win7-sp1-x64-3 win7-sp1-x64-3 KVM :47: :02: Adware

魔盾安全分析报告 分析类型 开始时间 结束时间 持续时间 分析引擎版本 FILE 2016-10-09 03:47:10 2016-10-09 04:02:31 921 秒 1.4-Maldun 虚拟机机器名 标签 虚拟机管理 开机时间 关机时间 win7-sp1-x64-3 win7-sp1-x64-3 KVM 2016-10-09 03:47:43 2016-10-09 04:02:31 魔盾分数 10.0 Adware 文件详细信息 文件名 文件大小 文件类型 CRC32 MD5 SHA1 SHA256 SHA512 Ssdeep PEiD 59533f5a8068103585dcb4b8a1c9d4bf.exe 417760 字节 PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows 5B7B6700 59533f5a8068103585dcb4b8a1c9d4bf 3b64992d8c4b30cc9d25125319abbce4bdac15ab 6bee4ece57d01f10d982edcf492ecc1d3124d16b978169782878120fced4b58b 1a2aab5f84cd49287d24fda66639c7c496fcb0e4f3c38568b4eddb03fa42a283f27984f5e5348628187dda1d452c311411fe8de705598279c34c990e888cc69a 6144:Zcq+e7rYyA9LnYQmqHSLqnkWcpWyuly7gOG61DhhnRyctjXwg5N9j6al:mqr49LnY+VjyQADhhnlT56M 无匹配 Yara DebuggerException ConsoleCtrl () ThreadControl Context () VirusTotal VirusTotal 链接 VirusTotal 扫描时间 : 2016-10-07 08:25:44 扫描结果 : 29/56 特征 创建 RWX 内存 二进制源中出现非常规语言 : Russian 文件已被至少十个 VirusTotal 上的反病毒引擎检测为病毒 Bkav: W32.HfsAdware.607E McAfee: Artemis!59533F5A8068 Malwarebytes: Adware.RuKometa Zillya: Adware.RuKoma.Win32.3 AegisLab: Virus.W32.Heim!c K7GW: Adware ( 004f4bb01 ) K7AntiVirus: Adware ( 004f4bb01 ) Invincea: trojandropper.win32.gepys.a Baidu: Win32.Trojan.WisdomEyes.151026.9950.9996 Symantec: Trojan.Gen.2 ESET-NOD32: a variant of Win32/Adware.RuKoma.A Avast: Win32:Adware-gen [Adw] Tencent: Win32.Adware.Malware.Wtnu Comodo: UnclassifiedMalware DrWeb: Trojan.MulDrop6.49360 VIPRE: Trojan.Win32.Generic!BT McAfee-GW-Edition: Artemis!PUP Cyren: W32/Adware.UGEM-0377 Jiangmin: Adware.Agent.vwb Avira: ADWARE/RuKoma.zwjs Antiy-AVL: Trojan/Win32.TSGeneric ViRobot: Adware.Rukoma.417760[h] ALYac: Gen:Variant.Razy.84088 AVware: Trojan.Win32.Generic!BT Rising: Malware.Generic!IIQXDp6pNUF@2 (thunder) Yandex: PUA.RuKoma! Ikarus: PUA.Adstantinko AVG: Win32/Heim.A CrowdStrike: malicious_confidence_98% (W) 运行截图 网络分析

TCP 连接 IP 地址 端口 178.255.83.1 80 UDP 连接 IP 地址 端口 192.168.122.72 53440 192.168.122.72 62955 192.168.122.72 53440 192.168.122.72 62955 192.168.122.72 53440 192.168.122.72 62955 HTTP 请求 URL http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbssdxxdg447ymkrnpvviulv3rkbzqqukzfg%2f4pn%2buv5pmq4z%2fnms71jzhiceho6kcjshz9aa9ea1ytomxy%3d HTTP 数据 GE T / MF Ew Tz BN ME sw ST AJB gu rd gm CG gu AB BS Sd xx dg 44 7y mk RN PV Vi UL v3r kb zq QU KZ Fg %2 F4 pn %2 Bu v5 pm q4 z% 2F nm S7 1Jz hic EH O6

kcj SH z9 Aa 9E A1 yt om XY %3 D HT TP/ 1.1 Co nn ect ion : K ee p-a liv e Ac ce pt: */* Us er- Ag ent : M icr os oft -Cr ypt oa PI/ 6.1 Ho st: ocs p.c om od oc a.c om 静态分析 PE 信息 初始地址 入口地址 声明校验值 实际校验值 0x00400000 0x00402230 0x0006b88b 0x0006b88b 最低操作系统版本要求 5.0 编译时间 2016-07-21 18:37:56 PE 数据组成 名称 虚拟地址 虚拟大小 原始数据大小 特征 熵 (Entropy).text 0x00001000 0x0003a87f 0x0003aa00 IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE 6.55.idata 0x0003c000 0x000020a0 0x00002200 IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ 5.58.rsrc 0x0003f000 0x00016b58 0x00016c00 IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ 3.31.ogjam 0x00056000 0x00007f74 0x00008000 IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ 4.55.iql 0x0005e000 0x00000620 0x00000800 IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ 3.73.sjh 0x0005f000 0x00002043 0x00002200 IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ 4.36.ekdobfn 0x00062000 0x00001616 0x00001800 IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ 4.31.qjzvxi 0x00064000 0x00004c81 0x00004e00 IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ 4.47 覆盖 偏移量 : 大小 : 0x00064c00 0x000013e0 资源 名称 偏移量 大小 语言 子语言熵 (Entropy) 文件类型 RT_RCDATA 0x0003f228 0x0000bc3e LANG_RUSSIAN SUBLANG_RUSSIAN 3.27 data RT_RCDATA 0x0003f228 0x0000bc3e LANG_RUSSIAN SUBLANG_RUSSIAN 3.27 data

RT_MANIFEST 0x0003f0d0 0x00000152 LANG_RUSSIAN SUBLANG_RUSSIAN 4.75 ASCII text 导入 库 KERNEL32.dll: 0x43c000 - CreateFileA 0x43c004 - Process32FirstW 0x43c008 - SetThreadPriorityBoost 0x43c00c - SetInformationJobObject 0x43c010 - SetLocalTime 0x43c014 - MoveFileW 0x43c018 - ReadConsoleOutputW 0x43c01c - lstrcpyn 0x43c020 - SetFileAttributesA 0x43c024 - SetConsoleCursorPosition 0x43c028 - IsDBCSLeadByte 0x43c02c - Process32Next 0x43c030 - CreateFileW 0x43c034 - GetFileAttributesExA 0x43c038 - WritePrivateProfileStructA 0x43c03c - TlsFree 0x43c040 - WaitForDebugEvent 0x43c044 - GlobalReAlloc 0x43c048 - VirtualProtectEx 0x43c04c - GetWindowsDirectoryA 0x43c050 - GetProfileStringA 0x43c054 - GetProcAddress 0x43c058 - GlobalGetAtomNameA 0x43c05c - GetConsoleScreenBufferInfo 0x43c060 - GetSystemInfo 0x43c064 - GetDevicePowerState 0x43c068 - IsProcessInJob 0x43c06c - ActivateActCtx 0x43c070 - GetConsoleTitleA 0x43c074 - lstrlen 0x43c078 - ResumeThread 0x43c07c - Thread32First 0x43c080 - MoveFileWithProgressA 0x43c084 - PostQueuedCompletionStatus 0x43c088 - IsBadStringPtrW 0x43c08c - HeapCreate 0x43c090 - QueryActCtxW 0x43c094 - VirtualFree 0x43c098 - GetDateFormatW 0x43c09c - lstrcpy 0x43c0a0 - UnregisterWaitEx 0x43c0a4 - OpenMutexW 0x43c0a8 - AllocConsole 0x43c0ac - UnregisterWait 0x43c0b0 - SetConsoleMode 0x43c0b4 - CreateTapePartition 0x43c0b8 - FindClose 0x43c0bc - RaiseException 0x43c0c0 - GetConsoleFontSize 0x43c0c4 - CompareStringA 0x43c0c8 - SetProcessAffinityMask 0x43c0cc - FreeEnvironmentStringsW 0x43c0d0 - lstrcmpia 0x43c0d4 - LZOpenFileA 0x43c0d8 - GetHandleInformation 0x43c0dc - GenerateConsoleCtrlEvent 0x43c0e0 - WriteConsoleOutputAttribute 0x43c0e4 - WriteConsoleInputW 0x43c0e8 - PulseEvent 0x43c0ec - GetNumaHighestNodeNumber 0x43c0f0 - GetVolumePathNameA 0x43c0f4 - CloseHandle 0x43c0f8 - GlobalFindAtomA 0x43c0fc - WritePrivateProfileStringA 0x43c100 - FindFirstFileW 0x43c104 - QueryInformationJobObject 0x43c108 - CreateWaitableTimerA 0x43c10c - GetNumberOfConsoleMouseButtons 0x43c110 - GetBinaryType 0x43c114 - GetLocaleInfoA 0x43c118 - GetAtomNameA 0x43c11c - GetProcessHeap 0x43c120 - GetCPInfo 0x43c124 - SetLastError 0x43c128 - BuildCommDCBAndTimeoutsA 0x43c12c - SetThreadContext 0x43c130 - WaitCommEvent 0x43c134 - SetThreadExecutionState 0x43c138 - ReleaseMutex 0x43c13c - WriteProfileStringA 0x43c140 - CreateThread 0x43c144 - VerifyVersionInfoW 0x43c148 - GetFileTime 0x43c14c - FreeUserPhysicalPages 0x43c150 - RemoveDirectoryW 0x43c154 - CreateRemoteThread 0x43c158 - GetCalendarInfoW 0x43c15c - GetNumaAvailableMemoryNode 0x43c160 - IsWow64Process 0x43c164 - CancelDeviceWakeupRequest 0x43c168 - GetComputerNameExA 0x43c16c - Heap32Next 0x43c170 - WriteProcessMemory 0x43c174 - MoveFileWithProgressW 0x43c178 - HeapAlloc 0x43c17c - GetFileAttributesW

0x43c180 - CreateFileMappingW 0x43c184 - GetCurrentProcess 0x43c188 - GetConsoleAliasesLengthA 0x43c18c - GetShortPathNameA 0x43c190 - FlushFileBuffers 0x43c194 - GlobalMemoryStatusEx 0x43c198 - LCMapStringA 0x43c19c - lstrcpyna 0x43c1a0 - FindVolumeMountPointClose 0x43c1a4 - GetVolumePathNameW 0x43c1a8 - DeleteVolumeMountPointA 0x43c1ac - SetProcessWorkingSetSize 0x43c1b0 - EnumResourceNamesA 0x43c1b4 - EnumTimeFormatsA 0x43c1b8 - GetThreadPriorityBoost 0x43c1bc - OpenMutexA 0x43c1c0 - GetTempFileNameA 0x43c1c4 - lstrcmp 0x43c1c8 - SetFileApisToANSI 0x43c1cc - SetDefaultCommConfigA 0x43c1d0 - FindFirstFileExA 0x43c1d4 - SwitchToFiber 0x43c1d8 - FreeEnvironmentStringsA 0x43c1dc - CreateJobSet 0x43c1e0 - GetCurrencyFormatA 0x43c1e4 - GetModuleHandleExA 0x43c1e8 - Beep 0x43c1ec - EnumCalendarInfoW 0x43c1f0 - SetConsoleOutputCP 0x43c1f4 - GetCurrentConsoleFont 0x43c1f8 - DeleteFileW 0x43c1fc - GetNativeSystemInfo 0x43c200 - ExpandEnvironmentStringsA 0x43c204 - _llseek 0x43c208 - SetFirmwareEnvironmentVariableW 0x43c20c - GetDefaultCommConfigA 0x43c210 - GetProfileIntA 0x43c214 - DosDateTimeToFileTime 0x43c218 - ReadProcessMemory 0x43c21c - CallNamedPipeW 0x43c220 - GetQueuedCompletionStatus 0x43c224 - WritePrivateProfileSectionW 0x43c228 - lstrlena 0x43c22c - GetModuleFileNameW 0x43c230 - LZInit 0x43c234 - EnumCalendarInfoExA 0x43c238 - SystemTimeToFileTime 0x43c23c - ProcessIdToSessionId 0x43c240 - GetConsoleAliasesA 0x43c244 - LoadLibraryA 库 OLE32.dll: 0x43c24c - HBITMAP_UserSize 0x43c250 - HBITMAP_UserUnmarshal 0x43c254 - CoCreateGuid 0x43c258 - CreateErrorInfo 0x43c25c - CoFreeLibrary 0x43c260 - ReadFmtUserTypeStg 0x43c264 - GetHGlobalFromStream 0x43c268 - CreateItemMoniker 0x43c26c - CoGetInterceptorFromTypeInfo 0x43c270 - OleDraw 0x43c274 - CoQueryAuthenticationServices 0x43c278 - CoSetCancelObject 0x43c27c - SNB_UserSize 0x43c280 - CoInitializeSecurity 0x43c284 - HBITMAP_UserMarshal 0x43c288 - CoWaitForMultipleHandles 0x43c28c - CoFreeUnusedLibraries 0x43c290 - CoBuildVersion 0x43c294 - CoRegisterClassObject 0x43c298 - CoInitialize 0x43c29c - CoRevokeMallocSpy 0x43c2a0 - OleIsCurrentClipboard 0x43c2a4 - OleNoteObjectVisible 0x43c2a8 - HICON_UserFree 0x43c2ac - CoFileTimeToDosDateTime 0x43c2b0 - CoIsHandlerConnected 0x43c2b4 - OleIsRunning 0x43c2b8 - CoGetInstanceFromIStorage 0x43c2bc - HGLOBAL_UserSize 0x43c2c0 - CoTaskMemFree 0x43c2c4 - StgCreateDocfile 0x43c2c8 - OleCreateLinkToFile 0x43c2cc - HDC_UserSize 0x43c2d0 - HWND_UserMarshal 0x43c2d4 - CoReleaseMarshalData 0x43c2d8 - FmtIdToPropStgName 0x43c2dc - SNB_UserFree 0x43c2e0 - CreateBindCtx 0x43c2e4 - FreePropVariantArray 0x43c2e8 - StgIsStorageFile 0x43c2ec - CoMarshalInterface 0x43c2f0 - OleCreateLinkFromDataEx 0x43c2f4 - CoCancelCall 0x43c2f8 - ProgIDFromCLSID 0x43c2fc - CoTaskMemAlloc 0x43c300 - CoSetProxyBlanket

库 SHELL32.dll: 0x43c308 - StrChrW 0x43c30c - SHCreateProcessAsUserW 0x43c310 - SHGetIconOverlayIndexA 0x43c314 - DragAcceptFiles 0x43c318 - DoEnvironmentSubstA 0x43c31c - SHGetFolderPathW 0x43c320 - SHCreateQueryCancelAutoPlayMoniker 0x43c324 - Shell_NotifyIcon 0x43c328 - SHGetNewLinkInfo 0x43c32c - SHIsFileAvailableOffline 0x43c330 - StrCmpNA 0x43c334 - SHSetLocalizedName 0x43c338 - SHGetDesktopFolder 0x43c33c - SHGetFileInfoA 0x43c340 - SHChangeNotify 0x43c344 - SHQueryRecycleBinW 0x43c348 - FindExecutableA 0x43c34c - SHGetPathFromIDListA 0x43c350 - SHGetDataFromIDListA 库 OLEAUT32.dll: 0x43c358 - VarDecMul 0x43c35c - OleCreatePropertyFrameIndirect 0x43c360 - VarUI2FromDec 0x43c364 - VarR4FromCy 0x43c368 - SafeArrayCreateEx 0x43c36c - VarFormat 0x43c370 - VarBoolFromDisp 0x43c374 - VarCySub 0x43c378 - VarR8FromCy 0x43c37c - VarUI2FromDisp 0x43c380 - VarI8FromUI8 0x43c384 - VarI4FromR8 0x43c388 - SysReAllocStringLen 0x43c38c - VarI8FromR4 0x43c390 - VarDecFromBool 0x43c394 - VarUI4FromDate 0x43c398 - VarI1FromUI8 0x43c39c - LPSAFEARRAY_UserUnmarshal 0x43c3a0 - VariantTimeToDosDateTime 0x43c3a4 - VarUI1FromR4 0x43c3a8 - VarUI8FromR4 0x43c3ac - VarR8FromDate 0x43c3b0 - VarAdd 0x43c3b4 - SafeArrayPutElement 0x43c3b8 - VariantChangeType 0x43c3bc - GetRecordInfoFromTypeInfo 0x43c3c0 - VarI4FromUI1 0x43c3c4 - VarBstrFromI4 0x43c3c8 - BSTR_UserFree 0x43c3cc - VarI2FromUI2 0x43c3d0 - VarDateFromI4 0x43c3d4 - UnRegisterTypeLib 0x43c3d8 - VarNeg 0x43c3dc - GetErrorInfo 0x43c3e0 - VarBstrFromR4 0x43c3e4 - VarR4FromUI2 0x43c3e8 - VarMonthName 0x43c3ec - VarCyFromDisp 0x43c3f0 - LPSAFEARRAY_UserMarshal 0x43c3f4 - VarAbs 0x43c3f8 - VarI2FromI4 0x43c3fc - VarAnd 0x43c400 - VarCyFromR8 0x43c404 - VarCyFromUI4 0x43c408 - VarUI2FromI4 0x43c40c - VarR4FromDec 0x43c410 - VarI8FromCy 0x43c414 - SafeArrayDestroyData 0x43c418 - VarCyCmpR8 0x43c41c - SafeArrayGetElemsize 0x43c420 - VarCyFromDate 0x43c424 - GetAltMonthNames 0x43c428 - OleSavePictureFile 0x43c42c - VarDateFromUI1 0x43c430 - VARIANT_UserFree 0x43c434 - VarCyAbs 0x43c438 - RegisterTypeLib 0x43c43c - VarR4FromUI1 0x43c440 - SafeArrayGetLBound 0x43c444 - VarBoolFromDate 0x43c448 - VarR8Pow 0x43c44c - VarCyFromDec 0x43c450 - VarI2FromUI1 0x43c454 - SafeArrayAllocDescriptorEx 0x43c458 - CreateErrorInfo 0x43c45c - VarUI8FromUI2 0x43c460 - BSTR_UserMarshal 0x43c464 - VarDateFromBool 0x43c468 - VarUI4FromDec 0x43c46c - VarDateFromUdate 0x43c470 - VarR8FromUI1 0x43c474 - VarR4FromUI8 0x43c478 - VarI2FromI1 0x43c47c - VarI8FromI2 0x43c480 - VarUI1FromUI2 0x43c484 - VarDecFromUI1 0x43c488 - VarCyFromBool 0x43c48c - VarUI4FromI8

0x43c490 - VarI4FromCy 0x43c494 - VarDecFromI8 0x43c498 - OleCreatePropertyFrame 0x43c49c - VarR8FromDec 0x43c4a0 - VarI8FromDisp 0x43c4a4 - VarI8FromDec 0x43c4a8 - VarDecSub 0x43c4ac - VarBstrFromUI2 投放文件 无信息 行为分析 互斥量 (Mutexes) 无信息 执行的命令无信息 创建的服务无信息 启动的服务无信息 进程 59533f5a8068103585dcb4b8a1c9d4bf.exe PID: 100, 上一级进程 PID: 600 访问的文件无信息 读取的文件无信息 修改的文件无信息 删除的文件无信息 注册表键 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles 读取的注册表键 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles 修改的注册表键无信息 删除的注册表键无信息 API 解析 crypt32.dll.cryptstringtobinarya rpcrt4.dll.uuidtostringw rpcrt4.dll.rpcstringfreew kernel32.dll.getlocaltime kernel32.dll.systemtimetofiletime kernel32.dll.filetimetosystemtime kernel32.dll.interlockeddecrement kernel32.dll.gettemppathw kernel32.dll.createdirectoryw kernel32.dll.getmodulefilenamew kernel32.dll.setfileattributesw kernel32.dll.getenvironmentvariablew kernel32.dll.getcurrentprocessid kernel32.dll.removedirectoryw kernel32.dll.deletefilew kernel32.dll.getfiletime kernel32.dll.closehandle kernel32.dll.filetimetolocalfiletime kernel32.dll.getsystemtimeasfiletime kernel32.dll.loadlibraryw kernel32.dll.getprocaddress kernel32.dll.versetconditionmask kernel32.dll.verifyversioninfow kernel32.dll.getfileattributesw kernel32.dll.localfree kernel32.dll.getlasterror kernel32.dll.movefileexw kernel32.dll.sleep kernel32.dll.getcommandlinew kernel32.dll.setstdhandle kernel32.dll.setendoffile kernel32.dll.createfilew kernel32.dll.writeconsolew kernel32.dll.heaprealloc kernel32.dll.isvalidlocale kernel32.dll.enumsystemlocalesa kernel32.dll.getlocaleinfoa kernel32.dll.getuserdefaultlcid kernel32.dll.isvalidcodepage kernel32.dll.getoemcp

kernel32.dll.getacp kernel32.dll.getlocaleinfow kernel32.dll.gettickcount kernel32.dll.queryperformancecounter kernel32.dll.getenvironmentstringsw kernel32.dll.freeenvironmentstringsw kernel32.dll.flushfilebuffers kernel32.dll.readfile kernel32.dll.setfilepointer kernel32.dll.getconsolemode kernel32.dll.interlockedincrement kernel32.dll.interlockedcompareexchange kernel32.dll.interlockedexchange kernel32.dll.multibytetowidechar kernel32.dll.widechartomultibyte kernel32.dll.getstringtypew kernel32.dll.initializecriticalsection kernel32.dll.deletecriticalsection kernel32.dll.entercriticalsection kernel32.dll.leavecriticalsection kernel32.dll.heapfree kernel32.dll.heapsetinformation kernel32.dll.getstartupinfow kernel32.dll.raiseexception kernel32.dll.rtlunwind kernel32.dll.heapalloc kernel32.dll.lcmapstringw kernel32.dll.getcpinfo kernel32.dll.terminateprocess kernel32.dll.getcurrentprocess kernel32.dll.unhandledexceptionfilter kernel32.dll.setunhandledexceptionfilter kernel32.dll.isdebuggerpresent kernel32.dll.isprocessorfeaturepresent kernel32.dll.heapsize kernel32.dll.getmodulehandlew kernel32.dll.exitprocess kernel32.dll.tlsalloc kernel32.dll.tlsgetvalue kernel32.dll.tlssetvalue kernel32.dll.tlsfree kernel32.dll.setlasterror kernel32.dll.getcurrentthreadid kernel32.dll.heapcreate kernel32.dll.sethandlecount kernel32.dll.getstdhandle kernel32.dll.initializecriticalsectionandspincount kernel32.dll.getfiletype kernel32.dll.writefile kernel32.dll.getconsolecp kernel32.dll.getprocessheap advapi32.dll.regclosekey advapi32.dll.regqueryvalueexw advapi32.dll.regsetvalueexw advapi32.dll.regcreatekeyexw advapi32.dll.regopenkeyexw advapi32.dll.getusernamew shell32.dll.shgetfolderpathw ole32.dll.cotaskmemfree ole32.dll.cocreateguid ole32.dll.coinitialize ole32.dll.coinitializesecurity ole32.dll.cocreateinstance oleaut32.dll.#8 oleaut32.dll.#9 oleaut32.dll.#6 oleaut32.dll.#2 shlwapi.dll.pathappendw shlwapi.dll.shdeletekeyw kernel32.dll.flsalloc kernel32.dll.flsgetvalue kernel32.dll.flssetvalue kernel32.dll.flsfree 2016 上海魔盾信息科技有限公司