÈÙÒ«Õ½³¡2.bmp (428 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÇÕµã.bmp (308 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ-Ê׳ä2.bmp (348 bytes)
    C:\ÉñÏɽÙÅäÖÃ\ƽ̨µØÖ·.txt (1 bytes)
    C:\hrttp.dll (94 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÉèÖÃ.bmp (236 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¶¨Ê±»î¶¯2.bmp (320 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹¥³ÇÂÔµØ-¿ÉÒÔÌôÕ½.bmp (236 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\v5[1].htm (227 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¼¤Õ½BOSS2.bmp (548 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¿ªÆô¸ñ×Ó.bmp (748 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\µöÓãÂܲ·2.bmp (248 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ħ½çÃؾ³.bmp (292 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¶··¨Ì¨.bmp (356 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\µöÓãÂܲ·.bmp (356 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-°×Òø2.bmp (516 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¾º¼¼-ÅÅÃû½±Àø.bmp (392 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Ãâ·ÑÁìÈ¡.bmp (284 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-»Æ½ð1.bmp (432 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÈÎÎñ3.txt (17848 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Ï·Ë®.bmp (212 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\×ó·­Ò³1.bmp (284 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ºì°ü.bmp (236 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ-¹ú¼Ò2.bmp (324 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¸±±¾´óÌü2.bmp (392 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÈÙÒ«Õ½³¡.bmp (348 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¸£Àû´óÌü2.bmp (428 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\»î¶¯´óÌü2.bmp (320 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\t\QQ-ÏÂÀ­.bmp (260 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\²É¼¯ÖÐ1.bmp (356 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¼¤»î.bmp (580 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹ú¼ÒÕ½ÊÂ.bmp (380 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Ö÷Ïß3.bmp (248 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\æ϶ð.bmp (212 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Ϊ¿ªÆô2.bmp (1 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ-ºì°ü.bmp (284 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¼Ò×å.bmp (388 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ2.bmp (292 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÿÈÕ±Ø×ö1.bmp (464 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹¥³ÇÂÔµØ-Ç°ÍùÌôÕ½.bmp (292 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-°×Òø5.bmp (356 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹Ò»úÖÐ.bmp (284 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\µØͼ2.bmp (284 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ-¹ú¼Ò.bmp (284 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¼¤Õ½BOSS.bmp (452 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÈÎÎñ1.txt (17848 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÍË×é.bmp (356 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¶ÍÔì.bmp (236 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÈÎÎñ2.txt (16944 bytes)
    C:\ÉñÏɽÙÅäÖÃ\dm.dll (1 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Ãؾ³-Ë¢ÐÂ.bmp (248 bytes)
    C:\È«¾ÖÅäÖÃ.ini (23 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦ÏäÆæÓö-À¶É«.bmp (416 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÌØЧ.bmp (388 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\µöÓã1.bmp (356 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÏÉ×Ó.bmp (188 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÓÒ·­Ò³1.bmp (348 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹ú¼ÒÕ½ÊÂ2.bmp (608 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ħ½çÃؾ³2.bmp (284 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-°×Òø4.bmp (484 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÆìÖÄ-°×.bmp (236 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\×ó·­Ò³2.bmp (452 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÆìÖÄ-ºì.bmp (284 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\×é¶Ó.bmp (348 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\t\QQ-ÆäËûµÇ¼.bmp (464 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Çл».bmp (428 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1.she (26 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ-¾º¼¼.bmp (320 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-»Æ½ð7.bmp (544 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÖØÖÃ.bmp (380 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Õ½³¡´óÌü.bmp (324 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\²É¼¯ÖÐ2.bmp (356 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¸±±¾´óÌü3.bmp (380 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹¥³ÇÂÔµØ.bmp (324 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÓñÍÃ.bmp (208 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹¥³ÇÂÔµØ-¹¥»÷.bmp (392 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¸£Àû´óÌü.bmp (468 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\Í˳ö-BOSSµØͼ.bmp (388 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\±¦Ïä-»Æ½ð3.bmp (428 bytes)
    C:\ÉñÏɽÙÅäÖÃ\°æ±¾ÐÅÏ¢.ini (24 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÿÈÕ±Ø×ö2.bmp (320 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\ÓÒÒƶ¯.bmp (356 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¹Ø±Õ-Ïɽ×.bmp (348 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¸±±¾´óÌü.bmp (356 bytes)
    C:\ÉñÏɽÙÅäÖÃ\t\¸±±¾½áÊø.bmp (324 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2025 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now