网络行为

行为描述:联网打开网址

详情信息:InternetOpenUrlA: http://**.133.40.**:128/wpad.dat, hInternet = 0x00cc0010, Flags = 0x00000010

行为描述:连接指定站点

详情信息:InternetConnectA: ServerName = ai****om, PORT = 80, UserName = , Password = , hSession = 0x00cc0004, hConnect = 0x00cc0008, Flags = 0x00000000

InternetConnectA: ServerName = **.133.40.**, PORT = 128, UserName = , Password = , hSession = 0x00cc0010, hConnect = 0x00cc0014, Flags = 0x00000010

InternetConnectA: ServerName = ww****om, PORT = 80, UserName = , Password = , hSession = 0x00cc001c, hConnect = 0x00cc0020, Flags = 0x00000000

行为描述:打开HTTP连接

详情信息:InternetOpenA: UserAgent: Mozilla/5.0 (Windows; U; en) AppleWebKit/533.19.4 (KHTML, like Gecko) AdobeAIR/4.0, hSession = 0x00cc0004

InternetOpenA: UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Win32; Trident/4.0), hSession = 0x00cc0010

InternetOpenA: UserAgent: Mozilla/5.0 (Windows; U; zh-CN) AppleWebKit/533.19.4 (KHTML, like Gecko) AdobeAIR/4.0, hSession = 0x00cc001c

行为描述:建立到一个指定的套接字连接

详情信息:URL: wpad, IP: **.133.40.**:128, SOCKET = 0x000003f0

URL: ww****om, IP: **.133.40.**:80, SOCKET = 0x000003e0

URL: ai****om, IP: **.133.40.**:80, SOCKET = 0x000003d4

行为描述:读取网络文件

详情信息:hFile = 0x00cc0018, BytesToRead =4010, BytesRead = 4010.

hFile = 0x00cc0024, BytesToRead =65536, BytesRead = 65536.

hFile = 0x00cc000c, BytesToRead =65536, BytesRead = 65536.

行为描述:发送HTTP包

详情信息:GET /wpad.dat HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32; Trident/4.0)

Host: **.133.40.**:128

GET /version/check?type=win&pid=com%2Efairygui%2EFairyGUIEditor&ver=20506 HTTP/1.1

Referer: app:/FairyGUIEditor.swf

Accept: text/xml, application/xml, application/xhtml+xml, text/html;q=0.9, text/plain;q=0.8, text/css, image/png, image/jpeg, image/gif;q=0.8, application/x-shockwave-flash, video/mp4;q=0.9, flv-application/octet-stream;q=0.8, video/x-flv;q=0.7, audio/mp4, application/futuresplash, */*;q=0.5

x-flash-version: 12,0,0,68

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows; U; zh-CN) AppleWebKit/533.19.4 (KHTML, like Gecko) AdobeAIR/4.0

Host: ww****om

Connection: Keep-Alive

GET /air?version=4.0.0.1628&appid=com.fairygui.FairyGUIEditor&runtimeType=c&os=w&osVer=Windows%20XP&arch=x86&lang=zh-CN HTTP/1.1

Accept: text/xml, application/xml, application/xhtml+xml, text/html;q=0.9, text/plain;q=0.8, text/css, image/png, image/jpeg, image/gif;q=0.8, application/x-shockwave-flash, video/mp4;q=0.9, flv-application/octet-stream;q=0.8, video/x-flv;q=0.7, audio/mp4, application/futuresplash, */*;q=0.5

x-flash-version: 12,0,0,68

User-Agent: Mozilla/5.0 (Windows; U; en) AppleWebKit/533.19.4 (KHTML, like Gecko) AdobeAIR/4.0

Host: ai****om

Connection: Keep-Alive

行为描述:打开HTTP请求

详情信息:HttpOpenRequestA: ai****om:80/air?version=4.0.0.1628&appid=com.fairygui.fairyguieditor&runtimetype=c&os=w&osver=windows xp&arch=x86&lang=zh-cn, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x00400800

HttpOpenRequestA: **.133.40.**:128/wpad.dat, hConnect = 0x00cc0014, hRequest = 0x00cc0018, Verb: GET, Referer: , Flags = 0x00000010

HttpOpenRequestA: ww****om:80/version/check?type=win&pid=com%2efairygui%2efairyguieditor&ver=20506, hConnect = 0x00cc0020, hRequest = 0x00cc0024, Verb: GET, Referer: app:/FairyGUIEditor.swf, Flags = 0x00400800

行为描述:按名称获取主机地址

详情信息:GetAddrInfoW: computer

GetAddrInfoW: wpad

GetAddrInfoW: ww****om

GetAddrInfoW: ai****om