Gen.Variant.Hupigon.3_0cead74d34

by malwarelabrobot on October 9th, 2014 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Zusy.Elzob.8178 (B) (Emsisoft), Gen:Variant.Hupigon.3 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan-PSW, Trojan


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 0cead74d347f9a2237f63d712db562fc
SHA1: 4b27eb719bf5cce0b4b2f57030786ca5f34b1985
SHA256: ddb1b74dd328dc7ba936a2fff5aa34ae3fe2077203e7d9a6a620bc57ae9c2455
SSDeep: 24576:MgDXuC7R5UZNxSQLJLCyJ1IamzciJX5nIw1kEbr/ZXln41yEbDjx1OBSM:MgDXurQLUBVc1kEbrtEbD3M
Size: 1945600 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2010-08-15 04:09:56
Analyzed on: WindowsXPESX SP3 32-bit


Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:132

Mutexes

The following mutexes were created/opened:

__DDrawCheckExclMode__
__DDrawExclMode__
DDrawWindowListMutex
DDrawDriverObjectListMutex
{1B655094-FE2A-433c-A877-FF9793445069}
c:!documents and settings!adm!local settings!history!history.ie5!mshist012014100820141009!
_!SHMSFTHISTORY!_
CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
ZonesLockedCacheCounterMutex
ZonesCacheCounterMutex
ZonesCounterMutex
WininetProxyRegistryMutex
WininetConnectionMutex
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
c:!documents and settings!adm!cookies!
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
RasPbFile
ShimCacheMutex

File activity

The process %original file name%.exe:132 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tcss.ping[2].js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1307700639_1837963180_10232_sPicName[1].jpg (3068 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cdn_djl[2].js (324 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (357 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1307416434_1837963180_5710_sPicName[1].jpg (2234 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Info_new_13[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\include_page090326[1].shtml (678 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\include_page090326[1].htm (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cdn_djl[1].js (239 bytes)
%System%\drivers\etc\hosts (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1307067350_1837963180_17485_sPicName[1].jpg (1846 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1289532425_1837963180_32014_sPicName[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1308045043_1837963180_13717_sPicName[1].jpg (1825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1306403789_1837963180_16515_sPicName[1].jpg (3406 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1243401051_-405729108_18166_sPicName[1].jpg (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1308045810_1837963180_19553_sPicName[1].jpg (2866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Info_new_13[2].js (23 bytes)
%Program Files%\1.scr (14022 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qq[1].txt (139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\gg_flash_2[1].swf (1753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\client_bg2010[1].png (4948 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1307589442_1837963180_16665_sPicName[1].jpg (1038 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tcss.ping[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1232032171_-405729108_7352_sPicName[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cdn_djl[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Info_new_13[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\include_page090326[1].shtml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tcss.ping[1].js (0 bytes)

Registry activity

The process %original file name%.exe:132 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014100820141009]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014100820141009\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014100820141009]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014100820141009]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014100820141009]
"CachePrefix" = ":2014100820141009:"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 14 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1281834596"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 EB 7C 10 85 E7 C7 D6 8E 5E 83 97 FF 22 D6 8D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014100820141009]
"CacheRepair" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

Task Manager is disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013030120130302]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021120130218]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021820130225]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 734 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1 https://password.qq.com
127.0.0.1 http://aq.qq.com


Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 535659 536576 4.5282 081e3148322f7663866625e0f9018625
.rdata 540672 1296810 1298432 4.93631 a61ae65ba5e09026689d0cb58b1ead4b
.data 1839104 279594 65536 3.53837 0d7ef341019e9389cf662ad2814a529f
.rsrc 2121728 37828 40960 3.94818 5654e64a4d34a4e5826de8248dd6554c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://103.7.29.178/images/dnf/client/client_bg2010.png
hxxp://103.7.29.178/upload/qqgg/dnf/1289532425_1837963180_32014_sPicName.jpg
hxxp://103.7.29.178/upload/qqgg/dnf/1232032171_-405729108_7352_sPicName.jpg
hxxp://103.7.29.178/upload/qqgg/dnf/1243401051_-405729108_18166_sPicName.jpg
hxxp://163.177.72.141/pingd?dm=client.dnf.qq.com&url=/client/include_page090326.shtml&rdm=-&rurl=-&rarg=-&pvid=4643270694&scr=1024x768&scl=32-bit&lang=en-us&java=1&pf=Win32&tz=-3&flash=11.0&ct=lan&vs=tcsso.3.1.5&ext=nw=1;tm=390;ch=1&hurlcn=ad=dnf.qq.com&rand=12283&reserved1=-1&tt=
hxxp://ossweb-img.qq.com/upload/qqgg/dnf/1243401051_-405729108_18166_sPicName.jpg
hxxp://ossweb-img.qq.com/images/dnf/client/client_bg2010.png
hxxp://ossweb-img.qq.com/upload/qqgg/dnf/1289532425_1837963180_32014_sPicName.jpg
hxxp://ossweb-img.qq.com/upload/qqgg/dnf/1232032171_-405729108_7352_sPicName.jpg
jqmt.qq.com 203.205.148.71


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /images/dnf/client/client_bg2010.png HTTP/1.1
Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 07 May 2010 09:34:01 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694


HTTP/1.1 304 Not Modified
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=3600
Expires: Wed, 08 Oct 2014 22:05:58 GMT
Content-Type: image/png
Content-Length: 0
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Inner Cluster 
....


GET /images/dnf/client/client_bg2010.png HTTP/1.1


Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 07 May 2010 09:34:01 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694


HTTP/1.1 304 Not Modified
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=3600
Expires: Wed, 08 Oct 2014 22:05:58 GMT
Content-Type: image/png
Content-Length: 0
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Inner Cluster 
....


GET /images/dnf/client/client_bg2010.png HTTP/1.1


Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 07 May 2010 09:34:01 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694


HTTP/1.1 304 Not Modified
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=3600
Expires: Wed, 08 Oct 2014 22:05:58 GMT
Content-Type: image/png
Content-Length: 0
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Inner Cluster 
....


GET /images/dnf/client/client_bg2010.png HTTP/1.1


Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 07 May 2010 09:34:01 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694


HTTP/1.1 304 Not Modified
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=3600
Expires: Wed, 08 Oct 2014 22:05:58 GMT
Content-Type: image/png
Content-Length: 0
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Inner Cluster 
....


GET /upload/qqgg/dnf/1232032171_-405729108_7352_sPicName.jpg HTTP/1.1


Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694


HTTP/1.1 200 OK
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=15768000
Expires: Thu, 09 Apr 2015 09:05:58 GMT
Last-Modified: Wed, 02 May 2012 04:07:12 GMT
Content-Type: image/jpeg
Content-Length: 3166
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Disktank
X-Cache-Lookup: Hit From Inner Cluster 
......JFIF.....H.H.....C..............................................
......................C...............................................
........................!.............................................
.=...........................!1..A.."3Qr..#24aq...5Bt.................
.......................4.......................!.1.AQ.aq..."2.....#3..
4...............?.....w%?.2..=..}. ..hB.S7. .".M}.....>G.......j.p.
...T....F?=.R.......K/.um...B..9'=t!/8...B^rO.B...}[email protected]
pT>:....'&j....zj..6..g.p..(.t....U...l......V<y.t....t/n.13A$..
.......=J.M3.=G.FTYr..BZ....F.l....k....T.m...t..{.v....R..*J]J..B.R[.
.................=.? }=(.2..{..q.v.....~][W...Z.......x..H..[(..v.**.y
....<8.....[.dps.52.{.%[email protected]]...H.[q.S...P..J.i...
TC..  .....'[[F....$.|.T...qkop..].....Q.^w~..}..,4.~m...6.i..)...@...
....Z6TF.v...(..\....BvA..V].T.XV]. ...-..6..u..9=........|7..s.F..R..
u..=..X.I.H=..F...Q=.i...s![.c...QaT............lW.L.o8.S^F..l..^...S.
..p.a..'P...-i.I.><......7$n.Q........F...../..T.......4.p.|...t
.1R.........*8..PX%..zm.~.g.....T>.E.........m].l.....".O...3&.....
..-!@...$.Z%..5,kd.......YU...e..X]...F.V.*.g\4..u.......0......S$0..}
.._..w..W..r8..5...i.i.l....S.....E. v....so...].Ly.....~...-. .......
.q.Y-l....i.F...J..%7...f....4..L.Y.V......{.(...9.....R2......<...
....W...x....Ut.6u.f<\.....H..(.Ke..E ..A ....u\j..n...x... 3..pDL.
.(.k]...m.F.-..........r..r[.....Q.V...... .M\.w..~.!gfpw....L.....\..
..$......q....8Q.O5..,6ZJ...O.......k.Y....ihB...7;...n.....\Uf...
<<< skipped >>>


GET /images/dnf/client/client_bg2010.png HTTP/1.1
Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 07 May 2010 09:34:01 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694


HTTP/1.1 304 Not Modified
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=3600
Expires: Wed, 08 Oct 2014 22:05:58 GMT
Content-Type: image/png
Content-Length: 0
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Inner Cluster 
....


GET /images/dnf/client/client_bg2010.png HTTP/1.1


Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 07 May 2010 09:34:01 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694


HTTP/1.1 304 Not Modified
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=3600
Expires: Wed, 08 Oct 2014 22:05:58 GMT
Content-Type: image/png
Content-Length: 0
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Inner Cluster 
....


GET /images/dnf/client/client_bg2010.png HTTP/1.1


Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 07 May 2010 09:34:01 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694


HTTP/1.1 304 Not Modified
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=3600
Expires: Wed, 08 Oct 2014 22:05:58 GMT
Content-Type: image/png
Content-Length: 0
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Inner Cluster 
....


GET /upload/qqgg/dnf/1289532425_1837963180_32014_sPicName.jpg HTTP/1.1


Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694


HTTP/1.1 200 OK
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=15768000
Expires: Thu, 09 Apr 2015 09:05:58 GMT
Last-Modified: Thu, 03 May 2012 03:14:04 GMT
Content-Type: image/jpeg
Content-Length: 7399
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Disktank
X-Cache-Lookup: Hit From Inner Cluster 
......JFIF.....H.H.....C..............................................
......................C...............................................
........................ .............................................
?...........................!."1...AQ.2aq#$B.....%R..35DE.............
........................<.........................!.1A.Q...."aq..#2
BRr...b...S..3C.............?..d:......O.EzL...Iu....e)[.,..K!*._$ .Q#
.w.imI.90#.2N.....ZZZ=.U.L.$..`......j6*~g.......MD...y.A....~...`2.W.
qX..c.........ML..^t.x|..p.....=.......,r....S.....M.........j...#..$Y
.:.xw...:.G...P.O....$....../[email protected]..&.f.q...q..Q......x.....O.!.J
e..H...).B....~..-.g.T.J...............5....([email protected].....
..f(....8h.XzG..lE.l.S..T.>_]9. j4.G....;P..Q'.N>....?..5Y?J..}t
....o.......&O....j'..YYA....:G..s...<0.......)6ZX..u.!...%.S..,..=
.....G...n.@gA>..I.}..s .K......A'.:I..0......S......|g...O.*Uf.q..
[email protected] ...6.,@.K........c...O.Jo..........9..(W.kv8*...O./O
.'.............,....^.[../3S.?.~zK...4....xO.ui...'..QbH.".g..|SC..~..
y..V....,'..y.&.f........z........k...,(...8........z^...........'..so
.Q.9V..H.R.S$..........x^.....,D...,-... .$r.._....|..S.?G.......:...A
a.....-.9Q.L~..G.!.....<......,",.<Hj.e8.....x...../:o.....VbB..
.......Vo.uT=.}aO...<.....'......-U.4.'!X.....T....<..V..I..(...
R... y..R..)...3...4.A..x.xr.....>8Se:B...?..q..A... O...<.....x
..U6...U.!.vzd..Q%..<..........O.BH*I.....f.t...F.:.....WV...!...c.
.4.M....o...J~:.H..H9H=..F....F8....`6....d )..p.....i....UY.}...?
<<< skipped >>>

GET /upload/qqgg/dnf/1243401051_-405729108_18166_sPicName.jpg HTTP/1.1


Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694


HTTP/1.1 200 OK
Server: OMG_MID
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:59 GMT
Cache-Control: max-age=15768000
Expires: Thu, 09 Apr 2015 09:05:59 GMT
Last-Modified: Tue, 01 May 2012 22:42:55 GMT
Content-Type: image/jpeg
Content-Length: 4067
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Upstream
X-Cache-Lookup: Hit From Inner Cluster 
......JFIF.....H.H.....C..............................................
......................C...............................................
........................!.............................................
A...........................!."1A...2Qq.#3BR....%'457Sar.bce..........
...........................7.........................!1.AQ."aq.2R.....
..Br..b................?....>cTf.LV...E~.)*w.S....'Y..%.. x....%$w.
.....z...r.6jE... C..v..R.Q....n....XO3.."w..u.P.V.J.1. )\....0.>Z.
.}....V..GyG^U...aHi)J..y.!\.WS...N4........?#...P.lk..D.Z.M*..8..g8.1
......cu.Z.....P..%CI..V.$.O.c.>.....'..hR.Tm...J..Vt..RU..O...va..
A.yu..&)....u......#[email protected][email protected]...{j>&
gt;.....zRq[.....v (...P..V....H]l.*..M.Z.<b]^.N3./...d.)..:.&ou...
PnL...).I.....5L..........E6,X.....c........u...Uk..X.........?......M
J.....i.......s.!P..k...Y#I'.W@.. .......G.zL...O@\[email protected]?...h-.0..Qu
.Y.[.2.........s-...Q0...K.q$.....> ... .....M.....M.vj........A.@.
.W...?HE.Q..,.}....{......yIH...5.m..H.w.t.I..}...gB.s)R4>z......Mk
.f.O.j..:#........K.dII.G..d%......d.5.m.$.-.iD......O?..=..R.U.Mu....
.N..J.n.*.A..}2.m.b..yX.......yrd$.sN..W{..T...iJ*.u.O.......CM<~t,
.X..o.EV.-..L.d..I...oR...0.n$t8..K....<.T[P.d..8......I.o1$...D0..
yGI.]........aR..i......?..c....{..;Y..w...z.o..m.S.T..i....z...i...H-
.....c.S..QW.E....y..).L..(8.F>[email protected].}.a*..t....M..\%...OO.j
2m..h....ou#...x&.vZ.E........-.)......=.Y.F.=.:..4....N._Z..2TD.Z.T v
.......]..,.fGCs...J.v<e...^B..b2.()'...../.]..K.^@.q.P.......2
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_132:

.text
`.rdata
@.data
.rsrc
t%SVh
t$(SSh
~%UVW
u$SShe
DNFchinas.exe
910106473
smtp.qq.com
%System%\drivers\etc\hosts
127.0.0.1 hXXps://password.qq.com
127.0.0.1 hXXp://aq.qq.com
%Program Files%\1.scr
explorer.exe hXXp://gamesafe.qq.com/cgi-bin/cltverify/cltverify
\TNE\TMfwwd.dat
DNdssaf.dll
%System%\
explorer.exe hXXp://gamesafe.qq.com/
&qqpassword=
explorer.exe hXXp://dl_dir.qq.com/invc/qqdoctor/qqdoctorsetup/QQDoctor_Setup_v3.2.exe
Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskmgr
explorer.exe hXXp://down.qq.com/iedsafe/QQGameProtect/QQGameProtectBin.zip
q.cd6
.eiT@a,
5.xA2
Y%D?Y0`
=.RD"
!%sn%
tV.EB%-6Y{
ú9V
F;p%U
jc.CB
g.NX0V
Ë} 
#-4$.4%/6#,4" 2%/6%/6$.4%/5
(0'29",2! 2
&.! 2",2'29
(0%/5$.4%/6%/6" 2#,4%/6$.4#-4
)-5 .5%)0'*1 #(!&, %- %,
%$(.$',"% !%,
!((,225=( 2&,6
% /6( 2"&,
%$(..18&*0#'. %, $ ( 2
$', 07( 0
!).28,/7
!)#'..1748@
)-5&*0#'.
!)&*/!%,
!)$(/ $ 
!)%(.$'-( 1
)-5!%,!%,
#-3$.4 %/
!)&)2&*3
#-3$.4 %/' 2
#,!$  /8"% %)/%(/&*2
'-2:26=&)/
# !&-%)0&)1#'/$)1!%-"&-*.6"&,
!!&. $ "&-
&' 4,09"&-
#-3$.4 %/,08 /9 &.
&/ (1",2
(/",2 (1
&/ (1 )/_
!)$(0&)0
" #'/"&.' 3/3<#'/
!),09!%-
%$(0-1:),3-09-09&*0
')0"'-#%,#& 
&"&/04=-1:*.7 09!&.
#%)2#'0$(048@ 07
" ,08#&.04=(,5
#*( 3"&-)-6 08( 3
" #& ' 2%(.05=
)/%/4!)1
'-!)1 3;!)1 3;
'-!)1!)1 3;" 1
)/ 3;!)1 3;!)1
'-!)1%/4
"*2!&0,08
$.).6 09-2;)-6$(1&*4
# 15>*/8 $.
!)%*3 09"&/
'/!)1",2 (0
'/%-4%-4
%-4 )/ (0%-5
&, (0",2!)1
'/%-4 )/
!  .6& 2
(0",2!)1
&,%-4 )/ (0%-5
'/%-5 (0
15?).6!%/%*3
",2#-2(08!(1 (1 (1%/4 3;
 4<,1<16? $,
)!&/$)1!&.
!)$)2' 4).9 %.!&/
#)*.4,06#)1#%-%'0
",2#-2(08!(1 (1 (1%/4
 4<,1< %-
*4<*5<'29/9@-7?)4<&18
&18
$*5=-8?'08
*4<*5<'29/9@-7?)4<&18)5='29
&18
)5=
-1;*0;#(0' 6#)3
*4<*5<'29/9@-7?)4<&18)5=
(3;-8@(3;(2:'29#.5#.5
*5=*5=
*5=*4>
#.5#.5'29(2:(3;-8@(3;}
(3;-8@(3;(2:'29#.5#.5&18*6>
*5=*5=#.5
!,3&18#.5
#.5'29(2:(3;-8@(3;}
(&)1%)0,/7$'-
\v}UmuWpxTnuRltVowVovSjqTlsRgqQgoRirPgnMaiJ`gG^eD\b?V]9NV5KR0FM/CJ/BI0EK2HN1FL4JP3JP2HN2HO5KR:RZ>W_=T\AYaF_hOirI`g
(3;-8@(3;(2:'29#.5#.5&18
*5=*5=
'29(2:(3;-8@(3;}
"*5=
"%,8@ 7?*6>
 $-04>!%-,1:
$, 09 09"'1
,8@*6> 7?
 $-,1;(,5*.7#(0
!(#'/!# 
_t{\qxUjpL`fEV\@QW:IQ8GM6FL4BH3AH5CH7EK:HN=LPAPUEV\CV\?RY7JQ/CK.CJ-AH0DK1GM2HN3HO6KS8OV=T[@YaHajKdlNgpVqzXszBU[
% %/.4>.3;*/8)-6 /9%)1 09 09
#&*4>,8@
 $-& 5%)3*.7*.6!%. /8/4>$)2(-6
"%,8@ 7?
).8,08)5=
YnuI\c?QX9NT7MT8MT;PW?T[=S[<RZ;QY7LS6LR2GM-AG(9@$39 .4!.3&15.8<7CG=KP<LR6JO/DJ.AH-AH1CK5JP:QX=U\?V^G_hMgoSmtSnuZt{d}
((,5' 2"'/
#-%*4"&/
# ,08)5=
"*!&0$)2!%-
" $- %.& 6(,4,08)5=
#&*6>
'2; )2'2;$07
"* /8.3<,08)5=
#,#'/%)0' 2/3:'2;
&-2<%)2).8*.6
!(#'105?#(1
").2</4=
" "&.15?)-5&)1
%*,3#'. 09'*105?$)2
"%#/7 6@#/7 6@
" )-526=).8
$!&. /7 09
#$)1#&.',5).7.3=
!*#(0,0:
$-!&/.2;%)1 /8,09' 4,1:' 3*/7$)2-2<(,3
" #'016?
$,27@' 2
!)$(1%)1
$ 8@(4?)"/6
'#(0& 4/4<-19.2:*.5
"!%,#&/(-616>26?/4=$)2 $  /7
")"&-'*227?%*3
)5> 8@(4?)"/6
")' 3-1804=
")#'0#(0
!**.6*/7%*3
#'.*.6' 4 # 
!*' 3/4=#'/"&.%)1
&$(/!&.),404;' 2
")"&.05>%)0
(*.7!%,(-6*-5)-4
&*2)-6 $,
#'*0&)/',404;%(0 #*
!("&-'*026=
!)%)2"&.
#*15=-19!$ 
'(-5$(/%)1
%((3>)7@
& #*0)4:(17(18(3:)5=)5<'19'2:"-2 */
!'$(/26>
"' #*!%, $ 
& $ (,3%)0
%u6G~<M
"(#& ),3*-4'*/ .4
")"%,26=
"'$(0"&-
"lL-9B
!(#% ,/5),4
#*$', #*
!( #)-18
*.5$&,$&,
$'*1( 2*.4
#'&/6$,2
#("$)#&,
#' (-")0
& $-4'18(17
&)/) 1!$*
%*)29*4;'18%/5#,2!(- ',
"%-3(28'05$-2")/!)-# 1").!(,
#$/46,03#&'#( ,2518=/8<)04&,0'-1'-2)05(/4(/5(/4!'*
!#%,2'/4#,1# 0
',/06:*/2$(*& .(-1&,0(-1*04*04%,0"(*
$($ 0"(-
"&!' $*.
!#*/(06-6<!(,
 3!.6!-6  4
!%*-(-0$( & .)/3,37(.2
,5 -6 -6 -6!-6 -6 .6!.6"/8!/8!.7!/8!/7!.7!/8!-6 -6!.7
,4!.6 -6
 4 ,5 -6 ,5
,5 -6 -6
 4 ,6!-6!/7!/8!/7!.6!/8!/7 -6
,5 -6 -6 -6
 3 -6 -6 ,5 ,6
 4!-6!.6!-6!-6"/8!-6!.6!.7 ,4 ,5"/8!/7!-6!-7!/9!.8!.7
 4 -6 ,6
 5 ,5 -6
 5 -6!.8!-7
,6!.7 -7
!&"(/#*1
!'!(0&-4")/!(-
% #-3$-5!)0!)1 (0!*1!)1
(.!)1#,4" 2
(/!)1 )0
(/!*1$/4$/5$/5'29#-4#-2"-2
$ #-4",3!*1
&.",4!)0!*2
'/!)1" 3
'/" 2" 2"*2" 2!)1
"'&/4&07%.4")/$-3!(-$-4"*0"*1'0:'0:%/8")3$-7" 4
") (1!(1 (0
"'# 2$-6!(2!)2&/9!)2!(0# 5$,7!)2
'0# 6!(2
#*6$*6")3
$.!&2&.;!'2
"  &0$*7$*7
#,"*5 &0
#.!&1!'0
$,"(3&.:%,8&.;'/<$*6"(4 $.
#, &/ (0
%,!)2!(1
$. '/ '/
") &.$ 2$,4%.5!(/"(0"(0!(0 '.
!%'%)-',1$ -
&,$.6$.8'1<&09&1;#,5
#, &2!(3
$."*6$*6 &0
-Oh%C[
&3$AZ$AZ.Kd'8G-E[4Wv8`
$..GY;_z$5F4QjO
.EUn%9L/Mh:b
4Xt$=T!2@)>L1Oi3Tr&=T.Kc6Yu)E]
3J.Rr
.Ux(Ln Kf%;N
%0.ET
%;Lœ
.Tl*Mg$B_I
9``&@@&@@
1K^$6B&7BAZm7Pd$;K(=JŒ_
2>2I\Fa{0@J5JX2K].DV3GY;SfJB[oW|
 7 1?0I\9Xp2Pi-Ja FY(>N6RjV
.Vv-Lk
'.&09&.7&.6'/7'-4
#'!',&-2'-2&,1
"*1#*0")/$)/!'- '."(0#',$).)16,6<*29&-3 38,6<"*.
$(%/5$-4
(,$/4&08#)/
%*",3 ).").(28)4; ).
'  )- *0
!%#)/!&  &,
$) *0 (/
$( *0 */
)0"(.!(.$,1-6= &,
$*'/6,4<,4;,39/6;*05%.5
#'",2$05 )-
!(.#-2&17# 1 & ",0"-4!,1
#)(/4&,2
% %,3'/7"*0
$) $)!$ *3;.9@-6= 39 2:.6=$)/
#-! 4'19 (-
'-(/7,2:.4; 27,27.8@#,3 *2  2
&K%Ds
;n%Dw Q
).MnNy
)H{-J}3S
0[%Ft ;a.P}
&1$0>#.=
IEC hXXp://VVV.iec.ch
.IEC 61966-2.1 Default RGB colour space - sRGB
CRT curv
(7),01444
'9=82<.342
Lf%Ur
}~~}}}}~~}}~}~~}}~}}~}~~}~~}}~}~~~~
}~~}~~~~
! )-*8>$/5"-3
'*#.3'3:*7>(49(4;#-3'29'27 (-
$*",2
$*#.4! 1 (/!)0
!'! 2! 1
$(  1$07
!%#.5! 2
"$06  1!,2"-3
#(! 2$06
)- )/"-4(4:
%)%/4 ) 
'*#.3(5<(4;$/5
$)#.4 */
$'#,1)5;,9@ 9?(4:
"&#-2$.4&17(39#,1$.3
','19%.3
%*!)/#,3#-3
"&"-3 *0
(-! 1
!%!,2$07
!& */ (/#)1% 2#(-
)3Œ*?J*=I*=H$7B#5>"3<-@K':D#6@
*3$3=#3<
(1!/8 /7
%)! 0 ).
$)#.4#.4
(," 0'29&26"-0#-2
%)"-4"-3 ).
#'!,2  1
(.$/6
'.$*0!& "',&/6'08#.4(2:)17$(.%*/
(1#2<$1; /7
%- /7 ,3
#'$/6#,2
).$07
)-! 0! 0"-1
''',--/00
oDþ-`E2XF9PG@IHGFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHI
023=>?9;<
012345012
9:;<>>,./
012<>>9:;
<>><>>,./
9;;=>>022
'(( ,,-//=>>9;;
YZZQSSHJJ
,..344011
)  577577
244899244
;==;==,--
)  577;==>@@244
,--577899
/00133=??=??/00
 ,,=??:<<
133799466
 ,, ,, ,,
/00133799/00
899<>>:<<:<<>@@:<<
344344566
133.// ,,
022-//022
688466466688
"$'.FHH248
"%'.ACD369
%#&/'*0#&.
688=??:;;
=??688355
:;;=??688
*  011011*  
*  011-..-..
355=??=??
*  011688
-..011-..
,..344677
344/00,..,..&''
,../00,..
)**,../00344
3449::9::
344/00)**
677677,..
)**/00/00)**
344<>>344
677677677
,..677344
677677)**
)**/00/00/00)**
,..9::9::<>><>>
,../00)**
)**/00,..
<>>677,..
,..677<>>
,..9::<>>
344<>><>>344
<>><>>677
,../00344/00
<>>677)**
&'')**)**,..)**
&'',../00,..
,--/00,--
8::>@@;==;==;==233
233>@@>@@566(**
8::>@@8::
(**/00(**
233;==566
566566/00/00/00(**
,--566>@@
/008::8::
>@@566(**
(**/00566;==566/00/00,--
&&&,--/00/00/00566566
;==>@@233
233;==233
,--/00/00
>@@566/00/00/00,--
#'&28&27
&*$.5&19"*0
%( )-(5;
&,$06
$*! 3",4
& !-3 ,1
!%!,2$18 ,3
#)" 2!*/!(-"*1 ).
.>I(:F <F:Tc>av.ET.GU1HU;[k7N]&6?
--4>&*3!#*&)0$(0"$*%(0"$ 
$(!)/)4;&39!).%,1'16(4;(4;
#&$.3  /  0
(.)#06 *1
'-  1 ,2
&*$.4$/4'38*6;*6;
&.! 2",2
&.'29%/6)29! 2.7>'28
(0%/5" 2#,4%/6$.4#-4
!&",1$/6"-3#-3!*/#/5 */
(8A.CP*<G->I5Uh/IZ0K[1EQ3M\@^q$4> /9)?K!1:*<E ?K/DR"19!1; -6.FU>]p(:E
,5%3=!/:
(6=.DS
-' 4*0:' 4#&.
%!#*"#*##)$&,"#)$&-"&-$(.$'-##*$&,& 2$&-',3,5;#',
#'*19 #)',3
',$/7 *0
&**7>$/5"-1! .
"&$). 3:
.71GW*@L*?K ?J!3?*=I$7A0EP >J"4?.BN-@M'9E(:E!2<$6@
-"$ ).6 2<!$,$&.(*3*-5-4<-19
$)&*1 .6&*1#'-(-3*08'07(06'/5&-3"% 
!&$.5(6= ).
%*#,1'39(28$.2#,2
$! 1)3:*28!&*
%*",3#*0#(-(/7
/80FQ >K!3<Œ1FT'9E"2; 0;!1;#2<)=G
'1"0;$2;
%- -6!.6
-$&,"#*(-4$'-"#)),3' 1%).*-5')1(,3(/6'.5%*0&*0&)/
$)29#(.!%*'-3'06!&*
#*5<!*0%/6*9@$/4)6;"*/&.5*6='38#-2$-3
'- 3;" 1
'-!)1 3;" 1
"*2'16(4:(4: )/
( #,1 &,
%*$06
&,")- ' 
#(&.4)06%*1
;[m*;GDd{5Qb/CP"4=>^s<Yk(8B'6?Bcv.BN#3<6P`"1:)=I-EQ .6!2<
(1!1;&5?
)2!/8"2;
-/5>#&-#%,$% &)0*.5',3$)0(,2*/7',4*08%*2',3&,4!% #(-(27
#,1%.5#,1
&, )/%-4
'/%-5 (0 )/%-4
&,%-5 (0
&, (0%-5
'/",2!)1
#(&.5 &,'08 &-
#&)06(.5
.FT6Sd=Yk6Qc3K[2L[@at):E$4>%4>2JY,CO,>J):D
,40FR9Ra$1:"3<!/91KZ8Sf%4? /9.CP(=G)=I >J
/9':E ?J'8D$6@|
-6#1: /8
.7"1;!/9
%  .5"1:"19!/8
$($).&,2#(/
'-%/4 3;
&.%/4 3;
'- 3;%/4
& "-4" 2
(-(7> *0$17! 0"*.'/4'.6&.5%.4&.7%.6
& "*/*4:*18
,33IU;Te.AN|$2<.GW5Pa&4@!0:0ES)<Hj&9C
-6!09"2;
,5 /8$4>#3<
'/ -6"17
&*!*0" 0*8?(5=
&* (,'3:#-3$.4" 0
',$07#/4
!$ &*#,2!*0")/'-3 38
(6@:[p @O3K[=\n6P_"/8'9D-?J;Xi <G8Sc3GU
#&)/'-3 $)
)5=
!*.%/4&05#.5$/5&16'17&29'29$-2
##.5*5=*5=
!$#.5(2;
!,3&18
*3 .6!0: /7!/8&6>
"#9EŸ
&18!,3"-4
*5=#.5(2;
"-0 *.
 7?*6>,8@
#' (-$17
-4$3=)=H1GT)>J.BO$7A!3>-@L-BN$7@$7@);F
-/4<*,5 -5 ,405>-2:#%,!#)' 2')1(,3)/6' 2( 3$(/
$(',3*18 29,29)/5)17 4;#(,!' # 0&.4!&*
*6> 7?
&, *0)5=
$)" 0",1
#&#,0)6;"-1 ',
"&"*/ % 
#(#' (05% 1$*/&-3
(-%-3',1)17
9Wi%5?:Tc8Qb&6@'<H&:G.ER -4)<G/DP/CP0EQ2Qa&4>';G ?K
'//BO&7?4Oa5Qb&6?#3<)<I.CN5LY
*3!2=!0:"2<!08 .7#2>
#&-2 28&,2"(/#(,)5=
)5=#-4#.4
',*8@*8?)6<&27'2;
"'!(.$/6
%)!(-!*.
&," 2'/6'.3'.3
07#2<!09"2<
 2$4<#2;
 4%4>"1:
#(.4&*0'-3)08!& '2;
'2;(3:*5<'28$,2 (.
9Ug=\p*<H9Zl5N]!/8 @L(;G'[email protected]
 4 /8"2:&6@ .9
*3"/:#2<
,9@(48'27 7=%.5%/4'38'38'38#.2
$* (." 2!)0
%)#,2!',
,4.ET3JY!195N_'8D!07*=H#3<4Pa*@M
(0':E"5?!4>!2;‹.CN&6A,@M 09"4='7@#4@$3?);G"5> -7$5@
(/"1;"1:%5? .9
"&*7@(5=
$.5"-3
*6? */ */
"'!'  #&
)9A)=HA_p2GVFew3HU%5>#4>#2;.DQ*<F$6A/GU1GU .7/FT,AOž&:D /80L] ?I
(1 3;#6@
,5 /7#3= .6
.7 /8 /7
%)&-5,5= 6<-6>-4?(.6)/6*07%(."',#).(17%,2 %*
!' "'*6?
*/ ).!*0
)0#/7!,2
$( %*%.3%-3!(.
!&").(.4$' 
,4#08)>J ?J.HW%3<):D
$(*4:,6?%-3$-4" 2&/6$,2
"&$,1)06&*/
)0!.8!/9
& '4:!,1#.4$/5
).".4!,1
"lL0<D%2;(6?-9B-9B2@G.;C 7B
.8.BN;Vg2LZ*=H
*3#3<#5>
.7!1; /8$4=
*2 .7!/:
-,3;-2;"!'""(,1: /7''/'*1*/7(,4&(. $(!%)%',' 1' 3 "("% %*0 19(-5 #) #) 29 08#'-"& '.4).4"&  8@
"lL-9B(6?-9B0>F 7B.;B 8A6CL-9B(6?%2;0<D6CL.;B 7B.;B 7B.;C2@G-9B-9B(6?%2;0<D6CL 8A0=E1>F0>E
"%",1$/4 8@'17
# &) 39 #'
,6$4>"2<$5?%5?
-%(/)-5,08$% "#)
%$%  "'!#)"%*
#* $)"& "& $,2)4: %)
&)$07! 2 */
' #-1%.3'4<*8@
,5.DP6Rf-DP3O`8Sa
-5l!3="4?%4?&6A(9E%5@(:E#4>j
#',3)19"(-
"'!#)( 3#'.
$)# 0!' *4:"(.
!$#(-&-2!&* $),6< $(
#('4<*8@
"'#-5#,3
(/!*1",3%/6#-4!*1
- 1:%(/$%, 08,1;%'- !&$'-' 1
"'#'-)07 5<'/5"',#).
#& & (06)07#*/
*1  2  2
 3.CQ>Zl2DP1KZ/DR -6
%- ;E6Qa <E.FS(=I
'0&7@ 1:"4<
-#$*'*2"$*(,3"#) 07(-3
)18$,1!' &.4'07!&*!& #*/'/6#*/
%*"(.&,3$ 1
)0$19! 1
'  *0!,2
",0(2:'2;'3:)5<&09$/9
-5$09 .7$3=
-),3*,4(*2(*1#$*( 2#%*"&**39$'-
#('07"' 
$(&.3#).
$(%,2'06!',!',$,0&.3$*0 %)
# % $,3#)/!&,#,3!)0&29%/5$ 1 3:.9@#-2!,2
#(%3:&2:  3
##/6#-3#,1!-0
(-*7=&18
& *3!,6  5!-7
'#-;%/<"-8%0;'3?"-7
&8B*=J.CR#5@$19 ?L BP#193O^(8@
)1!.7"1;%5?"2<$3=
- /7&&-&$-*-6(,3 2; /7&)0)-5,19
#!& !', & $,0&/4*4;,7>$ 0
"''/4(17)28
(,$.4"*.
&*&29! 0
(/ *1"-3
'.",3 )0
&-"-5"-5
"*#-5'19'3<'3<(3;! 2
*0#.7#.6"-2!,2
$*&2:&2:
"(!)/$ 3
"2<-AO,@N .8%5=5Tg(7A';E:Ud
%-#2:$2<
-*.8()3$" * 3#$,',4 3;)-5$%,#$)
!!%*#*.!& "*/'05 %*
#' $)!& 
$07*7@#-5!)/
&-#-4&19
' )5=)6='16$-4
&0")3 '/
"2<'<H.CO':G#4> .54Oa/GV"29=[o%6>
 5$5? /:
)0!/7"1;!/8
$()2.2<$#*(*2( 3%*0%(.'(0( 2'*1%(/& 1$).$).' 1
"&',1%). "&$(-*28-4<,28-49
$'!*/)6<$/4!-3
%/5 5<(17&05",0
(,$18$06! /
'0$/9#0:
)0%/9%-8!'0#*3(5?! 3".6#-7%-6&-5$,4
-5!2;#4?$5> 0:
&3:&28#-2#-2(5;
&,'28*9?(29)5=
,4!08 .7%4?
!( .5!08
&)"*.#,2#.3&19!*.!*0
(-  1" 0!).&06*6<!)/
)/$.6'09"(/$)0
 4$6@$4>
)1.FT
& !*0!*0
&  */! 3&08)5;(4:(16)28
 7> 8>" 0
%5>*<G'6@(9B'9B.CN/CS-?J
(1!2<$5@
-7!0:!0:
.4 08!.8'5@
(1!1:!2>!0:"3=
"'$*0,5<)05'-4(/6
" & )49!)-
#/4#/6  1
/8|
&-$2<%3<!18
'/ -4#2:
-/5=-2:).5/8@/8@-3;*07*07&,2
$(&28%/3$-3)6<'3:
&,"*/$/2" 1#.3
#'"',$).
&;F0EQ4O_2IW AN%:I/ER|(:E 1<'9C*@M.DT"4A
 3.CS*>I
-'*1'*0!#'
#'*0/6<08>"& !$)#&,!%*#(-'-2#( 
"'#'-/5=$).
'*!*/ )/" 2$*0'27$.3
')&15)6<",0
.DP4JX0HX3JX4IW-CQ0DQŸ*>L!3?$6C"3A*>N
&-#4>$3>%5?
-#%-( 4"#*
$-4!)-# /%/3",1" /'05'04&05! .  .#,2
&)$/5#.3
%.!2=}
[email protected]@)36 ) 
$(!,1"*/
#&!,1#.4'3:" 1
"(!(/!,1
%**8@*7>'28" 0
%*"-2 )-
&((39%-2
!(08# 0",1%/4
)2 0;!2=$4@
%)*5=-9?(17$,1&/3 5:
!'#)/$*1$ 1
',#/5&18",1$-2,7>&/5*3:'27$.2!(,
,6=-8>$,1
&)#/4 *0
%) *0$-3'06,7=
-.3;-19),3*-5'*/ 06/5=*/6$% "#* %%',' 0$',&*/*/6 "&
#"(-$ 1 %)
%#,1# /$.4# 2 ).
 5=-8?! 1
"'$*/$).$(,%).%)0$)/&,2%*1%,1%*/$*/& 0
!$$)/"',
#&%,1#*/!(,!& '.4*39
' )5<# 1"*0'2:
'-")/$*0#(.
#'"&*!$("',&.4$,2
##).'07#).$ 0%-3#)/%-2
"%$,1%-2'.4%,2
%) '-#,3%/5
!'",2",3!,2#.5# 2 %*
-&,4$).% 1
!%',2 18#(-
#'#).%*/"(,%,2&-3)28#*/
"$,1 %)!&*"(-$*1"*0
%(!*/" 1$.4
&, '-&/4(06)38&15,7= 4<*29,6< 6<'28
-)09)/7%,3# 1"',(.5',2 #'"$(%,1 %)
!%"(-$*/ %)
#'$,2!&*
!&!(/&.5)4;
!&"*0"*0
&.4,8?'17 (,
"($,3! 1
!& (-!*0&27%/4%,1)38 9?(49%-5
"'!).#-2
!'#)0%-3
-&)0' 2#&,'-5"&,#).#*/#).$)/!&*
!#(-'/4$*/!%*#).'06 $)(18!(,
#)# 1%.5"*0
'5.TxM
$,4&18(2:"*/
$* *2
'/$(."& 
!$"' %-2!&*
!%%,1-8@!&*$,1
!%!&* $(
!"*0&/6#(-
'.!)0!*1
$&/3)3:" 0
.7?'06 *0
"( #) #(
$) $)$(/
!&!2; 0<
#& $("' 
!%& 1$).
"'&-4$)0"%*
& #-2 */
-3:.6>(2;"*0
$("*/ )/%-4 (.
!"#((,2).4%*0
"%"%*!$(!$)#& $(-%)/' 1"%*"% (,2%(-#%*
18@-5<,5> 6=!(-
&!(.'/7")/
"' &, (-(3:#*1
#'"*0 */
$'#',!& 
(.$ 1#%*$(/
$(&05' 1!#'!%*# 1
$( '-%*1)-3*.6
"'"/8$3=
&)/).4$',
#'$.4&08
' #,3*3:-49*/4&,1.8>,5;)05*39)07*/617?
-4"/7"29
(-#-2$-3$.2!).
',!*/",0
# 0)6<'16%/3  2"-4
'.5'/5 6=)39$*0$ 0(26# 0-7>(17&-2'05%-2
%*!&*%-1")-&.3,6<,7<)27
%)*5<&/6!(-
% "*0)4<
%*%-2%)/!"(%)/ 4<$*1&18(2: 18,18,/7
' &.5,5< 5<(1:
! (.&07$ 3
$(#&, #)
"'!(.'08!).#,4$ 1 "&
-.2:*,5( 4 "*%'0).9$'2 )&&.),2"&,!% %)0 07(*/##'*.4%'-( 1' 0&*0% 1'*1')-,18 "'%*0#'-"' 
" ' # 2!(.$.4" 0
#( )/%.5(18(3;&/5 (-!),(16(17 ',
-()0  4''1%(2
)#&0#&/! ("" &'0
%%'0')1$$)$$*( 2""().5!& 
"$',(.4%-3
"'#*0# 1
"& '-%.5(3:
!%!*2$-4# 0$-2$/3
$*"'.$-4
%*!*1%,3*08*18&,1$*/$ 1!(.
%( %)',2,/7
!&#%*%(.%)/
$('-3*29% 2
"%  1"-4
&  *0"-2
&,&2;*5<)27,5;-9@)4;(06%.6#*2&-7*5?%2:
(,# 0#,1%-3#*/"(.$.4!).$,3!(-
& "*1%-1
%)# 1$-4#*0'17,9@%/4
$.4$/4&17(39
$.".9"/8
(,#,1)5;)28
(/!-2!-2
"'&/7")/
!& &*$-2%/4 ',
%)#-0$-3# 1"*0
#&'38"(,#,4)39&05%.5&-5&/7# 1
$)# 2$,4
$*! 2$-7"*3
%*$/5! 1
$ !)/!&-
& (08'09!*2
$ " 2 $*!'/
#'&/4-7>
%, *2 *0
'-!*1(19$,2
'-(19$-4
!"(1'/8#)1'-6*2:&-4  3
#)"(0"%,!$,
#$ 1'.4!$)
$",3# 3#,3$.6!)0
"()5?%.5(39'07
%, '.  1
& '/)2='.9).7 3>,5=$/7
#)!'/"(.
&&)/.7?'-3
"'$*1 ',*5=*3;)07(07&-5")0'/5&-3*18(28# /$,2&/3# 2
$* $)!&,
% #(% 1)08% 2 #)
&.3%,2 &*&.5!*2(19&.6&,4'18$,4%-5
%*")/&09%/7!).$,2!(/ %,
-$',)-5(,4"' 
#("*0 $ 
$"&, #)!$*
%* */!*0!*0#-4!*1
$(",3!'- %)(27$ 1"'-
"& *3",5
$, &-" 2 '.# 4
%*")1# 1
(,#,1 */
!%! 0!*0
"/5!,4 ,3
*1",1(07%)0 3;-4=-3<%*0
!' )/#,4$.5#,3
#)&,3&-3#(/
!%!',!'. )0
&,! 0! 0
#",2!*0 )/
&,#/5$.5!*1
$-!)2%,7%,4
"&!(. %* &,
%*")0!'-$.4
!%'-3%-4%-4").
$ 0%-3",3 */
(.!-3 *0
$(",2 (,
#*/)07.8>(.3)3:
$)%,3'.5
& 2' 3!&-
!'-4-4<.7=*18)18$ 1# 0!(.
(."*1$05
&-$-6"'-
$(!)0 (0!(0%,5 %-
$ !(2")3
" &*(18# 2
$* '/&.8,5<(-4*.6) 115<16=*-4(,4)07
"*1&/5)26).5,4<08?,3:)06$ //6>%)0%,2 3;&-5%-5
%*%-5$.4 (.
"'%2:#.4
'-# 3"*1)39,6>*29,4<(/6*18'-4#' &,1,5>,3;)28)29
""(-%,2!' ",1
%*#.4"-2
$,)2>)0:)0;%,5
&*!)/! 2
&  )/ '. &,"'.$*1)29-8@)18%*/*28'-3(/6)18'.4 4; 4:'/3"'-
#(!&*&/4,8?,8@"-1 *.! 0
%," 4  0
)-&38! 0
$&)3:&.3'/5&,3
*- )-! 0# 0"*/$,1$*.-6=&.3$ 0&-3"',"',%,3)/6-5< 29#)/
$*%.4&04$/2&16$-3"*0
% 3< 1:.4=18? 06"(,
%*!)0&,3"& &,2.7>-6;'.2(.3)27"(-
&")0*2:,5;'.2#( *28*3:&-3,4;.7=&-2 %* ' $,1)3;!&-
(.!(.(38#/9
!$",1",1
(-&,4,3;-2:'*1$&-%*1 %)
!(,*3:)39 (,
& $.4%.2$*.*2:.6='-3$)-&*//7?-6; 39'-5%*0 5=%,2'/6&.7 '/ &-
'0#.5" 1
# !'. %)
!$$/4!(.)/7-6=-7>/8@*39/9@,5<(/4*17(.5 &)# 0,8@ 7?&29 */
).#-5&18
"&!&,&.4$,0$ 0(08(.6#(.& 2*18& 0
$#(-!%**4:$ 2
"'"(-'06#,2
& #)0*/7-5=-5<(-4'-3-4:&,0$*/ ' # 1
&*! 0 )0
! 1#,3 4:$ 0 (-
#(0(-5&*0(,3-4;)05'-4,3<(.3#(- &*
"'"(-&/4'06 % 
"!)1#,5"-3#-5
& " 4'2;(1: 28,49).5'.5#,4
%-"(/!$)
#)#)1%*1&/6
$'!)0" 1
$ " 2" 2
&-$-5!'-!&*%-2$,3 '*&.4$*/$ /!' %,2-5<.6>(17,5=',2!$)
"'$)0 3:,28,3:' 4$(0$)1#*0!(,
$('07(18%/6 )/
!' !( !(
"(!$*"% #%,#%-"%-!%-
")!$,"%."%.!#,
$. (2!(2
&0 '2 '2 '2 &2
'2 '2 '2 '2 (3 &1 '2!(3!)4!(4
&0 '2"*5")4")4!(4 '2
%0 &2")4")5!(2!(2 &1
%/ &1 &1
$. &1$*4$ 6#)4#*5
%/ '2 '2 &1
%/ '2#)4!(3
- (2!(3!(4!(4!(4 '3 '3 '3 (3 (3 (3
&1 &2 &2 &2 '3 '3 '3 '3 '2 '2 &2
&1 '2 '2 '2 '2
&2 &2 &1 &1 &0
&1 &2 &2 '2 '2 '2 '2
'.5'/5 6=
 4;.9?(16
(,# 0#,1
!',*4;$*0
'/&.8,5<(-4*.6) 115<16=*-4(,4)07
-462:= 03)--%(&!!!
%*)% *%  '-.
#%"',*#%!!
-/ 140, %  ,7;8250030% -
4529;967456213.)(#&$
%&#&(%"$!
.EU"5F>]v/=E
PPHID;IGARWWZhoV``JKGHB6NL@UYWV]^LKFRVRYaaNQND@3D=.X`b^lsKJA?4%U[W`os[hkTXUIH>MF:Zba_ntV\\TRILH9TTJcotbr{KH>UUNGD<=8/ORO^r{XdjJNMED;KH>MOL^oyW`d<5*73 ^q}OUTIH?OPIORMB?7=7.B>6OTR[kq_r{ZgmPWYEIG@B>CC=CD?CGEKX_RhwSl
<6.IE:0
<70761 6=
?<5>?:(16
:8/.,&! 2
52(42,#,1
61(::6$*0
3,$653")/
[email protected]
.0 22-'"
25100 &!
/.)686(!
&&$ -, ,(%$
*(#1.)1. 00-
 )&)(#  $ *#%!
,-()(!--).. 
(./.7:)--
)' )'! *$--)12-12-$!
./*,-(),'-0-*-*
!" $$!$#"%#"%%$'&(**(* $&(
! ( ,,/025757:7;?
#$"(..(,,%'%$'$$&$$'$ "
'**"# %'%(-,(*)')( -.*  -21&&$&%#011.11.11 --
-/..11 01).-#%$ !
%'&(,, 11)..%%%
)..*.-$%#)--'*)!$#"%$$((#'' #$
)-1),2$',
$&"),$,. ''
#% &(!')%*-
!*/315:28;.26-26(,0',/%)-
$)-& 0(13 &'
hXXp://dnf.qq.com/client/include_page090326.shtml
$3@$3@$3@$3@
)()542>=
0;:(42$0.)54
'32.:9,86
Hfx.AM
'%S_^9DC8CBFPNHSQ;GE'103>>;GE%1/DON
 ) 65'32ALL.:9HSQ'324??4??8CB2>==HGHRP$0.JUS=HG>JHHRP*65!- 
)('320;:$0.#.-
&$R_]:FD:FDHSQLXV:FD6B@3?>
 ).:8HSQ-972>=".,(42>KI".,<HF1><FQO<HFMYW*647CA2>=".,MYW?KJ,861><1=;Ta_6B@ITR$0.8DBCNM$0.BML4@?#/-/;9?KJ%1/KWU".,1=;1><
;GEFQO3?>1><%1/AML/;92>=4@?@LK1=;$0.3?>1><%1/AML/;92>=4@?@LK1=;$0.HSQ'21:FD2>=%1/6B@KWUBML ,*KVTJUS@LK4@?1=;=IGDONHSQ'325A?;GEFQO3?>1><%1/AML/;92>=4@?@LK1=;$0.>JH ,*AML
%#4@?-970<:/;9
 )2>=.:8
'%4@?".,4@?$0.CNM#/-JUS".,5A?GRP(420<:MZX?KJ#/-/;93?>
#.-'32 ,*3>>)545A?FQO'32(42DON0<:5A?KVT=IG5A?2>=)53>KI#/-1=;8DB*645A?KVT 751=;HSQKVT/;9&101=;9EC?KJ.:89EC*648DB)537CA*64$0.HSQ@LK0<:6B@BML'32@LK4@?)539EC=IGWdbCNM
,*,86'21
'32GRP3?>$0.BML9ECKWU-97>KI
'32GRP3?>$0.BML:FDMYW@LK!- Q^\
'32GRP3?>$0.BMLO\Z;GE6B@:FDBML
'|A
'%(423>>
_Q.UH)4(
'|AMZX(42 ,* ,*-97>KI<HF".,/;97CAMZX(42 ,* ,*-97>KI<HF".,/;9!- 4@? 751=; ,*/;9O\Z5A?BML6B@FQO
 )4@?*64 75<HFN[Y5A?5A?7CA;GEAML#/-ITREPNKWU$0.KVT".,-97MZXMYW 75ITREPNKWU$0.KVT".,-97MZXMYW 75;GEMYW!- 2>=
$")536B@:FDP][/;9 75>KI>JH.:88DB,86EPN=IG'213?>$0.BML=IG8DB@LKEPN%1/5A?
'%Ub`R_]-97:FD=HG
'|A@LK:FD%1/:FD%1/1=;
('$0.$0.4@?".,
'%HSQLXV9ECBML(424@?EPN'219EC)53-97%1/9EC9EC!- 2>=Ub`)53 751><(42KVT>KI
('3?>%1/
ITRJUS@LKLXVGRP=IG?KJLXV*646B@HSQBML@LKLXVGRP=IG?KJLXV*646B@HSQBML3?>$0.AMLCNM
S`^BMLITR$0.3?>>JH2>=P][GRPAML=IG3?>ITR$0.3?>>JH2>=P][GRPAML=IG3?>7CAKVTBML$0.BML2>=8DB@LK<HFQ^\JUS>KIKVT0<:*64
*(%1/,86
 ),861=;
(''21'32
$"2>=/;9*64R_]$0.GRP:FD9EC'21#.-=HG)54CNM%1/>KI
 )%1/ 75
$"4@?'21
,86(423?>AML%1/*64HSQLXV3?>
 ),86#/-
 ).:8 ,*
 )6B@8DB@LK&10".,'32S`^$0.EPN6B@
)(CNM$0.FQO
" 3?>0<:
 )(42!- %1/
 )ITRQ^\*64KWUFQO.:8ITRAML>KIJUS@LKBMLO\Z7CA>JHMZX1=;*64/;9DON7CACNM6B@.:8<HF@LKAMLDONMYW<HF$0.FQO<HF&10>JHS`^7CA
&$6B@9EC:FD>JH7CACNM6B@.:8<HF@LKAMLDONMYW<HF$0.FQO<HF&10>JHS`^7CA
&$6B@9EC:FD>JH 75>JHFQO 751><?KJHSQ(42JUS 757CA&10)538DB:FD3?>AML*64?KJ!- ITR ,*'32(42$0.KVT2>=&10DON>JH
&$5A? ,*,86KWU2>=&10AML8DB)537CA@LK*64>KI-97MZX*64.:8-97@LK>JH 75$0.$0.KVT&10MZX(42
*(!- -97!- ;GE>KI=IG@LKMZX5A?BML%1/XecAMLMYW7CAKVT@LKMZX5A?BML%1/XecAMLMYW7CAKVT-97MZX*64.:8-97@LK>JH 75$0.$0.KVT&10MZX(42
'%FQO
'%FQO>KI>JH/;95A?6B@9EC8DBGRPVca
*(1=;!- 4@?
'B3?>;GEKWU>JH&10HSQ;GE4@?*64$0.,86BMLKWU>JH&10HSQ;GE4@?*64$0.,86BML1=;>JH4@?R_]EPN3?>4@?FQO ,*)53;GELXVGRP
&$ 75DON=IG7CA&10HSQ(42KVTAML1=;9EC?KJ;GE0<:@LK ,*JUS!- !- CNM(42)53LXV=IG*64>JH0<:!- !- CNM(42)53LXV=IG*64>JH0<:<HF?KJ0<:6B@'32:FDJUSCNM'32R_]$0.CNMN[Y8DB&10
%#GRP>JH0<:<HF?KJ0<:6B@'32:FDJUSCNM'32R_]$0.CNMN[Y8DB&10
'|AMZX(42 ,* ,*-97>KI<HF".,/;97CAMZX(42 ,* ,*-97>KI<HF".,/;9!- 4@? 751=; ,*/;9O\Z5A?BML6B@FQO@LKO\Z".,ITRMYW-97MZX7CA 75 75?KJ8DBKWU.:8N[Y".,/;9!- 4@? 751=; ,*/;9O\Z5A?BML6B@FQO@LKO\Z".,ITRMYW-97MZX7CA 75 75?KJ8DBKWU.:8N[Y
#!0<:'32
)(KWU$0.KVT".,-97MZXMYW9EC9EC*64JUS'21@LK2>=8DBEPN*64
 )%1/N[Y@LKAML5A?FQON[Y)53*64)53>JH*642>=-97AML1><0<:'21)53/;9Wdb6B@Ta_BMLTa_LXV$0.3?>$0.AMLCNM
JUSP][AMLMZX.:8?KJKVTITRJUS@LKLXVGRP=IG?KJLXV*646B@HSQBML@LKLXVGRP=IG?KJLXV*646B@HSQBML3?>$0.AMLCNM
'%JUSGRP3?>@LK,86JUS(42>KI7CAKVTBML$0.BML2>=8DB@LK<HFQ^\JUS>KIKVT0<:*64
3?>:FD#/-S`^BMLITR$0.3?>>JH2>=P][GRPAML=IG3?>ITR$0.3?>>JH2>=P][GRPAML=IG3?>7CAKVTBML$0.BML2>=8DB@LK<HFQ^\JUS>KIKVT0<:*64
'%JUSGRP3?>@LK,86JUS(42>KI7CAKVTBML$0.BML2>=8DB@LK<HFQ^\
)(/;9&10
3?>'21&10%1/
@LKAMLDONMYW<HF$0.FQO<HF&10>JHS`^7CA
&10AML8DB)537CA@LK*64>KI-97MZX*64.:8-97@LK>JH 75$0.$0.KVT&10MZX(42
>JH 75$0.$0.KVT&10MZX(42
*(2>= 75
'B3?>;GEKWU>JH&10
)(JUS$0.MYWP][?KJ ,*&10-97%1//;9*64MZX<HFP][?KJ ,*&10-97%1//;9*64MZX<HF<HF(42
)(JUS$0.MYWP][?KJ ,*&10-97%1//;9*64MZX<HFBML3?>LXV)53
*(8DB%1/&10Q^\/;9N[Y8DBQ^\@LKN[Y#/-$0.&10HSQLXV
('(424@?MZX(42$0.BML=IG<HF
'&:FD$0.EPN@LK<HF'32JUS-97(42!- 6B@>KI0<:HSQN[Y3?>5A?&103?>1=;,86Ta_O\ZKWU)536B@VcaITR3?>1=;,86Ta_O\ZKWU)536B@VcaITR
 ) 65,86
 ) ,*".,
 )3?>?KJ?KJKVTCNMAMLS`^LXVAML)531><HSQ$0.&10AML#/-$0.DONAML)531><HSQ$0.&10AML#/-$0.DON
'&3?>-97
'%-97>JHHSQ@LK0<:5A? ,*DON.:8 ,*%1/(42BMLMYW*64/;9>JH".,7CA1><'21FQO$0.DON
'&JUS0<:=IG1=;ITR5A?>KI1><HSQ$0.&10AML#/-$0.GRP1><9EC9EC>JH
$":FD#/-MYW 75'21:FD4@?9EC7CA!- $0.MYW'21Q^\;GE*64!- .:8 75AML)53<HF=IGJUS8DBJUS
" -97KWU<HF9EC5A?N[YDON)53!- '32)53$0.KVT
'32)533?>
)(-97'21'32)53
%#JUS$0.LXV>KIP][-97:FD!- ".,'32
'|A(421=;
%$1><1><!- 
'%CNM-97 75:FD5A?
&$&100<:
*($0.EPN7CAHSQ,86@LK4@?DON
 )ITRBML%1/%1/1><%1/$0.KVU0;:;GE$0.
(' ,*,86
('1=;)53<HF>KI.:8*64AML<HF!- $0.CNMCNM(42BMLO\ZDON3?>)534@?&10GRP7CA.:8/;9>KILXV6B@
MYW/;94@?>JH$0.DONJUSEPNCNM/;91=;BML
*(KWU'21%1/R_]%1/BML.:8*64ITRFQOEPN$0.LXV
'&&10/;9
9EC4@?!- @LK$0.DON
'&&100<:)53
'BLXV ,*6B@6B@JUS?KJJUSFQOAML1><)53MYWITR;GE>KI
'B
(',86.:8
#!(42,86'21".,
 )2>=4@?2>=)53
('!- S`^$0.GRPAML.:8$0.=IGLXVBML
'%>KI$0.FQOJUSR_]8DB=IG=IG2>=
$"=IG9ECEPNCNM,86DON1></;9'21%1/GRPFQO>KILXV.:81><'219EC@LK.:8N[Y2>=>KILXV.:81><'219EC@LK.:8N[Y2>=$0.FQOJUSR_]8DB=IG=IG2>=
(' ,*R_]R_]-97S`^DON6B@-976B@$0.JUSFQO
%#?KJ6B@0<:'32EPN3?>>JH6B@5A?;GEXec1=;5A?1>< 75ITR!- 6B@5A?;GEXec1=;5A?1>< 75ITR!- )53
;GEXec1=;5A?1>< 75ITRFQOCNM,861=;@LK
'%)53MYWXec?KJ8DB@LK.:8ITR:FD,86>JH3?>MZXMZX3?>DON2>=".,<HF 75(42,86$0.DONEPN
'&KVT".,<HF 75(42,86$0.DONEPN
'&9EC=IGJUS".,?KJ9EC=IG".,6B@@LK ,*KWU?KJ$0.?KJ7CA 75(42,86$0.DONEPN
.:8#/-*64
 )".,1><
".,1><&10
0<:".,&10)53
$0.KVT3?>
!- 3?>1><
/;93?>#/-*64
'%$0.2>=
 75%1/(420<:
*64'32*64
(',86'32
,86*640<:,86
*640<:,86
#/-.:8#/-
2>=-973?>
!- $0.CNMCNM(42
/;94@?>JH$0.DONJUSEPNCNM/;91=;BML
*(1=;-97
'21#/-".,-97".,)53*64-97.:9
4@?!- @LK$0.DON6B@
&10.:82>=
 )0<:*641><
,862>=$0.
(( ,*3>>(42
$0.DONBML7CA
'%,86 ,*
)(%1/9ECGRP=IG?KJLXV*646B@HSQBML3?>$0.AMLCNM
%#&10%1/3?>>JH2>=P][GRPAML=IG3?>7CAKVTBML$0.BML2>=8DB@LK<HFQ^\JUS>KIKVT0<:*64
&$".,1=;
&100<:'32
(''21$0.EPNITR(424@?HSQO\Z ,*#/-'32=IG6B@,86(42 ,*>JH.:83?>3?>;GE,86KVT>KI-97 75JUSAML'32AML'21.:8<HF,86>KIAML$0.AML'32AML'21.:8<HF,86>KIAML$0.HSQO\Z ,*#/-'32=IG6B@,86(42 ,*>JH.:83?>3?>;GE,86KVT>KI-97 75JUSAML'32AML'21.:8<HF,86>KIAML$0.JUSMZX/;94@?
,86(423?>AML%1/*64HSQLXV3?>P][ 75LXVR_]?KJ.:8BMLO\ZITR;GE
 )-97*643?> ,*
*(1=;#/-.:8#/-
'%4??#.-
'32-97)53
'21)53)53
,86$0.DONEPN
(42,86$0.DON
'&2>=(42
4@?$0.)53
 )".,1><&10
".,&10)53 ,*'21
,*(422>=
,*'212>=
2>=1=;(42
'%$0.2>=,860<:
0<:&10".,
$0.HSQ
/;9!- ".,'32
)53/;9#/-/;9
 751>< ,*
'%CNM
'%CNM:FDMYW
('0<:".,
)(8DB(42$0.HSQ7CA,865A?
,861=;1=;
 ))53 750<:".,,86
('3?>KWU=IG$0.CNM'321><1=; ,*7CAFQO
('3?>KWU=IG$0.CNM'321><2>=
 )4@?1=;
 )4@?#/- ,*
&$N[YBML$0.GRP@LK8DB 75.:8CNMFQO5A??KJ3?>7CAEPN%1/$0.'32*64EPN
'&'21,867CAS`^HSQ'32$0.AML,86HSQKVT1><*641><7CA:FDFQO6B@@LK
%#/;99ECITR?KJBML$0.MZX>KIUb`EPN/;9.:81><
'%CNM!- 1><
 ),86%1/
 )>KIMZX>JH1=;@LK$0.JUS
5A?8DB>JH=IG,86AML;GE>JH@LK<HF(42?KJ$0.BML8DB-97(42,86EPNDONKWU'32*64&10*647CA=IG;GE5A?8DB>JH=IG,86AML;GE>JH@LK<HF(42?KJ$0.BML8DB-97(42,86EPNDONKWU'32*64&10*647CA=IG;GE
&$9EC=IGLXV8DB!- 2>==IG1=;6B@-97<HF-97%1/$0.CNM%1/:FDEPNWdb5A?6B@>KI'32.:9
 )#/-@LK)53GRP6B@1><<HF@LK6B@AMLAMLAML>KI2>=BML0<:MZX'21-97<HF#/-$0.KVTAMLN[Y5A?,86/;9CNM5A?9EC8DB2>=4@?&10*64:FD4@?GRP9ECKVT(42.:8'216B@6B@BML%1/BML 75KVT(42.:8'216B@6B@BML%1/BML 752>=
#!'32#/-
 )DON?KJ3?>5A?8DBLXV>JH9ECO\Z*64>KIMZXBML'21%1/EPN$0.AML 75FQO ,*ITRR_],86
#!:FD!- 9EC5A?0<:1><4@?MZXAML1=;?KJKVT,86DON#/-$0.CNM#/-:FD
&$2>=3?>&10
*(4@? 75
'%FQOITR?KJ)53".,DON".,KVT<HF(42(42CNMMYW/;9>KI)53'21)53(42.:8>JH%1/*64".,,86GRP8DB<HFJUS.:8CNMJUS;GEEPN 75
'&,86>JH6B@;GEFQO 751><.:8JUS%1/$0.KVU0;:;GE$0.
HSQLXV?KJ3?>'32AMLAML<HFBML;GEHSQLXV?KJ3?>'32AMLAML<HFBML;GE@LK'21
HSQLXV?KJ3?>'32AMLAML<HFBML;GEAML5A?BML?KJ&107CA(420<: 75 ,*Ta_4@?>JH&105A?AML=IGHSQ1><CNM?KJ1=;2>=%1/,86<HF6B@7CA6B@O\Z1><
('!- -97
 )3?>$0.EPN1><AMLCNM/;94@?;GEN[Y6B@
%#4@? 75
 ) ,*&10$0.HSQ2>=:FD
 ).:8#/-
*(&10'329ECKVT1=;Ub`DON>JH'32MYW6B@3?>=IG'21#/--971=;JUSAML#/-&10LXV,86JUS<HF>JH&103?>1><4@?P][FQOP][$0.KVT>JH&103?>1><4@?P][FQOP][$0.KVTJUS
)($0.KVTJUS
#!*64!- 
)(%1/0<:?KJ8DBJUS:FD 75>KIN[YCNM3?>&10 ,*%1/8DB7CA(428DBMYWDON4@?KVT2>=9ECAMLDON&104@?&10".,@LKAML1=;-979EC9EC/;95A?5A?1><=IG2>=%1/>JH'320<:KWUMZX#/-AMLKVTEPN$0.0<:6B@AMLBMLBML9ECS`^?KJ1=;4@?$0.ITRAMLBMLBML9ECS`^?KJ1=;4@?$0.ITR9EC9EC/;95A?5A?1><=IG2>=%1/>JH'320<:KWUMZX#/-AMLKVTEPN$0.0<:6B@AMLBMLBML9ECS`^?KJ1=;4@?$0.ITR@LK
%#-97.:84@?
&$".,#/-#/-1=; 75
$"5A?Ta_EPN$0.KVT'21>KIHSQ>KI1=;'32
)(O\Z'32&10KVT?KJ7CA)53CNM@LK:FD@LK)531=;/;9KVT3?>P]['327CA-97/;9)53".,Vca$0.HSQ 75'327CA-97/;9)53".,Vca$0.HSQ 754@?.:8DON
)(O\Z'32&10KVT?KJ7CA)53CNM@LK:FD@LK)531=;/;9KVT3?>P]['327CA-97/;9)53".,Vca$0.HSQ 75
/:8*31,656@?
(&.86! *
3<;$- 0;94=<
#,  43(20
#!/97! )! )5>= )(2;;'0/! )
(&AJI" *6A@9BA#.,ITR&0.EPN!, 6?>?GEAJI
&$#)(2:8!''
" ,21$ )
'%#('"''$)(
%*)*1/%*)
$#(.-!'&
#)'!'&"''
"""''#''
#"#''', #)'"''
"'',11!'&
%%"*( 10'-,!'%*0/'.-(..")(
)1/'., )' 32
'%1:9/87
&.-&-,(.-
$$!&%#('#('& *$)(#('
#"&  % *-32&-,")(/76*11!('
*0/*/. $$
! (, (,,%**$)(
##$*)&, .33&, '-, &%',,,11#** '&.43 10#)()-,*..%** 0/
#""((% *$*)076#))
*/.,11& *
"!(,,&**& *!&%& *
"!(,,&**& *!&%(, !&% %$
%$'  !&% %%
$#$*)& *!&%(, !&% %$
$#$*)%*) %$(-,(,,
"!(,,&**& *
$#"'&*..
#"', ', 
(-,$(('  
*/.!&%*.-
! (,,#(' 0/
$)("'&"'&
#" %$#('#('
""& * %$&, !'&
%$#)('-,.32
#"")(&-,
! )0/'.-$ *# )#*)"*(
4:9.54298!(' ('# *-435<;/653:95<;298
&$(//*10
$$ &&6=<398$ *!)(
""-54-43/76 ('
&$*11&.-188"*)&/.5<;)1/*21,33(0/!('&/.
$##**.54*10087188
%- )0/'/.-43.64"*) 32'/.6<;&.-
"!"*) ('188$, 5<; ('(//(//
"!"*) ('188$, 5<; ('(//(// 21'/..545<:
&$6=<.54/655<:"*)
$"(//-434;:/76!)(# *
$$&.-*10&/-7>=,43(//(// 21'/..545<:
$$&.-*10&/-7>=,434;:-43# **10 ('(//3:9
&%"*) ('188$, 5<; ('(//$, /76 &&,43188,43,43 ('&/-!)(!('
!!/65)1/ 32
#""*)188
$# 21 32!)(,43-43&.-
!!,43188,43,43 ('&/-!)(!('
!!3:9&.-
!! ('&-,
"*)# */76"*)
&-,(//!)(-43%-,'/.)00*20"*)%- &.-
,43)10)31
('*42'10/87,65-761;:,65
&%6?>5>>
('(211:9
 433=;6?>
%%2<:,65
)'(215?>
 ),87(32
%$)541=;
 )-97'32
S`^BMLITR$0.3?>>JH2>=P][GRPAML=IG3?>ITR$0.3?>>JH2>=P][GRPAML=IG3?>7CAKVTBML$0.BML2>=8DB@LK<HFQ^\JUS>KIKVT=IG#/-<HF7CAEPN1=;O\Z8DB0<:0<:=IG#/-<HF7CAEPN1=;O\Z8DB.:81><
@LKAMLDONMYW<HF$0.FQO<HFKWU2>=
>JH 75$0.$0.KVT&10MZX 75HSQ
$"*64<HF/;91><HSQ$0.&10AML#/-$0.DONAML)531><HSQ$0.&10AML#/-$0.DON
S`^BMLITR$0.3?>>JH2>=P][GRPAML=IG3?>ITR$0.3?>>JH2>=P][GRPAML=IG3?>7CAKVTBML$0.BML2>=8DB@LK<HFQ^\JUS
>JH 75$0.$0.KVT
#.-'32 ,*3>>)545A?FQO'32(42DON0<:5A?KVT=IG5A?2>=)53>KI#/-1=;8DB*645A?KVT 751=;HSQKVT/;9&101=;9EC?KJ.:89EC*648DB)537CA*64$0.HSQ@LK0<:6B@BML'32@LK4@?)539EC=IGWdbCNM
'|AMZX
!- 4@? 751=;
(',862>=
$0.KVT".,
EPNKWU$0.KVT
,*'32-97
)(KWU$0.KVT".,-97MZXMYW9EC9EC*64JUS'21@LK2>=8DB
*641=;%1/
$0.BML2>=8DB@LK<HFQ^\JUS>KIKVT0<:*64
3?>$0.BML9ECKWU-97
,* 753?>
'210<:&10'32
,86'32,86
)531><1><
/;94@?1><2>=
'B3?>;GEKWU
*64$0.,86
*64%1/'32
2>='214@?0<:
4@?0<:$0.
)(JUS$0.MYW
JUS$0.MYWP][?KJ ,*
8CB1=;?KJAML5A?3?>0<:CNMKWU:FD>KICNM,86KVT ,*-97:FD)53(42'327CA9EC2>=".,5A?>JHJUS".,DON1=;MYW/;94@?>JH$0.DONJUSEPNCNM/;91=;BML
 )P][7CA'21%1/AML9EC4@?!- @LK$0.DON6B@
('$0.KVT3?>@LK 751><?KJ-971><CNMAML:FDO\Z
('2>=1=;(42
-970<:)53
-97$0.*64
'BLXV ,*6B@6B@JUS?KJJUSFQO
3?>-97&10)53
3?>-973?>
&10'21/;9
4@?'210<:*644@?2>=
1><'32".,
)(2>=-97
*(FQO=IG;GEFQO$0.DONBML7CA/;9?KJ>JH%1/8DB8DBCNM'32
9DCS_^0;:<HF8DB1><EPN1=;3?>HSQ-97DON.:85A?-979EC".,DONJUS3?>BML$0.MYWAML3?>HSQ>JHUb`9ECCNMDON!- :FD5A?
&10%1/,86*640<:
1><,86?KJ.:8AML,860<:GRP8DB)53;GE8DBAML%1/$0.MZXAML".,GRP@LK$0.'21
)(<HFKVT;GE6B@$0.EPNHSQMYW
6B@$0.EPNHSQ
('3?>.:8
,86(42 ,*
>KIAML$0.AML'32AML'21.:8<HF,86>KIAML$0.HSQO\Z
,*>JH.:83?>3?>;GE,86KVT>KI-97 75JUSAML'32AML'21.:8<HF,86>KIAML$0.JUSMZX/;94@?
 75!- 1=;
'&/;9AMLHSQ$0.KVT
%#3?>1><
6B@5A?;GEXec1=;5A?1>< 75ITR
$0.DONEPN
(42 ,*'21
 )1><!- 
)((42R_]$0.HSQ
&$EPN*64<HF)53".,2>=*64*64$0.LXV 751=;@LK".,1=;-97:FDS`^(42ITR<HF>KI$0.7CA
#!3?>4@?
('&102>=
'%CNM:FDMYW:FD
$"-97.:8MYW$0.CNM<HF2>=(42FQO8DB
!- !- CNM(42)53LXV=IG*64>JH0<:!- !- CNM(42)53LXV=IG*64>JH0<:<HF?KJ0<:6B@'32:FDJUSCNM'32R_]$0.CNMN[Y8DB&10
ITREPNKWU$0.KVT".,-97MZXMYW 75ITREPNKWU$0.KVT".,-97MZXMYW 75;GEMYW!- 2>=
".,&10/;9
hXXp://ten-cent.ys168.com/1.exe
hXXp://31002:[email protected]/shouxin.asp
%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
ole32.dll
__MSVCRT_HEAP_SELECT
user32.dll
RASAPI32.dll
iphlpapi.dll
SHLWAPI.dll
MPR.dll
WINMM.dll
WS2_32.dll
VERSION.dll
GetProcessHeap
WinExec
GetCPInfo
KERNEL32.dll
GetKeyState
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetWindowsHookExA
USER32.dll
GetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GDI32.dll
WINSPOOL.DRV
comdlg32.dll
RegCloseKey
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
OLEAUT32.dll
COMCTL32.dll
oledlg.dll
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCanonicalizeUrlA
WININET.dll
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.*)|*.*||
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
%d.%d
%d / %d
%d/%d
Bogus message code %d
(%d-%d):
%ld%c
(*.htm;*.html)|*.htm;*.html
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
HELO %s
SMTP
AUTH LOGIN
LOGIN
AUTH=LOGIN
EHLO %s
.PAVCOleException@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCOleDispatchException@@
zcÁ
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
"<u$>~%C
%<Z!2E 5P%DsJ
224,.0347%(*
1Fe%5X
$%%Sbb
$8<?48:)-2gv}
%%(%(/#(4$$&&)/
'-.Vf
"&$"&$"&$
*"&$"&$"&$
"&$44* (0
)29)0;#)-
#-5&3>(5@ )2
")!)0)28
&?H_y
(*.*)
1.0.0.0
(hXXp://VVV.eyuyan.com)


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tcss.ping[2].js (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1307700639_1837963180_10232_sPicName[1].jpg (3068 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cdn_djl[2].js (324 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (357 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1307416434_1837963180_5710_sPicName[1].jpg (2234 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Info_new_13[1].js (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\include_page090326[1].shtml (678 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\include_page090326[1].htm (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cdn_djl[1].js (239 bytes)
    %System%\drivers\etc\hosts (63 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1307067350_1837963180_17485_sPicName[1].jpg (1846 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1289532425_1837963180_32014_sPicName[1].jpg (7 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1308045043_1837963180_13717_sPicName[1].jpg (1825 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1306403789_1837963180_16515_sPicName[1].jpg (3406 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1243401051_-405729108_18166_sPicName[1].jpg (48 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1308045810_1837963180_19553_sPicName[1].jpg (2866 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Info_new_13[2].js (23 bytes)
    %Program Files%\1.scr (14022 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@qq[1].txt (139 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\gg_flash_2[1].swf (1753 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\client_bg2010[1].png (4948 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1307589442_1837963180_16665_sPicName[1].jpg (1038 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (2892 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tcss.ping[1].js (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1232032171_-405729108_7352_sPicName[1].jpg (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

  4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
    127.0.0.1 localhost
  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now