Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 4d2bd8792bb1a4d9deda88d4274ddc88
SHA1: 3c69a2be5ecbf002b94729d90914a36fe9671e07
SHA256: 1424acf78aff67aec9e96a017ab65c93c337689437e9cbe2595dbe9cce919255
SSDeep: 24576:Pdr2WeEFKbc4IvrEEcBSbf3I/wW6i10TCS8PLeRB2YOzUyEGWAQ5nEZTZ1RzVKE1:PM57LeRkLVc2jPK9M9fwEBYZOqDIH
Size: 2818048 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2015-05-01 16:52:49
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:348
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:348 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (8 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.xfluoke[2].txt (451 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.xfluoke[1].xml (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (898 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tghh[1].txt (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\21[1].gif (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.xfluoke[1].txt (187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bt[1].txt (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tj[1].htm (726 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\banben[1].txt (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\uctc64[1].txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\zuidibanben[1].txt (4 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[2].js (21 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5012 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wz64[1].txt (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@www.xfluoke[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)
Registry activity
The process %original file name%.exe:348 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1024x768x32(BGR 0)" = "31,31,31,31"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CC 8F 01 C5 19 D9 54 C0 D1 EC F6 A4 49 63 D7 17"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (8 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.xfluoke[2].txt (451 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.xfluoke[1].xml (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (898 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tghh[1].txt (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\21[1].gif (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.xfluoke[1].txt (187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bt[1].txt (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tj[1].htm (726 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\banben[1].txt (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\uctc64[1].txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\zuidibanben[1].txt (4 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[2].js (21 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5012 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wz64[1].txt (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: ????????
Product Name: ????????
Product Version: 9.8.0.1
Legal Copyright: ????????
??:www.luokexf.com
??:admin@luokexf.com
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 9.8.0.1
File Description: www.luokexf.com
Comments: www.luokexf.com
Language: Language Neutral
Company Name: ????????Product Name: ????????Product Version: 9.8.0.1Legal Copyright: ??????????:www.luokexf.com??:admin@luokexf.comLegal Trademarks: Original Filename: Internal Name: File Version: 9.8.0.1File Description: www.luokexf.comComments: www.luokexf.comLanguage: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 1675264 | 1675264 | 4.51404 | 42a638a1231f75fdc2ebbf13641d56fb |
.rdata | 1679360 | 964570 | 966656 | 4.27472 | 562ceb61e5a658233ce82a1cf3212a28 |
.data | 2646016 | 333416 | 110592 | 3.80958 | 7a4af5380a97974862235e4cbdf8f654 |
.rsrc | 2981888 | 61440 | 61440 | 4.21394 | 247373246633bbb5e4fe4f94ae4d4fe7 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://www.xfluoke.com/data/cs.txt | 192.225.225.167 |
hxxp://www.xfluoke.com/data/tjrj/bt.txt | 192.225.225.167 |
hxxp://www.xfluoke.com/data/tjrj/uctc64.txt | 192.225.225.167 |
hxxp://www.xfluoke.com/data/tjrj/wz64.txt | 192.225.225.167 |
hxxp://www.xfluoke.com/data/tjrj/tghh.txt | 192.225.225.167 |
hxxp://www.xfluoke.com/data/tj.html?V9.8 | 192.225.225.167 |
hxxp://www.xfluoke.com/data/banben.txt | 192.225.225.167 |
hxxp://www.xfluoke.com/data/zuidibanben.txt | 192.225.225.167 |
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=4369261&web_id=4369261&show=pic1 | |
hxxp://hm.e.shifen.com/h.js?4de4eadcf85ee6dc5ae83132e3429e3f | |
hxxp://hm.e.shifen.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=823678787&si=4de4eadcf85ee6dc5ae83132e3429e3f&st=1&v=1.1.2&lv=1 | |
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=5931522 | |
hxxp://static.n.shifen.com/hmt/icon/21.gif | |
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=5931522&t=z | |
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=574177603 | 42.120.219.171 |
hxxp://cnzz.mmstat.com/app.gif?&cna=lkxVDq3LIhwCAcLyYOPsHJRL | 42.120.219.171 |
hxxp://hm.baidu.com/h.js?4de4eadcf85ee6dc5ae83132e3429e3f | 220.181.7.190 |
hxxp://eiv.baidu.com/hmt/icon/21.gif | 115.239.211.92 |
hxxp://s25.cnzz.com/stat.php?id=4369261&web_id=4369261&show=pic1 | 1.99.192.16 |
hxxp://s4.cnzz.com/stat.php?id=5931522 | 1.99.192.15 |
hxxp://c.cnzz.com/core.php?web_id=5931522&t=z | 212.98.178.235 |
hxxp://pcookie.cnzz.com/app.gif?&cna=lkxVDq3LIhwCAcLyYOPsHJRL | 42.120.219.171 |
hxxp://hm.baidu.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=823678787&si=4de4eadcf85ee6dc5ae83132e3429e3f&st=1&v=1.1.2&lv=1 | 220.181.7.190 |
17roco.qq.com | |
oz.cnzz.com |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /stat.php?id=4369261&web_id=4369261&show=pic1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s25.cnzz.com
Connection: Keep-Alive
HTTP/1.1 503 Service Temporarily Unavailable
Server: Tengine
Content-Length: 0
Connection: keep-alive
Via: cache20.l2de1[0,503-0,M], cache5.l2de1[1224,0], cache7.by1[1326,503-0,M], cache6.by1[1320,1327,502001]
Age: 0
X-Cache: MISS TCP_MISS dirn:-2:-2
X-Swift-SaveTime: Fri, 14 Aug 2015 21:32:50 GMT
X-Swift-CacheTime: 1
...
GET /app.gif?&cna=lkxVDq3LIhwCAcLyYOPsHJRL HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: pcookie.cnzz.com
HTTP/1.1 200 OK
Server: Tengine
Date: Fri, 14 Aug 2015 21:33:14 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=lkxVDq3LIhwCAcLyYOPsHJRL; expires=Mon, 11-Aug-25 21:33:14 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..
GET /stat.php?id=5931522 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Date: Fri, 14 Aug 2015 21:33:05 GMT
Last-Modified: Fri, 14 Aug 2015 21:33:05 GMT
Cache-Control: max-age=5400,s-maxage=5400
Via: cache8.l2de1[679,200-0,M], cache52.l2de1[681,0], cache3.by1[809,200-0,M], cache4.by1[809,0]
X-Cache: MISS TCP_REFRESH_MISS dirn:11:822725449
X-Swift-SaveTime: Fri, 14 Aug 2015 21:33:05 GMT
X-Swift-CacheTime: 5400
1f77..(function(){function k(){this.c="5931522";this.R="z";this.N="";this.K="";this.M="";this.r="1439587985";this.P="oz.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=5931522");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURIComponent,n=unescape;k.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),this.ga(),.this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.pa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},na:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},pa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if("[object
<<< skipped >>>
GET /hmt/icon/21.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: eiv.baidu.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=311040000
Content-Length: 1119
Content-Type: image/gif
Date: Fri, 14 Aug 2015 21:33:05 GMT
Etag: "762990053"
Expires: Sun, 22 Jun 2025 21:33:05 GMT
Last-Modified: Tue, 13 Apr 2010 09:38:40 GMT
Server: BWS/1.0
GIF89a........s..E.....M...................ZS.2-.YS.......2,.c[..D.......0'..:..0.&..]Z..8..>..D.TM.................C................._..^.....u..w........~........k.4......X..d.......=1.....a.c[.PH.h_.....b..........PH........A..9....h`..J..1.......g`..W........2........z.#...p..m....jd........*.............[Q...........6..G..............6..t............. ..TL.....!....$....."..;0.....h.7-..............Z.............%..:.....H@....^W.QJ..'. !..........70.._. %.'...T.0'..Q.G?.ws....-$........h.}w.....>...........L.....#.......:0.............\S.............*".....Q..............<..T.!...p.$...}........N..........d_...........j.......VN.....o.....e........[......................................................................................................................!.......,............u...,..>6.T.T..&T.".H. ....3^.PQ.G..:^..H.-.T....2#!........K..iP.&..03%X..x.P/^.$...`...G>Xd....!..d.T...j.,..fQ..8l<..U%..G|.h.......$p..f......R..b.....*R@W"2y..8..V3.LV`t.e..7.>.........\D..O.H.....$...^.]..).. ...9..E...d\...V.U1..i......B]......c.P<0.i...v.]D..G .?p-.CD.Fi;>..v....r`..&........./.dp....`.....;HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=311040000..Content-Length: 1119..Content-Type: image/gif..Date: Fri, 14 Aug 2015 21:33:05 GMT..Etag: "762990053"..Expires: Sun, 22 Jun 2025 21:33:05 GMT..Last-Modified: Tue, 13 Apr 2010 09:38:40 GMT..Server: BWS/1.0..GIF89a........s..E.....M...................ZS.2-.YS.......2,.c[..D.......0'..:..0.&..]Z..8..>..D.TM.........
<<< skipped >>>
GET /h.js?4de4eadcf85ee6dc5ae83132e3429e3f HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hm.baidu.com
Connection: Keep-Alive
Cookie: HMACCOUNT=AD4692A2C64DD9D0
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 8132
Content-Type: application/javascript
Date: Fri, 14 Aug 2015 21:32:59 GMT
Etag: 8b48cdb64fbfffc707d2e5f18c17239e
Server: apache
...............(function(){var h={},mt={},c={id:"4de4eadcf85ee6dc5ae83132e3429e3f",dm:["luokexf.com"],js:"tongji.baidu.com/hm-web/js/",etrk:[],icon:'/hmt/icon/21|gif|20|20',ctrk:false,align:-1,nv:-1,vdur:1800000,age:31536000000,rec:0,rp:[],trust:0,vcard:0,qiao:0,lxb:0,conv:0,comm:0,apps:''};.;kw..... h4 ..LI.....]....$.I..]Y..IHb..LR.]I.}g..%)...9......=.f.Sc..v.../....a..rk..6....;.(..a^..k....X..r3..`..$...H.&"..Z.%.,./c...w.y.~5.3_....^S...x...Q.Ut..U..&w..o{...,....Ec.!.b..........T.....|.^wi......T..i.....$}!...iN..`2.UdA...oV&rg...<Hb.3...Z..\[X.Z-.ubqg...`.N..D.t..n.6L....o..g. .M.......$.A< ..Z._t...8e..)N._9..5.b......`.....7.?.i.OLZl...i.... ........HW...)...b..~n.......8..O.......%....3..F...OG.[..V.......b...........>...^....j.....p.?.s.>.....t9.%..o._.V..@O....sa.`lr ...<...S...................69...t..gn#*(...e.q.P..|j.....m....I7.r...U.>..C..}rx...I..$..........]i.J......Xo...b ....p.&..q.....o.(\,...~.rZ*.d).3M.....I.c_.}..6a)..\..............D.P..8@.....>..,0.".(.1I..I.N..`........p...y!.....o...a"...K.H#...}49@.0mVv..0.0....\....Z..Ha...S5,jK...6..[..q.R...qn.X.t...(.Zn....S..;.d./Ua..}../.).l6., w..,.Am.d..v.)..f....v..K@...qP..\..>.!|....J#.... <...}!.|.6- ...lw..W..O..@...?..~FK...Bh....U.{..i..md."..4.=.@j..g ..<.?|.(...!.....vO..{.QG...l..............Y......r.....].../}...*/e..Zt....\.5..0.n.wA..k../...c.oC.-...8.x.-d..z.......sm.V....u.OF.s.....f...l....fJ....]_.#........f..w..F.>#......1."..8.A....U.......i1n... .r...@......].B..\.a..q.$.<......_I`....
<<< skipped >>>
GET /hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=823678787&si=4de4eadcf85ee6dc5ae83132e3429e3f&st=1&v=1.1.2&lv=1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hm.baidu.com
Connection: Keep-Alive
Cookie: HMACCOUNT=AD4692A2C64DD9D0
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Fri, 14 Aug 2015 21:33:00 GMT
Pragma: no-cache
Server: apache
X-Content-Type-Options: nosniff
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Control: private, max-age=0, no-cache..Content-Length: 43..Content-Type: image/gif..Date: Fri, 14 Aug 2015 21:33:00 GMT..Pragma: no-cache..Server: apache..X-Content-Type-Options: nosniff..GIF89a.............!.......,...........L..;..
GET /9.gif?abc=1&rnd=574177603 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Server: Tengine
Date: Fri, 14 Aug 2015 21:33:10 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=lkxVDq3LIhwCAcLyYOPsHJRL; expires=Mon, 11-Aug-25 21:33:10 GMT; path=/; domain=.mmstat.com
Set-Cookie: sca=e5eda8bb; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=6f4e345be57ddf80b14160e3_1439587990; expires=Mon, 11-Aug-25 21:33:10 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=lkxVDq3LIhwCAcLyYOPsHJRL
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..
GET /data/cs.txt HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: VVV.xfluoke.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Length: 1
Content-Type: text/plain
Last-Modified: Fri, 20 Jun 2014 18:23:20 GMT
Accept-Ranges: bytes
ETag: "6fa6a3b6b48ccf1:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:39 GMT
1....
GET /data/tjrj/bt.txt HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: hXXp://VVV.xfluoke.com/data/tjrj/bt.txt
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Host: VVV.xfluoke.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Length: 42
Content-Type: text/plain
Last-Modified: Tue, 15 Apr 2014 22:41:15 GMT
Accept-Ranges: bytes
ETag: "c39032cffb58cf1:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:39 GMT
....2345..........2345......(............)....
GET /data/tjrj/uctc64.txt HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: hXXp://VVV.xfluoke.com/data/tjrj/uctc64.txt
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Host: VVV.xfluoke.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Length: 1
Content-Type: text/plain
Last-Modified: Fri, 22 Aug 2014 20:04:39 GMT
Accept-Ranges: bytes
ETag: "a27cff4d44becf1:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:39 GMT
1....
GET /data/tjrj/wz64.txt HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: hXXp://VVV.xfluoke.com/data/tjrj/wz64.txt
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Host: VVV.xfluoke.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Length: 69
Content-Type: text/plain
Last-Modified: Fri, 15 Aug 2014 02:41:57 GMT
Accept-Ranges: bytes
ETag: "83be827b32b8cf1:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:39 GMT
GET /data/tjrj/tghh.txt HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: hXXp://VVV.xfluoke.com/data/tjrj/tghh.txt
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Host: VVV.xfluoke.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Length: 1
Content-Type: text/plain
Last-Modified: Wed, 20 Aug 2014 01:15:18 GMT
Accept-Ranges: bytes
ETag: "3fa1df3414bccf1:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:39 GMT
0....
GET /data/tj.html?V9.8 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.xfluoke.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 726
Content-Type: text/html
Last-Modified: Fri, 13 Jun 2014 21:45:01 GMT
Accept-Ranges: bytes
ETag: "86b972ba5087cf1:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:41 GMT
<script src="hXXp://s25.cnzz.com/stat.php?id=4369261&web_id=4369261&show=pic1" language="JavaScript"></script>..<script type="text/javascript">..var _bdhmProtocol = (("https:" == document.location.protocol) ? " hXXps://" : " hXXp://");..document.write(unescape(""));..</script>..<script type="text/javascript">var cnzz_protocol = (("https:" == document.location.protocol) ? " hXXps://" : " hXXp://");document.write(unescape("3E"));</script>....
GET /data/zuidibanben.txt HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: hXXp://VVV.xfluoke.com/data/zuidibanben.txt
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Host: VVV.xfluoke.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Length: 4
Content-Type: text/plain
Last-Modified: Sat, 25 Oct 2014 17:00:19 GMT
Accept-Ranges: bytes
ETag: "244c312875f0cf1:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:41 GMT
V2.9..
GET /core.php?web_id=5931522&t=z HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 760
Connection: keep-alive
Date: Fri, 14 Aug 2015 21:33:05 GMT
Last-Modified: Fri, 14 Aug 2015 21:33:05 GMT
Expires: Fri, 14 Aug 2015 21:48:05 GMT
Via: cache12.l2de1[324,200-0,M], cache61.l2de1[341,0], cache6.by1[395,200-0,M], cache3.by1[396,0]
X-Cache: MISS TCP_REFRESH_MISS dirn:3:687567441
X-Swift-SaveTime: Fri, 14 Aug 2015 21:33:06 GMT
X-Swift-CacheTime: 899
!function(){var p,q,r,a=encodeURIComponent,b="5931522",c="",d="",e="online_v3.php",f="z3.cnzz.com",g="1",h="text",i="z",j="站长统计",k=window["_CNZZDbridge_" b]["bobject"],l="http:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k["callRequest"]([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k["createScriptIcon"](n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a href='" q "' target=_blank title='" j "'>" j "</a>",k["createIcon"]([p])))}();..
GET /data/banben.txt HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: hXXp://VVV.xfluoke.com/data/banben.txt
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Host: VVV.xfluoke.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Length: 5
Content-Type: text/plain
Last-Modified: Fri, 14 Aug 2015 13:09:55 GMT
Accept-Ranges: bytes
ETag: "48f3b98392d6d01:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:41 GMT
V11.3..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_348:
.text
.text
.rdata
.rdata
@.data
@.data
.rsrc
.rsrc
t$(SSh
t$(SSh
~%UVW
~%UVW
u.hpzg
u.hpzg
u$SShe
u$SShe
ws2_32.dll
ws2_32.dll
wininet.dll
wininet.dll
shell32.dll
shell32.dll
kernel32.dll
kernel32.dll
shlwapi.dll
shlwapi.dll
ntdll.dll
ntdll.dll
OLEACC.DLL
OLEACC.DLL
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
ShellExecuteA
ShellExecuteA
DeleteUrlCacheEntry
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
FindCloseUrlCache
EnumChildWindows
EnumChildWindows
GetAsyncKeyState
GetAsyncKeyState
{A068799B-7551-46b9-8CA8-EEF8357AFEA4}
{A068799B-7551-46b9-8CA8-EEF8357AFEA4}
00000000000
00000000000
9527000000030004
9527000000030004
hXXp://res.17roco.qq.com/res/
hXXp://res.17roco.qq.com/res/
/scene.swf
/scene.swf
hXXp://res.17roco.qq.com/res/scene/
hXXp://res.17roco.qq.com/res/scene/
hXXp://17roco.qq.com/cgi-bin/buy_items?id=
hXXp://17roco.qq.com/cgi-bin/buy_items?id=
hXXp://web2.17roco.qq.com/fcgi-bin/login2
hXXp://web2.17roco.qq.com/fcgi-bin/login2
&skey=
&skey=
&angel_key=
&angel_key=
pskey=
pskey=
z>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
z>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
http=
http=
HTTP/1.1
HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
hXXp://
hXXp://
]]>
]]>
hXXp://17roco.qq.com/cgi-bin/lovely_ruila?cmd=1&uin=
hXXp://17roco.qq.com/cgi-bin/lovely_ruila?cmd=1&uin=
9527000000120002
9527000000120002
0000000000000033
0000000000000033
9527000000120017
9527000000120017
9527000000120406
9527000000120406
9527000000120005
9527000000120005
0000000000000034
0000000000000034
9527000000120007
9527000000120007
0000006600000000
0000006600000000
9527000000032342
9527000000032342
0000006700000000
0000006700000000
9527000000032343
9527000000032343
0000006800000000
0000006800000000
0000006900000000
0000006900000000
0000007000000000
0000007000000000
0000007100000000
0000007100000000
0000007200000000
0000007200000000
0000007300000000
0000007300000000
0000007400000000
0000007400000000
0000007500000000
0000007500000000
00000076000000020800
00000076000000020800
9527000000032340
9527000000032340
00000031000000020800
00000031000000020800
9527000000032341
9527000000032341
0000003200000000
0000003200000000
9527000000032346
9527000000032346
00000000000000020101
00000000000000020101
#hXXp://17roco.qq.com
#hXXp://17roco.qq.com
hXXp://res.17roco.qq.com/swf/night.swf
hXXp://res.17roco.qq.com/swf/night.swf
hXXp://17roco.qq.com/cgi-bin/shadow?cmd=0&id=1
hXXp://17roco.qq.com/cgi-bin/shadow?cmd=0&id=1
hXXp://17roco.qq.com/cgi-bin/shadow?cmd=2&id=
hXXp://17roco.qq.com/cgi-bin/shadow?cmd=2&id=
hXXp://17roco.qq.com/cgi-bin/shadow?cmd=3
hXXp://17roco.qq.com/cgi-bin/shadow?cmd=3
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=109&condition=1&type=1
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=109&condition=1&type=1
0000003900000000
0000003900000000
9527000000032191
9527000000032191
9527000000032287
9527000000032287
hXXp://17roco.qq.com/cgi-bin/vipweeklyaward?cmd=1
hXXp://17roco.qq.com/cgi-bin/vipweeklyaward?cmd=1
hXXp://17roco.qq.com/cgi-bin/vip_gift_of_month?cmd=0
hXXp://17roco.qq.com/cgi-bin/vip_gift_of_month?cmd=0
hXXp://17roco.qq.com/cgi-bin/vip_gift_of_month?cmd=1
hXXp://17roco.qq.com/cgi-bin/vip_gift_of_month?cmd=1
0000003000000000
0000003000000000
hXXp://17roco.qq.com/cgi-bin/mining?cmd=2&type=
hXXp://17roco.qq.com/cgi-bin/mining?cmd=2&type=
hXXp://17roco.qq.com/cgi-bin/hitmonster?cmd=0
hXXp://17roco.qq.com/cgi-bin/hitmonster?cmd=0
hXXp://17roco.qq.com/cgi-bin/hitmonster?cmd=1
hXXp://17roco.qq.com/cgi-bin/hitmonster?cmd=1
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=
hXXp://17roco.qq.com/cgi-bin/career_work?cmd=1&type=
hXXp://17roco.qq.com/cgi-bin/career_work?cmd=1&type=
hXXp://17roco.qq.com/cgi-bin/weektaskwork?cmd=1&type=14
hXXp://17roco.qq.com/cgi-bin/weektaskwork?cmd=1&type=14
hXXp://17roco.qq.com/cgi-bin/experience_tree?cmd=2
hXXp://17roco.qq.com/cgi-bin/experience_tree?cmd=2
hXXp://17roco.qq.com/cgi-bin/experience_tree?cmd=3
hXXp://17roco.qq.com/cgi-bin/experience_tree?cmd=3
9527000000120404
9527000000120404
hXXp://17roco.qq.com/cgi-bin/pet_training?cmd=2&type=
hXXp://17roco.qq.com/cgi-bin/pet_training?cmd=2&type=
9527000000170004
9527000000170004
00000034000000020801
00000034000000020801
00000034000000020800
00000034000000020800
9527000000170005
9527000000170005
00000036000000020801
00000036000000020801
00000038000000020802
00000038000000020802
0000000000000000
0000000000000000
9527000000120022
9527000000120022
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=133&condition=1&type=1
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=133&condition=1&type=1
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=134&condition=1&type=1
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=134&condition=1&type=1
hXXp://17roco.qq.com/cgi-bin/samul_belt?cmd=2
hXXp://17roco.qq.com/cgi-bin/samul_belt?cmd=2
hXXp://17roco.qq.com/cgi-bin/new_shoot_machine?cmd=1
hXXp://17roco.qq.com/cgi-bin/new_shoot_machine?cmd=1
hXXp://17roco.qq.com/cgi-bin/weektaskwork?cmd=3&type=86&step=0
hXXp://17roco.qq.com/cgi-bin/weektaskwork?cmd=3&type=86&step=0
hXXp://17roco.qq.com/cgi-bin/weektaskwork?cmd=3&type=86&step=1
hXXp://17roco.qq.com/cgi-bin/weektaskwork?cmd=3&type=86&step=1
hXXp://17roco.qq.com/cgi-bin/career_get?cmd=0
hXXp://17roco.qq.com/cgi-bin/career_get?cmd=0
hXXp://17roco.qq.com/cgi-bin/career_get?cmd=1
hXXp://17roco.qq.com/cgi-bin/career_get?cmd=1
hXXp://17roco.qq.com/cgi-bin/newhorizons?cmd=4
hXXp://17roco.qq.com/cgi-bin/newhorizons?cmd=4
hXXp://17roco.qq.com/cgi-bin/newhorizons?cmd=2&ship=4
hXXp://17roco.qq.com/cgi-bin/newhorizons?cmd=2&ship=4
hXXp://17roco.qq.com/cgi-bin/newhorizons?cmd=3&ship=4&address=8
hXXp://17roco.qq.com/cgi-bin/newhorizons?cmd=3&ship=4&address=8
hXXp://17roco.qq.com/cgi-bin/roco_shortcut_fourth?cmd=1
hXXp://17roco.qq.com/cgi-bin/roco_shortcut_fourth?cmd=1
hXXp://17roco.qq.com/cgi-bin/week_reward_3366?cmd=1&blue=1
hXXp://17roco.qq.com/cgi-bin/week_reward_3366?cmd=1&blue=1
hXXp://17roco.qq.com/cgi-bin/week_reward_3366?cmd=1&blue=0
hXXp://17roco.qq.com/cgi-bin/week_reward_3366?cmd=1&blue=0
hXXp://17roco.qq.com/cgi-bin/freedom_gift?cmd=1&src=0
hXXp://17roco.qq.com/cgi-bin/freedom_gift?cmd=1&src=0
hXXp://17roco.qq.com/cgi-bin/freedom_gift?cmd=1&src=1
hXXp://17roco.qq.com/cgi-bin/freedom_gift?cmd=1&src=1
0000002400000000
0000002400000000
9527000000032231
9527000000032231
hXXp://17roco.qq.com/cgi-bin/challenge_lewei?cmd=0
hXXp://17roco.qq.com/cgi-bin/challenge_lewei?cmd=0
hXXp://17roco.qq.com/cgi-bin/daily_sales?cmd=1&item=50397209&num=2
hXXp://17roco.qq.com/cgi-bin/daily_sales?cmd=1&item=50397209&num=2
00000000000000040000
00000000000000040000
9527000000030025
9527000000030025
hXXp://17roco.qq.com/cgi-bin/lulumagiclampgame?cmd=0
hXXp://17roco.qq.com/cgi-bin/lulumagiclampgame?cmd=0
hXXp://17roco.qq.com/cgi-bin/angel_stat?cmd=1&id=67
hXXp://17roco.qq.com/cgi-bin/angel_stat?cmd=1&id=67
hXXp://17roco.qq.com/cgi-bin/lulumagiclampgame?cmd=1&score=1900
hXXp://17roco.qq.com/cgi-bin/lulumagiclampgame?cmd=1&score=1900
hXXp://17roco.qq.com/cgi-bin/normaldigtreasure?cmd=0
hXXp://17roco.qq.com/cgi-bin/normaldigtreasure?cmd=0
hXXp://17roco.qq.com/cgi-bin/normaldigtreasure?cmd=1&gamestr=
hXXp://17roco.qq.com/cgi-bin/normaldigtreasure?cmd=1&gamestr=
hXXp://17roco.qq.com/cgi-bin/digtreasuregeneral?cmd=0&type=1
hXXp://17roco.qq.com/cgi-bin/digtreasuregeneral?cmd=0&type=1
hXXp://17roco.qq.com/cgi-bin/digtreasuregeneral?cmd=1&type=1&str=
hXXp://17roco.qq.com/cgi-bin/digtreasuregeneral?cmd=1&type=1&str=
hXXp://17roco.qq.com/cgi-bin/treasure_hunter?cmd=1
hXXp://17roco.qq.com/cgi-bin/treasure_hunter?cmd=1
hXXp://17roco.qq.com/cgi-bin/treasure_hunter?cmd=3
hXXp://17roco.qq.com/cgi-bin/treasure_hunter?cmd=3
hXXp://17roco.qq.com/cgi-bin/treasure_hunter?cmd=5&id=
hXXp://17roco.qq.com/cgi-bin/treasure_hunter?cmd=5&id=
hXXp://17roco.qq.com/
hXXp://17roco.qq.com/
hXXp://17roco.qq.com/login.html
hXXp://17roco.qq.com/login.html
9527000000030005
9527000000030005
hXXp://res.17roco.qq.com/res/item/
hXXp://res.17roco.qq.com/res/item/
VVV.luokeby.com
VVV.luokeby.com
hXXp://VVV.ucbug.com/
hXXp://VVV.ucbug.com/
VVV.luokeby.com
VVV.luokeby.com
hXXp://VVV.2345.com/?11054
hXXp://VVV.2345.com/?11054
data/tjrj/dz.txt
data/tjrj/dz.txt
000000000000000907
000000000000000907
02000000000001
02000000000001
00000000000000020201
00000000000000020201
000000000000000902
000000000000000902
00000000000000010
00000000000000010
9527000000030040
9527000000030040
hXXp://17roco.qq.com/cgi-bin/hurdle_game_award?id=
hXXp://17roco.qq.com/cgi-bin/hurdle_game_award?id=
@hXXp://17roco.qq.com/cgi-bin/god_of_cookery?cmd=2&win=0&score=5000&rabit=0
@hXXp://17roco.qq.com/cgi-bin/god_of_cookery?cmd=2&win=0&score=5000&rabit=0
17170444
17170444
hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=0&type=1
hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=0&type=1
hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=1&type=1&goodsid=16842756&goodsnum=
hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=1&type=1&goodsid=16842756&goodsnum=
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67305489&num=1&ran=0
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67305489&num=1&ran=0
hXXp://17roco.qq.com/cgi-bin/compound_game_award?gameId=4000&cmd=2&id=2
hXXp://17roco.qq.com/cgi-bin/compound_game_award?gameId=4000&cmd=2&id=2
hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=1&type=2&goodsid=33751051&goodsnum=1
hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=1&type=2&goodsid=33751051&goodsnum=1
hXXp://17roco.qq.com/cgi-bin/run_cow?cmd=1&unkown=
hXXp://17roco.qq.com/cgi-bin/run_cow?cmd=1&unkown=
hXXp://17roco.qq.com/cgi-bin/run_cow?cmd=2&game_time=15&unkown=
hXXp://17roco.qq.com/cgi-bin/run_cow?cmd=2&game_time=15&unkown=
hXXp://17roco.qq.com/cgi-bin/run_cow?cmd=3&unkown=
hXXp://17roco.qq.com/cgi-bin/run_cow?cmd=3&unkown=
9527000000030009
9527000000030009
jy@luokexf.com
jy@luokexf.com
G|Z%d
G|Z%d
user32.dll
user32.dll
GetKeyboardType,MessageBoxA,CharNextA
GetKeyboardType,MessageBoxA,CharNextA
advapi32.dll
advapi32.dll
RegQueryValueExA,RegOpenKeyExA,RegCloseKey
RegQueryValueExA,RegOpenKeyExA,RegCloseKey
hXXp://17roco.qq.com/cgi-bin/hero_treasure?cmd=0
hXXp://17roco.qq.com/cgi-bin/hero_treasure?cmd=0
hXXp://17roco.qq.com/cgi-bin/hero_treasure?cmd=2
hXXp://17roco.qq.com/cgi-bin/hero_treasure?cmd=2
jy@luokeby.com
jy@luokeby.com
00000000000000020
00000000000000020
&time=&cmd=1&skey=
&time=&cmd=1&skey=
hXXp://17roco.qq.com/cgi-bin/go_super_man?skey=&angel_uin=
hXXp://17roco.qq.com/cgi-bin/go_super_man?skey=&angel_uin=
&time=&cmd=2&skey=
&time=&cmd=2&skey=
000000000000
000000000000
9527000000030010
9527000000030010
hXXp://17roco.qq.com/cgi-bin/run_baby?cmd=2&flag=3&unkown=
hXXp://17roco.qq.com/cgi-bin/run_baby?cmd=2&flag=3&unkown=
hXXp://17roco.qq.com/cgi-bin/run_baby?cmd=3&unkown=
hXXp://17roco.qq.com/cgi-bin/run_baby?cmd=3&unkown=
0000002600000004
0000002600000004
9527000000030015
9527000000030015
hXXp://VVV.baidu.com/s?wd=flash
hXXp://VVV.baidu.com/s?wd=flash
00000000000000050
00000000000000050
9527000000030029
9527000000030029
VVV.luokexf.com
VVV.luokexf.com
hXXp://17roco.qq.com/cgi-bin/star_guide?cmd=2&step=
hXXp://17roco.qq.com/cgi-bin/star_guide?cmd=2&step=
hXXp://17roco.qq.com/cgi-bin/buy_items?id=100728839&num=
hXXp://17roco.qq.com/cgi-bin/buy_items?id=100728839&num=
9527000000120004
9527000000120004
0000000000000001
0000000000000001
9527000000120006
9527000000120006
hXXp://17roco.qq.com/cgi-bin/digtreasure?cmd=1&gamestr=
hXXp://17roco.qq.com/cgi-bin/digtreasure?cmd=1&gamestr=
hXXp://17roco.qq.com/cgi-bin/digtreasureinmine?cmd=1&gamestr=
hXXp://17roco.qq.com/cgi-bin/digtreasureinmine?cmd=1&gamestr=
hXXp://17roco.qq.com/cgi-bin/digtreasure?cmd=0
hXXp://17roco.qq.com/cgi-bin/digtreasure?cmd=0
hXXp://17roco.qq.com/cgi-bin/digtreasureinmine?cmd=0
hXXp://17roco.qq.com/cgi-bin/digtreasureinmine?cmd=0
000000000000000901
000000000000000901
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.*)|*.*
(*.*)|*.*
).txt
).txt
00000000000000090
00000000000000090
0000000000000006010
0000000000000006010
0000000
0000000
0000000000000006020
0000000000000006020
hXXp://17roco.qq.com/cgi-bin/crazy_sale?cmd=1
hXXp://17roco.qq.com/cgi-bin/crazy_sale?cmd=1
hXXp://17roco.qq.com/cgi-bin/crazy_sale?cmd=3&npc=
hXXp://17roco.qq.com/cgi-bin/crazy_sale?cmd=3&npc=
hXXp://17roco.qq.com/cgi-bin/crazy_sale?cmd=4&npc=
hXXp://17roco.qq.com/cgi-bin/crazy_sale?cmd=4&npc=
0000000000000010
0000000000000010
9527000000030018
9527000000030018
hXXp://17roco.qq.com/cgi-bin/login
hXXp://17roco.qq.com/cgi-bin/login
hXXp://17roco.qq.com/default.html
hXXp://17roco.qq.com/default.html
WS2_32.DLL
WS2_32.DLL
9527000100070001
9527000100070001
9527000000030001
9527000000030001
luokexf.com
luokexf.com
luokexf.com
luokexf.com
GET /cgi-bin/reclaim_goods?cmd=1&
GET /cgi-bin/reclaim_goods?cmd=1&
222.73.78.102
222.73.78.102
angel_key=
angel_key=
0000000000000044
0000000000000044
9527000000070003
9527000000070003
00000000000000
00000000000000
0000000000000002
0000000000000002
9527000000030003
9527000000030003
-.png
-.png
hXXp://res.17roco.qq.com/res/combat/icons/
hXXp://res.17roco.qq.com/res/combat/icons/
00000069
00000069
00100001
00100001
9527000000030041
9527000000030041
09000000000000010000
09000000000000010000
09000000000000001388
09000000000000001388
9527000000030011
9527000000030011
8@030015
8@030015
00000026000000
00000026000000
0000000000000017
0000000000000017
0000000000000027
0000000000000027
00030003
00030003
hXXp://17roco.qq.com/cgi-bin/discovery?cmd=1&page=
hXXp://17roco.qq.com/cgi-bin/discovery?cmd=1&page=
(1,3,1000)
(1,3,1000)
jy@luokexf.com
jy@luokexf.com
hXXp://17roco.qq.com/cgi-bin/hurdle_game_award?id=2087&score=9000&type=2
hXXp://17roco.qq.com/cgi-bin/hurdle_game_award?id=2087&score=9000&type=2
hXXp://17roco.qq.com/cgi-bin/roco_legends?cmd=1&chapter=
hXXp://17roco.qq.com/cgi-bin/roco_legends?cmd=1&chapter=
hXXp://17roco.qq.com/cgi-bin/heaven_treasure?cmd=1&unkown=
hXXp://17roco.qq.com/cgi-bin/heaven_treasure?cmd=1&unkown=
) 9.VIP
) 9.VIP
?cmd=0&index=
?cmd=0&index=
hXXp://17roco.qq.com/cgi-bin/spirit_evo_
hXXp://17roco.qq.com/cgi-bin/spirit_evo_
?cmd=1&index=
?cmd=1&index=
?cmd=2&index=
?cmd=2&index=
:VVV.luokexf.com
:VVV.luokexf.com
k%UPp
k%UPp
fg.VG
fg.VG
%C',@
%C',@
>Ùd
>Ùd
FpUdP
FpUdP
:t6.dB
:t6.dB
s.ftlZ
s.ftlZ
Y.dlh
Y.dlh
oLQP.xL
oLQP.xL
0244>" `
0244>" `
%U{&X
%U{&X
ComboLBox%SHE_
ComboLBox%SHE_
otkeyScrol;r[MDIClil
otkeyScrol;r[MDIClil
#3276870
#3276870
l5k%x-l h
l5k%x-l h
9p%s m)t4`#
9p%s m)t4`#
&y1`Ã
&y1`Ã
f`c%US.
f`c%US.
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
USER32.dll
USER32.dll
SkinH_EL.dll
SkinH_EL.dll
9527000000032282
9527000000032282
0000003700000003
0000003700000003
9527000000032283
9527000000032283
0000002100000002
0000002100000002
0000002200000000
0000002200000000
0000002300000000
0000002300000000
9527000000032281
9527000000032281
hXXp://VVV.xfluoke.com/
hXXp://VVV.xfluoke.com/
data/cs.txt
data/cs.txt
hXXp://VVV.17luoke.com/
hXXp://VVV.17luoke.com/
hXXp://VVV.luokexf.com/
hXXp://VVV.luokexf.com/
data/tjrj/bt.txt
data/tjrj/bt.txt
data/tjrj/uctc64.txt
data/tjrj/uctc64.txt
data/tjrj/wz64.txt
data/tjrj/wz64.txt
data/tjrj/tghh.txt
data/tjrj/tghh.txt
data/tj.html?V
data/tj.html?V
data/banben.txt
data/banben.txt
data/zuidibanben.txt
data/zuidibanben.txt
VVV.luokexf.com
VVV.luokexf.com
data/bossyc.txt
data/bossyc.txt
data/llzyc.txt
data/llzyc.txt
data/gonggao/gglx.txt
data/gonggao/gglx.txt
data/gonggao/tcgg.txt
data/gonggao/tcgg.txt
data/gonggao/wbgg.txt
data/gonggao/wbgg.txt
! VVV.luokexf.com
! VVV.luokexf.com
data/gonggao/wygg.html
data/gonggao/wygg.html
data/tjrj/bytsn.txt
data/tjrj/bytsn.txt
VVV.luokexf.com
VVV.luokexf.com
data/gengxinneirong.txt
data/gengxinneirong.txt
data/zidonggengxin.txt
data/zidonggengxin.txt
data/bdwjm.txt
data/bdwjm.txt
hXXp://VVV.luokeby.com/
hXXp://VVV.luokeby.com/
data/rj/banben.txt
data/rj/banben.txt
data/rj/gxnr.txt
data/rj/gxnr.txt
data/rj/zdgx.txt
data/rj/zdgx.txt
00000087000000020801
00000087000000020801
9527000000032263
9527000000032263
9527000000032264
9527000000032264
0000003300000000
0000003300000000
9527000000032268
9527000000032268
0000003400000000
0000003400000000
00000087000000020802
00000087000000020802
0000005600000005
0000005600000005
0000003800000000
0000003800000000
00000039000000020803
00000039000000020803
00000000000000020400
00000000000000020400
9527000000030023
9527000000030023
9527000000032288
9527000000032288
hXXp://17roco.qq.com/cgi-bin/dungeon?cmd=0
hXXp://17roco.qq.com/cgi-bin/dungeon?cmd=0
hXXp://17roco.qq.com/cgi-bin/dungeon?cmd=1
hXXp://17roco.qq.com/cgi-bin/dungeon?cmd=1
0000008600000000
0000008600000000
00000000000000090200
00000000000000090200
hXXp://17roco.qq.com/cgi-bin/angel_befall?cmd=1&index=
hXXp://17roco.qq.com/cgi-bin/angel_befall?cmd=1&index=
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67371070&num=1&ran=
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67371070&num=1&ran=
hXXp://17roco.qq.com/cgi-bin/assemble_robot?cmd=0
hXXp://17roco.qq.com/cgi-bin/assemble_robot?cmd=0
hXXp://17roco.qq.com/cgi-bin/assemble_robot?cmd=1
hXXp://17roco.qq.com/cgi-bin/assemble_robot?cmd=1
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67371073&num=1&ran=
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67371073&num=1&ran=
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=0&game=2085
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=0&game=2085
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=1&game=2085
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=1&game=2085
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67371096&num=1&ran=
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67371096&num=1&ran=
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=0&game=2110
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=0&game=2110
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=1&game=2110
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=1&game=2110
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=1&game=2116
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=1&game=2116
data/zdgxMD5.txt
data/zdgxMD5.txt
hXXp://VVV.luokeby.com/data/rj/md5.txt
hXXp://VVV.luokeby.com/data/rj/md5.txt
VVV.xfluoke.com
VVV.xfluoke.com
admin@luokexf.com
admin@luokexf.com
hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=1&type=
hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=1&type=
0000006200000002
0000006200000002
hXXp://res.17roco.qq.com/res/game/2051/game.swf
hXXp://res.17roco.qq.com/res/game/2051/game.swf
hXXp://17roco.qq.com/cgi-bin/weekend_exp?cmd=1&unkown=
hXXp://17roco.qq.com/cgi-bin/weekend_exp?cmd=1&unkown=
hXXp://17roco.qq.com/cgi-bin/weekend_exp?cmd=2&exp=40000&diamondnum=0&unkown=
hXXp://17roco.qq.com/cgi-bin/weekend_exp?cmd=2&exp=40000&diamondnum=0&unkown=
/game.swf
/game.swf
hXXp://res.17roco.qq.com/res/game/
hXXp://res.17roco.qq.com/res/game/
VVV.luokeby.com
VVV.luokeby.com
data/tikubanben.txt
data/tikubanben.txt
data/tikugengxinneirong.txt
data/tikugengxinneirong.txt
data/tikugengxindizhi.txt
data/tikugengxindizhi.txt
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67305517&num=1&ran=0
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67305517&num=1&ran=0
hXXp://17roco.qq.com/cgi-bin/alchemy?cmd=1&id=3&id0=67305517&count0=1&id1=67239970&count1=1&id2=67239975&count2=1
hXXp://17roco.qq.com/cgi-bin/alchemy?cmd=1&id=3&id0=67305517&count0=1&id1=67239970&count1=1&id2=67239975&count2=1
hXXp://17roco.qq.com/cgi-bin/alchemy?cmd=1&id=3&id0=67305517&count0=1&id1=67239960&count1=1&id2=67239974&count2=1
hXXp://17roco.qq.com/cgi-bin/alchemy?cmd=1&id=3&id0=67305517&count0=1&id1=67239960&count1=1&id2=67239974&count2=1
hXXp://17roco.qq.com/cgi-bin/alchemy?cmd=1&id=3&id0=67305517&count0=1&id1=67239962&count1=1&id2=67239970&count2=1
hXXp://17roco.qq.com/cgi-bin/alchemy?cmd=1&id=3&id0=67305517&count0=1&id1=67239962&count1=1&id2=67239970&count2=1
9527000000030033
9527000000030033
hXXp://17roco.qq.com/creat.html
hXXp://17roco.qq.com/creat.html
hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=3&id=
hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=3&id=
hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=9&id=
hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=9&id=
hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=4&id=
hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=4&id=
hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=10&id=
hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=10&id=
hXXp://17roco.qq.com/cgi-bin/ivincibel_boxer?cmd=3&level=
hXXp://17roco.qq.com/cgi-bin/ivincibel_boxer?cmd=3&level=
hXXp://17roco.qq.com/cgi-bin/gongfu_rabbit?cmd=7&skillId=
hXXp://17roco.qq.com/cgi-bin/gongfu_rabbit?cmd=7&skillId=
hXXp://17roco.qq.com/cgi-bin/gongfu_rabbit?cmd=8&skillId=
hXXp://17roco.qq.com/cgi-bin/gongfu_rabbit?cmd=8&skillId=
00000033000000020821
00000033000000020821
00000027000000020820
00000027000000020820
00000026000000021025
00000026000000021025
00000029000000021025
00000029000000021025
00000026000000021022
00000026000000021022
00000030000000021022
00000030000000021022
00000029000000020819
00000029000000020819
00000042000000020817
00000042000000020817
00000031000000021019
00000031000000021019
00000039000000021019
00000039000000021019
00000029000000020816
00000029000000020816
00000025000000020815
00000025000000020815
00000023000000021015
00000023000000021015
00000033000000020814
00000033000000020814
00000022000000021014
00000022000000021014
00000032000000021014
00000032000000021014
00000026000000020813
00000026000000020813
00000035000000020812
00000035000000020812
00000045000000020811
00000045000000020811
00000020000000020810
00000020000000020810
00000024000000021009
00000024000000021009
00000054000000021008
00000054000000021008
00000053000000021007
00000053000000021007
00000053000000021006
00000053000000021006
00000062000000021006
00000062000000021006
00000034000000021002
00000034000000021002
00000047000000021000
00000047000000021000
00000023000000020807
00000023000000020807
(642,538)
(642,538)
(565,442)
(565,442)
(454,66)
(454,66)
0000013300000000
0000013300000000
9527000000032409
9527000000032409
0000013400000000
0000013400000000
0000013500000000
0000013500000000
9527000000032408
9527000000032408
0000013600000000
0000013600000000
hXXp://17roco.qq.com/cgi-bin/roco_diamond_5_1?cmd=0&unkown=
hXXp://17roco.qq.com/cgi-bin/roco_diamond_5_1?cmd=0&unkown=
hXXp://17roco.qq.com/cgi-bin/roco_diamond_5_1?cmd=1&unkown=
hXXp://17roco.qq.com/cgi-bin/roco_diamond_5_1?cmd=1&unkown=
hXXp://17roco.qq.com/cgi-bin/roco_diamond_5_1?cmd=2&which_one=
hXXp://17roco.qq.com/cgi-bin/roco_diamond_5_1?cmd=2&which_one=
00000035000000020049
00000035000000020049
hXXp://17roco.qq.com/cgi-bin/hurdle_game_award?id=2001&score=4000&type=2
hXXp://17roco.qq.com/cgi-bin/hurdle_game_award?id=2001&score=4000&type=2
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=55&condition=1&type=1
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=55&condition=1&type=1
hXXp://bangbang.qq.com/php/login?game=
hXXp://bangbang.qq.com/php/login?game=
luokexf.com(
luokexf.com(
anonymous@123.com
anonymous@123.com
.exe|.rar|.zip|.gif|.jpg|.mp3|.rm
.exe|.rar|.zip|.gif|.jpg|.mp3|.rm
V9.8 VVV.luokexf.com
V9.8 VVV.luokexf.com
jy@xfluoke.com
jy@xfluoke.com
Adobe Photoshop CS Windows
Adobe Photoshop CS Windows
2014:05:31 01:19:52
2014:05:31 01:19:52
urlTEXT
urlTEXT
MsgeTEXT
MsgeTEXT
4hXXp://ns.adobe.com/xap/1.0/
4hXXp://ns.adobe.com/xap/1.0/
xmlns:exif='hXXp://ns.adobe.com/exif/1.0/'>
xmlns:exif='hXXp://ns.adobe.com/exif/1.0/'>
xmlns:pdf='hXXp://ns.adobe.com/pdf/1.3/'>
xmlns:pdf='hXXp://ns.adobe.com/pdf/1.3/'>
xmlns:photoshop='hXXp://ns.adobe.com/photoshop/1.0/'>
xmlns:photoshop='hXXp://ns.adobe.com/photoshop/1.0/'>
xmlns:tiff='hXXp://ns.adobe.com/tiff/1.0/'>
xmlns:tiff='hXXp://ns.adobe.com/tiff/1.0/'>
xmlns:xap='hXXp://ns.adobe.com/xap/1.0/'>
xmlns:xap='hXXp://ns.adobe.com/xap/1.0/'>
Adobe Photoshop CS Windows
Adobe Photoshop CS Windows
xmlns:stRef='hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#'
xmlns:stRef='hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#'
xmlns:xapMM='hXXp://ns.adobe.com/xap/1.0/mm/'>
xmlns:xapMM='hXXp://ns.adobe.com/xap/1.0/mm/'>
uuid:62daa5ef-e81e-11e3-9f80-e32458687af0
uuid:62daa5ef-e81e-11e3-9f80-e32458687af0
adobe:docid:photoshop:62daa5ee-e81e-11e3-9f80-e32458687af0
adobe:docid:photoshop:62daa5ee-e81e-11e3-9f80-e32458687af0
adobe:docid:photoshop:62daa5f2-e81e-11e3-9f80-e32458687af0
adobe:docid:photoshop:62daa5f2-e81e-11e3-9f80-e32458687af0
xmlns:dc='hXXp://purl.org/dc/elements/1.1/'>
xmlns:dc='hXXp://purl.org/dc/elements/1.1/'>
IEC hXXp://VVV.iec.ch
IEC hXXp://VVV.iec.ch
.IEC 61966-2.1 Default RGB colour space - sRGB
.IEC 61966-2.1 Default RGB colour space - sRGB
CRT curv
CRT curv
s%5xH_
s%5xH_
g.mk^Y2.
g.mk^Y2.
.rlE2
.rlE2
s.TkY
s.TkY
7.cS[
7.cS[
lT.uj
lT.uj
a6.jB
a6.jB
)_.Ps
)_.Ps
A.sW8
A.sW8
ui%c(M
ui%c(M
}GH.lnZ
}GH.lnZ
,(.ob
,(.ob
AQ.ASk
AQ.ASk
c3A.DL
c3A.DL
I.of]
I.of]
u.wwD
u.wwD
4v%Su
4v%Su
jy@xfluoke.com
jy@xfluoke.com
23:00-6:00
23:00-6:00
:100794372
:100794372
1(12000)
1(12000)
:17039362
:17039362
00000000
00000000
hXXp://17roco.qq.com/login.htmls
hXXp://17roco.qq.com/login.htmls
ûZQ&
ûZQ&
hXXp://VVV.xfluoke.com/webhtm/zdsc.htm
hXXp://VVV.xfluoke.com/webhtm/zdsc.htm
hXXp://bangbang.qq.com/php/login?game=roco&H#
hXXp://bangbang.qq.com/php/login?game=roco&H#
123 / 999
123 / 999
>0123456789ABCDEF deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
>0123456789ABCDEF deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
F%*.*f
F%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
ole32.dll
ole32.dll
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
RASAPI32.dll
RASAPI32.dll
GetProcessHeap
GetProcessHeap
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
GetKeyState
GetKeyState
RegisterHotKey
RegisterHotKey
UnregisterHotKey
UnregisterHotKey
ExitWindowsEx
ExitWindowsEx
GetViewportOrgEx
GetViewportOrgEx
WINMM.dll
WINMM.dll
WINSPOOL.DRV
WINSPOOL.DRV
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyA
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
OLEAUT32.dll
OLEAUT32.dll
oledlg.dll
oledlg.dll
WS2_32.dll
WS2_32.dll
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
WININET.dll
WININET.dll
GetCPInfo
GetCPInfo
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
comdlg32.dll
comdlg32.dll
RegCreateKeyExA
RegCreateKeyExA
.PAVCException@@
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
1.0.6
1.0.6
\shell32.dll
\shell32.dll
%d%d%d
%d%d%d
rundll32.exe shell32.dll,
rundll32.exe shell32.dll,
[%s:%d]
[%s:%d]
Range: bytes=%s-
Range: bytes=%s-
[%s:%d]
[%s:%d]
PASS %s
PASS %s
PASS ******
PASS ******
USER %s
USER %s
E:\dev\e\static_link\static_libs\source\downlib\mystrlib.cpp
E:\dev\e\static_link\static_libs\source\downlib\mystrlib.cpp
SIZE %s
SIZE %s
PORT
PORT
User-Agent: %s
User-Agent: %s
Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Referer: %s
Referer: %s
Host: %s
Host: %s
GET %s HTTP/1.1
GET %s HTTP/1.1
HTTP/1.0
HTTP/1.0
Cookie: %s
Cookie: %s
%d, %s
%d, %s
\\192.168.0.129\TCP\1037
\\192.168.0.129\TCP\1037
NSPlayer/9.0.0.2980; {%s}; Host: %s
NSPlayer/9.0.0.2980; {%s}; Host: %s
rmff_fix_header: assuming data.size=%i
rmff_fix_header: assuming data.size=%i
rmff_fix_header: assuming data.num_packets=%i
rmff_fix_header: assuming data.num_packets=%i
rmff_fix_header: assuming prop.num_packets=%i
rmff_fix_header: assuming prop.num_packets=%i
rmff_fix_header: setting prop.data_offset from %i to %i
rmff_fix_header: setting prop.data_offset from %i to %i
rmff_fix_header: correcting prop.num_streams from %i to %i
rmff_fix_header: correcting prop.num_streams from %i to %i
rmff_fix_header: correcting prop.size from %i to %i
rmff_fix_header: correcting prop.size from %i to %i
%s %s %s
%s %s %s
Session: %s
Session: %s
Cseq: %u
Cseq: %u
%*s %s
%*s %s
%*s %u
%*s %u
CSeq: %u
CSeq: %u
rtsp://%s:%i
rtsp://%s:%i
rtsp://%s:%i/%s
rtsp://%s:%i/%s
ClientID: Linux_2.4_6.0.9.1235_play32_RN01_EN_586
ClientID: Linux_2.4_6.0.9.1235_play32_RN01_EN_586
GUID: 00000000-0000-0000-0000-000000000000
GUID: 00000000-0000-0000-0000-000000000000
[%s:%d]
[%s:%d]
User-Agent: RealMedia Player Version 6.0.9.1235 (linux-2.0-libc6-i386-gcc2.95)
User-Agent: RealMedia Player Version 6.0.9.1235 (linux-2.0-libc6-i386-gcc2.95)
Range: npt=%s-
Range: npt=%s-
%s/streamid=1
%s/streamid=1
%s/streamid=0
%s/streamid=0
Transport: x-pn-tng/tcp;mode=play,rtp/avp/tcp;unicast;mode=play
Transport: x-pn-tng/tcp;mode=play,rtp/avp/tcp;unicast;mode=play
If-Match: %s
If-Match: %s
RealChallenge2: %s, sd=%s
RealChallenge2: %s, sd=%s
Title: %s
Title: %s
Copyright: %s
Copyright: %s
Author: %s
Author: %s
real: Content-length for description too big (> %uMB)!
real: Content-length for description too big (> %uMB)!
Require: com.real.retain-entity-for-setup
Require: com.real.retain-entity-for-setup
SupportsMaximumASMBandwidth: 1
SupportsMaximumASMBandwidth: 1
Bandwidth: %u
Bandwidth: %u
Challenge1: %s
Challenge1: %s
hash output: %x %x %x %x
hash output: %x %x %x %x
hash input: %x %x %x %x
hash input: %x %x %x %x
stream=%u;rule=%u,
stream=%u;rule=%u,
Illegal character '%c' in input.
Illegal character '%c' in input.
1.1.3
1.1.3
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
Corrupt JPEG data: found marker 0xx instead of RST%d
Corrupt JPEG data: found marker 0xx instead of RST%d
Warning: unknown JFIF revision number %d.d
Warning: unknown JFIF revision number %d.d
Corrupt JPEG data: %u extraneous bytes before marker 0xx
Corrupt JPEG data: %u extraneous bytes before marker 0xx
Inconsistent progression sequence for component %d coefficient %d
Inconsistent progression sequence for component %d coefficient %d
Unknown Adobe color transform code %d
Unknown Adobe color transform code %d
Obtained XMS handle %u
Obtained XMS handle %u
Freed XMS handle %u
Freed XMS handle %u
Unrecognized component IDs %d %d %d, assuming YCbCr
Unrecognized component IDs %d %d %d, assuming YCbCr
JFIF extension marker: RGB thumbnail image, length %u
JFIF extension marker: RGB thumbnail image, length %u
JFIF extension marker: palette thumbnail image, length %u
JFIF extension marker: palette thumbnail image, length %u
JFIF extension marker: JPEG-compressed thumbnail image, length %u
JFIF extension marker: JPEG-compressed thumbnail image, length %u
Opened temporary file %s
Opened temporary file %s
Closed temporary file %s
Closed temporary file %s
Ss=%d, Se=%d, Ah=%d, Al=%d
Ss=%d, Se=%d, Ah=%d, Al=%d
Component %d: dc=%d ac=%d
Component %d: dc=%d ac=%d
Start Of Scan: %d components
Start Of Scan: %d components
Component %d: %dhx%dv q=%d
Component %d: %dhx%dv q=%d
Start Of Frame 0xx: width=%u, height=%u, components=%d
Start Of Frame 0xx: width=%u, height=%u, components=%d
Smoothing not supported with nonstandard sampling ratios
Smoothing not supported with nonstandard sampling ratios
RST%d
RST%d
At marker 0xx, recovery action %d
At marker 0xx, recovery action %d
Selected %d colors for quantization
Selected %d colors for quantization
Quantizing to %d colors
Quantizing to %d colors
Quantizing to %d = %d*%d*%d colors
Quantizing to %d = %d*%d*%d colors
%4u %4u %4u %4u %4u %4u %4u %4u
%4u %4u %4u %4u %4u %4u %4u %4u
Unexpected marker 0xx
Unexpected marker 0xx
Miscellaneous marker 0xx, length %u
Miscellaneous marker 0xx, length %u
with %d x %d thumbnail image
with %d x %d thumbnail image
JFIF extension marker: type 0xx, length %u
JFIF extension marker: type 0xx, length %u
Warning: thumbnail image size does not match data length %u
Warning: thumbnail image size does not match data length %u
JFIF APP0 marker: version %d.d, density %dx%d %d
JFIF APP0 marker: version %d.d, density %dx%d %d
= = = = = = = =
= = = = = = = =
Obtained EMS handle %u
Obtained EMS handle %u
Freed EMS handle %u
Freed EMS handle %u
Define Restart Interval %u
Define Restart Interval %u
Define Quantization Table %d precision %d
Define Quantization Table %d precision %d
Define Huffman Table 0xx
Define Huffman Table 0xx
Define Arithmetic Table 0xx: 0xx
Define Arithmetic Table 0xx: 0xx
Unknown APP14 marker (not Adobe), length %u
Unknown APP14 marker (not Adobe), length %u
Unknown APP0 marker (not JFIF), length %u
Unknown APP0 marker (not JFIF), length %u
Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d
Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d
Unsupported marker type 0xx
Unsupported marker type 0xx
Failed to create temporary file %s
Failed to create temporary file %s
Unsupported JPEG process: SOF type 0xx
Unsupported JPEG process: SOF type 0xx
Cannot quantize to more than %d colors
Cannot quantize to more than %d colors
Cannot quantize to fewer than %d colors
Cannot quantize to fewer than %d colors
Cannot quantize more than %d color components
Cannot quantize more than %d color components
Insufficient memory (case %d)
Insufficient memory (case %d)
Not a JPEG file: starts with 0xx 0xx
Not a JPEG file: starts with 0xx 0xx
Quantization table 0xx was not defined
Quantization table 0xx was not defined
Huffman table 0xx was not defined
Huffman table 0xx was not defined
Backing store not supported
Backing store not supported
Arithmetic table 0xx was not defined
Arithmetic table 0xx was not defined
Cannot transcode due to multiple use of quantization table %d
Cannot transcode due to multiple use of quantization table %d
Maximum supported image dimension is %u pixels
Maximum supported image dimension is %u pixels
Empty JPEG image (DNL not supported)
Empty JPEG image (DNL not supported)
Bogus DQT index %d
Bogus DQT index %d
Bogus DHT index %d
Bogus DHT index %d
Bogus DAC value 0x%x
Bogus DAC value 0x%x
Bogus DAC index %d
Bogus DAC index %d
Unsupported color conversion request
Unsupported color conversion request
Too many color components: %d, max %d
Too many color components: %d, max %d
Buffer passed to JPEG library is too small
Buffer passed to JPEG library is too small
JPEG parameter struct mismatch: library thinks size is %u, caller expects %u
JPEG parameter struct mismatch: library thinks size is %u, caller expects %u
Improper call to JPEG library in state %d
Improper call to JPEG library in state %d
Invalid scan script at entry %d
Invalid scan script at entry %d
Invalid progressive parameters at scan script entry %d
Invalid progressive parameters at scan script entry %d
Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d
Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d
Unsupported JPEG data precision %d
Unsupported JPEG data precision %d
Invalid memory pool code %d
Invalid memory pool code %d
Wrong JPEG library version: library is %d, caller expects %d
Wrong JPEG library version: library is %d, caller expects %d
Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c
Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c
DCT scaled block size %dx%d not supported
DCT scaled block size %dx%d not supported
Invalid component ID %d in SOS
Invalid component ID %d in SOS
NULL row buffer for row %ld, pass %d
NULL row buffer for row %ld, pass %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
Unknown zTXt compression type %d
Unknown zTXt compression type %d
gamma = (%d/100000)
gamma = (%d/100000)
gx=%f, gy=%f, bx=%f, by=%f
gx=%f, gy=%f, bx=%f, by=%f
wx=%f, wy=%f, rx=%f, ry=%f
wx=%f, wy=%f, rx=%f, ry=%f
incorrect gamma=(%d/100000)
incorrect gamma=(%d/100000)
%s: Cannot open
%s: Cannot open
%s: Write error at scanline %lu
%s: Write error at scanline %lu
%s: Seek error at scanline %lu
%s: Seek error at scanline %lu
%u: Sample out of range, max %u
%u: Sample out of range, max %u
%s: Cannot modify tag "%s" while writing
%s: Cannot modify tag "%s" while writing
%s: Unknown %stag %u
%s: Unknown %stag %u
%f: Bad value for "%s"
%f: Bad value for "%s"
%s: Invalid %stag "%s" (not supported by codec)
%s: Invalid %stag "%s" (not supported by codec)
TIFFVSetField ... pass by value not imp.
TIFFVSetField ... pass by value not imp.
%ld: Bad value for "%s"
%ld: Bad value for "%s"
%d: Bad value for "%s"
%d: Bad value for "%s"
Nonstandard tile length %d, convert file
Nonstandard tile length %d, convert file
Nonstandard tile width %d, convert file
Nonstandard tile width %d, convert file
Bad value %ld for "%s" tag ignored
Bad value %ld for "%s" tag ignored
%s: Invalid InkNames value; expecting %d names, found %d
%s: Invalid InkNames value; expecting %d names, found %d
TIFFVGetField ... pass by value not imp.
TIFFVGetField ... pass by value not imp.
Sorry, can not handle images with %d-bit samples
Sorry, can not handle images with %d-bit samples
Sorry, can not handle LogLuv images with %s=%d
Sorry, can not handle LogLuv images with %s=%d
Sorry, LogLuv data must have %s=%d or %d
Sorry, LogLuv data must have %s=%d or %d
Sorry, can not handle image with %s=%d
Sorry, can not handle image with %s=%d
Sorry, LogL data must have %s=%d
Sorry, LogL data must have %s=%d
Sorry, can not handle separated image with %s=%d
Sorry, can not handle separated image with %s=%d
Sorry, can not handle RGB image with %s=%d
Sorry, can not handle RGB image with %s=%d
Sorry, can not handle YCbCr images with %s=%d
Sorry, can not handle YCbCr images with %s=%d
Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d
Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d
Missing needed %s tag
Missing needed %s tag
Sorry, can not image with %d-bit samples
Sorry, can not image with %d-bit samples
"%s": Bad mode
"%s": Bad mode
Not a TIFF file, bad version number %d (0x%x)
Not a TIFF file, bad version number %d (0x%x)
Not a TIFF file, bad magic number %d (0x%x)
Not a TIFF file, bad magic number %d (0x%x)
%s: Out of memory (TIFF structure)
%s: Out of memory (TIFF structure)
Sample %d out of range, max %u
Sample %d out of range, max %u
Internal error, unknown tag 0x%x
Internal error, unknown tag 0x%x
Tag %d
Tag %d
%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu
%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu
%s: Read error at scanline %lu; got %lu bytes, expected %lu
%s: Read error at scanline %lu; got %lu bytes, expected %lu
%s: Seek error at scanline %lu, strip %lu
%s: Seek error at scanline %lu, strip %lu
%s: Data buffer too small to hold strip %lu
%s: Data buffer too small to hold strip %lu
%s: Read error on strip %lu; got %lu bytes, expected %lu
%s: Read error on strip %lu; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu
%s: Seek error at row %ld, col %ld, tile %ld
%s: Seek error at row %ld, col %ld, tile %ld
%s: Data buffer too small to hold tile %ld
%s: Data buffer too small to hold tile %ld
%s: No space for data buffer at scanline %ld
%s: No space for data buffer at scanline %ld
Compression scheme %u %s encoding is not implemented
Compression scheme %u %s encoding is not implemented
%s %s encoding is not implemented
%s %s encoding is not implemented
%s %s encoding is no longer implemented due to Unisys patent enforcement
%s %s encoding is no longer implemented due to Unisys patent enforcement
Compression scheme %u %s decoding is not implemented
Compression scheme %u %s decoding is not implemented
%s %s decoding is not implemented
%s %s decoding is not implemented
Compression algorithm does not support random access
Compression algorithm does not support random access
Bogus "%s" field, ignoring and calculating from imagelength
Bogus "%s" field, ignoring and calculating from imagelength
TIFF directory is missing required "%s" field, calculating from imagelength
TIFF directory is missing required "%s" field, calculating from imagelength
wrong data type %d for "%s"; tag ignored
wrong data type %d for "%s"; tag ignored
unknown field with tag %d (0x%x) encountered
unknown field with tag %d (0x%x) encountered
No space %s
No space %s
TIFF directory is missing required "%s" field
TIFF directory is missing required "%s" field
incorrect count for field "%s" (%lu, expecting %lu); tag ignored
incorrect count for field "%s" (%lu, expecting %lu); tag ignored
Error fetching data for field "%s"
Error fetching data for field "%s"
%s: Rational with zero denominator (num = %lu)
%s: Rational with zero denominator (num = %lu)
Cannot handle different per-sample values for field "%s"
Cannot handle different per-sample values for field "%s"
cannot read TIFF_ANY type %d for field "%s"
cannot read TIFF_ANY type %d for field "%s"
"%s": Information lost writing value (%g) as (unsigned) RATIONAL
"%s": Information lost writing value (%g) as (unsigned) RATIONAL
Error writing data for field "%s"
Error writing data for field "%s"
%s: Error writing SubIFD directory link
%s: Error writing SubIFD directory link
%s compression support is not configured
%s compression support is not configured
?%s: No space for LogLuv state block
?%s: No space for LogLuv state block
Inappropriate photometric interpretation %d for SGILog compression; %s
Inappropriate photometric interpretation %d for SGILog compression; %s
LogL16Decode: Not enough data at row %d (short %d pixels)
LogL16Decode: Not enough data at row %d (short %d pixels)
LogLuvDecode24: Not enough data at row %d (short %d pixels)
LogLuvDecode24: Not enough data at row %d (short %d pixels)
LogLuvDecode32: Not enough data at row %d (short %d pixels)
LogLuvDecode32: Not enough data at row %d (short %d pixels)
%s: No space for SGILog translation buffer
%s: No space for SGILog translation buffer
No support for converting user data format to LogL
No support for converting user data format to LogL
No support for converting user data format to LogLuv
No support for converting user data format to LogLuv
SGILog compression supported only for %s, or raw data
SGILog compression supported only for %s, or raw data
Unknown data format %d for LogLuv compression
Unknown data format %d for LogLuv compression
Unknown encoding %d for LogLuv compression
Unknown encoding %d for LogLuv compression
%s: No space for state block
%s: No space for state block
%s: Bad code word at scanline %d (x %lu)
%s: Bad code word at scanline %d (x %lu)
%s: %s at scanline %d (got %lu, expected %lu)
%s: %s at scanline %d (got %lu, expected %lu)
%s: Premature EOF at scanline %d (x %lu)
%s: Premature EOF at scanline %d (x %lu)
%s: No space for Group 3/4 reference line
%s: No space for Group 3/4 reference line
%s: No space for Group 3/4 run arrays
%s: No space for Group 3/4 run arrays
%s: Uncompressed data (not supported) at scanline %d (x %lu)
%s: Uncompressed data (not supported) at scanline %d (x %lu)
Fax SubAddress: %s
Fax SubAddress: %s
(%u = 0x%x)
(%u = 0x%x)
%suncompressed data
%suncompressed data
%sEOL padding
%sEOL padding
%s2-d encoding
%s2-d encoding
Improper JPEG sampling factors %d,%d
Improper JPEG sampling factors %d,%d
Apparently should be %d,%d,decompressor will try reading with sampling %d,%d
Apparently should be %d,%d,decompressor will try reading with sampling %d,%d
Improper JPEG strip/tile size, expected %dx%d, got %dx%d
Improper JPEG strip/tile size, expected %dx%d, got %dx%d
RowsPerStrip must be multiple of %d for JPEG
RowsPerStrip must be multiple of %d for JPEG
JPEG tile width must be multiple of %d
JPEG tile width must be multiple of %d
JPEG tile height must be multiple of %d
JPEG tile height must be multiple of %d
BitsPerSample %d not allowed for JPEG
BitsPerSample %d not allowed for JPEG
PhotometricInterpretation %d not allowed for JPEG
PhotometricInterpretation %d not allowed for JPEG
ThunderDecode: %s data at scanline %ld (%lu != %lu)
ThunderDecode: %s data at scanline %ld (%lu != %lu)
PackBitsDecode: discarding %d bytes to avoid buffer overrun
PackBitsDecode: discarding %d bytes to avoid buffer overrun
LZWDecode: Not enough data at scanline %d (short %d bytes)
LZWDecode: Not enough data at scanline %d (short %d bytes)
LZWDecode: Strip %d not terminated with EOI code
LZWDecode: Strip %d not terminated with EOI code
LZWDecode: Bogus encoding, loop in the code table; scanline %d
LZWDecode: Bogus encoding, loop in the code table; scanline %d
LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)
LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)
DumpModeDecode: Not enough data for scanline %d
DumpModeDecode: Not enough data for scanline %d
Horizontal differencing "Predictor" not supported with %d-bit samples
Horizontal differencing "Predictor" not supported with %d-bit samples
"Predictor" value %d not supported
"Predictor" value %d not supported
%u (0x%x)
%u (0x%x)
.PAVCOleException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
xfluoke.com
xfluoke.com
|Z|hXXp://VVV.ucbug.com|W|
|Z|hXXp://VVV.ucbug.com|W|
c:\%original file name%.exe
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
_^$###!$'
_^$###!$'
.Zfggfghfg_!!!$UX_]0
.Zfggfghfg_!!!$UX_]0
123456789
123456789
1, 0, 6, 6
1, 0, 6, 6
(*.*)
(*.*)
9.8.0.1
9.8.0.1
:admin@luokexf.com
:admin@luokexf.com
%original file name%.exe_348_rwx_010A0000_0003D000:
`.rsrc
`.rsrc
L$(h%f
L$(h%f
SSh0j
SSh0j
msctls_hotkey32
msctls_hotkey32
TVCLHotKey
TVCLHotKey
THotKey
THotKey
\skinh.she
\skinh.she
}uo,x6l5k%x-l h
}uo,x6l5k%x-l h
9p%s m)t4`#b
9p%s m)t4`#b
e"m?c&y1`Ã
e"m?c&y1`Ã
SetViewportOrgEx
SetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
EnumThreadWindows
EnumThreadWindows
EnumChildWindows
EnumChildWindows
`c%US.4/
`c%US.4/
!#$
!#$
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.UPX0
@.UPX0
`.UPX1
`.UPX1
`.reloc
`.reloc
f`c%US.
f`c%US.
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
USER32.dll
USER32.dll
SkinH_EL.dll
SkinH_EL.dll
1, 0, 6, 6
1, 0, 6, 6