Trojan.GenericKD.2536090_e76460b2cf – Adaware

Trojan.GenericKD.2536090 (B) (Emsisoft), Trojan.GenericKD.2536090 (AdAware), Trojan.Win32.FlyStudio.FD, Trojan.Win32.Swrort.3.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: e76460b2cfac79074715d45f1dcc46d6

SHA1: 69996e59ee2df592fa1c9163eb7ad85235f5920d

SHA256: 06e68b678d7d541673cb80eb4f11eb2354b8703450017297e48c6cb80d385568

SSDeep: 49152:5xmfjYjEwgeON184o 0XwoeMaqkZinzzXeVgHiDR q2vxkkrEq69CVY:/UTH8450XreMaRZinzzDHgcq2JkkrBV

Size: 2491904 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: BPTUD

Created at: 2015-06-10 11:10:59

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:464

Mutexes

The following mutexes were created/opened:

ini_read_writeRasPbFileShimCacheMutex

File activity

The process %original file name%.exe:464 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\sqlite3.dll (1825 bytes)
C:\qyd1.edb (260 bytes)
C:\qyd.db-journal (1594 bytes)
C:\qyd.db (149 bytes)
C:\qyd2.enx (1 bytes)

The Trojan deletes the following file(s):

C:\qyd.db-journal (0 bytes)

Registry activity

The process %original file name%.exe:464 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C 55 84 1D 9C 37 1B D2 3B 12 9E C4 EA C0 7A C7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

Dropped PE files

MD5	File path
d6580cc678d0a80596628cd3cab61ff1	c:\sqlite3.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\sqlite3.dll (1825 bytes)
C:\qyd1.edb (260 bytes)
C:\qyd.db-journal (1594 bytes)
C:\qyd2.enx (1 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	3383296	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	3387392	2195456	2192384	5.47226	012515bb2110448a8f69a2f56fa711e2
.rsrc	5582848	299008	298496	2.81472	aef34539121e69c65638a0ed493bef83

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://65770.vhost8.cloudvhost.cn/gx1.txt
hxxp://www.qqydw.com/gx1.txt	122.114.121.8

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /gx1.txt HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: VVV.qqydw.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 30 Aug 2015 13:17:07 GMT

Server: Apache

Last-Modified: Sun, 30 Aug 2015 02:18:33 GMT

ETag: "327ae9-287e-51e7deeff3040"

Accept-Ranges: bytes

Content-Length: 10366

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/plain; charset=UTF-8

QQ.............[1:9.3|hXXp://qyddl.kuaiyunds.com/qyddl/QQÃ§Â©ÂºÃ©%97Â´Ã¨Â®Â¿Ã¥Â®Â¢Ã¦ÂÂÃ¥Ââ€“Ã¥â„¢Â¨.rar]..QQ...........[2:9.41|hXXp://shsoft.kuaiyunds.com/shsoft/QQÃ¨Âµâ€žÃ¦â€“â„¢Ã¦Å¸%A5Ã¨Â¯Â¢Ã¥â„¢Â¨.exe]..QQ......................(......).[4:8.91|http://shsoft.kuaiyunds.com/shsoft/QQÃ§â€ºÂ´Ã¦Å½Â¥Ã¥Å Â Ã¥Â¥%BDÃ¥Ââ€¹Ã¨Â¿â€¡Ã¦Â»Â¤.exe]..QQ......................(......).[8:2.02|hXXp://shsoft.kuaiyunds.com/shsoft/QQÃ¥ÂÂ·Ã¥Ââ€¢Ã¥ÂÅ’Ã¥Ââ€˜Ã§Ââ€ºÃ©â‚¬â€°Ã¥â„¢Â¨.exe]......................[6:1.0|hXXp://VVV.qydrj.com]......QQ.........[7:1.3|hXXp://VVV.qydrj.com]..QQ.................[9:1.1|hXXp://VVV.qydrj.com]..QQ.............[10:3.6|hXXp://shsoft.kuaiyunds.com/shsoft/QQÃ§Â¾Â¤Ã¦Ë†ÂÃ¥â€˜ËœÃ¦ÂÂÃ¥Ââ€“Ã¥â„¢Â¨.exe]..QQ.................[11:1.6|hXXp://VVV.qydrj.com]..QQ.................[31:8.5|hXXp://shsoft.kuaiyunds.com/shsoft/Ã§Â²Â¾Ã¥â€¡â€ QQÃ¥ÂÂ·Ã§Â ÂÃ©â€¡â€¡Ã©â€ºâ€ Ã¤Â¸â€œÃ¥%AEÂ¶.exe]..QQ................QQ.........[13:1.2|hXXp://VVV.qqydw.com]......QQ.............[14:2.1|hXXp://VVV.qydrj.com]..QQ...............[15:2.5|hXXp://VVV.qydrj.com]..QQ.................[16:3.11|hXXp://VVV.qydrj.com]..QQ.................[17:3.0|hXXp://VVV.qydrj.com]..QQ.................[18:1.5|hXXp://VVV.qqydw.com]..QQ.................[19:1.2|http://VVV.qqydw.com]..QQ.................[20:1.1|hXXp://VVV.qqydw.com]..QQ...........................[21:1.9|]..QQ...............[22:1.2|http://VVV.qqydw.com]..QQ...........[23:1.0|hXXp://VVV.qqydw.com]..QQ..

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_464:

`.rsrc

3h%S~

t%SVh

t$(SSh

~%UVW

u$SShe

ole32.dll

FastVerCode.dll

UUWiseHelper.dll

dc.dll

atl.dll

gdiplus.dll

shlwapi.dll

kernel32.dll

user32.dll

Psapi.dll

GdiPlus.dll

sqlite3.dll

Kernel32.dll

ADVAPI32.DLL

secur32.dll

advapi32.dll

shell32.dll

Rasapi32.dll

ntdll.dll

GetProcessHeap

CreateIoCompletionPort

uu_loginA

ShellExecuteA

ReportError

uu_reportError

EnumChildWindows

GdiplusShutdown

sqlite3_errcode

sqlite3_open_v2

sqlite3_close

sqlite3_rekey

sqlite3_key

sqlite3_free

sqlite3_errmsg

sqlite3_libversion

sqlite3_busy_timeout

sqlite3_exec

sqlite3_prepare_v2

sqlite3_step

sqlite3_column_int

sqlite3_finalize

sqlite3_get_table

sqlite3_free_table

sqlite3_interrupt

sqlite3_changes

sqlite3_bind_blob

sqlite3_data_count

sqlite3_reset

sqlite3_column_count

sqlite3_column_name

sqlite3_column_decltype

sqlite3_column_text

sqlite3_column_blob

sqlite3_column_int64

sqlite3_column_double

sqlite3_sql

sqlite3_column_bytes

GetProcessHeaps

{B6F7542F-B8FE-46a8-9605-98856A687097}

{E5000198-4471-40e2-92BC-D0BA075BDBB2}

{A068799B-7551-46b9-8CA8-EEF8357AFEA4}

KEY: {

{3F4DACA4-160D-11D2-A8E9-00104B365C9F}

hXXp://xiaoqu.qq.com/cgi-bin/bar/category_list

hXXp://xiaoqu.qq.com/mobile/index.html?_lv=28743&_wv=1027&_bid=128

Mozilla/5.0 (Linux; Android 4.4.2; GT-N7100 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 V1_AND_SQ_5.4.0_218_YYB_D QQ/5.4.1.2395 NetType/WIFI

zone.qq.com/cgi-bin/friendshow/cgi_get_visitor_single?uin=

hXXp://g.

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36

hXXp://user.qzone.qq.com/

&url=

&unikey=

zone.qq.com/cgi-bin/likes/get_like_list_app?uin=

hXXp://users.

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36

"nick":"

@1970-01-01 08:00:00

.@&count=15&sidomain=ctc.qzonestyle.gtimg.cn&useutf8=1&outputhtmlfeed=1&refer=2&r=0.4309617872349918&g_tk=

zone.qq.com/cgi-bin/feeds/feeds_html_act_all?uin=

hXXp://ic2.

hXXp://ctc.qzs.qq.com/qzone/profile/index.html?tab=info

data-unikey=\x22

data-key=\x22

@qq.com

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

\LZConfig.ini

\FastVerCode.dll

.text

`.rdata

@.data

@.reloc

NETAPI32.dll

MFC42.DLL

KERNEL32.dll

SHLWAPI.dll

WININET.dll

.PAVCObject@@

.PAVCException@@

.PAVCFileException@@

.PAVCInternetException@@

Content-Disposition: form-data; name="key"

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MALN)

POST /api.php?mod=yzm&act=state HTTP/1.1

/api.php?mod=yzm&act=state

LZConfig.ini

User-Agent: Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0)

HTTP/1.1

/api.php?mod=yzm&act=add

POST /api.php?mod=yzmm&act=result_new HTTP/1.1

/api.php?mod=yzmm&act=result_new

POST /api.php?mod=yzm&act=point HTTP/1.1

/api.php?mod=yzm&act=point

POST /api.php?mod=yzm&act=register HTTP/1.1

/api.php?mod=yzm&act=register

eee.hyslt.com

POST /api.php?mod=dmuser&act=yzm_error HTTP/1.1

/api.php?mod=dmuser&act=yzm_error

.hyslt.com

XXXXXX

hXXp://ip.qq.com/

POST /api.php?mod=yzm&act=server HTTP/1.1

/api.php?mod=yzm&act=server

\UUExtConfig.ini

CodeType=0\UUWiseHelper.dll

SSSSh

ByScreen.JPG

operator

GetProcessWindowStation

E:\work\UUWiseHelper

\UUWiseHelper.pdb

RegCloseKey

RegOpenKeyExW

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

urlmon.dll

dbghelp.dll

IPHLPAPI.DLL

WS2_32.dll

GetCPInfo

UUWiseHelper.DLL

uu_easyRecognizeUrlA

uu_easyRecognizeUrlW

uu_loginW

uu_recognizeByCodeTypeAndUrlA

uu_recognizeByCodeTypeAndUrlW

zcÃ

"0,01070

8Â8J8R8x8

0#0'0-01070;0

=*>0>4>8>

5%6S6

3$3,383\3|3

:-1014,URL

:-19011,

TEAKEY

\dc.dll

WSOCK32.dll

MSVCP60.dll

ReportError_A

VBYB_ReportError

VB_ReportError

debug.ini

ReportError:%s

Error:%s

%s|!|%s

\dms.pdb

%u%u,

dclog.txt

config.ini

port

settimeout:%d

[%d]%s

reg2:%s

checkok:%s %s

check fail:%s %s %s

check:%s %s

getcjfail:%s %s

getcj:%s %s

%s%uout

%s%uin

put img ok:%s

put img fail:%s

put img:%s %s %d

get result ok:%s,%s

get result fail:%s

get result:%s

notifyfail ok:%s

%s\%d-%s.png

notifyfail fail:%s,%s

notifyfail:%s

getimgok:%s,%s

getimg:%s

getinfo fail:%s

getinfo:%s,%s

setresult:%s,%s

HTTP/1.1 200 OK

recv:%d

send:%d

GET /ip.txt HTTP/1.1

Host: %s

User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2

select:%d

ioctlsocket:%d

socket:%d

api.qqchaoren.net

14.17.65.24

14.17.65.23

dama2.qqchaoren.net

dama1.qqchaoren.net

connect total:%s %d

:%s %d

connect discard:%s %d

[d-d-d d:d:d](u)

recv timeout:

recvfail:%d

server close:%d

recv:%d

send:%d

sendfail:%d

connect timeout:

connectok:%s %hu

127.0.0.1

1.1.3

qq.com/

zone.qq.com/cgi-bin/friendshow/cgi_get_visitor_simple?uin=

hXXp://b1.qzone.qq.com/cgi-bin/blognew/blog_output_data?uin=

zone.qq.com/cgi-bin/blognew/blog_get_interaction?uin=

hXXp://b.

"opnick":"

zone.qq.com/cgi-bin/blognew/get_comment_list?uin=

hXXp://b11.

zone.qq.com/cgi-bin/blognew/blog_output_data?uin=

hXXp://b1.

hXXp://ctc.qzs.qq.com/qzone/newblog/blogcanvas.html

.idata

.edata

P.vmp0

`.vmp1

.reloc

P.rsrc

version.dll

1e.ro4A

oleaut32.dll

H0.gW

comctl32.dll

gdi32.dll

d.jF/"

r#'%C

6.Xdp

g|$^.Cn

>.bM8

>Z.Ye

w4R`$p%s*

f.zo~L^

wsock32.dll

Ã‹.L@

l.sQ{

c-t{.FF

b#I".wM

e.ENZ

xip.tu

@>.vO

%FX2Fsi

qKT.jLka

3.LD7

G,.gd

<.cff>

&8.XMj

$~O.Ba

)].Wd

/_{M%U

Q%s6|

lVfeVg

!%uO

mh.ud

m%Csn%

kq84.QaI

)f%fg

.SuDYw

K)`p.frC

*%s!%

aR.dDb&

.xk 4g

)%S{.

'U}.Ue

l%S(8x$!(

1L%UJ

.vtbw

.iA5N

yyhKa%S

d.Zd=#R

x0r%F{

.IPi)

Vj.jH

>M%X9

/8[

bc.lTk

ks_GetMsg

kssPlugin.dll

tole32.dll

hXXp://xiaoqu.qq.com/cgi-bin/bar/get_gbar_by_collction

hXXp://xiaoqu.qq.com/cgi-bin/bar/get_bar_list_by_category

&num=15&cgi_host=http://taotao.qq.com/cgi-bin/emotion_cgi_msglist_v6&code_version=1&format=jsonp&need_private_comment=1&g_tk=

q.com/cgi-bin/emotion_cgi_msglist_v6?uin=

hXXp://taotao.

{"certified":

hXXp://b11.qzone.qq.com/cgi-bin/blognew/get_abs?hostUin=

hXXp://cgi.find.qq.com/q

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.59 QQ/6.4.12593.201 Safari/537.36

hXXp://find.qq.com/index.html?version=1&im_version=5407&width=910&height=610&search_target=0

&sessionid=0&keyword=

&sessionid=1&keyword=

\IP.qyd

hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=1&rsv_idx=1&tn=baidu&wd=ipÃ¦Å¸Â¥Ã¨Â¯Â¢

hXXp://VVV.ip138.com/ips138.asp

hXXp://r.qzone.qq.com/cgi-bin/user/qzone_cgi_msg_getcnt2?uin=

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36

hXXp://xui.ptlogin2.qq.com/cgi-bin/xlogin?proxy_url=http://qzs.qq.com/qzone/v6/portal/proxy.html&daid=5&pt_qzone_sig=1&hide_title_bar=1&low_login=0&qlogin_auto_login=1&no_verifyimg=1&link_target=blank&appid=549000912&style=22&target=self&s_url=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone&pt_qr_app=Ã¦â€°â€¹Ã¦Å“ÂºQQÃ§Â©ÂºÃ©â€”Â´&pt_qr_link=http://z.qzone.com/download.html&self_regurl=http://qzs.qq.com/qzone/v6/reg/index.html&pt_qr_help_link=http://z.qzone.com/download.html

login_sig=

,login_sig:"

VVV.qqydw.com

&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone&r=0.

&js_type=1&login_sig=

hXXp://check.ptlogin2.qq.com/check?regmaster=

&0.7227352769114077

hXXp://captcha.qq.com/cap_union_show?clientype=2&uin=

hXXp://captcha.qq.com/getimgbysig?aid=

&0.18814749689772725

hXXp://captcha.qq.com/cap_union_verify?aid=

Hs("{pass}","{uin}","{code}")

{pass}

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('Y 1O=X(){X r(){W.n=1d;W.e=0;W.4V=W.3h=W.4k=W.q=W.p=W.d=1d}X B(r,z,I){1d!=r&&("50"==2W r?W.3i(r,z,I):1d==z&&"3T"!=2W r?W.1S(r,1B):W.1S(r,z))}X z(){Z 1u B(1d)}X A(r){Y V=z();V.2c(r);Z V}X D(r){Y z=1,I;0!=(I=r>>>16)&&(r=I,z =16);0!=(I=r>>8)&&(r=I,z =8);0!=(I=r>>4)&&(r=I,z =4);0!=(I=r>>2)&&(r=I,z =2);0!=r>>1&&(z =1);Z z}X C(r){W.m=r}X E(r){W.m=r;W.2a=r.2V();W.2f=W.2a&1N;W.2U=W.2a>>15;W.2T=(1>8&1f;L[G ]^=r>>16&1f;L[G ]^=r>>24&1f;G>=U&&(G-=U)}X O(){}X N(){W.j=W.i=0;W.S=[]}r.1b.2R=X(r){Z r.2Q(W.e,W.n)};r.1b.2P=X(r,z){1d!=r&&1d!=z&&0>3;1a(z>=15;0>15,G=z*R F*E,R=E*R ((G&1N)>>30) (G>>>15) z*F (D>>>30);A[B ]=R&2L}Z D};H=30;B.1b.1e=H;B.1b.1s=(1=K; K)S[H ]=K;H=3n;19(K=10;36>K; K)S[H ]=K;H=3D;19(K=10;36>K; K)S[H ]=K;C.1b.2e=X(r){Z 0>r.s||0r.s&&0>15)*W.2f&W.2T)=r.1o;)r[A]-=r.1o,r[ A] }r.1q();r.2b(W.m.t,r);0r?-1:0;0r?W[0]=r 1o:W.t=0};B.1b.1S=X(r,z){Y A;1a(16==z)A=4;1h 1a(8==z)A=3;1h 1a(1B==z)A=8;1h 1a(2==z)A=1;1h 1a(32==z)A=5;1h 1a(4==z)A=2;1h{W.3I(r,z);Z}W.s=W.t=0;19(Y D=r.1c,C=!1,E=0;0J?"-"==r.1l(D)&&(C=!0):(C=!1,0==E?W[W.t ]=J:E A>W.1e?(W[W.t-1]|=(J&(1>W.1e-E):W[W.t-1]|=J=W.1e&&(E-=W.1e))}8==A&&0!=(r[0]&2I)&&(W.s=-1,0>B|E,E=(W[F]&D)=W.t)z.t=0;1h{Y B=r%W.1e,D=W.1e-B,C=(1>B;19(Y E=A 1;E>B;0>=W.1e;1a(r.t>=W.1e;B =W.s}1h{19(B =W.s;A>=W.1e;B-=r.s}z.s=0>B?-1:0;-1>B?z[A ]=W.1o B:0=z.1o&&(r[A z.t]-=z.1o,r[A z.t 1]=1)}0=E.t)){Y F=W.1w();1a(F.t>W.29:0),K=W.2K/H,H=(1J&&B.1x.1m(C,C)}}}};B.1b.2V=X(){1a(1>W.t)Z 0;Y r=W[0];1a(0==(r&1))Z 0;Y z=r&3,z=z*(2-(r&15)*z)&15,z=z*(2-(r&1f)*z)&1f,z=z*(2-((r&1G)*z&1G))&1G,z=z*(2-r*z%W.1o)%W.1o;Z 0r)Z B.1U;Y C=z(),E=z(),F=A.2e(W),G=D(r)-1;19(F.1I(C);0W.s)Z"-" W.1Z().1F(r);1a(16==r)r=4;1h 1a(8==r)r=3;1h 1a(2==r)r=1;1h 1a(32==r)r=5;1h 1a(4==r)r=2;1h Z W.3o(r);Y z=(1>E)&&(B=!0,C="2A".1l(A));0>(E =W.1e-r)):(A=W[D]>>(E-=r)&z,0>=E&&(E =W.1e,--D)),0W.s?W.1Z():W};B.1b.1H=X(r){Y z=W.s-r.s;1a(0!=z)Z z;Y A=W.t,z=A-r.t;1a(0!=z)Z z;19(;0=W.t?0:W.1e*(W.t-1) D(W[W.t-1]^W.s&W.1s)};B.1b.2J=X(r){Y A=z();W.1w().1Q(r,1d,A);0>W.s&&0r||z.2G()?1u C(z):1u E(z);Z W.2E(r,A)};B.1x=A(0);B.1U=A(1);Y T,L,G;1a(1d==L){L=[];19(G=0;G>>8,L[G ]=H&1f;G=0;F()}O.1b.2M=X(r){Y z;19(z=0;zz; z)W.S[z]=z;19(z=A=0;1B>z; z)A=A W.S[z] r[z%r.1c]&1f,B=W.S[z],W.S[z]=W.S[A],W.S[A]=B;W.j=W.i=0};N.1b.2x=X(){Y r;W.i=W.i 1&1f;W.j=W.j W.S[W.i]&1f;r=W.S[W.i];W.S[W.i]=W.S[W.j];W.S[W.j]=r;Z W.S[r W.S[W.i]&1f]};Y U=1B;Z{2r:X(z,A,B){A="41";B="3";Y C=1u r;C.2P(A,B);Z C.26(z)}}}(),s="",a=0,g=[],x=[],y=0,u=0,m=[],t=[],n=!0;X e(){Z 1p.35(1r*1p.2z())}X j(r,B,z){1a(!z||4>>0}X b(r,B,z){r[B 3]=z>>0&1f;r[B 2]=z>>8&1f;r[B 1]=z>>16&1f;r[B 0]=z>>24&1f}X w(r){1a(!r)Z"";19(Y B="",z=0;zz;z )x[z]=0;19(z=1;2>=z;)8>a&&(g[a ]=e()&1f,z ),8==a&&p();19(z=0;0a&&(g[a ]=r[z ],B--),8==a&&p();19(z=1;7>=z;)8>a&&(g[a ]=0,z ),8==a&&p();Z m}X q(r){Y B=0,z=1t(8),B=r.1c;t=r;1a(0!=B%8||16>B)Z 1d;x=l(r);a=x[0]&7;B=B-a-10;1a(0>B)Z 1d;19(Y A=0;A=A;)1a(8>a&&(a ,A ),8==a&&(z=r,!f()))Z 1d;19(A=0;0!=B;)1a(8>a&&(m[A]=(z[u a]^x[a])&1f,A ,B--,a ),8==a&&(z=r,u=y-8,!f()))Z 1d;19(A=1;8>A;A ){1a(8>a){1a(0!=(z[u a]^x[a]))Z 1d;a }1a(8==a&&(z=r,u=y,!f()))Z 1d}Z m}X p(){19(Y r=0;8>r;r )g[r]=n?g[r]^x[r]:g[r]^m[u r];19(Y B=k(g),r=0;8>r;r )m[y r]=B[r]^x[r],x[r]=g[r];u=y;y =8;a=0;n=!1}X k(r){Y B=16,z=j(r,0,4);r=j(r,4,4);19(Y A=j(s,0,4),D=j(s,4,4),C=j(s,8,4),E=j(s,12,4),F=0;0>>0,z =(r>>5) D,z=(z&1r)>>>0,r =(z>>5) E,r=(r&1r)>>>0;B=1t(8);b(B,0,z);b(B,4,r);Z B}X l(r){Y B=16,z=j(r,0,4);r=j(r,4,4);19(Y A=j(s,0,4),D=j(s,4,4),C=j(s,8,4),E=j(s,12,4),F=3y;0>>5) E,r=(r&1r)>>>0,z-=(r>>5) D,z=(z&1r)>>>0,F-=2o,F=(F&1r)>>>0;B=1t(8);b(B,0,z);b(B,4,r);Z B}X f(){19(Y r=0;8>r;r )x[r]^=t[y r];x=l(x);y =8;a=0;Z!0}X o(r,B){Y z=[];1a(B)19(Y A=0;A>18)),E.1y(z.1l(C>>12&1J)),E.1y(z.1l(C>>6&1J)),E.1y(z.1l(C&1J));3e(r.1c-F){2B 1:C=A(r,D)>18) z.1l(C>>12&1J) B B);3g;2B 2:C=A(r,D)>18) z.1l(C>>12&1J) z.1l(C>>6&1J) B)}Z E.2C("")}},2D=1,3j="",1n=8,2F=32;X 1W(r){Z 2H(r)}X 2H(r){Z 2l(1E(1K(r),r.1c*1n))}X 3q(r){Z 2d(1E(1K(r),r.1c*1n))}X 3s(r,B){Z 2l(1R(r,B))}X 3u(r,B){Z 3v(1R(r,B))}X 3w(r,B){Z 2d(1R(r,B))}X 1E(r,B){r[B>>5]|=2I>>9C;C )A[C]=z[C]^4T,D[C]=z[C]^4U;z=1E(A.2Y(1K(B)),4W B.1c*1n);Z 1E(D.2Y(z),4X)}X 1v(r,B){Y z=(r&1G) (B&1G);Z(r>>16) (B>>16) (z>>16)>>32-B}X 1K(r){19(Y B=[],z=(1>5]|=(r.1C(A/1n)&z)>5]>>>A2&z);Z B}X 2l(r){19(Y B=2D?"4Y":"4Z",z="",A=0;A>2]>>A%4*8 4&15) B.1l(r[A>>2]>>A%4*8&15);Z z}X 2Z(r){19(Y B=[],z=0;zD.1c;)D="0" D;1D.2g(r);B=1D.2p(D A 1D.28(B) z C);1D.2g("");Z B.57(/[\\/\\ =]/g,X(r){Z{"/":"-"," ":"*","=":"58"}[r]})}X 4Q(r,B,z){Z 33(r,B,z,!1)};',62,320,'||||||||||||||||||||||||||||||||||||||||||||||||||||||||||this|function|var|return||||||||||for|if|prototype|length|null|DB|255|md5_gg|else|md5_hh|md5_ff|md5_ii|charAt|subTo|chrsz|DV|Math|clamp|4294967295|DM|Array|new|safe_add|abs|ZERO|push|am|reduce|256|charCodeAt|TEA|core_md5|toString|65535|compareTo|copyTo|63|str2binl|dlShiftTo|md5_cmn|32767|RSA|floor|divRemTo|core_hmac_md5|fromString|parseInt|ONE|mulTo|md5|multiplyTo|sqrTo|negate||||||squareTo|encrypt|F1|strToBytes|F2|mp|drShiftTo|fromInt|binl2str|convert|mpl|initkey|String|fromCharCode|substr|lShiftTo|binl2hex|revert|rShiftTo|2654435769|enAsBase64|encode|rsa_encrypt|PADCHAR|ALPHA|getbyte|throw|arguments|next|init|random|0123456789abcdefghijklmnopqrstuvwxyz|case|join|hexcase|exp|mode|isEven|hex_md5|128|mod|FV|1073741823|nextBytes|bitLength|uv_alert|setPublic|modPowInt|doPublic|mt2|um|mph|invDigit|typeof|bit_rol|concat|hexchar2bin||temp||getEncryption|Exception|round||SyntaxError|Not|enough|Message|min|too|pow|switch|long|break|dmq1|fromNumber|b64pad|Date|Invalid|248|97|toRadix|public|str_md5|key|hex_hmac_md5|65536|b64_hmac_md5|binl2b64|str_hmac_md5|64|3816266640|1732584193|271733879|1732584194|271733878|65|680876936|389564586|getTime|606105819|fromRadix|1044525330|176418897|1200080426|1473231341|45705983|1770035416|1958414417|42063|1990404162|1804603682|string|40341101|1502002290|1236535329|decrypt|165796510|1069501632|643717713|F20CE00BAE5361F8FA3AE9CEFA495362FF7DA1BA628F64A347F0A8C012BF0B254A30CD92ABFFE7A6EE0DC424CB6166F8819EFA5BCCB20EDFB4AD02E412CCF579B1CA711D55B8B0B3AEB60153D5E0693A2A86F3167D7847A0CB8B00004716A9095D9BADC977CBB804DBDCBA6029A9710869A453F27DFDDF83C016D928B3CBF4C7|373897302|701558691|38016083|660478335|405537848|568446438||1019803690|187363961|1163531501|1444681467|51403784|1735328473|1926607734|bytesToStr|378558|2022574463|1839030562|dmp1|35309556|1530992060|1272893353|155497632|1094730640|681279174|358537222|722521979|76029189|640364487|421815835|530742520|995338651|bytesInStr|198630844|1126891415|1416354905|dataFromStr|57434055|1700485571|1894986606|1051523|2054922799|1873313359|30611744|1560198380|1309151649|145523070|1120210379|718787259|343485551|Hs|max|ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789|909522486|1549556828|coeff|512|640|0123456789ABCDEF|0123456789abcdef|number|eval||INVALID_CHARACTER_ERR|DOM|toUpperCase|000|replace|_|Number'.split('|'),0,{}))

&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone&ptredirect=0&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=5-12-

hXXp://ptlogin2.qq.com/login?u=

hXXp://xui.ptlogin2.qq.com/

ptmbsuperkey=

hXXp://qzs.qq.com/qzone/v5/loginsucc.html?para=izone&ptsig=

skey=

p_skey=

'0','','0','

skey=@

:hXXp://VVV.eyuyan.cc

hXXp://find.qq.com/index.html?version=1&im_version=5395&width=910&height=610&search_target=0

num=20&page=0&sessionid=0&keyword=&agerg=

&sessionid=1&keyword=&agerg=

zone.qq.com/cgi-bin/new/get_msgb?uin=

hXXp://m.

"nickname":"

hXXp://cgi.find.qq.com/

hXXp://find.qq.com/index.html?version=1&im_version=5365&width=910&height=610&search_target=0

hXXp://VVV.jsdati.com

hXXp://VVV.qqchaoren.net

hXXp://VVV.uuwise.com

=10410331

=VVV.2cqq.com

=hXXp://VVV.2cqq.com

hXXp://

\sqlite3.dll

3.6.18

SQLite format 3

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLYFcpD

sqlite3_aggregate_context

sqlite3_aggregate_count

sqlite3_auto_extension

sqlite3_backup_finish

sqlite3_backup_init

sqlite3_backup_pagecount

sqlite3_backup_remaining

sqlite3_backup_step

sqlite3_bind_double

sqlite3_bind_int

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_parameter_count

sqlite3_bind_parameter_index

sqlite3_bind_parameter_name

sqlite3_bind_text

sqlite3_bind_text16

sqlite3_bind_value

sqlite3_bind_zeroblob

sqlite3_blob_bytes

sqlite3_blob_close

sqlite3_blob_open

sqlite3_blob_read

sqlite3_blob_write

sqlite3_busy_handler

sqlite3_clear_bindings

sqlite3_collation_needed

sqlite3_collation_needed16

sqlite3_column_bytes16

sqlite3_column_database_name

sqlite3_column_database_name16

sqlite3_column_decltype16

sqlite3_column_name16

sqlite3_column_origin_name

sqlite3_column_origin_name16

sqlite3_column_table_name

sqlite3_column_table_name16

sqlite3_column_text16

sqlite3_column_type

sqlite3_column_value

sqlite3_commit_hook

sqlite3_complete

sqlite3_complete16

sqlite3_config

sqlite3_context_db_handle

sqlite3_create_collation

sqlite3_create_collation16

sqlite3_create_collation_v2

sqlite3_create_function

sqlite3_create_function16

sqlite3_create_module

sqlite3_create_module_v2

sqlite3_db_config

sqlite3_db_handle

sqlite3_db_mutex

sqlite3_db_status

sqlite3_declare_vtab

sqlite3_enable_load_extension

sqlite3_enable_shared_cache

sqlite3_errmsg16

sqlite3_expired

sqlite3_extended_errcode

sqlite3_extended_result_codes

sqlite3_file_control

sqlite3_get_autocommit

sqlite3_get_auxdata

sqlite3_global_recover

sqlite3_initialize

sqlite3_last_insert_rowid

sqlite3_libversion_number

sqlite3_limit

sqlite3_load_extension

sqlite3_malloc

sqlite3_memory_alarm

sqlite3_memory_highwater

sqlite3_memory_used

sqlite3_mprintf

sqlite3_mutex_alloc

sqlite3_mutex_enter

sqlite3_mutex_free

sqlite3_mutex_leave

sqlite3_mutex_try

sqlite3_next_stmt

sqlite3_open

sqlite3_open16

sqlite3_os_end

sqlite3_os_init

sqlite3_overload_function

sqlite3_prepare

sqlite3_prepare16

sqlite3_prepare16_v2

sqlite3_profile

sqlite3_progress_handler

sqlite3_randomness

sqlite3_realloc

sqlite3_release_memory

sqlite3_reset_auto_extension

sqlite3_result_blob

sqlite3_result_double

sqlite3_result_error

sqlite3_result_error16

sqlite3_result_error_code

sqlite3_result_error_nomem

sqlite3_result_error_toobig

sqlite3_result_int

sqlite3_result_int64

sqlite3_result_null

sqlite3_result_text

sqlite3_result_text16

sqlite3_result_text16be

sqlite3_result_text16le

sqlite3_result_value

sqlite3_result_zeroblob

sqlite3_rollback_hook

sqlite3_set_authorizer

sqlite3_set_auxdata

sqlite3_shutdown

sqlite3_sleep

sqlite3_snprintf

sqlite3_soft_heap_limit

sqlite3_sourceid

sqlite3_status

sqlite3_stmt_status

sqlite3_strnicmp

sqlite3_table_column_metadata

sqlite3_test_control

sqlite3_thread_cleanup

sqlite3_threadsafe

sqlite3_total_changes

sqlite3_trace

sqlite3_transfer_bindings

sqlite3_update_hook

sqlite3_user_data

sqlite3_value_blob

sqlite3_value_bytes

sqlite3_value_bytes16

sqlite3_value_double

sqlite3_value_int

sqlite3_value_int64

sqlite3_value_numeric_type

sqlite3_value_text

sqlite3_value_text16

sqlite3_value_text16be

sqlite3_value_text16le

sqlite3_value_type

sqlite3_version

sqlite3_vfs_find

sqlite3_vfs_register

sqlite3_vfs_unregister

sqlite3_vmprintf

sqlite3_win32_mbcs_to_utf8

%s\etilqs_

OsError 0x%x (%u)

unknown database %s

%s-mjX

922337203685477580

RowKey

keyinfo(%d

%s(%d)

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s

database table is locked: %s

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

invalid page number %d

2nd reference to page %d

Page %d:

unable to get the page. error code=%d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

cannot open indexed column for writing

cannot open value of type %s

sqlite_stat1

SELECT idx, stat FROM %Q.sqlite_stat1

too many attached databases - max %d

database %s is already in use

Invalid key value

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s: %s.%s

%s: %s

sqlite3_extension_init

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s

database schema is locked: %s

sqlite3_get_table() called with two or more incompatible queries

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

no such module: %s

vtable constructor failed: %s

vtable constructor did not declare schema: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

there is already another table or index with this name: %s

sqlite_

table %s may not be altered

view %s may not be altered

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

%s OR name=%Q

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE tbl=%Q

sqlite_detach

misuse of aggregate: %s()

invalid name: "%s"

not authorized to use function: %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

sqlite_attach

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

%s %T cannot reference objects in database %s

view %s is circularly defined

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

indexed columns are not unique

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

a JOIN clause is required before %s

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

foreign_key_list

*** in database %s ***

unsupported encoding: %s

rekey

hexkey

hexrekey

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

%s:%d

no such index: %s

sqlite_subquery_%p_

%s.%s

no such table: %s

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

at most %d tables in a join

cannot use index: %s

TABLE %s

%s AS %s

%s WITH INDEX %s

%s VIA MULTI-INDEX UNION

%s USING PRIMARY KEY

%s VIRTUAL TABLE INDEX %d:%s

%s ORDER BY

table %s: xBestIndex returned an invalid plan

sqlite_version

sqlite_source_id

d-d-d d:d:d

d:d:d

d-d-d

unable to close due to unfinished backup operation

SQL logic error or missing database

large file support is disabled

unable to use function %s in the requested context

no such vfs: %s

sqlite_rename_table

sqlite_rename_trigger

%.*s"%w"%s

automatic extension loading failed: %s

no such table column: %s.%s

c%d%s

unknown tokenizer: %s

%s%s%Q

%s,%Q HIDDEN

%s,docid HIDDEN)

docid INTEGER PRIMARY KEY,

create table %_segments( blockid INTEGER PRIMARY KEY, block blob);

create table %_segdir( level integer, idx integer, start_block integer, leaves_end_block integer, end_block integer, root blob, primary key(level, idx));

%d %d %d %d

Error in optimize: %s

porter

CREATE TABLE x(%s

%s, %s

CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))

PRAGMA %Q.page_size

%s {%s}

0&3*3.32363:3>3

1!2*232

C:\Windows\qqydw.ini

BFeUQy48sgDIgituHpLLjZpSFM99LRy5cgyfc2jZnBPXfs2bXCuDTPyRecN0KucEwKf1heFA4bVrg3yT45lkse/D0MebGxED/eMEmaLRA8jCQUC4a0vSDsfGFLgvYUnJhRssT6D8qhIBKCq3tm8nsux0QGJtS1vryWVq4x8uuKzXBfLxR5RnyAwimqrkz1IrVbmIueIPTNgKJUNuobkC/KDzpvVplDMOQLYlRDgXq1l/fPpgBzn8vM8TN698ao9rzXQh6zwhXnVKlqzm5vYf3ZsqTCx5RsuvlMWBPTpGbJ/DoKy6OVNdtPFVge1NrRTrE qD74RUBIw9KBQNBohq2pv69QekwgnzKQgP7uNePJysjqQc4o2cFA2KUJuMERdZNw9RSn8acmliXlb6wYGsg6zBlbGi86RUwq1OXi3AUan/iCU25icEkXwzFYR6aq07ddbdvfWztzH5SN76DgYF7s0I3PmEmzOYXKnl51lZTQoNGyrw8/GMAZqaS8HpyZMV9JacNBGVLdh1GBHcpJTdAWjHINn9F1Tkc0GFZaTTd4bBAzqqa8aIsUlVxhuKRWXwl8NTEQUtQCCJ1FpKv3p/2pTSxU28/SvEuk9zen0Jdqri3tOvI52dbF/8uhyHJPeVVPayPCtruRosJQ5zSiZbKALSshbqgClfDPBmXmLZMp5kDw2KXKiXratnmGZxPhpeAJxI4Makq210KZYcjhsH/7y2Zhw7BjqnmuTK9r53RppqCV4e0IdnraQz0xGlrpx6a2rcuUWm2KUbsS3t7o2GKZVdA3igPWDwU7m4ES6Tbm 6QqyxZ6zCuMlN7Z/kQN8pQrZxuHZOS7f3XQdG7c4aXWe0bZKaul2FvwJ8vN7r9vYS/I1pR5O6AjcyVqALs6IhNpqeAAGfB/8CM6zKz4mOafk2MHkcjXfNTo7g3uiOW3sgwS83oPWyUIEgbrA98NQ7rx19QqCduWyUD8uFMg/rmMJdcEivyNTtL 1MSE6c62XRuwnDsMIaJbMadQO28mnWQbkfDqYAqzLe/UMIclcevUsk ljHGsVNfgs/AJIul9Iup4SI9spHiXdTwiJEfYda9tidiYMJDCbSElQ01JIqoNyiQM6JhKbADW NLSJAwGIxF9JHRBTase IVZ8qtfhjfUGDDHp/64/1JnSKMgmmBG0GZQ93LqW3S0o2dtEjIIbrKeYN0nVAOD98TmsaaPXOIaLzsxI5eTQXoWmBvCoUod18iWA9cm8X6jtp744OxmkBCIzyGd/8/fVnuXtdDn5la9Heve8TbIx40H/doz26UEJkoi8Ee A0lyKMZzvf52tf0haJrjYLf6VFakw4d5/nNuqCiwkuBTxV43FM0jfTM2IyASsw1M6LT3RuE Dgdw6GJQav3PIcaX2FIP 3LMmyKs JssHRtEMYxbsWK ENrpWbtndIMjAqDCq65HlMS968j/w kdglMRCUnigeuKl208CkIBuGyFllo2KnZOmfyPjqrIeC9pzLSFQCaCBGtEzZ7d63qgkFPyNPtIgqNYwcHprANS3 ZWhQAzOWoVQhEwTGnd27OAu6VIzf DNK3bhZS2aQR/iMIUxzzaSniTaAN7fjOU/qMH2zNrPbFkUFbv9ieR6inLg/kQgj SZ/rnMOncErz3u1r/5O8LucOo6NW2b1orPbIBGSeBa0ctOUQpjRtoe6TLGGb9LXULJmIqM=

/qyd.db

\qyd1.edb

\qyd2.enx

/qyd1.edb

/qyd2.enx

/qyd.db-journal

hXXp://VVV.qqydw.com/gx1.txt

SSOAxCtrlForPTLogin.SSOForPTLogin2

hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin

document.body.innerHTML=GetuinKey();

function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g

&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone

&clientkey=

hXXp://ptlogin2.qq.com/jump?clientuin=

skey=

; skey=

\qyd.db

hXXp://ctc.qzs.qq.com/qzone/v5/owner2/ic/feeds.html

/mood/

&unikey=http://user.qzone.qq.com/

q.com/cgi-bin/emotion_cgi_getcmtreply_v6?need_private_comment=1&uin=

function timea(){var d,s;d=new Date();d.setTime('

QQ.txt

&sessionid=0&keyword=&agerg=

hXXp://cgi.find.qq.com/qqfind/lbs/get_neighbor

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.59 QQ/6.6.13172.201 Safari/537.36

hXXp://find.qq.com/index.html?version=1&im_version=5377&width=910&height=610&search_target=0

li=8gCXOMgLXqaPcunO3ta3IDtlmgmVGyrDUcwiZ4xG6rfCMC7G1uqttnxz+NCb21hzrbmnIXcHMFNxr6Dy/0IlyA==&sign=69FDFC9541B460DC62E17E0BB1E3CB6C6BCDAFB60B987E544BBE1E9DB2F4797B98B54CE208892DC07969BC79032594908DFECDCA98F9AB33&offset=1&cnt=20&sessionid=0

hXXp://xiaoqu.qq.com/cgi-bin/bar/post/get_post_by_page

nick_name

hXXp://xiaoqu.qq.com/cgi-bin/bar/post/get_comment_by_page

cookies.txt

WinHttp.WinHttpRequest.5.1

application/x-www-form-urlencoded

SetClientCertificate

VVV.baidu.com

798222986

Math.round(new Date().getTime()/1000)

Math.round(new Date().getTime())

Math.round(new Date().getTime() * 100)

7 9 10 5 8 4 2 1 6 3 7 9 10 5 8 4 2

WScript.Shell

rundll32.exe url.dll,FileProtocolHandler

function trim_output() {while (output.length && (output[output.length - 1] === " " || output[output.length - 1] === indent_string)) {output.pop();}}

function print_newline(ignore_repeated) {ignore_repeated = typeof ignore_repeated === "undefined" ? true : ignore_repeated;trim_output();if (!output.length) {return;}if (output[output.length - 1] !== "\n" || !ignore_repeated) {output.push("\n");}for (var i = 0; i

function print_space() {var last_output = output.length ? output[output.length - 1] : " ";if (last_output !== " " && last_output !== "\n" && last_output !== indent_string) {output.push(" ");}}

function print_token() {output.push(token_text);}

function remove_indent() {if (output.length && output[output.length - 1] === indent_string) {output.pop();}}

function set_mode(mode) {modes.push(current_mode);current_mode = mode;}

function restore_mode() {do_block_just_closed = current_mode === "DO_BLOCK";current_mode = modes.pop();}

function in_array(what, arr) {for (var i = 0; i

indent_character = indent_character || " ";indent_size = indent_size || 4;indent_string = "";while (indent_size--) {indent_string = indent_character;}input = js_source_text;last_word = "";last_type = "TK_START_EXPR";last_text = "";output = [];do_block_just_closed = false;var_line = false;var_line_tainted = false;whitespace = "\n\r\t ".split("");wordchar = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$".split("");punct = " - * / % & -- = = -= *= /= $= == === != !== > = > >> >>>= >>=

x =a.replace(/^\s /, '')

1970/01/01 00:00:00

%d/%d/%d %d:%d:%d

Adodb.Stream

MSScriptControl.ScriptControl

Scripting.Encoder

1, 2, 0, 1, 2, 0, 2, 0, 0, 2, 0, 2, 1, 0, 2, 0,

1, 0, 2, 0, 1, 1, 2, 0, 0, 2, 1, 0, 2, 0, 0, 2,

1, 1, 0, 2, 0, 2, 0, 1, 0, 1, 1, 2, 0, 1, 0, 2,

1, 0, 2, 0, 1, 1, 2, 0, 0, 1, 1, 2, 0, 1, 0, 2

digits["A".charCodeAt(0) i] = i

digits["a".charCodeAt(0) i] = i 26

for (var i=0; i

if (char.charCodeAt(0) > 126) return char

if (escapes.indexOf(char) != -1) return escaped.substr(escapes.indexOf(char), 1)

val = (digits[string.substr(0,1).charCodeAt(0)]

val = (digits[string.substr(1,1).charCodeAt(0)] >> 4)

val = (digits[string.substr(1,1).charCodeAt(0)] & 0xf)

val = ((digits[string.substr(2,1).charCodeAt(0)] >> 2)

val = ((digits[string.substr(2,1).charCodeAt(0)] & 0x3)

val = (digits[string.substr(3,1).charCodeAt(0)]

scriptIndex = encodingString.indexOf(marker, stringIndex)

unEncodingString = encodingString.substring(stringIndex, scriptIndex)

scriptIndex = marker.length

unEncodingString = encodingString.substr(stringIndex, encodingString.length)

encodingLength = encodingString.substr(scriptIndex, 6)

scriptIndex = (6 "==".length)

stringIndex = scriptIndex "DQgAAA==^#~@".length

char = encodingString.substr(scriptIndex, 1)

if (char.charCodeAt(0)

unEncodingString = String.fromCharCode(transformed[pick_encoding[unEncodingIndexd]][char.charCodeAt(0)])

unEncodingString = unescape(encodingString.substr( scriptIndex, 1))

re = new RegExp("(JScript|VBscript).encode", "gmi")

while(arr = re.exec(unEncodingString)) unEncodingString = RegExp.leftContext RegExp.$1 RegExp.rightContext

strdec(AdodbStream.ReadText);

function urlencodeutf8(str) {

function urlencode(str) {

function urldecode(str) {

urlencode

0.0.0.0

0000000000

Primary Key

select count(*) from sqlite_master where type='table' and tbl_name='

select name as title from sqlite_master where type='table'

select name as title from sqlite_master where type='table' and name not like('sqlite%')

select sql from sqlite_master where type='table' and name='

SELECT name FROM sqlite_master WHERE type='table' ORDER BY name

select sql from sqlite_master where type='index' and name='

select sql from sqlite_master where type='view' and name='

select sql from sqlite_master where type='trigger' and name='

\Microsoft\Network\Connections\pbk\rasphone.pbk

ChangePasswordRequested

PasswordExpired

TempObj=JSON.parse(str);

var obj=JSON.parse(str);

Lobj.push(obj);

return Lobj.length;

function GetAllKey(){

Lobj = JSON.parse(str);

var str=JSON.stringify(Lobj);

return Lobj.str;

if (typeof Date.prototype.toJSON !== 'function') {

Date.prototype.toJSON = function (key) {

return isFinite(this.valueOf())

? this.getUTCFullYear() '-'

f(this.getUTCMonth() 1) '-'

f(this.getUTCDate()) 'T'

f(this.getUTCHours()) ':'

f(this.getUTCMinutes()) ':'

f(this.getUTCSeconds()) 'Z'

String.prototype.toJSON =

Number.prototype.toJSON =

Boolean.prototype.toJSON = function (key) {

return this.valueOf();

'"' : '\\"',

'\\': '\\\\'

escapable.lastIndex = 0;

return escapable.test(string) ? '"' string.replace(escapable, function (a) {

: '\\u' ('0000' a.charCodeAt(0).toString(16)).slice(-4);

function str(key, holder) {

k, // The member key.

value = holder[key];

typeof value.toJSON === 'function') {

value = value.toJSON(key);

value = rep.call(holder, key, value);

if (Object.prototype.toString.apply(value) === '[object Array]') {

length = value.length;

v = partial.length === 0

? '[\n' gap partial.join(',\n' gap) '\n' mind ']'

: '[' partial.join(',') ']';

length = rep.length;

partial.push(quote(k) (gap ? ': ' : ':') v);

if (Object.prototype.hasOwnProperty.call(value, k)) {

v = partial.length === 0

? '{\n' gap partial.join(',\n' gap) '\n' mind '}'

: '{' partial.join(',') '}';

if (typeof JSON.stringify !== 'function') {

JSON.stringify = function (value, replacer, space) {

typeof replacer.length !== 'number')) {

throw new Error('JSON.stringify');

if (typeof JSON.parse !== 'function') {

JSON.parse = function (text, reviver) {

function walk(holder, key) {

var k, v, value = holder[key];

if (Object.prototype.hasOwnProperty.call(value, k)) {

return reviver.call(holder, key, value);

cx.lastIndex = 0;

if (cx.test(text)) {

text = text.replace(cx, function (a) {

('0000' a.charCodeAt(0).toString(16)).slice(-4);

.test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@')

.replace(/"[^"\\\n\r]*"|true|false|null|-?\d (?:\.\d*)?(?:[eE][ \-]?\d )?/g, ']')

.replace(/(?:^|:|,)(?:\s*\[) /g, ''))) {

throw new SyntaxError('JSON.parse');

JSON.stringify(Lobj['

Lobj.push("

Lobj.push(

Lobj.push('

Lobj.length

JSON.stringify(Lobj[

Lobj.splice(

JSON.stringify(Lobj

GetAllKey

function encrypt(str,pass){

data = m_xxtea.encrypt(str, pass);

function decrypt(str,pass){

data = m_xxtea.decrypt(str, pass);

if (str.match(/^[\x00-\x7f]*$/) != null) {

return str.toString();

len = str.length;

c = str.charCodeAt(i);

out[j] = str.charAt(i);

out[j] = String.fromCharCode(0xc0 | (c >>> 6),

out[j] = String.fromCharCode(0xe0 | (c >>> 12),

c2 = str.charCodeAt(i);

out[j] = String.fromCharCode(0xf0 | ((c >>> 18) & 0x3f),

return out.join('');

if ((str.match(/^[\x00-\x7f]*$/) != null) ||

(str.match(/^[\x00-\xff]*$/) == null)) {

c = str.charCodeAt(i );

out[j ] = str.charAt(i - 1);

c2 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((c & 0x1f)

c3 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((c & 0x0f)

c4 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((s >>> 10) & 0x03ff) | 0xd800,

var base64EncodeChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /'.split('');

len = str.length;

c = str.charCodeAt(i )

str.charCodeAt(i )

str.charCodeAt(i );

c = str.charCodeAt(i );

c = str.charCodeAt(i )

return out.join('');

-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,

-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,

if (/[^ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\ \/\=]/.test(str)) {

if (str.charAt(len - 2) == '=') {

else if (str.charAt(len - 1) == '=') {

c1 = base64DecodeChars[str.charCodeAt(i )];

c2 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode((c1 > 4));

c3 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode(((c2 & 0x0f) > 2));

c4 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode(((c3 & 0x03)

var length = data.length;

data[i] = String.fromCharCode(

return data.join('').substring(0, n);

return data.join('');

var length = string.length;

result[i >> 2] = string.charCodeAt(i) |

string.charCodeAt(i 1)

string.charCodeAt(i 2)

string.charCodeAt(i 3)

result[result.length] = length;

this.encrypt = function(string, key) {

var k = stringToLongArray(key, false);

if (k.length

k.length = 4;

var n = v.length - 1;

var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = 0;

this.decrypt = function(string, key) {

var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = q * delta & 0xffffffff;

* See hXXp://pajhome.org.uk/crypt/md5 for details.

function hex_sha1(s){return binb2hex(core_sha1(str2binb(s),s.length * chrsz));}

function b64_sha1(s){return binb2b64(core_sha1(str2binb(s),s.length * chrsz));}

function str_sha1(s){return binb2str(core_sha1(str2binb(s),s.length * chrsz));}

function hex_hmac_sha1(key, data){ return binb2hex(core_hmac_sha1(key, data));}

function b64_hmac_sha1(key, data){ return binb2b64(core_hmac_sha1(key, data));}

function str_hmac_sha1(key, data){ return binb2str(core_hmac_sha1(key, data));}

for(var i = 0; i

* Calculate the HMAC-SHA1 of a key and some data

function core_hmac_sha1(key, data)

var bkey = str2binb(key);

if(bkey.length > 16) bkey = core_sha1(bkey, key.length * chrsz);

ipad[i] = bkey[i] ^ 0x36363636;

opad[i] = bkey[i] ^ 0x5C5C5C5C;

var hash = core_sha1(ipad.concat(str2binb(data)), 512 data.length * chrsz);

return core_sha1(opad.concat(hash), 512 160);

* Add integers, wrapping at 2^32. This uses 16-bit operations internally

for(var i = 0; i

bin[i>>5] |= (str.charCodeAt(i / chrsz) & mask)

for(var i = 0; i

str = String.fromCharCode((bin[i>>5] >>> (32 - chrsz - i2)) & mask);

for(var i = 0; i

str = hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 4)) & 0xF)

hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 )) & 0xF);

for(var i = 0; i

if(i * 8 j * 6 > binarray.length * 32) str = b64pad;

else str = tab.charAt((triplet >> 6*(3-j)) & 0x3F);

__MSVCRT_HEAP_SELECT

qqcrypt.dll

/-UM2.SD60O:

6.LX:0GN?2CEE4>=L785T:1/Z=,*a?'%d@%#fB#!hB!

dA@(

(2015.06.10)

(2015.06.07)

(2015.06.06)

(2015.06.05)

(2015.05.31)

(2015.05.29)

(2015.05.27)

(2015.05.22)

(2015.05.18)

(2015.05.17)

(2015.05.16)

(2015.05.15)

(2015.05.14)

(2015.05.12)

(2015.05.11)

(2015.05.02)

(2015.04.28)

(2015.04.21)

(2015.04.15)

(2015.04.02)

(2015.04.01)

(2015.03.30)

(2015.03.27)

(2015.03.26)

(2015.03.25)

(2015.03.23)

(2015.03.18)

(2015.03.14)

(2015.03.13)

(2015.03.07)

(2015.03.06)

(2015.03.05)

(2015.03.01)

(2015.02.09)

(2015.01.31)

(2015.01.30)

(2015.01.29)

(2015.01.28)

(2015.01.22)

(2015.01.19)

(2015.01.18)

(2015.01.13)

(2015.01.12)

(2015.01.11)

(2015.01.10)

(2015.01.08)

(2014.12.24)

(2014.12.23)

(2014.12.21)

(2014.12.01)

(2014.11.30)

(2014.11.25)

(2014.11.22)

(2014.11.20)

(2014.11.14)

(2014.11.13)

(2014.11.12)

(2014.11.11)

tn|px.lD

.comment {color:green}

*.txt

|*.txt

%d&&'

123456789

00003333

1.2.18

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

MSWHEEL_ROLLMSG

Broken pipe

Inappropriate I/O control operation

Operation not permitted

.PAVCNotSupportedException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

icmp.dll

windows

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

libpng error: %s

libpng warning: %s

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

Y%d

X%d

Height%d

Width%d

RECT(%d, %d)-(%d, %d)

Styles0xX

Control ID%d

Handle0xX

burlywood

\winhlp32.exe

:%d) |

%I64d%s

:0{}%s

:%d)%s

(*.avi)|*.avi

WPFT532.CNV

WPFT632.CNV

EXCEL32.CNV

write32.wpc

Windows Write

mswrd632.wpc

Word for Windows 6.0

wword5.cnv

Word for Windows 5.0

mswrd832.cnv

mswrd632.cnv

Word 6.0/95 for Windows & Macintosh

html32.cnv

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

\u00%c%c

json_tokener_parse_ex: error %s at offset %d

json_tokener_comment: %s

HTTP HTTPS.

;3 #>6.&

'2, / 0&7!4-)1#

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

GetWindowsDirectoryA

WinExec

RegCreateKeyExA

RegOpenKeyExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

GetViewportOrgEx

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

GetKeyState

AVIFIL32.dll

comdlg32.dll

RASAPI32.dll

WINMM.dll

WINSPOOL.DRV

1, 0, 6, 6

- Skin.dll

2014, 2, 7, 1

FastVerCode.DLL

CCaptchaRecognizer::recognizeByCodeTypeAndUrl

hXXp://s1.uudati.com:

hXXp://s1.taskok.com:

hXXp://s1.uudama.com:

hXXp://s1.uuwise.com:

/Api/config.aspx

2.0.0.5

WiseClientAPI-2.0.0.5

CCaptchaRecognizer::__UpdateTKEY

CCaptchaRecognizer::_IsNeedLogin

/Api/DecodeImg.aspx

xxxxxxxxxxx

hXXp://p1.uuwise.net:

hXXp://p1.uudama.net:

hXXp://p1.taskok.com:

hXXp://p1.uuwise.com:

hXXp://p1.uudama.com:

CCaptchaRecognizer::easyRecognizeUrl

%d%d%d%d%d

CCaptchaRecognizer::_CalcRandomPort

/Api/VerifyAPIFile.aspx

/Api/UserLogin.aspx

CCaptchaRecognizer::login

/Api/UserReg.aspx

/Api/PayCard.aspx

/Api/ReportError.aspx

CCaptchaRecognizer::reportError

/Api/UserPoint.aspx

|2.0.0.5|

/Api/DecodeResult.aspx

ID/KEY/

ByTypeBytes.JPG

%d-%d-%d

CHttpRequestHelper::_ReadResponse

User-Agent:WiseClient-2.0.0.5;

WiseClient-2.0.0.5

CHttpRequestHelper::_InternalRequest

CHttpRequestHelper::RequestGetImage

CHttpRequestHelper::RequestPost

ServerPort

UUExtConfig.ini

-:-:-.%d

tCRYPTDLL.DLL

3.cn.pool.ntp.org

2.cn.pool.ntp.org

1.cn.pool.ntp.org

0.cn.pool.ntp.org

cn.pool.ntp.org

\\.\PHYSICALDRIVE0

Microsoft Windows Millennium Edition

Microsoft Windows 98

Microsoft Windows 95

%s (Build %d)

Service Pack 6a (Build %d)

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

Web Edition

Service Pack %d (Build %d)

Microsoft Windows NT

Microsoft Windows 2000

Microsoft Windows XP

Microsoft Windows Server 2003,

Microsoft Windows XP Professional x64 Edition

Microsoft Windows Server 2003 "R2"

Windows Server 2008

Windows Vista

Windows Server 2008 R2

Windows 7

ox-x-x-x-x-x

\Tencent\Users\*.*

nKERNEL32.DLL

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

!"#$%&'()* ,-.

uuwise.com

2, 0, 0, 5

1.0.0.1

!"#$%&'()* ,-

25, 0, 0, 1

Windows

9.5.25.212

(*.*)

%original file name%.exe_464_rwx_00401000_00551000:

3h%S~

t%SVh

t$(SSh

~%UVW

u$SShe

ole32.dll

FastVerCode.dll

UUWiseHelper.dll

dc.dll

atl.dll

gdiplus.dll

shlwapi.dll

kernel32.dll

user32.dll

Psapi.dll

GdiPlus.dll

sqlite3.dll

Kernel32.dll

ADVAPI32.DLL

secur32.dll

advapi32.dll

shell32.dll

Rasapi32.dll

ntdll.dll

GetProcessHeap

CreateIoCompletionPort

uu_loginA

ShellExecuteA

ReportError

uu_reportError

EnumChildWindows

GdiplusShutdown

sqlite3_errcode

sqlite3_open_v2

sqlite3_close

sqlite3_rekey

sqlite3_key

sqlite3_free

sqlite3_errmsg

sqlite3_libversion

sqlite3_busy_timeout

sqlite3_exec

sqlite3_prepare_v2

sqlite3_step

sqlite3_column_int

sqlite3_finalize

sqlite3_get_table

sqlite3_free_table

sqlite3_interrupt

sqlite3_changes

sqlite3_bind_blob

sqlite3_data_count

sqlite3_reset

sqlite3_column_count

sqlite3_column_name

sqlite3_column_decltype

sqlite3_column_text

sqlite3_column_blob

sqlite3_column_int64

sqlite3_column_double

sqlite3_sql

sqlite3_column_bytes

GetProcessHeaps

{B6F7542F-B8FE-46a8-9605-98856A687097}

{E5000198-4471-40e2-92BC-D0BA075BDBB2}

{A068799B-7551-46b9-8CA8-EEF8357AFEA4}

KEY: {

{3F4DACA4-160D-11D2-A8E9-00104B365C9F}

hXXp://xiaoqu.qq.com/cgi-bin/bar/category_list

hXXp://xiaoqu.qq.com/mobile/index.html?_lv=28743&_wv=1027&_bid=128

Mozilla/5.0 (Linux; Android 4.4.2; GT-N7100 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 V1_AND_SQ_5.4.0_218_YYB_D QQ/5.4.1.2395 NetType/WIFI

zone.qq.com/cgi-bin/friendshow/cgi_get_visitor_single?uin=

hXXp://g.

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36

hXXp://user.qzone.qq.com/

&url=

&unikey=

zone.qq.com/cgi-bin/likes/get_like_list_app?uin=

hXXp://users.

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36

"nick":"

@1970-01-01 08:00:00

.@&count=15&sidomain=ctc.qzonestyle.gtimg.cn&useutf8=1&outputhtmlfeed=1&refer=2&r=0.4309617872349918&g_tk=

zone.qq.com/cgi-bin/feeds/feeds_html_act_all?uin=

hXXp://ic2.

hXXp://ctc.qzs.qq.com/qzone/profile/index.html?tab=info

data-unikey=\x22

data-key=\x22

@qq.com

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

\LZConfig.ini

\FastVerCode.dll

.text

`.rdata

@.data

@.reloc

NETAPI32.dll

MFC42.DLL

KERNEL32.dll

SHLWAPI.dll

WININET.dll

.PAVCObject@@

.PAVCException@@

.PAVCFileException@@

.PAVCInternetException@@

Content-Disposition: form-data; name="key"

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MALN)

POST /api.php?mod=yzm&act=state HTTP/1.1

/api.php?mod=yzm&act=state

LZConfig.ini

User-Agent: Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0)

HTTP/1.1

/api.php?mod=yzm&act=add

POST /api.php?mod=yzmm&act=result_new HTTP/1.1

/api.php?mod=yzmm&act=result_new

POST /api.php?mod=yzm&act=point HTTP/1.1

/api.php?mod=yzm&act=point

POST /api.php?mod=yzm&act=register HTTP/1.1

/api.php?mod=yzm&act=register

eee.hyslt.com

POST /api.php?mod=dmuser&act=yzm_error HTTP/1.1

/api.php?mod=dmuser&act=yzm_error

.hyslt.com

XXXXXX

hXXp://ip.qq.com/

POST /api.php?mod=yzm&act=server HTTP/1.1

/api.php?mod=yzm&act=server

\UUExtConfig.ini

CodeType=0\UUWiseHelper.dll

SSSSh

ByScreen.JPG

operator

GetProcessWindowStation

E:\work\UUWiseHelper

\UUWiseHelper.pdb

RegCloseKey

RegOpenKeyExW

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

urlmon.dll

dbghelp.dll

IPHLPAPI.DLL

WS2_32.dll

GetCPInfo

UUWiseHelper.DLL

uu_easyRecognizeUrlA

uu_easyRecognizeUrlW

uu_loginW

uu_recognizeByCodeTypeAndUrlA

uu_recognizeByCodeTypeAndUrlW

zcÃ

"0,01070

8Â8J8R8x8

0#0'0-01070;0

=*>0>4>8>

5%6S6

3$3,383\3|3

:-1014,URL

:-19011,

TEAKEY

\dc.dll

WSOCK32.dll

MSVCP60.dll

ReportError_A

VBYB_ReportError

VB_ReportError

debug.ini

ReportError:%s

Error:%s

%s|!|%s

\dms.pdb

%u%u,

dclog.txt

config.ini

port

settimeout:%d

[%d]%s

reg2:%s

checkok:%s %s

check fail:%s %s %s

check:%s %s

getcjfail:%s %s

getcj:%s %s

%s%uout

%s%uin

put img ok:%s

put img fail:%s

put img:%s %s %d

get result ok:%s,%s

get result fail:%s

get result:%s

notifyfail ok:%s

%s\%d-%s.png

notifyfail fail:%s,%s

notifyfail:%s

getimgok:%s,%s

getimg:%s

getinfo fail:%s

getinfo:%s,%s

setresult:%s,%s

HTTP/1.1 200 OK

recv:%d

send:%d

GET /ip.txt HTTP/1.1

Host: %s

User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2

select:%d

ioctlsocket:%d

socket:%d

api.qqchaoren.net

14.17.65.24

14.17.65.23

dama2.qqchaoren.net

dama1.qqchaoren.net

connect total:%s %d

:%s %d

connect discard:%s %d

[d-d-d d:d:d](u)

recv timeout:

recvfail:%d

server close:%d

recv:%d

send:%d

sendfail:%d

connect timeout:

connectok:%s %hu

127.0.0.1

1.1.3

qq.com/

zone.qq.com/cgi-bin/friendshow/cgi_get_visitor_simple?uin=

hXXp://b1.qzone.qq.com/cgi-bin/blognew/blog_output_data?uin=

zone.qq.com/cgi-bin/blognew/blog_get_interaction?uin=

hXXp://b.

"opnick":"

zone.qq.com/cgi-bin/blognew/get_comment_list?uin=

hXXp://b11.

zone.qq.com/cgi-bin/blognew/blog_output_data?uin=

hXXp://b1.

hXXp://ctc.qzs.qq.com/qzone/newblog/blogcanvas.html

.idata

.edata

P.vmp0

`.vmp1

.reloc

P.rsrc

version.dll

1e.ro4A

oleaut32.dll

H0.gW

comctl32.dll

gdi32.dll

d.jF/"

r#'%C

6.Xdp

g|$^.Cn

>.bM8

>Z.Ye

w4R`$p%s*

f.zo~L^

wsock32.dll

Ã‹.L@

l.sQ{

c-t{.FF

b#I".wM

e.ENZ

xip.tu

@>.vO

%FX2Fsi

qKT.jLka

3.LD7

G,.gd

<.cff>

&8.XMj

$~O.Ba

)].Wd

/_{M%U

Q%s6|

lVfeVg

!%uO

mh.ud

m%Csn%

kq84.QaI

)f%fg

.SuDYw

K)`p.frC

*%s!%

aR.dDb&

.xk 4g

)%S{.

'U}.Ue

l%S(8x$!(

1L%UJ

.vtbw

.iA5N

yyhKa%S

d.Zd=#R

x0r%F{

.IPi)

Vj.jH

>M%X9

/8[

bc.lTk

ks_GetMsg

kssPlugin.dll

tole32.dll

hXXp://xiaoqu.qq.com/cgi-bin/bar/get_gbar_by_collction

hXXp://xiaoqu.qq.com/cgi-bin/bar/get_bar_list_by_category

&num=15&cgi_host=http://taotao.qq.com/cgi-bin/emotion_cgi_msglist_v6&code_version=1&format=jsonp&need_private_comment=1&g_tk=

q.com/cgi-bin/emotion_cgi_msglist_v6?uin=

hXXp://taotao.

{"certified":

hXXp://b11.qzone.qq.com/cgi-bin/blognew/get_abs?hostUin=

hXXp://cgi.find.qq.com/q

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.59 QQ/6.4.12593.201 Safari/537.36

hXXp://find.qq.com/index.html?version=1&im_version=5407&width=910&height=610&search_target=0

&sessionid=0&keyword=

&sessionid=1&keyword=

\IP.qyd

hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=1&rsv_idx=1&tn=baidu&wd=ipÃ¦Å¸Â¥Ã¨Â¯Â¢

hXXp://VVV.ip138.com/ips138.asp

hXXp://r.qzone.qq.com/cgi-bin/user/qzone_cgi_msg_getcnt2?uin=

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36

login_sig=

,login_sig:"

VVV.qqydw.com

&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone&r=0.

&js_type=1&login_sig=

hXXp://check.ptlogin2.qq.com/check?regmaster=

&0.7227352769114077

hXXp://captcha.qq.com/cap_union_show?clientype=2&uin=

hXXp://captcha.qq.com/getimgbysig?aid=

&0.18814749689772725

hXXp://captcha.qq.com/cap_union_verify?aid=

Hs("{pass}","{uin}","{code}")

{pass}

&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone&ptredirect=0&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=5-12-

hXXp://ptlogin2.qq.com/login?u=

hXXp://xui.ptlogin2.qq.com/

ptmbsuperkey=

hXXp://qzs.qq.com/qzone/v5/loginsucc.html?para=izone&ptsig=

skey=

p_skey=

'0','','0','

skey=@

:hXXp://VVV.eyuyan.cc

hXXp://find.qq.com/index.html?version=1&im_version=5395&width=910&height=610&search_target=0

num=20&page=0&sessionid=0&keyword=&agerg=

&sessionid=1&keyword=&agerg=

zone.qq.com/cgi-bin/new/get_msgb?uin=

hXXp://m.

"nickname":"

hXXp://cgi.find.qq.com/

hXXp://find.qq.com/index.html?version=1&im_version=5365&width=910&height=610&search_target=0

hXXp://VVV.jsdati.com

hXXp://VVV.qqchaoren.net

hXXp://VVV.uuwise.com

=10410331

=VVV.2cqq.com

=hXXp://VVV.2cqq.com

hXXp://

\sqlite3.dll

3.6.18

SQLite format 3

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

sqlite3_aggregate_context

sqlite3_aggregate_count

sqlite3_auto_extension

sqlite3_backup_finish

sqlite3_backup_init

sqlite3_backup_pagecount

sqlite3_backup_remaining

sqlite3_backup_step

sqlite3_bind_double

sqlite3_bind_int

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_parameter_count

sqlite3_bind_parameter_index

sqlite3_bind_parameter_name

sqlite3_bind_text

sqlite3_bind_text16

sqlite3_bind_value

sqlite3_bind_zeroblob

sqlite3_blob_bytes

sqlite3_blob_close

sqlite3_blob_open

sqlite3_blob_read

sqlite3_blob_write

sqlite3_busy_handler

sqlite3_clear_bindings

sqlite3_collation_needed

sqlite3_collation_needed16

sqlite3_column_bytes16

sqlite3_column_database_name

sqlite3_column_database_name16

sqlite3_column_decltype16

sqlite3_column_name16

sqlite3_column_origin_name

sqlite3_column_origin_name16

sqlite3_column_table_name

sqlite3_column_table_name16

sqlite3_column_text16

sqlite3_column_type

sqlite3_column_value

sqlite3_commit_hook

sqlite3_complete

sqlite3_complete16

sqlite3_config

sqlite3_context_db_handle

sqlite3_create_collation

sqlite3_create_collation16

sqlite3_create_collation_v2

sqlite3_create_function

sqlite3_create_function16

sqlite3_create_module

sqlite3_create_module_v2

sqlite3_db_config

sqlite3_db_handle

sqlite3_db_mutex

sqlite3_db_status

sqlite3_declare_vtab

sqlite3_enable_load_extension

sqlite3_enable_shared_cache

sqlite3_errmsg16

sqlite3_expired

sqlite3_extended_errcode

sqlite3_extended_result_codes

sqlite3_file_control

sqlite3_get_autocommit

sqlite3_get_auxdata

sqlite3_global_recover

sqlite3_initialize

sqlite3_last_insert_rowid

sqlite3_libversion_number

sqlite3_limit

sqlite3_load_extension

sqlite3_malloc

sqlite3_memory_alarm

sqlite3_memory_highwater

sqlite3_memory_used

sqlite3_mprintf

sqlite3_mutex_alloc

sqlite3_mutex_enter

sqlite3_mutex_free

sqlite3_mutex_leave

sqlite3_mutex_try

sqlite3_next_stmt

sqlite3_open

sqlite3_open16

sqlite3_os_end

sqlite3_os_init

sqlite3_overload_function

sqlite3_prepare

sqlite3_prepare16

sqlite3_prepare16_v2

sqlite3_profile

sqlite3_progress_handler

sqlite3_randomness

sqlite3_realloc

sqlite3_release_memory

sqlite3_reset_auto_extension

sqlite3_result_blob

sqlite3_result_double

sqlite3_result_error

sqlite3_result_error16

sqlite3_result_error_code

sqlite3_result_error_nomem

sqlite3_result_error_toobig

sqlite3_result_int

sqlite3_result_int64

sqlite3_result_null

sqlite3_result_text

sqlite3_result_text16

sqlite3_result_text16be

sqlite3_result_text16le

sqlite3_result_value

sqlite3_result_zeroblob

sqlite3_rollback_hook

sqlite3_set_authorizer

sqlite3_set_auxdata

sqlite3_shutdown

sqlite3_sleep

sqlite3_snprintf

sqlite3_soft_heap_limit

sqlite3_sourceid

sqlite3_status

sqlite3_stmt_status

sqlite3_strnicmp

sqlite3_table_column_metadata

sqlite3_test_control

sqlite3_thread_cleanup

sqlite3_threadsafe

sqlite3_total_changes

sqlite3_trace

sqlite3_transfer_bindings

sqlite3_update_hook

sqlite3_user_data

sqlite3_value_blob

sqlite3_value_bytes

sqlite3_value_bytes16

sqlite3_value_double

sqlite3_value_int

sqlite3_value_int64

sqlite3_value_numeric_type

sqlite3_value_text

sqlite3_value_text16

sqlite3_value_text16be

sqlite3_value_text16le

sqlite3_value_type

sqlite3_version

sqlite3_vfs_find

sqlite3_vfs_register

sqlite3_vfs_unregister

sqlite3_vmprintf

sqlite3_win32_mbcs_to_utf8

%s\etilqs_

OsError 0x%x (%u)

unknown database %s

%s-mjX

922337203685477580

RowKey

keyinfo(%d

%s(%d)

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s

database table is locked: %s

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

invalid page number %d

2nd reference to page %d

Page %d:

unable to get the page. error code=%d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

cannot open indexed column for writing

cannot open value of type %s

sqlite_stat1

SELECT idx, stat FROM %Q.sqlite_stat1

too many attached databases - max %d

database %s is already in use

Invalid key value

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s: %s.%s

%s: %s

sqlite3_extension_init

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s

database schema is locked: %s

sqlite3_get_table() called with two or more incompatible queries

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

no such module: %s

vtable constructor failed: %s

vtable constructor did not declare schema: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

there is already another table or index with this name: %s

sqlite_

table %s may not be altered

view %s may not be altered

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

%s OR name=%Q

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE tbl=%Q

sqlite_detach

misuse of aggregate: %s()

invalid name: "%s"

not authorized to use function: %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

sqlite_attach

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

%s %T cannot reference objects in database %s

view %s is circularly defined

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

indexed columns are not unique

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

a JOIN clause is required before %s

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

foreign_key_list

*** in database %s ***

unsupported encoding: %s

rekey

hexkey

hexrekey

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

%s:%d

no such index: %s

sqlite_subquery_%p_

%s.%s

no such table: %s

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

at most %d tables in a join

cannot use index: %s

TABLE %s

%s AS %s

%s WITH INDEX %s

%s VIA MULTI-INDEX UNION

%s USING PRIMARY KEY

%s VIRTUAL TABLE INDEX %d:%s

%s ORDER BY

table %s: xBestIndex returned an invalid plan

sqlite_version

sqlite_source_id

d-d-d d:d:d

d:d:d

d-d-d

unable to close due to unfinished backup operation

SQL logic error or missing database

large file support is disabled

unable to use function %s in the requested context

no such vfs: %s

sqlite_rename_table

sqlite_rename_trigger

%.*s"%w"%s

automatic extension loading failed: %s

no such table column: %s.%s

c%d%s

unknown tokenizer: %s

%s%s%Q

%s,%Q HIDDEN

%s,docid HIDDEN)

docid INTEGER PRIMARY KEY,

create table %_segments( blockid INTEGER PRIMARY KEY, block blob);

create table %_segdir( level integer, idx integer, start_block integer, leaves_end_block integer, end_block integer, root blob, primary key(level, idx));

%d %d %d %d

Error in optimize: %s

porter

CREATE TABLE x(%s

%s, %s

PRAGMA %Q.page_size

%s {%s}

0&3*3.32363:3>3

1!2*232

C:\Windows\qqydw.ini

/qyd.db

\qyd1.edb

\qyd2.enx

/qyd1.edb

/qyd2.enx

/qyd.db-journal

hXXp://VVV.qqydw.com/gx1.txt

SSOAxCtrlForPTLogin.SSOForPTLogin2

hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin

document.body.innerHTML=GetuinKey();

&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone

&clientkey=

hXXp://ptlogin2.qq.com/jump?clientuin=

skey=

; skey=

\qyd.db

hXXp://ctc.qzs.qq.com/qzone/v5/owner2/ic/feeds.html

/mood/

&unikey=http://user.qzone.qq.com/

q.com/cgi-bin/emotion_cgi_getcmtreply_v6?need_private_comment=1&uin=

function timea(){var d,s;d=new Date();d.setTime('

QQ.txt

&sessionid=0&keyword=&agerg=

hXXp://cgi.find.qq.com/qqfind/lbs/get_neighbor

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.59 QQ/6.6.13172.201 Safari/537.36

hXXp://find.qq.com/index.html?version=1&im_version=5377&width=910&height=610&search_target=0

hXXp://xiaoqu.qq.com/cgi-bin/bar/post/get_post_by_page

nick_name

hXXp://xiaoqu.qq.com/cgi-bin/bar/post/get_comment_by_page

cookies.txt

WinHttp.WinHttpRequest.5.1

application/x-www-form-urlencoded

SetClientCertificate

VVV.baidu.com

798222986

Math.round(new Date().getTime()/1000)

Math.round(new Date().getTime())

Math.round(new Date().getTime() * 100)

7 9 10 5 8 4 2 1 6 3 7 9 10 5 8 4 2

WScript.Shell

rundll32.exe url.dll,FileProtocolHandler

function trim_output() {while (output.length && (output[output.length - 1] === " " || output[output.length - 1] === indent_string)) {output.pop();}}

function print_space() {var last_output = output.length ? output[output.length - 1] : " ";if (last_output !== " " && last_output !== "\n" && last_output !== indent_string) {output.push(" ");}}

function print_token() {output.push(token_text);}

function remove_indent() {if (output.length && output[output.length - 1] === indent_string) {output.pop();}}

function set_mode(mode) {modes.push(current_mode);current_mode = mode;}

function restore_mode() {do_block_just_closed = current_mode === "DO_BLOCK";current_mode = modes.pop();}

function in_array(what, arr) {for (var i = 0; i

x =a.replace(/^\s /, '')

1970/01/01 00:00:00

%d/%d/%d %d:%d:%d

Adodb.Stream

MSScriptControl.ScriptControl

Scripting.Encoder

1, 2, 0, 1, 2, 0, 2, 0, 0, 2, 0, 2, 1, 0, 2, 0,

1, 0, 2, 0, 1, 1, 2, 0, 0, 2, 1, 0, 2, 0, 0, 2,

1, 1, 0, 2, 0, 2, 0, 1, 0, 1, 1, 2, 0, 1, 0, 2,

1, 0, 2, 0, 1, 1, 2, 0, 0, 1, 1, 2, 0, 1, 0, 2

digits["A".charCodeAt(0) i] = i

digits["a".charCodeAt(0) i] = i 26

for (var i=0; i

if (char.charCodeAt(0) > 126) return char

if (escapes.indexOf(char) != -1) return escaped.substr(escapes.indexOf(char), 1)

val = (digits[string.substr(0,1).charCodeAt(0)]

val = (digits[string.substr(1,1).charCodeAt(0)] >> 4)

val = (digits[string.substr(1,1).charCodeAt(0)] & 0xf)

val = ((digits[string.substr(2,1).charCodeAt(0)] >> 2)

val = ((digits[string.substr(2,1).charCodeAt(0)] & 0x3)

val = (digits[string.substr(3,1).charCodeAt(0)]

scriptIndex = encodingString.indexOf(marker, stringIndex)

unEncodingString = encodingString.substring(stringIndex, scriptIndex)

scriptIndex = marker.length

unEncodingString = encodingString.substr(stringIndex, encodingString.length)

encodingLength = encodingString.substr(scriptIndex, 6)

scriptIndex = (6 "==".length)

stringIndex = scriptIndex "DQgAAA==^#~@".length

char = encodingString.substr(scriptIndex, 1)

if (char.charCodeAt(0)

unEncodingString = String.fromCharCode(transformed[pick_encoding[unEncodingIndexd]][char.charCodeAt(0)])

unEncodingString = unescape(encodingString.substr( scriptIndex, 1))

re = new RegExp("(JScript|VBscript).encode", "gmi")

while(arr = re.exec(unEncodingString)) unEncodingString = RegExp.leftContext RegExp.$1 RegExp.rightContext

strdec(AdodbStream.ReadText);

function urlencodeutf8(str) {

function urlencode(str) {

function urldecode(str) {

urlencode

0.0.0.0

0000000000

Primary Key

select count(*) from sqlite_master where type='table' and tbl_name='

select name as title from sqlite_master where type='table'

select name as title from sqlite_master where type='table' and name not like('sqlite%')

select sql from sqlite_master where type='table' and name='

SELECT name FROM sqlite_master WHERE type='table' ORDER BY name

select sql from sqlite_master where type='index' and name='

select sql from sqlite_master where type='view' and name='

select sql from sqlite_master where type='trigger' and name='

\Microsoft\Network\Connections\pbk\rasphone.pbk

ChangePasswordRequested

PasswordExpired

TempObj=JSON.parse(str);

var obj=JSON.parse(str);

Lobj.push(obj);

return Lobj.length;

function GetAllKey(){

Lobj = JSON.parse(str);

var str=JSON.stringify(Lobj);

return Lobj.str;

if (typeof Date.prototype.toJSON !== 'function') {

Date.prototype.toJSON = function (key) {

return isFinite(this.valueOf())

? this.getUTCFullYear() '-'

f(this.getUTCMonth() 1) '-'

f(this.getUTCDate()) 'T'

f(this.getUTCHours()) ':'

f(this.getUTCMinutes()) ':'

f(this.getUTCSeconds()) 'Z'

String.prototype.toJSON =

Number.prototype.toJSON =

Boolean.prototype.toJSON = function (key) {

return this.valueOf();

'"' : '\\"',

'\\': '\\\\'

escapable.lastIndex = 0;

return escapable.test(string) ? '"' string.replace(escapable, function (a) {

: '\\u' ('0000' a.charCodeAt(0).toString(16)).slice(-4);

function str(key, holder) {

k, // The member key.

value = holder[key];

typeof value.toJSON === 'function') {

value = value.toJSON(key);

value = rep.call(holder, key, value);

if (Object.prototype.toString.apply(value) === '[object Array]') {

length = value.length;

v = partial.length === 0

? '[\n' gap partial.join(',\n' gap) '\n' mind ']'

: '[' partial.join(',') ']';

length = rep.length;

partial.push(quote(k) (gap ? ': ' : ':') v);

if (Object.prototype.hasOwnProperty.call(value, k)) {

v = partial.length === 0

? '{\n' gap partial.join(',\n' gap) '\n' mind '}'

: '{' partial.join(',') '}';

if (typeof JSON.stringify !== 'function') {

JSON.stringify = function (value, replacer, space) {

typeof replacer.length !== 'number')) {

throw new Error('JSON.stringify');

if (typeof JSON.parse !== 'function') {

JSON.parse = function (text, reviver) {

function walk(holder, key) {

var k, v, value = holder[key];

if (Object.prototype.hasOwnProperty.call(value, k)) {

return reviver.call(holder, key, value);

cx.lastIndex = 0;

if (cx.test(text)) {

text = text.replace(cx, function (a) {

('0000' a.charCodeAt(0).toString(16)).slice(-4);

.test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@')

.replace(/"[^"\\\n\r]*"|true|false|null|-?\d (?:\.\d*)?(?:[eE][ \-]?\d )?/g, ']')

.replace(/(?:^|:|,)(?:\s*\[) /g, ''))) {

throw new SyntaxError('JSON.parse');

JSON.stringify(Lobj['

Lobj.push("

Lobj.push(

Lobj.push('

Lobj.length

JSON.stringify(Lobj[

Lobj.splice(

JSON.stringify(Lobj

GetAllKey

function encrypt(str,pass){

data = m_xxtea.encrypt(str, pass);

function decrypt(str,pass){

data = m_xxtea.decrypt(str, pass);

if (str.match(/^[\x00-\x7f]*$/) != null) {

return str.toString();

len = str.length;

c = str.charCodeAt(i);

out[j] = str.charAt(i);

out[j] = String.fromCharCode(0xc0 | (c >>> 6),

out[j] = String.fromCharCode(0xe0 | (c >>> 12),

c2 = str.charCodeAt(i);

out[j] = String.fromCharCode(0xf0 | ((c >>> 18) & 0x3f),

return out.join('');

if ((str.match(/^[\x00-\x7f]*$/) != null) ||

(str.match(/^[\x00-\xff]*$/) == null)) {

c = str.charCodeAt(i );

out[j ] = str.charAt(i - 1);

c2 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((c & 0x1f)

c3 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((c & 0x0f)

c4 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((s >>> 10) & 0x03ff) | 0xd800,

var base64EncodeChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /'.split('');

len = str.length;

c = str.charCodeAt(i )

str.charCodeAt(i )

str.charCodeAt(i );

c = str.charCodeAt(i );

c = str.charCodeAt(i )

return out.join('');

-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,

-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,

if (/[^ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\ \/\=]/.test(str)) {

if (str.charAt(len - 2) == '=') {

else if (str.charAt(len - 1) == '=') {

c1 = base64DecodeChars[str.charCodeAt(i )];

c2 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode((c1 > 4));

c3 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode(((c2 & 0x0f) > 2));

c4 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode(((c3 & 0x03)

var length = data.length;

data[i] = String.fromCharCode(

return data.join('').substring(0, n);

return data.join('');

var length = string.length;

result[i >> 2] = string.charCodeAt(i) |

string.charCodeAt(i 1)

string.charCodeAt(i 2)

string.charCodeAt(i 3)

result[result.length] = length;

this.encrypt = function(string, key) {

var k = stringToLongArray(key, false);

if (k.length

k.length = 4;

var n = v.length - 1;

var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = 0;

this.decrypt = function(string, key) {

var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = q * delta & 0xffffffff;

* See hXXp://pajhome.org.uk/crypt/md5 for details.

function hex_sha1(s){return binb2hex(core_sha1(str2binb(s),s.length * chrsz));}

function b64_sha1(s){return binb2b64(core_sha1(str2binb(s),s.length * chrsz));}

function str_sha1(s){return binb2str(core_sha1(str2binb(s),s.length * chrsz));}

function hex_hmac_sha1(key, data){ return binb2hex(core_hmac_sha1(key, data));}

function b64_hmac_sha1(key, data){ return binb2b64(core_hmac_sha1(key, data));}

function str_hmac_sha1(key, data){ return binb2str(core_hmac_sha1(key, data));}

for(var i = 0; i

* Calculate the HMAC-SHA1 of a key and some data

function core_hmac_sha1(key, data)

var bkey = str2binb(key);

if(bkey.length > 16) bkey = core_sha1(bkey, key.length * chrsz);

ipad[i] = bkey[i] ^ 0x36363636;

opad[i] = bkey[i] ^ 0x5C5C5C5C;

var hash = core_sha1(ipad.concat(str2binb(data)), 512 data.length * chrsz);

return core_sha1(opad.concat(hash), 512 160);

* Add integers, wrapping at 2^32. This uses 16-bit operations internally

for(var i = 0; i

bin[i>>5] |= (str.charCodeAt(i / chrsz) & mask)

for(var i = 0; i

str = String.fromCharCode((bin[i>>5] >>> (32 - chrsz - i2)) & mask);

for(var i = 0; i

str = hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 4)) & 0xF)

hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 )) & 0xF);

for(var i = 0; i

if(i * 8 j * 6 > binarray.length * 32) str = b64pad;

else str = tab.charAt((triplet >> 6*(3-j)) & 0x3F);

__MSVCRT_HEAP_SELECT

qqcrypt.dll

/-UM2.SD60O:

6.LX:0GN?2CEE4>=L785T:1/Z=,*a?'%d@%#fB#!hB!

dA@(

(2015.06.10)

(2015.06.07)

(2015.06.06)

(2015.06.05)

(2015.05.31)

(2015.05.29)

(2015.05.27)

(2015.05.22)

(2015.05.18)

(2015.05.17)

(2015.05.16)

(2015.05.15)

(2015.05.14)

(2015.05.12)

(2015.05.11)

(2015.05.02)

(2015.04.28)

(2015.04.21)

(2015.04.15)

(2015.04.02)

(2015.04.01)

(2015.03.30)

(2015.03.27)

(2015.03.26)

(2015.03.25)

(2015.03.23)

(2015.03.18)

(2015.03.14)

(2015.03.13)

(2015.03.07)

(2015.03.06)

(2015.03.05)

(2015.03.01)

(2015.02.09)

(2015.01.31)

(2015.01.30)

(2015.01.29)

(2015.01.28)

(2015.01.22)

(2015.01.19)

(2015.01.18)

(2015.01.13)

(2015.01.12)

(2015.01.11)

(2015.01.10)

(2015.01.08)

(2014.12.24)

(2014.12.23)

(2014.12.21)

(2014.12.01)

(2014.11.30)

(2014.11.25)

(2014.11.22)

(2014.11.20)

(2014.11.14)

(2014.11.13)

(2014.11.12)

(2014.11.11)

tn|px.lD

.comment {color:green}

*.txt

|*.txt

%d&&'

123456789

00003333

1.2.18

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

MSWHEEL_ROLLMSG

Broken pipe

Inappropriate I/O control operation

Operation not permitted

.PAVCNotSupportedException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

icmp.dll

windows

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

libpng error: %s

libpng warning: %s

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

Y%d

X%d

Height%d

Width%d

RECT(%d, %d)-(%d, %d)

Styles0xX

Control ID%d

Handle0xX

burlywood

\winhlp32.exe

:%d) |

%I64d%s

:0{}%s

:%d)%s

(*.avi)|*.avi

WPFT532.CNV

WPFT632.CNV

EXCEL32.CNV

write32.wpc

Windows Write

mswrd632.wpc

Word for Windows 6.0

wword5.cnv

Word for Windows 5.0

mswrd832.cnv

mswrd632.cnv

Word 6.0/95 for Windows & Macintosh

html32.cnv

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

\u00%c%c

json_tokener_parse_ex: error %s at offset %d

json_tokener_comment: %s

HTTP HTTPS.

;3 #>6.&

'2, / 0&7!4-)1#

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

GetWindowsDirectoryA

WinExec

RegCreateKeyExA

RegOpenKeyExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

GetViewportOrgEx

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

GetKeyState

1, 0, 6, 6

- Skin.dll

2014, 2, 7, 1

FastVerCode.DLL

CCaptchaRecognizer::recognizeByCodeTypeAndUrl

hXXp://s1.uudati.com:

hXXp://s1.taskok.com:

hXXp://s1.uudama.com:

hXXp://s1.uuwise.com:

/Api/config.aspx

2.0.0.5

WiseClientAPI-2.0.0.5

CCaptchaRecognizer::__UpdateTKEY

CCaptchaRecognizer::_IsNeedLogin

/Api/DecodeImg.aspx

xxxxxxxxxxx

hXXp://p1.uuwise.net:

hXXp://p1.uudama.net:

hXXp://p1.taskok.com:

hXXp://p1.uuwise.com:

hXXp://p1.uudama.com:

CCaptchaRecognizer::easyRecognizeUrl

%d%d%d%d%d

CCaptchaRecognizer::_CalcRandomPort

/Api/VerifyAPIFile.aspx

/Api/UserLogin.aspx

CCaptchaRecognizer::login

/Api/UserReg.aspx

/Api/PayCard.aspx

/Api/ReportError.aspx

CCaptchaRecognizer::reportError

/Api/UserPoint.aspx

|2.0.0.5|

/Api/DecodeResult.aspx

ID/KEY/

ByTypeBytes.JPG

%d-%d-%d

CHttpRequestHelper::_ReadResponse

User-Agent:WiseClient-2.0.0.5;

WiseClient-2.0.0.5

CHttpRequestHelper::_InternalRequest

CHttpRequestHelper::RequestGetImage

CHttpRequestHelper::RequestPost

ServerPort

UUExtConfig.ini

-:-:-.%d

tCRYPTDLL.DLL

3.cn.pool.ntp.org

2.cn.pool.ntp.org

1.cn.pool.ntp.org

0.cn.pool.ntp.org

cn.pool.ntp.org

\\.\PHYSICALDRIVE0

Microsoft Windows Millennium Edition

Microsoft Windows 98

Microsoft Windows 95

%s (Build %d)

Service Pack 6a (Build %d)

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

Web Edition

Service Pack %d (Build %d)

Microsoft Windows NT

Microsoft Windows 2000

Microsoft Windows XP

Microsoft Windows Server 2003,

Microsoft Windows XP Professional x64 Edition

Microsoft Windows Server 2003 "R2"

Windows Server 2008

Windows Vista

Windows Server 2008 R2

Windows 7

ox-x-x-x-x-x

\Tencent\Users\*.*

nKERNEL32.DLL

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

!"#$%&'()* ,-.

uuwise.com

2, 0, 0, 5

1.0.0.1

!"#$%&'()* ,-

25, 0, 0, 1

Windows

9.5.25.212

(*.*)

%original file name%.exe_464_rwx_010A8000_0000C000:

x.yvr

x.yvkd

x.yvw

x.yvq5v

%original file name%.exe_464_rwx_0113D000_000CA000:

version.dll

user32.dll

shell32.dll

1e.ro4A

oleaut32.dll

H0.gW

comctl32.dll

advapi32.dll

gdi32.dll

d.jF/"

r#'%C

6.Xdp

g|$^.Cn

>.bM8

>Z.Ye

w4R`$p%s*

f.zo~L^

wsock32.dll

ntdll.dll

Ã‹.L@

l.sQ{

c-t{.FF

b#I".wM

e.ENZ

xip.tu

@>.vO

%FX2Fsi

qKT.jLka

3.LD7

G,.gd

<.cff>

&8.XMj

$~O.Ba

)].Wd

/_{M%U

Q%s6|

lVfeVg

!%uO

mh.ud

m%Csn%

kq84.QaI

)f%fg

.SuDYw

K)`p.frC

*%s!%

aR.dDb&

.xk 4g

ShellExecuteA

RegCloseKey

)%S{.

'U}.Ue

l%S(8x$!(

1L%UJ

.vtbw

.iA5N

yyhKa%S

d.Zd=#R

x0r%F{

.IPi)

Vj.jH

>M%X9

/8[

bc.lTk

ks_GetMsg

kssPlugin.dll

tole32.dll

kernel32.dll

%original file name%.exe_464_rwx_10000000_0003F000:

`.rsrc

L$(h%f

SSh0j

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ã

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1, 0, 6, 6

- Skin.dll