Skip to main content

Gen.Variant.Strictor.29584_2006969609


HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Strictor.29584 (B) (Emsisoft), Gen:Variant.Strictor.29584 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.IEDummy.FD, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 20069696096089107067816004071bfd

SHA1: b733bc45b89e2b782e93155a0caaeb11740ed5f5

SHA256: 0918c983ce00c2002b91170e0810bcdf422b6e64827d24a7f9055b71e1715604

SSDeep: 24576:7NBaERO0P7v7vOi3FwV0vOVyNzKRBehm9dN3YvandAk hr7987A:7NBFVrLp3DOVsYs8dFYvanGVhr7r

Size: 2060288 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171

Company: no certificate found

Created at: 2015-05-24 08:23:11

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-PSW. Trojan program intended for stealing users passwords.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

attrib.exe:1884
attrib.exe:1692
attrib.exe:1208
attrib.exe:636
cacls.exe:612
cacls.exe:1976
cacls.exe:224
cacls.exe:1260
cacls.exe:592

The Trojan injects its code into the following process(es):

wscntmx.exe:1288
%original file name%.exe:1736

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process wscntmx.exe:1288 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\b.bat (255 bytes)
%System%\drivers\etc\hosts.ics (17013 bytes)
C:\a.bat (356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\cj[1].txt (4605 bytes)
%System%\drivers\etc\hosts (16478 bytes)

The process %original file name%.exe:1736 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\43881.tmp (15 bytes)
%System%\drivers\etc\protocol (799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\style[1].css (12015 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\game[1].htm (32375 bytes)
%System%\drivers\etc\networks (407 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso.hcjd56[2].txt (313 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\click[1].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\jiaqun[1].htm (254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\title-bg[1].jpg (1458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\bg[1].jpg (61672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\drivers\etc\lmhosts.sam (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso.hcjd56[1].txt (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\soso.hcjd56[1].htm (1199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\count1[1].gif (715 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (788 bytes)
%System%\drivers\etc\services (7 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\43881.tmp (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso.hcjd56[1].txt (0 bytes)

Registry activity

The process attrib.exe:1884 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 D2 58 95 FA 47 AB 73 0A A7 1C 10 44 95 B5 FE"

The process attrib.exe:1692 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 4E A5 D4 76 3B 69 E6 3F DE BE E1 C0 FD 7D E6"

The process attrib.exe:1208 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 A5 F0 9B 95 5A A2 CD 15 F5 D0 14 06 B9 60 F1"

The process attrib.exe:636 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 D5 31 63 D8 92 6B C8 C0 85 4D 96 EA AA 17 B6"

The process wscntmx.exe:1288 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF E4 EC 0D DB CE 28 1D 6C E1 5F DE 63 15 B7 94"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wscntmx" = "D:\\wscntmx.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1736 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 84 27 1F 6D BE 93 91 B2 8A 85 67 9A DD 8D F2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process cacls.exe:612 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 64 D6 8E 71 C3 6D B8 11 2E D4 5B ED C7 11 D4"

The process cacls.exe:1976 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 C6 69 F6 EF 92 B0 DA 63 21 D6 29 12 45 7D F9"

The process cacls.exe:224 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B 89 C8 FC 2B B0 E3 91 27 83 ED 82 CC 42 1C BD"

The process cacls.exe:1260 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 DD EE 42 0B 2C 29 7A 6E 2F CE AA A4 CD 4E 21"

The process cacls.exe:592 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 67 03 8C 79 5D 3B 46 B6 CE 9F 41 C8 BA A4 00"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 65537 bytes in size. The following strings are added to the hosts file listed below:

23.234.20.24www.gmbbk.cn
23.234.20.24www.180sf.net
23.234.20.24www.jielesh.com
23.234.20.24www2.9ozz.com
23.234.20.24t1.jscxmp.cn
23.234.20.24www.30tw.net
23.234.20.24zhaofu.520kq.com
23.234.20.24679pk.wudi.679pk.679pk.com
23.234.20.24wanfu.hy5166.com
23.234.20.24www2.9ozz.com
23.234.20.24www.tjits.cn
23.234.20.24www.cnewworld.com
23.234.20.24www.hzxhdj.com
23.234.20.24www.hbsme.gov.cn
23.234.20.24n55.xdjmall.cn
23.234.20.24xs8c8.kingsandqueens
23.234.20.2439vpj.btcqianbao.cn
23.234.20.24www.yonghui16.com
23.234.20.24www.mxmill.com
23.234.20.24www.jntc.nm.cn
23.234.20.24www.mishicq.com
23.234.20.24123.u432.com
23.234.20.24123.vvq13.com
23.234.20.24123.vvq14.com
23.234.20.24123.vvq15.com
23.234.20.24www.45730.com
23.234.20.2452145-118uc.fhough.com
23.234.20.24wvvw.58sf-9.com
23.234.20.24www.lywap.com
23.234.20.24a52145.jzs01.com
23.234.20.24z6.xfgzs.net
23.234.20.24www.tz-wd.com
23.234.20.24www.mt30.net
23.234.20.24wanfu.966ty.com
23.234.20.24www.st991.com
23.234.20.24988.pa579.com
23.234.20.245k.611739.com
23.234.20.24www1.vzhishu.com
23.234.20.24pk.memekr.com
23.234.20.24veletuan.com
23.234.20.24mir.qq.com
23.234.20.24h.081983.com
23.234.20.24www.118902.com
23.234.20.24www.yjxkj.com
23.234.20.24www.121578.com
23.234.20.24b.memekr.com
23.234.20.24www.k1f.net
23.234.20.24www.btzol.com
23.234.20.24z.icloud3g.com
23.234.20.24www.zhaosf.com.cn
23.234.20.24www.xr-1688.com
23.234.20.24679pk.679pk.com
23.234.20.24g.zhenhgw.com
23.234.20.24www2.memekr.com
23.234.20.24z.wgmtrade.com
23.234.20.24v.zhenhgw.com
23.234.20.24c.vbbse4.com
23.234.20.24www1.memekr.com
23.234.20.24www.kfb126.com
23.234.20.24huikaimin.blog.163.com
23.234.20.24k.memekr.com
23.234.20.24p.veletuan.com
23.234.20.24c.btg55.com
23.234.20.24v.cpjp737.com
23.234.20.24www.agou920.com
23.234.20.24first.cpjp737.com
23.234.20.24c.veletuan.com
23.234.20.24head.memekr.com
23.234.20.24g.veletuan.com
23.234.20.24g.zhenhgw.com
23.234.20.24v.cpjp737.com
23.234.20.24s.vzhishu.com
23.234.20.24memekr.com
23.234.20.24v.zhenhgw.com
23.234.20.24c.vbbse4.com
23.234.20.24k.memekr.com
23.234.20.24p.veletuan.com
23.234.20.24www.schzhp.cn
23.234.20.24memekr.com
23.234.20.24www.jlwfbdc.com
23.234.20.24t.vzhishu.com
23.234.20.248.zhenhgw.com
23.234.20.24www.210cq.com
23.234.20.24z.veletuan.com
23.234.20.241.zhenhgw.com
23.234.20.24y.vzhishu.com
23.234.20.24www.680sf.com
23.234.20.24www.81945.com
23.234.20.24www.45574.com
23.234.20.24680sf.com
23.234.20.2481945.com
23.234.20.2445574.com
23.234.20.24c.cpjp737.com
23.234.20.24lm.363.com
23.234.20.24v.wxyxe.com
23.234.20.24www.ahzttz.com
23.234.20.24xup.88448.com
23.234.20.24www.88448.com
23.234.20.24www.aaastor.com
23.234.20.24www.delos-lighting.com
23.234.20.24www.tlwz.org
23.234.20.24www.zddiu.com
23.234.20.24www.monthidc.com
23.234.20.24www.chinawlf.com
23.234.20.24www.blueanimalbio.com
23.234.20.24www.dfac.com
23.234.20.24www.glzyz.com
23.234.20.24www.hxsiyuan.cn
23.234.20.24www.wohuixue.com
23.234.20.24wvw.1234pk.com
23.234.20.241234pk.com
23.234.20.24www.nc334yy.com
23.234.20.24www.cqjztc.com
23.234.20.24www.cdsdsy.net
23.234.20.24www.cjfans.com
23.234.20.24www.jsfoundry.com
23.234.20.24www.handanyz.com
23.234.20.24www.lingxiao.com.cn
23.234.20.24www.jfpgs.com
23.234.20.24hjc.bingdaofz.com
23.234.20.24www.romanting.com
23.234.20.24dns.ic123.cc
23.234.20.24ad.036yx.com
23.234.20.24www.lingxiao.com.cn
23.234.20.24www.hwxxkj.com
23.234.20.24www.ypdzkj.com
23.234.20.24www.starworldhk.com
23.234.20.24www.nfgt.com
23.234.20.24v.vzhishu.com
23.234.20.248.zhenhgw.com
23.234.20.24www.blgmj.com
23.234.20.24www.962sf.com
23.234.20.24www.bingdaofz.com
23.234.20.24bingdaofz.com
23.234.20.24zhaof.icloud3g.com
23.234.20.24www.326sf.com
23.234.20.24www.813sf.com
23.234.20.24www.45chuanqi45.com
23.234.20.24www.1213sf.com
23.234.20.24g.zhenhgw.com
23.234.20.24as.xfgzs.net
23.234.20.24b.memekr.com
23.234.20.24n.veletuan.com
23.234.20.24cdn.9377t.com
23.234.20.24v.memekr.com
23.234.20.24www.dnkbl.com
23.234.20.246.zhenhgw.com
23.234.20.24j.cpjp737.com
23.234.20.241.veletuan.com
23.234.20.24www.sjcjlb.cn
23.234.20.24p.cpjp737.com
23.234.20.24p.cpjp737.com
23.234.20.24zhaof1.wgmtrade.com
23.234.20.24www.xinjiasu.com
23.234.20.24www.jwbjc.com
23.234.20.24www.mmgyz.net
23.234.20.24i.611739.com
23.234.20.24www.eggtt.com
23.234.20.24www.gm635.com
23.234.20.24k.7it7.com
23.234.20.24www.zizhixuke.com
23.234.20.24www.nfgt.com
23.234.20.24www.mmgyz.net
23.234.20.24www.ku30.com
23.234.20.24ku30.com
23.234.20.24f.081983.com
23.234.20.247.081983.com
23.234.20.24www.chuge8.com
23.234.20.24www.wanms.com
23.234.20.241.kitefeung.com
23.234.20.241.liaochengjiayuan.com
23.234.20.24www.foodzhan.com
23.234.20.24eggtt.com
23.234.20.24www.915youxi.com
23.234.20.24915youxi.com
23.234.20.24d.131f.com
23.234.20.24y.118902.com
23.234.20.241.7it7.com
23.234.20.24www.91wanfu.com
23.234.20.2491wanfu.com
23.234.20.24www.quwanfu.com
23.234.20.24quwanfu.com
23.234.20.24www.91wuc.com
23.234.20.24www.zhaosf.com
23.234.20.24www.gykailijx.com
23.234.20.24q.611739.com
23.234.20.24www.588by.com
23.234.20.24duang.5com.cc
23.234.20.2491wuc.com
23.234.20.24www.sy170.com
23.234.20.24tzlsofa.com
23.234.20.24www.tzlsofa.com
23.234.20.24k.v58d.com
23.234.20.24www.119021.com
23.234.20.24121578.com
23.234.20.24www.cq7373.com
23.234.20.24ht.80honey.com
23.234.20.24www.hongbzn.com
23.234.20.24www.cfbingyue.cc
23.234.20.24www.zgjingyi.com
23.234.20.24youxi.036yx.com
23.234.20.24www.wxboao.com
23.234.20.24jh.j550.com
23.234.20.2433ok.com
23.234.20.24www.52zhaosf.com
23.234.20.2452zhaosf.com
23.234.20.24www.zhaosf123.co
23.234.20.24www.455151.com
23.234.20.24455151.com
23.234.20.24www.zhaosf.at
23.234.20.24zhaosf.cc
23.234.20.24www.zhaosf.cc
23.234.20.24www.zhaosf.org.cn
23.234.20.24www.mcjd.net
23.234.20.24z.611739.com
23.234.20.24www.911wanwan.com
23.234.20.24www.517zg.com
23.234.20.24www.dju8.com
23.234.20.24www.kfb163.com
23.234.20.24www.7t57.com
23.234.20.2433ok.cm
23.234.20.24www.33ok.com
23.234.20.24www1.33ok.com
23.234.20.24www2.33ok.com
23.234.20.24www3.33ok.com
23.234.20.24www4.33ok.com
23.234.20.24www.520mc.cn
23.234.20.24x.118902.com
23.234.20.24www.2kfb.com
23.234.20.24www.mcjiuju.cn
23.234.20.24zgjingyi.com
23.234.20.24aaa.xu98.com
23.234.20.24pk05.90523.com
23.234.20.24www.chasf.com
23.234.20.249.611739.com
23.234.20.24m.611739.com
23.234.20.24k.118902.com
23.234.20.24www.338mu.com
23.234.20.24first.611739.com
23.234.20.24p.081983.com
23.234.20.24www.sxrdwy.com
23.234.20.24happy.118902.com
23.234.20.24sxrdwy.com
23.234.20.24www.zhxsjc.com
23.234.20.24zhxsjc.com
23.234.20.24bg.118902.com
23.234.20.24www.234wy.com
23.234.20.24ku.081983.com
23.234.20.24www.1000q.com
23.234.20.241000q.com
23.234.20.24vip.h1995.com
23.234.20.24www.1745.com
23.234.20.24www.hzmeixin.com
23.234.20.24hzmeixin.com
23.234.20.24g.mt30.net
23.234.20.24www.miehunsha.com
23.234.20.24miehunsha.com
23.234.20.24www.miehunwg.com
23.234.20.24miehunwg.com
23.234.20.24www.qdcyrc.com
23.234.20.24www.180sf.net
23.234.20.24www.zhengzhouzp.cn
23.234.20.24pd.mt30.net
23.234.20.24j.118902.com
23.234.20.24n.611739.com
23.234.20.24www.988wanwan.com
23.234.20.24www.909wanwan.com
23.234.20.24www.999wanwan.com
23.234.20.24www.57ab.com
23.234.20.24kh.mt30.net
23.234.20.24zhaof.ctc0.com
23.234.20.24kd.611739.com
23.234.20.24www.456yx.com
23.234.20.24456yx.com
23.234.20.24www.3355sf.com
23.234.20.24xx.611739.com
23.234.20.243355sf.com
23.234.20.24www.3355sf.com
23.234.20.24ee.mt30.net
23.234.20.24tb.25jx.net
23.234.20.24ko.u25u.com
23.234.20.24hc.25jx.net
23.234.20.24kk.u25u.com
23.234.20.24y.611739.com
23.234.20.24co.118902.com
23.234.20.24stat.5pk.com
23.234.20.24sk.081983.com
23.234.20.24ee.mt30.ne
23.234.20.24bdtg.37.com
23.234.20.24v.61173f9.com
23.234.20.24to.118902.com
23.234.20.24www.dfsj521.com
23.234.20.24a.118902.com
23.234.20.24x.081983.com
23.234.20.24jc.mt30.net
23.234.20.24www.vis752.com
23.234.20.24dd.yang868.com
23.234.20.24baidu.pk05.com
23.234.20.24zhaof.3737wyx.cn
23.234.20.24www.5336.com
23.234.20.24www.kaifu1.com
23.234.20.24a.611739.com
23.234.20.24cx.j550.com
23.234.20.24www.st945.com
23.234.20.24st945.com
23.234.20.246x.u25u.com
23.234.20.249kk.wd258.com
23.234.20.24kx.u25u.com
23.234.20.24bx.25jx.net
23.234.20.24www.chengdongsteel.com
23.234.20.24ss.u25u.com
23.234.20.24ye.25jx.net
23.234.20.24pk.j550.com
23.234.20.247s.u25u.com
23.234.20.24ss.u25u.com
23.234.20.24p.u25u.com
23.234.20.24x.j550.com
23.234.20.24nl.25jx.net
23.234.20.24sw.u25u.com
23.234.20.245.25jx.net
23.234.20.249.k1f.net
23.234.20.249k2.wd258.com
23.234.20.24www.9377b.com
23.234.20.24www.5ding.com
23.234.20.24www.lyh23.com
23.234.20.24x.25jx.net
23.234.20.24cc.u25u.com
23.234.20.24tg.95k.com
23.234.20.24www.bjwcl.com
23.234.20.24www.9377o.com
23.234.20.24bdtg.9377e.com
23.234.20.24bbs.121210.com
23.234.20.24121210.com
23.234.20.24www.121210.com
23.234.20.24g.02qu.com
23.234.20.246.u25u.com
23.234.20.24bbs.wg78.com
23.234.20.24wg78.com
23.234.20.24f.25jx.net
23.234.20.24y.j550.com
23.234.20.241.nanyang2012.com
23.234.20.24sx.fans8979.com
23.234.20.24d.416191.com
23.234.20.24vip.h1995.com
23.234.20.24youxi.baidu.com
23.234.20.24d.k1f.net
23.234.20.24dd.yang898.com
23.234.20.24dd.yang858.com
23.234.20.24www.daishichuchen.com
23.234.20.24www.yzshule.com
23.234.20.24fb.98zsjm.com
23.234.20.24www.hqa.cn.com
23.234.20.24www.zx-cj.com
23.234.20.24www.628552.com
23.234.20.24y.02qu.com
23.234.20.24d.416191.com
23.234.20.24www.sith.cc
23.234.20.24www.9377t.com
23.234.20.24www.tianxiang-intl.com
23.234.20.24www.yn30.com
23.234.20.241.bzhtwqx.com
23.234.20.24www.zzhttex.com
23.234.20.24haocq.131sf.com
23.234.20.24zhaof.aassdd.net
23.234.20.24zhaof.98zslc.com
23.234.20.24zhaof.youxizx.net
23.234.20.24www.300sf.com
23.234.20.24www.45uc.com
23.234.20.24www.chasf.com
23.234.20.24999.wd258.com
23.234.20.24yyy.wd258.com
23.234.20.24go.sf999.com
23.234.20.24www.haost.com
23.234.20.241.hhyouxi.net
23.234.20.24cq.98zslc.com
23.234.20.24www.112fu.com
23.234.20.24www.kaiqu.com
23.234.20.241.youxizx.net
23.234.20.24www.777sf.com
23.234.20.24www.hdjddl.com
23.234.20.24112fu.huashengshipin.com
23.234.20.2458sf.58sf-1.com
23.234.20.24www.yx19.com
23.234.20.24www.yx31.com
23.234.20.24dn.67cx.com
23.234.20.24t.u25u.com
23.234.20.24w.hsdbm.com
23.234.20.24dd.yang808.com
23.234.20.24iwan.baidu.com
23.234.20.24www.83cq.com
23.234.20.241.aassdd.net
23.234.20.24www.hfhybjgs.com
23.234.20.24www.haoqj.com
23.234.20.24www.haojuezhan.com
23.234.20.24www.zskunshang.com
23.234.20.24a.mt30.net
23.234.20.24www.377f.com
23.234.20.24t.25jx.net
23.234.20.24d.be-real.cn
23.234.20.24d.diaoyiyuan.cn
23.234.20.24www.xlmqt.com
23.234.20.24www.528day.com
23.234.20.24www.789zt.com
23.234.20.246.shangwanghui.com
23.234.20.241.shangwanghui.com
23.234.20.24yx.minyouxi.com
23.234.20.241.678bigfoot.com
23.234.20.2445uc.0731gfang.com
23.234.20.24d.baidudiyi.net
23.234.20.24u1.yhwl88.net
23.234.20.24www.9945.com
23.234.20.24www.23u.com
23.234.20.24www.haofu.com
23.234.20.24www.sf184.com
23.234.20.24www.sfw.com
23.234.20.24tg.applx85.com
23.234.20.24aa.liaochengjiayuan.com
23.234.20.24ht.v58d.com
23.234.20.2445uc.pf8898.com
23.234.20.2461.115163.com
23.234.20.24haocq.0553dx.com
23.234.20.24d.baidudiyi.net
23.234.20.241.baidudiyi.net
23.234.20.2411.baidudiyi.net
23.234.20.24www.hycartoon.com
23.234.20.246.115163.com
23.234.20.24www.sybnzh.cn
23.234.20.24aa.kitefeung.com
23.234.20.2411s.pf8898.com
23.234.20.241.mt30.net
23.234.20.24www.snzad.com
23.234.20.24www.uq2558.com
23.234.20.24www.hada5688.com
23.234.20.24www.zzctech.com
23.234.20.24www.kf521.com
23.234.20.24ss99.927wz.com
23.234.20.24zhaocq.aassdd.net
23.234.20.24haocq.youxizx.net
23.234.20.24160uc.600co.com
23.234.20.24fa.oz9es.com
23.234.20.24nx.5cn.cc
23.234.20.24889tt.d3yy.cn
23.234.20.24vip.jzc123.com
23.234.20.24www.oryin.com
23.234.20.24776tt.d3yy.cn
23.234.20.24www.meihaomianjia.com
23.234.20.24www.zgr999.com
23.234.20.24www.yxzhaofu.com
23.234.20.24pk6666.isitestar.cn
23.234.20.24www.lwmoyu.com
23.234.20.24www.pk515.com
23.234.20.24www.uc277.com
23.234.20.24www.uc828.com
23.234.20.24885ok.52fanfou.com
23.234.20.24www.pk05.com
23.234.20.243355t.jybz66.com
23.234.20.24www.134p.com
23.234.20.2488pkdxy.plpl123.com
23.234.20.24rt.5cn.cc
23.234.20.24www.521jjj.com
23.234.20.24www.wst86.cn
23.234.20.241199t.kao77.com
23.234.20.246677y.szxmmw.com
23.234.20.24www.weilai99.com
23.234.20.24zhaocq.98zslc.com
23.234.20.24lk.yhwl88.net
23.234.20.249911.9zph.com
23.234.20.24z.67cx.com
23.234.20.24www.longyi-group.com
23.234.20.24www.genehi.com
23.234.20.24www.362g.com
23.234.20.24www.3sbl.net
23.234.20.24www.herbalife888.cn
23.234.20.24ns.78lc.net
23.234.20.24dd.guidawang.com
23.234.20.243355t.jybz66.com
23.234.20.24www.sf123uu.com
23.234.20.241.25jx.net
23.234.20.24xd.qicaimofang.com
23.234.20.24www.sz-lb.com
23.234.20.24www.zo6knln.com
23.234.20.24www.o68js.com
23.234.20.24pk789a.52fanfou.com
23.234.20.24zhaocq.700uc.com
23.234.20.24www.06954.com
23.234.20.24168tg.psc8.com
23.234.20.24www.69945.com
23.234.20.24160uc.600co.com
23.234.20.24www.09846.com
23.234.20.2488pkjx.mei12a.com
23.234.20.24www.xhtk.net
23.234.20.24www.45569.com
23.234.20.24www.njzs58.com
23.234.20.248pk.mei12a.com
23.234.20.2488pkh1.kkk21sd.com
23.234.20.2488pkdxw.mei12a.com
23.234.20.2488pkdxy.mei12a.com
23.234.20.24www.anansf.com
23.234.20.24www.haowz.com
23.234.20.24999.23dpw.com
23.234.20.24st.scdcyb.com
23.234.20.24xs.qicaimofang.com
23.234.20.24zhaosf.2866101.com
23.234.20.24www.jyjyh.com
23.234.20.24www.zhaohuajx.com
23.234.20.24www.8iss.com
23.234.20.24www.jnlvjie.com
23.234.20.24sf123.21daikuan.com
23.234.20.24zhaosf.2866101.com
23.234.20.24tuiguang.8iss.com
23.234.20.24tuiguang.8msm.com
23.234.20.24fe.yueworld.net
23.234.20.24920aa.changyc.com
23.234.20.24xb.qicaimofang.com
23.234.20.24www.yx003.com
23.234.20.24www1.pkokok.com
23.234.20.24cz.yueworld.net
23.234.20.24tuiguang.muu9.com
23.234.20.24haosf.98zsjm.com
23.234.20.24www.75945.com
23.234.20.24www.lpf010.com
23.234.20.24www.6000pk.com
23.234.20.249pk.2766161.com
23.234.20.24www.zhaof7.com
23.234.20.24www.cqhr.org
23.234.20.24www.ddzhe.com
23.234.20.24pk789.52fanfou.com
23.234.20.24160uc.com
23.234.20.24www.1nhh.com
23.234.20.24www.52sol.com
23.234.20.24www.cpu500.com
23.234.20.24www.2381sfcq.com
23.234.20.24www.uc37.com
23.234.20.24www.98pk97.com
23.234.20.24www.hbcyly.com
23.234.20.24haosf.lfweibo.com
23.234.20.24cq.kgfanli.com
23.234.20.24www.999yc.com
23.234.20.24www1.jjj.com
23.234.20.24zhaosf.acrmbs.com
23.234.20.24www.uc900.com
23.234.20.24www2.jjj.com
23.234.20.24www3.jjj.com
162.211.182.31711ok.zz135.com
23.234.20.24w13518.hr.jw.tczj.net
23.234.20.24zhaofu7.com
23.234.20.24tuiguang.592097.com
23.234.20.24v.yueworld.net
23.234.20.24zhaosf.ofyn.net
23.234.20.24dk.qicaimofang.com
23.234.20.24578101.com
23.234.20.24www.578101.com
23.234.20.24www.126disk.com
23.234.20.24tui99.592097.com
23.234.20.24tui99.8msm.com
23.234.20.24dd.guidawang.com
23.234.20.24bb.fushilu.com
23.234.20.24www.zhaofu7.com
23.234.20.24www.baiduzhaokf.com
23.234.20.24www.haosf.com
23.234.20.24www.jsl-cn.com
23.234.20.24www.88858.com
23.234.20.24www.heshilurong.com
23.234.20.24www.168fm.com
23.234.20.24www.artobrain.com
23.234.20.24wwv.jb345.com
23.234.20.24www.zhaosf9999.com
23.234.20.24www.uc1000.com
23.234.20.24www4.jjj.com
23.234.20.24www.uc900.com
23.234.20.24www.uc900.com
23.234.20.24www.cctv-kowann.com
23.234.20.24www5.jjj.com
23.234.20.24www.artobrain.com
23.234.20.24www.jxytqz.com
23.234.20.24www.as9z.com
23.234.20.24pk789.52fanfou.com:81
23.234.20.2436cq.dg8681.com:3636
23.234.20.24www.444yx.com
23.234.20.24www.993yx.com
23.234.20.24jjj.com
23.234.20.24www1.99s.com
23.234.20.24www2.99s.com
23.234.20.2499s.com
23.234.20.24www99s.com
23.234.20.24www.uc1000.com
23.234.20.242410.eodfmr.cn
23.234.20.24www.www99s.com
23.234.20.24www.woool99s.com
23.234.20.24www3.99s.com
23.234.20.249k1.pa579.com
23.234.20.24new.fa111.com
23.234.20.24www4.99s.com
23.234.20.24www5.99s.com
23.234.20.24www.09445.com
23.234.20.24www.cdxxzs.com
23.234.20.24www.angelsimple.cn
23.234.20.24www.lida00.cn
23.234.20.24www.zbzishen.com
23.234.20.24www.86jiewang.cn
23.234.20.24www.itcr.cn
23.234.20.24www.99u.net.ru
23.234.20.24www.wan345.com
23.234.20.24www.525uc.com
23.234.20.24www.1cq.com
23.234.20.24www.jjj.com
23.234.20.24www.99s.com
23.234.20.24www.gm005.com
23.234.20.24www.68kf.com
23.234.20.24wwk.astbw.com
23.234.20.24zz.sf163.com
23.234.20.24www.sotrip.com
23.234.20.2433k.pa579.com
23.234.20.24www.555sf.com
23.234.20.24www.66hst.com
23.234.20.2466hst.com
23.234.20.24www.xin45.com
23.234.20.24xin45.com
23.234.20.24www.zhaocq.com
23.234.20.241.52yanzheng.sinaapp.com
23.234.20.24www.175sf.com
23.234.20.24www.yxyhx.com
23.234.20.24www.168fm.com
23.234.20.24habourbiotech.com
23.234.20.24www.pydwlm.com
23.234.20.24www.ux99.com
23.234.20.24www.hn17173.net
23.234.20.24www.5s98.com
23.234.20.24www.880s.com
23.234.20.24www.118uc.com
23.234.20.24www.zf777.com
23.234.20.2481.2381f.com
23.234.20.24www.njkaidu.com
23.234.20.24www.9szf.com
23.234.20.24www.999zsf.com
23.234.20.24www.85zf.com
23.234.20.24www.951pk.com
23.234.20.24www.851pk.com
23.234.20.24988.pa579.com
23.234.20.24ad.97uu.com
23.234.20.24www.i8pk.com
23.234.20.24www.sf996.com
23.234.20.24www.0579st.com
23.234.20.24www.mc1314.com
23.234.20.24gm016.comforum.php
23.234.20.24www.whsfzx.com
23.234.20.24dd.sh-tongy.com
23.234.20.24111.kaihu365.com
23.234.20.24www.dddgm.com
23.234.20.24www.ok126.net
23.234.20.24www.wanshituliao.com
23.234.20.24www.zaxue.net
23.234.20.24www.4006517008.com
23.234.20.24www.tcrhy.com
23.234.20.24www.vdisk.cnyy6018
23.234.20.24www.sf383.com
23.234.20.24www.001gm.net
23.234.20.24www.006it.com
23.234.20.24www.gm5555.com
23.234.20.24www.yxyhx.com
23.234.20.24www.3jidi-gz.com
23.234.20.24www.100gczg.com
23.234.20.24haosf.lgknow.com
23.234.20.24habourbiotech.com
23.234.20.24www.satsalt.com
23.234.20.24tg1.37.com
23.234.20.24pi.nuwa-mountain.org
23.234.20.24www.jafdc.net
23.234.20.24www.5iwowo.com
23.234.20.24www.bonopt.com
23.234.20.24www.jzdkfj.com
23.234.20.24henuedu.cn
23.234.20.24www.sdjialiang.com
23.234.20.24www.10010cq.com
23.234.20.24www.z0137cx.comkwcs
23.234.20.24www.0512rc.net
23.234.20.24www.dahanjg.com
23.234.20.24www.ht-vision.com
23.234.20.24www.3159wine.com
23.234.20.24www.jfy8rv.comzjp6bw
23.234.20.24www.yxyhx.com
23.234.20.24www.9uzg.com
23.234.20.24www.gm667.com
23.234.20.24www.znspyq.com9dzf7w
23.234.20.24www.18-81.net
23.234.20.24www.ht-vision.com
23.234.20.24www.gmwly.com
23.234.20.24user.qzone.qq.com5674167
23.234.20.24t.qq.comchuanqisf8997
23.234.20.24www.njjqgck.com
23.234.20.24www.hkalu.com
23.234.20.24www.60sf.com
23.234.20.24www.pk123.com
23.234.20.24www.52anzu.com
23.234.20.24www1.52anzu.com
23.234.20.2452anzu.com
23.234.20.24www.wf22.com
23.234.20.24xingyoufz.wwpan.com
23.234.20.24www.36ok.com
23.234.20.24www.32fa.com
23.234.20.24wws.99acc.com
23.234.20.24www.916cq.com
23.234.20.241711ok.sh77577.com
23.234.20.24www.18uc.com
23.234.20.2418uc.com
23.234.20.2488pk.com
23.234.20.24www.88pk.com
23.234.20.24162.212.180.86
23.234.20.2436ok.com
23.234.20.24118.99.26.156
23.234.20.2423.234.60.34
23.234.20.24www.52anzu.net
23.234.20.24www.77250.com
23.234.20.2477250.com
23.234.20.24www1.52anzu.net
23.234.20.24tt.1kuv.com
23.234.20.24www.33ok.com
23.234.20.24916cq.com
23.234.20.2491ww.91fu.com
23.234.20.24www1.pk777.com
23.234.20.24www.sf999.com
23.234.20.24www.yeahooo.net
23.234.20.241.townhall.cn
23.234.20.24www.bjjijiubao.com
23.234.20.241.xa1314.com.cn
23.234.20.24www.yvwtjf.com
23.234.20.24www.stylepacking.com
23.234.20.24www.cnfengye.com
23.234.20.24www.zazgame.com
23.234.20.24www.zrplay.com
23.234.20.24www.yczdwj.com
23.234.20.24www.zheyutegang.com
23.234.20.24www.sf123.com
23.234.20.24www.daqiandoor.com
23.234.20.24www.77d8.com
23.234.20.24www.3159wine.com
23.234.20.24www.wwesf.com
23.234.20.24www.7988ok.com
23.234.20.24www.shfengyi.com
23.234.20.24pg.iflu.com.cn
23.234.20.24www.gdtrane.com
23.234.20.24www.scxlm.com
23.234.20.24www.kisspk.com
23.234.20.24www.cqxz.com.cn
23.234.20.24www.kanonsh.com
23.234.20.24www.gm1208.com
23.234.20.24www.provoxav.com
23.234.20.24dgdimei.com
23.234.20.24www.cntzdh.com
23.234.20.24www.hanwise.com
23.234.20.24www.mfttj.com
23.234.20.24www.shenqi.com
23.234.20.24www.52345.com
23.234.20.2481f.hao899.com
23.234.20.24www.sf123.com
23.234.20.24www.3159wine.com
23.234.20.24www.daqiandoor.com
23.234.20.242sogo.com
23.234.20.24mobanbbs.com
23.234.20.2491ww.555uc.com
23.234.20.24www.99j.com
23.234.20.24www.91ww.com
23.234.20.24www.777uc.com
23.234.20.24www.xbkdq.com
23.234.20.2466sf.77zhao.com
23.234.20.24www.184pk.com
23.234.20.24www.sf999.com
23.234.20.24www.pk777.com
23.234.20.24www.alfatoyota.com
23.234.20.24mobanbbs.com
23.234.20.24www.stbshg.com
23.234.20.24www.daqiandoor.com
23.234.20.24www.1cq.com
23.234.20.24www.xbkdq.com
23.234.20.24www.sf123.com
23.234.20.24www.3159wine.com
23.234.20.24www.buyishijia.com
23.234.20.24www.sf999.com
23.234.20.24www.shenqi.com
23.234.20.24www.52345.com
23.234.20.24www.92045.com
23.234.20.24www.926.com
23.234.20.24www.99j.com
23.234.20.24www.945pk.com
23.234.20.248uc.haosf33.com
23.234.20.24www.91ww.com
23.234.20.24www.8uu.com
23.234.20.2481f.hao883.com
23.234.20.2481f.hao979.com
23.234.20.2481f.hao899.com
23.234.20.24www.81f.com
23.234.20.24www.nihao119.com
23.234.20.24www.66sf.com
23.234.20.24kkkfu.sylytz.com
23.234.20.2483aa.sf078.com
23.234.20.24521fu.9173uc.com
23.234.20.24www.777uc.com
23.234.20.24www.pk777.com
23.234.20.24www.30ok-1.com
23.234.20.24www.haocq.com
23.234.20.24www.1000ok.com
23.234.20.24wvw.rq23.com
23.234.20.24wvw.2013wan.com
23.234.20.24wvw.9377z.com
23.234.20.24mmm.wopaijs.com
23.234.20.24www.yyy279.com
23.234.20.24wvw.9377s.com
23.234.20.24www.zhujiutx.com
23.234.20.24www.hbwxkj.com
23.234.20.24www.sh-chengshan.com
23.234.20.24zhaosfcq.com
23.234.20.24www.subpig.net
23.234.20.24www.jlzcfx.com
23.234.20.24www.66sf.com
23.234.20.24www.cdxxlh.com
23.234.20.24www.83uc.com
23.234.20.24www.shjwd.com
23.234.20.24www.jingming-sh.com
23.234.20.24www.aerosun.cn
23.234.20.24www.qdhd.com.cn
23.234.20.24www.flyxg.com
23.234.20.24www.zggljt.com
23.234.20.24www.99mc.com
23.234.20.24www.138zg.com
23.234.20.24www.523zg.com
23.234.20.24www.98zg.com
23.234.20.24www.78zg.cn
23.234.20.24www.99ting.cn
23.234.20.24www.27zg.com
23.234.20.24www.92sanduo.com
23.234.20.24www.527zg.com
23.234.20.24www.xstylxx.com
23.234.20.24www.xrsd-water.com
23.234.20.24www.tttjsq.com
23.234.20.24www.y1995.com
23.234.20.24www.883sf.com
23.234.20.24sf123.com
23.234.20.24changjing.759rsq.com
23.234.20.24xinqing.kqgf69.com
23.234.20.24www.xahdc.com
23.234.20.24www.haotl.com
23.234.20.24www.chinajin-hui.com
23.234.20.24www.fullkang.net.com
23.234.20.24tanxian.u895.com
23.234.20.24www.m526.com
23.234.20.24www.majorsoul.com
23.234.20.24changjing.pbbxy.com
23.234.20.24sf225.com
23.234.20.24www.haosf.com
23.234.20.24www.tcrhy.com
23.234.20.24www.001gm.net
23.234.20.24cqdl321.com
23.234.20.24www.b9jojo.com
23.234.20.24www.9kf.com
23.234.20.24www.sf138.com
23.234.20.24www.628118.com
23.234.20.24www.hezol.com
23.234.20.24www.qjkutrgw.com
23.234.20.24www.ashijia.com
23.234.20.24www.1200sf.com
23.234.20.24www.aarongj.com
23.234.20.24www.53my.com
23.234.20.24www.888cnc.com
23.234.20.24www.sf3000.com
23.234.20.24www.29u.in
23.234.20.24www.96sf.com
23.234.20.24www.3159wine.com
23.234.20.24www.sf800.com
23.234.20.24www.77mxd.com
23.234.20.24www.9uzg.com
23.234.20.24www.sf999.com.ru
23.234.20.24www.szmajsy.com
23.234.20.24www.jptea.cn
23.234.20.24www.cqpk11.com
23.234.20.24www.insdfjisd.com
23.234.20.24www.828kk.com
23.234.20.24www.irrchina.com
23.234.20.24www.22nf.com
23.234.20.24www.jiutianzs.com
23.234.20.24www.103la.com
23.234.20.24www.889ok.com
23.234.20.24huanshou.8236r.com
23.234.20.24www.1129f.com
23.234.20.24345ye.861sf.com
23.234.20.24www.861sf.com
23.234.20.24861sf.com
23.234.20.24www.sf985.com
23.234.20.24www.bonopt.com
23.234.20.24cq45.cn
23.234.20.24www.cq45.cn
23.234.20.24www.bgdtw.com
23.234.20.24www.930t.com
23.234.20.24www.tianhuao.com
23.234.20.24www.99a.net.ru
23.234.20.24www.hmyigou.com
23.234.20.24www.fzjx.net
23.234.20.24www.ez-max.net
23.234.20.24www.zhuoranfm.com
23.234.20.24www.ccadly.net
23.234.20.24www.chinasysw.com
23.234.20.24www.dyjkdd.com
23.234.20.24www.cnbaoerte.com
23.234.20.24www.sf895.com
23.234.20.24www.joywei.com
23.234.20.24www.yalincs.com
23.234.20.24www.kkstar.com
23.234.20.24www.949g.com
23.234.20.24www.zhaosf.com.co
23.234.20.24www.3000ok.com.cn
23.234.20.24n813.com
23.234.20.24uc88.com
23.234.20.24qu45.com
23.234.20.24www.aop9988.com
23.234.20.24www.sdytgj.com
23.234.20.24www.gzgien.com
23.234.20.24www.chuanqige.com
23.234.20.2451my8.com
23.234.20.24www.99j.com.es
23.234.20.24www.sf452.com
23.234.20.24www.981sf.com
23.234.20.24www.sf382.com
23.234.20.24www.hldly.com
23.234.20.24www.sf062.com
23.234.20.24www.8345sf.com
23.234.20.24www.sdfwesq.com
23.234.20.24www.sjxt123.com
23.234.20.24www.daqiandoor.com
23.234.20.24www.125sf.com
23.234.20.24www.xieqiyy.com
23.234.20.24www.ldyeya.com
23.234.20.24www.088sf.net
23.234.20.2483so.com
23.234.20.24www.sf421.com
23.234.20.24www.4f920.com
23.234.20.24www.tiaolou8.com
23.234.20.24www.taocooler.com
23.234.20.24www.wanpp.com
23.234.20.24www.fhzsm.com
23.234.20.24www.pt12319.com
23.234.20.24www.hx-lace.com
23.234.20.24www.jiagao.net
23.234.20.2476776.com
23.234.20.24www.htwjcy.com
23.234.20.24www.win757.com
23.234.20.24www.hnjxzz.cn
23.234.20.24www.xmdvip.com
23.234.20.24swqzp.com
23.234.20.24www.tungsten-moly.com
23.234.20.24jingyan.986jj.com
23.234.20.24www.xxf888.com
23.234.20.24www.cnrsyy.com
23.234.20.24www.txingzuo.com
23.234.20.24www.ykmir.com
23.234.20.24www.xjxianping.cn
23.234.20.24www.web01.cn
23.234.20.24www.yijiaedu.cn
23.234.20.24dushisuanlafen.cn
23.234.20.24www.zzyichen.com
23.234.20.24www.cnnoblelight.com
23.234.20.24klkemu.net
23.234.20.24www.faith-forever.com
23.234.20.24www.bopuai.cn
23.234.20.24www.xzchuitou.cn
23.234.20.24www.ccxbzk.cn
23.234.20.24www.915788.com
23.234.20.24www.sdxtcnc.com
23.234.20.24www.sz-stv.com
23.234.20.24www.fjoss.com
23.234.20.24www.204sf.com
23.234.20.24www.tech-sss.com
23.234.20.24www.mywowpl.com
23.234.20.24www.shi-yi.net
23.234.20.24www.hzlyfashion.com
23.234.20.24www.freeshu.com
23.234.20.24www.chinatianmei.com
23.234.20.2400pk.com
23.234.20.24www.tqb88.com
23.234.20.244593.9kf.com
23.234.20.24www.120yi.com
23.234.20.24www.hdmchina.com
23.234.20.24www.zzfuxi.com
23.234.20.24www.sdicl.com
23.234.20.24www.ebontec.com
23.234.20.24www.3000oksf.com
23.234.20.24www.shqing8.com
23.234.20.24www.666mir.com
23.234.20.24www.adchy.com
23.234.20.24www.pyprint.com
23.234.20.24www.56chuanqi.com
23.234.20.24www.simicc.com
23.234.20.24www.a5zg.com
23.234.20.24www.szhcgroup.com
23.234.20.24www.57ssy.com
23.234.20.24www.qingzhou8.com
23.234.20.24tt292.com
23.234.20.24www.jiatianneiyi.com
23.234.20.24www.leeed.com
23.234.20.24www.20020505.com
23.234.20.24www.kl-chem.com
23.234.20.24www.tjzssd.com
23.234.20.24www.nnhxjh.com
23.234.20.24www.dwmir.com
23.234.20.24www.kk519.com
23.234.20.24www.chinanewhope.net
23.234.20.24www.yalimei-group.com
23.234.20.24www.jiulongbelt.com
23.234.20.24www.dushisuanlafen.cn
23.234.20.24www.cn0796.com
23.234.20.24www.hnfengyuan.com
23.234.20.24www.yixinghai.com
23.234.20.24www.zgtjsteel.com
23.234.20.24www.51disky.com
23.234.20.24www.zhybbs.com
23.234.20.24www.91kaixue.com
23.234.20.24www.fyplay.com
23.234.20.24www.wowidc.com
23.234.20.24www.jiahongtex.com
23.234.20.24www.diselife.com
23.234.20.24www.yygdz.com
23.234.20.24www.kexingco.com
23.234.20.24www.88fb.com
23.234.20.24www.botaofan.com
23.234.20.24www.zzhdjx.cn
23.234.20.24www.cntuliao.com
23.234.20.24www.m5y6.cn
23.234.20.24www.songzhilu.com
23.234.20.24zhaopeng.net
23.234.20.24www.xiayunfei.com
23.234.20.24soyoesd.cn
23.234.20.24www.523zg.com
23.234.20.24regongjixie.com
23.234.20.24www.mir87.com
23.234.20.24chinachengyang.cn
23.234.20.24www.dgguanglin.com
23.234.20.24www.huayuebz.com
23.234.20.24www.xxsw028.com
23.234.20.24www.myppchina.com
23.234.20.24www.gzsuper.com
23.234.20.24www.txhtc.com
23.234.20.24www.cdcx1956.com
23.234.20.24www.yaliwood.com
23.234.20.24www.flower024.com
23.234.20.24www.5ttb.com
23.234.20.24www.i193.com
23.234.20.24www.shweiheng.com
23.234.20.24www.65wt.com
23.234.20.24u17766.com
23.234.20.24www.600sf.com
23.234.20.24www.baodaobike.com
23.234.20.24www.56fabu.com
23.234.20.24www.pt12319.com
23.234.20.24pk.sydahe.com
23.234.20.24cnpeishi.cn
23.234.20.24www.2-55.com
23.234.20.24www.cdfufu.com
23.234.20.24www.bzydzs.com
23.234.20.24www.dhl.gov.cn
23.234.20.24www.81cq.com
23.234.20.24www.sxfyxyq.com
23.234.20.24111wt.com
23.234.20.2481sf.com
23.234.20.2444dy.com
23.234.20.2430wy.com
23.234.20.24999wg.net
23.234.20.24915m.com
23.234.20.2466kf.net
23.234.20.24www.qs930.com
23.234.20.24www.shutu.cc
23.234.20.24sf666.75gm.com
23.234.20.24www.kkksf.com
23.234.20.24www.zhao3f.com
23.234.20.246cq.cc
23.234.20.24u7u73.com
23.234.20.24sf923.com
23.234.20.24oryin.com
23.234.20.24gm777.com
23.234.20.24gm333.com
23.234.20.24cseht.com
23.234.20.24520f.com
23.234.20.24258x.com
23.234.20.2457ww.com
23.234.20.2457591.com
23.234.20.2433sf.com
23.234.20.24sf509.com
23.234.20.24803cq.com
23.234.20.2425930.com
23.234.20.24812315.com
23.234.20.2411cq.cn
23.234.20.2494ww.com
23.234.20.24777wt.com
23.234.20.24www.99mc.com
23.234.20.24980cq.com
23.234.20.24hdhjgs.com
23.234.20.2451zzsf.com
23.234.20.240574k.com
23.234.20.24wjlon.cn
23.234.20.24d518.com
23.234.20.24sf29.com
23.234.20.24222sf.com
23.234.20.2423qianbao.com
23.234.20.24195ca.com
23.234.20.24118967.com
23.234.20.2410000ok.com
23.234.20.2472cq.com
23.234.20.245zaoxie.com
23.234.20.24555beian.com
23.234.20.2455hj.com
23.234.20.2445758.com
23.234.20.2441345.com
23.234.20.24258sf.com
23.234.20.249000sf.com
23.234.20.2487sf.com
23.234.20.2489946.com
23.234.20.2488f.com
23.234.20.2486rs.com
23.234.20.2477yu.com
23.234.20.2481592.com
23.234.20.2474981.com
23.234.20.24818wy.com
23.234.20.249826w.com
23.234.20.24www.myidc.cc
23.234.20.24www.whygjt.com
23.234.20.24www.nd-zk.com
23.234.20.24haosf.com.cn
23.234.20.24www.sf3000ok.com
23.234.20.24www.145930.com
23.234.20.24www.80ww.com
23.234.20.24www.258x.com
23.234.20.24www.sf509.com
23.234.20.24www.tjklm.com
23.234.20.2417sz.net
23.234.20.24www.81sf.com
23.234.20.24www.0663yh.com
23.234.20.24whygjt.com
23.234.20.24www.cc816.com
23.234.20.24www.bohaomj.com
23.234.20.24www.blbfg.com
23.234.20.24jndd.com.cn
23.234.20.24www.ba45.com
23.234.20.24www.bjwztc.com
23.234.20.24www.bangbangtuan.com
23.234.20.241.wzca.com.cn
23.234.20.24www.51yygw.com
23.234.20.24www.912kf.com
23.234.20.24www.eduqc.com
23.234.20.24www.ebssfp.com
23.234.20.24www.dingfengtop.com
23.234.20.24www.dc-superglue.com
23.234.20.24www.daweilp.com
23.234.20.24www.czacyq.com
23.234.20.24www.cqxiexin.com
23.234.20.24www.cltqgs.com
23.234.20.24www.cnaxchem.com
23.234.20.24www.chengdajc.com
23.234.20.24www.cdztnt.com
23.234.20.24www.chinawoollen.com
23.234.20.24www.chinaenyu.com
23.234.20.24www.ihc360.com
23.234.20.24www.hrener.com
23.234.20.24www.howelltoy.com
23.234.20.24www.fzqmw.com
23.234.20.24www.hongweimotor.com
23.234.20.24www.gardenhn.com
23.234.20.24www.fzghj.com
23.234.20.24www.fhouse360.com
23.234.20.24www.fdzyy.com
23.234.20.24www.fujunsh.com
23.234.20.24www.funkan.com
23.234.20.24www.pxfangbao.com
23.234.20.24www.pk138.com
23.234.20.24www.oursuzuki.com
23.234.20.24www.movfox.com
23.234.20.24www.nbyongxiang.com
23.234.20.24www.maoshanchem.com
23.234.20.24www.longyundianli.com
23.234.20.24www.linxiatravel.com
23.234.20.24www.jhrace.com
23.234.20.24www.jxytoys.com
23.234.20.24www.kpaofeite.com
23.234.20.24www.jiang456.com
23.234.20.24www.szgargen.com
23.234.20.24www.szelcc.com
23.234.20.24www.sun-sand-sea.com
23.234.20.24www.shzhuwang.com
23.234.20.24www.ssbrakepad.com
23.234.20.24www.shxianghao.com
23.234.20.24www.shchenggang.com
23.234.20.24www.quhi-tech.com
23.234.20.24www.sh16pu.com
23.234.20.24www.reach-way.com
23.234.20.24www.sddzauto.com
23.234.20.24www.yhszy.com
23.234.20.24www.xinfengjixie.com
23.234.20.24www.xiduanpress.com
23.234.20.24www.xuyetrade.com
23.234.20.24www.xaxhny.com
23.234.20.24www.wzxiyin.com
23.234.20.24www.wxlujia.com
23.234.20.24www.usnaike.com
23.234.20.24www.tyhzh.com
23.234.20.24www.szhmxled.com
23.234.20.24yaosf.net
23.234.20.24www.zjyingguan.com
23.234.20.24www.zzwzgn.com
23.234.20.24www.zjtsmj.com
23.234.20.24www.zjgujia.com
23.234.20.24www.30fu.com
23.234.20.24www.zgshunxing.com
23.234.20.24www.zhcrane.com
23.234.20.24www.zhao5f.com
23.234.20.24www.ytjiangyou.com
23.234.20.24www.yinghongjixie.com
23.234.20.24www.zwyt.net
23.234.20.24zzhdjx.cn
23.234.20.24www.szmhk.com
23.234.20.24www.ccggge.com
23.234.20.24www.0007590.com
23.234.20.24www4.29u.com
23.234.20.24www.nlcoad.com
23.234.20.2426ss.com
23.234.20.24zhaohaosf.net
23.234.20.24www.eanfang.com
23.234.20.24www.ntwmyy.com
23.234.20.24eanfang.com
23.234.20.24www.88pknb.com
23.234.20.24www.hh8gg.pw
23.234.20.24www.hycygy.com
23.234.20.24114code.com
23.234.20.24www.legendpw.net
23.234.20.24www.dgyuanyang.com
23.234.20.24www.sf999.name
23.234.20.24www.125kkk.com
23.234.20.24go.sf999.com
23.234.20.24wwww.017cq.com
23.234.20.24cnc.sf999.com
23.234.20.24www.xztd888.com
23.234.20.24www.iyqxkcqw.com
23.234.20.24www.fenfa1688.com
23.234.20.24www.huahuiye.com
23.234.20.24www.sdqinuo.com
23.234.20.24www.njhxztz.com
23.234.20.24www.qibone.com
23.234.20.24www.aimkm.com
23.234.20.24www.195eeweqsc.com
23.234.20.24www.007sf.com
23.234.20.24www.512qz.com
23.234.20.24www.jxdpx.com
23.234.20.24www.haosf.org
23.234.20.24www.17123.com
23.234.20.24999sf.com
23.234.20.24www.7000hj.com
23.234.20.2467pp.com
23.234.20.2456chuanqi.com
23.234.20.24www.k8765.com
23.234.20.24www.haosf9999.com
23.234.20.24www.fw000.com
23.234.20.24www.gm333.com
23.234.20.24www.anmeiexpo.com
23.234.20.24www.999sf.com
23.234.20.24www.95ok.com
23.234.20.24sedio.cc
23.234.20.24www.5d5y.com
23.234.20.24www.gm777.com
23.234.20.24zhaosf.88654.com
23.234.20.24www.xifulei.com
23.234.20.24www.sf903.com
23.234.20.24www.syjm.net
23.234.20.24www.sf7000.com
23.234.20.24www.nbwanfeng.com
23.234.20.24677g.com
23.234.20.24sf63.com
23.234.20.24www.91kang.com
23.234.20.24cqniangzao.com
23.234.20.24www.999ok.com
23.234.20.2492gg.com
23.234.20.24921ww.com
23.234.20.24520sf.com
23.234.20.24239ok.com
23.234.20.24shdongqiao.com
23.234.20.24sd-yuhui.com
23.234.20.24meiri.vqkp35.com
23.234.20.24moni.227y.com
23.234.20.24gzonisi.cn
23.234.20.24345cc.cn.com
23.234.20.24chinayat.com
23.234.20.24www.3f6f.com
23.234.20.24www.258sf.com
23.234.20.24www.13su.com
23.234.20.24www.118967.com
23.234.20.24www.sardar.cc
23.234.20.24www.21sjzg.com
23.234.20.24www.0769hongri.com
23.234.20.24www.0574k.com
23.234.20.24www.020rencai.net
23.234.20.24uc99.com
23.234.20.24www.001info.com
23.234.20.24www.67pp.net
23.234.20.24www.666666s.com
23.234.20.24www.66kf.net
23.234.20.24www.5zaoxie.com
23.234.20.24www.55hj.com
23.234.20.24www.520sf.com
23.234.20.24www.51miehun.co
23.234.20.24www.51huigo.com
23.234.20.24www.45758.com
23.234.20.24www.5199g.com
23.234.20.24www.30wy.com
23.234.20.24www.922gg.com
23.234.20.24www.88f.com
23.234.20.24www.88102888.com
23.234.20.24www.921ww.com
23.234.20.24www.89946.com
23.234.20.24www.818wy.com
23.234.20.24www.86rs.com
23.234.20.24www.789sf.net
23.234.20.24www.77yu.com
23.234.20.24www.789is.com
23.234.20.24www.6836999.com
23.234.20.24www.boxianfengguan.com
23.234.20.24www.allaboutprogram.com
23.234.20.24www.avoio.com
23.234.20.24www.autohid.com
23.234.20.24www.aptx4869.net
23.234.20.24www.art-verb.com
23.234.20.24www.94haokan.com
23.234.20.24www.dj149.com
23.234.20.24www.dgdtw.com
23.234.20.24www.digrj.com
23.234.20.24www.dgzichi.com
23.234.20.24www.cqsfcn.com
23.234.20.24www.dfhero.com
23.234.20.24www.dabanwu.com
23.234.20.24www.chuanqisifu99.com
23.234.20.24www.chinakelly.com
23.234.20.24www.cfaninfo.com
23.234.20.24www.cgxgf.com
23.234.20.24www.byetee.com
23.234.20.24www.idcdong.com
23.234.20.24www.i-blinks.com
23.234.20.24www.hnlangjie.com
23.234.20.24www.hxfamily.com
23.234.20.24www.hzruili.com
23.234.20.24www.hnggfz.com
23.234.20.24www.hzkjy.com
23.234.20.24www.hlmodule.com
23.234.20.24www.hbwyw.net
23.234.20.24www.hbqdxjmf.com
23.234.20.24www.gzxlzs.com
23.234.20.24www.gzplay.com
23.234.20.24www.gxxjl.com
23.234.20.24www.guanhaiyujia.com
23.234.20.24www.dqzypx.com
23.234.20.24www.krksjx.com
23.234.20.24www.lishi99.com
23.234.20.24www.leiming-bulb.com
23.234.20.24www.lanyue2003.com
23.234.20.24www.laosf.com
23.234.20.24www.jzfsk.com
23.234.20.24www.knschina.com
23.234.20.24www.jsxgm.com
23.234.20.24www.jshhw.com
23.234.20.24www.jka77.com
23.234.20.24www.jn333.com
23.234.20.24www.j8y.net
23.234.20.24www.jieer.net
23.234.20.24www.jietewq.com
23.234.20.24www.i-dphoto.com
23.234.20.24www.pgmary.com
23.234.20.24www.pxfyzs.com
23.234.20.24www.pai4f.com
23.234.20.24www.njrybj.com
23.234.20.24www.oshococo.com
23.234.20.24www.nibou.net
23.234.20.24www.newseaswan.com
23.234.20.24www.myuheng.com
23.234.20.24www.mzwq.info
23.234.20.24www.lypfc.com
23.234.20.24www.lzyinfeng.com
23.234.20.24www.ly1000.com
23.234.20.24www.lvislife.com
23.234.20.24www.lx188.com
23.234.20.24www.shundaglass.com
23.234.20.24www.shyuanli.com
23.234.20.24www.sh-liuxin.com
23.234.20.24www.shi18.com
23.234.20.24www.sf920.net
23.234.20.24www.sea-reach.com
23.234.20.24www.sertai.com
23.234.20.24www.sf123-1.com
23.234.20.24www.sf123.cc
23.234.20.24www.saiyilong.com
23.234.20.24www.scienthoer.com
23.234.20.24www.ruichilida.com
23.234.20.24www.qunhuan.net
23.234.20.24www.qmxfw.com
23.234.20.24www.qhsdkj.com
23.234.20.24www.twdmly.com
23.234.20.24www.szyangcai.com
23.234.20.24www.tococi.com
23.234.20.24www.tcbl88.com
23.234.20.24www.sz-wells.com
23.234.20.24www.szpangzhi.com
23.234.20.24www.szjundaled.com
23.234.20.24www.szcmon.com
23.234.20.24www.szjlskj.com
23.234.20.24www.szabj.com
23.234.20.24www.syzwdj.com
23.234.20.24www.syqtdz.com
23.234.20.24www.sxhtdl.com
23.234.20.24www.sougousf.com
23.234.20.24www.zwnoon.com
23.234.20.24www.zszhongzhi.com
23.234.20.24www.z-sheng.com
23.234.20.24www.zpmc-cz.com
23.234.20.24www.zjtl.com
23.234.20.24www.zjpages.com
23.234.20.24www.zdhw-lighting.com
23.234.20.24www.youxi119.com
23.234.20.24www.ysmtc8.com
23.234.20.24www.yongdingfm.com
23.234.20.24www.yiqi163.com
23.234.20.24www.yingxiangceliangyi.com
23.234.20.24www.wjnmyy.com
23.234.20.24www.wzcjyy.com
23.234.20.24www.wudait.com
23.234.20.24www.xhcsolar.com
23.234.20.24www.kmnc.net
23.234.20.24www2.8845sf.com
23.234.20.24120sf.0755nk.net
23.234.20.24www.muhon.com.cn
23.234.20.24www1.8845sf.com
23.234.20.24922gg.com
23.234.20.24www.yts189.com
23.234.20.24www.chakansdfj.com
23.234.20.24www.steelrq.com
23.234.20.24yindao.jfsm79.com
23.234.20.24www.zx0411.com
23.234.20.24www.kt516.com
23.234.20.2466sf.69ao.com
23.234.20.24www.lt925.com
23.234.20.24www.45wj.com
23.234.20.24www.tt371.com
23.234.20.24www.goule88.com
23.234.20.24www.ranwen.cm
23.234.20.24www.verosale.com
23.234.20.24grambox.com
23.234.20.24down.16kbook.com
23.234.20.24www.grambox.com
23.234.20.24cq.51zzsf.com
23.234.20.24www.ka688.com
23.234.20.24www.hj010.com
23.234.20.24www.64sf.com
23.234.20.24www.921pk.com
23.234.20.24kt516.com
23.234.20.24www.gc771.com
23.234.20.24www.su315.com
23.234.20.24www.jindepower.com
23.234.20.2488uc.sf19.cn
23.234.20.24www.hrm123.net
23.234.20.24www.bjyjy.com
23.234.20.24www.uc99.com
23.234.20.24wvw.9kf.com
23.234.20.2497sf.com
23.234.20.24www.70uc.com
23.234.20.24www.zhaoqiqi.com
23.234.20.24www.hnrbysc.com
23.234.20.24www.69ao.com
23.234.20.2432feef.11cq.cn
23.234.20.24176.01kp.com
23.234.20.24www.kuj8.com
23.234.20.2481f.27-88.com
23.234.20.24www.917se.com
23.234.20.24www.fabumir.com
23.234.20.24www.uc007.com
23.234.20.24www.sf999.com.de
23.234.20.24www.zhaosf.co
23.234.20.24haosf12345.gm127.com
23.234.20.24zhaosf.co
23.234.20.2466sf.com
23.234.20.24www.chuanqisf.com
23.234.20.24zhuzaigua.com
23.234.20.24www.1pk.com
23.234.20.2428uc.com
23.234.20.24chenmo.cc
23.234.20.24www.sf22.com
23.234.20.24www.sf405.com
23.234.20.24www.cz45.com
23.234.20.24115cq.com
23.234.20.24www.803cq.com
23.234.20.24www.25930.com
23.234.20.24123f.com
23.234.20.24hongxuda.com
23.234.20.24haocqsf.com
23.234.20.24www.100rcw.com
23.234.20.24www.10000ok.com
23.234.20.24www.05uc.com
23.234.20.24www.23qianbao.com
23.234.20.24www.222sf.com
23.234.20.24www.72cq.com
23.234.20.24www.ahmcks.com
23.234.20.24www.90zzs.com
23.234.20.24www.csqnw.com
23.234.20.24www.dlz888.com
23.234.20.24www.jx789.com
23.234.20.24www.jsywg.com
23.234.20.24www.tccyg.com
23.234.20.24www.wcfm103.com
23.234.20.24www.wjdhfz.com
23.234.20.24www.zzz7.net
23.234.20.24www.m3088tv.com
23.234.20.24www.cxhdl.com
23.234.20.24www.szbiaoyu.com
23.234.20.24www.gzpioneer.com
23.234.20.24www.mi-sc.com
23.234.20.24www.hosisoft.com
23.234.20.24www.huakangpc.com
23.234.20.24www.zjkylsk.com
23.234.20.24www.casscno.com
23.234.20.24www.0808sf.com
23.234.20.24www.jinhuachang.com
23.234.20.24www.dongya888.com
23.234.20.24www.fhxzd.com
23.234.20.24www.sgwjg.com
23.234.20.24www.pntfrc.com
23.234.20.24www.sf9.cn
23.234.20.24www.lxsqrfms.com
23.234.20.24www.ygpkndz.com
23.234.20.24www.jrxktdy.com
23.234.20.24www.1007movie.net
23.234.20.2430.9youwang.com
23.234.20.2451huigo.com
23.234.20.2451sf.com
23.234.20.24520cq.com
23.234.20.24520cq.net
23.234.20.24765wg.com
23.234.20.24789is.com
23.234.20.24www.23vo.com
23.234.20.248aa.com
23.234.20.2491545.com
23.234.20.2499245.com
23.234.20.2495sf.com
23.234.20.2499ting.cn
23.234.20.2499ting.com
23.234.20.24aaa.xz667.com
23.234.20.24ac198.com
23.234.20.24aa.606wz.com
23.234.20.24bbs.1x.la
23.234.20.24dbconsys.com
23.234.20.24gaosf.com
23.234.20.24gg.herom2.net
23.234.20.24hao-sf-123.com
23.234.20.24haosf.org
23.234.20.24hao119.com
23.234.20.24laosf.com
23.234.20.24search.sf999.com
23.234.20.24sf3000.com
23.234.20.24sf86.com
23.234.20.24sf99.com
23.234.20.24sf999.net
23.234.20.24sfsf.d518.com
23.234.20.24shenqi.com
23.234.20.24www.fzrhcopper.com
23.234.20.24www.008fy.com
23.234.20.24www.022hs.com
23.234.20.24www.123qf.com
23.234.20.24www.13xp.com
23.234.20.24www.163fb.com
23.234.20.24www.450sf.com
23.234.20.2423vo.com
23.234.20.24www.1x.la
23.234.20.24www.23bb.net
23.234.20.24www.28uc.com
23.234.20.24www.33sf.com
23.234.20.24450sf.com
23.234.20.24www.55ip.com
23.234.20.24www.58751.com
23.234.20.24www.6090sf.com
23.234.20.24www.67pp.com
23.234.20.24www.77145.com
23.234.20.24www.707wz.com
23.234.20.24www.7pv.net
23.234.20.24www.78x8.com
23.234.20.24www.810f.com
23.234.20.24www.8u8uu.com
23.234.20.24www.915m.com
23.234.20.24www.96cs.com
23.234.20.24www.92gg.com
23.234.20.24www.99245.com
23.234.20.24www.sfniu.com
23.234.20.24www.sihai-musical.com
23.234.20.24www.cq588.com
23.234.20.2491084.com
23.234.20.24www.dobgame.com
23.234.20.24www.fireol.com
23.234.20.24www.fei24.com
23.234.20.24www.game-114.com
23.234.20.24www.gaosf.com
23.234.20.24www.gmhaosf.com
23.234.20.24www.hao3a.com
23.234.20.24www.haosf.bz
23.234.20.24www.htdqsec.com
23.234.20.24www.hzhswj.com
23.234.20.24www.pk920.com
23.234.20.24www.liwoma.com
23.234.20.247000uc.com
23.234.20.24www.nwpbl.com
23.234.20.24www.ok3000.com
23.234.20.24www.23c.com
23.234.20.24www.pk555.com
23.234.20.24www.pk920.com
23.234.20.24www.rbtvs.com
23.234.20.24www.91084.com
23.234.20.24www.sdzblj.com
23.234.20.24www.sf121.com
23.234.20.24www.sebxa.com
23.234.20.24www.sf3000.com
23.234.20.24www.sf86.com
23.234.20.24www.sf999.net
23.234.20.24www.shuo321.com
23.234.20.24www.shuiguanyin.com
23.234.20.24www.sxzkzx.com
23.234.20.24www.uc88.com
23.234.20.24www.weihuangsz.com
23.234.20.24www.weizhixs.com
23.234.20.24www.wodewww.com
23.234.20.24www.wsf520.com
23.234.20.2423c.com
23.234.20.24www.xcwsg.com
23.234.20.24www.xjlgc.com
23.234.20.24www.zhuzaicq.com
23.234.20.24www1.uc88.com
23.234.20.24www2.520cq.com
23.234.20.24www5.29u.com
23.234.20.24www4.520cq.com
23.234.20.24www5.520cq.com
23.234.20.243000ko.com
23.234.20.24www.sdjnxy.com
23.234.20.24sf999.com
23.234.20.24www.51okf.com
23.234.20.24www.iiwoool.com
23.234.20.24www.rxshige.com
23.234.20.24www.dghke.com
23.234.20.24www.7kkb.net
23.234.20.24www.789518.com
23.234.20.24www.cqfff.com
23.234.20.24www4.beer51.com
23.234.20.24www.cseht.com
23.234.20.24www.82926.com
23.234.20.248uc.558uc.com
23.234.20.24www.99cangzhou.com
23.234.20.24www.pjzbw.com
23.234.20.24www.52375.com
23.234.20.24www.xdhmotor.com
23.234.20.24www.shmeigu168.com
23.234.20.24www.comvod.com
23.234.20.24www.gz-sc.com
23.234.20.24www.stylepacking.com
23.234.20.24www.hnfdczj.com
23.234.20.24www.wfxycc.com
23.234.20.24www.26ss.com
23.234.20.24www.hezhihui.com
23.234.20.24www.wuxihuaxia.com
23.234.20.24www.nblongyi.com
23.234.20.24www.7zcq.com
23.234.20.247ugg.com
23.234.20.24www.dliuren.com
23.234.20.24www.wmult.com
23.234.20.24www.3159wine.com
23.234.20.24www.sf5137.com
23.234.20.24www.cxxcqp.com
23.234.20.24www.qz92.com
23.234.20.24www.stronger-filter.com
23.234.20.24www1.65cf.com
23.234.20.24i8pk.com
23.234.20.24www.trnly.com
23.234.20.24www.zhaokj.com
23.234.20.24www.yaojuezhan.com
23.234.20.24www.tt2sf.com
23.234.20.24www.qupaike.com
23.234.20.24www.luowenqi.com
23.234.20.24qqfcwgw.com
23.234.20.24www.taosf.com.ru
23.234.20.24www.zj-xd.com
23.234.20.24www.mgszyc.com
23.234.20.249pk.dgjt.net
23.234.20.24www.2umm.com
23.234.20.24www.yxyhx.com
23.234.20.24zhaokf.com
23.234.20.24www.sf010.com
23.234.20.24www.sfdawang.com
23.234.20.24www.17fg.com
23.234.20.24abc.top258.cn
23.234.20.24www.gm7.cc
23.234.20.249kf.rzsport.com
23.234.20.24ss.sg368.com
23.234.20.24www.yy-bags.com
23.234.20.24video.shunlo.com
23.234.20.24www.45yes.com
23.234.20.24www.cnyongli.com
23.234.20.24www.sf03.com
23.234.20.24www.88kf.net
23.234.20.24www.88kf.com
23.234.20.24www.sf168.com
23.234.20.24555sf.com
23.234.20.24www.ourbep.com
23.234.20.24www.manmank.com
23.234.20.24sebxa.com
23.234.20.24hchxh.com
23.234.20.24z34.sf19.cn
23.234.20.24www.mobilefad.com
23.234.20.24www.sf22-2.com
23.234.20.24www.tlsfwz.com
23.234.20.24www.westmm.com
23.234.20.247080st.com
23.234.20.24www.sf322.com
23.234.20.24www.zyjms.com
23.234.20.24yy.7080st.com
23.234.20.24jcniao.com
23.234.20.24letanju.com
23.234.20.24soso.8kst.com
23.234.20.24www.taleclub.com
23.234.20.24008cqsf.com
23.234.20.24112sf.com
23.234.20.24114.75sf.cn
23.234.20.24123sf.com
23.234.20.24138bt.com
23.234.20.24138sf.com
23.234.20.24139.limulu.com
23.234.20.24163.fuatw.com
23.234.20.24168.w198.net
23.234.20.24168.zh-db.com
23.234.20.24178bifen.com
23.234.20.2417fg.com
23.234.20.2423c.com
23.234.20.2423ok.com
23.234.20.2428yes.com
23.234.20.2429u.com
23.234.20.24500sf.com
23.234.20.24513ux.com
23.234.20.24515.zh-db.com
23.234.20.2451xunt.com
23.234.20.24520.szgumi.com
23.234.20.2452345.com
23.234.20.24523sf.com
23.234.20.24523u.com
23.234.20.2455z5.com
23.234.20.24666sf.com
23.234.20.2466cq.com
23.234.20.2473sf.com
23.234.20.24777gm.com
23.234.20.247uc.com
23.234.20.2481f.com
23.234.20.2481fu.com
23.234.20.248845.com
23.234.20.2488858.com
23.234.20.24www.qizhu.cc
23.234.20.24www.as9z.com
23.234.20.248uu.com
23.234.20.2491ww.com
23.234.20.2492045.com
23.234.20.24920sf.com
23.234.20.24926.com
23.234.20.2492fu.com
23.234.20.24999hj.com
23.234.20.2499j.com
23.234.20.249kf.com
23.234.20.249pk.k197.com
23.234.20.249pk.u7u73.com
23.234.20.24ad.97uu.com
23.234.20.24haocq.com
23.234.20.24pk123.com
23.234.20.24plinm.com
23.234.20.24qiqi530.com
23.234.20.24qq.007uc.com
23.234.20.24sf138.com
23.234.20.24sf168.com
23.234.20.24sf176.com
23.234.20.24sf215.com
23.234.20.24sf222.com
23.234.20.24sf30.com
23.234.20.24sf777.com
23.234.20.24www.xhnano.com
23.234.20.24sogou.1000ok.com
23.234.20.24ww.1388fu.com
23.234.20.24www.005sf.com
23.234.20.24www.008n.com
23.234.20.24www.015999.com
23.234.20.24www.023cz.com
23.234.20.24www.023toilet.com
23.234.20.24www.027fruit.com
23.234.20.24www.0313hybj.com
23.234.20.24www.0532oa.com
23.234.20.24www.055735.com
23.234.20.24www.07186.com
23.234.20.24www.1000gsf.com
23.234.20.24www.112sf.com
23.234.20.24www.114haosf.com
23.234.20.24www.115cq.com
23.234.20.24www.11811445.com
23.234.20.24www.11cq.cn
23.234.20.24www.120sf.com
23.234.20.24www.123cq.com
23.234.20.24www.123f.com
23.234.20.24www.123hj.com
23.234.20.24www.123sf.com
23.234.20.24www.123uu.com
23.234.20.24www.130136.com
23.234.20.24www.134sf.com
23.234.20.24www.138bt.com
23.234.20.24www.145sf.com
23.234.20.24www.15ss.com
23.234.20.24www.16753.com
23.234.20.24www.17fabu8.com
23.234.20.24www.215pk.com
23.234.20.24www.22j.com
23.234.20.24www.234sfww.com
23.234.20.24www.23c.com
23.234.20.24www.23fu.com
23.234.20.24www.23ok.com
23.234.20.24www.23sfu.cn
23.234.20.24www.27sf.com
23.234.20.24www.28yes.com
23.234.20.24www.29u.com
23.234.20.24www.3000ok.cc
23.234.20.24www.3000pk.com
23.234.20.24www.31cqsf.com
23.234.20.24www.31i.cn
23.234.20.24300sf.com
23.234.20.24www.3300sf.com
23.234.20.24www.33345.com
23.234.20.24www.333ok.com
23.234.20.24www.33pk.com
23.234.20.24www.33wt.com
23.234.20.24www.361cq.com
23.234.20.24www.365taoba.com
23.234.20.24www.371cyw.com
23.234.20.24www.37ok.com
23.234.20.24www.3dmeibang.com
23.234.20.24www.3qsf.com
23.234.20.24www.418sf.in
23.234.20.24www.425sf.com
23.234.20.24www.44dy.com
23.234.20.24www.45195.com
23.234.20.24www.34ok.com
23.234.20.24www.8cq.cc
23.234.20.24www.45bang.com
23.234.20.2434ok.com
23.234.20.24www.45hs.com
23.234.20.24www.4nic-dy.com
23.234.20.24www.500sf.com
23.234.20.24www.51sf.com
23.234.20.24www.52058.com
23.234.20.24www.520cq.com
23.234.20.24www.520jy.com
23.234.20.24zhaosf.hsdbm.com
23.234.20.24www.523sf.com
23.234.20.24www.523u.com
23.234.20.24www.531U.com
23.234.20.24www.533ok.com
23.234.20.24www.53sf.com
23.234.20.24www.53uc.com
23.234.20.24www.53w.com.cn
23.234.20.24www.54ss.net
23.234.20.24www.pk920.com
23.234.20.24www.55z5.com
23.234.20.24www.565sf.com
23.234.20.24www.56ss.com
23.234.20.24cdchuanghui.com
23.234.20.24www.57591.com
23.234.20.24www.57f.com
23.234.20.24www.57fg.com
23.234.20.24www.57ww.com
23.234.20.24www.5800sf.com
23.234.20.24www.58sf.com
23.234.20.24www.58uc.com
23.234.20.24www.5index.net
23.234.20.24www.5qu.com
23.234.20.24www.64pk.com
23.234.20.24www.6645.com
23.234.20.24www.666sf.com
23.234.20.24www.676711.com
23.234.20.24www.677g.com
23.234.20.24www.67m2.com
23.234.20.24www.686f.com
23.234.20.24www.697sf.com
23.234.20.24www.6cq.cc
23.234.20.24www.73sf.com
23.234.20.24www.75sf.cn
23.234.20.24www.777gm.com
23.234.20.24www.77d8.com
23.234.20.24www.77kl.com
23.234.20.24www.79j.com
23.234.20.24www.7j773.com
23.234.20.24www.7uc.com
23.234.20.24www.80845.com
23.234.20.24www.812315.com
23.234.20.24www.81267.com
23.234.20.24www.81fu.com
23.234.20.24www.823f.com
23.234.20.24www.82506.com
23.234.20.24www.860572.com
23.234.20.24www.860580.com
23.234.20.24www.87sf.com
23.234.20.24www.8845.com
23.234.20.24www.88845.com
23.234.20.24www.88858.com
23.234.20.24www.89176.com
23.234.20.24www.8aa.com
23.234.20.24www.8uc.com
23.234.20.24www.900hj.com
23.234.20.24www.909f.com
23.234.20.24www.9100sf.com
23.234.20.24www.915301.com
23.234.20.24www.91545.com
23.234.20.24www.91ff.com
23.234.20.24www.91wuc.com
23.234.20.24www.920666.com
23.234.20.24www.920gg.com
23.234.20.24www.920sf.com
23.234.20.24www.923u.com
23.234.20.24www.92fu.com
23.234.20.24www.92ww.com
23.234.20.24www.93sf.com
23.234.20.24www.94432.com
23.234.20.24www.95sf.com
23.234.20.24www.96645.com
23.234.20.24www.9800sf.com
23.234.20.24www.980cq.com
23.234.20.24www.99964.com
23.234.20.24www.999hj.com
23.234.20.24www.999wg.net
23.234.20.24www.99a.com
23.234.20.24www.99ji.com
23.234.20.24www.99pk.com
23.234.20.24www.apbfhl.com
23.234.20.24www.aifugu.com
23.234.20.24www.33pk.com
23.234.20.2433pk.com
23.234.20.24www.bjhdshengda.com
23.234.20.24www.bjtdyz.com
23.234.20.24www.bsfzjx.com
23.234.20.24www.bsrcsc.com
23.234.20.24www.cnycta.com
23.234.20.24www.cq45.com
23.234.20.24www.cq91530.com
23.234.20.24www.cqy6.com
23.234.20.24www.csrxj.com
23.234.20.24www.cy4f.com
23.234.20.24www.fy371.com
23.234.20.24www.gm888.com
23.234.20.24www.gxxgy.com
23.234.20.24www.gzxing.com
23.234.20.24www.heli-cn.com
23.234.20.24www.hnyuhai.com
23.234.20.24www.hstztc.com
23.234.20.24www.hwhaosf.com
23.234.20.24www.7000uc.com
23.234.20.24www.ksd777.com
23.234.20.24www.laisf.com
23.234.20.24www.laohaosf.com
23.234.20.24www.lovewg.com
23.234.20.24www.luckysz.com
23.234.20.24www.mai101.com
23.234.20.24www.mikating.com
23.234.20.24www.mtv110.com
23.234.20.24www.nj-row.com
23.234.20.24www.nybxm.com
23.234.20.24www.ocerlight.com
23.234.20.24www.oksf.net
23.234.20.24www.pk123.com
23.234.20.24www.plinm.com
23.234.20.24www.qiqi530.com
23.234.20.24www.qzrt.com
23.234.20.24www.recairen.com
23.234.20.24www.rexuesf.in
23.234.20.24www.sf0058.com
23.234.20.24www.sf1003.com
23.234.20.24www.sf17.com
23.234.20.24www.sf176.com
23.234.20.24www.sf215.com
23.234.20.24www.sf222.com
23.234.20.24www.sf231.com
23.234.20.24www.sf29.com
23.234.20.24www.sf30.com
23.234.20.24www.sf520.com.cn
23.234.20.24www.sf555.com
23.234.20.24www.sf5858.com
23.234.20.24www.sf63.com
23.234.20.24www.sf777.com
23.234.20.24www.sf8500.com
23.234.20.24www.sf92045.com
23.234.20.24www.sf930.com
23.234.20.24www.sf99.com
23.234.20.24www.shaibar.com
23.234.20.24www.shamandi.com
23.234.20.24www.ksjxyy.com
23.234.20.24www.sktpcbic.com
23.234.20.24www.stkj66.com
23.234.20.24www.tj-aote.com
23.234.20.24www.haosf999.com
23.234.20.24www.wan45.com
23.234.20.24www.whjdwxw.com
23.234.20.24www.whlinuo.com
23.234.20.24www.worldkcc.com
23.234.20.24www.wtcqsf.com
23.234.20.24www.xiaomeisf.com
23.234.20.24www.xihaihotel.com
23.234.20.24www.xindudu.com
23.234.20.24www.xinganchem.com
23.234.20.24www.ovytgnby.com
23.234.20.24www.xinsf.com
23.234.20.24www.yeschongcao.com
23.234.20.24www.ynyeer.com
23.234.20.24www.ysguandao.com
23.234.20.24www.yxzhidao.com
23.234.20.24www.zhaochenmo.com
23.234.20.24www.zhaofg.com
23.234.20.24www.zhaohaosf.net
23.234.20.24www.zhaokf.com
23.234.20.24www.zhaosf88.com
23.234.20.24www.zhaoss.com
23.234.20.24www1.pk123.com
23.234.20.24www10.138sf.com
23.234.20.24xiaomeisf.com
23.234.20.24xinsf.com
23.234.20.24www.500ok.com
23.234.20.24www.wancm.com
23.234.20.24jjj.la
23.234.20.24zhaochenmo.com
23.234.20.24zuhukang.com
23.234.20.24www.shangkequ.com
23.234.20.24www.9527cqsf.com
23.234.20.24www.tjtuliao.com
23.234.20.24www.szplas.com
23.234.20.24www.hlxyx.com
23.234.20.24www.012sf.com
23.234.20.24www.zhaosf.cc
23.234.20.24www.07sf.com
23.234.20.24www.duoduosf.com
23.234.20.24www.sf66666.com
23.234.20.24www.my7su.com
23.234.20.24www.725sf.com
23.234.20.24725sf.com
23.234.20.24www.96sf.com
23.234.20.24www.pk196.com
23.234.20.24www.letanju.com
23.234.20.2450ss.com
23.234.20.24www.50ss.com
23.234.20.24sfdawang.com
23.234.20.24taocq.com
23.234.20.24www.73uu.com
23.234.20.24www.taocq.com
23.234.20.24www.30uc.com
23.234.20.24www.nz999.net
23.234.20.24www.ww45.com
23.234.20.24www.xt-dz.com
23.234.20.24www.pk99.com
23.234.20.24www.1e2w.cn
23.234.20.248845.678uc.com
23.234.20.24cq.3q33.com
23.234.20.24www.baojingqi.net
23.234.20.24www.didihc.com
23.234.20.24www.bangnijie.com
23.234.20.24www.chenmo.cc
23.234.20.24www.sina35.com
23.234.20.24www.175sf.com
23.234.20.24sf123.cc
23.234.20.24www.shfiro.com
23.234.20.24bjyocy.com
23.234.20.24www.pochanlawyer.com
23.234.20.24www.138sf.cc
23.234.20.2499pk.com
23.234.20.24www.22cq.com
23.234.20.24www.888ww.com
23.234.20.24www.2sifu.com
23.234.20.24wvw.uc99.com
23.234.20.24123.uc99.com
23.234.20.24999ok.com
23.234.20.24www.sf99.cc
23.234.20.24www.80sf.com
23.234.20.24www.33221.com
23.234.20.24www.pk9090.com
23.234.20.24pk9090.com
23.234.20.24www2.uc88.com
23.234.20.24www3.uc88.com
23.234.20.24www4.uc88.com
23.234.20.2488845.com
23.234.20.24www.sf9.com
23.234.20.24www.700sf.com
23.234.20.24920gg.com
23.234.20.24www.23c.com
23.234.20.24www.021sx.com
23.234.20.24www.sf78.com
23.234.20.24www.qjfang.cn
23.234.20.2423c.com
23.234.20.24www.yaofg.com
23.234.20.24www.07ket.com
23.234.20.24www.17hhg.com
23.234.20.24www.46cq.com
23.234.20.24www.wan345.com
23.234.20.24www.htlq.com
23.234.20.24www.nbkst.com
23.234.20.24www.meishipai.com
23.234.20.24www.987pk.com
23.234.20.24www.weisf.com
23.234.20.24www.baqisf.com
23.234.20.24www.91530.com
23.234.20.24www.zhaohaosf.com
23.234.20.24www.s400.com
23.234.20.24www.aichenmo.com
23.234.20.24www.sf315.com
23.234.20.24425sf.com
23.234.20.24www.23gg.com
23.234.20.24yaofg.com
23.234.20.24www.44woool.com
23.234.20.24www.17166.com
23.234.20.24www.wt789.com
23.234.20.24www.591maimai.com
23.234.20.24www.gggsf.com
23.234.20.24www.cecri.com
23.234.20.24www.cnpxba.com
23.234.20.24www.cqrcxx.com
23.234.20.24www.zhaowt.net
23.234.20.243000ak.com
23.234.20.24www.3000ak.com
23.234.20.24027gg.net
23.234.20.24www.85sf.com
23.234.20.24www.cnxinghang.com
23.234.20.24www.sf19.com
23.234.20.24www.uc600.com
23.234.20.24www.255uc.com
23.234.20.24255uc.com
23.234.20.24111.kaihu365.com
23.234.20.24www.3000ok-1.com
23.234.20.24www.3000ok.com
23.234.20.24www.sf588.com
23.234.20.24www.jjj3000ok.com
23.234.20.241000ok.com
23.234.20.24www.666923.com
23.234.20.24www.920313.com
23.234.20.24www.616st.com
23.234.20.24www.53my.com
23.234.20.24www.945176.net
23.234.20.24www.999sf.cc
23.234.20.24933gg.com
23.234.20.24haosf.com
23.234.20.24www.haosf.com.cn
23.234.20.24tg.cnm78.com
23.234.20.24www.1213sf.com
23.234.20.24www.678sf.com
23.234.20.24www.250sf.com
23.234.20.24www.92188.com
23.234.20.24888.hyds888.com
23.234.20.24www.646sf.com
23.234.20.24www.82cq.com
23.234.20.24sf99.cc
23.234.20.24www.50ww.com
23.234.20.24sf590.com
23.234.20.24www.sf590.com
23.234.20.24www.35fg.com
23.234.20.24www.sf526.com
23.234.20.24www.18ux.com
23.234.20.24www.520cq.net
23.234.20.24www.haosf12345.com
23.234.20.24sf22.com
23.234.20.24pk99.com
23.234.20.2479j.com
23.234.20.2455sf.com
23.234.20.24www.55sf.com
23.234.20.24www.zm63.com
23.234.20.24926.syslx.com
23.234.20.241000ok.cc
23.234.20.24www.1000ok.cc
23.234.20.243000ok.isosf.com
23.234.20.243000ok.com
23.234.20.24tt.syslx.com
23.234.20.24www.zhaofq.com
23.234.20.242013.cqmdl.com
23.234.20.24www.19fu.com
23.234.20.2419fu.com
23.234.20.24www.zhaosifu.com
23.234.20.24www.kom999.com
23.234.20.24www.ok777.com
23.234.20.24www.757sf.com
23.234.20.24www.50999.com
23.234.20.2433345.com
23.234.20.24999zg.com
23.234.20.24www.13ss.com
23.234.20.24www.520zf.com
23.234.20.2488pk.com
23.234.20.24www.990yx.com
23.234.20.24www.cqacura.com
23.234.20.24www.tldsny.com
23.234.20.24www.wzggwz.com
23.234.20.24www.tjnhey.com
23.234.20.24www.51friends.com
23.234.20.24aa.707wz.com
23.234.20.24www.cn-skf.com
23.234.20.24www.6sf.com
23.234.20.24www.jianfeixy.com
23.234.20.24www.shkingdu.com
23.234.20.24www.707wz.com
23.234.20.24www.suoyinm.com
23.234.20.24www.zcmeter.com
23.234.20.24www.115book.com
23.234.20.249kst.com
23.234.20.249u.7080st.com
23.234.20.24www.118uc.om
23.234.20.24www.haofwd.com
23.234.20.24www.zhaowoool.com
23.234.20.24www.gdhttz.com
23.234.20.24www.fzdbdz.com
23.234.20.24www.tianguhotel.com
23.234.20.24www.chinahjly.com
23.234.20.24tgaxved8.com
23.234.20.245a189.com
23.234.20.24www.wuwoool.com
23.234.20.24www.shitongdg.com
23.234.20.24www.sbqcssf.com
23.234.20.24www.51cssf.net.cn
23.234.20.24www.65535cs.com
23.234.20.24zhao.559woool.com
23.234.20.24www.559woool.com
23.234.20.24www.5sdl.com
23.234.20.24www.dandong-window.com
23.234.20.24www.xinyumen.com
23.234.20.24www.ahzhishang.com
23.234.20.24www.xd163.com
23.234.20.24www.trm-china.com
23.234.20.24www.aoyue168.com
23.234.20.24www.gdcable.com
23.234.20.24www.zhuwulong.com
23.234.20.24www.szjapson.com
23.234.20.24www.swan-storage.com
23.234.20.24www.cseptc.com
23.234.20.24www.zcgddz.com
23.234.20.24www.dycssf.com
23.234.20.24www.9965478.com
23.234.20.24www.jshgzb.com
23.234.20.24www.qd-qinggang.com
23.234.20.24gzgm.27pyki.com
23.234.20.24www.hcs888.com
23.234.20.24www.woool578.com
23.234.20.24www.jntex.com
23.234.20.24917wool.cn
23.234.20.24chuanqifj.com
23.234.20.24www.lqgz.com
23.234.20.24www.suwoool.com
23.234.20.24www.45ci.com
23.234.20.24www.sdyjt.com
23.234.20.24www1.bai12.com
23.234.20.24www.889cs.com
23.234.20.24www.cjphb.com
23.234.20.24www.szosun.com
23.234.20.24www.garment5.com
23.234.20.24www.gm66.com
23.234.20.24www.com15.com
23.234.20.24www.emc120.com
23.234.20.24ktjia.com
23.234.20.24www.05woool.com
23.234.20.24www.cnsjjs.com
23.234.20.24www.jnxsfr.com
23.234.20.24www.99cishan.com
23.234.20.2444woool.com
23.234.20.24www.mm886.net
23.234.20.24zhaosf.com
23.234.20.24www.shyssteel.com
23.234.20.24www.ywool.com
23.234.20.24www.hao123woool.com
23.234.20.24aixin168.com
23.234.20.24www.wooolfbw.com
23.234.20.24www.525pc.com
23.234.20.24www.zhaowooolsf.com
23.234.20.24www.cn-tyn.com
23.234.20.24www.917wool.cn
23.234.20.24www.hy225.com
23.234.20.24www.10gamer.com
23.234.20.24www.zv2o.com
23.234.20.24www.411wed.com
23.234.20.24www.lewoool.com
23.234.20.24gtcc2008.com
23.234.20.24945pk.com
23.234.20.24pk777.com
23.234.20.24www.168gamer.com
23.234.20.24new.guguyu.com
23.234.20.24web.longhoo.net
23.234.20.24www.8090yxs.com
23.234.20.24aszt.6268.com
23.234.20.24kf.07073.com
23.234.20.24www.mcncc.com
23.234.20.24www.wudijz.com
23.234.20.24lhzs.9377.com
23.234.20.24lhzs.37wan.com
23.234.20.24lhzs.yaowan.com
23.234.20.24lhzs.49you.com
23.234.20.24lhzs.8090yxs.com
23.234.20.24wz.49you.com
23.234.20.24wz.6711.com
23.234.20.24asqx.yaowan.com
23.234.20.24www.sifucun.com
23.234.20.24bbs.to4f.com
23.234.20.24www.pg666.cn


Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    attrib.exe:1884
    attrib.exe:1692
    attrib.exe:1208
    attrib.exe:636
    cacls.exe:612
    cacls.exe:1976
    cacls.exe:224
    cacls.exe:1260
    cacls.exe:592

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\b.bat (255 bytes)
    %System%\drivers\etc\hosts.ics (17013 bytes)
    C:\a.bat (356 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\cj[1].txt (4605 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\43881.tmp (15 bytes)
    %System%\drivers\etc\protocol (799 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\group[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\style[1].css (12015 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\game[1].htm (32375 bytes)
    %System%\drivers\etc\networks (407 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@soso.hcjd56[2].txt (313 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\click[1].htm (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\jiaqun[1].htm (254 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\title-bg[1].jpg (1458 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\bg[1].jpg (61672 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %System%\drivers\etc\lmhosts.sam (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@soso.hcjd56[1].txt (166 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\soso.hcjd56[1].htm (1199 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\count1[1].gif (715 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (788 bytes)
    %System%\drivers\etc\services (7 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "wscntmx" = "D:\\wscntmx.exe"

  5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
  6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  7. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: Language Neutral

Company Name: Product Name: ?????Product Version: 1.0.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ?????Comments: ??????????(http://www.eyuyan.com)Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text40965165035201924.52261e6d1e505b6e797f4264ecb246f28912f
.rdata524288143320614336005.427233335f2a8db532a922d434b6e99934e6a
.data1957888242410655363.50857ea27acb430ed52e731842deb15634ee5
.rsrc220364834688368643.974569bf5245a564665c71f614b79c10e4b5a

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL IP
hxxp://jc.941pojie.com/jiaqun.htm125.88.186.134
hxxp://jc.941pojie.com/cj.txt125.88.186.134
hxxp://jc.941pojie.com/zy.txt125.88.186.134
hxxp://jc.941pojie.com/tc.txt125.88.186.134
hxxp://p21.tcdn.qq.com/wpa/images/group.png
hxxp://jc.941pojie.com/cxbt.txt125.88.186.134
hxxp://count46.51yes.com/click.aspx?id=460737107&logo=161.147.124.247
hxxp://count46.51yes.com/count1.gif61.147.124.247
hxxp://count46.51yes.com/sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)61.147.124.247
hxxp://cj.941pojie.com/tc.txt125.88.186.134
hxxp://cj.941pojie.com/zy.txt125.88.186.134
hxxp://cj.941pojie.com/cxbt.txt125.88.186.134
hxxp://pub.idqqimg.com/wpa/images/group.png103.7.29.190
soso.hcjd56.com115.231.174.114
25145ko1.hbgyzs.com115.231.174.114

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /click.aspx?id=460737107&logo=1 HTTP/1.1

Accept: */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 30 Aug 2015 14:56:57 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Type: text/html; charset=gb2312

Content-Length: 1777

..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(endstr==-1) endstr=document.cookie.length;return document.cookie.substring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.length;var clen=document.cookie.length;var i=0;var j;while(i<clen) {j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=document.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..function cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*36000;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=0; expires=" y_e.toGMTString() "; path=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_count");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' escape(document.location) '&color=' screen.colorDepth 'x&resolution=' screen.width 'x' screen.height '&returning=' cc_k() '&language=' navigator.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('<a href="hXXp://countt.51yes.com/index.aspx?id=460737107" target=_blank><img width=20 height=20 border=0 hspace=0 vspace=0 src=

<<< skipped >>>

GET /sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 30 Aug 2015 14:56:58 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Length: 0

HTTP/1.1 200 OK..Date: Sun, 30 Aug 2015 14:56:58 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Control: private..Content-Length: 0..

GET /jiaqun.htm HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: jc.941pojie.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 30 Aug 2015 14:56:37 GMT

Content-Length: 217

Content-Type: text/html

Content-Encoding: gzip

Content-Location: hXXp://jc.941pojie.com/jiaqun.htm

Last-Modified: Sun, 30 Aug 2015 14:51:59 GMT

Accept-Ranges: bytes

ETag: "8091166c33e3d01:840bb"

Vary: Accept-Encoding

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

..........t.=R. .E.....y.....8.........]Y.he....v..z..-..9...!9.-}43..%c...c....}...1.v[.S.......O...J.....k.CU......m.....@-Ah..r{. .`..2.rY....#fK=..rJ.do.p...1..-..p.3..#.au..|~.R................d.g..v...o.........HTTP/1.1 200 OK..Date: Sun, 30 Aug 2015 14:56:37 GMT..Content-Length: 217..Content-Type: text/html..Content-Encoding: gzip..Content-Location: hXXp://jc.941pojie.com/jiaqun.htm..Last-Modified: Sun, 30 Aug 2015 14:51:59 GMT..Accept-Ranges: bytes..ETag: "8091166c33e3d01:840bb"..Vary: Accept-Encoding..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET............t.=R. .E.....y.....8.........]Y.he....v..z..-..9...!9.-}43..%c...c....}...1.v[.S.......O...J.....k.CU......m.....@-Ah..r{. .`..2.rY....#fK=..rJ.do.p...1..-..p.3..#.au..|~.R................d.g..v...o...........

GET /wpa/images/group.png HTTP/1.1

Accept: */*

Referer: hXXp://jc.941pojie.com/jiaqun.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pub.idqqimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Cache-Control: max-age=259200

Last-Modified: Fri, 12 Apr 2013 09:22:21 GMT

Content-Type: image/png

Content-Length: 1827

Keep-Alive: timeout=60

X-Cache-Lookup: Hit From MemCache

.PNG........IHDR...Z.........w.{'....PLTEV...dE)r.Ip..........F........F..Kyy...r.....~E ......m..c..........d3.....S.....r...S1...#.....c........A..l3....d.............ynvc......"..]Z@.mZ..jB..............&..I...\BH.....................rHh........z4$...X..0.....R.....s@6...{RL(.......Xs.y......S........%.........vb...4......bW...[%..........L..t..s..c>'...2..............wsw..i.............yM...WwaR...?-.fU...~K;.`H...t..V..:..d...........h/#.......Z74..........pt5(...K...vb=......lM.........N.kr......I A............pVs..k.....f'.p.....c..%...SG.J;..r6......fBr..o=5...T..J...jB......5.....|......n^....XLm3#......y.f.}X....]6...,y....8..........q.D-Mt....^* z= y>#.dK...^...........>..s..J..............B....q...................xy...'..t.....7..M...~Re........s: .K(.rP`)..^=.........3......G:V......WE..2.....pHYs.................IDAT8....T.U...lCs..It.....5r,*....I.K.].5p.d....2.4Fw.m}.....e.v7r.........S.D.IVR.&.....y8G;.................N.r...9.t......p9.....].......,Ko..i.......Mh.|@..hyw..9...n..qo-....C.....s.fpo..:{..vtQQG........'..zmr.......H...m.u4.;..t...7....C.........a...?....{)...W..4...u......(....l..Q.|......R.u.3K.;.!..}vy([.e.~YhG[^. y......C...<....~.<-^I3......$..B....z...?$......u...S.7....qF$?.wF..G..lkC#...=...A...C.......#x...Ea.yvS(..P..e..2..*....yD]]d.\.....{..h.....5.UK.@J....ux7...>5.H_....}...T]2x,EO7SEmf.6.u:sk(..4...-.,...o6;B...Me. .\..._.]SSs..._....?g.,.x.$.tL...)..u.<Mv`4..Q<QiU.1O.X%......q..-.w.h... **.....e}..E...'...51t...0...0v....)^1.'.^..U.u`| 3.8l.)

<<< skipped >>>

GET /click.aspx?id=460737107&logo=1 HTTP/1.1

Accept: */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 30 Aug 2015 14:56:53 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Type: text/html; charset=gb2312

Content-Length: 1777

..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(endstr==-1) endstr=document.cookie.length;return document.cookie.substring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.length;var clen=document.cookie.length;var i=0;var j;while(i<clen) {j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=document.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..function cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*36000;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=0; expires=" y_e.toGMTString() "; path=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_count");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' escape(document.location) '&color=' screen.colorDepth 'x&resolution=' screen.width 'x' screen.height '&returning=' cc_k() '&language=' navigator.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('<a href="hXXp://countt.51yes.com/index.aspx?id=460737107" target=_blank><img width=20 height=20 border=0 hspace=0 vspace=0 src=

<<< skipped >>>

GET /count1.gif HTTP/1.1

Accept: */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 715

Content-Type: image/gif

Last-Modified: Thu, 07 Apr 2005 17:25:22 GMT

Accept-Ranges: bytes

ETag: "02d4c7963bc51:3f4c"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Sun, 30 Aug 2015 14:56:54 GMT

GIF89a.....~........n...............................B.....x..[.....(c............................RS....wv...................Y.....~{....'...........|........A.................ie.Z[.__..g.M.................v..sr.`^.....................................>{.............&r....'..............F......g.O.....lo.^..jj..........NN.............n...s.................m...................S..$~................!.....~.,............~......stY..i..E@Tr9]9x~SM.4[z).V.R~JK*..W:0...0..nmA5&..Gy..%..^a?\.11D>..k-...-%3NC..=d(.~Hg...L:3?o...}..~Ol....w4p}}(. .{.@.<.8....l(..p0a...<^....N...5L..1.....i)..@C...D`0B...!.....!..;.`P..A.5.D..Qf...;. pa!...f..2b"......`A....8......R.M.`..F....(>`.. ....N.x.HF...jx.s.F.1...H2.....#....;HTTP/1.1 200 OK..Content-Length: 715..Content-Type: image/gif..Last-Modified: Thu, 07 Apr 2005 17:25:22 GMT..Accept-Ranges: bytes..ETag: "02d4c7963bc51:3f4c"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Sun, 30 Aug 2015 14:56:54 GMT..GIF89a.....~........n...............................B.....x..[.....(c............................RS....wv...................Y.....~{....'...........|........A.................ie.Z[.__..g.M.................v..sr.`^.....................................>{.............&r....'..............F......g.O.....lo.^..jj..........NN.............n...s.................m...................S..$~................!.....~.,............~......stY..i..E@Tr9]9x~SM.4[z).V.R~JK*..W:0...0..nmA5&..Gy..%..^a?\.11D>..k-...-%3NC..=d(.~Hg...L:3?o...}..~Ol....w4p}}(. .{.@.<.8..

<<< skipped >>>

GET /cj.txt HTTP/1.1

Accept: */*

Accept-Language: en-us

If-Modified-Since: Thu, 01 Jan 1970 00:00:00 GMT

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: jc.941pojie.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 30 Aug 2015 14:56:36 GMT

Content-Length: 12977

Content-Type: text/plain

Content-Encoding: gzip

Content-Location: hXXp://jc.941pojie.com/cj.txt

Last-Modified: Sun, 23 Aug 2015 18:38:27 GMT

Accept-Ranges: bytes

ETag: "809346e6d2ddd01:840b3"

Vary: Accept-Encoding

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

...........}Y..8.....j.9..Bp....DH.D..\..?..G.s.-O...Q.q..jL&k.Eq... .....}..f(......./$.....j%h.....@L...((.."h .Z#.a.?...N|.R|.. ...C.4.....M......%F.G..u&,M.p.ntk.WC.\...OK/...:.l..4C.4......$8d;....x.\.A....Q~....O..._s....h>.|.G.Nc.6.....1h7........~......4f.m{.. }}}X...=.....dqH......c.&.ZM[Cr....$.._.x}..|&h.~..^&d..J..n....z.v.U.j.C<v.y.....4kQPc).<.y.QSL..b,...Y.u)...A..q...[....#..G.4.%.P...0gE.....,.......Ad.K.. .x....!)Y..D.. ...6.7..N.Y.k...:..Ksj.~...7W.jv$..D.`o.u...v..Z.|.....o.K[.,....W...........7x.n.<.'..5.%G....9.30^.L[.QR...Y=O...T.%.K.{..............?..[..u)B...U..u)...x....O............g0......4 !..&L2j......{....!.......yT.`.k]).... ........97...DV.d^.n.ju,.....LKC.p)5..a.W.I...I.G..ho.~....ZX.......M..H.U........OV....I_...............t..i....4.....m.G.$...m.....*5..2..#............j..b....Ao_.........N...gMS.a...?......... ..|.. .w.nV...sy[....T........n;.w.[.....C.;......R...... ..h^x......1(.,...{... )}8....\&...A .....g.K}....O...s=...$...l.D......Y......WP5.."y?.qB.].^.&{i{......<..s........5..2..h.SS.{.Z..!...kUW.)y...|..Q...'f.z..e......%....2.1I.,f.T8.!.|._...@..Q.s..Q1..{.u.~..).>.......>....yI]...j.$..)~.....9YF1.z.f.9R.!....\B...VF.Y...(RV.Q.E.A..i...4.My!n...3O...J...b...>,.SY...8...*h..Z.8....D..<....V.&..b...$..o..)w......<4k..g.h%.].....S.Ca...B..l....I....$.[K*]p....yh.....L...p.....].t..Vo... ='......9...........<......:...8.6.-.o....9..S.L.y......x..T. .l~.....Z......!.S....9P.(.a.A.C]C..:K.%&504q..*..Fq...i.?.7.........no_...&...."...D

<<< skipped >>>

GET /cxbt.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: cj.941pojie.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 30 Aug 2015 14:56:40 GMT

Content-Length: 31

Content-Type: text/plain

Content-Location: hXXp://cj.941pojie.com/cxbt.txt

Last-Modified: Sun, 01 Mar 2015 05:20:17 GMT

Accept-Ranges: bytes

ETag: "eafeb367df53d01:840bb"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

......................@........HTTP/1.1 200 OK..Date: Sun, 30 Aug 2015 14:56:40 GMT..Content-Length: 31..Content-Type: text/plain..Content-Location: hXXp://cj.941pojie.com/cxbt.txt..Last-Modified: Sun, 01 Mar 2015 05:20:17 GMT..Accept-Ranges: bytes..ETag: "eafeb367df53d01:840bb"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET........................@..........

GET /sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 30 Aug 2015 14:56:54 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Length: 0

HTTP/1.1 200 OK..Date: Sun, 30 Aug 2015 14:56:54 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Control: private..Content-Length: 0..

GET /zy.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: cj.941pojie.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 30 Aug 2015 14:56:38 GMT

Content-Length: 26

Content-Type: text/plain

Content-Location: hXXp://cj.941pojie.com/zy.txt

Last-Modified: Sun, 26 Apr 2015 14:12:28 GMT

Accept-Ranges: bytes

ETag: "02ed062b80d01:840bb"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

hXXp://soso.hcjd56.com:88/....

GET /tc.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: cj.941pojie.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 30 Aug 2015 14:56:38 GMT

Content-Length: 26

Content-Type: text/plain

Content-Location: hXXp://cj.941pojie.com/tc.txt

Last-Modified: Sun, 26 Apr 2015 14:12:08 GMT

Accept-Ranges: bytes

ETag: "246922fb2a80d01:840bb"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

hXXp://soso.hcjd56.com:88/HTTP/1.1 200 OK..Date: Sun, 30 Aug 2015 14:56:38 GMT..Content-Length: 26..Content-Type: text/plain..Content-Location: hXXp://cj.941pojie.com/tc.txt..Last-Modified: Sun, 26 Apr 2015 14:12:08 GMT..Accept-Ranges: bytes..ETag: "246922fb2a80d01:840bb"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..hXXp://soso.hcjd56.com:88/..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1736:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t$(SSh

t$(SSh

~%UVW

~%UVW

u$SShe

u$SShe

shlwapi.dll

shlwapi.dll

kernel32.dll

kernel32.dll

00414599

00414599

%System%\drivers\etc

%System%\drivers\etc

%System%\drivers\etc\hosts

%System%\drivers\etc\hosts

127.0.0.1 VVV.52anzu.com

127.0.0.1 VVV.52anzu.com

127.0.0.1 www1.52anzu.com

127.0.0.1 www1.52anzu.com

127.0.0.1 52anzu.com

127.0.0.1 52anzu.com

127.0.0.1 VVV.sopojie.com

127.0.0.1 VVV.sopojie.com

127.0.0.1 www1.sopojie.com

127.0.0.1 www1.sopojie.com

127.0.0.1 sopojie.com

127.0.0.1 sopojie.com

127.0.0.1 1.52yanzheng.sinaapp.com

127.0.0.1 1.52yanzheng.sinaapp.com

%System%\drivers\etc\protocol

%System%\drivers\etc\protocol

tcp 6 TCP # Transmission control protocol

tcp 6 TCP # Transmission control protocol

udp 17 UDP # User datagram protocol

udp 17 UDP # User datagram protocol

%System%\drivers\etc\services

%System%\drivers\etc\services

# This file contains port numbers for well-known services defined by IANA

# This file contains port numbers for well-known services defined by IANA

# / [aliases...] [#]

# / [aliases...] [#]

echo 7/tcp

echo 7/tcp

echo 7/udp

echo 7/udp

discard 9/tcp sink null

discard 9/tcp sink null

discard 9/udp sink null

discard 9/udp sink null

systat 11/tcp users #Active users

systat 11/tcp users #Active users

daytime 13/tcp

daytime 13/tcp

daytime 13/udp

daytime 13/udp

qotd 17/tcp quote #Quote of the day

qotd 17/tcp quote #Quote of the day

qotd 17/udp quote #Quote of the day

qotd 17/udp quote #Quote of the day

chargen 19/tcp ttytst source #Character generator

chargen 19/tcp ttytst source #Character generator

chargen 19/udp ttytst source #Character generator

chargen 19/udp ttytst source #Character generator

ftp-data 20/tcp #FTP, data

ftp-data 20/tcp #FTP, data

ftp 21/tcp #FTP. control

ftp 21/tcp #FTP. control

telnet 23/tcp

telnet 23/tcp

smtp 25/tcp mail #Simple Mail Transfer Protocol

smtp 25/tcp mail #Simple Mail Transfer Protocol

time 37/tcp timserver

time 37/tcp timserver

time 37/udp timserver

time 37/udp timserver

rlp 39/udp resource #Resource Location Protocol

rlp 39/udp resource #Resource Location Protocol

nameserver 42/tcp name #Host Name Server

nameserver 42/tcp name #Host Name Server

nameserver 42/udp name #Host Name Server

nameserver 42/udp name #Host Name Server

nicname 43/tcp whois

nicname 43/tcp whois

domain 53/tcp #Domain Name Server

domain 53/tcp #Domain Name Server

domain 53/udp #Domain Name Server

domain 53/udp #Domain Name Server

bootps 67/udp dhcps #Bootstrap Protocol Server

bootps 67/udp dhcps #Bootstrap Protocol Server

bootpc 68/udp dhcpc #Bootstrap Protocol Client

bootpc 68/udp dhcpc #Bootstrap Protocol Client

tftp 69/udp #Trivial File Transfer

tftp 69/udp #Trivial File Transfer

gopher 70/tcp

gopher 70/tcp

finger 79/tcp

finger 79/tcp

http 80/tcp www www-http #World Wide Web

http 80/tcp www www-http #World Wide Web

kerberos 88/tcp krb5 kerberos-sec #Kerberos

kerberos 88/tcp krb5 kerberos-sec #Kerberos

kerberos 88/udp krb5 kerberos-sec #Kerberos

kerberos 88/udp krb5 kerberos-sec #Kerberos

hostname 101/tcp hostnames #NIC Host Name Server

hostname 101/tcp hostnames #NIC Host Name Server

iso-tsap 102/tcp #ISO-TSAP Class 0

iso-tsap 102/tcp #ISO-TSAP Class 0

rtelnet 107/tcp #Remote Telnet Service

rtelnet 107/tcp #Remote Telnet Service

pop2 109/tcp postoffice #Post Office Protocol - Version 2

pop2 109/tcp postoffice #Post Office Protocol - Version 2

pop3 110/tcp #Post Office Protocol - Version 3

pop3 110/tcp #Post Office Protocol - Version 3

sunrpc 111/tcp rpcbind portmap #SUN Remote Procedure Call

sunrpc 111/tcp rpcbind portmap #SUN Remote Procedure Call

sunrpc 111/udp rpcbind portmap #SUN Remote Procedure Call

sunrpc 111/udp rpcbind portmap #SUN Remote Procedure Call

auth 113/tcp ident tap #Identification Protocol

auth 113/tcp ident tap #Identification Protocol

uucp-path 117/tcp

uucp-path 117/tcp

nntp 119/tcp usenet #Network News Transfer Protocol

nntp 119/tcp usenet #Network News Transfer Protocol

ntp 123/udp #Network Time Protocol

ntp 123/udp #Network Time Protocol

epmap 135/tcp loc-srv #DCE endpoint resolution

epmap 135/tcp loc-srv #DCE endpoint resolution

epmap 135/udp loc-srv #DCE endpoint resolution

epmap 135/udp loc-srv #DCE endpoint resolution

netbios-ns 137/tcp nbname #NETBIOS Name Service

netbios-ns 137/tcp nbname #NETBIOS Name Service

netbios-ns 137/udp nbname #NETBIOS Name Service

netbios-ns 137/udp nbname #NETBIOS Name Service

netbios-dgm 138/udp nbdatagram #NETBIOS Datagram Service

netbios-dgm 138/udp nbdatagram #NETBIOS Datagram Service

netbios-ssn 139/tcp nbsession #NETBIOS Session Service

netbios-ssn 139/tcp nbsession #NETBIOS Session Service

imap 143/tcp imap4 #Internet Message Access Protocol

imap 143/tcp imap4 #Internet Message Access Protocol

pcmail-srv 158/tcp #PCMail Server

pcmail-srv 158/tcp #PCMail Server

snmp 161/udp #SNMP

snmp 161/udp #SNMP

snmptrap 162/udp snmp-trap #SNMP trap

snmptrap 162/udp snmp-trap #SNMP trap

print-srv 170/tcp #Network PostScript

print-srv 170/tcp #Network PostScript

bgp 179/tcp #Border Gateway Protocol

bgp 179/tcp #Border Gateway Protocol

irc 194/tcp #Internet Relay Chat Protocol

irc 194/tcp #Internet Relay Chat Protocol

ipx 213/udp #IPX over IP

ipx 213/udp #IPX over IP

ldap 389/tcp #Lightweight Directory Access Protocol

ldap 389/tcp #Lightweight Directory Access Protocol

https 443/tcp MCom

https 443/tcp MCom

https 443/udp MCom

https 443/udp MCom

microsoft-ds 445/tcp

microsoft-ds 445/tcp

microsoft-ds 445/udp

microsoft-ds 445/udp

kpasswd 464/tcp # Kerberos (v5)

kpasswd 464/tcp # Kerberos (v5)

kpasswd 464/udp # Kerberos (v5)

kpasswd 464/udp # Kerberos (v5)

isakmp 500/udp ike #Internet Key Exchange

isakmp 500/udp ike #Internet Key Exchange

exec 512/tcp #Remote Process Execution

exec 512/tcp #Remote Process Execution

biff 512/udp comsat

biff 512/udp comsat

login 513/tcp #Remote Login

login 513/tcp #Remote Login

who 513/udp whod

who 513/udp whod

cmd 514/tcp shell

cmd 514/tcp shell

syslog 514/udp

syslog 514/udp

printer 515/tcp spooler

printer 515/tcp spooler

talk 517/udp

talk 517/udp

ntalk 518/udp

ntalk 518/udp

efs 520/tcp #Extended File Name Server

efs 520/tcp #Extended File Name Server

router 520/udp route routed

router 520/udp route routed

timed 525/udp timeserver

timed 525/udp timeserver

tempo 526/tcp newdate

tempo 526/tcp newdate

courier 530/tcp rpc

courier 530/tcp rpc

conference 531/tcp chat

conference 531/tcp chat

netnews 532/tcp readnews

netnews 532/tcp readnews

netwall 533/udp #For emergency broadcasts

netwall 533/udp #For emergency broadcasts

uucp 540/tcp uucpd

uucp 540/tcp uucpd

klogin 543/tcp #Kerberos login

klogin 543/tcp #Kerberos login

kshell 544/tcp krcmd #Kerberos remote shell

kshell 544/tcp krcmd #Kerberos remote shell

new-rwho 550/udp new-who

new-rwho 550/udp new-who

remotefs 556/tcp rfs rfs_server

remotefs 556/tcp rfs rfs_server

rmonitor 560/udp rmonitord

rmonitor 560/udp rmonitord

monitor 561/udp

monitor 561/udp

ldaps 636/tcp sldap #LDAP over TLS/SSL

ldaps 636/tcp sldap #LDAP over TLS/SSL

doom 666/tcp #Doom Id Software

doom 666/tcp #Doom Id Software

doom 666/udp #Doom Id Software

doom 666/udp #Doom Id Software

kerberos-adm 749/tcp #Kerberos administration

kerberos-adm 749/tcp #Kerberos administration

kerberos-adm 749/udp #Kerberos administration

kerberos-adm 749/udp #Kerberos administration

kerberos-iv 750/udp #Kerberos version IV

kerberos-iv 750/udp #Kerberos version IV

kpop 1109/tcp #Kerberos POP

kpop 1109/tcp #Kerberos POP

phone 1167/udp #Conference calling

phone 1167/udp #Conference calling

ms-sql-s 1433/tcp #Microsoft-SQL-Server

ms-sql-s 1433/tcp #Microsoft-SQL-Server

ms-sql-s 1433/udp #Microsoft-SQL-Server

ms-sql-s 1433/udp #Microsoft-SQL-Server

ms-sql-m 1434/tcp #Microsoft-SQL-Monitor

ms-sql-m 1434/tcp #Microsoft-SQL-Monitor

ms-sql-m 1434/udp #Microsoft-SQL-Monitor

ms-sql-m 1434/udp #Microsoft-SQL-Monitor

wins 1512/tcp #Microsoft Windows Internet Name Service

wins 1512/tcp #Microsoft Windows Internet Name Service

wins 1512/udp #Microsoft Windows Internet Name Service

wins 1512/udp #Microsoft Windows Internet Name Service

ingreslock 1524/tcp ingres

ingreslock 1524/tcp ingres

l2tp 1701/udp #Layer Two Tunneling Protocol

l2tp 1701/udp #Layer Two Tunneling Protocol

pptp 1723/tcp #Point-to-point tunnelling protocol

pptp 1723/tcp #Point-to-point tunnelling protocol

radius 1812/udp #RADIUS authentication protocol

radius 1812/udp #RADIUS authentication protocol

radacct 1813/udp #RADIUS accounting protocol

radacct 1813/udp #RADIUS accounting protocol

nfsd 2049/udp nfs #NFS server

nfsd 2049/udp nfs #NFS server

knetd 2053/tcp #Kerberos de-multiplexor

knetd 2053/tcp #Kerberos de-multiplexor

man 9535/tcp #Remote Man Server

man 9535/tcp #Remote Man Server

%System%\drivers\etc\lmhosts.sam

%System%\drivers\etc\lmhosts.sam

# This is a sample LMHOSTS file used by the Microsoft TCP/IP for Windows.

# This is a sample LMHOSTS file used by the Microsoft TCP/IP for Windows.

# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts

# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts

# \0xnn (non-printing character support)

# \0xnn (non-printing character support)

# browser and logon services behave in TCP/IP environments. To preload

# browser and logon services behave in TCP/IP environments. To preload

# be able to read the lmhosts file successfully. This key is under

# be able to read the lmhosts file successfully. This key is under

# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE

# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE

# 102.54.94.97 rhino #PRE #DOM:networking #net group's DC

# 102.54.94.97 rhino #PRE #DOM:networking #net group's DC

# 102.54.94.102 "appname \0x14" #special app server

# 102.54.94.102 "appname \0x14" #special app server

# 102.54.94.123 popular #PRE #source server

# 102.54.94.123 popular #PRE #source server

# 102.54.94.117 localsrv #PRE #needed for the include

# 102.54.94.117 localsrv #PRE #needed for the include

%System%\drivers\etc\networks

%System%\drivers\etc\networks

# campus 284.122.107

# campus 284.122.107

# london 284.122.108

# london 284.122.108

D:\wscntmx.exe

D:\wscntmx.exe

`.data

`.data

@.vmp0

@.vmp0

`.vmp1

`.vmp1

.reloc

.reloc

}~/%D(

}~/%D(

.;6 (&%

.;6 (&%

1

1

1=;;6 )%#

1=;;6 )%#

=

=

=

=

=

=

==

==

=

=

=

=

=

=

==

==

=

=

e{TP.cda8

e{TP.cda8

U#ex'B-n}

U#ex'B-n}

MSVBVM60.DLL

MSVBVM60.DLL

user32.dll

user32.dll

5i.Id(HE

5i.Id(HE

~32.bd~

~32.bd~

.sKpK

.sKpK

.soAw?

.soAw?

.qT3

.qT3

hXXp://cj.941pojie.com/tc.txt

hXXp://cj.941pojie.com/tc.txt

hXXp://cj.941pojie.com/zy.txt

hXXp://cj.941pojie.com/zy.txt

hXXp://cj.941pojie.com/cxbt.txt

hXXp://cj.941pojie.com/cxbt.txt

hXXp://cj.941pojie.com/wbzz.txt

hXXp://cj.941pojie.com/wbzz.txt

.aspack

.aspack

.adata

.adata

.xqrq

.xqrq

.pH`X|

.pH`X|

.YON=

.YON=

p*.LIAt

p*.LIAt

5].NQg

5].NQg

=.cw| r\

=.cw| r\

C @Qb%3Ua@.5

C @Qb%3Ua@.5

l(8i?ZiDf\.SQ

l(8i?ZiDf\.SQ

%C*pig

%C*pig

The procedure entry point %s could not be located in the dynamic link library %s

The procedure entry point %s could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

comctl32.dll

comctl32.dll

gdi32.dll

gdi32.dll

msimg32.dll

msimg32.dll

msvcrt.dll

msvcrt.dll

msvfw32.dll

msvfw32.dll

hXXp://VVV.eyybc.com

hXXp://VVV.eyybc.com

\skinh.she

\skinh.she

M.GG^

M.GG^

%s T5

%s T5

]E4%F(

]E4%F(

.Funr

.Funr

.yyw'

.yyw'

%sX@:`

%sX@:`

J|.jv

J|.jv

p4%xcEm

p4%xcEm

.Jr1Z

.Jr1Z

7.YT"

7.YT"

.Uf!0

.Uf!0

!a%U}

!a%U}

[I(3/#N0.bd

[I(3/#N0.bd

j"%u=w

j"%u=w

q%Xn`

q%Xn`

@|H.NI

@|H.NI

.wdd!

.wdd!

S|%u4

S|%u4

5.ff)

5.ff)

;)?/\%~|/

;)?/\%~|/

U%D?~;

U%D?~;

l2.Ue

l2.Ue

9%crU

9%crU

XKw-k}

XKw-k}

zx/%FN[

zx/%FN[

LY.eo

LY.eo

z{.Do

z{.Do

%s=\RI

%s=\RI

}j%c%Y)

}j%c%Y)

Rx.GR

Rx.GR

4o#.dM

4o#.dM

IeS`%C

IeS`%C

[n 4\.UY

[n 4\.UY

,4.qO,

,4.qO,

gQ'.Io

gQ'.Io

%cLur?

%cLur?

s%DHB

s%DHB

]I%%X

]I%%X

I %d)

I %d)

.aEd(

.aEd(

Õ6m*

Õ6m*

5r.US

5r.US

:mD].tB

:mD].tB

fJ.WM_

fJ.WM_

fTpe

fTpe

.LLbX

.LLbX

f%fUZ

f%fUZ

.fOuV12

.fOuV12

*_.dC

*_.dC

&-N}

&-N}

({?.cQm

({?.cQm

R>o2.YN>

R>o2.YN>

.Cqx~c

.Cqx~c

.`.Qw

.`.Qw

.Onwj

.Onwj

Tn&.hL

Tn&.hL

**.dU

**.dU

%s;7*

%s;7*

0%x@w

0%x@w

%C^L:

%C^L:

CX%xm

CX%xm

!n]%x

!n]%x

%X,Cr

%X,Cr

*.Ea]S

*.Ea]S

Q.CGo

Q.CGo

tn!ay%F

tn!ay%F

2.kKX

2.kKX

Avi.CT

Avi.CT

xhZ_6%U

xhZ_6%U

%SY!8i

%SY!8i

&.PFy{xh

&.PFy{xh

sG.qmf

sG.qmf

5.ZrW

5.ZrW

%Ucda

%Ucda

n.BjCw

n.BjCw

.um ZZE7L

.um ZZE7L

/^p%u$

/^p%u$

I.NoQY

I.NoQY

zu.ew

zu.ew

D/.nT

D/.nT

z.LP"

z.LP"

.IRIx

.IRIx

"%Sh9

"%Sh9

&;%sUwa

&;%sUwa

kBS%dR

kBS%dR

VVV.meitu.com

VVV.meitu.com

M%u{$

M%u{$

;s.iF

;s.iF

9E.nV

9E.nV

X-.RP

X-.RP

>.xKA

>.xKA

uDPf

uDPf

jc.941pojie.com/jiaqun.htm

jc.941pojie.com/jiaqun.htm

F%*.*f

F%*.*f

CNotSupportedException

CNotSupportedException

commctrl_DragListMsg

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

Afx:%x:%x

COMCTL32.DLL

COMCTL32.DLL

CCmdTarget

CCmdTarget

ole32.dll

ole32.dll

__MSVCRT_HEAP_SELECT

__MSVCRT_HEAP_SELECT

RASAPI32.dll

RASAPI32.dll

iphlpapi.dll

iphlpapi.dll

SHLWAPI.dll

SHLWAPI.dll

MPR.dll

MPR.dll

WINMM.dll

WINMM.dll

WS2_32.dll

WS2_32.dll

VERSION.dll

VERSION.dll

GetProcessHeap

GetProcessHeap

WinExec

WinExec

KERNEL32.dll

KERNEL32.dll

GetKeyState

GetKeyState

USER32.dll

USER32.dll

GetViewportOrgEx

GetViewportOrgEx

GDI32.dll

GDI32.dll

WINSPOOL.DRV

WINSPOOL.DRV

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyExA

RegCreateKeyExA

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

OLEAUT32.dll

OLEAUT32.dll

COMCTL32.dll

COMCTL32.dll

oledlg.dll

oledlg.dll

WSOCK32.dll

WSOCK32.dll

HttpQueryInfoA

HttpQueryInfoA

HttpSendRequestA

HttpSendRequestA

HttpOpenRequestA

HttpOpenRequestA

InternetCrackUrlA

InternetCrackUrlA

InternetCanonicalizeUrlA

InternetCanonicalizeUrlA

WININET.dll

WININET.dll

GetCPInfo

GetCPInfo

CreateDialogIndirectParamA

CreateDialogIndirectParamA

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExA

SetWindowsHookExA

SetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

SetViewportExtEx

ScaleViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

GetViewportExtEx

comdlg32.dll

comdlg32.dll

%x.tmp

%x.tmp

.PAVCException@@

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.prn)|*.prn|

(*.*)|*.*||

(*.*)|*.*||

Shell32.dll

Shell32.dll

Mpr.dll

Mpr.dll

Advapi32.dll

Advapi32.dll

User32.dll

User32.dll

Gdi32.dll

Gdi32.dll

Kernel32.dll

Kernel32.dll

(&07-034/)7 '

(&07-034/)7 '

?? / %d]

?? / %d]

%d / %d]

%d / %d]

: %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

(*.CUR)|*.CUR|

%s:%d

%s:%d

windows

windows

out.prn

out.prn

%d.%d

%d.%d

%d / %d

%d / %d

%d/%d

%d/%d

Bogus message code %d

Bogus message code %d

(%d-%d):

(%d-%d):

%ld%c

%ld%c

(*.htm;*.html)|*.htm;*.html

(*.htm;*.html)|*.htm;*.html

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

HTTP/1.0

%s

%s

Reply-To: %s

Reply-To: %s

From: %s

From: %s

To: %s

To: %s

Subject: %s

Subject: %s

Date: %s

Date: %s

Cc: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

%a, %d %b %Y %H:%M:%S

SMTP

SMTP

VVV.dywt.com.cn

VVV.dywt.com.cn

.PAVCOleException@@

.PAVCOleException@@

.PAVCObject@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCResourceException@@

.PAVCUserException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

.PAVCArchiveException@@

.PAVCOleDispatchException@@

.PAVCOleDispatchException@@

zcÁ

zcÁ

c:\%original file name%.exe

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

#include "l.chs\afxres.rc" // Standard components

360.cn

360.cn

hosts2.exe

hosts2.exe

1, 0, 6, 6

1, 0, 6, 6

SkinH_EL.dll

SkinH_EL.dll

(*.*)

(*.*)

1.0.0.0

1.0.0.0

(hXXp://VVV.eyuyan.com)

(hXXp://VVV.eyuyan.com)

wscntmx.exe_1288:

.text

.text

`.data

`.data

.rsrc

.rsrc

@.vmp0

@.vmp0

`.vmp1

`.vmp1

.reloc

.reloc

}~/%D(

}~/%D(

.;6 (&%

.;6 (&%

1

1

1=;;6 )%#

1=;;6 )%#

=

=

=

=

=

=

==

==

=

=

=

=

=

=

==

==

=

=

attrib -r -s -h %windir%\system32\drivers\etc\hosts.ics

attrib -r -s -h %windir%\system32\drivers\etc\hosts.ics

attrib -r -s -h %windir%\system32\wbem\window\winxp.ics

attrib -r -s -h %windir%\system32\wbem\window\winxp.ics

#vb6chs.dll

#vb6chs.dll

%Program Files%\VB

%Program Files%\VB

\VB6.OLB

\VB6.OLB

advapi32.dll

advapi32.dll

RegCloseKey

RegCloseKey

RegCreateKeyA

RegCreateKeyA

RegOpenKeyA

RegOpenKeyA

VBA6.DLL

VBA6.DLL

e{TP.cda8

e{TP.cda8

U#ex'B-n}

U#ex'B-n}

MSVBVM60.DLL

MSVBVM60.DLL

user32.dll

user32.dll

5i.Id(HE

5i.Id(HE

~32.bd~

~32.bd~

.sKpK

.sKpK

.soAw?

.soAw?

.qT3

.qT3

kernel32.dll

kernel32.dll

SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN

SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN

Microsoft.XMLHTTP

Microsoft.XMLHTTP

hXXp://jc.941pojie.com/cj.txt

hXXp://jc.941pojie.com/cj.txt

%System%\drivers\etc

%System%\drivers\etc

%System%\drivers\etc\hosts

%System%\drivers\etc\hosts

c:\windows\system32\drivers\etc\hosts

c:\windows\system32\drivers\etc\hosts

c:\windows\system32\drivers\etc\hosts.ics

c:\windows\system32\drivers\etc\hosts.ics

c:\a.bat

c:\a.bat

c:\b.bat

c:\b.bat

zhaosf.com

zhaosf.com

Adodb.Stream

Adodb.Stream

360.cn

360.cn

windows

windows

hosts2.exe

hosts2.exe

wscntmx.exe_1288_rwx_0041F000_00001000:

MSVBVM60.DLL

MSVBVM60.DLL

user32.dll

user32.dll

iexplore.exe_484:

%?9-*09,*19}*09

%?9-*09,*19}*09

.text

.text

`.data

`.data

.rsrc

.rsrc

msvcrt.dll

msvcrt.dll

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

USER32.dll

USER32.dll

SHLWAPI.dll

SHLWAPI.dll

SHDOCVW.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

IE-X-X

rsabase.dll

rsabase.dll

System\CurrentControlSet\Control\Windows

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

dw15 -x -s %u

watson.microsoft.com

watson.microsoft.com

IEWatsonURL

IEWatsonURL

%s -h %u

%s -h %u

iedw.exe

iedw.exe

Iexplore.XPExceptionFilter

Iexplore.XPExceptionFilter

jscript.DLL

jscript.DLL

mshtml.dll

mshtml.dll

mlang.dll

mlang.dll

urlmon.dll

urlmon.dll

wininet.dll

wininet.dll

shdocvw.DLL

shdocvw.DLL

browseui.DLL

browseui.DLL

comctl32.DLL

comctl32.DLL

IEXPLORE.EXE

IEXPLORE.EXE

iexplore.pdb

iexplore.pdb

ADVAPI32.dll

ADVAPI32.dll

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

IExplorer.EXE

IExplorer.EXE

IIIIIB(II<.fg>

IIIIIB(II<.fg>

7?_____ZZSSH%

7?_____ZZSSH%

)z.UUUUUUUU

)z.UUUUUUUU

,....Qym

,....Qym

````2```

````2```

{.QLQIIIKGKGKGKGKGKG

{.QLQIIIKGKGKGKGKGKG

;33;33;0

;33;33;0

8888880

8888880

8887080

8887080

browseui.dll

browseui.dll

shdocvw.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

6.00.2900.5512 (xpsp.080413-2105)

Windows

Windows

Operating System

Operating System

6.00.2900.5512

6.00.2900.5512

wscntmx.exe_1288_rwx_00426000_00001000:

.soAw?

.soAw?

.qT3

.qT3

kernel32.dll

kernel32.dll