Gen:Variant.Strictor.107039 (BitDefender), Trojan:Win32/Tonmye (Microsoft), Gen:Variant.Strictor.107039 (B) (Emsisoft), Artemis!20C21AD8F386 (McAfee), Trojan.Gen.2 (Symantec), Gen:Variant.Strictor.107039 (FSecure), Generic_r.JKY (AVG), Win32:Malware-gen (Avast), Gen:Variant.Strictor.107039 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm, Malware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 20c21ad8f386a35e5ba818da389092bd
SHA1: 66a06a9f62572e5669b96c86a1c6d305678b85f9
SHA256: 0d8facf4ed9ddfaefa78b279b8c267d71b62e592f657a805ba02fa57a3da4f63
SSDeep: 49152:Ti2g Kb0ByEJUx5pVuNfGouQwj8s4sjAGlgSxZsbS7/Kx5BJ75:Oz g5pVuVGVQwj8ojAGWSxZsbO/u5Bd
Size: 2117632 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2016-06-01 10:00:21
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-PSW. Trojan program intended for stealing users passwords.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:344
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:344 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
C:\exdui.dll (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\47e1d0e04e8a224cbc6eedb4d182fd1a[1] (8281 bytes)
C:\CF_Updata.dll (1676 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
C:\CF_data.ini (54 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\47e1d0e04e8a224cbc6eedb4d182fd1a[1] (0 bytes)
Registry activity
The process %original file name%.exe:344 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 6D C4 E4 57 93 13 A2 B1 6E 73 3B EB A1 E1 29"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
e44c7bf56128f65884eac626e25ecc8f | c:\CF_Updata.dll |
c472335b008c5942ec8a162177058111 | c:\exdui.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
C:\exdui.dll (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\47e1d0e04e8a224cbc6eedb4d182fd1a[1] (8281 bytes)
C:\CF_Updata.dll (1676 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
C:\CF_data.ini (54 bytes) - Reboot the computer.
Static Analysis
VersionInfo
Company Name: Leesin
Product Name: CF????
Product Version: 2.5.0.0
Legal Copyright: http://www.cfzhushou.com
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.5.0.0
File Description: CF????
Comments: CF????
Language: English (United States)
Company Name: LeesinProduct Name: CF????Product Version: 2.5.0.0Legal Copyright: http://www.cfzhushou.comLegal Trademarks: Original Filename: Internal Name: File Version: 2.5.0.0File Description: CF????Comments: CF????Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 2535424 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 2539520 | 2072576 | 2068992 | 5.46798 | e5ae72d02ab4735d74de21ab0d0cedbe |
.rsrc | 4612096 | 49152 | 47616 | 3.74558 | 216e63d3f59081c5ae1777a7db8ac6c2 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_344:
`.rsrc
`.rsrc
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
ws2_32.dll
ws2_32.dll
kernel32.dll
kernel32.dll
user32.dll
user32.dll
User32.dll
User32.dll
Kernel32.dll
Kernel32.dll
shell32.dll
shell32.dll
gdiplus.dll
gdiplus.dll
GdiPlus.dll
GdiPlus.dll
Ole32.dll
Ole32.dll
OleAut32.dll
OleAut32.dll
CF_Updata.dll
CF_Updata.dll
wininet.dll
wininet.dll
ole32.dll
ole32.dll
atl.dll
atl.dll
gzip.dll
gzip.dll
ntdll.dll
ntdll.dll
urlmon
urlmon
gdi32.dll
gdi32.dll
Gdi32.dll
Gdi32.dll
imm32.dll
imm32.dll
OLEACC.DLL
OLEACC.DLL
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
GetAsyncKeyState
GetAsyncKeyState
GetProcessHeap
GetProcessHeap
GdipSetStringFormatHotkeyPrefix
GdipSetStringFormatHotkeyPrefix
RegisterHotKey
RegisterHotKey
UnregisterHotKey
UnregisterHotKey
ShellExecuteA
ShellExecuteA
42305932-06E6-47a5-AC79-8BDCDC58DF61
42305932-06E6-47a5-AC79-8BDCDC58DF61
WebBrowser
WebBrowser
JOIN
JOIN
CONFIG.SYS
CONFIG.SYS
DosExecPgm
DosExecPgm
Windows
Windows
1613-Windows
1613-Windows
WindowsServicePark
WindowsServicePark
1615-SQL
1615-SQL
1631-Windows
1631-Windows
1637-Windows
1637-Windows
WindowsServicePack
WindowsServicePack
1642-Windows
1642-Windows
WindowsRPC
WindowsRPC
Windows2000
Windows2000
CommPort
CommPort
NET.ACC
NET.ACC
LANMAN\NETPROG\ADDPAK.SER
LANMAN\NETPROG\ADDPAK.SER
CACHE.EXE
CACHE.EXE
WindowsNT
WindowsNT
3108-NETWKSTA.SYS
3108-NETWKSTA.SYS
CLANROOT\LOGS\FT.LOG
CLANROOT\LOGS\FT.LOG
LAMAN.INI
LAMAN.INI
3404-LAMAN.INI
3404-LAMAN.INI
NETWKSTA.SYS
NETWKSTA.SYS
3804-SCHED.LOG
3804-SCHED.LOG
3901-****
3901-****
3902-****
3902-****
4454-WindowsNT
4454-WindowsNT
4470-Windows2000
4470-Windows2000
4486-WindowsNT
4486-WindowsNT
4488-WindowsNTServer
4488-WindowsNTServer
4696-WindowsNTServer
4696-WindowsNTServer
4697-WindowsNTWorkstation
4697-WindowsNTWorkstation
5295-NETUS.HLP
5295-NETUS.HLP
5296-NET.HLP
5296-NET.HLP
5509-Windows2000
5509-Windows2000
RPLDISK.SYS
RPLDISK.SYS
$SystemRootSystem32Configetlogon.dns$
$SystemRootSystem32Configetlogon.dns$
MODEM.INF
MODEM.INF
schema.ini
schema.ini
2.5.5.1
2.5.5.1
2.5.5.7
2.5.5.7
2.5.5.14
2.5.5.14
9851-TCP/IP
9851-TCP/IP
\exdui.dll
\exdui.dll
.rsrc
.rsrc
@V.Dv
@V.Dv
.UmKm
.UmKm
4v %u
4v %u
oft.XMLDOMnY
oft.XMLDOMnY
\dwmapi.dll
\dwmapi.dll
A715A0-6587-11D0-924A_20AFC7/
A715A0-6587-11D0-924A_20AFC7/
Leave.CoIn@alize
Leave.CoIn@alize
number is %d.
number is %d.
:"%s"
:"%s"
..0`%X
..0`%X
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
ATL.DLL
ATL.DLL
GDI32.dll
GDI32.dll
MSVCRT.dll
MSVCRT.dll
OLEAUT32.dll
OLEAUT32.dll
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
USER32.dll
USER32.dll
exdui.dll
exdui.dll
t=.VMV
t=.VMV
%%fnW
%%fnW
,7Z.in
,7Z.in
k`%u"]
k`%u"]
Z,c
Z,c
1,,.aa
1,,.aa
hXXp://
hXXp://
, #&')*)
, #&')*)
-0-(0%()(
-0-(0%()(
k.fb2
k.fb2
9%fWS2
9%fWS2
9h.oc
9h.oc
".aBp
".aBp
.ijWU5
.ijWU5
w%SY
w%SY
Wkbn%X
Wkbn%X
kEYH
kEYH
&.kPd
&.kPd
(s.PKL
(s.PKL
MsgBox
MsgBox
SysShadow.SubWnd
SysShadow.SubWnd
%f%%f
%f%%f
7".Fv
7".Fv
>.OsM
>.OsM
r.vDO
r.vDO
V2.5.0
V2.5.0
\CF_data.ini
\CF_data.ini
hXXp://q.qlogo.cn/headimg_dl?bs=qq&dst_uin=
hXXp://q.qlogo.cn/headimg_dl?bs=qq&dst_uin=
hXXp://note.youdao.com/yws/public/note/47e1d0e04e8a224cbc6eedb4d182fd1a?keyfrom=public
hXXp://note.youdao.com/yws/public/note/47e1d0e04e8a224cbc6eedb4d182fd1a?keyfrom=public
hXXp://leesin1.zichaob.com/cf.txt
hXXp://leesin1.zichaob.com/cf.txt
\CF_Updata.dll
\CF_Updata.dll
.yP[=
.yP[=
%XX7.
%XX7.
i.dhG
i.dhG
'ASho%x
'ASho%x
,%u9]
,%u9]
w5\pUWSSHh
w5\pUWSSHh
$%FNHfI
$%FNHfI
.htbW
.htbW
.Be$>;
.Be$>;
.OXWh0T
.OXWh0T
AR,O%U
AR,O%U
0FtPo
0FtPo
R.NL3
R.NL3
.QTC0
.QTC0
z=Q%c`H
z=Q%c`H
%u5.]X
%u5.]X
.PTJ2T
.PTJ2T
WudP
WudP
ab.Lkl%
ab.Lkl%
%&'%u
%&'%u
dB.pn*
dB.pn*
l0y.WD
l0y.WD
.tCDHP
.tCDHP
.dHu`
.dHu`
WV4o.Ct
WV4o.Ct
EU%X_
EU%X_
0K.WN40
0K.WN40
.UGP$Kr
.UGP$Kr
WaM@{.wB_
WaM@{.wB_
<.>
<.>
X%C@ X
X%C@ X
.hZM:
.hZM:
l%uBGX
l%uBGX
,
,
ininet.dll
ininet.dll
33.cos.myq
33.cos.myq
m/1.txt
m/1.txt
form-urlF
form-urlF
7.P|.Nr
7.P|.Nr
0ZR.BI@/DE0,
0ZR.BI@/DE0,
O.OPP
O.OPP
%d&&'
%d&&'
*)(''&%$$#""!!
*)(''&%$$#""!!
?%*.*f
?%*.*f
_CmdT"
_CmdT"
.INI.HL^$=
.INI.HL^$=
R.MSVCRTerhC
R.MSVCRTerhC
9y.xX
9y.xX
9y.Phh
9y.Phh
X%Sm'
X%Sm'
.PAVG
.PAVG
(&07-034/)7
(&07-034/)7
)*$-2{
)*$-2{
%s:%d/]
%s:%d/]
6]| 0 '.
6]| 0 '.
Eh.dE7
Eh.dE7
keyw
keyw
E:\e5\
E:\e5\
%SOCK
%SOCK
29\TCP"d7
29\TCP"d7
qCONT.WlB
qCONT.WlB
f2pn-t|/tcp;
f2pn-t|/tcp;
.dyw(/cn.dx
.dyw(/cn.dx
zcÃ
zcÃ
Ug>Key
Ug>Key
=.tex
=.tex
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
PAD
PAD
COMCTL32.dll
COMCTL32.dll
comdlg32.dll
comdlg32.dll
WINMM.dll
WINMM.dll
WINSPOOL.DRV
WINSPOOL.DRV
WS2_32.dll
WS2_32.dll
RegCloseKey
RegCloseKey
2.dll
2.dll
.jF
.jF
https
https
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
http=
http=
HTTP/1.1
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
hXXps://
hXXps://
&s_url=http://cf.qq.com/comm-htdocs/login/logincallback.htm&f_url=&ptlang=2052&ptredirect=100&aid=21000124&daid=8&j_later=0&low_login_hour=0®master=0&pt_login_type=1&pt_aid=0&pt_aaid=0&pt_light=0&pt_3rd_aid=0
&s_url=http://cf.qq.com/comm-htdocs/login/logincallback.htm&f_url=&ptlang=2052&ptredirect=100&aid=21000124&daid=8&j_later=0&low_login_hour=0®master=0&pt_login_type=1&pt_aid=0&pt_aaid=0&pt_light=0&pt_3rd_aid=0
&service=login&nodirect=0&ptsigx=
&service=login&nodirect=0&ptsigx=
hXXp://ptlogin4.game.qq.com/check_sig?pttype=1&uin=
hXXp://ptlogin4.game.qq.com/check_sig?pttype=1&uin=
p_skey=
p_skey=
skey=
skey=
666666666
666666666
hXXp://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=cf&area=
hXXp://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=cf&area=
szNick_name=
szNick_name=
news.exe
news.exe
,.Ey)
,.Ey)
qTcp,
qTcp,
hXXp://wpa.qq.com/msgrd?v=3&uin=138417120&site=qq&menu=yes
hXXp://wpa.qq.com/msgrd?v=3&uin=138417120&site=qq&menu=yes
hXXp://apps.game.qq.com/cf/a20141126main/getUserInfo.php?action=initQuery&sArea=
hXXp://apps.game.qq.com/cf/a20141126main/getUserInfo.php?action=initQuery&sArea=
hXXp://apps.game.qq.com/cgi-bin/cf/cfvip/checkCFvipStatue.cgi?rd=0.3552593735512346&_=1459778886737
hXXp://apps.game.qq.com/cgi-bin/cf/cfvip/checkCFvipStatue.cgi?rd=0.3552593735512346&_=1459778886737
msg":"
msg":"
tEXtXML:com.adobe.xmp
tEXtXML:com.adobe.xmp
xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/"
xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/"
xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/"
xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/"
xmlns:dc="hXXp://purl.org/dc/elements/1.1/"
xmlns:dc="hXXp://purl.org/dc/elements/1.1/"
xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/"
xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/"
xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#"
xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#"
xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/"
xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/"
xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">
xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">
Adobe Photoshop CC (Windows)
Adobe Photoshop CC (Windows)
/* |xGv00|13a28bd5e87728de7241d2f04c3c02f5 */hXXp://apps.game.qq.com/cf/cfvip/doCfVip.php?action=getCfVipInfo&rd=0.16843547895445687&_=1459479795992
/* |xGv00|13a28bd5e87728de7241d2f04c3c02f5 */hXXp://apps.game.qq.com/cf/cfvip/doCfVip.php?action=getCfVipInfo&rd=0.16843547895445687&_=1459479795992
hXXp://apps.game.qq.com/php/tgclub/v2/user/logininfo?callback=jQuery17209628733010031283_1459773913284&_=1459773913464
hXXp://apps.game.qq.com/php/tgclub/v2/user/logininfo?callback=jQuery17209628733010031283_1459773913284&_=1459773913464
ÿF8>NFFFh
ÿF8>NFFFh
ÿFV
ÿFV
&e_code=0&g_code=0&eas_url=http://xinyue.qq.com/act/pc/shenhanghezuoPC/&sServiceDepartment=xinyue
&e_code=0&g_code=0&eas_url=http://xinyue.qq.com/act/pc/shenhanghezuoPC/&sServiceDepartment=xinyue
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=40568&sServiceDepartment=xinyue&set_info=xinyue
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=40568&sServiceDepartment=xinyue&set_info=xinyue
cdkeylist":"
cdkeylist":"
&appid=15000103&js_ver=10153&js_type=1&login_sig=0nLadn6F*IOLoKBk7n-g3iCxqdCGPSIeyZhV-iaDTmCcf6BeP3DeVa3TGrAvmDod&u1=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&r=0.15214470936916769
&appid=15000103&js_ver=10153&js_type=1&login_sig=0nLadn6F*IOLoKBk7n-g3iCxqdCGPSIeyZhV-iaDTmCcf6BeP3DeVa3TGrAvmDod&u1=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&r=0.15214470936916769
hXXp://check.ptlogin2.qq.com/check?regmaster=&pt_tea=1&pt_vcode=1&uin=
hXXp://check.ptlogin2.qq.com/check?regmaster=&pt_tea=1&pt_vcode=1&uin=
&pt_randsalt=0&ptredirect=1&u1=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=2-6-1461659794871&js_ver=10153&js_type=1&login_sig=0nLadn6F*IOLoKBk7n-g3iCxqdCGPSIeyZhV-iaDTmCcf6BeP3DeVa3TGrAvmDod&pt_uistyle=20&aid=15000103&daid=5&
&pt_randsalt=0&ptredirect=1&u1=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=2-6-1461659794871&js_ver=10153&js_type=1&login_sig=0nLadn6F*IOLoKBk7n-g3iCxqdCGPSIeyZhV-iaDTmCcf6BeP3DeVa3TGrAvmDod&pt_uistyle=20&aid=15000103&daid=5&
hXXp://ptlogin2.qq.com/login?u=
hXXp://ptlogin2.qq.com/login?u=
&s_url=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&f_url=&ptlang=2052&ptredirect=100&aid=1000101&daid=5&j_later=0&low_login_hour=0®master=0&pt_login_type=2&pt_aid=15000103&pt_aaid=0&pt_light=0&pt_3rd_aid=0
&s_url=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&f_url=&ptlang=2052&ptredirect=100&aid=1000101&daid=5&j_later=0&low_login_hour=0®master=0&pt_login_type=2&pt_aid=15000103&pt_aaid=0&pt_light=0&pt_3rd_aid=0
hXXp://ptlogin4.qzone.qq.com/check_sig?pttype=2&uin=
hXXp://ptlogin4.qzone.qq.com/check_sig?pttype=2&uin=
return binl2hex(core_md5(str2binl(s), s.length * chrsz))
return binl2hex(core_md5(str2binl(s), s.length * chrsz))
return binl2str(core_md5(str2binl(s), s.length * chrsz))
return binl2str(core_md5(str2binl(s), s.length * chrsz))
function hex_hmac_md5(key, data) {
function hex_hmac_md5(key, data) {
return binl2hex(core_hmac_md5(key, data))
return binl2hex(core_hmac_md5(key, data))
function b64_hmac_md5(key, data) {
function b64_hmac_md5(key, data) {
return binl2b64(core_hmac_md5(key, data))
return binl2b64(core_hmac_md5(key, data))
function str_hmac_md5(key, data) {
function str_hmac_md5(key, data) {
return binl2str(core_hmac_md5(key, data))
return binl2str(core_hmac_md5(key, data))
for (var i = 0; i
for (var i = 0; i
function core_hmac_md5(key, data) {
function core_hmac_md5(key, data) {
var bkey = str2binl(key);
var bkey = str2binl(key);
if (bkey.length > 16) {
if (bkey.length > 16) {
bkey = core_md5(bkey, key.length * chrsz)
bkey = core_md5(bkey, key.length * chrsz)
ipad[i] = bkey[i] ^ 909522486;
ipad[i] = bkey[i] ^ 909522486;
opad[i] = bkey[i] ^ 1549556828
opad[i] = bkey[i] ^ 1549556828
var hash = core_md5(ipad.concat(str2binl(data)), 512 data.length * chrsz);
var hash = core_md5(ipad.concat(str2binl(data)), 512 data.length * chrsz);
return core_md5(opad.concat(hash), 512 128)
return core_md5(opad.concat(hash), 512 128)
for (var i = 0; i
for (var i = 0; i
bin[i >> 5] |= (str.charCodeAt(i / chrsz) & mask)
bin[i >> 5] |= (str.charCodeAt(i / chrsz) & mask)
for (var i = 0; i
for (var i = 0; i
str = String.fromCharCode((bin[i >> 5] >>> (i % 32)) & mask)
str = String.fromCharCode((bin[i >> 5] >>> (i % 32)) & mask)
for (var i = 0; i
for (var i = 0; i
str = hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8 4)) & 15) hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8)) & 15)
str = hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8 4)) & 15) hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8)) & 15)
for (var i = 0; i
for (var i = 0; i
if (i * 8 j * 6 > binarray.length * 32) {
if (i * 8 j * 6 > binarray.length * 32) {
str = tab.charAt((triplet >> 6 * (3 - j)) & 63)
str = tab.charAt((triplet >> 6 * (3 - j)) & 63)
for (var i = 0; i
for (var i = 0; i
arr.push('\\x' str.substr(i, 2))
arr.push('\\x' str.substr(i, 2))
arr = arr.join('');
arr = arr.join('');
function getEncryption(password, salt, vcode, isMd5) {
function getEncryption(password, salt, vcode, isMd5) {
password = password || '';
password = password || '';
var md5Pwd = isMd5 ? password: md5(password),
var md5Pwd = isMd5 ? password: md5(password),
rsaH1 = $.RSA.rsa_encrypt(h1),
rsaH1 = $.RSA.rsa_encrypt(h1),
rsaH1Len = (rsaH1.length / 2).toString(16),
rsaH1Len = (rsaH1.length / 2).toString(16),
hexVcode = TEA.strToBytes(vcode.toUpperCase()),
hexVcode = TEA.strToBytes(vcode.toUpperCase()),
vcodeLen = '000' vcode.length.toString(16);
vcodeLen = '000' vcode.length.toString(16);
while (rsaH1Len.length
while (rsaH1Len.length
TEA.initkey(s2);
TEA.initkey(s2);
var saltPwd = TEA.enAsBase64(rsaH1Len rsaH1 TEA.strToBytes(salt) vcodeLen hexVcode);
var saltPwd = TEA.enAsBase64(rsaH1Len rsaH1 TEA.strToBytes(salt) vcodeLen hexVcode);
TEA.initkey('');
TEA.initkey('');
return saltPwd.replace(/[\/\ =]/g,
return saltPwd.replace(/[\/\ =]/g,
'/': '-',
'/': '-',
' ': '*',
' ': '*',
'=': '_'
'=': '_'
function getRSAEncryption(password, vcode, isMd5) {
function getRSAEncryption(password, vcode, isMd5) {
var str1 = isMd5 ? password: md5(password);
var str1 = isMd5 ? password: md5(password);
var str2 = str1 vcode.toUpperCase();
var str2 = str1 vcode.toUpperCase();
var str3 = $.RSA.rsa_encrypt(str2);
var str3 = $.RSA.rsa_encrypt(str2);
$.RSA = function() {
$.RSA = function() {
while (z aD
while (z aD
t = aC.substring(z, z aD) '\n';
t = aC.substring(z, z aD) '\n';
return t aC.substring(z, aC.length)
return t aC.substring(z, aC.length)
return '0' t.toString(16)
return '0' t.toString(16)
return t.toString(16)
return t.toString(16)
if (aG
if (aG
var aC = aD.length - 1;
var aC = aD.length - 1;
var aE = aD.charCodeAt(aC--);
var aE = aD.charCodeAt(aC--);
z.nextBytes(t)
z.nextBytes(t)
this.dmp1 = null;
this.dmp1 = null;
this.dmq1 = null;
this.dmq1 = null;
this.coeff = null
this.coeff = null
if (z != null && t != null && z.length > 0 && t.length > 0) {
if (z != null && t != null && z.length > 0 && t.length > 0) {
uv_alert('Invalid RSA public key')
uv_alert('Invalid RSA public key')
return t.modPowInt(this.e, this.n)
return t.modPowInt(this.e, this.n)
var t = ah(aC, (this.n.bitLength() 7) >> 3);
var t = ah(aC, (this.n.bitLength() 7) >> 3);
var aD = this.doPublic(t);
var aD = this.doPublic(t);
var z = aD.toString(16);
var z = aD.toString(16);
if ((z.length & 1) == 0) {
if ((z.length & 1) == 0) {
N.prototype.doPublic = Y;
N.prototype.doPublic = Y;
N.prototype.setPublic = q;
N.prototype.setPublic = q;
N.prototype.encrypt = r;
N.prototype.encrypt = r;
this.fromNumber(z, t, aC)
this.fromNumber(z, t, aC)
this.fromString(z, 256)
this.fromString(z, 256)
this.fromString(z, t)
this.fromString(z, t)
aG = Math.floor(aC / 67108864);
aG = Math.floor(aC / 67108864);
if (ab && (navigator.appName == 'Microsoft Internet Explorer')) {
if (ab && (navigator.appName == 'Microsoft Internet Explorer')) {
au.prototype.am = aA;
au.prototype.am = aA;
if (ab && (navigator.appName != 'Netscape')) {
if (ab && (navigator.appName != 'Netscape')) {
au.prototype.am = b;
au.prototype.am = b;
au.prototype.am = az;
au.prototype.am = az;
au.prototype.DB = ay;
au.prototype.DB = ay;
au.prototype.DM = ((1
au.prototype.DM = ((1
au.prototype.DV = (1
au.prototype.DV = (1
au.prototype.FV = Math.pow(2, ac);
au.prototype.FV = Math.pow(2, ac);
au.prototype.F1 = ac - ay;
au.prototype.F1 = ac - ay;
au.prototype.F2 = 2 * ay - ac;
au.prototype.F2 = 2 * ay - ac;
ar = '0'.charCodeAt(0);
ar = '0'.charCodeAt(0);
ar = 'a'.charCodeAt(0);
ar = 'a'.charCodeAt(0);
ar = 'A'.charCodeAt(0);
ar = 'A'.charCodeAt(0);
return ag.charAt(t)
return ag.charAt(t)
var aC = ai[z.charCodeAt(t)];
var aC = ai[z.charCodeAt(t)];
z.fromInt(t);
z.fromInt(t);
this.fromRadix(aG, z);
this.fromRadix(aG, z);
var aF = aG.length,
var aF = aG.length,
if (aG.charAt(aF) == '-') {
if (aG.charAt(aF) == '-') {
if (aE aD > this.DB) {
if (aE aD > this.DB) {
this[this.t - 1] |= (t & ((1
this[this.t - 1] |= (t & ((1
this[this.t ] = (t >> (this.DB - aE))
this[this.t ] = (t >> (this.DB - aE))
if (aE >= this.DB) {
if (aE >= this.DB) {
aE -= this.DB
aE -= this.DB
this[this.t - 1] |= ((1
this[this.t - 1] |= ((1
this.clamp();
this.clamp();
au.ZERO.subTo(this, this)
au.ZERO.subTo(this, this)
var t = this.s & this.DM;
var t = this.s & this.DM;
return '-' this.negate().toString(z)
return '-' this.negate().toString(z)
return this.toRadix(z)
return this.toRadix(z)
var aG = this.DB - (aD * this.DB) % aC;
var aG = this.DB - (aD * this.DB) % aC;
if (aG > aG) > 0) {
if (aG > aG) > 0) {
aH |= this[--aD] >> (aG = this.DB - aC)
aH |= this[--aD] >> (aG = this.DB - aC)
aG = this.DB; --aD
aG = this.DB; --aD
au.ZERO.subTo(this, t);
au.ZERO.subTo(this, t);
return (this.s
return (this.s
return this.DB * (this.t - 1) l(this[this.t - 1] ^ (this.s & this.DM))
return this.DB * (this.t - 1) l(this[this.t - 1] ^ (this.s & this.DM))
z.t = Math.max(this.t - aC, 0);
z.t = Math.max(this.t - aC, 0);
var z = aH % this.DB;
var z = aH % this.DB;
var t = this.DB - z;
var t = this.DB - z;
var aE = Math.floor(aH / this.DB),
var aE = Math.floor(aH / this.DB),
aG = (this.s
aG = (this.s
aD.clamp()
aD.clamp()
var aE = Math.floor(aG / this.DB);
var aE = Math.floor(aG / this.DB);
var z = aG % this.DB;
var z = aG % this.DB;
t = Math.min(z.t, this.t);
t = Math.min(z.t, this.t);
aD[aC ] = aE & this.DM;
aD[aC ] = aE & this.DM;
aE >>= this.DB
aE >>= this.DB
aD[aC ] = aE & this.DM;
aD[aC ] = aE & this.DM;
aE >>= this.DB
aE >>= this.DB
aD[aC ] = this.DV aE
aD[aC ] = this.DV aE
var t = this.abs(),
var t = this.abs(),
aE = z.abs();
aE = z.abs();
aD[aC t.t] = t.am(0, aE[aC], aD, aC, 0, t.t)
aD[aC t.t] = t.am(0, aE[aC], aD, aC, 0, t.t)
aD.clamp();
aD.clamp();
au.ZERO.subTo(aD, aD)
au.ZERO.subTo(aD, aD)
var t = this.abs();
var t = this.abs();
var aD = t.am(z, t[z], aC, 2 * z, 0, 1);
var aD = t.am(z, t[z], aC, 2 * z, 0, 1);
if ((aC[z t.t] = t.am(z 1, 2 * t[z], aC, 2 * z 1, aD, t.t - z - 1)) >= t.DV) {
if ((aC[z t.t] = t.am(z 1, 2 * t[z], aC, 2 * z 1, aD, t.t - z - 1)) >= t.DV) {
aC[z t.t] -= t.DV;
aC[z t.t] -= t.DV;
aC[aC.t - 1] = t.am(z, t[z], aC, 2 * z, 0, 1)
aC[aC.t - 1] = t.am(z, t[z], aC, 2 * z, 0, 1)
aC.clamp()
aC.clamp()
var aQ = aK.abs();
var aQ = aK.abs();
var aI = this.abs();
var aI = this.abs();
aH.fromInt(0)
aH.fromInt(0)
this.copyTo(aG)
this.copyTo(aG)
var aP = this.DB - l(aQ[aQ.t - 1]);
var aP = this.DB - l(aQ[aQ.t - 1]);
aQ.lShiftTo(aP, aE);
aQ.lShiftTo(aP, aE);
aI.lShiftTo(aP, aG)
aI.lShiftTo(aP, aG)
aQ.copyTo(aE);
aQ.copyTo(aE);
aI.copyTo(aG)
aI.copyTo(aG)
var aT = this.FV / aL,
var aT = this.FV / aL,
aE.dlShiftTo(aN, aF);
aE.dlShiftTo(aN, aF);
if (aG.compareTo(aF) >= 0) {
if (aG.compareTo(aF) >= 0) {
aG.subTo(aF, aG)
aG.subTo(aF, aG)
au.ONE.dlShiftTo(aM, aF);
au.ONE.dlShiftTo(aM, aF);
aF.subTo(aE, aE);
aF.subTo(aE, aE);
var aD = (aG[--aO] == aC) ? this.DM: Math.floor(aG[aO] * aT (aG[aO - 1] aR) * aS);
var aD = (aG[--aO] == aC) ? this.DM: Math.floor(aG[aO] * aT (aG[aO - 1] aR) * aS);
if ((aG[aO] = aE.am(0, aD, aG, aN, 0, aM))
if ((aG[aO] = aE.am(0, aD, aG, aN, 0, aM))
aE.dlShiftTo(aN, aF);
aE.dlShiftTo(aN, aF);
aG.subTo(aF, aG);
aG.subTo(aF, aG);
aG.subTo(aF, aG)
aG.subTo(aF, aG)
aG.drShiftTo(aM, aH);
aG.drShiftTo(aM, aH);
au.ZERO.subTo(aH, aH)
au.ZERO.subTo(aH, aH)
aG.clamp();
aG.clamp();
aG.rShiftTo(aP, aG)
aG.rShiftTo(aP, aG)
au.ZERO.subTo(aG, aG)
au.ZERO.subTo(aG, aG)
this.abs().divRemTo(t, null, z);
this.abs().divRemTo(t, null, z);
if (this.s 0) {
if (this.s 0) {
t.subTo(z, z)
t.subTo(z, z)
if (t.s = 0) {
if (t.s = 0) {
return t.mod(this.m)
return t.mod(this.m)
t.divRemTo(this.m, null, t)
t.divRemTo(this.m, null, t)
t.multiplyTo(aC, z);
t.multiplyTo(aC, z);
this.reduce(z)
this.reduce(z)
t.squareTo(z);
t.squareTo(z);
M.prototype.convert = X;
M.prototype.convert = X;
M.prototype.revert = am;
M.prototype.revert = am;
M.prototype.reduce = L;
M.prototype.reduce = L;
M.prototype.mulTo = J;
M.prototype.mulTo = J;
M.prototype.sqrTo = aw;
M.prototype.sqrTo = aw;
z = (z * (2 - t * z % this.DV)) % this.DV;
z = (z * (2 - t * z % this.DV)) % this.DV;
return (z > 0) ? this.DV - z: -z
return (z > 0) ? this.DV - z: -z
this.mp = t.invDigit();
this.mp = t.invDigit();
this.mpl = this.mp & 32767;
this.mpl = this.mp & 32767;
this.mph = this.mp >> 15;
this.mph = this.mp >> 15;
this.um = (1
this.um = (1
this.mt2 = 2 * t.t
this.mt2 = 2 * t.t
t.abs().dlShiftTo(this.m.t, z);
t.abs().dlShiftTo(this.m.t, z);
z.divRemTo(this.m, null, z);
z.divRemTo(this.m, null, z);
if (t.s 0) {
if (t.s 0) {
this.m.subTo(z, z)
this.m.subTo(z, z)
t.copyTo(z);
t.copyTo(z);
this.reduce(z);
this.reduce(z);
while (t.t
while (t.t
var aD = (z * this.mpl (((z * this.mph (t[aC] >> 15) * this.mpl) & this.um)
var aD = (z * this.mpl (((z * this.mph (t[aC] >> 15) * this.mpl) & this.um)
t[z] = this.m.am(0, aD, t, aC, 0, this.m.t);
t[z] = this.m.am(0, aD, t, aC, 0, this.m.t);
while (t[z] >= t.DV) {
while (t[z] >= t.DV) {
t[z] -= t.DV;
t[z] -= t.DV;
t.clamp();
t.clamp();
t.drShiftTo(this.m.t, t);
t.drShiftTo(this.m.t, t);
if (t.compareTo(this.m) >= 0) {
if (t.compareTo(this.m) >= 0) {
t.subTo(this.m, t)
t.subTo(this.m, t)
g.prototype.convert = al;
g.prototype.convert = al;
g.prototype.revert = av;
g.prototype.revert = av;
g.prototype.reduce = R;
g.prototype.reduce = R;
g.prototype.mulTo = B;
g.prototype.mulTo = B;
g.prototype.sqrTo = ao;
g.prototype.sqrTo = ao;
return au.ONE
return au.ONE
aF = aI.convert(this),
aF = aI.convert(this),
aF.copyTo(aG);
aF.copyTo(aG);
aI.sqrTo(aG, aC);
aI.sqrTo(aG, aC);
aI.mulTo(aC, aF, aG)
aI.mulTo(aC, aF, aG)
return aI.revert(aG)
return aI.revert(aG)
if (aC
if (aC
return this.exp(aC, aD)
return this.exp(aC, aD)
au.prototype.copyTo = aa;
au.prototype.copyTo = aa;
au.prototype.fromInt = p;
au.prototype.fromInt = p;
au.prototype.fromString = y;
au.prototype.fromString = y;
au.prototype.clamp = Q;
au.prototype.clamp = Q;
au.prototype.dlShiftTo = at;
au.prototype.dlShiftTo = at;
au.prototype.drShiftTo = Z;
au.prototype.drShiftTo = Z;
au.prototype.lShiftTo = v;
au.prototype.lShiftTo = v;
au.prototype.rShiftTo = n;
au.prototype.rShiftTo = n;
au.prototype.subTo = ad;
au.prototype.subTo = ad;
au.prototype.multiplyTo = F;
au.prototype.multiplyTo = F;
au.prototype.squareTo = S;
au.prototype.squareTo = S;
au.prototype.divRemTo = G;
au.prototype.divRemTo = G;
au.prototype.invDigit = D;
au.prototype.invDigit = D;
au.prototype.isEven = k;
au.prototype.isEven = k;
au.prototype.exp = A;
au.prototype.exp = A;
au.prototype.toString = s;
au.prototype.toString = s;
au.prototype.negate = T;
au.prototype.negate = T;
au.prototype.abs = an;
au.prototype.abs = an;
au.prototype.compareTo = I;
au.prototype.compareTo = I;
au.prototype.bitLength = w;
au.prototype.bitLength = w;
au.prototype.mod = P;
au.prototype.mod = P;
au.prototype.modPowInt = ap;
au.prototype.modPowInt = ap;
au.ZERO = c(0);
au.ZERO = c(0);
au.ONE = c(1);
au.ONE = c(1);
d(new Date().getTime())
d(new Date().getTime())
if (navigator.appName == 'Netscape' && navigator.appVersion
if (navigator.appName == 'Netscape' && navigator.appVersion
var H = window.crypto.random(32);
var H = window.crypto.random(32);
for (K = 0; K
for (K = 0; K
W[ae ] = H.charCodeAt(K) & 255
W[ae ] = H.charCodeAt(K) & 255
K = Math.floor(65536 * Math.random());
K = Math.floor(65536 * Math.random());
o.init(W);
o.init(W);
for (ae = 0; ae
for (ae = 0; ae
return o.next()
return o.next()
for (t = 0; t
for (t = 0; t
af.prototype.nextBytes = ax;
af.prototype.nextBytes = ax;
z = (z this.S[aD] aE[aD % aE.length]) & 255;
z = (z this.S[aD] aE[aD % aE.length]) & 255;
m.prototype.init = f;
m.prototype.init = f;
m.prototype.next = a;
m.prototype.next = a;
t.setPublic(aC, z);
t.setPublic(aC, z);
return t.encrypt(aD)
return t.encrypt(aD)
return Math.round(Math.random() * 4294967295)
return Math.round(Math.random() * 4294967295)
for (var B = 0; B
for (var B = 0; B
var C = Number(D[B]).toString(16);
var C = Number(D[B]).toString(16);
if (C.length == 1) {
if (C.length == 1) {
for (var A = 0; A
for (var A = 0; A
C = String.fromCharCode(parseInt(B.substr(A, 2), 16))
C = String.fromCharCode(parseInt(B.substr(A, 2), 16))
for (var A = 0; A
for (var A = 0; A
B[A] = C.charCodeAt(A)
B[A] = C.charCodeAt(A)
var A = C.length;
var A = C.length;
var A = E.length;
var A = E.length;
for (var C = 0; C
for (var C = 0; C
var A = u.length;
var A = u.length;
for (var B = 0; B
for (var B = 0; B
C[B] = E.charCodeAt(B) & 255
C[B] = E.charCodeAt(B) & 255
for (var B = 0; B
for (var B = 0; B
C[A ] = parseInt(E.substr(B, 2), 16)
C[A ] = parseInt(E.substr(B, 2), 16)
s.TEA = {
s.TEA = {
for (var B = 0; B
for (var B = 0; B
A = String.fromCharCode(C[B])
A = String.fromCharCode(C[B])
return d.encode(A)
return d.encode(A)
initkey: function(A, B) {
initkey: function(A, B) {
d.PADCHAR = '=';
d.PADCHAR = '=';
d.ALPHA = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /';
d.ALPHA = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /';
d.getbyte = function(C, B) {
d.getbyte = function(C, B) {
var A = C.charCodeAt(B);
var A = C.charCodeAt(B);
d.encode = function(E) {
d.encode = function(E) {
if (arguments.length != 1) {
if (arguments.length != 1) {
var B = d.PADCHAR;
var B = d.PADCHAR;
var G = d.ALPHA;
var G = d.ALPHA;
var F = d.getbyte;
var F = d.getbyte;
var C = E.length - E.length % 3;
var C = E.length - E.length % 3;
if (E.length == 0) {
if (E.length == 0) {
A.push(G.charAt(H >> 18));
A.push(G.charAt(H >> 18));
A.push(G.charAt((H >> 12) & 63));
A.push(G.charAt((H >> 12) & 63));
A.push(G.charAt((H >> 6) & 63));
A.push(G.charAt((H >> 6) & 63));
A.push(G.charAt(H & 63))
A.push(G.charAt(H & 63))
switch (E.length - C) {
switch (E.length - C) {
A.push(G.charAt(H >> 18) G.charAt((H >> 12) & 63) B B);
A.push(G.charAt(H >> 18) G.charAt((H >> 12) & 63) B B);
A.push(G.charAt(H >> 18) G.charAt((H >> 12) & 63) G.charAt((H >> 6) & 63) B);
A.push(G.charAt(H >> 18) G.charAt((H >> 12) & 63) G.charAt((H >> 6) & 63) B);
return A.join('')
return A.join('')
if (!window.btoa) {
if (!window.btoa) {
window.btoa = d.encode
window.btoa = d.encode
var hex = str.toString(16);
var hex = str.toString(16);
var len = hex.length;
var len = hex.length;
arr.push('\\x' hex.substr(j, 2))
arr.push('\\x' hex.substr(j, 2))
var result = arr.join('');
var result = arr.join('');
hexVcode = s.TEA.strToBytes(c.toUpperCase()),
hexVcode = s.TEA.strToBytes(c.toUpperCase()),
vcodeLen = '000' c.length.toString(16);
vcodeLen = '000' c.length.toString(16);
s.TEA.initkey(s2);
s.TEA.initkey(s2);
var saltPwd = s.TEA.enAsBase64(rsaH1Len rsaH1 s.TEA.strToBytes(salt) vcodeLen hexVcode);
var saltPwd = s.TEA.enAsBase64(rsaH1Len rsaH1 s.TEA.strToBytes(salt) vcodeLen hexVcode);
s.TEA.initkey('');
s.TEA.initkey('');
&appid=21000124&js_ver=10151&js_type=1&login_sig=XJ3RXmdJfvKA-*hz7TXwNTq902uwplhW6tRdiEFDhxMVRhi1bDCo0QdXVBbNxAfN&u1=http://cf.qq.com/cp/a20160217cfyj/index.htm?e_code=213271&r=
&appid=21000124&js_ver=10151&js_type=1&login_sig=XJ3RXmdJfvKA-*hz7TXwNTq902uwplhW6tRdiEFDhxMVRhi1bDCo0QdXVBbNxAfN&u1=http://cf.qq.com/cp/a20160217cfyj/index.htm?e_code=213271&r=
function time(){return Math.random()}
function time(){return Math.random()}
hXXp://captcha.qq.com/cap_union_getsig_new?clientype=2&uin=
hXXp://captcha.qq.com/cap_union_getsig_new?clientype=2&uin=
hXXp://captcha.qq.com/getimgbysig?clientype=2&uin=
hXXp://captcha.qq.com/getimgbysig?clientype=2&uin=
&pt_randsalt=0&u1=http://cf.qq.com/cp/a20160217cfyj/index.htm?e_code=213271&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=2-4-1457704626950&js_ver=10151&js_type=1&login_sig=&pt_uistyle=32&aid=21000124&daid=8&
&pt_randsalt=0&u1=http://cf.qq.com/cp/a20160217cfyj/index.htm?e_code=213271&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=2-4-1457704626950&js_ver=10151&js_type=1&login_sig=&pt_uistyle=32&aid=21000124&daid=8&
pt_mbkey
pt_mbkey
d:d:d
d:d:d
hXXp://count.knowsky.com/count2/count.asp?id=85436&sx=1&ys=43
hXXp://count.knowsky.com/count2/count.asp?id=85436&sx=1&ys=43
hXXp://count.knowsky.com/img/(.*?)/(.*?).gif
hXXp://count.knowsky.com/img/(.*?)/(.*?).gif
&keyindex=9&pt_aid=21000124&daid=8&u1=http://cf.qq.com/comm-htdocs/login/logincallback.htm&clientkey=
&keyindex=9&pt_aid=21000124&daid=8&u1=http://cf.qq.com/comm-htdocs/login/logincallback.htm&clientkey=
hXXp://ptlogin2.qq.com/jump?clientuin=
hXXp://ptlogin2.qq.com/jump?clientuin=
&keyindex=9&pt_aid=15000103&daid=5&u1=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&clientkey=
&keyindex=9&pt_aid=15000103&daid=5&u1=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&clientkey=
.PaH
.PaH
U]X%xw
U]X%xw
O.vMk$
O.vMk$
s.>.vc
s.>.vc
%X~ -
%X~ -
SSOAxCtrlForPTLogin.SSOForPTLogin2
SSOAxCtrlForPTLogin.SSOForPTLogin2
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin
document.body.innerHTML=GetuinKey();
document.body.innerHTML=GetuinKey();
function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g
function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g
hXXp://act.tgp.qq.com/index.php/
hXXp://act.tgp.qq.com/index.php/
Host: act.tgp.qq.com
Host: act.tgp.qq.com
X-Requested-With: XMLHttpRequest
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0
Referer: hXXp://act.tgp.qq.com/cf/cf20160325/index.html?ADTAG=bangbang.hdsq
Referer: hXXp://act.tgp.qq.com/cf/cf20160325/index.html?ADTAG=bangbang.hdsq
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=
%7C
%7C
&user_checkparam=cf%7Cyes%7C
&user_checkparam=cf%7Cyes%7C
"msg":"
"msg":"
"sMsg":"
"sMsg":"
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=
,"iRet":"0","sMsg":"
,"iRet":"0","sMsg":"
modRet":{"iRet":"0","sMsg":"
modRet":{"iRet":"0","sMsg":"
"cdkey":"(.*?)"
"cdkey":"(.*?)"
[%d/d/d d:d]
[%d/d/d d:d]
\CF_CDKEY.ini
\CF_CDKEY.ini
1970-01-01 08:00:00
1970-01-01 08:00:00
hXXp://bang.qq.com/actcenter/queryFilterActList
hXXp://bang.qq.com/actcenter/queryFilterActList
"url":"(.*?)"
"url":"(.*?)"
hXXp://kf.qq.com/cgi-bin/common?rand=0.7021259550817557&command=command=C00006&fromtype=kfweb&fromtoolid=kfweb514&type=getCFSpend&area=
hXXp://kf.qq.com/cgi-bin/common?rand=0.7021259550817557&command=command=C00006&fromtype=kfweb&fromtoolid=kfweb514&type=getCFSpend&area=
Referer:hXXp://kf.qq.com/game/consume_records.html?code=cf
Referer:hXXp://kf.qq.com/game/consume_records.html?code=cf
hXXp://apps.game.qq.com/cgi-bin/cf/userinfo/userinfo.cgi?ssn=
hXXp://apps.game.qq.com/cgi-bin/cf/userinfo/userinfo.cgi?ssn=
hXXp://VVV.51.la/report/1_main.asp?id=18855916
hXXp://VVV.51.la/report/1_main.asp?id=18855916
hXXp://VVV.51.la/report/1_main_online.asp?id=18855916
hXXp://VVV.51.la/report/1_main_online.asp?id=18855916
hXXp://bbs.cf.qq.com/home.php?mod=task&do=apply&id=5
hXXp://bbs.cf.qq.com/home.php?mod=task&do=apply&id=5
hXXp://bbs.cf.qq.com/forum.php?mod=forumdisplay&fid=30503&page=6
hXXp://bbs.cf.qq.com/forum.php?mod=forumdisplay&fid=30503&page=6
&extra=page=6
&extra=page=6
hXXp://bbs.cf.qq.com/forum.php?mod=viewthread&tid=
hXXp://bbs.cf.qq.com/forum.php?mod=viewthread&tid=
99998888
99998888
&extra=&replysubmit=yes&infloat=yes&handlekey=fastpost&inajax=1
&extra=&replysubmit=yes&infloat=yes&handlekey=fastpost&inajax=1
hXXp://bbs.cf.qq.com/forum.php?mod=post&action=reply&fid=30503&tid=
hXXp://bbs.cf.qq.com/forum.php?mod=post&action=reply&fid=30503&tid=
&posttime=
&posttime=
hXXp://bbs.cf.qq.com/home.php?mod=task&do=draw&id=5
hXXp://bbs.cf.qq.com/home.php?mod=task&do=draw&id=5
hXXp://bbs.cf.qq.com/home.php?mod=spacecp&ac=credit&showcredit=1
hXXp://bbs.cf.qq.com/home.php?mod=spacecp&ac=credit&showcredit=1
&searchkey=15051408311873756101000000000000&from=1&question=å…Â费枪&vip=0&bangdou=1
&searchkey=15051408311873756101000000000000&from=1&question=å…Â费枪&vip=0&bangdou=1
%7C322%7C
%7C322%7C
*&checkparam=cf%7Cyes%7C
*&checkparam=cf%7Cyes%7C
&ams_checkparam=cf%7Cyes%7C
&ams_checkparam=cf%7Cyes%7C
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fbang.qq.com%2Fshop%2Findex%2Fcf%2F&eas_refer=&sServiceDepartment=xinyue&sServiceType=cf&sArea=
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fbang.qq.com%2Fshop%2Findex%2Fcf%2F&eas_refer=&sServiceDepartment=xinyue&sServiceType=cf&sArea=
Referer:hXXp://bang.qq.com/comm-htdocs/js/ams/v0.2R02/ajaxcdr.swf
Referer:hXXp://bang.qq.com/comm-htdocs/js/ams/v0.2R02/ajaxcdr.swf
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=38135&sServiceDepartment=xinyue&set_info=xinyue
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=38135&sServiceDepartment=xinyue&set_info=xinyue
hXXp://bangbang.qq.com/php/robott3nologin/servey
hXXp://bangbang.qq.com/php/robott3nologin/servey
Referer:hXXp://bang.qq.com/actcenter/index/cf
Referer:hXXp://bang.qq.com/actcenter/index/cf
hXXp://bang.qq.com/ugc1/getActRecommend
hXXp://bang.qq.com/ugc1/getActRecommend
game=cf&mid=0&eid=5&surl=http://bangbang.qq.com/php/login?game=cf&durl=http://bang.qq.com/actcenter/index/cf?&ref=ingame01&ref=ingame01
game=cf&mid=0&eid=5&surl=http://bangbang.qq.com/php/login?game=cf&durl=http://bang.qq.com/actcenter/index/cf?&ref=ingame01&ref=ingame01
hXXp://bang.qq.com/user/scorePersonalAcenter
hXXp://bang.qq.com/user/scorePersonalAcenter
Referer: hXXp://bang.qq.com/main/tradeinfo/
Referer: hXXp://bang.qq.com/main/tradeinfo/
game=bangbang&mid=9&eid=9000&surl=http://bang.qq.com/main/tradeinfo/&durl=http://bang.qq.com/main/tradeinfo/&world=0&serviceType=2&ref=
game=bangbang&mid=9&eid=9000&surl=http://bang.qq.com/main/tradeinfo/&durl=http://bang.qq.com/main/tradeinfo/&world=0&serviceType=2&ref=
hXXp://bang.qq.com/user/scorePersonal
hXXp://bang.qq.com/user/scorePersonal
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fdaoju.qq.com%2Fmall%2Fjudou2.0%2Fcf.shtml&eas_refer=&sServiceDepartment=djc&sServiceType=dj
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fdaoju.qq.com%2Fmall%2Fjudou2.0%2Fcf.shtml&eas_refer=&sServiceDepartment=djc&sServiceType=dj
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=dj&iActivityId=11117&sServiceDepartment=djc&set_info=djc
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=dj&iActivityId=11117&sServiceDepartment=djc&set_info=djc
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fdaoju.qq.com%2Fmall%2Fjudou2.0%2Fcf.shtml&eas_refer=&sServiceDepartment=djc
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fdaoju.qq.com%2Fmall%2Fjudou2.0%2Fcf.shtml&eas_refer=&sServiceDepartment=djc
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=dj&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=11117&iFlowId=96910&g_tk=
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=dj&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=11117&iFlowId=96910&g_tk=
Referer:hXXp://daoju.qq.com/comm-htdocs/js/milo/ajaxcdr.swf?0.9721381550078127
Referer:hXXp://daoju.qq.com/comm-htdocs/js/milo/ajaxcdr.swf?0.9721381550078127
sMsg":"
sMsg":"
bHasSendFailItem":"0","iRet":"0","sMsg":"
bHasSendFailItem":"0","iRet":"0","sMsg":"
hXXp://apps.game.qq.com/daoju/v3/api/app/e_app/add_jf_firstlogin.php?appSource=ios&appVersion=35&sDeviceID=
hXXp://apps.game.qq.com/daoju/v3/api/app/e_app/add_jf_firstlogin.php?appSource=ios&appVersion=35&sDeviceID=
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fdaoju.qq.com%2Fmall%2Ftask.shtml&eas_refer=&sServiceDepartment=djc
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fdaoju.qq.com%2Fmall%2Ftask.shtml&eas_refer=&sServiceDepartment=djc
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=dj&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=35644&iFlowId=204638&g_tk=
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=dj&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=35644&iFlowId=204638&g_tk=
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=dj&iActivityId=35644&sServiceDepartment=djc&set_info=djc
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=dj&iActivityId=35644&sServiceDepartment=djc&set_info=djc
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=23314&callback=vipSignNew.signCb&g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=23314&callback=vipSignNew.signCb&g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?actid=52002&g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?actid=52002&g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=79968&callback=vipSignNew.signCb&g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=79968&callback=vipSignNew.signCb&g_tk=
hXXp://iyouxi.vip.qq.com/ams.php?_c=page&actid=22249&g_tk=
hXXp://iyouxi.vip.qq.com/ams.php?_c=page&actid=22249&g_tk=
hXXp://iyouxi.vip.qq.com/ams2.02.php?actid=23074&g_tk_type=1&g_tk=
hXXp://iyouxi.vip.qq.com/ams2.02.php?actid=23074&g_tk_type=1&g_tk=
hXXp://iyouxi.vip.qq.com/jsonp.php?_c=page&actid=5474&isLoadUserInfo=1&callback=page.signInCb&g_tk=
hXXp://iyouxi.vip.qq.com/jsonp.php?_c=page&actid=5474&isLoadUserInfo=1&callback=page.signInCb&g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=54963&callback=vipSignNew.signCb&g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=54963&callback=vipSignNew.signCb&g_tk=
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fxinyue.qq.com%2Fweb201410%2Fwebgame.shtml&eas_refer=http%3A%2F%2Fxinyue.qq.com%2Fweb201410%2Fwebgame.shtml&sServiceDepartment=xinyue&sServiceType=tgclub
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fxinyue.qq.com%2Fweb201410%2Fwebgame.shtml&eas_refer=http%3A%2F%2Fxinyue.qq.com%2Fweb201410%2Fwebgame.shtml&sServiceDepartment=xinyue&sServiceType=tgclub
Referer: hXXp://xinyue.qq.com/comm-htdocs/js/milo/ajaxcdr.swf?0.7271989360451698
Referer: hXXp://xinyue.qq.com/comm-htdocs/js/milo/ajaxcdr.swf?0.7271989360451698
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=21547&sServiceDepartment=xinyue&set_info=xinyue
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=21547&sServiceDepartment=xinyue&set_info=xinyue
&_=1452520903377
&_=1452520903377
hXXp://pay.video.qq.com/fcgi-bin/sign?callback=jQuery111006800204519842937_1452520903238&low_login=1&uin=
hXXp://pay.video.qq.com/fcgi-bin/sign?callback=jQuery111006800204519842937_1452520903238&low_login=1&uin=
hXXp://share.music.qq.com/fcgi-bin/dmrp_activity/fcg_feedback_send_lottery.fcg?activeid=110&rnd=1458872103167&g_tk=
hXXp://share.music.qq.com/fcgi-bin/dmrp_activity/fcg_feedback_send_lottery.fcg?activeid=110&rnd=1458872103167&g_tk=
&_=1454839692917
&_=1454839692917
hXXp://x.pet.qq.com/vip_platform?cmd=set_sign_info&timer=1454839703753&callback=jQuery110205429354978259653_1454839692914&token=
hXXp://x.pet.qq.com/vip_platform?cmd=set_sign_info&timer=1454839703753&callback=jQuery110205429354978259653_1454839692914&token=
msg": "
msg": "
hXXp://vip.qzone.qq.com/fcg-bin/v2/fcg_mobile_vip_site_checkin?t=0.46869834180487055&g_tk=
hXXp://vip.qzone.qq.com/fcg-bin/v2/fcg_mobile_vip_site_checkin?t=0.46869834180487055&g_tk=
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_0 like Mac OS X) AppleWebKit/600.1.3 (KHTML, like Gecko) Version/8.0 Mobile/12A4345d Safari/600.1.4
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_0 like Mac OS X) AppleWebKit/600.1.3 (KHTML, like Gecko) Version/8.0 Mobile/12A4345d Safari/600.1.4
hXXp://qun.qzone.qq.com/cgi-bin/get_group_list?callbackFun=woaiwang&uin=
hXXp://qun.qzone.qq.com/cgi-bin/get_group_list?callbackFun=woaiwang&uin=
Referer: hXXp://qiandao.qun.qq.com/cgi-bin/sign
Referer: hXXp://qiandao.qun.qq.com/cgi-bin/sign
Host: qiandao.qun.qq.com
Host: qiandao.qun.qq.com
hXXp://qiandao.qun.qq.com/cgi-bin/sign
hXXp://qiandao.qun.qq.com/cgi-bin/sign
hXXp://qiandao.qun.qq.com/cgi-bin/new_flag
hXXp://qiandao.qun.qq.com/cgi-bin/new_flag
hXXp://iyouxi.vip.qq.com/ams3.0.php?g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?g_tk=
hXXp://buluo.qq.com/cgi-bin/bar/card/bar_list_by_page
hXXp://buluo.qq.com/cgi-bin/bar/card/bar_list_by_page
hXXp://buluo.qq.com/cgi-bin/bar/user/sign
hXXp://buluo.qq.com/cgi-bin/bar/user/sign
hXXp://bang.qq.com/comm-htdocs/js/ams/v0.2R02/ajaxcdr.swf
hXXp://bang.qq.com/comm-htdocs/js/ams/v0.2R02/ajaxcdr.swf
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=38135&sServiceDepartment=group_f
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=38135&sServiceDepartment=group_f
hXXp://cfzhushou.com/cfzs/help.html
hXXp://cfzhushou.com/cfzs/help.html
hXXp://cfzhushou.com/help.html
hXXp://cfzhushou.com/help.html
hXXp://ip.qq.com/cgi-bin/myip
hXXp://ip.qq.com/cgi-bin/myip
hXXps://aq.qq.com/cn2/safe_service/device_lock
hXXps://aq.qq.com/cn2/safe_service/device_lock
&collect=yehFdbVCaf6iRVmDtqzeLJS11vU2naOwqvdxlLqGgQgGJ4_1_XDmcUqe-XbQfHy6_zKOfL_dTnSV5_S5FuHtVYE2M64qMUdEQwAofTHRuzp5HPhYJuWiJRwtmyS8dEllMsGR5MxIy6kK3cCNw9aOvyKUaV8xygen57rNX0BAzkOOtzxtXLSOnSV6prBECoE5JCuV_pDIt_Hl6Vy4fWiQrRmAoS2Dud5MMasCnWCHonOwKhub5TaOuEpjfoEAF2ResP3i32BFRog1PO8WIxl4D__-61X3q-C4RD3jR5GbftwSIPPU8chK9rrwr5I3XW-yGYyNLKKfSvRl4CIRSmenCQw9MdOLMBA-Kq3wA-Isq5nFFis-2uJm8OdDb0rcVGZZM8lF5eN_dSLgHOFx-kGUSWkuLYx9QHR-_3K4B4wu907rpbKeobTewmLGw6-az0VkyJSlwRdFjciqcUFPdpy3kuIDdh9P6JnGiMb16ADzfjA8KdwuUZaXG40CKTsTX6L-kjN-f2iYbkyQP1NS8oaBXXCCGHHToXvb8lGeiMud00_wtNjKywve0slKxZhcDZlcNcagw0WtCD8ckxCANdo2WinaIWzyApgf1gMl_pRAtgsH1PMmglKLLnmoZo86HGTPDAoyMzzQF5MMdTJ2LYKwxSK2swj4yeKX3jPZHOuYt74*&ans=
&collect=yehFdbVCaf6iRVmDtqzeLJS11vU2naOwqvdxlLqGgQgGJ4_1_XDmcUqe-XbQfHy6_zKOfL_dTnSV5_S5FuHtVYE2M64qMUdEQwAofTHRuzp5HPhYJuWiJRwtmyS8dEllMsGR5MxIy6kK3cCNw9aOvyKUaV8xygen57rNX0BAzkOOtzxtXLSOnSV6prBECoE5JCuV_pDIt_Hl6Vy4fWiQrRmAoS2Dud5MMasCnWCHonOwKhub5TaOuEpjfoEAF2ResP3i32BFRog1PO8WIxl4D__-61X3q-C4RD3jR5GbftwSIPPU8chK9rrwr5I3XW-yGYyNLKKfSvRl4CIRSmenCQw9MdOLMBA-Kq3wA-Isq5nFFis-2uJm8OdDb0rcVGZZM8lF5eN_dSLgHOFx-kGUSWkuLYx9QHR-_3K4B4wu907rpbKeobTewmLGw6-az0VkyJSlwRdFjciqcUFPdpy3kuIDdh9P6JnGiMb16ADzfjA8KdwuUZaXG40CKTsTX6L-kjN-f2iYbkyQP1NS8oaBXXCCGHHToXvb8lGeiMud00_wtNjKywve0slKxZhcDZlcNcagw0WtCD8ckxCANdo2WinaIWzyApgf1gMl_pRAtgsH1PMmglKLLnmoZo86HGTPDAoyMzzQF5MMdTJ2LYKwxSK2swj4yeKX3jPZHOuYt74*&ans=
hXXp://captcha.qq.com/cap_union_verify_new?clientype=2&uin=
hXXp://captcha.qq.com/cap_union_verify_new?clientype=2&uin=
hXXp://captcha.qq.com/getimage?aid=210001040.5721703316085041
hXXp://captcha.qq.com/getimage?aid=210001040.5721703316085041
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=41615&sServiceDepartment=group_f
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=41615&sServiceDepartment=group_f
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=qqgame&iActivityId=41615&sServiceDepartment=group_h&set_info=group_h
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=qqgame&iActivityId=41615&sServiceDepartment=group_h&set_info=group_h
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=50394&sServiceDepartment=group_f
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=50394&sServiceDepartment=group_f
hXXp://apps.game.qq.com/daoju/appmarket/daoju_promotion/cloud_ticket/QueryCloudTicket.php?acctid=A100078&id=28&time=0.23177661886438727&_=1461381268102
hXXp://apps.game.qq.com/daoju/appmarket/daoju_promotion/cloud_ticket/QueryCloudTicket.php?acctid=A100078&id=28&time=0.23177661886438727&_=1461381268102
*&checkparam=cf|yes|
*&checkparam=cf|yes|
&ams_checkparam=cf|yes|
&ams_checkparam=cf|yes|
&e_code=0&g_code=0&eas_url=http://daoju.qq.com/mall/judou2.0/cf.shtml&sServiceDepartment=djc&sPartition=
&e_code=0&g_code=0&eas_url=http://daoju.qq.com/mall/judou2.0/cf.shtml&sServiceDepartment=djc&sPartition=
Referer:hXXp://daoju.qq.com/comm-htdocs/js/milo/ajaxcdr.swf?0.6722960381302983
Referer:hXXp://daoju.qq.com/comm-htdocs/js/milo/ajaxcdr.swf?0.6722960381302983
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=42715&sServiceDepartment=djc&set_info=djc
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=42715&sServiceDepartment=djc&set_info=djc
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fbang.qq.com%2Fshop%2Findex%2Fcf%2F&eas_refer=http%3A%2F%2Fbang.qq.com%2Fmain%2Ftradeinfo%2F&sServiceDepartment=xinyue
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fbang.qq.com%2Fshop%2Findex%2Fcf%2F&eas_refer=http%3A%2F%2Fbang.qq.com%2Fmain%2Ftradeinfo%2F&sServiceDepartment=xinyue
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=tgclub&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=38135&iFlowId=
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=tgclub&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=38135&iFlowId=
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=38135&sServiceDepartment=xinyue&set_info=xinyue
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=38135&sServiceDepartment=xinyue&set_info=xinyue
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=tgclub&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=38135&iFlowId=214216&g_tk=
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=tgclub&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=38135&iFlowId=214216&g_tk=
|322|
|322|
sCdKey=
sCdKey=
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=8918&sServiceDepartment=x1m1
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=8918&sServiceDepartment=x1m1
sMsg" : "
sMsg" : "
\gzip.dll
\gzip.dll
.text
.text
`.data
`.data
@.reloc
@.reloc
KERNEL32.dll
KERNEL32.dll
gzip.pdb
gzip.pdb
_u%SV
_u%SV
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E)
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E)
hXXp://apps.game.qq.com/cgi-bin/cf/a20090409forceout/getinfo.cgi
hXXp://apps.game.qq.com/cgi-bin/cf/a20090409forceout/getinfo.cgi
hXXp://webd.tgp.qq.com/cf/info_proxy/weapon_stat_info?&&zone_id=
hXXp://webd.tgp.qq.com/cf/info_proxy/weapon_stat_info?&&zone_id=
1970.01.01 00:00:00
1970.01.01 00:00:00
hXXps://ssl.ptlogin2.qq.com/ptqrshow?appid=21000124&e=2&l=M&s=4&d=72&v=4&t=0.061519597441372864&daid=8
hXXps://ssl.ptlogin2.qq.com/ptqrshow?appid=21000124&e=2&l=M&s=4&d=72&v=4&t=0.061519597441372864&daid=8
&js_ver=10151&js_type=1&login_sig=7qKho-IT4nBHQJBVoTYw6p-IGP0hieZLRsmCy5MWU7g0bRJNRkb5q8yH7BUA7cTM&pt_uistyle=20&aid=21000124&daid=8&
&js_ver=10151&js_type=1&login_sig=7qKho-IT4nBHQJBVoTYw6p-IGP0hieZLRsmCy5MWU7g0bRJNRkb5q8yH7BUA7cTM&pt_uistyle=20&aid=21000124&daid=8&
hXXps://ssl.ptlogin2.qq.com/ptqrlogin?ptredirect=1&u1=http://cf.qq.com/cp/a20160223czxlx/index.htm?e_code=213709&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=6-0-
hXXps://ssl.ptlogin2.qq.com/ptqrlogin?ptredirect=1&u1=http://cf.qq.com/cp/a20160223czxlx/index.htm?e_code=213709&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=6-0-
hXXp://cf.qq.com/cfvip/
hXXp://cf.qq.com/cfvip/
hXXp://xinyue.qq.com
hXXp://xinyue.qq.com
?kernel32.dll
?kernel32.dll
hXXp://apps.game.qq.com/CommArticle/app/reg/gdate.php
hXXp://apps.game.qq.com/CommArticle/app/reg/gdate.php
crossfire.exe
crossfire.exe
Report
Report
themepassword
themepassword
SysShadow.HostWnd
SysShadow.HostWnd
{6AEDBD6D-3FB5-418A-83A6-7F45229DC872}
{6AEDBD6D-3FB5-418A-83A6-7F45229DC872}
VBScript.RegExp
VBScript.RegExp
{0002DF05-0000-0000-C000-000000000046}
{0002DF05-0000-0000-C000-000000000046}
{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}
{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}
{6D5140C1-7436-11CE-8034-00AA006009FA}
{6D5140C1-7436-11CE-8034-00AA006009FA}
{D30C1661-CDAF-11d0-8A3E-00C04FC9E26E}
{D30C1661-CDAF-11d0-8A3E-00C04FC9E26E}
document.all.resultjs.innerText=
document.all.resultjs.innerText=
var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');
var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');
SysShadow.Menu
SysShadow.Menu
Microsoft.XMLDOM
Microsoft.XMLDOM
14:00~16:00
14:00~16:00
12:00-19:00
12:00-19:00
123456789
123456789
00003333
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
F%*.*f
F%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
iphlpapi.dll
iphlpapi.dll
MPR.dll
MPR.dll
VERSION.dll
VERSION.dll
WSOCK32.dll
WSOCK32.dll
.PAVCException@@
.PAVCException@@
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
.PAVCFileException@@
.PAVCFileException@@
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
1.1.3
1.1.3
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
msscript.ocx
msscript.ocx
VVV.dywt.com.cn
VVV.dywt.com.cn
\\.\Smartvsd
\\.\Smartvsd
\\.\PhysicalDrive%d
\\.\PhysicalDrive%d
\\.\Scsi%d:
\\.\Scsi%d:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
%d%d%d
%d%d%d
rundll32.exe shell32.dll,
rundll32.exe shell32.dll,
.PAVCOleException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.PAVCArchiveException@@
right-curly-bracket
right-curly-bracket
left-curly-bracket
left-curly-bracket
0123456789
0123456789
c:\%original file name%.exe
c:\%original file name%.exe
GetCPInfo
GetCPInfo
WinExec
WinExec
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
GetViewportExtEx
GetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
SetViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
GetViewportOrgEx
GetViewportOrgEx
GetKeyState
GetKeyState
GetKeyboardState
GetKeyboardState
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCrackUrlA
`.rdata
`.rdata
@.data
@.data
_
_
.QX' x
.QX' x
Keyk
Keyk
UrlA3
UrlA3
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
.FNNNNNNNNNNNNNNV
.FNNNNNNNNNNNNNNV
.FNNNNNNNNNNNN
.FNNNNNNNNNNNN
.CNNNB
.CNNNB
.CNNd
.CNNd
ÃDDDDDDQC
ÃDDDDDDQC
PAD
PAD
oledlg.dll
oledlg.dll
RASAPI32.dll
RASAPI32.dll
WININET.dll
WININET.dll
1.0.15.507
1.0.15.507
1.0.0.0
1.0.0.0
6.0.2600.0 (xpclient.010817-1148)
6.0.2600.0 (xpclient.010817-1148)
6.0.2600.0
6.0.2600.0
(*.*)
(*.*)
2.5.0.0
2.5.0.0
hXXp://VVV.cfzhushou.com
hXXp://VVV.cfzhushou.com
%original file name%.exe_344_rwx_00401000_00463000:
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
ws2_32.dll
ws2_32.dll
kernel32.dll
kernel32.dll
user32.dll
user32.dll
User32.dll
User32.dll
Kernel32.dll
Kernel32.dll
shell32.dll
shell32.dll
gdiplus.dll
gdiplus.dll
GdiPlus.dll
GdiPlus.dll
Ole32.dll
Ole32.dll
OleAut32.dll
OleAut32.dll
CF_Updata.dll
CF_Updata.dll
wininet.dll
wininet.dll
ole32.dll
ole32.dll
atl.dll
atl.dll
gzip.dll
gzip.dll
ntdll.dll
ntdll.dll
urlmon
urlmon
gdi32.dll
gdi32.dll
Gdi32.dll
Gdi32.dll
imm32.dll
imm32.dll
OLEACC.DLL
OLEACC.DLL
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
GetAsyncKeyState
GetAsyncKeyState
GetProcessHeap
GetProcessHeap
GdipSetStringFormatHotkeyPrefix
GdipSetStringFormatHotkeyPrefix
RegisterHotKey
RegisterHotKey
UnregisterHotKey
UnregisterHotKey
ShellExecuteA
ShellExecuteA
42305932-06E6-47a5-AC79-8BDCDC58DF61
42305932-06E6-47a5-AC79-8BDCDC58DF61
WebBrowser
WebBrowser
JOIN
JOIN
CONFIG.SYS
CONFIG.SYS
DosExecPgm
DosExecPgm
Windows
Windows
1613-Windows
1613-Windows
WindowsServicePark
WindowsServicePark
1615-SQL
1615-SQL
1631-Windows
1631-Windows
1637-Windows
1637-Windows
WindowsServicePack
WindowsServicePack
1642-Windows
1642-Windows
WindowsRPC
WindowsRPC
Windows2000
Windows2000
CommPort
CommPort
NET.ACC
NET.ACC
LANMAN\NETPROG\ADDPAK.SER
LANMAN\NETPROG\ADDPAK.SER
CACHE.EXE
CACHE.EXE
WindowsNT
WindowsNT
3108-NETWKSTA.SYS
3108-NETWKSTA.SYS
CLANROOT\LOGS\FT.LOG
CLANROOT\LOGS\FT.LOG
LAMAN.INI
LAMAN.INI
3404-LAMAN.INI
3404-LAMAN.INI
NETWKSTA.SYS
NETWKSTA.SYS
3804-SCHED.LOG
3804-SCHED.LOG
3901-****
3901-****
3902-****
3902-****
4454-WindowsNT
4454-WindowsNT
4470-Windows2000
4470-Windows2000
4486-WindowsNT
4486-WindowsNT
4488-WindowsNTServer
4488-WindowsNTServer
4696-WindowsNTServer
4696-WindowsNTServer
4697-WindowsNTWorkstation
4697-WindowsNTWorkstation
5295-NETUS.HLP
5295-NETUS.HLP
5296-NET.HLP
5296-NET.HLP
5509-Windows2000
5509-Windows2000
RPLDISK.SYS
RPLDISK.SYS
$SystemRootSystem32Configetlogon.dns$
$SystemRootSystem32Configetlogon.dns$
MODEM.INF
MODEM.INF
schema.ini
schema.ini
2.5.5.1
2.5.5.1
2.5.5.7
2.5.5.7
2.5.5.14
2.5.5.14
9851-TCP/IP
9851-TCP/IP
\exdui.dll
\exdui.dll
.rsrc
.rsrc
@V.Dv
@V.Dv
.UmKm
.UmKm
4v %u
4v %u
oft.XMLDOMnY
oft.XMLDOMnY
\dwmapi.dll
\dwmapi.dll
A715A0-6587-11D0-924A_20AFC7/
A715A0-6587-11D0-924A_20AFC7/
Leave.CoIn@alize
Leave.CoIn@alize
number is %d.
number is %d.
:"%s"
:"%s"
..0`%X
..0`%X
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
ATL.DLL
ATL.DLL
GDI32.dll
GDI32.dll
MSVCRT.dll
MSVCRT.dll
OLEAUT32.dll
OLEAUT32.dll
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
USER32.dll
USER32.dll
exdui.dll
exdui.dll
t=.VMV
t=.VMV
%%fnW
%%fnW
,7Z.in
,7Z.in
k`%u"]
k`%u"]
Z,c
Z,c
1,,.aa
1,,.aa
hXXp://
hXXp://
, #&')*)
, #&')*)
-0-(0%()(
-0-(0%()(
k.fb2
k.fb2
9%fWS2
9%fWS2
9h.oc
9h.oc
".aBp
".aBp
.ijWU5
.ijWU5
w%SY
w%SY
Wkbn%X
Wkbn%X
kEYH
kEYH
&.kPd
&.kPd
(s.PKL
(s.PKL
MsgBox
MsgBox
SysShadow.SubWnd
SysShadow.SubWnd
%f%%f
%f%%f
7".Fv
7".Fv
>.OsM
>.OsM
r.vDO
r.vDO
V2.5.0
V2.5.0
\CF_data.ini
\CF_data.ini
hXXp://q.qlogo.cn/headimg_dl?bs=qq&dst_uin=
hXXp://q.qlogo.cn/headimg_dl?bs=qq&dst_uin=
hXXp://note.youdao.com/yws/public/note/47e1d0e04e8a224cbc6eedb4d182fd1a?keyfrom=public
hXXp://note.youdao.com/yws/public/note/47e1d0e04e8a224cbc6eedb4d182fd1a?keyfrom=public
hXXp://leesin1.zichaob.com/cf.txt
hXXp://leesin1.zichaob.com/cf.txt
\CF_Updata.dll
\CF_Updata.dll
.yP[=
.yP[=
%XX7.
%XX7.
i.dhG
i.dhG
'ASho%x
'ASho%x
,%u9]
,%u9]
w5\pUWSSHh
w5\pUWSSHh
$%FNHfI
$%FNHfI
.htbW
.htbW
.Be$>;
.Be$>;
.OXWh0T
.OXWh0T
AR,O%U
AR,O%U
0FtPo
0FtPo
R.NL3
R.NL3
.QTC0
.QTC0
z=Q%c`H
z=Q%c`H
%u5.]X
%u5.]X
.PTJ2T
.PTJ2T
WudP
WudP
ab.Lkl%
ab.Lkl%
%&'%u
%&'%u
dB.pn*
dB.pn*
l0y.WD
l0y.WD
.tCDHP
.tCDHP
.dHu`
.dHu`
WV4o.Ct
WV4o.Ct
EU%X_
EU%X_
0K.WN40
0K.WN40
.UGP$Kr
.UGP$Kr
WaM@{.wB_
WaM@{.wB_
<.>
<.>
X%C@ X
X%C@ X
.hZM:
.hZM:
l%uBGX
l%uBGX
,
,
ininet.dll
ininet.dll
33.cos.myq
33.cos.myq
m/1.txt
m/1.txt
form-urlF
form-urlF
7.P|.Nr
7.P|.Nr
0ZR.BI@/DE0,
0ZR.BI@/DE0,
O.OPP
O.OPP
%d&&'
%d&&'
*)(''&%$$#""!!
*)(''&%$$#""!!
?%*.*f
?%*.*f
_CmdT"
_CmdT"
.INI.HL^$=
.INI.HL^$=
R.MSVCRTerhC
R.MSVCRTerhC
9y.xX
9y.xX
9y.Phh
9y.Phh
X%Sm'
X%Sm'
.PAVG
.PAVG
(&07-034/)7
(&07-034/)7
)*$-2{
)*$-2{
%s:%d/]
%s:%d/]
6]| 0 '.
6]| 0 '.
Eh.dE7
Eh.dE7
keyw
keyw
E:\e5\
E:\e5\
%SOCK
%SOCK
29\TCP"d7
29\TCP"d7
qCONT.WlB
qCONT.WlB
f2pn-t|/tcp;
f2pn-t|/tcp;
.dyw(/cn.dx
.dyw(/cn.dx
zcÃ
zcÃ
Ug>Key
Ug>Key
=.tex
=.tex
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
PAD
PAD
COMCTL32.dll
COMCTL32.dll
comdlg32.dll
comdlg32.dll
WINMM.dll
WINMM.dll
WINSPOOL.DRV
WINSPOOL.DRV
WS2_32.dll
WS2_32.dll
RegCloseKey
RegCloseKey
2.dll
2.dll
.jF
.jF
https
https
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
http=
http=
HTTP/1.1
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
hXXps://
hXXps://
&s_url=http://cf.qq.com/comm-htdocs/login/logincallback.htm&f_url=&ptlang=2052&ptredirect=100&aid=21000124&daid=8&j_later=0&low_login_hour=0®master=0&pt_login_type=1&pt_aid=0&pt_aaid=0&pt_light=0&pt_3rd_aid=0
&s_url=http://cf.qq.com/comm-htdocs/login/logincallback.htm&f_url=&ptlang=2052&ptredirect=100&aid=21000124&daid=8&j_later=0&low_login_hour=0®master=0&pt_login_type=1&pt_aid=0&pt_aaid=0&pt_light=0&pt_3rd_aid=0
&service=login&nodirect=0&ptsigx=
&service=login&nodirect=0&ptsigx=
hXXp://ptlogin4.game.qq.com/check_sig?pttype=1&uin=
hXXp://ptlogin4.game.qq.com/check_sig?pttype=1&uin=
p_skey=
p_skey=
skey=
skey=
666666666
666666666
hXXp://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=cf&area=
hXXp://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=cf&area=
szNick_name=
szNick_name=
news.exe
news.exe
,.Ey)
,.Ey)
qTcp,
qTcp,
hXXp://wpa.qq.com/msgrd?v=3&uin=138417120&site=qq&menu=yes
hXXp://wpa.qq.com/msgrd?v=3&uin=138417120&site=qq&menu=yes
hXXp://apps.game.qq.com/cf/a20141126main/getUserInfo.php?action=initQuery&sArea=
hXXp://apps.game.qq.com/cf/a20141126main/getUserInfo.php?action=initQuery&sArea=
hXXp://apps.game.qq.com/cgi-bin/cf/cfvip/checkCFvipStatue.cgi?rd=0.3552593735512346&_=1459778886737
hXXp://apps.game.qq.com/cgi-bin/cf/cfvip/checkCFvipStatue.cgi?rd=0.3552593735512346&_=1459778886737
msg":"
msg":"
tEXtXML:com.adobe.xmp
tEXtXML:com.adobe.xmp
xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/"
xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/"
xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/"
xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/"
xmlns:dc="hXXp://purl.org/dc/elements/1.1/"
xmlns:dc="hXXp://purl.org/dc/elements/1.1/"
xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/"
xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/"
xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#"
xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#"
xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/"
xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/"
xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">
xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">
Adobe Photoshop CC (Windows)
Adobe Photoshop CC (Windows)
/* |xGv00|13a28bd5e87728de7241d2f04c3c02f5 */hXXp://apps.game.qq.com/cf/cfvip/doCfVip.php?action=getCfVipInfo&rd=0.16843547895445687&_=1459479795992
/* |xGv00|13a28bd5e87728de7241d2f04c3c02f5 */hXXp://apps.game.qq.com/cf/cfvip/doCfVip.php?action=getCfVipInfo&rd=0.16843547895445687&_=1459479795992
hXXp://apps.game.qq.com/php/tgclub/v2/user/logininfo?callback=jQuery17209628733010031283_1459773913284&_=1459773913464
hXXp://apps.game.qq.com/php/tgclub/v2/user/logininfo?callback=jQuery17209628733010031283_1459773913284&_=1459773913464
ÿF8>NFFFh
ÿF8>NFFFh
ÿFV
ÿFV
&e_code=0&g_code=0&eas_url=http://xinyue.qq.com/act/pc/shenhanghezuoPC/&sServiceDepartment=xinyue
&e_code=0&g_code=0&eas_url=http://xinyue.qq.com/act/pc/shenhanghezuoPC/&sServiceDepartment=xinyue
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=40568&sServiceDepartment=xinyue&set_info=xinyue
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=40568&sServiceDepartment=xinyue&set_info=xinyue
cdkeylist":"
cdkeylist":"
&appid=15000103&js_ver=10153&js_type=1&login_sig=0nLadn6F*IOLoKBk7n-g3iCxqdCGPSIeyZhV-iaDTmCcf6BeP3DeVa3TGrAvmDod&u1=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&r=0.15214470936916769
&appid=15000103&js_ver=10153&js_type=1&login_sig=0nLadn6F*IOLoKBk7n-g3iCxqdCGPSIeyZhV-iaDTmCcf6BeP3DeVa3TGrAvmDod&u1=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&r=0.15214470936916769
hXXp://check.ptlogin2.qq.com/check?regmaster=&pt_tea=1&pt_vcode=1&uin=
hXXp://check.ptlogin2.qq.com/check?regmaster=&pt_tea=1&pt_vcode=1&uin=
&pt_randsalt=0&ptredirect=1&u1=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=2-6-1461659794871&js_ver=10153&js_type=1&login_sig=0nLadn6F*IOLoKBk7n-g3iCxqdCGPSIeyZhV-iaDTmCcf6BeP3DeVa3TGrAvmDod&pt_uistyle=20&aid=15000103&daid=5&
&pt_randsalt=0&ptredirect=1&u1=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=2-6-1461659794871&js_ver=10153&js_type=1&login_sig=0nLadn6F*IOLoKBk7n-g3iCxqdCGPSIeyZhV-iaDTmCcf6BeP3DeVa3TGrAvmDod&pt_uistyle=20&aid=15000103&daid=5&
hXXp://ptlogin2.qq.com/login?u=
hXXp://ptlogin2.qq.com/login?u=
&s_url=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&f_url=&ptlang=2052&ptredirect=100&aid=1000101&daid=5&j_later=0&low_login_hour=0®master=0&pt_login_type=2&pt_aid=15000103&pt_aaid=0&pt_light=0&pt_3rd_aid=0
&s_url=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&f_url=&ptlang=2052&ptredirect=100&aid=1000101&daid=5&j_later=0&low_login_hour=0®master=0&pt_login_type=2&pt_aid=15000103&pt_aaid=0&pt_light=0&pt_3rd_aid=0
hXXp://ptlogin4.qzone.qq.com/check_sig?pttype=2&uin=
hXXp://ptlogin4.qzone.qq.com/check_sig?pttype=2&uin=
return binl2hex(core_md5(str2binl(s), s.length * chrsz))
return binl2hex(core_md5(str2binl(s), s.length * chrsz))
return binl2str(core_md5(str2binl(s), s.length * chrsz))
return binl2str(core_md5(str2binl(s), s.length * chrsz))
function hex_hmac_md5(key, data) {
function hex_hmac_md5(key, data) {
return binl2hex(core_hmac_md5(key, data))
return binl2hex(core_hmac_md5(key, data))
function b64_hmac_md5(key, data) {
function b64_hmac_md5(key, data) {
return binl2b64(core_hmac_md5(key, data))
return binl2b64(core_hmac_md5(key, data))
function str_hmac_md5(key, data) {
function str_hmac_md5(key, data) {
return binl2str(core_hmac_md5(key, data))
return binl2str(core_hmac_md5(key, data))
for (var i = 0; i
for (var i = 0; i
function core_hmac_md5(key, data) {
function core_hmac_md5(key, data) {
var bkey = str2binl(key);
var bkey = str2binl(key);
if (bkey.length > 16) {
if (bkey.length > 16) {
bkey = core_md5(bkey, key.length * chrsz)
bkey = core_md5(bkey, key.length * chrsz)
ipad[i] = bkey[i] ^ 909522486;
ipad[i] = bkey[i] ^ 909522486;
opad[i] = bkey[i] ^ 1549556828
opad[i] = bkey[i] ^ 1549556828
var hash = core_md5(ipad.concat(str2binl(data)), 512 data.length * chrsz);
var hash = core_md5(ipad.concat(str2binl(data)), 512 data.length * chrsz);
return core_md5(opad.concat(hash), 512 128)
return core_md5(opad.concat(hash), 512 128)
for (var i = 0; i
for (var i = 0; i
bin[i >> 5] |= (str.charCodeAt(i / chrsz) & mask)
bin[i >> 5] |= (str.charCodeAt(i / chrsz) & mask)
for (var i = 0; i
for (var i = 0; i
str = String.fromCharCode((bin[i >> 5] >>> (i % 32)) & mask)
str = String.fromCharCode((bin[i >> 5] >>> (i % 32)) & mask)
for (var i = 0; i
for (var i = 0; i
str = hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8 4)) & 15) hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8)) & 15)
str = hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8 4)) & 15) hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8)) & 15)
for (var i = 0; i
for (var i = 0; i
if (i * 8 j * 6 > binarray.length * 32) {
if (i * 8 j * 6 > binarray.length * 32) {
str = tab.charAt((triplet >> 6 * (3 - j)) & 63)
str = tab.charAt((triplet >> 6 * (3 - j)) & 63)
for (var i = 0; i
for (var i = 0; i
arr.push('\\x' str.substr(i, 2))
arr.push('\\x' str.substr(i, 2))
arr = arr.join('');
arr = arr.join('');
function getEncryption(password, salt, vcode, isMd5) {
function getEncryption(password, salt, vcode, isMd5) {
password = password || '';
password = password || '';
var md5Pwd = isMd5 ? password: md5(password),
var md5Pwd = isMd5 ? password: md5(password),
rsaH1 = $.RSA.rsa_encrypt(h1),
rsaH1 = $.RSA.rsa_encrypt(h1),
rsaH1Len = (rsaH1.length / 2).toString(16),
rsaH1Len = (rsaH1.length / 2).toString(16),
hexVcode = TEA.strToBytes(vcode.toUpperCase()),
hexVcode = TEA.strToBytes(vcode.toUpperCase()),
vcodeLen = '000' vcode.length.toString(16);
vcodeLen = '000' vcode.length.toString(16);
while (rsaH1Len.length
while (rsaH1Len.length
TEA.initkey(s2);
TEA.initkey(s2);
var saltPwd = TEA.enAsBase64(rsaH1Len rsaH1 TEA.strToBytes(salt) vcodeLen hexVcode);
var saltPwd = TEA.enAsBase64(rsaH1Len rsaH1 TEA.strToBytes(salt) vcodeLen hexVcode);
TEA.initkey('');
TEA.initkey('');
return saltPwd.replace(/[\/\ =]/g,
return saltPwd.replace(/[\/\ =]/g,
'/': '-',
'/': '-',
' ': '*',
' ': '*',
'=': '_'
'=': '_'
function getRSAEncryption(password, vcode, isMd5) {
function getRSAEncryption(password, vcode, isMd5) {
var str1 = isMd5 ? password: md5(password);
var str1 = isMd5 ? password: md5(password);
var str2 = str1 vcode.toUpperCase();
var str2 = str1 vcode.toUpperCase();
var str3 = $.RSA.rsa_encrypt(str2);
var str3 = $.RSA.rsa_encrypt(str2);
$.RSA = function() {
$.RSA = function() {
while (z aD
while (z aD
t = aC.substring(z, z aD) '\n';
t = aC.substring(z, z aD) '\n';
return t aC.substring(z, aC.length)
return t aC.substring(z, aC.length)
return '0' t.toString(16)
return '0' t.toString(16)
return t.toString(16)
return t.toString(16)
if (aG
if (aG
var aC = aD.length - 1;
var aC = aD.length - 1;
var aE = aD.charCodeAt(aC--);
var aE = aD.charCodeAt(aC--);
z.nextBytes(t)
z.nextBytes(t)
this.dmp1 = null;
this.dmp1 = null;
this.dmq1 = null;
this.dmq1 = null;
this.coeff = null
this.coeff = null
if (z != null && t != null && z.length > 0 && t.length > 0) {
if (z != null && t != null && z.length > 0 && t.length > 0) {
uv_alert('Invalid RSA public key')
uv_alert('Invalid RSA public key')
return t.modPowInt(this.e, this.n)
return t.modPowInt(this.e, this.n)
var t = ah(aC, (this.n.bitLength() 7) >> 3);
var t = ah(aC, (this.n.bitLength() 7) >> 3);
var aD = this.doPublic(t);
var aD = this.doPublic(t);
var z = aD.toString(16);
var z = aD.toString(16);
if ((z.length & 1) == 0) {
if ((z.length & 1) == 0) {
N.prototype.doPublic = Y;
N.prototype.doPublic = Y;
N.prototype.setPublic = q;
N.prototype.setPublic = q;
N.prototype.encrypt = r;
N.prototype.encrypt = r;
this.fromNumber(z, t, aC)
this.fromNumber(z, t, aC)
this.fromString(z, 256)
this.fromString(z, 256)
this.fromString(z, t)
this.fromString(z, t)
aG = Math.floor(aC / 67108864);
aG = Math.floor(aC / 67108864);
if (ab && (navigator.appName == 'Microsoft Internet Explorer')) {
if (ab && (navigator.appName == 'Microsoft Internet Explorer')) {
au.prototype.am = aA;
au.prototype.am = aA;
if (ab && (navigator.appName != 'Netscape')) {
if (ab && (navigator.appName != 'Netscape')) {
au.prototype.am = b;
au.prototype.am = b;
au.prototype.am = az;
au.prototype.am = az;
au.prototype.DB = ay;
au.prototype.DB = ay;
au.prototype.DM = ((1
au.prototype.DM = ((1
au.prototype.DV = (1
au.prototype.DV = (1
au.prototype.FV = Math.pow(2, ac);
au.prototype.FV = Math.pow(2, ac);
au.prototype.F1 = ac - ay;
au.prototype.F1 = ac - ay;
au.prototype.F2 = 2 * ay - ac;
au.prototype.F2 = 2 * ay - ac;
ar = '0'.charCodeAt(0);
ar = '0'.charCodeAt(0);
ar = 'a'.charCodeAt(0);
ar = 'a'.charCodeAt(0);
ar = 'A'.charCodeAt(0);
ar = 'A'.charCodeAt(0);
return ag.charAt(t)
return ag.charAt(t)
var aC = ai[z.charCodeAt(t)];
var aC = ai[z.charCodeAt(t)];
z.fromInt(t);
z.fromInt(t);
this.fromRadix(aG, z);
this.fromRadix(aG, z);
var aF = aG.length,
var aF = aG.length,
if (aG.charAt(aF) == '-') {
if (aG.charAt(aF) == '-') {
if (aE aD > this.DB) {
if (aE aD > this.DB) {
this[this.t - 1] |= (t & ((1
this[this.t - 1] |= (t & ((1
this[this.t ] = (t >> (this.DB - aE))
this[this.t ] = (t >> (this.DB - aE))
if (aE >= this.DB) {
if (aE >= this.DB) {
aE -= this.DB
aE -= this.DB
this[this.t - 1] |= ((1
this[this.t - 1] |= ((1
this.clamp();
this.clamp();
au.ZERO.subTo(this, this)
au.ZERO.subTo(this, this)
var t = this.s & this.DM;
var t = this.s & this.DM;
return '-' this.negate().toString(z)
return '-' this.negate().toString(z)
return this.toRadix(z)
return this.toRadix(z)
var aG = this.DB - (aD * this.DB) % aC;
var aG = this.DB - (aD * this.DB) % aC;
if (aG > aG) > 0) {
if (aG > aG) > 0) {
aH |= this[--aD] >> (aG = this.DB - aC)
aH |= this[--aD] >> (aG = this.DB - aC)
aG = this.DB; --aD
aG = this.DB; --aD
au.ZERO.subTo(this, t);
au.ZERO.subTo(this, t);
return (this.s
return (this.s
return this.DB * (this.t - 1) l(this[this.t - 1] ^ (this.s & this.DM))
return this.DB * (this.t - 1) l(this[this.t - 1] ^ (this.s & this.DM))
z.t = Math.max(this.t - aC, 0);
z.t = Math.max(this.t - aC, 0);
var z = aH % this.DB;
var z = aH % this.DB;
var t = this.DB - z;
var t = this.DB - z;
var aE = Math.floor(aH / this.DB),
var aE = Math.floor(aH / this.DB),
aG = (this.s
aG = (this.s
aD.clamp()
aD.clamp()
var aE = Math.floor(aG / this.DB);
var aE = Math.floor(aG / this.DB);
var z = aG % this.DB;
var z = aG % this.DB;
t = Math.min(z.t, this.t);
t = Math.min(z.t, this.t);
aD[aC ] = aE & this.DM;
aD[aC ] = aE & this.DM;
aE >>= this.DB
aE >>= this.DB
aD[aC ] = aE & this.DM;
aD[aC ] = aE & this.DM;
aE >>= this.DB
aE >>= this.DB
aD[aC ] = this.DV aE
aD[aC ] = this.DV aE
var t = this.abs(),
var t = this.abs(),
aE = z.abs();
aE = z.abs();
aD[aC t.t] = t.am(0, aE[aC], aD, aC, 0, t.t)
aD[aC t.t] = t.am(0, aE[aC], aD, aC, 0, t.t)
aD.clamp();
aD.clamp();
au.ZERO.subTo(aD, aD)
au.ZERO.subTo(aD, aD)
var t = this.abs();
var t = this.abs();
var aD = t.am(z, t[z], aC, 2 * z, 0, 1);
var aD = t.am(z, t[z], aC, 2 * z, 0, 1);
if ((aC[z t.t] = t.am(z 1, 2 * t[z], aC, 2 * z 1, aD, t.t - z - 1)) >= t.DV) {
if ((aC[z t.t] = t.am(z 1, 2 * t[z], aC, 2 * z 1, aD, t.t - z - 1)) >= t.DV) {
aC[z t.t] -= t.DV;
aC[z t.t] -= t.DV;
aC[aC.t - 1] = t.am(z, t[z], aC, 2 * z, 0, 1)
aC[aC.t - 1] = t.am(z, t[z], aC, 2 * z, 0, 1)
aC.clamp()
aC.clamp()
var aQ = aK.abs();
var aQ = aK.abs();
var aI = this.abs();
var aI = this.abs();
aH.fromInt(0)
aH.fromInt(0)
this.copyTo(aG)
this.copyTo(aG)
var aP = this.DB - l(aQ[aQ.t - 1]);
var aP = this.DB - l(aQ[aQ.t - 1]);
aQ.lShiftTo(aP, aE);
aQ.lShiftTo(aP, aE);
aI.lShiftTo(aP, aG)
aI.lShiftTo(aP, aG)
aQ.copyTo(aE);
aQ.copyTo(aE);
aI.copyTo(aG)
aI.copyTo(aG)
var aT = this.FV / aL,
var aT = this.FV / aL,
aE.dlShiftTo(aN, aF);
aE.dlShiftTo(aN, aF);
if (aG.compareTo(aF) >= 0) {
if (aG.compareTo(aF) >= 0) {
aG.subTo(aF, aG)
aG.subTo(aF, aG)
au.ONE.dlShiftTo(aM, aF);
au.ONE.dlShiftTo(aM, aF);
aF.subTo(aE, aE);
aF.subTo(aE, aE);
var aD = (aG[--aO] == aC) ? this.DM: Math.floor(aG[aO] * aT (aG[aO - 1] aR) * aS);
var aD = (aG[--aO] == aC) ? this.DM: Math.floor(aG[aO] * aT (aG[aO - 1] aR) * aS);
if ((aG[aO] = aE.am(0, aD, aG, aN, 0, aM))
if ((aG[aO] = aE.am(0, aD, aG, aN, 0, aM))
aE.dlShiftTo(aN, aF);
aE.dlShiftTo(aN, aF);
aG.subTo(aF, aG);
aG.subTo(aF, aG);
aG.subTo(aF, aG)
aG.subTo(aF, aG)
aG.drShiftTo(aM, aH);
aG.drShiftTo(aM, aH);
au.ZERO.subTo(aH, aH)
au.ZERO.subTo(aH, aH)
aG.clamp();
aG.clamp();
aG.rShiftTo(aP, aG)
aG.rShiftTo(aP, aG)
au.ZERO.subTo(aG, aG)
au.ZERO.subTo(aG, aG)
this.abs().divRemTo(t, null, z);
this.abs().divRemTo(t, null, z);
if (this.s 0) {
if (this.s 0) {
t.subTo(z, z)
t.subTo(z, z)
if (t.s = 0) {
if (t.s = 0) {
return t.mod(this.m)
return t.mod(this.m)
t.divRemTo(this.m, null, t)
t.divRemTo(this.m, null, t)
t.multiplyTo(aC, z);
t.multiplyTo(aC, z);
this.reduce(z)
this.reduce(z)
t.squareTo(z);
t.squareTo(z);
M.prototype.convert = X;
M.prototype.convert = X;
M.prototype.revert = am;
M.prototype.revert = am;
M.prototype.reduce = L;
M.prototype.reduce = L;
M.prototype.mulTo = J;
M.prototype.mulTo = J;
M.prototype.sqrTo = aw;
M.prototype.sqrTo = aw;
z = (z * (2 - t * z % this.DV)) % this.DV;
z = (z * (2 - t * z % this.DV)) % this.DV;
return (z > 0) ? this.DV - z: -z
return (z > 0) ? this.DV - z: -z
this.mp = t.invDigit();
this.mp = t.invDigit();
this.mpl = this.mp & 32767;
this.mpl = this.mp & 32767;
this.mph = this.mp >> 15;
this.mph = this.mp >> 15;
this.um = (1
this.um = (1
this.mt2 = 2 * t.t
this.mt2 = 2 * t.t
t.abs().dlShiftTo(this.m.t, z);
t.abs().dlShiftTo(this.m.t, z);
z.divRemTo(this.m, null, z);
z.divRemTo(this.m, null, z);
if (t.s 0) {
if (t.s 0) {
this.m.subTo(z, z)
this.m.subTo(z, z)
t.copyTo(z);
t.copyTo(z);
this.reduce(z);
this.reduce(z);
while (t.t
while (t.t
var aD = (z * this.mpl (((z * this.mph (t[aC] >> 15) * this.mpl) & this.um)
var aD = (z * this.mpl (((z * this.mph (t[aC] >> 15) * this.mpl) & this.um)
t[z] = this.m.am(0, aD, t, aC, 0, this.m.t);
t[z] = this.m.am(0, aD, t, aC, 0, this.m.t);
while (t[z] >= t.DV) {
while (t[z] >= t.DV) {
t[z] -= t.DV;
t[z] -= t.DV;
t.clamp();
t.clamp();
t.drShiftTo(this.m.t, t);
t.drShiftTo(this.m.t, t);
if (t.compareTo(this.m) >= 0) {
if (t.compareTo(this.m) >= 0) {
t.subTo(this.m, t)
t.subTo(this.m, t)
g.prototype.convert = al;
g.prototype.convert = al;
g.prototype.revert = av;
g.prototype.revert = av;
g.prototype.reduce = R;
g.prototype.reduce = R;
g.prototype.mulTo = B;
g.prototype.mulTo = B;
g.prototype.sqrTo = ao;
g.prototype.sqrTo = ao;
return au.ONE
return au.ONE
aF = aI.convert(this),
aF = aI.convert(this),
aF.copyTo(aG);
aF.copyTo(aG);
aI.sqrTo(aG, aC);
aI.sqrTo(aG, aC);
aI.mulTo(aC, aF, aG)
aI.mulTo(aC, aF, aG)
return aI.revert(aG)
return aI.revert(aG)
if (aC
if (aC
return this.exp(aC, aD)
return this.exp(aC, aD)
au.prototype.copyTo = aa;
au.prototype.copyTo = aa;
au.prototype.fromInt = p;
au.prototype.fromInt = p;
au.prototype.fromString = y;
au.prototype.fromString = y;
au.prototype.clamp = Q;
au.prototype.clamp = Q;
au.prototype.dlShiftTo = at;
au.prototype.dlShiftTo = at;
au.prototype.drShiftTo = Z;
au.prototype.drShiftTo = Z;
au.prototype.lShiftTo = v;
au.prototype.lShiftTo = v;
au.prototype.rShiftTo = n;
au.prototype.rShiftTo = n;
au.prototype.subTo = ad;
au.prototype.subTo = ad;
au.prototype.multiplyTo = F;
au.prototype.multiplyTo = F;
au.prototype.squareTo = S;
au.prototype.squareTo = S;
au.prototype.divRemTo = G;
au.prototype.divRemTo = G;
au.prototype.invDigit = D;
au.prototype.invDigit = D;
au.prototype.isEven = k;
au.prototype.isEven = k;
au.prototype.exp = A;
au.prototype.exp = A;
au.prototype.toString = s;
au.prototype.toString = s;
au.prototype.negate = T;
au.prototype.negate = T;
au.prototype.abs = an;
au.prototype.abs = an;
au.prototype.compareTo = I;
au.prototype.compareTo = I;
au.prototype.bitLength = w;
au.prototype.bitLength = w;
au.prototype.mod = P;
au.prototype.mod = P;
au.prototype.modPowInt = ap;
au.prototype.modPowInt = ap;
au.ZERO = c(0);
au.ZERO = c(0);
au.ONE = c(1);
au.ONE = c(1);
d(new Date().getTime())
d(new Date().getTime())
if (navigator.appName == 'Netscape' && navigator.appVersion
if (navigator.appName == 'Netscape' && navigator.appVersion
var H = window.crypto.random(32);
var H = window.crypto.random(32);
for (K = 0; K
for (K = 0; K
W[ae ] = H.charCodeAt(K) & 255
W[ae ] = H.charCodeAt(K) & 255
K = Math.floor(65536 * Math.random());
K = Math.floor(65536 * Math.random());
o.init(W);
o.init(W);
for (ae = 0; ae
for (ae = 0; ae
return o.next()
return o.next()
for (t = 0; t
for (t = 0; t
af.prototype.nextBytes = ax;
af.prototype.nextBytes = ax;
z = (z this.S[aD] aE[aD % aE.length]) & 255;
z = (z this.S[aD] aE[aD % aE.length]) & 255;
m.prototype.init = f;
m.prototype.init = f;
m.prototype.next = a;
m.prototype.next = a;
t.setPublic(aC, z);
t.setPublic(aC, z);
return t.encrypt(aD)
return t.encrypt(aD)
return Math.round(Math.random() * 4294967295)
return Math.round(Math.random() * 4294967295)
for (var B = 0; B
for (var B = 0; B
var C = Number(D[B]).toString(16);
var C = Number(D[B]).toString(16);
if (C.length == 1) {
if (C.length == 1) {
for (var A = 0; A
for (var A = 0; A
C = String.fromCharCode(parseInt(B.substr(A, 2), 16))
C = String.fromCharCode(parseInt(B.substr(A, 2), 16))
for (var A = 0; A
for (var A = 0; A
B[A] = C.charCodeAt(A)
B[A] = C.charCodeAt(A)
var A = C.length;
var A = C.length;
var A = E.length;
var A = E.length;
for (var C = 0; C
for (var C = 0; C
var A = u.length;
var A = u.length;
for (var B = 0; B
for (var B = 0; B
C[B] = E.charCodeAt(B) & 255
C[B] = E.charCodeAt(B) & 255
for (var B = 0; B
for (var B = 0; B
C[A ] = parseInt(E.substr(B, 2), 16)
C[A ] = parseInt(E.substr(B, 2), 16)
s.TEA = {
s.TEA = {
for (var B = 0; B
for (var B = 0; B
A = String.fromCharCode(C[B])
A = String.fromCharCode(C[B])
return d.encode(A)
return d.encode(A)
initkey: function(A, B) {
initkey: function(A, B) {
d.PADCHAR = '=';
d.PADCHAR = '=';
d.ALPHA = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /';
d.ALPHA = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /';
d.getbyte = function(C, B) {
d.getbyte = function(C, B) {
var A = C.charCodeAt(B);
var A = C.charCodeAt(B);
d.encode = function(E) {
d.encode = function(E) {
if (arguments.length != 1) {
if (arguments.length != 1) {
var B = d.PADCHAR;
var B = d.PADCHAR;
var G = d.ALPHA;
var G = d.ALPHA;
var F = d.getbyte;
var F = d.getbyte;
var C = E.length - E.length % 3;
var C = E.length - E.length % 3;
if (E.length == 0) {
if (E.length == 0) {
A.push(G.charAt(H >> 18));
A.push(G.charAt(H >> 18));
A.push(G.charAt((H >> 12) & 63));
A.push(G.charAt((H >> 12) & 63));
A.push(G.charAt((H >> 6) & 63));
A.push(G.charAt((H >> 6) & 63));
A.push(G.charAt(H & 63))
A.push(G.charAt(H & 63))
switch (E.length - C) {
switch (E.length - C) {
A.push(G.charAt(H >> 18) G.charAt((H >> 12) & 63) B B);
A.push(G.charAt(H >> 18) G.charAt((H >> 12) & 63) B B);
A.push(G.charAt(H >> 18) G.charAt((H >> 12) & 63) G.charAt((H >> 6) & 63) B);
A.push(G.charAt(H >> 18) G.charAt((H >> 12) & 63) G.charAt((H >> 6) & 63) B);
return A.join('')
return A.join('')
if (!window.btoa) {
if (!window.btoa) {
window.btoa = d.encode
window.btoa = d.encode
var hex = str.toString(16);
var hex = str.toString(16);
var len = hex.length;
var len = hex.length;
arr.push('\\x' hex.substr(j, 2))
arr.push('\\x' hex.substr(j, 2))
var result = arr.join('');
var result = arr.join('');
hexVcode = s.TEA.strToBytes(c.toUpperCase()),
hexVcode = s.TEA.strToBytes(c.toUpperCase()),
vcodeLen = '000' c.length.toString(16);
vcodeLen = '000' c.length.toString(16);
s.TEA.initkey(s2);
s.TEA.initkey(s2);
var saltPwd = s.TEA.enAsBase64(rsaH1Len rsaH1 s.TEA.strToBytes(salt) vcodeLen hexVcode);
var saltPwd = s.TEA.enAsBase64(rsaH1Len rsaH1 s.TEA.strToBytes(salt) vcodeLen hexVcode);
s.TEA.initkey('');
s.TEA.initkey('');
&appid=21000124&js_ver=10151&js_type=1&login_sig=XJ3RXmdJfvKA-*hz7TXwNTq902uwplhW6tRdiEFDhxMVRhi1bDCo0QdXVBbNxAfN&u1=http://cf.qq.com/cp/a20160217cfyj/index.htm?e_code=213271&r=
&appid=21000124&js_ver=10151&js_type=1&login_sig=XJ3RXmdJfvKA-*hz7TXwNTq902uwplhW6tRdiEFDhxMVRhi1bDCo0QdXVBbNxAfN&u1=http://cf.qq.com/cp/a20160217cfyj/index.htm?e_code=213271&r=
function time(){return Math.random()}
function time(){return Math.random()}
hXXp://captcha.qq.com/cap_union_getsig_new?clientype=2&uin=
hXXp://captcha.qq.com/cap_union_getsig_new?clientype=2&uin=
hXXp://captcha.qq.com/getimgbysig?clientype=2&uin=
hXXp://captcha.qq.com/getimgbysig?clientype=2&uin=
&pt_randsalt=0&u1=http://cf.qq.com/cp/a20160217cfyj/index.htm?e_code=213271&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=2-4-1457704626950&js_ver=10151&js_type=1&login_sig=&pt_uistyle=32&aid=21000124&daid=8&
&pt_randsalt=0&u1=http://cf.qq.com/cp/a20160217cfyj/index.htm?e_code=213271&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=2-4-1457704626950&js_ver=10151&js_type=1&login_sig=&pt_uistyle=32&aid=21000124&daid=8&
pt_mbkey
pt_mbkey
d:d:d
d:d:d
hXXp://count.knowsky.com/count2/count.asp?id=85436&sx=1&ys=43
hXXp://count.knowsky.com/count2/count.asp?id=85436&sx=1&ys=43
hXXp://count.knowsky.com/img/(.*?)/(.*?).gif
hXXp://count.knowsky.com/img/(.*?)/(.*?).gif
&keyindex=9&pt_aid=21000124&daid=8&u1=http://cf.qq.com/comm-htdocs/login/logincallback.htm&clientkey=
&keyindex=9&pt_aid=21000124&daid=8&u1=http://cf.qq.com/comm-htdocs/login/logincallback.htm&clientkey=
hXXp://ptlogin2.qq.com/jump?clientuin=
hXXp://ptlogin2.qq.com/jump?clientuin=
&keyindex=9&pt_aid=15000103&daid=5&u1=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&clientkey=
&keyindex=9&pt_aid=15000103&daid=5&u1=http://act.qzone.qq.com/meteor/pc/index.html?rid=998=1000&e_code=224288?ADTAG=bangbang.hdsq&clientkey=
.PaH
.PaH
U]X%xw
U]X%xw
O.vMk$
O.vMk$
s.>.vc
s.>.vc
%X~ -
%X~ -
SSOAxCtrlForPTLogin.SSOForPTLogin2
SSOAxCtrlForPTLogin.SSOForPTLogin2
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin
document.body.innerHTML=GetuinKey();
document.body.innerHTML=GetuinKey();
function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g
function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g
hXXp://act.tgp.qq.com/index.php/
hXXp://act.tgp.qq.com/index.php/
Host: act.tgp.qq.com
Host: act.tgp.qq.com
X-Requested-With: XMLHttpRequest
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0
Referer: hXXp://act.tgp.qq.com/cf/cf20160325/index.html?ADTAG=bangbang.hdsq
Referer: hXXp://act.tgp.qq.com/cf/cf20160325/index.html?ADTAG=bangbang.hdsq
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=
%7C
%7C
&user_checkparam=cf%7Cyes%7C
&user_checkparam=cf%7Cyes%7C
"msg":"
"msg":"
"sMsg":"
"sMsg":"
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=
,"iRet":"0","sMsg":"
,"iRet":"0","sMsg":"
modRet":{"iRet":"0","sMsg":"
modRet":{"iRet":"0","sMsg":"
"cdkey":"(.*?)"
"cdkey":"(.*?)"
[%d/d/d d:d]
[%d/d/d d:d]
\CF_CDKEY.ini
\CF_CDKEY.ini
1970-01-01 08:00:00
1970-01-01 08:00:00
hXXp://bang.qq.com/actcenter/queryFilterActList
hXXp://bang.qq.com/actcenter/queryFilterActList
"url":"(.*?)"
"url":"(.*?)"
hXXp://kf.qq.com/cgi-bin/common?rand=0.7021259550817557&command=command=C00006&fromtype=kfweb&fromtoolid=kfweb514&type=getCFSpend&area=
hXXp://kf.qq.com/cgi-bin/common?rand=0.7021259550817557&command=command=C00006&fromtype=kfweb&fromtoolid=kfweb514&type=getCFSpend&area=
Referer:hXXp://kf.qq.com/game/consume_records.html?code=cf
Referer:hXXp://kf.qq.com/game/consume_records.html?code=cf
hXXp://apps.game.qq.com/cgi-bin/cf/userinfo/userinfo.cgi?ssn=
hXXp://apps.game.qq.com/cgi-bin/cf/userinfo/userinfo.cgi?ssn=
hXXp://VVV.51.la/report/1_main.asp?id=18855916
hXXp://VVV.51.la/report/1_main.asp?id=18855916
hXXp://VVV.51.la/report/1_main_online.asp?id=18855916
hXXp://VVV.51.la/report/1_main_online.asp?id=18855916
hXXp://bbs.cf.qq.com/home.php?mod=task&do=apply&id=5
hXXp://bbs.cf.qq.com/home.php?mod=task&do=apply&id=5
hXXp://bbs.cf.qq.com/forum.php?mod=forumdisplay&fid=30503&page=6
hXXp://bbs.cf.qq.com/forum.php?mod=forumdisplay&fid=30503&page=6
&extra=page=6
&extra=page=6
hXXp://bbs.cf.qq.com/forum.php?mod=viewthread&tid=
hXXp://bbs.cf.qq.com/forum.php?mod=viewthread&tid=
99998888
99998888
&extra=&replysubmit=yes&infloat=yes&handlekey=fastpost&inajax=1
&extra=&replysubmit=yes&infloat=yes&handlekey=fastpost&inajax=1
hXXp://bbs.cf.qq.com/forum.php?mod=post&action=reply&fid=30503&tid=
hXXp://bbs.cf.qq.com/forum.php?mod=post&action=reply&fid=30503&tid=
&posttime=
&posttime=
hXXp://bbs.cf.qq.com/home.php?mod=task&do=draw&id=5
hXXp://bbs.cf.qq.com/home.php?mod=task&do=draw&id=5
hXXp://bbs.cf.qq.com/home.php?mod=spacecp&ac=credit&showcredit=1
hXXp://bbs.cf.qq.com/home.php?mod=spacecp&ac=credit&showcredit=1
&searchkey=15051408311873756101000000000000&from=1&question=å…Â费枪&vip=0&bangdou=1
&searchkey=15051408311873756101000000000000&from=1&question=å…Â费枪&vip=0&bangdou=1
%7C322%7C
%7C322%7C
*&checkparam=cf%7Cyes%7C
*&checkparam=cf%7Cyes%7C
&ams_checkparam=cf%7Cyes%7C
&ams_checkparam=cf%7Cyes%7C
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fbang.qq.com%2Fshop%2Findex%2Fcf%2F&eas_refer=&sServiceDepartment=xinyue&sServiceType=cf&sArea=
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fbang.qq.com%2Fshop%2Findex%2Fcf%2F&eas_refer=&sServiceDepartment=xinyue&sServiceType=cf&sArea=
Referer:hXXp://bang.qq.com/comm-htdocs/js/ams/v0.2R02/ajaxcdr.swf
Referer:hXXp://bang.qq.com/comm-htdocs/js/ams/v0.2R02/ajaxcdr.swf
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=38135&sServiceDepartment=xinyue&set_info=xinyue
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=38135&sServiceDepartment=xinyue&set_info=xinyue
hXXp://bangbang.qq.com/php/robott3nologin/servey
hXXp://bangbang.qq.com/php/robott3nologin/servey
Referer:hXXp://bang.qq.com/actcenter/index/cf
Referer:hXXp://bang.qq.com/actcenter/index/cf
hXXp://bang.qq.com/ugc1/getActRecommend
hXXp://bang.qq.com/ugc1/getActRecommend
game=cf&mid=0&eid=5&surl=http://bangbang.qq.com/php/login?game=cf&durl=http://bang.qq.com/actcenter/index/cf?&ref=ingame01&ref=ingame01
game=cf&mid=0&eid=5&surl=http://bangbang.qq.com/php/login?game=cf&durl=http://bang.qq.com/actcenter/index/cf?&ref=ingame01&ref=ingame01
hXXp://bang.qq.com/user/scorePersonalAcenter
hXXp://bang.qq.com/user/scorePersonalAcenter
Referer: hXXp://bang.qq.com/main/tradeinfo/
Referer: hXXp://bang.qq.com/main/tradeinfo/
game=bangbang&mid=9&eid=9000&surl=http://bang.qq.com/main/tradeinfo/&durl=http://bang.qq.com/main/tradeinfo/&world=0&serviceType=2&ref=
game=bangbang&mid=9&eid=9000&surl=http://bang.qq.com/main/tradeinfo/&durl=http://bang.qq.com/main/tradeinfo/&world=0&serviceType=2&ref=
hXXp://bang.qq.com/user/scorePersonal
hXXp://bang.qq.com/user/scorePersonal
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fdaoju.qq.com%2Fmall%2Fjudou2.0%2Fcf.shtml&eas_refer=&sServiceDepartment=djc&sServiceType=dj
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fdaoju.qq.com%2Fmall%2Fjudou2.0%2Fcf.shtml&eas_refer=&sServiceDepartment=djc&sServiceType=dj
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=dj&iActivityId=11117&sServiceDepartment=djc&set_info=djc
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=dj&iActivityId=11117&sServiceDepartment=djc&set_info=djc
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fdaoju.qq.com%2Fmall%2Fjudou2.0%2Fcf.shtml&eas_refer=&sServiceDepartment=djc
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fdaoju.qq.com%2Fmall%2Fjudou2.0%2Fcf.shtml&eas_refer=&sServiceDepartment=djc
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=dj&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=11117&iFlowId=96910&g_tk=
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=dj&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=11117&iFlowId=96910&g_tk=
Referer:hXXp://daoju.qq.com/comm-htdocs/js/milo/ajaxcdr.swf?0.9721381550078127
Referer:hXXp://daoju.qq.com/comm-htdocs/js/milo/ajaxcdr.swf?0.9721381550078127
sMsg":"
sMsg":"
bHasSendFailItem":"0","iRet":"0","sMsg":"
bHasSendFailItem":"0","iRet":"0","sMsg":"
hXXp://apps.game.qq.com/daoju/v3/api/app/e_app/add_jf_firstlogin.php?appSource=ios&appVersion=35&sDeviceID=
hXXp://apps.game.qq.com/daoju/v3/api/app/e_app/add_jf_firstlogin.php?appSource=ios&appVersion=35&sDeviceID=
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fdaoju.qq.com%2Fmall%2Ftask.shtml&eas_refer=&sServiceDepartment=djc
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fdaoju.qq.com%2Fmall%2Ftask.shtml&eas_refer=&sServiceDepartment=djc
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=dj&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=35644&iFlowId=204638&g_tk=
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=dj&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=35644&iFlowId=204638&g_tk=
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=dj&iActivityId=35644&sServiceDepartment=djc&set_info=djc
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=dj&iActivityId=35644&sServiceDepartment=djc&set_info=djc
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=23314&callback=vipSignNew.signCb&g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=23314&callback=vipSignNew.signCb&g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?actid=52002&g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?actid=52002&g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=79968&callback=vipSignNew.signCb&g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=79968&callback=vipSignNew.signCb&g_tk=
hXXp://iyouxi.vip.qq.com/ams.php?_c=page&actid=22249&g_tk=
hXXp://iyouxi.vip.qq.com/ams.php?_c=page&actid=22249&g_tk=
hXXp://iyouxi.vip.qq.com/ams2.02.php?actid=23074&g_tk_type=1&g_tk=
hXXp://iyouxi.vip.qq.com/ams2.02.php?actid=23074&g_tk_type=1&g_tk=
hXXp://iyouxi.vip.qq.com/jsonp.php?_c=page&actid=5474&isLoadUserInfo=1&callback=page.signInCb&g_tk=
hXXp://iyouxi.vip.qq.com/jsonp.php?_c=page&actid=5474&isLoadUserInfo=1&callback=page.signInCb&g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=54963&callback=vipSignNew.signCb&g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=54963&callback=vipSignNew.signCb&g_tk=
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fxinyue.qq.com%2Fweb201410%2Fwebgame.shtml&eas_refer=http%3A%2F%2Fxinyue.qq.com%2Fweb201410%2Fwebgame.shtml&sServiceDepartment=xinyue&sServiceType=tgclub
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fxinyue.qq.com%2Fweb201410%2Fwebgame.shtml&eas_refer=http%3A%2F%2Fxinyue.qq.com%2Fweb201410%2Fwebgame.shtml&sServiceDepartment=xinyue&sServiceType=tgclub
Referer: hXXp://xinyue.qq.com/comm-htdocs/js/milo/ajaxcdr.swf?0.7271989360451698
Referer: hXXp://xinyue.qq.com/comm-htdocs/js/milo/ajaxcdr.swf?0.7271989360451698
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=21547&sServiceDepartment=xinyue&set_info=xinyue
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=21547&sServiceDepartment=xinyue&set_info=xinyue
&_=1452520903377
&_=1452520903377
hXXp://pay.video.qq.com/fcgi-bin/sign?callback=jQuery111006800204519842937_1452520903238&low_login=1&uin=
hXXp://pay.video.qq.com/fcgi-bin/sign?callback=jQuery111006800204519842937_1452520903238&low_login=1&uin=
hXXp://share.music.qq.com/fcgi-bin/dmrp_activity/fcg_feedback_send_lottery.fcg?activeid=110&rnd=1458872103167&g_tk=
hXXp://share.music.qq.com/fcgi-bin/dmrp_activity/fcg_feedback_send_lottery.fcg?activeid=110&rnd=1458872103167&g_tk=
&_=1454839692917
&_=1454839692917
hXXp://x.pet.qq.com/vip_platform?cmd=set_sign_info&timer=1454839703753&callback=jQuery110205429354978259653_1454839692914&token=
hXXp://x.pet.qq.com/vip_platform?cmd=set_sign_info&timer=1454839703753&callback=jQuery110205429354978259653_1454839692914&token=
msg": "
msg": "
hXXp://vip.qzone.qq.com/fcg-bin/v2/fcg_mobile_vip_site_checkin?t=0.46869834180487055&g_tk=
hXXp://vip.qzone.qq.com/fcg-bin/v2/fcg_mobile_vip_site_checkin?t=0.46869834180487055&g_tk=
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_0 like Mac OS X) AppleWebKit/600.1.3 (KHTML, like Gecko) Version/8.0 Mobile/12A4345d Safari/600.1.4
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_0 like Mac OS X) AppleWebKit/600.1.3 (KHTML, like Gecko) Version/8.0 Mobile/12A4345d Safari/600.1.4
hXXp://qun.qzone.qq.com/cgi-bin/get_group_list?callbackFun=woaiwang&uin=
hXXp://qun.qzone.qq.com/cgi-bin/get_group_list?callbackFun=woaiwang&uin=
Referer: hXXp://qiandao.qun.qq.com/cgi-bin/sign
Referer: hXXp://qiandao.qun.qq.com/cgi-bin/sign
Host: qiandao.qun.qq.com
Host: qiandao.qun.qq.com
hXXp://qiandao.qun.qq.com/cgi-bin/sign
hXXp://qiandao.qun.qq.com/cgi-bin/sign
hXXp://qiandao.qun.qq.com/cgi-bin/new_flag
hXXp://qiandao.qun.qq.com/cgi-bin/new_flag
hXXp://iyouxi.vip.qq.com/ams3.0.php?g_tk=
hXXp://iyouxi.vip.qq.com/ams3.0.php?g_tk=
hXXp://buluo.qq.com/cgi-bin/bar/card/bar_list_by_page
hXXp://buluo.qq.com/cgi-bin/bar/card/bar_list_by_page
hXXp://buluo.qq.com/cgi-bin/bar/user/sign
hXXp://buluo.qq.com/cgi-bin/bar/user/sign
hXXp://bang.qq.com/comm-htdocs/js/ams/v0.2R02/ajaxcdr.swf
hXXp://bang.qq.com/comm-htdocs/js/ams/v0.2R02/ajaxcdr.swf
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=38135&sServiceDepartment=group_f
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=38135&sServiceDepartment=group_f
hXXp://cfzhushou.com/cfzs/help.html
hXXp://cfzhushou.com/cfzs/help.html
hXXp://cfzhushou.com/help.html
hXXp://cfzhushou.com/help.html
hXXp://ip.qq.com/cgi-bin/myip
hXXp://ip.qq.com/cgi-bin/myip
hXXps://aq.qq.com/cn2/safe_service/device_lock
hXXps://aq.qq.com/cn2/safe_service/device_lock
&collect=yehFdbVCaf6iRVmDtqzeLJS11vU2naOwqvdxlLqGgQgGJ4_1_XDmcUqe-XbQfHy6_zKOfL_dTnSV5_S5FuHtVYE2M64qMUdEQwAofTHRuzp5HPhYJuWiJRwtmyS8dEllMsGR5MxIy6kK3cCNw9aOvyKUaV8xygen57rNX0BAzkOOtzxtXLSOnSV6prBECoE5JCuV_pDIt_Hl6Vy4fWiQrRmAoS2Dud5MMasCnWCHonOwKhub5TaOuEpjfoEAF2ResP3i32BFRog1PO8WIxl4D__-61X3q-C4RD3jR5GbftwSIPPU8chK9rrwr5I3XW-yGYyNLKKfSvRl4CIRSmenCQw9MdOLMBA-Kq3wA-Isq5nFFis-2uJm8OdDb0rcVGZZM8lF5eN_dSLgHOFx-kGUSWkuLYx9QHR-_3K4B4wu907rpbKeobTewmLGw6-az0VkyJSlwRdFjciqcUFPdpy3kuIDdh9P6JnGiMb16ADzfjA8KdwuUZaXG40CKTsTX6L-kjN-f2iYbkyQP1NS8oaBXXCCGHHToXvb8lGeiMud00_wtNjKywve0slKxZhcDZlcNcagw0WtCD8ckxCANdo2WinaIWzyApgf1gMl_pRAtgsH1PMmglKLLnmoZo86HGTPDAoyMzzQF5MMdTJ2LYKwxSK2swj4yeKX3jPZHOuYt74*&ans=
&collect=yehFdbVCaf6iRVmDtqzeLJS11vU2naOwqvdxlLqGgQgGJ4_1_XDmcUqe-XbQfHy6_zKOfL_dTnSV5_S5FuHtVYE2M64qMUdEQwAofTHRuzp5HPhYJuWiJRwtmyS8dEllMsGR5MxIy6kK3cCNw9aOvyKUaV8xygen57rNX0BAzkOOtzxtXLSOnSV6prBECoE5JCuV_pDIt_Hl6Vy4fWiQrRmAoS2Dud5MMasCnWCHonOwKhub5TaOuEpjfoEAF2ResP3i32BFRog1PO8WIxl4D__-61X3q-C4RD3jR5GbftwSIPPU8chK9rrwr5I3XW-yGYyNLKKfSvRl4CIRSmenCQw9MdOLMBA-Kq3wA-Isq5nFFis-2uJm8OdDb0rcVGZZM8lF5eN_dSLgHOFx-kGUSWkuLYx9QHR-_3K4B4wu907rpbKeobTewmLGw6-az0VkyJSlwRdFjciqcUFPdpy3kuIDdh9P6JnGiMb16ADzfjA8KdwuUZaXG40CKTsTX6L-kjN-f2iYbkyQP1NS8oaBXXCCGHHToXvb8lGeiMud00_wtNjKywve0slKxZhcDZlcNcagw0WtCD8ckxCANdo2WinaIWzyApgf1gMl_pRAtgsH1PMmglKLLnmoZo86HGTPDAoyMzzQF5MMdTJ2LYKwxSK2swj4yeKX3jPZHOuYt74*&ans=
hXXp://captcha.qq.com/cap_union_verify_new?clientype=2&uin=
hXXp://captcha.qq.com/cap_union_verify_new?clientype=2&uin=
hXXp://captcha.qq.com/getimage?aid=210001040.5721703316085041
hXXp://captcha.qq.com/getimage?aid=210001040.5721703316085041
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=41615&sServiceDepartment=group_f
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=41615&sServiceDepartment=group_f
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=qqgame&iActivityId=41615&sServiceDepartment=group_h&set_info=group_h
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=qqgame&iActivityId=41615&sServiceDepartment=group_h&set_info=group_h
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=50394&sServiceDepartment=group_f
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=50394&sServiceDepartment=group_f
hXXp://apps.game.qq.com/daoju/appmarket/daoju_promotion/cloud_ticket/QueryCloudTicket.php?acctid=A100078&id=28&time=0.23177661886438727&_=1461381268102
hXXp://apps.game.qq.com/daoju/appmarket/daoju_promotion/cloud_ticket/QueryCloudTicket.php?acctid=A100078&id=28&time=0.23177661886438727&_=1461381268102
*&checkparam=cf|yes|
*&checkparam=cf|yes|
&ams_checkparam=cf|yes|
&ams_checkparam=cf|yes|
&e_code=0&g_code=0&eas_url=http://daoju.qq.com/mall/judou2.0/cf.shtml&sServiceDepartment=djc&sPartition=
&e_code=0&g_code=0&eas_url=http://daoju.qq.com/mall/judou2.0/cf.shtml&sServiceDepartment=djc&sPartition=
Referer:hXXp://daoju.qq.com/comm-htdocs/js/milo/ajaxcdr.swf?0.6722960381302983
Referer:hXXp://daoju.qq.com/comm-htdocs/js/milo/ajaxcdr.swf?0.6722960381302983
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=42715&sServiceDepartment=djc&set_info=djc
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=42715&sServiceDepartment=djc&set_info=djc
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fbang.qq.com%2Fshop%2Findex%2Fcf%2F&eas_refer=http%3A%2F%2Fbang.qq.com%2Fmain%2Ftradeinfo%2F&sServiceDepartment=xinyue
&e_code=0&g_code=0&eas_url=http%3A%2F%2Fbang.qq.com%2Fshop%2Findex%2Fcf%2F&eas_refer=http%3A%2F%2Fbang.qq.com%2Fmain%2Ftradeinfo%2F&sServiceDepartment=xinyue
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=tgclub&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=38135&iFlowId=
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=tgclub&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=38135&iFlowId=
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=38135&sServiceDepartment=xinyue&set_info=xinyue
hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=38135&sServiceDepartment=xinyue&set_info=xinyue
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=tgclub&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=38135&iFlowId=214216&g_tk=
gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=tgclub&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=38135&iFlowId=214216&g_tk=
|322|
|322|
sCdKey=
sCdKey=
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=8918&sServiceDepartment=x1m1
hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=8918&sServiceDepartment=x1m1
sMsg" : "
sMsg" : "
\gzip.dll
\gzip.dll
.text
.text
`.data
`.data
@.reloc
@.reloc
KERNEL32.dll
KERNEL32.dll
gzip.pdb
gzip.pdb
_u%SV
_u%SV
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E)
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E)
hXXp://apps.game.qq.com/cgi-bin/cf/a20090409forceout/getinfo.cgi
hXXp://apps.game.qq.com/cgi-bin/cf/a20090409forceout/getinfo.cgi
hXXp://webd.tgp.qq.com/cf/info_proxy/weapon_stat_info?&&zone_id=
hXXp://webd.tgp.qq.com/cf/info_proxy/weapon_stat_info?&&zone_id=
1970.01.01 00:00:00
1970.01.01 00:00:00
hXXps://ssl.ptlogin2.qq.com/ptqrshow?appid=21000124&e=2&l=M&s=4&d=72&v=4&t=0.061519597441372864&daid=8
hXXps://ssl.ptlogin2.qq.com/ptqrshow?appid=21000124&e=2&l=M&s=4&d=72&v=4&t=0.061519597441372864&daid=8
&js_ver=10151&js_type=1&login_sig=7qKho-IT4nBHQJBVoTYw6p-IGP0hieZLRsmCy5MWU7g0bRJNRkb5q8yH7BUA7cTM&pt_uistyle=20&aid=21000124&daid=8&
&js_ver=10151&js_type=1&login_sig=7qKho-IT4nBHQJBVoTYw6p-IGP0hieZLRsmCy5MWU7g0bRJNRkb5q8yH7BUA7cTM&pt_uistyle=20&aid=21000124&daid=8&
hXXps://ssl.ptlogin2.qq.com/ptqrlogin?ptredirect=1&u1=http://cf.qq.com/cp/a20160223czxlx/index.htm?e_code=213709&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=6-0-
hXXps://ssl.ptlogin2.qq.com/ptqrlogin?ptredirect=1&u1=http://cf.qq.com/cp/a20160223czxlx/index.htm?e_code=213709&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=6-0-
hXXp://cf.qq.com/cfvip/
hXXp://cf.qq.com/cfvip/
hXXp://xinyue.qq.com
hXXp://xinyue.qq.com
?kernel32.dll
?kernel32.dll
hXXp://apps.game.qq.com/CommArticle/app/reg/gdate.php
hXXp://apps.game.qq.com/CommArticle/app/reg/gdate.php
crossfire.exe
crossfire.exe
Report
Report
themepassword
themepassword
SysShadow.HostWnd
SysShadow.HostWnd
{6AEDBD6D-3FB5-418A-83A6-7F45229DC872}
{6AEDBD6D-3FB5-418A-83A6-7F45229DC872}
VBScript.RegExp
VBScript.RegExp
{0002DF05-0000-0000-C000-000000000046}
{0002DF05-0000-0000-C000-000000000046}
{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}
{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}
{6D5140C1-7436-11CE-8034-00AA006009FA}
{6D5140C1-7436-11CE-8034-00AA006009FA}
{D30C1661-CDAF-11d0-8A3E-00C04FC9E26E}
{D30C1661-CDAF-11d0-8A3E-00C04FC9E26E}
document.all.resultjs.innerText=
document.all.resultjs.innerText=
var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');
var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');
SysShadow.Menu
SysShadow.Menu
Microsoft.XMLDOM
Microsoft.XMLDOM
14:00~16:00
14:00~16:00
12:00-19:00
12:00-19:00
123456789
123456789
00003333
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
F%*.*f
F%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
iphlpapi.dll
iphlpapi.dll
MPR.dll
MPR.dll
VERSION.dll
VERSION.dll
WSOCK32.dll
WSOCK32.dll
.PAVCException@@
.PAVCException@@
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
.PAVCFileException@@
.PAVCFileException@@
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
1.1.3
1.1.3
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
msscript.ocx
msscript.ocx
VVV.dywt.com.cn
VVV.dywt.com.cn
\\.\Smartvsd
\\.\Smartvsd
\\.\PhysicalDrive%d
\\.\PhysicalDrive%d
\\.\Scsi%d:
\\.\Scsi%d:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
%d%d%d
%d%d%d
rundll32.exe shell32.dll,
rundll32.exe shell32.dll,
.PAVCOleException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.PAVCArchiveException@@
right-curly-bracket
right-curly-bracket
left-curly-bracket
left-curly-bracket
0123456789
0123456789
c:\%original file name%.exe
c:\%original file name%.exe
GetCPInfo
GetCPInfo
WinExec
WinExec
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
GetViewportExtEx
GetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
SetViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
GetViewportOrgEx
GetViewportOrgEx
GetKeyState
GetKeyState
GetKeyboardState
GetKeyboardState
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCrackUrlA
`.rdata
`.rdata
@.data
@.data
_
_
.QX' x
.QX' x
1.0.15.507
1.0.15.507
1.0.0.0
1.0.0.0
6.0.2600.0 (xpclient.010817-1148)
6.0.2600.0 (xpclient.010817-1148)
6.0.2600.0
6.0.2600.0
%original file name%.exe_344_rwx_01630000_00013000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
1.2.3
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
inflate 1.2.3 Copyright 1995-2005 Mark Adler
%c%c%c%c%c%c%c%c%c%c
%c%c%c%c%c%c%c%c%c%c
MSVCRT.dll
MSVCRT.dll
KERNEL32.dll
KERNEL32.dll
zlib1.dll
zlib1.dll
!"#$%&'()* ,-./012
!"#$%&'()* ,-./012
DLL support by Alessandro Iacopetti & Gilles Vollant
DLL support by Alessandro Iacopetti & Gilles Vollant
%original file name%.exe_344_rwx_10001000_00033000:
f9z.vk
f9z.vk
@Microsoft.XMLDOM
@Microsoft.XMLDOM
dwmapi.dll
dwmapi.dll
Riched20.dll
Riched20.dll
Riched32.dll
Riched32.dll
{00000000-0000-0000-C000-000000000046}
{00000000-0000-0000-C000-000000000046}
{34A715A0-6587-11D0-924A-0020AFC7AC4D}
{34A715A0-6587-11D0-924A-0020AFC7AC4D}
kernel32.dll
kernel32.dll
ole32.dll
ole32.dll
gdiplus.dll
gdiplus.dll
GdiPlus.dll
GdiPlus.dll
gdi32.dll
gdi32.dll
user32.dll
user32.dll
Advapi32.dll
Advapi32.dll
advapi32.dll
advapi32.dll
User32.dll
User32.dll
ntdll.dll
ntdll.dll
Ole32.dll
Ole32.dll
shell32.dll
shell32.dll
atl.dll
atl.dll
program internal error number is %d.
program internal error number is %d.
:"%s"
:"%s"
:"%s".
:"%s".
GetProcessHeap
GetProcessHeap
&..0`%X
&..0`%X
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
.reloc
.reloc