Edit tour

Windows Analysis Report
skfp.exe

Overview

General Information

Sample Name:	skfp.exe
Analysis ID:	884321
MD5:	625015d57b994752c5544feb964216ae
SHA1:	71aadd64bf38e31539c216ba3e14172afbde7259
SHA256:	a477d22921573b5b5b3798eb673b3248d48a6aa32c538117ca43874b4142c183

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Uses 32bit PE files

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

PE file contains executable resources (Code or Archives)

Program does not show much activity (idle)

Entry point lies outside standard sections

PE file contains sections with non-standard names

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

skfp.exe (PID: 5936 cmdline: C:\Users\user\Desktop\skfp.exe MD5: 625015D57B994752C5544FEB964216AE)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: skfp.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: skfp.exe

Static PE information: certificate valid

Source:	Binary string: V2.36_VS2013\Release\OnlineUpdate.pdb source: skfp.exe, 00000000.00000000.385777883.0000000005036000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: V2.33_VS2013\Release\OnlineUpdate.pdb source: skfp.exe, 00000000.00000000.385777883.00000000053A5000.00000002.00000001.01000000.00000003.sdmp

Source: skfp.exe, 00000000.00000000.385777883.0000000005C7B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://172.19.1.107/
Source: skfp.exe	String found in binary or memory: http://172.19.1.107/GetRegSrc/GetRegSrc.asmx
Source: skfp.exe	String found in binary or memory: http://192.168.29.37/hxfws-common/enterpriseRegister/toRegistInfo
Source: skfp.exe	String found in binary or memory: http://192.168.29.37/hxfws-common/enterpriseService/ItemOrderInterface
Source: skfp.exe	String found in binary or memory: http://192.168.29.37/hxfws-common/enterpriseService/ItemOrderOperate
Source: skfp.exe	String found in binary or memory: http://192.168.29.37/hxfws-common/enterpriseService/options
Source: skfp.exe	String found in binary or memory: http://192.168.29.37/hxfws-common/enterpriseService/optionshttp://fws.51fapiao.cn:8085/hxfws-common/
Source: skfp.exe	String found in binary or memory: http://192.168.29.37/hxfws-common/enterpriseService/platformItemInfo
Source: skfp.exe	String found in binary or memory: http://192.168.29.37/hxfws-common/enterpriseService/queryDetail
Source: skfp.exe	String found in binary or memory: http://192.168.29.37/hxfws-common/enterpriseService/toBind
Source: skfp.exe	String found in binary or memory: http://192.168.29.37/hxfws-common/registEnterprise/regist51CloudProduct
Source: skfp.exe	String found in binary or memory: http://192.168.29.37/hxfws-common/registEnterprise/regist51CloudProducthttp://192.168.29.37/hxfws-co
Source: skfp.exe	String found in binary or memory: http://192.168.29.54/login.htm?para=
Source: skfp.exe	String found in binary or memory: http://192.168.4.104:7020/acceptFramework/UniAcceptService
Source: skfp.exe	String found in binary or memory: http://192.168.4.104:7020/acceptFramework/UniAcceptServiceCTptkcs.dllAisino
Source: skfp.exe	String found in binary or memory: http://api-ibot.aisino.com/kprj/info/companyinfo/auth?authType=collect&entTaxNum=
Source: skfp.exe	String found in binary or memory: http://api-ibot.aisino.com/kprj/info/companyinfo/auth?authType=collect&entTaxNum=50auth_state
Source: skfp.exe	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: skfp.exe	String found in binary or memory: http://download.i-tax.cn/softs/
Source: skfp.exe	String found in binary or memory: http://fws.51fapiao.cn:8085/hxfws-common/enterpriseRegister/toRegistInfo
Source: skfp.exe	String found in binary or memory: http://fws.51fapiao.cn:8085/hxfws-common/enterpriseService/options
Source: skfp.exe	String found in binary or memory: http://fws.51fapiao.cn:8085/hxfws-common/enterpriseService/queryDetail
Source: skfp.exe	String found in binary or memory: http://fws.51fapiao.cn:8085/hxfws-common/enterpriseService/toBind
Source: skfp.exe	String found in binary or memory: http://lwzc.aisino.com
Source: skfp.exe	String found in binary or memory: http://lwzc.aisino.com/GetRegSrc/GetRegSrc.asmx
Source: skfp.exe	String found in binary or memory: http://lwzc.aisino.comhttp://
Source: skfp.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: skfp.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: skfp.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: skfp.exe	String found in binary or memory: http://service.aisino.com/announce/blog/notice?entTaxNum=
Source: skfp.exe	String found in binary or memory: http://service.aisino.com/announce/blog/notice?entTaxNum=&machNum=91noticeNum
Source: skfp.exe	String found in binary or memory: http://service.aisino.com/api-kprj/info/companyinfo
Source: skfp.exe	String found in binary or memory: http://service.aisino.com/api-kprj/info/companyinfokprjtypename24_swTypeaddressNummachNumentTaxNumen
Source: skfp.exe	String found in binary or memory: http://service.aisino.com/kprj?chat_id=
Source: skfp.exe	String found in binary or memory: http://service.aisino.com/kprj?chat_id=&chat_name=CloudService_QDFPZSCloudService_QYZQJHskin%d
Source: skfp.exe	String found in binary or memory: http://service.aisino.com/kprj?chat_id=24_
Source: skfp.exe	String found in binary or memory: http://tempuri.org/
Source: skfp.exe	String found in binary or memory: http://tempuri.org/Decode
Source: skfp.exe	String found in binary or memory: http://tempuri.org/DownloadRegFile
Source: skfp.exe	String found in binary or memory: http://tempuri.org/DownloadRegFilehttp://lwzc.aisino.com/GetRegSrc/GetRegSrc.asmxhttp://tempuri.org/
Source: skfp.exe	String found in binary or memory: http://tempuri.org/GetPwd
Source: skfp.exe	String found in binary or memory: http://tempuri.org/GetRegFile
Source: skfp.exe	String found in binary or memory: http://tempuri.org/GetRegFileNewEdition
Source: skfp.exe	String found in binary or memory: http://tempuri.org/SimplyGetRegFile
Source: skfp.exe	String found in binary or memory: http://tempuri.org/Test
Source: skfp.exe	String found in binary or memory: http://wdfp.5ifapiao.com/common-scaninvoice/static/qr4tqm/getinvoice.html?zfc=
Source: skfp.exe	String found in binary or memory: http://www.aisino.com
Source: skfp.exe	String found in binary or memory: http://www.aisino.comopenhttp://www.chinatax.gov.cn/boost
Source: skfp.exe	String found in binary or memory: http://www.chinatax.gov.cn/
Source: skfp.exe	String found in binary or memory: http://www.chinatax.gov.cn/dataspec/
Source: skfp.exe	String found in binary or memory: http://www.chinatax.gov.cn/tirip/dataspec/interfaces.xsd
Source: skfp.exe	String found in binary or memory: http://www.chinatax.gov.cn/tirip/dataspec/interfaces.xsdEI.DYCOMCS.U.EC.INTRAZZSDZFP6618146209611234
Source: skfp.exe	String found in binary or memory: http://www.i-tax.cn
Source: skfp.exe	String found in binary or memory: http://www.i-tax.cn/LWZCManger/CheckRegisterInfo
Source: skfp.exe	String found in binary or memory: http://www.i-tax.cn/SurveyQuestion/?sh=
Source: skfp.exe	String found in binary or memory: http://www.i-tax.cn/SurveyQuestion/?sh=chkNeverTipSurveyNeverchkMonthNoTipSurveyByMonthSSQPl
Source: skfp.exe	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: skfp.exe	String found in binary or memory: http://www.winimage.com/zLibDll
Source: skfp.exe	String found in binary or memory: https://127.0.0.1:7001
Source: skfp.exe	String found in binary or memory: https://127.0.0.1:7002
Source: skfp.exe	String found in binary or memory: https://deliver.51fapiao.cn/deliver/deliver
Source: skfp.exe	String found in binary or memory: https://deliver.51fapiao.cn/deliver/deliverhttp://fws.51fapiao.cn:8085/hxfws-common/enterpriseServic
Source: skfp.exe	String found in binary or memory: https://digi.aisino.com/accessToken/v1.0/get
Source: skfp.exe	String found in binary or memory: https://digi.aisino.com/accessToken/v1.0/login
Source: skfp.exe	String found in binary or memory: https://digi.aisino.com/api/v1.0/51.formatfile.build
Source: skfp.exe	String found in binary or memory: https://digi.aisino.com/api/v1.0/51.invoice.deliver
Source: skfp.exe	String found in binary or memory: https://digi.aisino.com/api/v1.0/51.speedBilling.ultimate.feedback.add
Source: skfp.exe	String found in binary or memory: https://digi.aisino.com/api/v1.0/51.speedBilling.ultimate.feedback.choose
Source: skfp.exe	String found in binary or memory: https://digi.aisino.com/api/v1.0/51.speedBilling.ultimate.prefixQuery
Source: skfp.exe	String found in binary or memory: https://digi.aisino.com:8888/deliver/deliver
Source: skfp.exe	String found in binary or memory: https://fws.51fapiao.cn/hxfws-common/enterpriseRegister/toRegistInfo
Source: skfp.exe	String found in binary or memory: https://fws.51fapiao.cn/hxfws-common/enterpriseService/ItemOrderInterface
Source: skfp.exe	String found in binary or memory: https://fws.51fapiao.cn/hxfws-common/enterpriseService/ItemOrderOperate
Source: skfp.exe	String found in binary or memory: https://fws.51fapiao.cn/hxfws-common/enterpriseService/options
Source: skfp.exe	String found in binary or memory: https://fws.51fapiao.cn/hxfws-common/enterpriseService/optionshttp://fws.51fapiao.cn:8085/hxfws-comm
Source: skfp.exe	String found in binary or memory: https://fws.51fapiao.cn/hxfws-common/enterpriseService/platformItemInfo
Source: skfp.exe	String found in binary or memory: https://fws.51fapiao.cn/hxfws-common/enterpriseService/queryDetail
Source: skfp.exe	String found in binary or memory: https://fws.51fapiao.cn/hxfws-common/enterpriseService/queryDetailhttp://192.168.29.37/hxfws-common/
Source: skfp.exe	String found in binary or memory: https://fws.51fapiao.cn/hxfws-common/enterpriseService/toBind
Source: skfp.exe	String found in binary or memory: https://fws.51fapiao.cn/hxfws-common/enterpriseService/toBindhttp://192.168.29.37/hxfws-common/enter
Source: skfp.exe	String found in binary or memory: https://fws.51fapiao.cn/hxfws-common/registEnterprise/regist51CloudProduct
Source: skfp.exe	String found in binary or memory: https://fws.51fapiao.cn/hxfws-common/registEnterprise/regist51CloudProducthttps://fws.51fapiao.cn/hx
Source: skfp.exe	String found in binary or memory: https://hgz.miit.gov.cn/enterprise/api/invoices/taxation/UploadInvoices
Source: skfp.exe	String found in binary or memory: https://hgz.miit.gov.cn/enterprise/api/invoices/taxation/UploadInvoiceshttps://jdchgz.miit.gov.cn/en
Source: skfp.exe	String found in binary or memory: https://inv-veri.chinatax.gov.cn/xgxz.html
Source: skfp.exe	String found in binary or memory: https://inv-veri.chinatax.gov.cn/xgxz.htmlSkinMarginmainGroup
Source: skfp.exe	String found in binary or memory: https://jdchgz.miit.gov.cn/enterprise/api/invoices/taxation/UploadInvoices
Source: skfp.exe	String found in binary or memory: https://openapi.51fapiao.cn/accessToken/v1.0/get
Source: skfp.exe	String found in binary or memory: https://openapi.51fapiao.cn/accessToken/v1.0/gethttps://digi.aisino.com/accessToken/v1.0/get
Source: skfp.exe	String found in binary or memory: https://openapi.51fapiao.cn/accessToken/v1.0/login
Source: skfp.exe	String found in binary or memory: https://openapi.51fapiao.cn/accessToken/v1.0/loginhttps://digi.aisino.com/accessToken/v1.0/loginTEST
Source: skfp.exe	String found in binary or memory: https://openapi.51fapiao.cn/api/v1.0/51.formatfile.build
Source: skfp.exe	String found in binary or memory: https://openapi.51fapiao.cn/api/v1.0/51.invoice.deliver
Source: skfp.exe	String found in binary or memory: https://openapi.51fapiao.cn/api/v1.0/51.invoice.deliverhttps://digi.aisino.com/api/v1.0/51.invoice.d
Source: skfp.exe	String found in binary or memory: https://openapi.51fapiao.cn/api/v1.0/51.speedBilling.ultimate.feedback.add
Source: skfp.exe	String found in binary or memory: https://openapi.51fapiao.cn/api/v1.0/51.speedBilling.ultimate.feedback.choose
Source: skfp.exe	String found in binary or memory: https://openapi.51fapiao.cn/api/v1.0/51.speedBilling.ultimate.feedback.choosehttps://digi.aisino.com
Source: skfp.exe	String found in binary or memory: https://openapi.51fapiao.cn/api/v1.0/51.speedBilling.ultimate.prefixQuery
Source: skfp.exe	String found in binary or memory: https://openapi.51fapiao.cn/api/v1.0/51.speedBilling.ultimate.prefixQueryhttps://digi.aisino.com/api
Source: skfp.exe	String found in binary or memory: https://tdps.aisino.com/wr/
Source: skfp.exe	String found in binary or memory: https://tdps.aisino.com/wr/jdlsmsGetWifiVec-wifiArray:
Source: skfp.exe	String found in binary or memory: https://u.i-tax.cn/sys/pos/collect
Source: skfp.exe	String found in binary or memory: https://u.i-tax.cn/sys/pos/collectLoadIniFile-tdps_proxy1:%sLoadIniFile-realHttpsCert:%stdps_proxy1P
Source: skfp.exe, 00000000.00000000.385777883.0000000005EE2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.aisino.cn
Source: skfp.exe	String found in binary or memory: https://www.aisino.cn/introduction
Source: skfp.exe, 00000000.00000000.385777883.0000000005C7B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.baidu.com/
Source: skfp.exe, 00000000.00000000.385777883.0000000005EE2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://yun.51fapiao.cn
Source: skfp.exe	String found in binary or memory: https://yun.51fapiao.cn/login.htm?para=

Source: skfp.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: skfp.exe, 00000000.00000000.385777883.0000000005036000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOnlineUpdate.exe, vs skfp.exe
Source: skfp.exe, 00000000.00000000.385777883.00000000053A5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOnlineUpdate.exe, vs skfp.exe

Source: C:\Users\user\Desktop\skfp.exe	Section loaded: sofc.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: libcurldll.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: zlib1.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: libxls.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: pdftox.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: fofdgsdk32.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: log4cxx.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: sm2_soft_miracl_dll.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: cryp_api.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: decodecert.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: tapkfrshclt.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\skfp.exe	Section loaded: winmm.dll	Jump to behavior

Source: skfp.exe	Static PE information: Resource name: DC_EXE type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: skfp.exe	Static PE information: Resource name: DC_EXE type: PE32 executable (GUI) Intel 80386, for MS Windows

Source: C:\Users\user\Desktop\skfp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: skfp.exe	String found in binary or memory: set-addPolicy
Source: skfp.exe	String found in binary or memory: %c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%cuser + domain + host name too bigsetAttr-CertsetAttr-PGWYcappayment gateway capabilitiessetAttr-TokenTypesetAttr-IssCapissuer capabilitiesset-rootKeyThumbset-addPolicysetAttr-Token-EMVsetAttr-Token-B0PrimesetAttr-IssCap-CVMsetAttr-IssCap-T2setAttr-IssCap-SigsetAttr-GenCryptgrmgenerate cryptogramsetAttr-T2Encencrypted track 2setAttr-T2cleartxtcleartext track 2setAttr-TokICCsigICC or token signaturesetAttr-SecDevSigsecure device signatureset-brand-IATA-ATAset-brand-Dinersset-brand-AmericanExpressset-brand-JCBset-brand-Visaset-brand-MasterCardset-brand-NovusDES-CDMFdes-cdmfrsaOAEPEncryptionSETITU-Titu-tJOINT-ISO-ITU-Tjoint-iso-itu-tinternational-organizationsInternational OrganizationsmsSmartcardLoginMicrosoft SmartcardloginmsUPNMicrosoft Universal Principal NameAES-128-CFB1aes-128-cfb1AES-192-CFB1aes-192-cfb1AES-256-CFB1aes-256-cfb1AES-128-CFB8aes-128-cfb8AES-192-CFB8aes-192-cfb8AES-256-CFB8aes-256-cfb8DES-CFB1des-cfb1DES-CFB8des-cfb8DES-EDE3-CFB1des-ede3-cfb1DES-EDE3-CFB8des-ede3-cfb8streetstreetAddresspostalCodeid-pplproxyCertInfoProxy Certificate Informationid-ppl-anyLanguageAny languageid-ppl-inheritAllInherit allnameConstraintsX509v3 Name Constraintsid-ppl-independentIndependentRSA-SHA256sha256WithRSAEncryptionRSA-SHA384sha384WithRSAEncryptionRSA-SHA512sha512WithRSAEncryptionRSA-SHA224sha224WithRSAEncryptionsha256sha384SHA512sha512SHA224sha224identified-organizationcerticom-arcwapwap-wsgid-characteristic-two-basisonBasistpBasisppBasisc2pnb163v1c2pnb163v2c2pnb163v3c2pnb176v1c2tnb191v1c2tnb191v2c2tnb191v3c2onb191v4c2onb191v5c2pnb208w1c2tnb239v1c2tnb239v2c2tnb239v3c2onb239v4c2onb239v5c2pnb272w1c2pnb304w1c2tnb359v1c2pnb368w1c2tnb431r1secp112r1secp112r2secp128r1secp128r2secp160k1secp160r1secp160r2secp192k1*
Source: skfp.exe	String found in binary or memory: id-cmc-addExtensions
Source: skfp.exe	String found in binary or memory: \AisinoJSPCSP\aisino_service_admin.exe /Install
Source: skfp.exe	String found in binary or memory: ...\AisinoJSPCSP\aisino_service_admin.exe /Installsc delete "Aisino jsp shuikong"\AisinoJSPCSP\cspsign.dll\ai109b_gm.dllSM2SM2CONTAINER\AisinoJSPCSP\aisino_service_admin.exeALTER TABLE QDPT_FPXX_TDYS_BDC ADD COLUMN DW varchar(40);SELECT COUNT() FROM SQLITE_MASTER WHERE TBL_NAME='QDPT_FPXX_TDYS_BDC' AND [SQL] like '%DW%' AND TYPE='table'ALTER TABLE QDPT_FPXX_TDYS_JZFW ADD COLUMN JZXMMC varchar(80);SELECT COUNT() FROM SQLITE_MASTER WHERE TBL_NAME='QDPT_FPXX_TDYS_JZFW' AND [SQL] like '%JZXMMC%' AND TYPE='table'ALTER TABLE QDPT_FPXX_TDYS_JZFW ADD JZFWFSD varchar(250);SELECT COUNT(*) FROM SQLITE_MASTER WHERE TBL_NAME='QDPT_FPXX_TDYS_JZFW' AND [SQL] like '%JZFWFSD%' AND TYPE='table'replace into SYS_CONFIG (NAME,VALUE) values('DB_VER','
Source: skfp.exe	String found in binary or memory: ParseDjFile_DZ-----------------COMMON_FPKJ_XMXX-start
Source: skfp.exe	String found in binary or memory: Main-StopTdps
Source: skfp.exe	String found in binary or memory: Main-StopTdps-waiting...
Source: skfp.exe	String found in binary or memory: Main-StartTdps
Source: skfp.exe	String found in binary or memory: : error CollectDataThread-JsonStr:%sCollectDataThread-CreateThread-SendDataThread:%dCollectDataThread-GpsStr:%sCollectDataThread-WifiStr:%sCollectDataThread-RESET...CollectDataThread-continue...CollectDataThread-BeginCollectDataThread-Get Nsrsbh and sbbh failed...SendDataThread-ResponseJson:%sgrSendDataThread-URL:%sSendDataThread-ErrorMsg:%sSendDataThread-BeginSendDataThread-Proxy:%sCollectDataThread-EndCollectDataThread-Waiting...SendDataThread-Local-ErrorMsg:%sSendDataThread-Local-ResponseJson:%s{"d":"SendDataThread-Local-SendData:%sSendDataThread-wr-mins:%d"}SendDataThread-gr-mins:%dwr29 b 1 0 4029 b 1 0 3729 b 0 0 1029 b 0 0 3929 b 0 0 4229 b 0 0 33SendDataThread-End29 b 0 0 43Main-StopTdpsMain-StopTdps-waiting...Main-StartTdpsMain-CreateThread-CollectDataThread:%dVersion: v1.0_20101201Main-LoadTdpsIniFileMain-LoadIniFile-failed++++++++++++++++ START ++++++++++++++++LoadIniFile-region:%sLoadIniFile-realUrl:%sTCDPLoadIniFile-waitingTime:%dtdps_logLOG++++++++++++++++ END ++++++++++++++++\bin\tdps_proxy=======================================-----BEGIN CERTIFICATE-----https://u.i-tax.cn/sys/pos/collectLoadIniFile-tdps_proxy1:%sLoadIniFile-realHttpsCert:%stdps_proxy1PROXY$GNRMC,GetWifiVec-gpsVec: %dExecuteCommand-result-length:%dExecuteCommand-result/Hex:%sExecuteCommand-len:%dExecuteCommand-retcode:%d29 b 0 0 34ExecuteCommand-commandId:%d, mins:%dhttps://tdps.aisino.com/wr/jdlsmsGetWifiVec-wifiArray: %dcsdGetWifiVec-gpsArray: %dGetWifiVec-wifiVec: %d
Source: skfp.exe	String found in binary or memory: : error CollectDataThread-JsonStr:%sCollectDataThread-CreateThread-SendDataThread:%dCollectDataThread-GpsStr:%sCollectDataThread-WifiStr:%sCollectDataThread-RESET...CollectDataThread-continue...CollectDataThread-BeginCollectDataThread-Get Nsrsbh and sbbh failed...SendDataThread-ResponseJson:%sgrSendDataThread-URL:%sSendDataThread-ErrorMsg:%sSendDataThread-BeginSendDataThread-Proxy:%sCollectDataThread-EndCollectDataThread-Waiting...SendDataThread-Local-ErrorMsg:%sSendDataThread-Local-ResponseJson:%s{"d":"SendDataThread-Local-SendData:%sSendDataThread-wr-mins:%d"}SendDataThread-gr-mins:%dwr29 b 1 0 4029 b 1 0 3729 b 0 0 1029 b 0 0 3929 b 0 0 4229 b 0 0 33SendDataThread-End29 b 0 0 43Main-StopTdpsMain-StopTdps-waiting...Main-StartTdpsMain-CreateThread-CollectDataThread:%dVersion: v1.0_20101201Main-LoadTdpsIniFileMain-LoadIniFile-failed++++++++++++++++ START ++++++++++++++++LoadIniFile-region:%sLoadIniFile-realUrl:%sTCDPLoadIniFile-waitingTime:%dtdps_logLOG++++++++++++++++ END ++++++++++++++++\bin\tdps_proxy=======================================-----BEGIN CERTIFICATE-----https://u.i-tax.cn/sys/pos/collectLoadIniFile-tdps_proxy1:%sLoadIniFile-realHttpsCert:%stdps_proxy1PROXY$GNRMC,GetWifiVec-gpsVec: %dExecuteCommand-result-length:%dExecuteCommand-result/Hex:%sExecuteCommand-len:%dExecuteCommand-retcode:%d29 b 0 0 34ExecuteCommand-commandId:%d, mins:%dhttps://tdps.aisino.com/wr/jdlsmsGetWifiVec-wifiArray: %dcsdGetWifiVec-gpsArray: %dGetWifiVec-wifiVec: %d

Source: classification engine

Classification label: clean3.winEXE@1/0@0/0

Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE XTSWXX SET QYBH = '' WHERE QYBH = '';UPDATE XXFP SET BSZT='1',BSRZ='
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE [FORMAT_BUILD_INFO] ([FPZL] char(1) NOT NULL,[FPDM] varchar(12) NOT NULL,[FPHM] int NOT NULL,[XZDZ] varchar(200),[JFM] varchar(50),PRIMARY KEY ([FPZL],[FPDM],[FPHM]));
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE [HZFP_SQD_QD]([SQDH] varchar(30) NOT NULL,[MXXH] int NOT NULL,[JE] decimal NOT NULL,[SLV] float,[SE] decimal,[SPMC] varchar(100) NOT NULL,[SPSM] varchar(6),[GGXH] varchar(40),[JLDW] varchar(25),[SL] VARCHAR(21),[DJ] VARCHAR(21),[HSJBZ] bit NOT NULL,[SPBH] varchar(16),[FPHXZ] int NOT NULL,[XTHASH] varchar(40),[FLBM] VARCHAR(20),[QYSPBM] VARCHAR(20),[SFXSYHZC] VARCHAR(2),[YHZCMC] VARCHAR(50),[LSLBS] VARCHAR(2), Primary Key(SQDH,MXXH));
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE [LYGL_JPXX] ([LBDM] VARCHAR NOT NULL, [JQSH] VARCHAR(8) NOT NULL,[JZZH] VARCHAR(8) NOT NULL,[LGZS] INT NOT NULL,[QSHM] VARCHAR(8) NOT NULL,[SYZS] INT NOT NULL,[KPXE] DECIMAL NOT NULL,[LGRQ] DATETIME NOT NULL,[JPGG] VARCHAR NOT NULL,CONSTRAINT [sqlite_autoindex_LYGL_JPXX_1] PRIMARY KEY ([LBDM], [JQSH], [JZZH]));
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE [LYGL_PSXX] ([SFMR] BOOL NOT NULL,[SJR] VARCHAR NOT NULL,[YZBM] VARCHAR,[DZ] VARCHAR NOT NULL,[GDDH] VARCHAR,[YDDH] VARCHAR NOT NULL,[BZ] VARCHAR,CONSTRAINT [sqlite_autoindex_LYGL_PSXX_1] PRIMARY KEY ([SJR], [YZBM], [DZ], [GDDH], [YDDH]));
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE [ACCESS_TOKEN] ([QYSH] VARCHAR(25) NOT NULL,[KPJH] VARCHAR(10) NOT NULL,[TOKEN] varchar(50),[EXPIRES] varchar(20),[REQUEST_TIME] datetime,CONSTRAINT[] PRIMARY KEY([QYSH], [KPJH]));
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE [XZQH_SJ] ([xzqhDm] CHAR NOT NULL,[sjxzqhDm] CHAR,[basexzqhDm] CHAR,[xzqhMc] CHAR,[xzqhJc] CHAR);
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE [BM_XFS]([BM] varchar(19) NOT NULL UNIQUE,[HBBM] varchar(19) NOT NULL,[MC] varchar(200) NOT NULL, [SM] varchar(4000), [SLV] varchar(200),[ZZSTSGL] varchar(500),[ZZSZCYJ] varchar(1000),[ZZSTSNRDM] varchar(100),[XFSGL] varchar(500),[XFSZCYJ] varchar(1000),[XFSTSNRDM] varchar(100),[GJZ] varchar(2000),[HZX] varchar(1),[TJJBM] varchar(500),[HGJCKSPPM] TEXT,[BMB_BBH] varchar(20) NOT NULL,[BBH] varchar(20) NOT NULL,[KYZT] varchar(1),[QYSJ] varchar(8),[GDQJZSJ] varchar(8),[SJBM] varchar(19),[GXSJ] DATETIME,[WJ] INT,[ISHIDE] INT NOT NULL DEFAULT 0,[SLVSELECT] float(0),[YHZC] varchar(4),[YHZCMC] varchar(200),[LSLVBS] varchar(1),[FLBMJC] varchar(200),CONSTRAINT [sqlite_autoindex_BM_SPFL_1] PRIMARY KEY ([BM]));
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: skfp.exe, 00000000.00000000.370686263.0000000001851000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE [BM_DZY]([BM] varchar(19) NOT NULL UNIQUE,[HBBM] varchar(19) NOT NULL,[MC] varchar(200) NOT NULL, [SM] varchar(4000), [SLV] varchar(200),[ZZSTSGL] varchar(500),[ZZSZCYJ] varchar(1000),[ZZSTSNRDM] varchar(100),[XFSGL] varchar(500),[XFSZCYJ] varchar(1000),[XFSTSNRDM] varchar(100),[GJZ] varchar(2000),[HZX] varchar(1),[TJJBM] varchar(500),[HGJCKSPPM] TEXT,[BMB_BBH] varchar(20) NOT NULL,[BBH] varchar(20) NOT NULL,[KYZT] varchar(1),[QYSJ] varchar(8),[GDQJZSJ] varchar(8),[SJBM] varchar(19),[GXSJ] DATETIME,[WJ] INT,[ISHIDE] INT NOT NULL DEFAULT 0,[SLVSELECT] float(0),[YHZC] varchar(4),[YHZCMC] varchar(200),[LSLVBS] varchar(1),[FLBMJC] varchar(200),CONSTRAINT [sqlite_autoindex_BM_SPFL_1] PRIMARY KEY ([BM]));

Source: skfp.exe

Static file information: File size 95438112 > 1048576

Source: skfp.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: skfp.exe

Static PE information: certificate valid

Source: skfp.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x144f600
Source: skfp.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x4d8200
Source: skfp.exe	Static PE information: Raw size of .IK60 is bigger than: 0x100000 < 0x2c21600
Source: skfp.exe	Static PE information: Raw size of .IK62 is bigger than: 0x100000 < 0x5f0800
Source: skfp.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xf7d200

Source:	Binary string: V2.36_VS2013\Release\OnlineUpdate.pdb source: skfp.exe, 00000000.00000000.385777883.0000000005036000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: V2.33_VS2013\Release\OnlineUpdate.pdb source: skfp.exe, 00000000.00000000.385777883.00000000053A5000.00000002.00000001.01000000.00000003.sdmp

Source: initial sample

Static PE information: section where entry point is pointing to: .IK62

Source: skfp.exe	Static PE information: section name: .IK60
Source: skfp.exe	Static PE information: section name: .IK61
Source: skfp.exe	Static PE information: section name: .IK62

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
skfp.exe	3%	ReversingLabs

Source	Detection	Scanner	Label
http://tempuri.org/	0%	URL Reputation	safe
http://download.i-tax.cn/softs/	0%	Avira URL Cloud	safe
http://www.chinatax.gov.cn/dataspec/	0%	Avira URL Cloud	safe
http://www.aisino.comopenhttp://www.chinatax.gov.cn/boost	0%	Avira URL Cloud	safe
https://hgz.miit.gov.cn/enterprise/api/invoices/taxation/UploadInvoices	0%	Avira URL Cloud	safe
http://www.i-tax.cn/SurveyQuestion/?sh=chkNeverTipSurveyNeverchkMonthNoTipSurveyByMonthSSQPl	0%	Avira URL Cloud	safe
http://www.chinatax.gov.cn/	0%	Avira URL Cloud	safe
http://tempuri.org/DownloadRegFile	0%	Avira URL Cloud	safe
http://tempuri.org/Decode	0%	Avira URL Cloud	safe
https://u.i-tax.cn/sys/pos/collectLoadIniFile-tdps_proxy1:%sLoadIniFile-realHttpsCert:%stdps_proxy1P	0%	Avira URL Cloud	safe
https://www.aisino.cn	0%	Avira URL Cloud	safe
https://hgz.miit.gov.cn/enterprise/api/invoices/taxation/UploadInvoiceshttps://jdchgz.miit.gov.cn/en	0%	Avira URL Cloud	safe
http://192.168.29.37/hxfws-common/enterpriseService/toBind	0%	Avira URL Cloud	safe
http://tempuri.org/GetPwd	0%	Avira URL Cloud	safe
http://wdfp.5ifapiao.com/common-scaninvoice/static/qr4tqm/getinvoice.html?zfc=	0%	Avira URL Cloud	safe
http://lwzc.aisino.comhttp://	0%	Avira URL Cloud	safe
http://tempuri.org/SimplyGetRegFile	0%	Avira URL Cloud	safe
http://tempuri.org/GetRegFileNewEdition	0%	Avira URL Cloud	safe
http://tempuri.org/DownloadRegFilehttp://lwzc.aisino.com/GetRegSrc/GetRegSrc.asmxhttp://tempuri.org/	0%	Avira URL Cloud	safe
https://jdchgz.miit.gov.cn/enterprise/api/invoices/taxation/UploadInvoices	0%	Avira URL Cloud	safe
http://www.chinatax.gov.cn/tirip/dataspec/interfaces.xsd	0%	Avira URL Cloud	safe
http://192.168.29.37/hxfws-common/registEnterprise/regist51CloudProducthttp://192.168.29.37/hxfws-co	0%	Avira URL Cloud	safe
https://127.0.0.1:7001	0%	Avira URL Cloud	safe
https://127.0.0.1:7002	0%	Avira URL Cloud	safe
https://inv-veri.chinatax.gov.cn/xgxz.htmlSkinMarginmainGroup	0%	Avira URL Cloud	safe
https://inv-veri.chinatax.gov.cn/xgxz.html	0%	Avira URL Cloud	safe
http://www.i-tax.cn/SurveyQuestion/?sh=	0%	Avira URL Cloud	safe
http://192.168.29.37/hxfws-common/enterpriseService/platformItemInfo	0%	Avira URL Cloud	safe
http://192.168.29.37/hxfws-common/enterpriseService/options	0%	Avira URL Cloud	safe
http://192.168.29.37/hxfws-common/enterpriseService/ItemOrderInterface	0%	Avira URL Cloud	safe
http://172.19.1.107/GetRegSrc/GetRegSrc.asmx	0%	Avira URL Cloud	safe
http://192.168.29.37/hxfws-common/enterpriseService/ItemOrderOperate	0%	Avira URL Cloud	safe
http://www.i-tax.cn/LWZCManger/CheckRegisterInfo	0%	Avira URL Cloud	safe
https://u.i-tax.cn/sys/pos/collect	0%	Avira URL Cloud	safe
http://192.168.29.37/hxfws-common/registEnterprise/regist51CloudProduct	0%	Avira URL Cloud	safe
http://192.168.4.104:7020/acceptFramework/UniAcceptServiceCTptkcs.dllAisino	0%	Avira URL Cloud	safe
http://192.168.29.37/hxfws-common/enterpriseService/optionshttp://fws.51fapiao.cn:8085/hxfws-common/	0%	Avira URL Cloud	safe
http://192.168.29.37/hxfws-common/enterpriseRegister/toRegistInfo	0%	Avira URL Cloud	safe
http://tempuri.org/Test	0%	Avira URL Cloud	safe
http://www.i-tax.cn	0%	Avira URL Cloud	safe
http://192.168.4.104:7020/acceptFramework/UniAcceptService	0%	Avira URL Cloud	safe
http://172.19.1.107/	0%	Avira URL Cloud	safe
https://www.aisino.cn/introduction	0%	Avira URL Cloud	safe
http://192.168.29.37/hxfws-common/enterpriseService/queryDetail	0%	Avira URL Cloud	safe
http://tempuri.org/GetRegFile	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.aisino.com	skfp.exe	false		high
http://download.i-tax.cn/softs/	skfp.exe	false	Avira URL Cloud: safe	unknown
http://service.aisino.com/announce/blog/notice?entTaxNum=&machNum=91noticeNum	skfp.exe	false		high
https://deliver.51fapiao.cn/deliver/deliverhttp://fws.51fapiao.cn:8085/hxfws-common/enterpriseServic	skfp.exe	false		high
https://digi.aisino.com/accessToken/v1.0/login	skfp.exe	false		high
http://api-ibot.aisino.com/kprj/info/companyinfo/auth?authType=collect&entTaxNum=50auth_state	skfp.exe	false		high
http://www.chinatax.gov.cn/dataspec/	skfp.exe	false	Avira URL Cloud: safe	unknown
https://www.aisino.cn	skfp.exe, 00000000.00000000.385777883.0000000005EE2000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.aisino.comopenhttp://www.chinatax.gov.cn/boost	skfp.exe	false	Avira URL Cloud: safe	unknown
https://openapi.51fapiao.cn/api/v1.0/51.speedBilling.ultimate.feedback.choosehttps://digi.aisino.com	skfp.exe	false		high
https://hgz.miit.gov.cn/enterprise/api/invoices/taxation/UploadInvoices	skfp.exe	false	Avira URL Cloud: safe	unknown
https://openapi.51fapiao.cn/api/v1.0/51.speedBilling.ultimate.prefixQuery	skfp.exe	false		high
http://tempuri.org/Decode	skfp.exe	false	Avira URL Cloud: safe	unknown
http://www.chinatax.gov.cn/	skfp.exe	false	Avira URL Cloud: safe	unknown
https://openapi.51fapiao.cn/accessToken/v1.0/gethttps://digi.aisino.com/accessToken/v1.0/get	skfp.exe	false		high
http://www.i-tax.cn/SurveyQuestion/?sh=chkNeverTipSurveyNeverchkMonthNoTipSurveyByMonthSSQPl	skfp.exe	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	skfp.exe	false	URL Reputation: safe	unknown
https://digi.aisino.com/accessToken/v1.0/get	skfp.exe	false		high
https://u.i-tax.cn/sys/pos/collectLoadIniFile-tdps_proxy1:%sLoadIniFile-realHttpsCert:%stdps_proxy1P	skfp.exe	false	Avira URL Cloud: safe	unknown
http://tempuri.org/DownloadRegFile	skfp.exe	false	Avira URL Cloud: safe	unknown
https://digi.aisino.com/api/v1.0/51.speedBilling.ultimate.feedback.add	skfp.exe	false		high
https://hgz.miit.gov.cn/enterprise/api/invoices/taxation/UploadInvoiceshttps://jdchgz.miit.gov.cn/en	skfp.exe	false	Avira URL Cloud: safe	unknown
https://jdchgz.miit.gov.cn/enterprise/api/invoices/taxation/UploadInvoices	skfp.exe	false	Avira URL Cloud: safe	unknown
https://openapi.51fapiao.cn/api/v1.0/51.speedBilling.ultimate.feedback.choose	skfp.exe	false		high
http://lwzc.aisino.comhttp://	skfp.exe	false	Avira URL Cloud: safe	unknown
https://fws.51fapiao.cn/hxfws-common/enterpriseService/toBind	skfp.exe	false		high
http://tempuri.org/GetPwd	skfp.exe	false	Avira URL Cloud: safe	unknown
https://fws.51fapiao.cn/hxfws-common/enterpriseRegister/toRegistInfo	skfp.exe	false		high
https://digi.aisino.com/api/v1.0/51.speedBilling.ultimate.prefixQuery	skfp.exe	false		high
https://fws.51fapiao.cn/hxfws-common/enterpriseService/optionshttp://fws.51fapiao.cn:8085/hxfws-comm	skfp.exe	false		high
http://fws.51fapiao.cn:8085/hxfws-common/enterpriseRegister/toRegistInfo	skfp.exe	false		high
http://tempuri.org/DownloadRegFilehttp://lwzc.aisino.com/GetRegSrc/GetRegSrc.asmxhttp://tempuri.org/	skfp.exe	false	Avira URL Cloud: safe	unknown
http://tempuri.org/GetRegFileNewEdition	skfp.exe	false	Avira URL Cloud: safe	unknown
https://fws.51fapiao.cn/hxfws-common/enterpriseService/ItemOrderOperate	skfp.exe	false		high
http://fws.51fapiao.cn:8085/hxfws-common/enterpriseService/options	skfp.exe	false		high
https://digi.aisino.com:8888/deliver/deliver	skfp.exe	false		high
http://wdfp.5ifapiao.com/common-scaninvoice/static/qr4tqm/getinvoice.html?zfc=	skfp.exe	false	Avira URL Cloud: safe	unknown
http://192.168.29.37/hxfws-common/enterpriseService/toBind	skfp.exe	false	Avira URL Cloud: safe	unknown
http://192.168.29.37/hxfws-common/registEnterprise/regist51CloudProducthttp://192.168.29.37/hxfws-co	skfp.exe	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	skfp.exe	false		high
http://service.aisino.com/kprj?chat_id=&chat_name=CloudService_QDFPZSCloudService_QYZQJHskin%d	skfp.exe	false		high
http://tempuri.org/SimplyGetRegFile	skfp.exe	false	Avira URL Cloud: safe	unknown
https://fws.51fapiao.cn/hxfws-common/registEnterprise/regist51CloudProducthttps://fws.51fapiao.cn/hx	skfp.exe	false		high
https://openapi.51fapiao.cn/api/v1.0/51.invoice.deliverhttps://digi.aisino.com/api/v1.0/51.invoice.d	skfp.exe	false		high
https://digi.aisino.com/api/v1.0/51.formatfile.build	skfp.exe	false		high
https://fws.51fapiao.cn/hxfws-common/enterpriseService/options	skfp.exe	false		high
http://www.chinatax.gov.cn/tirip/dataspec/interfaces.xsd	skfp.exe	false	Avira URL Cloud: safe	unknown
https://inv-veri.chinatax.gov.cn/xgxz.html	skfp.exe	false	Avira URL Cloud: safe	unknown
http://service.aisino.com/announce/blog/notice?entTaxNum=	skfp.exe	false		high
http://192.168.29.37/hxfws-common/enterpriseService/platformItemInfo	skfp.exe	false	Avira URL Cloud: safe	unknown
https://127.0.0.1:7001	skfp.exe	false	Avira URL Cloud: safe	unknown
https://127.0.0.1:7002	skfp.exe	false	Avira URL Cloud: safe	unknown
http://192.168.29.37/hxfws-common/enterpriseService/ItemOrderInterface	skfp.exe	false	Avira URL Cloud: safe	unknown
http://service.aisino.com/kprj?chat_id=24_	skfp.exe	false		high
http://lwzc.aisino.com	skfp.exe	false		high
https://fws.51fapiao.cn/hxfws-common/enterpriseService/ItemOrderInterface	skfp.exe	false		high
https://inv-veri.chinatax.gov.cn/xgxz.htmlSkinMarginmainGroup	skfp.exe	false	Avira URL Cloud: safe	unknown
http://lwzc.aisino.com/GetRegSrc/GetRegSrc.asmx	skfp.exe	false		high
https://openapi.51fapiao.cn/accessToken/v1.0/get	skfp.exe	false		high
http://api-ibot.aisino.com/kprj/info/companyinfo/auth?authType=collect&entTaxNum=	skfp.exe	false		high
https://yun.51fapiao.cn/login.htm?para=	skfp.exe	false		high
http://www.i-tax.cn/SurveyQuestion/?sh=	skfp.exe	false	Avira URL Cloud: safe	unknown
http://192.168.29.37/hxfws-common/enterpriseService/options	skfp.exe	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	skfp.exe	false		high
http://www.i-tax.cn/LWZCManger/CheckRegisterInfo	skfp.exe	false	Avira URL Cloud: safe	unknown
https://tdps.aisino.com/wr/jdlsmsGetWifiVec-wifiArray:	skfp.exe	false		high
http://192.168.29.37/hxfws-common/enterpriseService/ItemOrderOperate	skfp.exe	false	Avira URL Cloud: safe	unknown
https://openapi.51fapiao.cn/accessToken/v1.0/loginhttps://digi.aisino.com/accessToken/v1.0/loginTEST	skfp.exe	false		high
http://172.19.1.107/GetRegSrc/GetRegSrc.asmx	skfp.exe	false	Avira URL Cloud: safe	unknown
http://192.168.29.37/hxfws-common/enterpriseService/optionshttp://fws.51fapiao.cn:8085/hxfws-common/	skfp.exe	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	skfp.exe	false		high
http://192.168.29.37/hxfws-common/enterpriseRegister/toRegistInfo	skfp.exe	false	Avira URL Cloud: safe	unknown
https://openapi.51fapiao.cn/api/v1.0/51.speedBilling.ultimate.feedback.add	skfp.exe	false		high
https://openapi.51fapiao.cn/accessToken/v1.0/login	skfp.exe	false		high
https://deliver.51fapiao.cn/deliver/deliver	skfp.exe	false		high
https://openapi.51fapiao.cn/api/v1.0/51.formatfile.build	skfp.exe	false		high
https://fws.51fapiao.cn/hxfws-common/enterpriseService/toBindhttp://192.168.29.37/hxfws-common/enter	skfp.exe	false		high
https://digi.aisino.com/api/v1.0/51.invoice.deliver	skfp.exe	false		high
http://service.aisino.com/api-kprj/info/companyinfo	skfp.exe	false		high
https://u.i-tax.cn/sys/pos/collect	skfp.exe	false	Avira URL Cloud: safe	unknown
http://172.19.1.107/	skfp.exe, 00000000.00000000.385777883.0000000005C7B000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://192.168.29.37/hxfws-common/registEnterprise/regist51CloudProduct	skfp.exe	false	Avira URL Cloud: safe	unknown
http://192.168.4.104:7020/acceptFramework/UniAcceptServiceCTptkcs.dllAisino	skfp.exe	false	Avira URL Cloud: safe	unknown
https://www.aisino.cn/introduction	skfp.exe	false	Avira URL Cloud: safe	unknown
http://service.aisino.com/kprj?chat_id=	skfp.exe	false		high
https://fws.51fapiao.cn/hxfws-common/enterpriseService/platformItemInfo	skfp.exe	false		high
http://tempuri.org/GetRegFile	skfp.exe	false	Avira URL Cloud: safe	unknown
https://fws.51fapiao.cn/hxfws-common/enterpriseService/queryDetailhttp://192.168.29.37/hxfws-common/	skfp.exe	false		high
http://www.i-tax.cn	skfp.exe	false	Avira URL Cloud: safe	unknown
https://tdps.aisino.com/wr/	skfp.exe	false		high
https://openapi.51fapiao.cn/api/v1.0/51.invoice.deliver	skfp.exe	false		high
http://tempuri.org/Test	skfp.exe	false	Avira URL Cloud: safe	unknown
https://fws.51fapiao.cn/hxfws-common/enterpriseService/queryDetail	skfp.exe	false		high
http://192.168.29.37/hxfws-common/enterpriseService/queryDetail	skfp.exe	false	Avira URL Cloud: safe	unknown
http://service.aisino.com/api-kprj/info/companyinfokprjtypename24_swTypeaddressNummachNumentTaxNumen	skfp.exe	false		high
http://curl.haxx.se/docs/http-cookies.html	skfp.exe	false		high
https://openapi.51fapiao.cn/api/v1.0/51.speedBilling.ultimate.prefixQueryhttps://digi.aisino.com/api	skfp.exe	false		high
http://fws.51fapiao.cn:8085/hxfws-common/enterpriseService/toBind	skfp.exe	false		high
https://digi.aisino.com/api/v1.0/51.speedBilling.ultimate.feedback.choose	skfp.exe	false		high
http://192.168.4.104:7020/acceptFramework/UniAcceptService	skfp.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	884321
Start date and time:	2023-06-08 17:56:02 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	skfp.exe
Detection:	CLEAN
Classification:	clean3.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: skfp.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.682790287679605
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	skfp.exe
File size:	95438112
MD5:	625015d57b994752c5544feb964216ae
SHA1:	71aadd64bf38e31539c216ba3e14172afbde7259
SHA256:	a477d22921573b5b5b3798eb673b3248d48a6aa32c538117ca43874b4142c183
SHA512:	2f43d2b20e2b0f8bea79ab7ea2b3791428edb1932cd59842e462cf7d0a35905360599ba270ce930b0f0fb651b33668a33a549e3379aa624e4771e41c87cc55b5
SSDEEP:	1572864:G1D4VEvrajIRkip7mZhhul5qE483ZWEyS5gt0Xnga7u00uluRCYnYnkidRIU2kfV:G1D4VEvra8RbpiZOvq1lJMgaXga7u0Pn
TLSH:	01280111FB85C431E54211F1A61CBB69836A79710B740AD3F3CE1E2E6FB16C29F34A66
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....ad..........#.......D..._...............E...@..........................p............ ................................

File Icon


Icon Hash:	2d3229243436362d

Static PE Info

General

Entrypoint:	0x4c9951a
Entrypoint Section:	.IK62
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6461B508 [Mon May 15 04:28:56 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	bd92fa524d441238fad42dd7a66122ae

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	12/26/2021 4:00:00 PM 1/2/2025 3:59:59 PM
Subject Chain	CN=\u822a\u5929\u4fe1\u606f\u80a1\u4efd\u6709\u9650\u516c\u53f8, O=\u822a\u5929\u4fe1\u606f\u80a1\u4efd\u6709\u9650\u516c\u53f8, S=\u5317\u4eac\u5e02, C=CN
Version:	3
Thumbprint MD5:	825AB654A9C3F30178E62D2E383900FF
Thumbprint SHA-1:	1AEC44347785C7F88F4002C937BD8F262F779EDB
Thumbprint SHA-256:	4D5C9601CA8F563AF8D74130176EE76DCFEEB7264981A013293C890FDBB7A370
Serial:	0937421CB5BB144BA49317CA2C8E40FC

Entrypoint Preview

Instruction
call 00007F8B08ACD117h
lea ecx, dword ptr [edx+ecx+085E77C4h]
inc ax
xor ebx, ecx
dec byte ptr [esp+edx*4-234C75D8h]
call 00007F8B08CEB6D6h
xor eax, FB9127A7h
mov edx, 8D020714h
ror eax, 02h
or dx, dx
inc eax
bswap eax
xor ebx, eax
mov dword ptr [esp], edx
add edi, eax
pop eax
pop eax
pop edx
pop edx
jmp edi
not dx
dec eax
mov dword ptr [esp+edx-72AD3B69h], ecx
xor ebx, eax
add esi, eax
xchg dword ptr [esp+04h], ecx
add ecx, FFB7195Bh
jmp ecx
lea edi, dword ptr [edi+eax*2-04h]
mov dword ptr [esp+eax*4+04h], edx
mov ecx, dword ptr [eax+edi]
ror ax, FFE3h
sar edx, FFFFFFB4h
xor ecx, ebx
add eax, 0E00D9BFh
sal edx, 59h
dec ecx
and dl, FFFFFF9Eh
xor ecx, 95A1953Bh
ror ecx, 03h
shl dx, 006Dh
call 00007F8B08ACBE47h
sub edi, 00000004h
mov ecx, 66162088h
movzx eax, cx
mov ecx, dword ptr [edi+eax*2-00004110h]
movsx edx, ax
lea eax, dword ptr [25BD0512h+eax*2]
xor ecx, ebx
jmp 00007F8B08B13626h
movzx eax, cx
add edi, edx
mov dword ptr [esp+ecx], edi
retn 0004h
pop edx
add edx, 00123220h
jmp edx
dec ecx
mov ecx, dword ptr [ebx]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1921b00	0xaa7	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4794e20	0x348	.IK62
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4bb9000	0xf7d1b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x5aff600	0x4f20	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4bb8720	0x40	.IK62
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x45c6000	0x164	.IK61
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x144f582	0x144f600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1451000	0x4d808e	0x4d8200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x192a000	0x79688	0x47200	False	0.19967184753954306	DOS executable (block device driver)	5.434386906471729	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.IK60	0x19a4000	0x2c21480	0x2c21600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.IK61	0x45c6000	0x16f0	0x1800	False	0.0419921875	data	0.35565413400060863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.IK62	0x45c8000	0x5f0770	0x5f0800	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4bb9000	0xf7d1b0	0xf7d200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
BKIMG	0x4bc3eb8	0x17ffa	PNG image data, 1365 x 727, 8-bit/color RGBA, non-interlaced	Chinese	China
BKIMG	0x4bdbeb4	0x56342	PNG image data, 1382 x 726, 8-bit/color RGBA, non-interlaced	Chinese	China
BKIMG	0x4c321f8	0x44c	PNG image data, 840 x 40, 8-bit/color RGB, non-interlaced	Chinese	China
BKIMG	0x4c32644	0x11f	PNG image data, 348 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China
BKIMG	0x4c32764	0x3f8f	PNG image data, 44 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China
DC_EXE	0x4c366f4	0x3aac00	PE32 executable (GUI) Intel 80386, for MS Windows	Chinese	China
DC_EXE	0x4fe12f4	0x3aa800	PE32 executable (GUI) Intel 80386, for MS Windows	Chinese	China
GIF	0x538baf4	0x2125	GIF image data, version 89a, 66 x 66	Chinese	China
IMG	0x538dc1c	0xa54	PNG image data, 42 x 14, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x538e670	0x715	PNG image data, 108 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x538ed88	0x6e8	PNG image data, 108 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x538f470	0x855	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x538fcc8	0x89e	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5390568	0x973	PNG image data, 63 x 21, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5390edc	0x8bc	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5391798	0x805	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5391fa0	0x258	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53921f8	0x643	PNG image data, 360 x 35, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x539283c	0x707	PNG image data, 108 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5392f44	0x6d4	PNG image data, 108 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5393618	0x7b8	PNG image data, 360 x 35, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5393dd0	0x158	PNG image data, 21 x 21, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5393f28	0x1eeb	PNG image data, 1243 x 647, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5395e14	0xcb8	PNG image data, 450 x 482, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5396acc	0xcb8	PNG image data, 450 x 482, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5397784	0xd15d	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53a48e4	0xd346	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53b1c2c	0xd728	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53bf354	0x10271	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53cf5c8	0xdd8d	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53dd358	0xd3ff	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53ea758	0xd2ad	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53f7a08	0x6c7	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53f80d0	0x6b5	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53f8788	0x681	PNG image data, 51 x 51, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53f8e0c	0x65d	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53f946c	0xb8	PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53f9524	0x543	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53f9a68	0x43a4	PNG image data, 200 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53fde0c	0xafb	PNG image data, 195 x 535, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53fe908	0xb33	PNG image data, 387 x 380, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x53ff43c	0xcee6	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x540c324	0xdd6e	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x541a094	0xd231	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x54272c8	0xd034	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x54342fc	0xc14c	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5440448	0xcb62	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x544cfac	0xcb43	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5459af0	0xc444	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5465f34	0xd804	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5473738	0xcb8	PNG image data, 450 x 482, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x54743f0	0xaed	PNG image data, 246 x 482, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5474ee0	0xe061	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5482f44	0xe9b3	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x54918f8	0xe153	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x549fa4c	0xcee6	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x54ac934	0xe5a9	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x54baee0	0xf26d	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x54ca150	0xe84b	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x54d899c	0xedd6	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x54e7774	0x1a010	PNG image data, 924 x 603, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5501784	0x198c7	PNG image data, 924 x 603, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x551b04c	0x16e0a	PNG image data, 934 x 686, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5531e58	0x3ea18	PNG image data, 938 x 686, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5570870	0x5e3b	PNG image data, 105 x 49, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x55766ac	0x1332	PNG image data, 172 x 48, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x55779e0	0x714e	PNG image data, 172 x 48, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x557eb30	0x48b51	PNG image data, 1000 x 646, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x55c7684	0x132e4	PNG image data, 945 x 628, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x55da968	0xb6fd	PNG image data, 869 x 603, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x55e6068	0x24fba	PNG image data, 998 x 646, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x560b024	0x13190	PNG image data, 945 x 628, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x561e1b4	0xb45	PNG image data, 387 x 380, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x561ecfc	0x534	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x561f230	0xcee6	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x562c118	0xd1f6	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5639310	0xdd6e	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5647080	0xd231	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x56542b4	0xd034	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x56612e8	0x529	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5661814	0x59f	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5661db4	0xc444	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x566e1f8	0x60b	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x566e804	0x25ce	PNG image data, 195 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5670dd4	0x291	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5671068	0x436	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x56714a0	0xddf3	PNG image data, 924 x 603, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x567f294	0x10b77	PNG image data, 924 x 603, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x568fe0c	0xdd72	PNG image data, 924 x 603, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x569db80	0x10a1d	PNG image data, 924 x 603, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x56ae5a0	0xb6f5	PNG image data, 869 x 603, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x56b9c98	0xa6b3	PNG image data, 869 x 603, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x56c434c	0xb95f	PNG image data, 924 x 603, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x56cfcac	0x1055f	PNG image data, 924 x 603, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x56e020c	0x55e8	PNG image data, 924 x 603, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x56e57f4	0x301	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x56e5af8	0x41a	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x56e5f14	0xb95f	PNG image data, 924 x 603, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x56f1874	0x1023a	PNG image data, 924 x 603, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5701ab0	0x256	PNG image data, 23 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5701d08	0x29c	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5701fa4	0x1a3	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5702148	0x4c0	PNG image data, 21 x 21, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5702608	0x15a	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5702764	0x756d	PNG image data, 183 x 159, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5709cd4	0x2ff	PNG image data, 21 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5709fd4	0xe58	PNG image data, 202 x 50, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x570ae2c	0x4176	PNG image data, 118 x 24, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x570efa4	0x1332	PNG image data, 150 x 50, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57102d8	0x1fa2	PNG image data, 150 x 50, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x571227c	0x516	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5712794	0x526	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5712cbc	0x51b	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57131d8	0x5f2	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57137cc	0x5cc	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5713d98	0x44ff	PNG image data, 1366 x 593, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5718298	0x21f3	PNG image data, 348 x 103, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x571a48c	0x23a6	PNG image data, 348 x 103, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x571c834	0x9b33	PNG image data, 348 x 103, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5726368	0x4d5	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5726840	0x9473	PNG image data, 348 x 103, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x572fcb4	0x91bb	PNG image data, 348 x 103, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5738e70	0xbab	PNG image data, 46 x 45, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5739a1c	0x96e2	PNG image data, 348 x 103, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5743100	0x4e37	PNG image data, 150 x 50, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5747f38	0x4f78	PNG image data, 150 x 50, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x574ceb0	0x4d23	PNG image data, 150 x 50, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5751bd4	0x3dd	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5751fb4	0x3c5	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x575237c	0x40c	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5752788	0x9d21	PNG image data, 348 x 103, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x575c4ac	0x3f6	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x575c8a4	0x4dc	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x575cd80	0xa361	PNG image data, 348 x 103, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57670e4	0xa626	PNG image data, 348 x 103, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x577170c	0x4e37	PNG image data, 150 x 50, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5776544	0x693	PNG image data, 1366 x 135, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x5776bd8	0x3db3	PNG image data, 132 x 40, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x577a98c	0x48d	PNG image data, 1366 x 40, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x577ae1c	0x11f	PNG image data, 348 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x577af3c	0xeb	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x577b028	0xbb	PNG image data, 16 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x577b0e4	0x3d1e	PNG image data, 132 x 40, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x577ee04	0x2115	PNG image data, 116 x 103, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x5780f1c	0x8c5	PNG image data, 420 x 310, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57817e4	0xb33	PNG image data, 387 x 380, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5782318	0xafb	PNG image data, 195 x 535, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5782e14	0xbfd3	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x578ede8	0xca64	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x579b84c	0xc6bc	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57a7f08	0xc14c	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57b4054	0xc8ca	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57c0920	0xd253	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57cdb74	0xc6b2	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57da228	0x15a	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57da384	0x232	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57da5b8	0x22f	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57da7e8	0xbdd	PNG image data, 72 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57db3c8	0x48f	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57db858	0xb5	PNG image data, 88 x 25, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57db910	0x15d	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57dba70	0x29c	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57dbd0c	0x36a	PNG image data, 21 x 14, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57dc078	0x488	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57dc500	0x2a7	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57dc7a8	0x2ff	PNG image data, 21 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57dcaa8	0x15f	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57dcc08	0x290	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57dce98	0xcb6	PNG image data, 450 x 482, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57ddb50	0xb6db	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57e922c	0xb54f	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x57f477c	0xbb76	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x58002f4	0xb58b	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x580b880	0xb96f	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x58171f0	0xb2ee	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x58224e0	0xb5d1	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x582dab4	0x15a	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x582dc10	0xed	PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x582dd00	0x411	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x582e114	0xdf	PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x582e1f4	0x59	PNG image data, 1 x 323, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x582e250	0x786	PNG image data, 58 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x582e9d8	0xa01	PNG image data, 613 x 200, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x582f3dc	0xa01	PNG image data, 613 x 200, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x582fde0	0xe212	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x583dff4	0xdd84	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x584bd78	0xda84	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x58597fc	0xd783	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5866f80	0xdefd	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5874e80	0xe206	PNG image data, 460 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5883088	0x241c3	PNG image data, 800 x 427, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x58a724c	0x2b71b	PNG image data, 800 x 427, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x58d2968	0x1c98d	PNG image data, 800 x 427, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x58ef2f8	0x939	PNG image data, 57 x 28, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x58efc34	0x1664b	PNG image data, 800 x 427, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5906280	0x1551d	PNG image data, 800 x 427, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x591b7a0	0x9f6	PNG image data, 57 x 28, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x591c198	0x178d5	PNG image data, 800 x 427, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5933a70	0x1505	PNG image data, 300 x 37, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5934f78	0xc1d	PNG image data, 300 x 36, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5935b98	0x37176	PNG image data, 180 x 590, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x596cd10	0x30c	PNG image data, 66 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x596d01c	0x6a9	PNG image data, 114 x 36, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x596d6c8	0x292	PNG image data, 45 x 9, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x596d95c	0x9ff0	PNG image data, 870 x 540, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x597794c	0xd821	PNG image data, 870 x 540, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5985170	0x72f	PNG image data, 480 x 44, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59858a0	0x167	PNG image data, 114 x 36, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5985a08	0x346	PNG image data, 66 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5985d50	0x314	PNG image data, 66 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x5986064	0xcca	PNG image data, 30 x 30, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x5986d30	0x8d3a	PNG image data, 560 x 170, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x598fa6c	0x10be	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel	Chinese	China
IMG	0x5990b2c	0xa9	PNG image data, 455 x 10, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x5990bd8	0xbbec	PNG image data, 450 x 115, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x599c7c4	0x8b	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x599c850	0xc46	PNG image data, 30 x 30, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x599d498	0xca0	PNG image data, 30 x 30, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x599e138	0x127e2	PNG image data, 400 x 196, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59b091c	0xcb3	PNG image data, 44 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59b15d0	0xc99	PNG image data, 24 x 44, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59b226c	0x306	PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59b2574	0x9b1	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59b2f28	0x672	PNG image data, 52 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59b359c	0xb61	PNG image data, 18 x 4, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59b4100	0x5dc	PNG image data, 8 x 9, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59b46dc	0x5f5	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59b4cd4	0x691b	PNG image data, 348 x 103, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59bb5f0	0x7fb	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59bbdec	0x8e8	PNG image data, 128 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59bc6d4	0x8ca	PNG image data, 144 x 48, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59bcfa0	0x816	PNG image data, 38 x 46, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59bd7b8	0x1cb	PNG image data, 345 x 115, 8-bit/color RGB, non-interlaced	Chinese	China
IMG	0x59bd984	0x2c2	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59bdc48	0x81b	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59be464	0x83d	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
IMG	0x59beca4	0x7a0	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
LAYOUT	0x59bf444	0x47b	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59bf8c0	0x43d	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59bfd00	0x4b1	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59c01b4	0x35c9	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (317)	Chinese	China
LAYOUT	0x59c3780	0xa70	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59c41f0	0xba4f	Unicode text, UTF-8 text, with very long lines (312)	Chinese	China
LAYOUT	0x59cfc40	0x8a24	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (324)	Chinese	China
LAYOUT	0x59d8664	0x4a6	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (373)	Chinese	China
LAYOUT	0x59d8b0c	0x9ec	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (334)	Chinese	China
LAYOUT	0x59d94f8	0xa02	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59d9efc	0x14ac	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59db3a8	0x7c1	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59dbb6c	0xc8e	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (332)	Chinese	China
LAYOUT	0x59dc7fc	0x6af	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (355)	Chinese	China
LAYOUT	0x59dceac	0xa7b	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59dd928	0x5e4	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59ddf0c	0x554	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59de460	0xa46	exported SGML document, Unicode text, UTF-8 (with BOM) text	Chinese	China
LAYOUT	0x59deea8	0x7e3	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59df68c	0x73b	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59dfdc8	0xffc0	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59efd88	0x11b5	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59f0f40	0x642	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59f1584	0x1118	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59f269c	0x3160	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59f57fc	0x1f51	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59f7750	0x20f2	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59f9844	0x22e5	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59fbb2c	0x1afb	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x59fd628	0x66f4	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (325)	Chinese	China
LAYOUT	0x5a03d1c	0x702	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a04420	0x3219	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a0763c	0x81e	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a07e5c	0x1017	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a08e74	0x3472	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a0c2e8	0x374b	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (317)	Chinese	China
LAYOUT	0x5a0fa34	0x10e4	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a10b18	0x81b	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a11334	0xd26	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (370)	Chinese	China
LAYOUT	0x5a1205c	0x10cd	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a1312c	0x537	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a13664	0x76f	XML 1.0 document, Unicode text, UTF-8 (with BOM) text	Chinese	China
LAYOUT	0x5a13dd4	0x7ec	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a145c0	0x6d6	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a14c98	0x4f3	Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a1518c	0x5e5	Unicode text, UTF-8 text, with CRLF line terminators	Chinese	China
LAYOUT	0x5a15774	0x715	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a15e8c	0xf72	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a16e00	0xd84	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a17b84	0x479	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a18000	0x5e6	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a185e8	0x993	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a18f7c	0x15f9	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a1a578	0x675	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators	Chinese	China
LAYOUT	0x5a1abf0	0x3b27	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a1e718	0x917	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a1f030	0x677	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a1f6a8	0x6b1	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a1fd5c	0x1be7	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (323), with CRLF line terminators	Chinese	China
LAYOUT	0x5a21944	0x1135	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a22a7c	0x3dfc	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a26878	0x614	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a26e8c	0xb26	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a279b4	0x5ed	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a27fa4	0x296e	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a2a914	0x95a	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a2b270	0x79a	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators	Chinese	China
LAYOUT	0x5a2ba0c	0xb6b	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators	Chinese	China
LAYOUT	0x5a2c578	0x981	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators	Chinese	China
LAYOUT	0x5a2cefc	0x8c1	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a2d7c0	0x89f	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators	Chinese	China
LAYOUT	0x5a2e060	0x5c4	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators	Chinese	China
LAYOUT	0x5a2e624	0x90a	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators	Chinese	China
LAYOUT	0x5a2ef30	0x53e	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators	Chinese	China
LAYOUT	0x5a2f470	0x6d45	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a361b8	0x2a88	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a38c40	0x519	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a3915c	0xa68	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a39bc4	0x3312	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a3ced8	0x728	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a3d600	0x62c3	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a438c4	0x6b9	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a43f80	0x489	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a4440c	0x61f	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a44a2c	0x9fd	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a4542c	0x130c	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a46738	0x1643	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a47d7c	0x41b9	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a4bf38	0x33a0	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a4f2d8	0x309b	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a52374	0x248c	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a54800	0x6af6	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (365)	Chinese	China
LAYOUT	0x5a5b2f8	0x5a8	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a5b8a0	0x55a	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a5bdfc	0x486	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a5c284	0x684	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a5c908	0xe9e	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a5d7a8	0x104a	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a5e7f4	0x598	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a5ed8c	0x9d8	exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators	Chinese	China
LAYOUT	0x5a5f764	0x8fd	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a60064	0x4dc	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a60540	0x91e	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a60e60	0x17cf	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a62630	0x1862	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a63e94	0xd3f	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a64bd4	0x1c2f	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a66804	0x152c	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a67d30	0xa79	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a687ac	0x1510	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a69cbc	0x10fb	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a6adb8	0x1276	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a6c030	0x5f4	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a6c624	0x90d	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a6cf34	0x676	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a6d5ac	0x19a0	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a6ef4c	0xff9	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a6ff48	0x3e84	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a73dcc	0x871	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a74640	0x1300	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a75940	0x26f2	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a78034	0xb20	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a78b54	0xd39	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a79890	0x1564	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a7adf4	0x1309	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a7c100	0x1e44	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a7df44	0x97c	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a7e8c0	0x18f0	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a801b0	0x18d7	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a81a88	0xcac	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a82734	0x2230	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a84964	0x28b5	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a8721c	0x93e	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a87b5c	0xd72	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a888d0	0x2604	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a8aed4	0x25c8	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a8d49c	0x141	ASCII text, with CRLF line terminators	Chinese	China
LAYOUT	0x5a8d5e0	0x2675	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a8fc58	0x59a	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a901f4	0x639	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a90830	0x853	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a91084	0x861	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a918e8	0x1fcc	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a938b4	0x2215	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (344)	Chinese	China
LAYOUT	0x5a95acc	0x638	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (333)	Chinese	China
LAYOUT	0x5a96104	0xc8c	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a96d90	0xc0e	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a979a0	0x1b93	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a99534	0x157e	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a9aab4	0xbfe	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a9b6b4	0x2b9d	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5a9e254	0x36fb	Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5aa1950	0x310f	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5aa4a60	0x114a	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5aa5bac	0xaf9	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5aa66a8	0xb2c	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5aa71d4	0x1a6b	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5aa8c40	0x140f	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5aaa050	0xa2c	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5aaaa7c	0x7e4	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5aab260	0x15f8	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5aac858	0x539	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5aacd94	0xd57	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5aadaec	0x2efa	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ab09e8	0x3102	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ab3aec	0x177c	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ab5268	0x6f2	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ab595c	0x2357	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ab7cb4	0x7e4	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ab8498	0x1af6	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ab9f90	0x9c0	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5aba950	0xe39	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5abb78c	0x2118	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5abd8a4	0xe67	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5abe70c	0x328f	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ac199c	0x1754	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ac30f0	0x98a	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ac3a7c	0x7f9	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ac4278	0x193c	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ac5bb4	0x11ec	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ac6da0	0x1d0c	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ac8aac	0x94e	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ac93fc	0x513	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ac9910	0xdd9	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5aca6ec	0x420	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5acab0c	0x55b	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (321)	Chinese	China
LAYOUT	0x5acb068	0x423	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5acb48c	0x537	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (305)	Chinese	China
LAYOUT	0x5acb9c4	0x6f5	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (388)	Chinese	China
LAYOUT	0x5acc0bc	0x417c	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (328)	Chinese	China
LAYOUT	0x5ad0238	0x9da	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad0c14	0x320	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad0f34	0x861	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad1798	0x42d	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad1bc8	0xc79	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad2844	0x129b	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad3ae0	0x86c	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad434c	0xb98	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad4ee4	0xc6	XML 1.0 document, ASCII text	Chinese	China
LAYOUT	0x5ad4fac	0x888	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad5834	0xad4	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad6308	0x803	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad6b0c	0x4f0	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad6ffc	0x946	exported SGML document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad7944	0x45f	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad7da4	0x8ca	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (561)	Chinese	China
LAYOUT	0x5ad8670	0x88d	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (508)	Chinese	China
LAYOUT	0x5ad8f00	0x98e	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad9890	0x5fd	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5ad9e90	0x11db	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
LAYOUT	0x5adb06c	0xadc	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
PNG	0x5adbb48	0x4a8	PNG image data, 52 x 26, 8-bit/color RGB, non-interlaced	Chinese	China
PNG	0x5adbff0	0x108f	PNG image data, 114 x 25, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5add080	0xe73	PNG image data, 108 x 25, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5addef4	0xd7c	PNG image data, 108 x 25, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5adec70	0x3ee7	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5ae2b58	0x1fa	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5ae2d54	0xf37	PNG image data, 108 x 25, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5ae3c8c	0xdb9	PNG image data, 120 x 15, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5ae4a48	0xcf2	PNG image data, 48 x 16, 8-bit/color RGB, non-interlaced	Chinese	China
PNG	0x5ae573c	0xb1f	PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5ae625c	0xcdf	PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5ae6f3c	0x715	PNG image data, 360 x 35, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5ae7654	0x1867	PNG image data, 192 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5ae8ebc	0xb79	PNG image data, 32 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5ae9a38	0xb87	PNG image data, 26 x 26, 8-bit/color RGB, non-interlaced	Chinese	China
PNG	0x5aea5c0	0xdd0	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5aeb390	0xaf7	PNG image data, 50 x 2, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5aebe88	0xb97	PNG image data, 200 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5aeca20	0xe6	PNG image data, 9 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5aecb08	0x1ca	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5aeccd4	0x1163	PNG image data, 120 x 15, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5aede38	0x1361	PNG image data, 144 x 48, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5aef19c	0x1650	PNG image data, 80 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5af07ec	0xd14	PNG image data, 15 x 30, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5af1500	0xd0a	PNG image data, 15 x 30, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5af220c	0xc37	PNG image data, 85 x 6, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5af2e44	0xc3c	PNG image data, 6 x 85, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5af3a80	0x3fa	PNG image data, 282 x 38, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5af3e7c	0xfc8	PNG image data, 153 x 17, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5af4e44	0x186	PNG image data, 162 x 18, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5af4fcc	0xca2	PNG image data, 102 x 17, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5af5c70	0xb67	PNG image data, 8 x 9, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5af67d8	0x1ca	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China
PNG	0x5af69a4	0x50f	PNG image data, 13 x 85, 8-bit/color RGBA, non-interlaced	Chinese	China
RTF	0x5af6eb4	0x18c58	Rich Text Format data, version 1, ANSI, code page 936, default middle east language ID 1025	Chinese	China
RTF	0x5b0fb0c	0xdb9e	Rich Text Format data, version 1, ANSI, code page 936, default middle east language ID 1025	Chinese	China
RTF	0x5b1d6ac	0x83e5	Rich Text Format data, version 1, ANSI, code page 936, default language ID 1033	Chinese	China
SMENU	0x5b25a94	0x22c	exported SGML document, Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b25cc0	0x198	exported SGML document, Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b25e58	0x2f1	exported SGML document, Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b2614c	0x1e0	exported SGML document, Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b2632c	0x12d	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b2645c	0x23c	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b26698	0x21a	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China
SMENU	0x5b268b4	0x134	exported SGML document, Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b269e8	0x627	exported SGML document, Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b27010	0x11b	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b2712c	0x1b6	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b272e4	0x123	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b27408	0x180	exported SGML document, Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b27588	0x264	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b277ec	0x315	exported SGML document, Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b27b04	0x122	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b27c28	0x120	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b27d48	0x12a	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b27e74	0x1c4	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b28038	0x1c3	exported SGML document, Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b281fc	0x161	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b28360	0x11f	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b28480	0x11c	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b2859c	0xd9	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b28678	0x112	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b2878c	0xa0	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b2882c	0x261	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b28a90	0xc6	Unicode text, UTF-8 (with BOM) text	Chinese	China
SMENU	0x5b28b58	0x358	Unicode text, UTF-8 (with BOM) text	Chinese	China
TRANSLATOR	0x5b28eb0	0x52a	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
UIDEF	0x5b293dc	0x91d	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China
VALUES	0x5b29cfc	0x17f	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China
VALUES	0x5b29e7c	0x5a7f	XML 1.0 document, Unicode text, UTF-8 text	Chinese	China
VALUES	0x5b2f8fc	0x2f0d	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China
XML	0x5b3280c	0x126	ASCII text	Chinese	China
XML	0x5b32934	0x6e5	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China
XML	0x5b3301c	0xbbd	ASCII text	Chinese	China
RT_ICON	0x5b33bdc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	Chinese	China
RT_ICON	0x5b34c84	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	Chinese	China
RT_GROUP_ICON	0x5b35d2c	0x14	data	Chinese	China
RT_GROUP_ICON	0x5b35d40	0x14	data	Chinese	China
RT_VERSION	0x5b35d54	0x2d4	data	Chinese	China
RT_MANIFEST	0x5b36028	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
SOFC.dll	aisino_PKCS7_getLastError
LibcurlDLL.dll	_aisino_acceptFramework_call_single_with_proxy@68
CRYPT32.dll	CryptFormatObject
zlib1.dll	compress
libxls.dll
WS2_32.dll	send
PDFToX.dll	GetBase64Size
fofdgsdk32.dll	OfdParam_Init
WLDAP32.dll
KERNEL32.dll	GetVersion, GetVersionExA, GetVersionExW
USER32.dll	GetCapture
GDI32.dll	CreateSolidBrush
COMDLG32.dll	GetSaveFileNameW
ADVAPI32.dll	CryptCreateHash
SHELL32.dll	SHAppBarMessage
ole32.dll	StgCreateDocfile
OLEAUT32.dll	SysStringByteLen
SHLWAPI.dll	PathFindExtensionA
WINTRUST.dll	CryptCATAdminReleaseCatalogContext
IMM32.dll	ImmSetCompositionWindow
MSIMG32.dll	TransparentBlt
gdiplus.dll	GdipSaveImageToFile
log4cxx.dll	?aprintf1@@YAXPADZZ
urlmon.dll	URLDownloadToFileA
SM2_soft_miracl_Dll.dll
IPHLPAPI.DLL	GetAdaptersInfo
CRYP_API.dll	Crypt_CloseDevice
decodecert.dll	GetCertInfo
TAPKFRSHClt.dll	RSH_DllAppAuth
PSAPI.DLL	GetProcessImageFileNameA
COMCTL32.dll	ImageList_ReplaceIcon
UxTheme.dll	DrawThemeText
oledlg.dll
SETUPAPI.dll	SetupDiDestroyDeviceInfoList
CRYPTUI.dll	CryptUIDlgSelectCertificateFromStore
OLEACC.dll	CreateStdAccessibleObject
WININET.dll	InternetCrackUrlA
WINMM.dll	PlaySoundA
WINSPOOL.DRV	OpenPrinterA
KERNEL32.dll	GetSystemTimeAsFileTime
KERNEL32.dll	HeapAlloc, HeapFree, ExitProcess, LoadLibraryA, GetModuleHandleA, GetProcAddress

Exports

Name	Ordinal	Address
_cJSON_AddArrayToObject@8	1	0x974be0
_cJSON_AddBoolToObject@12	2	0x9748d0
_cJSON_AddFalseToObject@8	3	0x974820
_cJSON_AddItemReferenceToArray@8	4	0x974620
_cJSON_AddItemReferenceToObject@12	5	0x974680
_cJSON_AddItemToArray@8	6	0x974450
_cJSON_AddItemToObject@12	7	0x974540
_cJSON_AddItemToObjectCS@12	8	0x9745b0
_cJSON_AddNullToObject@8	9	0x9746c0
_cJSON_AddNumberToObject@16	10	0x974980
_cJSON_AddObjectToObject@8	11	0x974b30
_cJSON_AddRawToObject@12	12	0x974aa0
_cJSON_AddStringToObject@12	13	0x974a10
_cJSON_AddTrueToObject@8	14	0x974770
_cJSON_Compare@12	15	0x975a90
_cJSON_CreateArray@0	16	0x975370
_cJSON_CreateArrayReference@4	17	0x9752a0
_cJSON_CreateBool@4	18	0x9750d0
_cJSON_CreateDoubleArray@8	19	0x975550
_cJSON_CreateFalse@0	20	0x9750a0
_cJSON_CreateFloatArray@8	21	0x975490
_cJSON_CreateIntArray@8	22	0x9753d0
_cJSON_CreateNull@0	23	0x975040
_cJSON_CreateNumber@8	24	0x975110
_cJSON_CreateObject@0	25	0x9753a0
_cJSON_CreateObjectReference@4	26	0x975260
_cJSON_CreateRaw@4	27	0x9752e0
_cJSON_CreateString@4	28	0x975190
_cJSON_CreateStringArray@8	29	0x975610
_cJSON_CreateStringReference@4	30	0x975220
_cJSON_CreateTrue@0	31	0x975070
_cJSON_Delete@4	32	0x9727e0
_cJSON_DeleteItemFromArray@8	33	0x974d50
_cJSON_DeleteItemFromObject@8	34	0x974df0
_cJSON_DeleteItemFromObjectCaseSensitive@8	35	0x974e20
_cJSON_DetachItemFromArray@8	36	0x974d00
_cJSON_DetachItemFromObject@8	37	0x974db0
_cJSON_DetachItemFromObjectCaseSensitive@8	38	0x974dd0
_cJSON_DetachItemViaPointer@8	39	0x974c90
_cJSON_Duplicate@8	40	0x9756c0
_cJSON_GetArrayItem@8	41	0x9741d0
_cJSON_GetArraySize@4	42	0x974180
_cJSON_GetErrorPtr@0	43	0x972590
_cJSON_GetNumberValue@4	44	0x9725d0
_cJSON_GetObjectItem@8	45	0x974330
_cJSON_GetObjectItemCaseSensitive@8	46	0x974350
_cJSON_GetStringValue@4	47	0x9725a0
_cJSON_HasObjectItem@8	48	0x974370
_cJSON_InitHooks@4	49	0x972730
_cJSON_InsertItemInArray@12	50	0x974e50
_cJSON_IsArray@4	51	0x975a30
_cJSON_IsBool@4	52	0x9759b0
_cJSON_IsFalse@4	53	0x975970
_cJSON_IsInvalid@4	54	0x975950
_cJSON_IsNull@4	55	0x9759d0
_cJSON_IsNumber@4	56	0x9759f0
_cJSON_IsObject@4	57	0x975a50
_cJSON_IsRaw@4	58	0x975a70
_cJSON_IsString@4	59	0x975a10
_cJSON_IsTrue@4	60	0x975990
_cJSON_Minify@4	61	0x975890
_cJSON_Parse@4	62	0x9735f0
_cJSON_ParseWithLength@8	63	0x973630
_cJSON_ParseWithLengthOpts@16	64	0x9734c0
_cJSON_ParseWithOpts@12	65	0x973480
_cJSON_Print@4	66	0x973750
_cJSON_PrintBuffered@12	67	0x973790
_cJSON_PrintPreallocated@16	68	0x973850
_cJSON_PrintUnformatted@4	69	0x973770
_cJSON_ReplaceItemInArray@12	70	0x974f40
_cJSON_ReplaceItemInObject@12	71	0x975000
_cJSON_ReplaceItemInObjectCaseSensitive@12	72	0x975020
_cJSON_ReplaceItemViaPointer@12	73	0x974ec0
_cJSON_SetNumberHelper@12	74	0x9729e0
_cJSON_SetValuestring@8	75	0x972a40
_cJSON_Version@0	76	0x972600
_cJSON_free@4	77	0x975d70
_cJSON_malloc@4	78	0x975d50

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

• skfp.exe

Click to jump to process

Memory Usage

• skfp.exe

Click to jump to process

Target ID:	0
Start time:	17:56:59
Start date:	08/06/2023
Path:	C:\Users\user\Desktop\skfp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\skfp.exe
Imagebase:	0x400000
File size:	95438112 bytes
MD5 hash:	625015D57B994752C5544FEB964216AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report skfp.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: skfp.exePID: 5936, Parent PID: 3452

General

File Activities

File Opened

File Attributes Queried

Volume Information Queried

Section Activities

Sections loaded by Windows

Registry Activities

Key Opened

Key Value Queried

Windows Analysis Report
skfp.exe