Gen.Variant.FakeAlert.96_00956e5276 – Adaware

Gen:Variant.FakeAlert.96 (B) (Emsisoft), Gen:Variant.FakeAlert.96 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 00956e5276f734217091682b0990d39d

SHA1: 48f18fb8b0e57770c05e38abce663225b44bcbc7

SHA256: 17f9a6563e58032f3be5ee1dbba9dc8837b342d72c818c2b9ebda435f75ba86f

SSDeep: 98304:5F86/qjqdwkLQHHhsSYt815zc1WiJvJBAUZL1c:Y1csKSOTJV6

Size: 3768320 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171

Company: no certificate found

Created at: 2014-06-09 03:59:16

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-PSW. Trojan program intended for stealing users passwords.

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:668

Mutexes

The following mutexes were created/opened:

SHIMLIB_LOG_MUTEX{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}ShimCacheMutex746bbf3569adEncrypt

File activity

The process %original file name%.exe:668 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\A4399dv_base[1].swf (5584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\faspbtn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\bg_1[1].gif (791 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\ico_ann[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\logo[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\hottop[1].gif (857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\icon_keys[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\b_2[1].gif (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\t_1[1].gif (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\1GQ340U13[1].gif (527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\zwsf2-3[1].gif (1352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\v134main[1].swf (331219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\c_5[1].gif (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\libg_2[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\MagicWeaponv1240[1].swf (210540 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\jquery-1.2.1.pack[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\bg_9[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\0f000QECn8mWOOje4W2f30[1].swf (810 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\ctrl_mo_v5[1].swf (39156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\t_9[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\crossdomain[1].xml (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\stat[1].php (1163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\4399_14504425052[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\lazy_iframe[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\sy_ico[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\4399_17564382760[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\libg_1[1].gif (899 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\zrsp_1[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\121055423955[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\t_3[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\0f000ZtbOwy2j0IrKBdl36[1].jpg (1943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\zmxy3_20130916[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\go_bbs[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\v134main[1].htm (923 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\stat[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\sszn[1].gif (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\game_bg[1].gif (776 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\bg_3[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\bg[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\n_zm1[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\ucenter[1].js (14244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\click[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\tjrm_img09[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\bds_s_v2[1].js (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\1016440UA2[1].jpg (1855 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\t_lm[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\tgbtn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\bg_5_20130716[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\more_boss[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\play_hs1202[2].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\101639333L6[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\t_4[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\base[1].css (9771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\bg_7[1].png (6 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@163[1].txt (338 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\lmbtn[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\ftbtn[1].gif (477 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@4399[1].txt (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\4399[2].js (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\78072[1].htm (3238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\logger[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\uijs[1].php (1541 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\core[2].php (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\crossdomain[2].xml (331 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\zb_nav_20131205[1].png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\b_4[1].gif (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\jquery-1.2.1.pack[1].js (1740 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\4399_17053265645[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\new5[1].gif (177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\4399[1].js (902 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\c_2[1].gif (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\t_2[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\1016395W521[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\1Q62S330N[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\zmxy3_20130916[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\core[1].php (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\more_boss_s[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\ecom[1].xml (233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\headerBg[1].gif (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\flash_ctrl_version[1].xml (530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\4399_16460972266[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\tjrm_img06[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\play_hs1202[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\t_6[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\0f0000I41e4oSte6MNwG4s[1].jpg (1943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\251424335C5[1].jpg (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\CAUZGLEZ.htm (1 bytes)
C:\SkinH_EL.dll (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\10163ZO2N[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\is[1].png (1017 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\ico_1[1].gif (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\bg_8[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\baiduLoader_as3[1].swf (2515 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\style[2].css (4 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[1].txt (925 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\c_4[1].gif (81 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\0f000Q1BFocx-cEB3jw0J0[1].swf (5492 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\xml[1].xml (664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\jcsp_1[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[2].txt (1518 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\tjrm_img011[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\sp_line_1[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\topbg_20140506[1].jpg (4510 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\ico[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\231502413S2[1].gif (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\trace_news[1].js (559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\scbg[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\chkDomain[1].js (554 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\style[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\online_v3[1].htm (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\nav_bg[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\bg_4[1].png (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\c_3[1].gif (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\b_5[1].gif (317 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\0f000Q1BFJ3x-cEB3jw0M0[1].jpg (4427 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\bg_6[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\c[1].php (952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\b_1[1].gif (610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\0913524M015[1].gif (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\c_1[1].gif (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\t_5[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\FuYun[1].swf (22194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\rq[1].htm (347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\crossdomain[1].xml (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\CALK4Z5D.swf (5230 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s8.4399.com\settings.sxx (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\zj_btn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\0f000QECn83WOOje4W2fl0[1].swf (1218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\101634512c8[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\t_8[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.wh0512[1].txt (249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\0109292I2U[1].jpg (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\core[1].php (751 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\tjrm_img08[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\zmxy3_20140808[2].css (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\bdshare[1].js (182 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\s8.4399.com\seed4399Value.sxx (80 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@163[2].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\b_3[1].gif (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\left[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\tjrm_img07[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\right[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\libg_3[1].gif (542 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\zmxy3_20140808[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\shell_v2[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\4399_14533870073[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\0f000QumSmNHL3kKP0qi86[1].swf (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\78072[1].htm (3936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\0f0000I41e4oSte6MNwG4s[1].jpg (1943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\n_mg_bg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\pic[1].gif (719 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cb.baidu[1].txt (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\uijs[1].xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\more_zb[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\0f000Q1BFoCx-cEB3jw0C0[1].swf (1654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\bdsstyle[1].css (9 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\0f000Q1BFJcx-cEB3jw0h0[1].jpg (3805 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\sc[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\new_icon_1[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\news_footer[1].js (25 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040820140409\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@163[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\4399[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\jquery-1.2.1.pack[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\78072[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\play_hs1202[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\zmxy3_20140808[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040820140409 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\uijs[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\zmxy3_20130916[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@163[1].txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s8.4399.com\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\0f0000I41e4oSte6MNwG4s[1].jpg (0 bytes)

Registry activity

The process %original file name%.exe:668 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090420140905]
"CacheOptions" = "11"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090420140905]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090420140905]
"CachePrefix" = ":2014090420140905:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1402275556"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090420140905]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 D9 DC 51 B2 37 18 F9 EE F3 6D 9C 1D D0 6F EB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090420140905]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014090420140905\"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014040820140409]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
147127382e001f495d1842ee7a9e7912	c:\SkinH_EL.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\A4399dv_base[1].swf (5584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\faspbtn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\bg_1[1].gif (791 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\ico_ann[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\logo[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\hottop[1].gif (857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\icon_keys[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\b_2[1].gif (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\t_1[1].gif (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\1GQ340U13[1].gif (527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\zwsf2-3[1].gif (1352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\v134main[1].swf (331219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\c_5[1].gif (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\libg_2[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\MagicWeaponv1240[1].swf (210540 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\jquery-1.2.1.pack[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\bg_9[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\0f000QECn8mWOOje4W2f30[1].swf (810 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\ctrl_mo_v5[1].swf (39156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\t_9[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\crossdomain[1].xml (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\stat[1].php (1163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\4399_14504425052[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\lazy_iframe[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\sy_ico[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\4399_17564382760[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\libg_1[1].gif (899 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\zrsp_1[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\121055423955[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\t_3[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\0f000ZtbOwy2j0IrKBdl36[1].jpg (1943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\zmxy3_20130916[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\go_bbs[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\v134main[1].htm (923 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\stat[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\sszn[1].gif (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\game_bg[1].gif (776 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\bg_3[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\bg[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\n_zm1[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\ucenter[1].js (14244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\click[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\tjrm_img09[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\bds_s_v2[1].js (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\1016440UA2[1].jpg (1855 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\t_lm[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\tgbtn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\bg_5_20130716[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\more_boss[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\play_hs1202[2].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\101639333L6[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\t_4[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\base[1].css (9771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\bg_7[1].png (6 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@163[1].txt (338 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\lmbtn[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\ftbtn[1].gif (477 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@4399[1].txt (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\4399[2].js (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\78072[1].htm (3238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\logger[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\uijs[1].php (1541 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\core[2].php (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\crossdomain[2].xml (331 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\zb_nav_20131205[1].png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\b_4[1].gif (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\jquery-1.2.1.pack[1].js (1740 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\4399_17053265645[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\new5[1].gif (177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\4399[1].js (902 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\c_2[1].gif (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\t_2[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\1016395W521[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\1Q62S330N[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\zmxy3_20130916[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\core[1].php (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\more_boss_s[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\ecom[1].xml (233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\headerBg[1].gif (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\flash_ctrl_version[1].xml (530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\4399_16460972266[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\tjrm_img06[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\play_hs1202[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\t_6[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\0f0000I41e4oSte6MNwG4s[1].jpg (1943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\251424335C5[1].jpg (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\CAUZGLEZ.htm (1 bytes)
C:\SkinH_EL.dll (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\10163ZO2N[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\is[1].png (1017 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\ico_1[1].gif (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\bg_8[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\baiduLoader_as3[1].swf (2515 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\style[2].css (4 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[1].txt (925 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\c_4[1].gif (81 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\0f000Q1BFocx-cEB3jw0J0[1].swf (5492 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\xml[1].xml (664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\jcsp_1[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[2].txt (1518 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\tjrm_img011[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\sp_line_1[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\topbg_20140506[1].jpg (4510 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\ico[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\231502413S2[1].gif (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\trace_news[1].js (559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\scbg[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\chkDomain[1].js (554 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\style[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\online_v3[1].htm (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\nav_bg[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\bg_4[1].png (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\c_3[1].gif (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\b_5[1].gif (317 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\0f000Q1BFJ3x-cEB3jw0M0[1].jpg (4427 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\bg_6[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\c[1].php (952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\b_1[1].gif (610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\0913524M015[1].gif (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\c_1[1].gif (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\t_5[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\FuYun[1].swf (22194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\rq[1].htm (347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\crossdomain[1].xml (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\CALK4Z5D.swf (5230 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s8.4399.com\settings.sxx (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\zj_btn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\0f000QECn83WOOje4W2fl0[1].swf (1218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\101634512c8[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\t_8[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.wh0512[1].txt (249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\0109292I2U[1].jpg (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\core[1].php (751 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\tjrm_img08[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\zmxy3_20140808[2].css (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\bdshare[1].js (182 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\s8.4399.com\seed4399Value.sxx (80 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@163[2].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\b_3[1].gif (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\left[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\tjrm_img07[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\right[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\libg_3[1].gif (542 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\zmxy3_20140808[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\shell_v2[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\4399_14533870073[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\0f000QumSmNHL3kKP0qi86[1].swf (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\78072[1].htm (3936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\0f0000I41e4oSte6MNwG4s[1].jpg (1943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\n_mg_bg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\pic[1].gif (719 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cb.baidu[1].txt (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\uijs[1].xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\more_zb[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\0f000Q1BFoCx-cEB3jw0C0[1].swf (1654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\bdsstyle[1].css (9 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\0f000Q1BFJcx-cEB3jw0h0[1].jpg (3805 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\sc[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\new_icon_1[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\news_footer[1].js (25 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1114983	1118208	4.52644	34166dc576f9b51ee736fc794c0093ce
.rdata	1122304	2429544	2433024	5.21334	a712d98ae2378a8e1cbfe31d4466f296
.data	3555328	337898	110592	3.52425	f25d1694e7c76974c6d85650a5c145c8
.rsrc	3895296	76857	40960	3.65216	dd72cb88f69f3512bfe7524f9e63db74
.rmnet	3973120	61440	61440	0.388197	656925b1066bbbfef83c6554670147c5

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://203.130.61.17/css/zmxy3_20140808.css
hxxp://203.130.61.17/jss/jquery-1.2.1.pack.js
hxxp://z5.cnzz.com/stat.htm?id=5815340&r=&lg=en-us&ntime=none&cnzz_eid=1722835169-1409794067-&showp=1276x846&t=&h=1&rnd=1856641077	42.156.140.18
hxxp://c.split.cnzz.com/core.php?web_id=5815340&show=line&online=1&t=z
hxxp://123.58.180.119/blog/static/215741063201301204752584/
hxxp://203.130.61.17/jss/trace_news.js
hxxp://online.cnzz.com/online/online_v3.php?id=5815340&h=z5.cnzz.com&on=1&s=line	42.156.162.15
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=851777303
hxxp://203.130.61.17/flashzt/img/zmxy3_20120913/logo.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg.gif
hxxp://pcookie.split.cnzz.com/app.gif?&cna=Gq6ODEoRhRUCASU5EL0s8UhE
hxxp://e.xdwscache.glb0.lxdns.com/moeryongshi/images/headerBg.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/go_bbs.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1406/231502413S2.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1309/121055423955.gif
hxxp://download023.rdb.cnc.ccgslb.net/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.htm
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2014/8/7/4399_17564382760.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2014/6/6/4399_14533870073.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2014/2/12/4399_14504425052.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img08.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/sc.gif
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2014/6/6/4399_16460972266.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img07.jpg
hxxp://e.xdwscache.glb0.lxdns.com/imageyx/seer2012/hottop.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/101634512c8.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/10163ZO2N.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/topbg_20140506.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/zj_btn.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/101639333L6.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/1016395W521.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/game_bg.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_1.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1408/251424335C5.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1408/0109292I2U.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_1.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_5_20130716.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/1016440UA2.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1404/0913524M015.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_6.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/libg_1.gif
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img06.jpg
hxxp://e.xdwscache.glb0.lxdns.com/new5.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy2/icon_keys.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_1.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1302/1Q62S330N.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1209/1GQ340U13.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/n_zm1.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/bg_3.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_4.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_1.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/left.gif
hxxp://download023.rdb.cnc.ccgslb.net/4399swf/js/chkDomain.js
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/sszn.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/nav_bg.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/scbg.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/bg_7.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/n_mg_bg.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/lmbtn.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_2.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/tgbtn.gif
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img011.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2013/5/27/4399_17053265645.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/ico_1.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/ftbtn.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_3.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/faspbtn.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/more_boss.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/more_boss_s.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_8.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/more_zb.gif
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img09.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/libg_2.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_9.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/ico_ann.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_4.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_lm.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_5.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_6.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/jcsp_1.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/sp_line_1.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_5.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_9.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/zb_nav_20131205.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/libg_3.gif
hxxp://e.xdwscache.glb0.lxdns.com/jss/lazy_iframe.js
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/right.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_2.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_2.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_3.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_3.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_4.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_4.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/new_icon_1.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/zrsp_1.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_5.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_8.png
hxxp://e.xdwscache.glb0.lxdns.com/jss/news_footer.js
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/newaobidao/ico.gif
hxxp://e.xdwscache.glb0.lxdns.com/js/bdshare.js?t=844
hxxp://e.xdwscache.glb0.lxdns.com/jss/zmxy3_20130916.js?v=1
hxxp://e.xdwscache.glb0.lxdns.com/resource/ucenter.js?20130513
hxxp://e.xdwscache.glb0.lxdns.com/resource/css/base.css
hxxp://cc00063.h.cnc.ccgslb.net/flashUniLogin/css/style.css?v=20121016
hxxp://bae.jomodns.com/static/js/shell_v2.js?t=4
hxxp://download023.rdb.cnc.ccgslb.net/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.swf
hxxp://bae.jomodns.com/static/js/logger.js?cdnversion=391610
hxxp://bae.jomodns.com/static/js/bds_s_v2.js?cdnversion=391610
hxxp://bae.jomodns.com/static/css/bdsstyle.css?cdnversion=20131219
hxxp://bae.jomodns.com/static/images/is.png?cdnversion=20131219
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/sy_ico.gif
hxxp://e.xdwscache.glb0.lxdns.com/jss/play_hs1202.js
hxxp://e.xdwscache.glb0.lxdns.com/jss/4399.js
hxxp://4399stat.5054399.com/js/click.js	115.182.52.78
hxxp://stat.d.4399api.net/crossdomain.xml
hxxp://stat.d.4399api.net/flash_ctrl_version.xml?ran=38740.6537309289
hxxp://tauruscz.danuoyi.tbcache.com/c.php?id=30039538
hxxp://c.split.cnzz.com/core.php?web_id=30039538&t=q
hxxp://c.split.cnzz.com/stat.php?id=4073713&web_id=4073713&show=pic
hxxp://q7.cnzz.com/stat.htm?id=30039538&r=&lg=en-us&ntime=none&cnzz_eid=805688180-1409790831-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=2086695384
hxxp://c.split.cnzz.com/core.php?web_id=4073713&show=pic&t=z
hxxp://e.xdwscache.glb0.lxdns.com/crossdomain.xml
hxxp://z3.cnzz.com/stat.htm?id=4073713&r=&lg=en-us&ntime=none&cnzz_eid=916211647-1409794086-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=485620972
hxxp://e.xdwscache.glb0.lxdns.com/control/zwsf2-3.gif?20120719
hxxp://icon.cnzz.com/img/pic.gif	42.156.162.7
hxxp://e.xdwscache.glb0.lxdns.com/control/A4399dv_base.swf?20130625
hxxp://stat.d.4399api.net/xml.php?ran=3799.88020285964&gameid=100015389&url=http://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.htm
hxxp://static.n.shifen.com/v.gif?pid=307&type=3071&sc=1980,4739,1276,818&desturl=&apitype=1&linkid=hznf0pbl823&velo_load=1735&velo_cssload=1016&velo_jsLoad=1000&cite_uid=480925&cite_type=1&cite_mini=1
hxxp://cb.e.shifen.com/crossdomain.xml
hxxp://cb.e.shifen.com/ecom?di=62872&tm=BAIDU_CLB_XML&asp_url=4399.com&return_type=1&ran=810.5809288099408
hxxp://cpro.e.shifen.com/cpro/ui/baiduLoader_as3.swf
hxxp://cpro.e.shifen.com/cpro/ui/uijs.php?at=6&fv=11&ch=417&ie=1&q=www4399com_tp_cpr&n=1&k=茅虏艙猫艩卤&f=猫驴鈥∶β宦っ