Detection ratio: 6 / 55

墨家小子

https://www.virustotal.com/en/fi ... nalysis/1448799249/
SHA256:        6f4feeb9fd07ab12434a65c3ea3467837ca0163fc6af85e96c65600364ef864f
File name:        6f4feeb9fd07ab12434a65c3ea3467837ca0163fc6af85e96c65600364ef864f.exe
Detection ratio:        6 / 55
Analysis date:        2015-11-29 12:14:09 UTC ( 1 minute ago )

yzt1004

Emsisoft












连个界面都没看到还想加自启动？果断拦了

process hacker 的图，好像它要添加防火墙例外？这个没提示

EnZhSTReLniKoVa

双击这个 居然把金山清理提取版 给行为监控了
AVA 25.4577
GD 25.5950

*** 进程 ***

进程: 4740
文件名: 金山毒霸垃圾清理2015.11.2.14641.exe
路径: c:\users\natsukihanae\desktop\金山毒霸垃圾清理2015.11.2.14641.exe

发行商：: 未知发行商
创建日期: 11/08/15 05:09:55
修改日期: 11/08/15 05:09:55

发行商：: 未知发行商


*** 操作 ***

程序正经过网络建立连接。
程序正在监听记录键盘输入。
一个未知进程访问了。
程序已将文件保存在系统文件夹。
程序已创建或已操作可执行文件。
该程序可以用户执行任何程序代码。
该程序可以用户执行任何程序代码。
程序已从自身的程序文件读取数据。
程序尝试直接访问底层磁盘。
程序进行了自我复制。
该程序试图删除其自身的程序文件。
程序在Windows文件夹已创建或已操作一个可执行文件。


*** 隔离区 ***

下列文件被转入隔离区：
C:\Users\NatsukiHanae\Desktop\金山毒霸垃圾清理2015.11.2.14641.exe
c:\users\natsukihanae\appdata\local\comms\temp\calendarcache.dat
c:\users\natsukihanae\appdata\local\comms\unistore\data\aggregatecache.uca
c:\users\natsukihanae\appdata\local\comms\unistoredb\store.vol
c:\users\natsukihanae\appdata\local\comms\unistoredb\uss.chk
c:\users\natsukihanae\appdata\local\comms\unistoredb\uss.log
c:\users\natsukihanae\appdata\local\microsoft\clr_v2.0\usagelogs\6f4feeb9fd07ab12434a65c3ea3467837ca0163fc6af85e96c65600364ef864f.exe.log
c:\users\natsukihanae\appdata\local\microsoft\windows\actioncentercache\ce2642fd-2470-4aaf-aaa5-78083ac81d51.png
c:\users\natsukihanae\appdata\local\microsoft\windows\actioncentercache\d836ffbe-3610-4e77-8e1f-94e91d8f6ad5.png
c:\users\natsukihanae\appdata\local\microsoft\windows\explorer\explorerstartuplog_runonce.etl
c:\users\natsukihanae\appdata\local\microsoft\windows\explorer\thumbcache_1280.db
c:\users\natsukihanae\appdata\local\microsoft\windows\explorer\thumbcache_16.db
c:\users\natsukihanae\appdata\local\microsoft\windows\explorer\thumbcache_1920.db
c:\users\natsukihanae\appdata\local\microsoft\windows\explorer\thumbcache_256.db
c:\users\natsukihanae\appdata\local\microsoft\windows\explorer\thumbcache_2560.db
c:\users\natsukihanae\appdata\local\microsoft\windows\explorer\thumbcache_32.db
c:\users\natsukihanae\appdata\local\microsoft\windows\explorer\thumbcache_48.db
c:\users\natsukihanae\appdata\local\microsoft\windows\explorer\thumbcache_768.db
c:\users\natsukihanae\appdata\local\microsoft\windows\explorer\thumbcache_96.db
c:\users\natsukihanae\appdata\local\microsoft\windows\explorer\thumbcache_idx.db
c:\users\natsukihanae\appdata\local\microsoft\windows\explorer\thumbcache_sr.db
c:\users\natsukihanae\appdata\local\microsoft\windows\inetcache\ie\wjykzpbi\hitmanpro_x64[1].exe
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\5d88gegz\1s_gdata-protects_cn_v1_45750[1].jpg
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\5d88gegz\awards_chn_45460[1].jpg
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\5d88gegz\csm_logo_874a1dd272[1].png
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\5d88gegz\diagram_banking_preventedlosses_h1_2015_v2_en_hl_lowres_48864w417_48935w254[1].jpg
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\5d88gegz\exli3krb3g.js
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\5d88gegz\gdrisa15_en_web_3d_45380w90[1].png
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\5d88gegz\t[3].gif
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\5d88gegz\zpi8539i.htm
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\j2otx9kj\avchn_startseite_45486w90[1].png
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\j2otx9kj\cbox[1].htm
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\j2otx9kj\fontawesome-webfont[1].woff
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\j2otx9kj\forum-7-1[2].htm
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\j2otx9kj\get[7].js
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\j2otx9kj\ischn_startseite_45492w90[1].png
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\j2otx9kj\jnijsyyq.htm
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\j2otx9kj\merged-b7762263e128b23fd595f7c52bcec5b7[1].js
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\q3p1xbrj\default-blessed1[1].css
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\q3p1xbrj\default[1].css
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\q3p1xbrj\get1uoffwxd.js
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\q3p1xbrj\iot_v2_48812h600_48840w254[1].png
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\q3p1xbrj\logo[1].png
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\q3p1xbrj\merged-d66bcbc9a4eb39f80fb04bdd4e02b824[1].js
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\q3p1xbrj\spfstqx8tky.gif
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\q3p1xbrj\swfuploadvt2o14ce.swf
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\ui62hyxs\businesschn_startseite_45497w90[1].png
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\ui62hyxs\exoiolubtn.js
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\ui62hyxs\forum[2].htm
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\ui62hyxs\home[1].htm
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\ui62hyxs\lp_15_b2b_mes_azure_auszeichnungen_ms-azure_v1_65447w800_65634w254[1].png
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\ui62hyxs\startbild_video_yourcompanyneedssicherheitnew_46437[1].jpg
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\ui62hyxs\stylesheet_99374d67ee[1].css
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\1p74zhzk.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\2x0rvg7b.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\3foncbpo.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\4r6ykoul.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\83kk90v6.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\8kx1yqxb.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\8mh627gv.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\8o10cvp3.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\9cuspv8m.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\9yslo6ak.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\chljz25p.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\d9kc37ya.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\du9o9b5e.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\hl1m6nvf.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\hr8nu8ay.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\htemlm0t.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\kby1rxlf.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\kydmx395.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\nwrt62z4.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\omj69mo0.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\puypc00d.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\qfr8zh9g.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\rux5orau.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\s1uohk4a.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\vh0d5c83.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\wrzw48gs.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\ywagz2u3.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cookies\zut2paom.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\user\default\domstore\w8ekss4o\bbs.kafan[1].xml
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\gnbqazna\ieonebox_v2[1].appcache
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\gnbqazna\ieonebox_v2[2].appcache
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\gnbqazna\suggestions[1].json
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\gnbqazna\suggestions[2].json
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\wo0y4n0o\suggestions[1].json
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\wo0y4n0o\suggestions[2].json
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\yej6t21r\ieonebox_v2[1].appcache
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\yej6t21r\suggestions[2].json
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\zrxqejmn\suggestions[1].json
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cookies\0arj1ae9.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cookies\3ez0vcp6.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cookies\4saxhsms.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cookies\93abdn28.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cookies\ql2xl7l2.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cookies\xt1z5ew7.txt
c:\users\natsukihanae\appdata\local\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\user\default\domstore\wok9l55d\www.bing[1].xml
c:\users\natsukihanae\appdata\local\temp\microsoft.explorer.notification.3b66c645-88ec-c32f-2885-2e17fe780fe3.png
c:\users\natsukihanae\appdata\local\temp\microsoft.explorer.notification.d8078032-2582-71ad-8506-e68c46530c2a.png
c:\users\natsukihanae\appdata\local\temp\systemwinr.exe
c:\users\natsukihanae\appdata\local\temp\a657b4d3-0b87-40c5-ba3a-7be5d624a0fb.png
c:\users\natsukihanae\appdata\roaming\microsoft\windows\recent\customdestinations\9696385ba4821f.customdestinations-ms
c:\users\natsukihanae\appdata\roaming\microsoft\windows\recent\customdestinations\9696385ba4821f.customdestinations-ms~rf3ef14.tmp
c:\users\natsukihanae\appdata\roaming\microsoft\windows\recent\customdestinations\x80c3f3azyj43rlicfiw.temp
c:\users\natsukihanae\appdata\roaming\tencent\androidserver\localdevicecache.xml
c:\windows\system32\drivers\hitmanpro37.sys

下列注册表项被删除：

\registry\user\s-1-5-21-2533445751-2411481644-359974300-1001\software\g data\antivirenkit || gdscinit

YGLR+KLGDSwn5ygmJifnCC0nrNpiYnLCqg0uJ8dvYmJycvwGp0InJyYmdHJwKycnJiYnB7li0fiC1grpcnKJLSYmJ5fYoCgnLSYmJw3KcnJoKSYmJ4eWoC0nLSYmJw1rcnL8YmJycvywKScoJiYnCNtyomJicqLAKieHLCYmJ4cM7HJyYmJycsAvJy4mJicObXKS12JicpLX0Cgnl2JicnIJnXJyYmJyctArJygmJicI3XJyYmJyctAuJycmJicHbnKSCI9ycmJicnLwKSd3YmJycgevcsJiYnLC8CwnJyYmJwdnJicnJiYnB4cmJ7diYnJyC4coJy8mJicPhyknLiYmJw6HKyeMnGJicsLICYctJycmJicHly8nKiYmJwqnKxv+NWYqLxl4NWYsJxv+NWYqDqctJy8mJicPtycnd2JicnIHtygnJyYmJwe3KicHty0n12JicnINty8n92JicnIPxywnJyYmJwfHLicqJiYnCscvJ4e2YmJycmgL1yknmScmJieZB9cqJycmJicH5ygnh3DecnJiYnJycH9yki0mJifZcJ9ycm5iYnJybnDvcnJiYnJycP9ykusmJiYnuW6AlnJyvAl4JycqJiYnCogmJycmJicHAA
规则版本： 5.0.71
OS: Windows 10.0 Service Pack 0.0 Build: 10586 - Workstation 64bit OS
DLL版本： 55982


MD5: 0DA21828AABAF06CEFD280273412C9A1

追影子的十三

过红伞扫描，云拉黑

wjy19800315

eset监控秒

EnZhSTReLniKoVa

电脑重启后
AVA 25.4577
GD 25.5950

*** 进程 ***

进程: 2592
文件名: 6f4feeb9fd07ab12434a65c3ea3467837ca0163fc6af85e96c65600364ef864f.exe
路径: c:\users\natsukihanae\desktop\6f4feeb9fd07ab12434a65c3ea3467837ca0163fc6af85e96c65600364ef864f.exe

发行商：: 未知发行商
创建日期: 11/29/15 12:19:37
修改日期: 11/29/15 12:13:23

启动进程：: explorer.exe
发行商：: Microsoft Windows


*** 操作 ***

程序正试图建立自启动项，以在系统启动时自动运行。
一个未知进程访问了。
程序已创建或已操作可执行文件。
该程序可以用户执行任何程序代码。
程序进行了自我复制。
可疑位置为启动区域。


*** 隔离区 ***

下列文件被转入隔离区：
C:\Users\NatsukiHanae\Desktop\6f4feeb9fd07ab12434a65c3ea3467837ca0163fc6af85e96c65600364ef864f.exe
c:\users\natsukihanae\appdata\local\microsoft\clr_v2.0\usagelogs\6f4feeb9fd07ab12434a65c3ea3467837ca0163fc6af85e96c65600364ef864f.exe.log
c:\users\natsukihanae\appdata\local\temp\systemwinr.exe

下列注册表项被删除：

\registry\user\s-1-5-21-2533445751-2411481644-359974300-1001\software\microsoft\windows\currentversion\run || 165eb3329b26adba61acf5f0cac0d35c

YGLxlqL2wHJyYmJyctBygnKCYmLgcnLXcoIqJ59wKnSCYmJCJwi3coJiYnKCgCwnKCYmJwjocnJiYnJykCsWbymXD9lycpAuJ7xiYnLCC8pywismJie8sC0nJycnJgascoJycnJywC8nJycnJgZtcnJycmJi0CgnvGJicsIL7XJyYmJycvAsJycnJyYG/3LCKiYmJ6xwp3JycLhygnKCYmJwyHJyYmJycnC6suFfY6aisuFfY6ZysuFfY6aScOxywi0mJifccPxywismJie8cJ1ycnJyYmJwrXJycnJiYnCOcnIHaCknzAAA
规则版本： 5.0.71
OS: Windows 10.0 Service Pack 0.0 Build: 10586 - Workstation 64bit OS
DLL版本： 55982

"C:\Users\NatsukiHanae\Desktop\6f4feeb9fd07ab12434a65c3ea3467837ca0163fc6af85e96c65600364ef864f.exe"
MD5: 4B1B7530F376551895C840863D808E32
C:\WINDOWS\explorer.exe
MD5:

XywCloud

SUD to BAV

陌上~烟雨遥

諾頓不殺

ericdj

webroot表示安全~~~~~

Crystalsecurity表示~~~~
VT有较多（相对）引擎报毒，所以骚年注意

wjy19800315

yzt1004 发表于 2015-11-29 20:39
Emsisoft

界面帅呆了
问一下
eam11自带的有中文吗
eam什么样eis估计就什么样