HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Strictor.29584 (B) (Emsisoft), Gen:Variant.Strictor.29584 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.IEDummy.FD, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 20069696096089107067816004071bfd
SHA1: b733bc45b89e2b782e93155a0caaeb11740ed5f5
SHA256: 0918c983ce00c2002b91170e0810bcdf422b6e64827d24a7f9055b71e1715604
SSDeep: 24576:7NBaERO0P7v7vOi3FwV0vOVyNzKRBehm9dN3YvandAk hr7987A:7NBFVrLp3DOVsYs8dFYvanGVhr7r
Size: 2060288 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2015-05-24 08:23:11
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-PSW. Trojan program intended for stealing users passwords.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
attrib.exe:1884
attrib.exe:1692
attrib.exe:1208
attrib.exe:636
cacls.exe:612
cacls.exe:1976
cacls.exe:224
cacls.exe:1260
cacls.exe:592
The Trojan injects its code into the following process(es):
wscntmx.exe:1288
%original file name%.exe:1736
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process wscntmx.exe:1288 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\b.bat (255 bytes)
%System%\drivers\etc\hosts.ics (17013 bytes)
C:\a.bat (356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\cj[1].txt (4605 bytes)
%System%\drivers\etc\hosts (16478 bytes)
The process %original file name%.exe:1736 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\43881.tmp (15 bytes)
%System%\drivers\etc\protocol (799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\style[1].css (12015 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\game[1].htm (32375 bytes)
%System%\drivers\etc\networks (407 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso.hcjd56[2].txt (313 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\click[1].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\jiaqun[1].htm (254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\title-bg[1].jpg (1458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\bg[1].jpg (61672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\drivers\etc\lmhosts.sam (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso.hcjd56[1].txt (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\soso.hcjd56[1].htm (1199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\count1[1].gif (715 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (788 bytes)
%System%\drivers\etc\services (7 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\43881.tmp (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso.hcjd56[1].txt (0 bytes)
Registry activity
The process attrib.exe:1884 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 D2 58 95 FA 47 AB 73 0A A7 1C 10 44 95 B5 FE"
The process attrib.exe:1692 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 4E A5 D4 76 3B 69 E6 3F DE BE E1 C0 FD 7D E6"
The process attrib.exe:1208 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 A5 F0 9B 95 5A A2 CD 15 F5 D0 14 06 B9 60 F1"
The process attrib.exe:636 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 D5 31 63 D8 92 6B C8 C0 85 4D 96 EA AA 17 B6"
The process wscntmx.exe:1288 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF E4 EC 0D DB CE 28 1D 6C E1 5F DE 63 15 B7 94"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wscntmx" = "D:\\wscntmx.exe"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process %original file name%.exe:1736 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 84 27 1F 6D BE 93 91 B2 8A 85 67 9A DD 8D F2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process cacls.exe:612 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 64 D6 8E 71 C3 6D B8 11 2E D4 5B ED C7 11 D4"
The process cacls.exe:1976 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 C6 69 F6 EF 92 B0 DA 63 21 D6 29 12 45 7D F9"
The process cacls.exe:224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B 89 C8 FC 2B B0 E3 91 27 83 ED 82 CC 42 1C BD"
The process cacls.exe:1260 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 DD EE 42 0B 2C 29 7A 6E 2F CE AA A4 CD 4E 21"
The process cacls.exe:592 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 67 03 8C 79 5D 3B 46 B6 CE 9F 41 C8 BA A4 00"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 65537 bytes in size. The following strings are added to the hosts file listed below:
23.234.20.24 | www.gmbbk.cn |
23.234.20.24 | www.180sf.net |
23.234.20.24 | www.jielesh.com |
23.234.20.24 | www2.9ozz.com |
23.234.20.24 | t1.jscxmp.cn |
23.234.20.24 | www.30tw.net |
23.234.20.24 | zhaofu.520kq.com |
23.234.20.24 | 679pk.wudi.679pk.679pk.com |
23.234.20.24 | wanfu.hy5166.com |
23.234.20.24 | www2.9ozz.com |
23.234.20.24 | www.tjits.cn |
23.234.20.24 | www.cnewworld.com |
23.234.20.24 | www.hzxhdj.com |
23.234.20.24 | www.hbsme.gov.cn |
23.234.20.24 | n55.xdjmall.cn |
23.234.20.24 | xs8c8.kingsandqueens |
23.234.20.24 | 39vpj.btcqianbao.cn |
23.234.20.24 | www.yonghui16.com |
23.234.20.24 | www.mxmill.com |
23.234.20.24 | www.jntc.nm.cn |
23.234.20.24 | www.mishicq.com |
23.234.20.24 | 123.u432.com |
23.234.20.24 | 123.vvq13.com |
23.234.20.24 | 123.vvq14.com |
23.234.20.24 | 123.vvq15.com |
23.234.20.24 | www.45730.com |
23.234.20.24 | 52145-118uc.fhough.com |
23.234.20.24 | wvvw.58sf-9.com |
23.234.20.24 | www.lywap.com |
23.234.20.24 | a52145.jzs01.com |
23.234.20.24 | z6.xfgzs.net |
23.234.20.24 | www.tz-wd.com |
23.234.20.24 | www.mt30.net |
23.234.20.24 | wanfu.966ty.com |
23.234.20.24 | www.st991.com |
23.234.20.24 | 988.pa579.com |
23.234.20.24 | 5k.611739.com |
23.234.20.24 | www1.vzhishu.com |
23.234.20.24 | pk.memekr.com |
23.234.20.24 | veletuan.com |
23.234.20.24 | mir.qq.com |
23.234.20.24 | h.081983.com |
23.234.20.24 | www.118902.com |
23.234.20.24 | www.yjxkj.com |
23.234.20.24 | www.121578.com |
23.234.20.24 | b.memekr.com |
23.234.20.24 | www.k1f.net |
23.234.20.24 | www.btzol.com |
23.234.20.24 | z.icloud3g.com |
23.234.20.24 | www.zhaosf.com.cn |
23.234.20.24 | www.xr-1688.com |
23.234.20.24 | 679pk.679pk.com |
23.234.20.24 | g.zhenhgw.com |
23.234.20.24 | www2.memekr.com |
23.234.20.24 | z.wgmtrade.com |
23.234.20.24 | v.zhenhgw.com |
23.234.20.24 | c.vbbse4.com |
23.234.20.24 | www1.memekr.com |
23.234.20.24 | www.kfb126.com |
23.234.20.24 | huikaimin.blog.163.com |
23.234.20.24 | k.memekr.com |
23.234.20.24 | p.veletuan.com |
23.234.20.24 | c.btg55.com |
23.234.20.24 | v.cpjp737.com |
23.234.20.24 | www.agou920.com |
23.234.20.24 | first.cpjp737.com |
23.234.20.24 | c.veletuan.com |
23.234.20.24 | head.memekr.com |
23.234.20.24 | g.veletuan.com |
23.234.20.24 | g.zhenhgw.com |
23.234.20.24 | v.cpjp737.com |
23.234.20.24 | s.vzhishu.com |
23.234.20.24 | memekr.com |
23.234.20.24 | v.zhenhgw.com |
23.234.20.24 | c.vbbse4.com |
23.234.20.24 | k.memekr.com |
23.234.20.24 | p.veletuan.com |
23.234.20.24 | www.schzhp.cn |
23.234.20.24 | memekr.com |
23.234.20.24 | www.jlwfbdc.com |
23.234.20.24 | t.vzhishu.com |
23.234.20.24 | 8.zhenhgw.com |
23.234.20.24 | www.210cq.com |
23.234.20.24 | z.veletuan.com |
23.234.20.24 | 1.zhenhgw.com |
23.234.20.24 | y.vzhishu.com |
23.234.20.24 | www.680sf.com |
23.234.20.24 | www.81945.com |
23.234.20.24 | www.45574.com |
23.234.20.24 | 680sf.com |
23.234.20.24 | 81945.com |
23.234.20.24 | 45574.com |
23.234.20.24 | c.cpjp737.com |
23.234.20.24 | lm.363.com |
23.234.20.24 | v.wxyxe.com |
23.234.20.24 | www.ahzttz.com |
23.234.20.24 | xup.88448.com |
23.234.20.24 | www.88448.com |
23.234.20.24 | www.aaastor.com |
23.234.20.24 | www.delos-lighting.com |
23.234.20.24 | www.tlwz.org |
23.234.20.24 | www.zddiu.com |
23.234.20.24 | www.monthidc.com |
23.234.20.24 | www.chinawlf.com |
23.234.20.24 | www.blueanimalbio.com |
23.234.20.24 | www.dfac.com |
23.234.20.24 | www.glzyz.com |
23.234.20.24 | www.hxsiyuan.cn |
23.234.20.24 | www.wohuixue.com |
23.234.20.24 | wvw.1234pk.com |
23.234.20.24 | 1234pk.com |
23.234.20.24 | www.nc334yy.com |
23.234.20.24 | www.cqjztc.com |
23.234.20.24 | www.cdsdsy.net |
23.234.20.24 | www.cjfans.com |
23.234.20.24 | www.jsfoundry.com |
23.234.20.24 | www.handanyz.com |
23.234.20.24 | www.lingxiao.com.cn |
23.234.20.24 | www.jfpgs.com |
23.234.20.24 | hjc.bingdaofz.com |
23.234.20.24 | www.romanting.com |
23.234.20.24 | dns.ic123.cc |
23.234.20.24 | ad.036yx.com |
23.234.20.24 | www.lingxiao.com.cn |
23.234.20.24 | www.hwxxkj.com |
23.234.20.24 | www.ypdzkj.com |
23.234.20.24 | www.starworldhk.com |
23.234.20.24 | www.nfgt.com |
23.234.20.24 | v.vzhishu.com |
23.234.20.24 | 8.zhenhgw.com |
23.234.20.24 | www.blgmj.com |
23.234.20.24 | www.962sf.com |
23.234.20.24 | www.bingdaofz.com |
23.234.20.24 | bingdaofz.com |
23.234.20.24 | zhaof.icloud3g.com |
23.234.20.24 | www.326sf.com |
23.234.20.24 | www.813sf.com |
23.234.20.24 | www.45chuanqi45.com |
23.234.20.24 | www.1213sf.com |
23.234.20.24 | g.zhenhgw.com |
23.234.20.24 | as.xfgzs.net |
23.234.20.24 | b.memekr.com |
23.234.20.24 | n.veletuan.com |
23.234.20.24 | cdn.9377t.com |
23.234.20.24 | v.memekr.com |
23.234.20.24 | www.dnkbl.com |
23.234.20.24 | 6.zhenhgw.com |
23.234.20.24 | j.cpjp737.com |
23.234.20.24 | 1.veletuan.com |
23.234.20.24 | www.sjcjlb.cn |
23.234.20.24 | p.cpjp737.com |
23.234.20.24 | p.cpjp737.com |
23.234.20.24 | zhaof1.wgmtrade.com |
23.234.20.24 | www.xinjiasu.com |
23.234.20.24 | www.jwbjc.com |
23.234.20.24 | www.mmgyz.net |
23.234.20.24 | i.611739.com |
23.234.20.24 | www.eggtt.com |
23.234.20.24 | www.gm635.com |
23.234.20.24 | k.7it7.com |
23.234.20.24 | www.zizhixuke.com |
23.234.20.24 | www.nfgt.com |
23.234.20.24 | www.mmgyz.net |
23.234.20.24 | www.ku30.com |
23.234.20.24 | ku30.com |
23.234.20.24 | f.081983.com |
23.234.20.24 | 7.081983.com |
23.234.20.24 | www.chuge8.com |
23.234.20.24 | www.wanms.com |
23.234.20.24 | 1.kitefeung.com |
23.234.20.24 | 1.liaochengjiayuan.com |
23.234.20.24 | www.foodzhan.com |
23.234.20.24 | eggtt.com |
23.234.20.24 | www.915youxi.com |
23.234.20.24 | 915youxi.com |
23.234.20.24 | d.131f.com |
23.234.20.24 | y.118902.com |
23.234.20.24 | 1.7it7.com |
23.234.20.24 | www.91wanfu.com |
23.234.20.24 | 91wanfu.com |
23.234.20.24 | www.quwanfu.com |
23.234.20.24 | quwanfu.com |
23.234.20.24 | www.91wuc.com |
23.234.20.24 | www.zhaosf.com |
23.234.20.24 | www.gykailijx.com |
23.234.20.24 | q.611739.com |
23.234.20.24 | www.588by.com |
23.234.20.24 | duang.5com.cc |
23.234.20.24 | 91wuc.com |
23.234.20.24 | www.sy170.com |
23.234.20.24 | tzlsofa.com |
23.234.20.24 | www.tzlsofa.com |
23.234.20.24 | k.v58d.com |
23.234.20.24 | www.119021.com |
23.234.20.24 | 121578.com |
23.234.20.24 | www.cq7373.com |
23.234.20.24 | ht.80honey.com |
23.234.20.24 | www.hongbzn.com |
23.234.20.24 | www.cfbingyue.cc |
23.234.20.24 | www.zgjingyi.com |
23.234.20.24 | youxi.036yx.com |
23.234.20.24 | www.wxboao.com |
23.234.20.24 | jh.j550.com |
23.234.20.24 | 33ok.com |
23.234.20.24 | www.52zhaosf.com |
23.234.20.24 | 52zhaosf.com |
23.234.20.24 | www.zhaosf123.co |
23.234.20.24 | www.455151.com |
23.234.20.24 | 455151.com |
23.234.20.24 | www.zhaosf.at |
23.234.20.24 | zhaosf.cc |
23.234.20.24 | www.zhaosf.cc |
23.234.20.24 | www.zhaosf.org.cn |
23.234.20.24 | www.mcjd.net |
23.234.20.24 | z.611739.com |
23.234.20.24 | www.911wanwan.com |
23.234.20.24 | www.517zg.com |
23.234.20.24 | www.dju8.com |
23.234.20.24 | www.kfb163.com |
23.234.20.24 | www.7t57.com |
23.234.20.24 | 33ok.cm |
23.234.20.24 | www.33ok.com |
23.234.20.24 | www1.33ok.com |
23.234.20.24 | www2.33ok.com |
23.234.20.24 | www3.33ok.com |
23.234.20.24 | www4.33ok.com |
23.234.20.24 | www.520mc.cn |
23.234.20.24 | x.118902.com |
23.234.20.24 | www.2kfb.com |
23.234.20.24 | www.mcjiuju.cn |
23.234.20.24 | zgjingyi.com |
23.234.20.24 | aaa.xu98.com |
23.234.20.24 | pk05.90523.com |
23.234.20.24 | www.chasf.com |
23.234.20.24 | 9.611739.com |
23.234.20.24 | m.611739.com |
23.234.20.24 | k.118902.com |
23.234.20.24 | www.338mu.com |
23.234.20.24 | first.611739.com |
23.234.20.24 | p.081983.com |
23.234.20.24 | www.sxrdwy.com |
23.234.20.24 | happy.118902.com |
23.234.20.24 | sxrdwy.com |
23.234.20.24 | www.zhxsjc.com |
23.234.20.24 | zhxsjc.com |
23.234.20.24 | bg.118902.com |
23.234.20.24 | www.234wy.com |
23.234.20.24 | ku.081983.com |
23.234.20.24 | www.1000q.com |
23.234.20.24 | 1000q.com |
23.234.20.24 | vip.h1995.com |
23.234.20.24 | www.1745.com |
23.234.20.24 | www.hzmeixin.com |
23.234.20.24 | hzmeixin.com |
23.234.20.24 | g.mt30.net |
23.234.20.24 | www.miehunsha.com |
23.234.20.24 | miehunsha.com |
23.234.20.24 | www.miehunwg.com |
23.234.20.24 | miehunwg.com |
23.234.20.24 | www.qdcyrc.com |
23.234.20.24 | www.180sf.net |
23.234.20.24 | www.zhengzhouzp.cn |
23.234.20.24 | pd.mt30.net |
23.234.20.24 | j.118902.com |
23.234.20.24 | n.611739.com |
23.234.20.24 | www.988wanwan.com |
23.234.20.24 | www.909wanwan.com |
23.234.20.24 | www.999wanwan.com |
23.234.20.24 | www.57ab.com |
23.234.20.24 | kh.mt30.net |
23.234.20.24 | zhaof.ctc0.com |
23.234.20.24 | kd.611739.com |
23.234.20.24 | www.456yx.com |
23.234.20.24 | 456yx.com |
23.234.20.24 | www.3355sf.com |
23.234.20.24 | xx.611739.com |
23.234.20.24 | 3355sf.com |
23.234.20.24 | www.3355sf.com |
23.234.20.24 | ee.mt30.net |
23.234.20.24 | tb.25jx.net |
23.234.20.24 | ko.u25u.com |
23.234.20.24 | hc.25jx.net |
23.234.20.24 | kk.u25u.com |
23.234.20.24 | y.611739.com |
23.234.20.24 | co.118902.com |
23.234.20.24 | stat.5pk.com |
23.234.20.24 | sk.081983.com |
23.234.20.24 | ee.mt30.ne |
23.234.20.24 | bdtg.37.com |
23.234.20.24 | v.61173f9.com |
23.234.20.24 | to.118902.com |
23.234.20.24 | www.dfsj521.com |
23.234.20.24 | a.118902.com |
23.234.20.24 | x.081983.com |
23.234.20.24 | jc.mt30.net |
23.234.20.24 | www.vis752.com |
23.234.20.24 | dd.yang868.com |
23.234.20.24 | baidu.pk05.com |
23.234.20.24 | zhaof.3737wyx.cn |
23.234.20.24 | www.5336.com |
23.234.20.24 | www.kaifu1.com |
23.234.20.24 | a.611739.com |
23.234.20.24 | cx.j550.com |
23.234.20.24 | www.st945.com |
23.234.20.24 | st945.com |
23.234.20.24 | 6x.u25u.com |
23.234.20.24 | 9kk.wd258.com |
23.234.20.24 | kx.u25u.com |
23.234.20.24 | bx.25jx.net |
23.234.20.24 | www.chengdongsteel.com |
23.234.20.24 | ss.u25u.com |
23.234.20.24 | ye.25jx.net |
23.234.20.24 | pk.j550.com |
23.234.20.24 | 7s.u25u.com |
23.234.20.24 | ss.u25u.com |
23.234.20.24 | p.u25u.com |
23.234.20.24 | x.j550.com |
23.234.20.24 | nl.25jx.net |
23.234.20.24 | sw.u25u.com |
23.234.20.24 | 5.25jx.net |
23.234.20.24 | 9.k1f.net |
23.234.20.24 | 9k2.wd258.com |
23.234.20.24 | www.9377b.com |
23.234.20.24 | www.5ding.com |
23.234.20.24 | www.lyh23.com |
23.234.20.24 | x.25jx.net |
23.234.20.24 | cc.u25u.com |
23.234.20.24 | tg.95k.com |
23.234.20.24 | www.bjwcl.com |
23.234.20.24 | www.9377o.com |
23.234.20.24 | bdtg.9377e.com |
23.234.20.24 | bbs.121210.com |
23.234.20.24 | 121210.com |
23.234.20.24 | www.121210.com |
23.234.20.24 | g.02qu.com |
23.234.20.24 | 6.u25u.com |
23.234.20.24 | bbs.wg78.com |
23.234.20.24 | wg78.com |
23.234.20.24 | f.25jx.net |
23.234.20.24 | y.j550.com |
23.234.20.24 | 1.nanyang2012.com |
23.234.20.24 | sx.fans8979.com |
23.234.20.24 | d.416191.com |
23.234.20.24 | vip.h1995.com |
23.234.20.24 | youxi.baidu.com |
23.234.20.24 | d.k1f.net |
23.234.20.24 | dd.yang898.com |
23.234.20.24 | dd.yang858.com |
23.234.20.24 | www.daishichuchen.com |
23.234.20.24 | www.yzshule.com |
23.234.20.24 | fb.98zsjm.com |
23.234.20.24 | www.hqa.cn.com |
23.234.20.24 | www.zx-cj.com |
23.234.20.24 | www.628552.com |
23.234.20.24 | y.02qu.com |
23.234.20.24 | d.416191.com |
23.234.20.24 | www.sith.cc |
23.234.20.24 | www.9377t.com |
23.234.20.24 | www.tianxiang-intl.com |
23.234.20.24 | www.yn30.com |
23.234.20.24 | 1.bzhtwqx.com |
23.234.20.24 | www.zzhttex.com |
23.234.20.24 | haocq.131sf.com |
23.234.20.24 | zhaof.aassdd.net |
23.234.20.24 | zhaof.98zslc.com |
23.234.20.24 | zhaof.youxizx.net |
23.234.20.24 | www.300sf.com |
23.234.20.24 | www.45uc.com |
23.234.20.24 | www.chasf.com |
23.234.20.24 | 999.wd258.com |
23.234.20.24 | yyy.wd258.com |
23.234.20.24 | go.sf999.com |
23.234.20.24 | www.haost.com |
23.234.20.24 | 1.hhyouxi.net |
23.234.20.24 | cq.98zslc.com |
23.234.20.24 | www.112fu.com |
23.234.20.24 | www.kaiqu.com |
23.234.20.24 | 1.youxizx.net |
23.234.20.24 | www.777sf.com |
23.234.20.24 | www.hdjddl.com |
23.234.20.24 | 112fu.huashengshipin.com |
23.234.20.24 | 58sf.58sf-1.com |
23.234.20.24 | www.yx19.com |
23.234.20.24 | www.yx31.com |
23.234.20.24 | dn.67cx.com |
23.234.20.24 | t.u25u.com |
23.234.20.24 | w.hsdbm.com |
23.234.20.24 | dd.yang808.com |
23.234.20.24 | iwan.baidu.com |
23.234.20.24 | www.83cq.com |
23.234.20.24 | 1.aassdd.net |
23.234.20.24 | www.hfhybjgs.com |
23.234.20.24 | www.haoqj.com |
23.234.20.24 | www.haojuezhan.com |
23.234.20.24 | www.zskunshang.com |
23.234.20.24 | a.mt30.net |
23.234.20.24 | www.377f.com |
23.234.20.24 | t.25jx.net |
23.234.20.24 | d.be-real.cn |
23.234.20.24 | d.diaoyiyuan.cn |
23.234.20.24 | www.xlmqt.com |
23.234.20.24 | www.528day.com |
23.234.20.24 | www.789zt.com |
23.234.20.24 | 6.shangwanghui.com |
23.234.20.24 | 1.shangwanghui.com |
23.234.20.24 | yx.minyouxi.com |
23.234.20.24 | 1.678bigfoot.com |
23.234.20.24 | 45uc.0731gfang.com |
23.234.20.24 | d.baidudiyi.net |
23.234.20.24 | u1.yhwl88.net |
23.234.20.24 | www.9945.com |
23.234.20.24 | www.23u.com |
23.234.20.24 | www.haofu.com |
23.234.20.24 | www.sf184.com |
23.234.20.24 | www.sfw.com |
23.234.20.24 | tg.applx85.com |
23.234.20.24 | aa.liaochengjiayuan.com |
23.234.20.24 | ht.v58d.com |
23.234.20.24 | 45uc.pf8898.com |
23.234.20.24 | 61.115163.com |
23.234.20.24 | haocq.0553dx.com |
23.234.20.24 | d.baidudiyi.net |
23.234.20.24 | 1.baidudiyi.net |
23.234.20.24 | 11.baidudiyi.net |
23.234.20.24 | www.hycartoon.com |
23.234.20.24 | 6.115163.com |
23.234.20.24 | www.sybnzh.cn |
23.234.20.24 | aa.kitefeung.com |
23.234.20.24 | 11s.pf8898.com |
23.234.20.24 | 1.mt30.net |
23.234.20.24 | www.snzad.com |
23.234.20.24 | www.uq2558.com |
23.234.20.24 | www.hada5688.com |
23.234.20.24 | www.zzctech.com |
23.234.20.24 | www.kf521.com |
23.234.20.24 | ss99.927wz.com |
23.234.20.24 | zhaocq.aassdd.net |
23.234.20.24 | haocq.youxizx.net |
23.234.20.24 | 160uc.600co.com |
23.234.20.24 | fa.oz9es.com |
23.234.20.24 | nx.5cn.cc |
23.234.20.24 | 889tt.d3yy.cn |
23.234.20.24 | vip.jzc123.com |
23.234.20.24 | www.oryin.com |
23.234.20.24 | 776tt.d3yy.cn |
23.234.20.24 | www.meihaomianjia.com |
23.234.20.24 | www.zgr999.com |
23.234.20.24 | www.yxzhaofu.com |
23.234.20.24 | pk6666.isitestar.cn |
23.234.20.24 | www.lwmoyu.com |
23.234.20.24 | www.pk515.com |
23.234.20.24 | www.uc277.com |
23.234.20.24 | www.uc828.com |
23.234.20.24 | 885ok.52fanfou.com |
23.234.20.24 | www.pk05.com |
23.234.20.24 | 3355t.jybz66.com |
23.234.20.24 | www.134p.com |
23.234.20.24 | 88pkdxy.plpl123.com |
23.234.20.24 | rt.5cn.cc |
23.234.20.24 | www.521jjj.com |
23.234.20.24 | www.wst86.cn |
23.234.20.24 | 1199t.kao77.com |
23.234.20.24 | 6677y.szxmmw.com |
23.234.20.24 | www.weilai99.com |
23.234.20.24 | zhaocq.98zslc.com |
23.234.20.24 | lk.yhwl88.net |
23.234.20.24 | 9911.9zph.com |
23.234.20.24 | z.67cx.com |
23.234.20.24 | www.longyi-group.com |
23.234.20.24 | www.genehi.com |
23.234.20.24 | www.362g.com |
23.234.20.24 | www.3sbl.net |
23.234.20.24 | www.herbalife888.cn |
23.234.20.24 | ns.78lc.net |
23.234.20.24 | dd.guidawang.com |
23.234.20.24 | 3355t.jybz66.com |
23.234.20.24 | www.sf123uu.com |
23.234.20.24 | 1.25jx.net |
23.234.20.24 | xd.qicaimofang.com |
23.234.20.24 | www.sz-lb.com |
23.234.20.24 | www.zo6knln.com |
23.234.20.24 | www.o68js.com |
23.234.20.24 | pk789a.52fanfou.com |
23.234.20.24 | zhaocq.700uc.com |
23.234.20.24 | www.06954.com |
23.234.20.24 | 168tg.psc8.com |
23.234.20.24 | www.69945.com |
23.234.20.24 | 160uc.600co.com |
23.234.20.24 | www.09846.com |
23.234.20.24 | 88pkjx.mei12a.com |
23.234.20.24 | www.xhtk.net |
23.234.20.24 | www.45569.com |
23.234.20.24 | www.njzs58.com |
23.234.20.24 | 8pk.mei12a.com |
23.234.20.24 | 88pkh1.kkk21sd.com |
23.234.20.24 | 88pkdxw.mei12a.com |
23.234.20.24 | 88pkdxy.mei12a.com |
23.234.20.24 | www.anansf.com |
23.234.20.24 | www.haowz.com |
23.234.20.24 | 999.23dpw.com |
23.234.20.24 | st.scdcyb.com |
23.234.20.24 | xs.qicaimofang.com |
23.234.20.24 | zhaosf.2866101.com |
23.234.20.24 | www.jyjyh.com |
23.234.20.24 | www.zhaohuajx.com |
23.234.20.24 | www.8iss.com |
23.234.20.24 | www.jnlvjie.com |
23.234.20.24 | sf123.21daikuan.com |
23.234.20.24 | zhaosf.2866101.com |
23.234.20.24 | tuiguang.8iss.com |
23.234.20.24 | tuiguang.8msm.com |
23.234.20.24 | fe.yueworld.net |
23.234.20.24 | 920aa.changyc.com |
23.234.20.24 | xb.qicaimofang.com |
23.234.20.24 | www.yx003.com |
23.234.20.24 | www1.pkokok.com |
23.234.20.24 | cz.yueworld.net |
23.234.20.24 | tuiguang.muu9.com |
23.234.20.24 | haosf.98zsjm.com |
23.234.20.24 | www.75945.com |
23.234.20.24 | www.lpf010.com |
23.234.20.24 | www.6000pk.com |
23.234.20.24 | 9pk.2766161.com |
23.234.20.24 | www.zhaof7.com |
23.234.20.24 | www.cqhr.org |
23.234.20.24 | www.ddzhe.com |
23.234.20.24 | pk789.52fanfou.com |
23.234.20.24 | 160uc.com |
23.234.20.24 | www.1nhh.com |
23.234.20.24 | www.52sol.com |
23.234.20.24 | www.cpu500.com |
23.234.20.24 | www.2381sfcq.com |
23.234.20.24 | www.uc37.com |
23.234.20.24 | www.98pk97.com |
23.234.20.24 | www.hbcyly.com |
23.234.20.24 | haosf.lfweibo.com |
23.234.20.24 | cq.kgfanli.com |
23.234.20.24 | www.999yc.com |
23.234.20.24 | www1.jjj.com |
23.234.20.24 | zhaosf.acrmbs.com |
23.234.20.24 | www.uc900.com |
23.234.20.24 | www2.jjj.com |
23.234.20.24 | www3.jjj.com |
162.211.182.3 | 1711ok.zz135.com |
23.234.20.24 | w13518.hr.jw.tczj.net |
23.234.20.24 | zhaofu7.com |
23.234.20.24 | tuiguang.592097.com |
23.234.20.24 | v.yueworld.net |
23.234.20.24 | zhaosf.ofyn.net |
23.234.20.24 | dk.qicaimofang.com |
23.234.20.24 | 578101.com |
23.234.20.24 | www.578101.com |
23.234.20.24 | www.126disk.com |
23.234.20.24 | tui99.592097.com |
23.234.20.24 | tui99.8msm.com |
23.234.20.24 | dd.guidawang.com |
23.234.20.24 | bb.fushilu.com |
23.234.20.24 | www.zhaofu7.com |
23.234.20.24 | www.baiduzhaokf.com |
23.234.20.24 | www.haosf.com |
23.234.20.24 | www.jsl-cn.com |
23.234.20.24 | www.88858.com |
23.234.20.24 | www.heshilurong.com |
23.234.20.24 | www.168fm.com |
23.234.20.24 | www.artobrain.com |
23.234.20.24 | wwv.jb345.com |
23.234.20.24 | www.zhaosf9999.com |
23.234.20.24 | www.uc1000.com |
23.234.20.24 | www4.jjj.com |
23.234.20.24 | www.uc900.com |
23.234.20.24 | www.uc900.com |
23.234.20.24 | www.cctv-kowann.com |
23.234.20.24 | www5.jjj.com |
23.234.20.24 | www.artobrain.com |
23.234.20.24 | www.jxytqz.com |
23.234.20.24 | www.as9z.com |
23.234.20.24 | pk789.52fanfou.com:81 |
23.234.20.24 | 36cq.dg8681.com:3636 |
23.234.20.24 | www.444yx.com |
23.234.20.24 | www.993yx.com |
23.234.20.24 | jjj.com |
23.234.20.24 | www1.99s.com |
23.234.20.24 | www2.99s.com |
23.234.20.24 | 99s.com |
23.234.20.24 | www99s.com |
23.234.20.24 | www.uc1000.com |
23.234.20.24 | 2410.eodfmr.cn |
23.234.20.24 | www.www99s.com |
23.234.20.24 | www.woool99s.com |
23.234.20.24 | www3.99s.com |
23.234.20.24 | 9k1.pa579.com |
23.234.20.24 | new.fa111.com |
23.234.20.24 | www4.99s.com |
23.234.20.24 | www5.99s.com |
23.234.20.24 | www.09445.com |
23.234.20.24 | www.cdxxzs.com |
23.234.20.24 | www.angelsimple.cn |
23.234.20.24 | www.lida00.cn |
23.234.20.24 | www.zbzishen.com |
23.234.20.24 | www.86jiewang.cn |
23.234.20.24 | www.itcr.cn |
23.234.20.24 | www.99u.net.ru |
23.234.20.24 | www.wan345.com |
23.234.20.24 | www.525uc.com |
23.234.20.24 | www.1cq.com |
23.234.20.24 | www.jjj.com |
23.234.20.24 | www.99s.com |
23.234.20.24 | www.gm005.com |
23.234.20.24 | www.68kf.com |
23.234.20.24 | wwk.astbw.com |
23.234.20.24 | zz.sf163.com |
23.234.20.24 | www.sotrip.com |
23.234.20.24 | 33k.pa579.com |
23.234.20.24 | www.555sf.com |
23.234.20.24 | www.66hst.com |
23.234.20.24 | 66hst.com |
23.234.20.24 | www.xin45.com |
23.234.20.24 | xin45.com |
23.234.20.24 | www.zhaocq.com |
23.234.20.24 | 1.52yanzheng.sinaapp.com |
23.234.20.24 | www.175sf.com |
23.234.20.24 | www.yxyhx.com |
23.234.20.24 | www.168fm.com |
23.234.20.24 | habourbiotech.com |
23.234.20.24 | www.pydwlm.com |
23.234.20.24 | www.ux99.com |
23.234.20.24 | www.hn17173.net |
23.234.20.24 | www.5s98.com |
23.234.20.24 | www.880s.com |
23.234.20.24 | www.118uc.com |
23.234.20.24 | www.zf777.com |
23.234.20.24 | 81.2381f.com |
23.234.20.24 | www.njkaidu.com |
23.234.20.24 | www.9szf.com |
23.234.20.24 | www.999zsf.com |
23.234.20.24 | www.85zf.com |
23.234.20.24 | www.951pk.com |
23.234.20.24 | www.851pk.com |
23.234.20.24 | 988.pa579.com |
23.234.20.24 | ad.97uu.com |
23.234.20.24 | www.i8pk.com |
23.234.20.24 | www.sf996.com |
23.234.20.24 | www.0579st.com |
23.234.20.24 | www.mc1314.com |
23.234.20.24 | gm016.comforum.php |
23.234.20.24 | www.whsfzx.com |
23.234.20.24 | dd.sh-tongy.com |
23.234.20.24 | 111.kaihu365.com |
23.234.20.24 | www.dddgm.com |
23.234.20.24 | www.ok126.net |
23.234.20.24 | www.wanshituliao.com |
23.234.20.24 | www.zaxue.net |
23.234.20.24 | www.4006517008.com |
23.234.20.24 | www.tcrhy.com |
23.234.20.24 | www.vdisk.cnyy6018 |
23.234.20.24 | www.sf383.com |
23.234.20.24 | www.001gm.net |
23.234.20.24 | www.006it.com |
23.234.20.24 | www.gm5555.com |
23.234.20.24 | www.yxyhx.com |
23.234.20.24 | www.3jidi-gz.com |
23.234.20.24 | www.100gczg.com |
23.234.20.24 | haosf.lgknow.com |
23.234.20.24 | habourbiotech.com |
23.234.20.24 | www.satsalt.com |
23.234.20.24 | tg1.37.com |
23.234.20.24 | pi.nuwa-mountain.org |
23.234.20.24 | www.jafdc.net |
23.234.20.24 | www.5iwowo.com |
23.234.20.24 | www.bonopt.com |
23.234.20.24 | www.jzdkfj.com |
23.234.20.24 | henuedu.cn |
23.234.20.24 | www.sdjialiang.com |
23.234.20.24 | www.10010cq.com |
23.234.20.24 | www.z0137cx.comkwcs |
23.234.20.24 | www.0512rc.net |
23.234.20.24 | www.dahanjg.com |
23.234.20.24 | www.ht-vision.com |
23.234.20.24 | www.3159wine.com |
23.234.20.24 | www.jfy8rv.comzjp6bw |
23.234.20.24 | www.yxyhx.com |
23.234.20.24 | www.9uzg.com |
23.234.20.24 | www.gm667.com |
23.234.20.24 | www.znspyq.com9dzf7w |
23.234.20.24 | www.18-81.net |
23.234.20.24 | www.ht-vision.com |
23.234.20.24 | www.gmwly.com |
23.234.20.24 | user.qzone.qq.com5674167 |
23.234.20.24 | t.qq.comchuanqisf8997 |
23.234.20.24 | www.njjqgck.com |
23.234.20.24 | www.hkalu.com |
23.234.20.24 | www.60sf.com |
23.234.20.24 | www.pk123.com |
23.234.20.24 | www.52anzu.com |
23.234.20.24 | www1.52anzu.com |
23.234.20.24 | 52anzu.com |
23.234.20.24 | www.wf22.com |
23.234.20.24 | xingyoufz.wwpan.com |
23.234.20.24 | www.36ok.com |
23.234.20.24 | www.32fa.com |
23.234.20.24 | wws.99acc.com |
23.234.20.24 | www.916cq.com |
23.234.20.24 | 1711ok.sh77577.com |
23.234.20.24 | www.18uc.com |
23.234.20.24 | 18uc.com |
23.234.20.24 | 88pk.com |
23.234.20.24 | www.88pk.com |
23.234.20.24 | 162.212.180.86 |
23.234.20.24 | 36ok.com |
23.234.20.24 | 118.99.26.156 |
23.234.20.24 | 23.234.60.34 |
23.234.20.24 | www.52anzu.net |
23.234.20.24 | www.77250.com |
23.234.20.24 | 77250.com |
23.234.20.24 | www1.52anzu.net |
23.234.20.24 | tt.1kuv.com |
23.234.20.24 | www.33ok.com |
23.234.20.24 | 916cq.com |
23.234.20.24 | 91ww.91fu.com |
23.234.20.24 | www1.pk777.com |
23.234.20.24 | www.sf999.com |
23.234.20.24 | www.yeahooo.net |
23.234.20.24 | 1.townhall.cn |
23.234.20.24 | www.bjjijiubao.com |
23.234.20.24 | 1.xa1314.com.cn |
23.234.20.24 | www.yvwtjf.com |
23.234.20.24 | www.stylepacking.com |
23.234.20.24 | www.cnfengye.com |
23.234.20.24 | www.zazgame.com |
23.234.20.24 | www.zrplay.com |
23.234.20.24 | www.yczdwj.com |
23.234.20.24 | www.zheyutegang.com |
23.234.20.24 | www.sf123.com |
23.234.20.24 | www.daqiandoor.com |
23.234.20.24 | www.77d8.com |
23.234.20.24 | www.3159wine.com |
23.234.20.24 | www.wwesf.com |
23.234.20.24 | www.7988ok.com |
23.234.20.24 | www.shfengyi.com |
23.234.20.24 | pg.iflu.com.cn |
23.234.20.24 | www.gdtrane.com |
23.234.20.24 | www.scxlm.com |
23.234.20.24 | www.kisspk.com |
23.234.20.24 | www.cqxz.com.cn |
23.234.20.24 | www.kanonsh.com |
23.234.20.24 | www.gm1208.com |
23.234.20.24 | www.provoxav.com |
23.234.20.24 | dgdimei.com |
23.234.20.24 | www.cntzdh.com |
23.234.20.24 | www.hanwise.com |
23.234.20.24 | www.mfttj.com |
23.234.20.24 | www.shenqi.com |
23.234.20.24 | www.52345.com |
23.234.20.24 | 81f.hao899.com |
23.234.20.24 | www.sf123.com |
23.234.20.24 | www.3159wine.com |
23.234.20.24 | www.daqiandoor.com |
23.234.20.24 | 2sogo.com |
23.234.20.24 | mobanbbs.com |
23.234.20.24 | 91ww.555uc.com |
23.234.20.24 | www.99j.com |
23.234.20.24 | www.91ww.com |
23.234.20.24 | www.777uc.com |
23.234.20.24 | www.xbkdq.com |
23.234.20.24 | 66sf.77zhao.com |
23.234.20.24 | www.184pk.com |
23.234.20.24 | www.sf999.com |
23.234.20.24 | www.pk777.com |
23.234.20.24 | www.alfatoyota.com |
23.234.20.24 | mobanbbs.com |
23.234.20.24 | www.stbshg.com |
23.234.20.24 | www.daqiandoor.com |
23.234.20.24 | www.1cq.com |
23.234.20.24 | www.xbkdq.com |
23.234.20.24 | www.sf123.com |
23.234.20.24 | www.3159wine.com |
23.234.20.24 | www.buyishijia.com |
23.234.20.24 | www.sf999.com |
23.234.20.24 | www.shenqi.com |
23.234.20.24 | www.52345.com |
23.234.20.24 | www.92045.com |
23.234.20.24 | www.926.com |
23.234.20.24 | www.99j.com |
23.234.20.24 | www.945pk.com |
23.234.20.24 | 8uc.haosf33.com |
23.234.20.24 | www.91ww.com |
23.234.20.24 | www.8uu.com |
23.234.20.24 | 81f.hao883.com |
23.234.20.24 | 81f.hao979.com |
23.234.20.24 | 81f.hao899.com |
23.234.20.24 | www.81f.com |
23.234.20.24 | www.nihao119.com |
23.234.20.24 | www.66sf.com |
23.234.20.24 | kkkfu.sylytz.com |
23.234.20.24 | 83aa.sf078.com |
23.234.20.24 | 521fu.9173uc.com |
23.234.20.24 | www.777uc.com |
23.234.20.24 | www.pk777.com |
23.234.20.24 | www.30ok-1.com |
23.234.20.24 | www.haocq.com |
23.234.20.24 | www.1000ok.com |
23.234.20.24 | wvw.rq23.com |
23.234.20.24 | wvw.2013wan.com |
23.234.20.24 | wvw.9377z.com |
23.234.20.24 | mmm.wopaijs.com |
23.234.20.24 | www.yyy279.com |
23.234.20.24 | wvw.9377s.com |
23.234.20.24 | www.zhujiutx.com |
23.234.20.24 | www.hbwxkj.com |
23.234.20.24 | www.sh-chengshan.com |
23.234.20.24 | zhaosfcq.com |
23.234.20.24 | www.subpig.net |
23.234.20.24 | www.jlzcfx.com |
23.234.20.24 | www.66sf.com |
23.234.20.24 | www.cdxxlh.com |
23.234.20.24 | www.83uc.com |
23.234.20.24 | www.shjwd.com |
23.234.20.24 | www.jingming-sh.com |
23.234.20.24 | www.aerosun.cn |
23.234.20.24 | www.qdhd.com.cn |
23.234.20.24 | www.flyxg.com |
23.234.20.24 | www.zggljt.com |
23.234.20.24 | www.99mc.com |
23.234.20.24 | www.138zg.com |
23.234.20.24 | www.523zg.com |
23.234.20.24 | www.98zg.com |
23.234.20.24 | www.78zg.cn |
23.234.20.24 | www.99ting.cn |
23.234.20.24 | www.27zg.com |
23.234.20.24 | www.92sanduo.com |
23.234.20.24 | www.527zg.com |
23.234.20.24 | www.xstylxx.com |
23.234.20.24 | www.xrsd-water.com |
23.234.20.24 | www.tttjsq.com |
23.234.20.24 | www.y1995.com |
23.234.20.24 | www.883sf.com |
23.234.20.24 | sf123.com |
23.234.20.24 | changjing.759rsq.com |
23.234.20.24 | xinqing.kqgf69.com |
23.234.20.24 | www.xahdc.com |
23.234.20.24 | www.haotl.com |
23.234.20.24 | www.chinajin-hui.com |
23.234.20.24 | www.fullkang.net.com |
23.234.20.24 | tanxian.u895.com |
23.234.20.24 | www.m526.com |
23.234.20.24 | www.majorsoul.com |
23.234.20.24 | changjing.pbbxy.com |
23.234.20.24 | sf225.com |
23.234.20.24 | www.haosf.com |
23.234.20.24 | www.tcrhy.com |
23.234.20.24 | www.001gm.net |
23.234.20.24 | cqdl321.com |
23.234.20.24 | www.b9jojo.com |
23.234.20.24 | www.9kf.com |
23.234.20.24 | www.sf138.com |
23.234.20.24 | www.628118.com |
23.234.20.24 | www.hezol.com |
23.234.20.24 | www.qjkutrgw.com |
23.234.20.24 | www.ashijia.com |
23.234.20.24 | www.1200sf.com |
23.234.20.24 | www.aarongj.com |
23.234.20.24 | www.53my.com |
23.234.20.24 | www.888cnc.com |
23.234.20.24 | www.sf3000.com |
23.234.20.24 | www.29u.in |
23.234.20.24 | www.96sf.com |
23.234.20.24 | www.3159wine.com |
23.234.20.24 | www.sf800.com |
23.234.20.24 | www.77mxd.com |
23.234.20.24 | www.9uzg.com |
23.234.20.24 | www.sf999.com.ru |
23.234.20.24 | www.szmajsy.com |
23.234.20.24 | www.jptea.cn |
23.234.20.24 | www.cqpk11.com |
23.234.20.24 | www.insdfjisd.com |
23.234.20.24 | www.828kk.com |
23.234.20.24 | www.irrchina.com |
23.234.20.24 | www.22nf.com |
23.234.20.24 | www.jiutianzs.com |
23.234.20.24 | www.103la.com |
23.234.20.24 | www.889ok.com |
23.234.20.24 | huanshou.8236r.com |
23.234.20.24 | www.1129f.com |
23.234.20.24 | 345ye.861sf.com |
23.234.20.24 | www.861sf.com |
23.234.20.24 | 861sf.com |
23.234.20.24 | www.sf985.com |
23.234.20.24 | www.bonopt.com |
23.234.20.24 | cq45.cn |
23.234.20.24 | www.cq45.cn |
23.234.20.24 | www.bgdtw.com |
23.234.20.24 | www.930t.com |
23.234.20.24 | www.tianhuao.com |
23.234.20.24 | www.99a.net.ru |
23.234.20.24 | www.hmyigou.com |
23.234.20.24 | www.fzjx.net |
23.234.20.24 | www.ez-max.net |
23.234.20.24 | www.zhuoranfm.com |
23.234.20.24 | www.ccadly.net |
23.234.20.24 | www.chinasysw.com |
23.234.20.24 | www.dyjkdd.com |
23.234.20.24 | www.cnbaoerte.com |
23.234.20.24 | www.sf895.com |
23.234.20.24 | www.joywei.com |
23.234.20.24 | www.yalincs.com |
23.234.20.24 | www.kkstar.com |
23.234.20.24 | www.949g.com |
23.234.20.24 | www.zhaosf.com.co |
23.234.20.24 | www.3000ok.com.cn |
23.234.20.24 | n813.com |
23.234.20.24 | uc88.com |
23.234.20.24 | qu45.com |
23.234.20.24 | www.aop9988.com |
23.234.20.24 | www.sdytgj.com |
23.234.20.24 | www.gzgien.com |
23.234.20.24 | www.chuanqige.com |
23.234.20.24 | 51my8.com |
23.234.20.24 | www.99j.com.es |
23.234.20.24 | www.sf452.com |
23.234.20.24 | www.981sf.com |
23.234.20.24 | www.sf382.com |
23.234.20.24 | www.hldly.com |
23.234.20.24 | www.sf062.com |
23.234.20.24 | www.8345sf.com |
23.234.20.24 | www.sdfwesq.com |
23.234.20.24 | www.sjxt123.com |
23.234.20.24 | www.daqiandoor.com |
23.234.20.24 | www.125sf.com |
23.234.20.24 | www.xieqiyy.com |
23.234.20.24 | www.ldyeya.com |
23.234.20.24 | www.088sf.net |
23.234.20.24 | 83so.com |
23.234.20.24 | www.sf421.com |
23.234.20.24 | www.4f920.com |
23.234.20.24 | www.tiaolou8.com |
23.234.20.24 | www.taocooler.com |
23.234.20.24 | www.wanpp.com |
23.234.20.24 | www.fhzsm.com |
23.234.20.24 | www.pt12319.com |
23.234.20.24 | www.hx-lace.com |
23.234.20.24 | www.jiagao.net |
23.234.20.24 | 76776.com |
23.234.20.24 | www.htwjcy.com |
23.234.20.24 | www.win757.com |
23.234.20.24 | www.hnjxzz.cn |
23.234.20.24 | www.xmdvip.com |
23.234.20.24 | swqzp.com |
23.234.20.24 | www.tungsten-moly.com |
23.234.20.24 | jingyan.986jj.com |
23.234.20.24 | www.xxf888.com |
23.234.20.24 | www.cnrsyy.com |
23.234.20.24 | www.txingzuo.com |
23.234.20.24 | www.ykmir.com |
23.234.20.24 | www.xjxianping.cn |
23.234.20.24 | www.web01.cn |
23.234.20.24 | www.yijiaedu.cn |
23.234.20.24 | dushisuanlafen.cn |
23.234.20.24 | www.zzyichen.com |
23.234.20.24 | www.cnnoblelight.com |
23.234.20.24 | klkemu.net |
23.234.20.24 | www.faith-forever.com |
23.234.20.24 | www.bopuai.cn |
23.234.20.24 | www.xzchuitou.cn |
23.234.20.24 | www.ccxbzk.cn |
23.234.20.24 | www.915788.com |
23.234.20.24 | www.sdxtcnc.com |
23.234.20.24 | www.sz-stv.com |
23.234.20.24 | www.fjoss.com |
23.234.20.24 | www.204sf.com |
23.234.20.24 | www.tech-sss.com |
23.234.20.24 | www.mywowpl.com |
23.234.20.24 | www.shi-yi.net |
23.234.20.24 | www.hzlyfashion.com |
23.234.20.24 | www.freeshu.com |
23.234.20.24 | www.chinatianmei.com |
23.234.20.24 | 00pk.com |
23.234.20.24 | www.tqb88.com |
23.234.20.24 | 4593.9kf.com |
23.234.20.24 | www.120yi.com |
23.234.20.24 | www.hdmchina.com |
23.234.20.24 | www.zzfuxi.com |
23.234.20.24 | www.sdicl.com |
23.234.20.24 | www.ebontec.com |
23.234.20.24 | www.3000oksf.com |
23.234.20.24 | www.shqing8.com |
23.234.20.24 | www.666mir.com |
23.234.20.24 | www.adchy.com |
23.234.20.24 | www.pyprint.com |
23.234.20.24 | www.56chuanqi.com |
23.234.20.24 | www.simicc.com |
23.234.20.24 | www.a5zg.com |
23.234.20.24 | www.szhcgroup.com |
23.234.20.24 | www.57ssy.com |
23.234.20.24 | www.qingzhou8.com |
23.234.20.24 | tt292.com |
23.234.20.24 | www.jiatianneiyi.com |
23.234.20.24 | www.leeed.com |
23.234.20.24 | www.20020505.com |
23.234.20.24 | www.kl-chem.com |
23.234.20.24 | www.tjzssd.com |
23.234.20.24 | www.nnhxjh.com |
23.234.20.24 | www.dwmir.com |
23.234.20.24 | www.kk519.com |
23.234.20.24 | www.chinanewhope.net |
23.234.20.24 | www.yalimei-group.com |
23.234.20.24 | www.jiulongbelt.com |
23.234.20.24 | www.dushisuanlafen.cn |
23.234.20.24 | www.cn0796.com |
23.234.20.24 | www.hnfengyuan.com |
23.234.20.24 | www.yixinghai.com |
23.234.20.24 | www.zgtjsteel.com |
23.234.20.24 | www.51disky.com |
23.234.20.24 | www.zhybbs.com |
23.234.20.24 | www.91kaixue.com |
23.234.20.24 | www.fyplay.com |
23.234.20.24 | www.wowidc.com |
23.234.20.24 | www.jiahongtex.com |
23.234.20.24 | www.diselife.com |
23.234.20.24 | www.yygdz.com |
23.234.20.24 | www.kexingco.com |
23.234.20.24 | www.88fb.com |
23.234.20.24 | www.botaofan.com |
23.234.20.24 | www.zzhdjx.cn |
23.234.20.24 | www.cntuliao.com |
23.234.20.24 | www.m5y6.cn |
23.234.20.24 | www.songzhilu.com |
23.234.20.24 | zhaopeng.net |
23.234.20.24 | www.xiayunfei.com |
23.234.20.24 | soyoesd.cn |
23.234.20.24 | www.523zg.com |
23.234.20.24 | regongjixie.com |
23.234.20.24 | www.mir87.com |
23.234.20.24 | chinachengyang.cn |
23.234.20.24 | www.dgguanglin.com |
23.234.20.24 | www.huayuebz.com |
23.234.20.24 | www.xxsw028.com |
23.234.20.24 | www.myppchina.com |
23.234.20.24 | www.gzsuper.com |
23.234.20.24 | www.txhtc.com |
23.234.20.24 | www.cdcx1956.com |
23.234.20.24 | www.yaliwood.com |
23.234.20.24 | www.flower024.com |
23.234.20.24 | www.5ttb.com |
23.234.20.24 | www.i193.com |
23.234.20.24 | www.shweiheng.com |
23.234.20.24 | www.65wt.com |
23.234.20.24 | u17766.com |
23.234.20.24 | www.600sf.com |
23.234.20.24 | www.baodaobike.com |
23.234.20.24 | www.56fabu.com |
23.234.20.24 | www.pt12319.com |
23.234.20.24 | pk.sydahe.com |
23.234.20.24 | cnpeishi.cn |
23.234.20.24 | www.2-55.com |
23.234.20.24 | www.cdfufu.com |
23.234.20.24 | www.bzydzs.com |
23.234.20.24 | www.dhl.gov.cn |
23.234.20.24 | www.81cq.com |
23.234.20.24 | www.sxfyxyq.com |
23.234.20.24 | 111wt.com |
23.234.20.24 | 81sf.com |
23.234.20.24 | 44dy.com |
23.234.20.24 | 30wy.com |
23.234.20.24 | 999wg.net |
23.234.20.24 | 915m.com |
23.234.20.24 | 66kf.net |
23.234.20.24 | www.qs930.com |
23.234.20.24 | www.shutu.cc |
23.234.20.24 | sf666.75gm.com |
23.234.20.24 | www.kkksf.com |
23.234.20.24 | www.zhao3f.com |
23.234.20.24 | 6cq.cc |
23.234.20.24 | u7u73.com |
23.234.20.24 | sf923.com |
23.234.20.24 | oryin.com |
23.234.20.24 | gm777.com |
23.234.20.24 | gm333.com |
23.234.20.24 | cseht.com |
23.234.20.24 | 520f.com |
23.234.20.24 | 258x.com |
23.234.20.24 | 57ww.com |
23.234.20.24 | 57591.com |
23.234.20.24 | 33sf.com |
23.234.20.24 | sf509.com |
23.234.20.24 | 803cq.com |
23.234.20.24 | 25930.com |
23.234.20.24 | 812315.com |
23.234.20.24 | 11cq.cn |
23.234.20.24 | 94ww.com |
23.234.20.24 | 777wt.com |
23.234.20.24 | www.99mc.com |
23.234.20.24 | 980cq.com |
23.234.20.24 | hdhjgs.com |
23.234.20.24 | 51zzsf.com |
23.234.20.24 | 0574k.com |
23.234.20.24 | wjlon.cn |
23.234.20.24 | d518.com |
23.234.20.24 | sf29.com |
23.234.20.24 | 222sf.com |
23.234.20.24 | 23qianbao.com |
23.234.20.24 | 195ca.com |
23.234.20.24 | 118967.com |
23.234.20.24 | 10000ok.com |
23.234.20.24 | 72cq.com |
23.234.20.24 | 5zaoxie.com |
23.234.20.24 | 555beian.com |
23.234.20.24 | 55hj.com |
23.234.20.24 | 45758.com |
23.234.20.24 | 41345.com |
23.234.20.24 | 258sf.com |
23.234.20.24 | 9000sf.com |
23.234.20.24 | 87sf.com |
23.234.20.24 | 89946.com |
23.234.20.24 | 88f.com |
23.234.20.24 | 86rs.com |
23.234.20.24 | 77yu.com |
23.234.20.24 | 81592.com |
23.234.20.24 | 74981.com |
23.234.20.24 | 818wy.com |
23.234.20.24 | 9826w.com |
23.234.20.24 | www.myidc.cc |
23.234.20.24 | www.whygjt.com |
23.234.20.24 | www.nd-zk.com |
23.234.20.24 | haosf.com.cn |
23.234.20.24 | www.sf3000ok.com |
23.234.20.24 | www.145930.com |
23.234.20.24 | www.80ww.com |
23.234.20.24 | www.258x.com |
23.234.20.24 | www.sf509.com |
23.234.20.24 | www.tjklm.com |
23.234.20.24 | 17sz.net |
23.234.20.24 | www.81sf.com |
23.234.20.24 | www.0663yh.com |
23.234.20.24 | whygjt.com |
23.234.20.24 | www.cc816.com |
23.234.20.24 | www.bohaomj.com |
23.234.20.24 | www.blbfg.com |
23.234.20.24 | jndd.com.cn |
23.234.20.24 | www.ba45.com |
23.234.20.24 | www.bjwztc.com |
23.234.20.24 | www.bangbangtuan.com |
23.234.20.24 | 1.wzca.com.cn |
23.234.20.24 | www.51yygw.com |
23.234.20.24 | www.912kf.com |
23.234.20.24 | www.eduqc.com |
23.234.20.24 | www.ebssfp.com |
23.234.20.24 | www.dingfengtop.com |
23.234.20.24 | www.dc-superglue.com |
23.234.20.24 | www.daweilp.com |
23.234.20.24 | www.czacyq.com |
23.234.20.24 | www.cqxiexin.com |
23.234.20.24 | www.cltqgs.com |
23.234.20.24 | www.cnaxchem.com |
23.234.20.24 | www.chengdajc.com |
23.234.20.24 | www.cdztnt.com |
23.234.20.24 | www.chinawoollen.com |
23.234.20.24 | www.chinaenyu.com |
23.234.20.24 | www.ihc360.com |
23.234.20.24 | www.hrener.com |
23.234.20.24 | www.howelltoy.com |
23.234.20.24 | www.fzqmw.com |
23.234.20.24 | www.hongweimotor.com |
23.234.20.24 | www.gardenhn.com |
23.234.20.24 | www.fzghj.com |
23.234.20.24 | www.fhouse360.com |
23.234.20.24 | www.fdzyy.com |
23.234.20.24 | www.fujunsh.com |
23.234.20.24 | www.funkan.com |
23.234.20.24 | www.pxfangbao.com |
23.234.20.24 | www.pk138.com |
23.234.20.24 | www.oursuzuki.com |
23.234.20.24 | www.movfox.com |
23.234.20.24 | www.nbyongxiang.com |
23.234.20.24 | www.maoshanchem.com |
23.234.20.24 | www.longyundianli.com |
23.234.20.24 | www.linxiatravel.com |
23.234.20.24 | www.jhrace.com |
23.234.20.24 | www.jxytoys.com |
23.234.20.24 | www.kpaofeite.com |
23.234.20.24 | www.jiang456.com |
23.234.20.24 | www.szgargen.com |
23.234.20.24 | www.szelcc.com |
23.234.20.24 | www.sun-sand-sea.com |
23.234.20.24 | www.shzhuwang.com |
23.234.20.24 | www.ssbrakepad.com |
23.234.20.24 | www.shxianghao.com |
23.234.20.24 | www.shchenggang.com |
23.234.20.24 | www.quhi-tech.com |
23.234.20.24 | www.sh16pu.com |
23.234.20.24 | www.reach-way.com |
23.234.20.24 | www.sddzauto.com |
23.234.20.24 | www.yhszy.com |
23.234.20.24 | www.xinfengjixie.com |
23.234.20.24 | www.xiduanpress.com |
23.234.20.24 | www.xuyetrade.com |
23.234.20.24 | www.xaxhny.com |
23.234.20.24 | www.wzxiyin.com |
23.234.20.24 | www.wxlujia.com |
23.234.20.24 | www.usnaike.com |
23.234.20.24 | www.tyhzh.com |
23.234.20.24 | www.szhmxled.com |
23.234.20.24 | yaosf.net |
23.234.20.24 | www.zjyingguan.com |
23.234.20.24 | www.zzwzgn.com |
23.234.20.24 | www.zjtsmj.com |
23.234.20.24 | www.zjgujia.com |
23.234.20.24 | www.30fu.com |
23.234.20.24 | www.zgshunxing.com |
23.234.20.24 | www.zhcrane.com |
23.234.20.24 | www.zhao5f.com |
23.234.20.24 | www.ytjiangyou.com |
23.234.20.24 | www.yinghongjixie.com |
23.234.20.24 | www.zwyt.net |
23.234.20.24 | zzhdjx.cn |
23.234.20.24 | www.szmhk.com |
23.234.20.24 | www.ccggge.com |
23.234.20.24 | www.0007590.com |
23.234.20.24 | www4.29u.com |
23.234.20.24 | www.nlcoad.com |
23.234.20.24 | 26ss.com |
23.234.20.24 | zhaohaosf.net |
23.234.20.24 | www.eanfang.com |
23.234.20.24 | www.ntwmyy.com |
23.234.20.24 | eanfang.com |
23.234.20.24 | www.88pknb.com |
23.234.20.24 | www.hh8gg.pw |
23.234.20.24 | www.hycygy.com |
23.234.20.24 | 114code.com |
23.234.20.24 | www.legendpw.net |
23.234.20.24 | www.dgyuanyang.com |
23.234.20.24 | www.sf999.name |
23.234.20.24 | www.125kkk.com |
23.234.20.24 | go.sf999.com |
23.234.20.24 | wwww.017cq.com |
23.234.20.24 | cnc.sf999.com |
23.234.20.24 | www.xztd888.com |
23.234.20.24 | www.iyqxkcqw.com |
23.234.20.24 | www.fenfa1688.com |
23.234.20.24 | www.huahuiye.com |
23.234.20.24 | www.sdqinuo.com |
23.234.20.24 | www.njhxztz.com |
23.234.20.24 | www.qibone.com |
23.234.20.24 | www.aimkm.com |
23.234.20.24 | www.195eeweqsc.com |
23.234.20.24 | www.007sf.com |
23.234.20.24 | www.512qz.com |
23.234.20.24 | www.jxdpx.com |
23.234.20.24 | www.haosf.org |
23.234.20.24 | www.17123.com |
23.234.20.24 | 999sf.com |
23.234.20.24 | www.7000hj.com |
23.234.20.24 | 67pp.com |
23.234.20.24 | 56chuanqi.com |
23.234.20.24 | www.k8765.com |
23.234.20.24 | www.haosf9999.com |
23.234.20.24 | www.fw000.com |
23.234.20.24 | www.gm333.com |
23.234.20.24 | www.anmeiexpo.com |
23.234.20.24 | www.999sf.com |
23.234.20.24 | www.95ok.com |
23.234.20.24 | sedio.cc |
23.234.20.24 | www.5d5y.com |
23.234.20.24 | www.gm777.com |
23.234.20.24 | zhaosf.88654.com |
23.234.20.24 | www.xifulei.com |
23.234.20.24 | www.sf903.com |
23.234.20.24 | www.syjm.net |
23.234.20.24 | www.sf7000.com |
23.234.20.24 | www.nbwanfeng.com |
23.234.20.24 | 677g.com |
23.234.20.24 | sf63.com |
23.234.20.24 | www.91kang.com |
23.234.20.24 | cqniangzao.com |
23.234.20.24 | www.999ok.com |
23.234.20.24 | 92gg.com |
23.234.20.24 | 921ww.com |
23.234.20.24 | 520sf.com |
23.234.20.24 | 239ok.com |
23.234.20.24 | shdongqiao.com |
23.234.20.24 | sd-yuhui.com |
23.234.20.24 | meiri.vqkp35.com |
23.234.20.24 | moni.227y.com |
23.234.20.24 | gzonisi.cn |
23.234.20.24 | 345cc.cn.com |
23.234.20.24 | chinayat.com |
23.234.20.24 | www.3f6f.com |
23.234.20.24 | www.258sf.com |
23.234.20.24 | www.13su.com |
23.234.20.24 | www.118967.com |
23.234.20.24 | www.sardar.cc |
23.234.20.24 | www.21sjzg.com |
23.234.20.24 | www.0769hongri.com |
23.234.20.24 | www.0574k.com |
23.234.20.24 | www.020rencai.net |
23.234.20.24 | uc99.com |
23.234.20.24 | www.001info.com |
23.234.20.24 | www.67pp.net |
23.234.20.24 | www.666666s.com |
23.234.20.24 | www.66kf.net |
23.234.20.24 | www.5zaoxie.com |
23.234.20.24 | www.55hj.com |
23.234.20.24 | www.520sf.com |
23.234.20.24 | www.51miehun.co |
23.234.20.24 | www.51huigo.com |
23.234.20.24 | www.45758.com |
23.234.20.24 | www.5199g.com |
23.234.20.24 | www.30wy.com |
23.234.20.24 | www.922gg.com |
23.234.20.24 | www.88f.com |
23.234.20.24 | www.88102888.com |
23.234.20.24 | www.921ww.com |
23.234.20.24 | www.89946.com |
23.234.20.24 | www.818wy.com |
23.234.20.24 | www.86rs.com |
23.234.20.24 | www.789sf.net |
23.234.20.24 | www.77yu.com |
23.234.20.24 | www.789is.com |
23.234.20.24 | www.6836999.com |
23.234.20.24 | www.boxianfengguan.com |
23.234.20.24 | www.allaboutprogram.com |
23.234.20.24 | www.avoio.com |
23.234.20.24 | www.autohid.com |
23.234.20.24 | www.aptx4869.net |
23.234.20.24 | www.art-verb.com |
23.234.20.24 | www.94haokan.com |
23.234.20.24 | www.dj149.com |
23.234.20.24 | www.dgdtw.com |
23.234.20.24 | www.digrj.com |
23.234.20.24 | www.dgzichi.com |
23.234.20.24 | www.cqsfcn.com |
23.234.20.24 | www.dfhero.com |
23.234.20.24 | www.dabanwu.com |
23.234.20.24 | www.chuanqisifu99.com |
23.234.20.24 | www.chinakelly.com |
23.234.20.24 | www.cfaninfo.com |
23.234.20.24 | www.cgxgf.com |
23.234.20.24 | www.byetee.com |
23.234.20.24 | www.idcdong.com |
23.234.20.24 | www.i-blinks.com |
23.234.20.24 | www.hnlangjie.com |
23.234.20.24 | www.hxfamily.com |
23.234.20.24 | www.hzruili.com |
23.234.20.24 | www.hnggfz.com |
23.234.20.24 | www.hzkjy.com |
23.234.20.24 | www.hlmodule.com |
23.234.20.24 | www.hbwyw.net |
23.234.20.24 | www.hbqdxjmf.com |
23.234.20.24 | www.gzxlzs.com |
23.234.20.24 | www.gzplay.com |
23.234.20.24 | www.gxxjl.com |
23.234.20.24 | www.guanhaiyujia.com |
23.234.20.24 | www.dqzypx.com |
23.234.20.24 | www.krksjx.com |
23.234.20.24 | www.lishi99.com |
23.234.20.24 | www.leiming-bulb.com |
23.234.20.24 | www.lanyue2003.com |
23.234.20.24 | www.laosf.com |
23.234.20.24 | www.jzfsk.com |
23.234.20.24 | www.knschina.com |
23.234.20.24 | www.jsxgm.com |
23.234.20.24 | www.jshhw.com |
23.234.20.24 | www.jka77.com |
23.234.20.24 | www.jn333.com |
23.234.20.24 | www.j8y.net |
23.234.20.24 | www.jieer.net |
23.234.20.24 | www.jietewq.com |
23.234.20.24 | www.i-dphoto.com |
23.234.20.24 | www.pgmary.com |
23.234.20.24 | www.pxfyzs.com |
23.234.20.24 | www.pai4f.com |
23.234.20.24 | www.njrybj.com |
23.234.20.24 | www.oshococo.com |
23.234.20.24 | www.nibou.net |
23.234.20.24 | www.newseaswan.com |
23.234.20.24 | www.myuheng.com |
23.234.20.24 | www.mzwq.info |
23.234.20.24 | www.lypfc.com |
23.234.20.24 | www.lzyinfeng.com |
23.234.20.24 | www.ly1000.com |
23.234.20.24 | www.lvislife.com |
23.234.20.24 | www.lx188.com |
23.234.20.24 | www.shundaglass.com |
23.234.20.24 | www.shyuanli.com |
23.234.20.24 | www.sh-liuxin.com |
23.234.20.24 | www.shi18.com |
23.234.20.24 | www.sf920.net |
23.234.20.24 | www.sea-reach.com |
23.234.20.24 | www.sertai.com |
23.234.20.24 | www.sf123-1.com |
23.234.20.24 | www.sf123.cc |
23.234.20.24 | www.saiyilong.com |
23.234.20.24 | www.scienthoer.com |
23.234.20.24 | www.ruichilida.com |
23.234.20.24 | www.qunhuan.net |
23.234.20.24 | www.qmxfw.com |
23.234.20.24 | www.qhsdkj.com |
23.234.20.24 | www.twdmly.com |
23.234.20.24 | www.szyangcai.com |
23.234.20.24 | www.tococi.com |
23.234.20.24 | www.tcbl88.com |
23.234.20.24 | www.sz-wells.com |
23.234.20.24 | www.szpangzhi.com |
23.234.20.24 | www.szjundaled.com |
23.234.20.24 | www.szcmon.com |
23.234.20.24 | www.szjlskj.com |
23.234.20.24 | www.szabj.com |
23.234.20.24 | www.syzwdj.com |
23.234.20.24 | www.syqtdz.com |
23.234.20.24 | www.sxhtdl.com |
23.234.20.24 | www.sougousf.com |
23.234.20.24 | www.zwnoon.com |
23.234.20.24 | www.zszhongzhi.com |
23.234.20.24 | www.z-sheng.com |
23.234.20.24 | www.zpmc-cz.com |
23.234.20.24 | www.zjtl.com |
23.234.20.24 | www.zjpages.com |
23.234.20.24 | www.zdhw-lighting.com |
23.234.20.24 | www.youxi119.com |
23.234.20.24 | www.ysmtc8.com |
23.234.20.24 | www.yongdingfm.com |
23.234.20.24 | www.yiqi163.com |
23.234.20.24 | www.yingxiangceliangyi.com |
23.234.20.24 | www.wjnmyy.com |
23.234.20.24 | www.wzcjyy.com |
23.234.20.24 | www.wudait.com |
23.234.20.24 | www.xhcsolar.com |
23.234.20.24 | www.kmnc.net |
23.234.20.24 | www2.8845sf.com |
23.234.20.24 | 120sf.0755nk.net |
23.234.20.24 | www.muhon.com.cn |
23.234.20.24 | www1.8845sf.com |
23.234.20.24 | 922gg.com |
23.234.20.24 | www.yts189.com |
23.234.20.24 | www.chakansdfj.com |
23.234.20.24 | www.steelrq.com |
23.234.20.24 | yindao.jfsm79.com |
23.234.20.24 | www.zx0411.com |
23.234.20.24 | www.kt516.com |
23.234.20.24 | 66sf.69ao.com |
23.234.20.24 | www.lt925.com |
23.234.20.24 | www.45wj.com |
23.234.20.24 | www.tt371.com |
23.234.20.24 | www.goule88.com |
23.234.20.24 | www.ranwen.cm |
23.234.20.24 | www.verosale.com |
23.234.20.24 | grambox.com |
23.234.20.24 | down.16kbook.com |
23.234.20.24 | www.grambox.com |
23.234.20.24 | cq.51zzsf.com |
23.234.20.24 | www.ka688.com |
23.234.20.24 | www.hj010.com |
23.234.20.24 | www.64sf.com |
23.234.20.24 | www.921pk.com |
23.234.20.24 | kt516.com |
23.234.20.24 | www.gc771.com |
23.234.20.24 | www.su315.com |
23.234.20.24 | www.jindepower.com |
23.234.20.24 | 88uc.sf19.cn |
23.234.20.24 | www.hrm123.net |
23.234.20.24 | www.bjyjy.com |
23.234.20.24 | www.uc99.com |
23.234.20.24 | wvw.9kf.com |
23.234.20.24 | 97sf.com |
23.234.20.24 | www.70uc.com |
23.234.20.24 | www.zhaoqiqi.com |
23.234.20.24 | www.hnrbysc.com |
23.234.20.24 | www.69ao.com |
23.234.20.24 | 32feef.11cq.cn |
23.234.20.24 | 176.01kp.com |
23.234.20.24 | www.kuj8.com |
23.234.20.24 | 81f.27-88.com |
23.234.20.24 | www.917se.com |
23.234.20.24 | www.fabumir.com |
23.234.20.24 | www.uc007.com |
23.234.20.24 | www.sf999.com.de |
23.234.20.24 | www.zhaosf.co |
23.234.20.24 | haosf12345.gm127.com |
23.234.20.24 | zhaosf.co |
23.234.20.24 | 66sf.com |
23.234.20.24 | www.chuanqisf.com |
23.234.20.24 | zhuzaigua.com |
23.234.20.24 | www.1pk.com |
23.234.20.24 | 28uc.com |
23.234.20.24 | chenmo.cc |
23.234.20.24 | www.sf22.com |
23.234.20.24 | www.sf405.com |
23.234.20.24 | www.cz45.com |
23.234.20.24 | 115cq.com |
23.234.20.24 | www.803cq.com |
23.234.20.24 | www.25930.com |
23.234.20.24 | 123f.com |
23.234.20.24 | hongxuda.com |
23.234.20.24 | haocqsf.com |
23.234.20.24 | www.100rcw.com |
23.234.20.24 | www.10000ok.com |
23.234.20.24 | www.05uc.com |
23.234.20.24 | www.23qianbao.com |
23.234.20.24 | www.222sf.com |
23.234.20.24 | www.72cq.com |
23.234.20.24 | www.ahmcks.com |
23.234.20.24 | www.90zzs.com |
23.234.20.24 | www.csqnw.com |
23.234.20.24 | www.dlz888.com |
23.234.20.24 | www.jx789.com |
23.234.20.24 | www.jsywg.com |
23.234.20.24 | www.tccyg.com |
23.234.20.24 | www.wcfm103.com |
23.234.20.24 | www.wjdhfz.com |
23.234.20.24 | www.zzz7.net |
23.234.20.24 | www.m3088tv.com |
23.234.20.24 | www.cxhdl.com |
23.234.20.24 | www.szbiaoyu.com |
23.234.20.24 | www.gzpioneer.com |
23.234.20.24 | www.mi-sc.com |
23.234.20.24 | www.hosisoft.com |
23.234.20.24 | www.huakangpc.com |
23.234.20.24 | www.zjkylsk.com |
23.234.20.24 | www.casscno.com |
23.234.20.24 | www.0808sf.com |
23.234.20.24 | www.jinhuachang.com |
23.234.20.24 | www.dongya888.com |
23.234.20.24 | www.fhxzd.com |
23.234.20.24 | www.sgwjg.com |
23.234.20.24 | www.pntfrc.com |
23.234.20.24 | www.sf9.cn |
23.234.20.24 | www.lxsqrfms.com |
23.234.20.24 | www.ygpkndz.com |
23.234.20.24 | www.jrxktdy.com |
23.234.20.24 | www.1007movie.net |
23.234.20.24 | 30.9youwang.com |
23.234.20.24 | 51huigo.com |
23.234.20.24 | 51sf.com |
23.234.20.24 | 520cq.com |
23.234.20.24 | 520cq.net |
23.234.20.24 | 765wg.com |
23.234.20.24 | 789is.com |
23.234.20.24 | www.23vo.com |
23.234.20.24 | 8aa.com |
23.234.20.24 | 91545.com |
23.234.20.24 | 99245.com |
23.234.20.24 | 95sf.com |
23.234.20.24 | 99ting.cn |
23.234.20.24 | 99ting.com |
23.234.20.24 | aaa.xz667.com |
23.234.20.24 | ac198.com |
23.234.20.24 | aa.606wz.com |
23.234.20.24 | bbs.1x.la |
23.234.20.24 | dbconsys.com |
23.234.20.24 | gaosf.com |
23.234.20.24 | gg.herom2.net |
23.234.20.24 | hao-sf-123.com |
23.234.20.24 | haosf.org |
23.234.20.24 | hao119.com |
23.234.20.24 | laosf.com |
23.234.20.24 | search.sf999.com |
23.234.20.24 | sf3000.com |
23.234.20.24 | sf86.com |
23.234.20.24 | sf99.com |
23.234.20.24 | sf999.net |
23.234.20.24 | sfsf.d518.com |
23.234.20.24 | shenqi.com |
23.234.20.24 | www.fzrhcopper.com |
23.234.20.24 | www.008fy.com |
23.234.20.24 | www.022hs.com |
23.234.20.24 | www.123qf.com |
23.234.20.24 | www.13xp.com |
23.234.20.24 | www.163fb.com |
23.234.20.24 | www.450sf.com |
23.234.20.24 | 23vo.com |
23.234.20.24 | www.1x.la |
23.234.20.24 | www.23bb.net |
23.234.20.24 | www.28uc.com |
23.234.20.24 | www.33sf.com |
23.234.20.24 | 450sf.com |
23.234.20.24 | www.55ip.com |
23.234.20.24 | www.58751.com |
23.234.20.24 | www.6090sf.com |
23.234.20.24 | www.67pp.com |
23.234.20.24 | www.77145.com |
23.234.20.24 | www.707wz.com |
23.234.20.24 | www.7pv.net |
23.234.20.24 | www.78x8.com |
23.234.20.24 | www.810f.com |
23.234.20.24 | www.8u8uu.com |
23.234.20.24 | www.915m.com |
23.234.20.24 | www.96cs.com |
23.234.20.24 | www.92gg.com |
23.234.20.24 | www.99245.com |
23.234.20.24 | www.sfniu.com |
23.234.20.24 | www.sihai-musical.com |
23.234.20.24 | www.cq588.com |
23.234.20.24 | 91084.com |
23.234.20.24 | www.dobgame.com |
23.234.20.24 | www.fireol.com |
23.234.20.24 | www.fei24.com |
23.234.20.24 | www.game-114.com |
23.234.20.24 | www.gaosf.com |
23.234.20.24 | www.gmhaosf.com |
23.234.20.24 | www.hao3a.com |
23.234.20.24 | www.haosf.bz |
23.234.20.24 | www.htdqsec.com |
23.234.20.24 | www.hzhswj.com |
23.234.20.24 | www.pk920.com |
23.234.20.24 | www.liwoma.com |
23.234.20.24 | 7000uc.com |
23.234.20.24 | www.nwpbl.com |
23.234.20.24 | www.ok3000.com |
23.234.20.24 | www.23c.com |
23.234.20.24 | www.pk555.com |
23.234.20.24 | www.pk920.com |
23.234.20.24 | www.rbtvs.com |
23.234.20.24 | www.91084.com |
23.234.20.24 | www.sdzblj.com |
23.234.20.24 | www.sf121.com |
23.234.20.24 | www.sebxa.com |
23.234.20.24 | www.sf3000.com |
23.234.20.24 | www.sf86.com |
23.234.20.24 | www.sf999.net |
23.234.20.24 | www.shuo321.com |
23.234.20.24 | www.shuiguanyin.com |
23.234.20.24 | www.sxzkzx.com |
23.234.20.24 | www.uc88.com |
23.234.20.24 | www.weihuangsz.com |
23.234.20.24 | www.weizhixs.com |
23.234.20.24 | www.wodewww.com |
23.234.20.24 | www.wsf520.com |
23.234.20.24 | 23c.com |
23.234.20.24 | www.xcwsg.com |
23.234.20.24 | www.xjlgc.com |
23.234.20.24 | www.zhuzaicq.com |
23.234.20.24 | www1.uc88.com |
23.234.20.24 | www2.520cq.com |
23.234.20.24 | www5.29u.com |
23.234.20.24 | www4.520cq.com |
23.234.20.24 | www5.520cq.com |
23.234.20.24 | 3000ko.com |
23.234.20.24 | www.sdjnxy.com |
23.234.20.24 | sf999.com |
23.234.20.24 | www.51okf.com |
23.234.20.24 | www.iiwoool.com |
23.234.20.24 | www.rxshige.com |
23.234.20.24 | www.dghke.com |
23.234.20.24 | www.7kkb.net |
23.234.20.24 | www.789518.com |
23.234.20.24 | www.cqfff.com |
23.234.20.24 | www4.beer51.com |
23.234.20.24 | www.cseht.com |
23.234.20.24 | www.82926.com |
23.234.20.24 | 8uc.558uc.com |
23.234.20.24 | www.99cangzhou.com |
23.234.20.24 | www.pjzbw.com |
23.234.20.24 | www.52375.com |
23.234.20.24 | www.xdhmotor.com |
23.234.20.24 | www.shmeigu168.com |
23.234.20.24 | www.comvod.com |
23.234.20.24 | www.gz-sc.com |
23.234.20.24 | www.stylepacking.com |
23.234.20.24 | www.hnfdczj.com |
23.234.20.24 | www.wfxycc.com |
23.234.20.24 | www.26ss.com |
23.234.20.24 | www.hezhihui.com |
23.234.20.24 | www.wuxihuaxia.com |
23.234.20.24 | www.nblongyi.com |
23.234.20.24 | www.7zcq.com |
23.234.20.24 | 7ugg.com |
23.234.20.24 | www.dliuren.com |
23.234.20.24 | www.wmult.com |
23.234.20.24 | www.3159wine.com |
23.234.20.24 | www.sf5137.com |
23.234.20.24 | www.cxxcqp.com |
23.234.20.24 | www.qz92.com |
23.234.20.24 | www.stronger-filter.com |
23.234.20.24 | www1.65cf.com |
23.234.20.24 | i8pk.com |
23.234.20.24 | www.trnly.com |
23.234.20.24 | www.zhaokj.com |
23.234.20.24 | www.yaojuezhan.com |
23.234.20.24 | www.tt2sf.com |
23.234.20.24 | www.qupaike.com |
23.234.20.24 | www.luowenqi.com |
23.234.20.24 | qqfcwgw.com |
23.234.20.24 | www.taosf.com.ru |
23.234.20.24 | www.zj-xd.com |
23.234.20.24 | www.mgszyc.com |
23.234.20.24 | 9pk.dgjt.net |
23.234.20.24 | www.2umm.com |
23.234.20.24 | www.yxyhx.com |
23.234.20.24 | zhaokf.com |
23.234.20.24 | www.sf010.com |
23.234.20.24 | www.sfdawang.com |
23.234.20.24 | www.17fg.com |
23.234.20.24 | abc.top258.cn |
23.234.20.24 | www.gm7.cc |
23.234.20.24 | 9kf.rzsport.com |
23.234.20.24 | ss.sg368.com |
23.234.20.24 | www.yy-bags.com |
23.234.20.24 | video.shunlo.com |
23.234.20.24 | www.45yes.com |
23.234.20.24 | www.cnyongli.com |
23.234.20.24 | www.sf03.com |
23.234.20.24 | www.88kf.net |
23.234.20.24 | www.88kf.com |
23.234.20.24 | www.sf168.com |
23.234.20.24 | 555sf.com |
23.234.20.24 | www.ourbep.com |
23.234.20.24 | www.manmank.com |
23.234.20.24 | sebxa.com |
23.234.20.24 | hchxh.com |
23.234.20.24 | z34.sf19.cn |
23.234.20.24 | www.mobilefad.com |
23.234.20.24 | www.sf22-2.com |
23.234.20.24 | www.tlsfwz.com |
23.234.20.24 | www.westmm.com |
23.234.20.24 | 7080st.com |
23.234.20.24 | www.sf322.com |
23.234.20.24 | www.zyjms.com |
23.234.20.24 | yy.7080st.com |
23.234.20.24 | jcniao.com |
23.234.20.24 | letanju.com |
23.234.20.24 | soso.8kst.com |
23.234.20.24 | www.taleclub.com |
23.234.20.24 | 008cqsf.com |
23.234.20.24 | 112sf.com |
23.234.20.24 | 114.75sf.cn |
23.234.20.24 | 123sf.com |
23.234.20.24 | 138bt.com |
23.234.20.24 | 138sf.com |
23.234.20.24 | 139.limulu.com |
23.234.20.24 | 163.fuatw.com |
23.234.20.24 | 168.w198.net |
23.234.20.24 | 168.zh-db.com |
23.234.20.24 | 178bifen.com |
23.234.20.24 | 17fg.com |
23.234.20.24 | 23c.com |
23.234.20.24 | 23ok.com |
23.234.20.24 | 28yes.com |
23.234.20.24 | 29u.com |
23.234.20.24 | 500sf.com |
23.234.20.24 | 513ux.com |
23.234.20.24 | 515.zh-db.com |
23.234.20.24 | 51xunt.com |
23.234.20.24 | 520.szgumi.com |
23.234.20.24 | 52345.com |
23.234.20.24 | 523sf.com |
23.234.20.24 | 523u.com |
23.234.20.24 | 55z5.com |
23.234.20.24 | 666sf.com |
23.234.20.24 | 66cq.com |
23.234.20.24 | 73sf.com |
23.234.20.24 | 777gm.com |
23.234.20.24 | 7uc.com |
23.234.20.24 | 81f.com |
23.234.20.24 | 81fu.com |
23.234.20.24 | 8845.com |
23.234.20.24 | 88858.com |
23.234.20.24 | www.qizhu.cc |
23.234.20.24 | www.as9z.com |
23.234.20.24 | 8uu.com |
23.234.20.24 | 91ww.com |
23.234.20.24 | 92045.com |
23.234.20.24 | 920sf.com |
23.234.20.24 | 926.com |
23.234.20.24 | 92fu.com |
23.234.20.24 | 999hj.com |
23.234.20.24 | 99j.com |
23.234.20.24 | 9kf.com |
23.234.20.24 | 9pk.k197.com |
23.234.20.24 | 9pk.u7u73.com |
23.234.20.24 | ad.97uu.com |
23.234.20.24 | haocq.com |
23.234.20.24 | pk123.com |
23.234.20.24 | plinm.com |
23.234.20.24 | qiqi530.com |
23.234.20.24 | qq.007uc.com |
23.234.20.24 | sf138.com |
23.234.20.24 | sf168.com |
23.234.20.24 | sf176.com |
23.234.20.24 | sf215.com |
23.234.20.24 | sf222.com |
23.234.20.24 | sf30.com |
23.234.20.24 | sf777.com |
23.234.20.24 | www.xhnano.com |
23.234.20.24 | sogou.1000ok.com |
23.234.20.24 | ww.1388fu.com |
23.234.20.24 | www.005sf.com |
23.234.20.24 | www.008n.com |
23.234.20.24 | www.015999.com |
23.234.20.24 | www.023cz.com |
23.234.20.24 | www.023toilet.com |
23.234.20.24 | www.027fruit.com |
23.234.20.24 | www.0313hybj.com |
23.234.20.24 | www.0532oa.com |
23.234.20.24 | www.055735.com |
23.234.20.24 | www.07186.com |
23.234.20.24 | www.1000gsf.com |
23.234.20.24 | www.112sf.com |
23.234.20.24 | www.114haosf.com |
23.234.20.24 | www.115cq.com |
23.234.20.24 | www.11811445.com |
23.234.20.24 | www.11cq.cn |
23.234.20.24 | www.120sf.com |
23.234.20.24 | www.123cq.com |
23.234.20.24 | www.123f.com |
23.234.20.24 | www.123hj.com |
23.234.20.24 | www.123sf.com |
23.234.20.24 | www.123uu.com |
23.234.20.24 | www.130136.com |
23.234.20.24 | www.134sf.com |
23.234.20.24 | www.138bt.com |
23.234.20.24 | www.145sf.com |
23.234.20.24 | www.15ss.com |
23.234.20.24 | www.16753.com |
23.234.20.24 | www.17fabu8.com |
23.234.20.24 | www.215pk.com |
23.234.20.24 | www.22j.com |
23.234.20.24 | www.234sfww.com |
23.234.20.24 | www.23c.com |
23.234.20.24 | www.23fu.com |
23.234.20.24 | www.23ok.com |
23.234.20.24 | www.23sfu.cn |
23.234.20.24 | www.27sf.com |
23.234.20.24 | www.28yes.com |
23.234.20.24 | www.29u.com |
23.234.20.24 | www.3000ok.cc |
23.234.20.24 | www.3000pk.com |
23.234.20.24 | www.31cqsf.com |
23.234.20.24 | www.31i.cn |
23.234.20.24 | 300sf.com |
23.234.20.24 | www.3300sf.com |
23.234.20.24 | www.33345.com |
23.234.20.24 | www.333ok.com |
23.234.20.24 | www.33pk.com |
23.234.20.24 | www.33wt.com |
23.234.20.24 | www.361cq.com |
23.234.20.24 | www.365taoba.com |
23.234.20.24 | www.371cyw.com |
23.234.20.24 | www.37ok.com |
23.234.20.24 | www.3dmeibang.com |
23.234.20.24 | www.3qsf.com |
23.234.20.24 | www.418sf.in |
23.234.20.24 | www.425sf.com |
23.234.20.24 | www.44dy.com |
23.234.20.24 | www.45195.com |
23.234.20.24 | www.34ok.com |
23.234.20.24 | www.8cq.cc |
23.234.20.24 | www.45bang.com |
23.234.20.24 | 34ok.com |
23.234.20.24 | www.45hs.com |
23.234.20.24 | www.4nic-dy.com |
23.234.20.24 | www.500sf.com |
23.234.20.24 | www.51sf.com |
23.234.20.24 | www.52058.com |
23.234.20.24 | www.520cq.com |
23.234.20.24 | www.520jy.com |
23.234.20.24 | zhaosf.hsdbm.com |
23.234.20.24 | www.523sf.com |
23.234.20.24 | www.523u.com |
23.234.20.24 | www.531U.com |
23.234.20.24 | www.533ok.com |
23.234.20.24 | www.53sf.com |
23.234.20.24 | www.53uc.com |
23.234.20.24 | www.53w.com.cn |
23.234.20.24 | www.54ss.net |
23.234.20.24 | www.pk920.com |
23.234.20.24 | www.55z5.com |
23.234.20.24 | www.565sf.com |
23.234.20.24 | www.56ss.com |
23.234.20.24 | cdchuanghui.com |
23.234.20.24 | www.57591.com |
23.234.20.24 | www.57f.com |
23.234.20.24 | www.57fg.com |
23.234.20.24 | www.57ww.com |
23.234.20.24 | www.5800sf.com |
23.234.20.24 | www.58sf.com |
23.234.20.24 | www.58uc.com |
23.234.20.24 | www.5index.net |
23.234.20.24 | www.5qu.com |
23.234.20.24 | www.64pk.com |
23.234.20.24 | www.6645.com |
23.234.20.24 | www.666sf.com |
23.234.20.24 | www.676711.com |
23.234.20.24 | www.677g.com |
23.234.20.24 | www.67m2.com |
23.234.20.24 | www.686f.com |
23.234.20.24 | www.697sf.com |
23.234.20.24 | www.6cq.cc |
23.234.20.24 | www.73sf.com |
23.234.20.24 | www.75sf.cn |
23.234.20.24 | www.777gm.com |
23.234.20.24 | www.77d8.com |
23.234.20.24 | www.77kl.com |
23.234.20.24 | www.79j.com |
23.234.20.24 | www.7j773.com |
23.234.20.24 | www.7uc.com |
23.234.20.24 | www.80845.com |
23.234.20.24 | www.812315.com |
23.234.20.24 | www.81267.com |
23.234.20.24 | www.81fu.com |
23.234.20.24 | www.823f.com |
23.234.20.24 | www.82506.com |
23.234.20.24 | www.860572.com |
23.234.20.24 | www.860580.com |
23.234.20.24 | www.87sf.com |
23.234.20.24 | www.8845.com |
23.234.20.24 | www.88845.com |
23.234.20.24 | www.88858.com |
23.234.20.24 | www.89176.com |
23.234.20.24 | www.8aa.com |
23.234.20.24 | www.8uc.com |
23.234.20.24 | www.900hj.com |
23.234.20.24 | www.909f.com |
23.234.20.24 | www.9100sf.com |
23.234.20.24 | www.915301.com |
23.234.20.24 | www.91545.com |
23.234.20.24 | www.91ff.com |
23.234.20.24 | www.91wuc.com |
23.234.20.24 | www.920666.com |
23.234.20.24 | www.920gg.com |
23.234.20.24 | www.920sf.com |
23.234.20.24 | www.923u.com |
23.234.20.24 | www.92fu.com |
23.234.20.24 | www.92ww.com |
23.234.20.24 | www.93sf.com |
23.234.20.24 | www.94432.com |
23.234.20.24 | www.95sf.com |
23.234.20.24 | www.96645.com |
23.234.20.24 | www.9800sf.com |
23.234.20.24 | www.980cq.com |
23.234.20.24 | www.99964.com |
23.234.20.24 | www.999hj.com |
23.234.20.24 | www.999wg.net |
23.234.20.24 | www.99a.com |
23.234.20.24 | www.99ji.com |
23.234.20.24 | www.99pk.com |
23.234.20.24 | www.apbfhl.com |
23.234.20.24 | www.aifugu.com |
23.234.20.24 | www.33pk.com |
23.234.20.24 | 33pk.com |
23.234.20.24 | www.bjhdshengda.com |
23.234.20.24 | www.bjtdyz.com |
23.234.20.24 | www.bsfzjx.com |
23.234.20.24 | www.bsrcsc.com |
23.234.20.24 | www.cnycta.com |
23.234.20.24 | www.cq45.com |
23.234.20.24 | www.cq91530.com |
23.234.20.24 | www.cqy6.com |
23.234.20.24 | www.csrxj.com |
23.234.20.24 | www.cy4f.com |
23.234.20.24 | www.fy371.com |
23.234.20.24 | www.gm888.com |
23.234.20.24 | www.gxxgy.com |
23.234.20.24 | www.gzxing.com |
23.234.20.24 | www.heli-cn.com |
23.234.20.24 | www.hnyuhai.com |
23.234.20.24 | www.hstztc.com |
23.234.20.24 | www.hwhaosf.com |
23.234.20.24 | www.7000uc.com |
23.234.20.24 | www.ksd777.com |
23.234.20.24 | www.laisf.com |
23.234.20.24 | www.laohaosf.com |
23.234.20.24 | www.lovewg.com |
23.234.20.24 | www.luckysz.com |
23.234.20.24 | www.mai101.com |
23.234.20.24 | www.mikating.com |
23.234.20.24 | www.mtv110.com |
23.234.20.24 | www.nj-row.com |
23.234.20.24 | www.nybxm.com |
23.234.20.24 | www.ocerlight.com |
23.234.20.24 | www.oksf.net |
23.234.20.24 | www.pk123.com |
23.234.20.24 | www.plinm.com |
23.234.20.24 | www.qiqi530.com |
23.234.20.24 | www.qzrt.com |
23.234.20.24 | www.recairen.com |
23.234.20.24 | www.rexuesf.in |
23.234.20.24 | www.sf0058.com |
23.234.20.24 | www.sf1003.com |
23.234.20.24 | www.sf17.com |
23.234.20.24 | www.sf176.com |
23.234.20.24 | www.sf215.com |
23.234.20.24 | www.sf222.com |
23.234.20.24 | www.sf231.com |
23.234.20.24 | www.sf29.com |
23.234.20.24 | www.sf30.com |
23.234.20.24 | www.sf520.com.cn |
23.234.20.24 | www.sf555.com |
23.234.20.24 | www.sf5858.com |
23.234.20.24 | www.sf63.com |
23.234.20.24 | www.sf777.com |
23.234.20.24 | www.sf8500.com |
23.234.20.24 | www.sf92045.com |
23.234.20.24 | www.sf930.com |
23.234.20.24 | www.sf99.com |
23.234.20.24 | www.shaibar.com |
23.234.20.24 | www.shamandi.com |
23.234.20.24 | www.ksjxyy.com |
23.234.20.24 | www.sktpcbic.com |
23.234.20.24 | www.stkj66.com |
23.234.20.24 | www.tj-aote.com |
23.234.20.24 | www.haosf999.com |
23.234.20.24 | www.wan45.com |
23.234.20.24 | www.whjdwxw.com |
23.234.20.24 | www.whlinuo.com |
23.234.20.24 | www.worldkcc.com |
23.234.20.24 | www.wtcqsf.com |
23.234.20.24 | www.xiaomeisf.com |
23.234.20.24 | www.xihaihotel.com |
23.234.20.24 | www.xindudu.com |
23.234.20.24 | www.xinganchem.com |
23.234.20.24 | www.ovytgnby.com |
23.234.20.24 | www.xinsf.com |
23.234.20.24 | www.yeschongcao.com |
23.234.20.24 | www.ynyeer.com |
23.234.20.24 | www.ysguandao.com |
23.234.20.24 | www.yxzhidao.com |
23.234.20.24 | www.zhaochenmo.com |
23.234.20.24 | www.zhaofg.com |
23.234.20.24 | www.zhaohaosf.net |
23.234.20.24 | www.zhaokf.com |
23.234.20.24 | www.zhaosf88.com |
23.234.20.24 | www.zhaoss.com |
23.234.20.24 | www1.pk123.com |
23.234.20.24 | www10.138sf.com |
23.234.20.24 | xiaomeisf.com |
23.234.20.24 | xinsf.com |
23.234.20.24 | www.500ok.com |
23.234.20.24 | www.wancm.com |
23.234.20.24 | jjj.la |
23.234.20.24 | zhaochenmo.com |
23.234.20.24 | zuhukang.com |
23.234.20.24 | www.shangkequ.com |
23.234.20.24 | www.9527cqsf.com |
23.234.20.24 | www.tjtuliao.com |
23.234.20.24 | www.szplas.com |
23.234.20.24 | www.hlxyx.com |
23.234.20.24 | www.012sf.com |
23.234.20.24 | www.zhaosf.cc |
23.234.20.24 | www.07sf.com |
23.234.20.24 | www.duoduosf.com |
23.234.20.24 | www.sf66666.com |
23.234.20.24 | www.my7su.com |
23.234.20.24 | www.725sf.com |
23.234.20.24 | 725sf.com |
23.234.20.24 | www.96sf.com |
23.234.20.24 | www.pk196.com |
23.234.20.24 | www.letanju.com |
23.234.20.24 | 50ss.com |
23.234.20.24 | www.50ss.com |
23.234.20.24 | sfdawang.com |
23.234.20.24 | taocq.com |
23.234.20.24 | www.73uu.com |
23.234.20.24 | www.taocq.com |
23.234.20.24 | www.30uc.com |
23.234.20.24 | www.nz999.net |
23.234.20.24 | www.ww45.com |
23.234.20.24 | www.xt-dz.com |
23.234.20.24 | www.pk99.com |
23.234.20.24 | www.1e2w.cn |
23.234.20.24 | 8845.678uc.com |
23.234.20.24 | cq.3q33.com |
23.234.20.24 | www.baojingqi.net |
23.234.20.24 | www.didihc.com |
23.234.20.24 | www.bangnijie.com |
23.234.20.24 | www.chenmo.cc |
23.234.20.24 | www.sina35.com |
23.234.20.24 | www.175sf.com |
23.234.20.24 | sf123.cc |
23.234.20.24 | www.shfiro.com |
23.234.20.24 | bjyocy.com |
23.234.20.24 | www.pochanlawyer.com |
23.234.20.24 | www.138sf.cc |
23.234.20.24 | 99pk.com |
23.234.20.24 | www.22cq.com |
23.234.20.24 | www.888ww.com |
23.234.20.24 | www.2sifu.com |
23.234.20.24 | wvw.uc99.com |
23.234.20.24 | 123.uc99.com |
23.234.20.24 | 999ok.com |
23.234.20.24 | www.sf99.cc |
23.234.20.24 | www.80sf.com |
23.234.20.24 | www.33221.com |
23.234.20.24 | www.pk9090.com |
23.234.20.24 | pk9090.com |
23.234.20.24 | www2.uc88.com |
23.234.20.24 | www3.uc88.com |
23.234.20.24 | www4.uc88.com |
23.234.20.24 | 88845.com |
23.234.20.24 | www.sf9.com |
23.234.20.24 | www.700sf.com |
23.234.20.24 | 920gg.com |
23.234.20.24 | www.23c.com |
23.234.20.24 | www.021sx.com |
23.234.20.24 | www.sf78.com |
23.234.20.24 | www.qjfang.cn |
23.234.20.24 | 23c.com |
23.234.20.24 | www.yaofg.com |
23.234.20.24 | www.07ket.com |
23.234.20.24 | www.17hhg.com |
23.234.20.24 | www.46cq.com |
23.234.20.24 | www.wan345.com |
23.234.20.24 | www.htlq.com |
23.234.20.24 | www.nbkst.com |
23.234.20.24 | www.meishipai.com |
23.234.20.24 | www.987pk.com |
23.234.20.24 | www.weisf.com |
23.234.20.24 | www.baqisf.com |
23.234.20.24 | www.91530.com |
23.234.20.24 | www.zhaohaosf.com |
23.234.20.24 | www.s400.com |
23.234.20.24 | www.aichenmo.com |
23.234.20.24 | www.sf315.com |
23.234.20.24 | 425sf.com |
23.234.20.24 | www.23gg.com |
23.234.20.24 | yaofg.com |
23.234.20.24 | www.44woool.com |
23.234.20.24 | www.17166.com |
23.234.20.24 | www.wt789.com |
23.234.20.24 | www.591maimai.com |
23.234.20.24 | www.gggsf.com |
23.234.20.24 | www.cecri.com |
23.234.20.24 | www.cnpxba.com |
23.234.20.24 | www.cqrcxx.com |
23.234.20.24 | www.zhaowt.net |
23.234.20.24 | 3000ak.com |
23.234.20.24 | www.3000ak.com |
23.234.20.24 | 027gg.net |
23.234.20.24 | www.85sf.com |
23.234.20.24 | www.cnxinghang.com |
23.234.20.24 | www.sf19.com |
23.234.20.24 | www.uc600.com |
23.234.20.24 | www.255uc.com |
23.234.20.24 | 255uc.com |
23.234.20.24 | 111.kaihu365.com |
23.234.20.24 | www.3000ok-1.com |
23.234.20.24 | www.3000ok.com |
23.234.20.24 | www.sf588.com |
23.234.20.24 | www.jjj3000ok.com |
23.234.20.24 | 1000ok.com |
23.234.20.24 | www.666923.com |
23.234.20.24 | www.920313.com |
23.234.20.24 | www.616st.com |
23.234.20.24 | www.53my.com |
23.234.20.24 | www.945176.net |
23.234.20.24 | www.999sf.cc |
23.234.20.24 | 933gg.com |
23.234.20.24 | haosf.com |
23.234.20.24 | www.haosf.com.cn |
23.234.20.24 | tg.cnm78.com |
23.234.20.24 | www.1213sf.com |
23.234.20.24 | www.678sf.com |
23.234.20.24 | www.250sf.com |
23.234.20.24 | www.92188.com |
23.234.20.24 | 888.hyds888.com |
23.234.20.24 | www.646sf.com |
23.234.20.24 | www.82cq.com |
23.234.20.24 | sf99.cc |
23.234.20.24 | www.50ww.com |
23.234.20.24 | sf590.com |
23.234.20.24 | www.sf590.com |
23.234.20.24 | www.35fg.com |
23.234.20.24 | www.sf526.com |
23.234.20.24 | www.18ux.com |
23.234.20.24 | www.520cq.net |
23.234.20.24 | www.haosf12345.com |
23.234.20.24 | sf22.com |
23.234.20.24 | pk99.com |
23.234.20.24 | 79j.com |
23.234.20.24 | 55sf.com |
23.234.20.24 | www.55sf.com |
23.234.20.24 | www.zm63.com |
23.234.20.24 | 926.syslx.com |
23.234.20.24 | 1000ok.cc |
23.234.20.24 | www.1000ok.cc |
23.234.20.24 | 3000ok.isosf.com |
23.234.20.24 | 3000ok.com |
23.234.20.24 | tt.syslx.com |
23.234.20.24 | www.zhaofq.com |
23.234.20.24 | 2013.cqmdl.com |
23.234.20.24 | www.19fu.com |
23.234.20.24 | 19fu.com |
23.234.20.24 | www.zhaosifu.com |
23.234.20.24 | www.kom999.com |
23.234.20.24 | www.ok777.com |
23.234.20.24 | www.757sf.com |
23.234.20.24 | www.50999.com |
23.234.20.24 | 33345.com |
23.234.20.24 | 999zg.com |
23.234.20.24 | www.13ss.com |
23.234.20.24 | www.520zf.com |
23.234.20.24 | 88pk.com |
23.234.20.24 | www.990yx.com |
23.234.20.24 | www.cqacura.com |
23.234.20.24 | www.tldsny.com |
23.234.20.24 | www.wzggwz.com |
23.234.20.24 | www.tjnhey.com |
23.234.20.24 | www.51friends.com |
23.234.20.24 | aa.707wz.com |
23.234.20.24 | www.cn-skf.com |
23.234.20.24 | www.6sf.com |
23.234.20.24 | www.jianfeixy.com |
23.234.20.24 | www.shkingdu.com |
23.234.20.24 | www.707wz.com |
23.234.20.24 | www.suoyinm.com |
23.234.20.24 | www.zcmeter.com |
23.234.20.24 | www.115book.com |
23.234.20.24 | 9kst.com |
23.234.20.24 | 9u.7080st.com |
23.234.20.24 | www.118uc.om |
23.234.20.24 | www.haofwd.com |
23.234.20.24 | www.zhaowoool.com |
23.234.20.24 | www.gdhttz.com |
23.234.20.24 | www.fzdbdz.com |
23.234.20.24 | www.tianguhotel.com |
23.234.20.24 | www.chinahjly.com |
23.234.20.24 | tgaxved8.com |
23.234.20.24 | 5a189.com |
23.234.20.24 | www.wuwoool.com |
23.234.20.24 | www.shitongdg.com |
23.234.20.24 | www.sbqcssf.com |
23.234.20.24 | www.51cssf.net.cn |
23.234.20.24 | www.65535cs.com |
23.234.20.24 | zhao.559woool.com |
23.234.20.24 | www.559woool.com |
23.234.20.24 | www.5sdl.com |
23.234.20.24 | www.dandong-window.com |
23.234.20.24 | www.xinyumen.com |
23.234.20.24 | www.ahzhishang.com |
23.234.20.24 | www.xd163.com |
23.234.20.24 | www.trm-china.com |
23.234.20.24 | www.aoyue168.com |
23.234.20.24 | www.gdcable.com |
23.234.20.24 | www.zhuwulong.com |
23.234.20.24 | www.szjapson.com |
23.234.20.24 | www.swan-storage.com |
23.234.20.24 | www.cseptc.com |
23.234.20.24 | www.zcgddz.com |
23.234.20.24 | www.dycssf.com |
23.234.20.24 | www.9965478.com |
23.234.20.24 | www.jshgzb.com |
23.234.20.24 | www.qd-qinggang.com |
23.234.20.24 | gzgm.27pyki.com |
23.234.20.24 | www.hcs888.com |
23.234.20.24 | www.woool578.com |
23.234.20.24 | www.jntex.com |
23.234.20.24 | 917wool.cn |
23.234.20.24 | chuanqifj.com |
23.234.20.24 | www.lqgz.com |
23.234.20.24 | www.suwoool.com |
23.234.20.24 | www.45ci.com |
23.234.20.24 | www.sdyjt.com |
23.234.20.24 | www1.bai12.com |
23.234.20.24 | www.889cs.com |
23.234.20.24 | www.cjphb.com |
23.234.20.24 | www.szosun.com |
23.234.20.24 | www.garment5.com |
23.234.20.24 | www.gm66.com |
23.234.20.24 | www.com15.com |
23.234.20.24 | www.emc120.com |
23.234.20.24 | ktjia.com |
23.234.20.24 | www.05woool.com |
23.234.20.24 | www.cnsjjs.com |
23.234.20.24 | www.jnxsfr.com |
23.234.20.24 | www.99cishan.com |
23.234.20.24 | 44woool.com |
23.234.20.24 | www.mm886.net |
23.234.20.24 | zhaosf.com |
23.234.20.24 | www.shyssteel.com |
23.234.20.24 | www.ywool.com |
23.234.20.24 | www.hao123woool.com |
23.234.20.24 | aixin168.com |
23.234.20.24 | www.wooolfbw.com |
23.234.20.24 | www.525pc.com |
23.234.20.24 | www.zhaowooolsf.com |
23.234.20.24 | www.cn-tyn.com |
23.234.20.24 | www.917wool.cn |
23.234.20.24 | www.hy225.com |
23.234.20.24 | www.10gamer.com |
23.234.20.24 | www.zv2o.com |
23.234.20.24 | www.411wed.com |
23.234.20.24 | www.lewoool.com |
23.234.20.24 | gtcc2008.com |
23.234.20.24 | 945pk.com |
23.234.20.24 | pk777.com |
23.234.20.24 | www.168gamer.com |
23.234.20.24 | new.guguyu.com |
23.234.20.24 | web.longhoo.net |
23.234.20.24 | www.8090yxs.com |
23.234.20.24 | aszt.6268.com |
23.234.20.24 | kf.07073.com |
23.234.20.24 | www.mcncc.com |
23.234.20.24 | www.wudijz.com |
23.234.20.24 | lhzs.9377.com |
23.234.20.24 | lhzs.37wan.com |
23.234.20.24 | lhzs.yaowan.com |
23.234.20.24 | lhzs.49you.com |
23.234.20.24 | lhzs.8090yxs.com |
23.234.20.24 | wz.49you.com |
23.234.20.24 | wz.6711.com |
23.234.20.24 | asqx.yaowan.com |
23.234.20.24 | www.sifucun.com |
23.234.20.24 | bbs.to4f.com |
23.234.20.24 | www.pg666.cn |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
attrib.exe:1884
attrib.exe:1692
attrib.exe:1208
attrib.exe:636
cacls.exe:612
cacls.exe:1976
cacls.exe:224
cacls.exe:1260
cacls.exe:592 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\b.bat (255 bytes)
%System%\drivers\etc\hosts.ics (17013 bytes)
C:\a.bat (356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\cj[1].txt (4605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\43881.tmp (15 bytes)
%System%\drivers\etc\protocol (799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\style[1].css (12015 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\game[1].htm (32375 bytes)
%System%\drivers\etc\networks (407 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso.hcjd56[2].txt (313 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\click[1].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\jiaqun[1].htm (254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\title-bg[1].jpg (1458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\bg[1].jpg (61672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\drivers\etc\lmhosts.sam (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso.hcjd56[1].txt (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\soso.hcjd56[1].htm (1199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\count1[1].gif (715 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (788 bytes)
%System%\drivers\etc\services (7 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wscntmx" = "D:\\wscntmx.exe" - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: Language Neutral
Company Name: Product Name: ?????Product Version: 1.0.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ?????Comments: ??????????(http://www.eyuyan.com)Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 516503 | 520192 | 4.52261 | e6d1e505b6e797f4264ecb246f28912f |
.rdata | 524288 | 1433206 | 1433600 | 5.42723 | 3335f2a8db532a922d434b6e99934e6a |
.data | 1957888 | 242410 | 65536 | 3.50857 | ea27acb430ed52e731842deb15634ee5 |
.rsrc | 2203648 | 34688 | 36864 | 3.97456 | 9bf5245a564665c71f614b79c10e4b5a |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://jc.941pojie.com/jiaqun.htm | 125.88.186.134 |
hxxp://jc.941pojie.com/cj.txt | 125.88.186.134 |
hxxp://jc.941pojie.com/zy.txt | 125.88.186.134 |
hxxp://jc.941pojie.com/tc.txt | 125.88.186.134 |
hxxp://p21.tcdn.qq.com/wpa/images/group.png | |
hxxp://jc.941pojie.com/cxbt.txt | 125.88.186.134 |
hxxp://count46.51yes.com/click.aspx?id=460737107&logo=1 | 61.147.124.247 |
hxxp://count46.51yes.com/count1.gif | 61.147.124.247 |
hxxp://count46.51yes.com/sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) | 61.147.124.247 |
hxxp://cj.941pojie.com/tc.txt | 125.88.186.134 |
hxxp://cj.941pojie.com/zy.txt | 125.88.186.134 |
hxxp://cj.941pojie.com/cxbt.txt | 125.88.186.134 |
hxxp://pub.idqqimg.com/wpa/images/group.png | 103.7.29.190 |
soso.hcjd56.com | 115.231.174.114 |
25145ko1.hbgyzs.com | 115.231.174.114 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /click.aspx?id=460737107&logo=1 HTTP/1.1
Accept: */*
Referer: hXXp://soso.hcjd56.com:88/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count46.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 30 Aug 2015 14:56:57 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Type: text/html; charset=gb2312
Content-Length: 1777
..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(endstr==-1) endstr=document.cookie.length;return document.cookie.substring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.length;var clen=document.cookie.length;var i=0;var j;while(i<clen) {j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=document.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..function cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*36000;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=0; expires=" y_e.toGMTString() "; path=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_count");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' escape(document.location) '&color=' screen.colorDepth 'x&resolution=' screen.width 'x' screen.height '&returning=' cc_k() '&language=' navigator.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('<a href="hXXp://countt.51yes.com/index.aspx?id=460737107" target=_blank><img width=20 height=20 border=0 hspace=0 vspace=0 src=
<<< skipped >>>
GET /sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://soso.hcjd56.com:88/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count46.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 30 Aug 2015 14:56:58 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Length: 0
HTTP/1.1 200 OK..Date: Sun, 30 Aug 2015 14:56:58 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Control: private..Content-Length: 0..
GET /jiaqun.htm HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: jc.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 30 Aug 2015 14:56:37 GMT
Content-Length: 217
Content-Type: text/html
Content-Encoding: gzip
Content-Location: hXXp://jc.941pojie.com/jiaqun.htm
Last-Modified: Sun, 30 Aug 2015 14:51:59 GMT
Accept-Ranges: bytes
ETag: "8091166c33e3d01:840bb"
Vary: Accept-Encoding
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
..........t.=R. .E.....y.....8.........]Y.he....v..z..-..9...!9.-}43..%c...c....}...1.v[.S.......O...J.....k.CU......m.....@-Ah..r{. .`..2.rY....#fK=..rJ.do.p...1..-..p.3..#.au..|~.R................d.g..v...o.........HTTP/1.1 200 OK..Date: Sun, 30 Aug 2015 14:56:37 GMT..Content-Length: 217..Content-Type: text/html..Content-Encoding: gzip..Content-Location: hXXp://jc.941pojie.com/jiaqun.htm..Last-Modified: Sun, 30 Aug 2015 14:51:59 GMT..Accept-Ranges: bytes..ETag: "8091166c33e3d01:840bb"..Vary: Accept-Encoding..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET............t.=R. .E.....y.....8.........]Y.he....v..z..-..9...!9.-}43..%c...c....}...1.v[.S.......O...J.....k.CU......m.....@-Ah..r{. .`..2.rY....#fK=..rJ.do.p...1..-..p.3..#.au..|~.R................d.g..v...o...........
GET /wpa/images/group.png HTTP/1.1
Accept: */*
Referer: hXXp://jc.941pojie.com/jiaqun.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pub.idqqimg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: X2S_Platform
Connection: keep-alive
Cache-Control: max-age=259200
Last-Modified: Fri, 12 Apr 2013 09:22:21 GMT
Content-Type: image/png
Content-Length: 1827
Keep-Alive: timeout=60
X-Cache-Lookup: Hit From MemCache
.PNG........IHDR...Z.........w.{'....PLTEV...dE)r.Ip..........F........F..Kyy...r.....~E ......m..c..........d3.....S.....r...S1...#.....c........A..l3....d.............ynvc......"..]Z@.mZ..jB..............&..I...\BH.....................rHh........z4$...X..0.....R.....s@6...{RL(.......Xs.y......S........%.........vb...4......bW...[%..........L..t..s..c>'...2..............wsw..i.............yM...WwaR...?-.fU...~K;.`H...t..V..:..d...........h/#.......Z74..........pt5(...K...vb=......lM.........N.kr......I A............pVs..k.....f'.p.....c..%...SG.J;..r6......fBr..o=5...T..J...jB......5.....|......n^....XLm3#......y.f.}X....]6...,y....8..........q.D-Mt....^* z= y>#.dK...^...........>..s..J..............B....q...................xy...'..t.....7..M...~Re........s: .K(.rP`)..^=.........3......G:V......WE..2.....pHYs.................IDAT8....T.U...lCs..It.....5r,*....I.K.].5p.d....2.4Fw.m}.....e.v7r.........S.D.IVR.&.....y8G;.................N.r...9.t......p9.....].......,Ko..i.......Mh.|@..hyw..9...n..qo-....C.....s.fpo..:{..vtQQG........'..zmr.......H...m.u4.;..t...7....C.........a...?....{)...W..4...u......(....l..Q.|......R.u.3K.;.!..}vy([.e.~YhG[^. y......C...<....~.<-^I3......$..B....z...?$......u...S.7....qF$?.wF..G..lkC#...=...A...C.......#x...Ea.yvS(..P..e..2..*....yD]]d.\.....{..h.....5.UK.@J....ux7...>5.H_....}...T]2x,EO7SEmf.6.u:sk(..4...-.,...o6;B...Me. .\..._.]SSs..._....?g.,.x.$.tL...)..u.<Mv`4..Q<QiU.1O.X%......q..-.w.h... **.....e}..E...'...51t...0...0v....)^1.'.^..U.u`| 3.8l.)
<<< skipped >>>
GET /click.aspx?id=460737107&logo=1 HTTP/1.1
Accept: */*
Referer: hXXp://soso.hcjd56.com:88/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count46.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 30 Aug 2015 14:56:53 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Type: text/html; charset=gb2312
Content-Length: 1777
..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(endstr==-1) endstr=document.cookie.length;return document.cookie.substring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.length;var clen=document.cookie.length;var i=0;var j;while(i<clen) {j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=document.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..function cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*36000;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=0; expires=" y_e.toGMTString() "; path=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_count");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' escape(document.location) '&color=' screen.colorDepth 'x&resolution=' screen.width 'x' screen.height '&returning=' cc_k() '&language=' navigator.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('<a href="hXXp://countt.51yes.com/index.aspx?id=460737107" target=_blank><img width=20 height=20 border=0 hspace=0 vspace=0 src=
<<< skipped >>>
GET /count1.gif HTTP/1.1
Accept: */*
Referer: hXXp://soso.hcjd56.com:88/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count46.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 715
Content-Type: image/gif
Last-Modified: Thu, 07 Apr 2005 17:25:22 GMT
Accept-Ranges: bytes
ETag: "02d4c7963bc51:3f4c"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sun, 30 Aug 2015 14:56:54 GMT
GIF89a.....~........n...............................B.....x..[.....(c............................RS....wv...................Y.....~{....'...........|........A.................ie.Z[.__..g.M.................v..sr.`^.....................................>{.............&r....'..............F......g.O.....lo.^..jj..........NN.............n...s.................m...................S..$~................!.....~.,............~......stY..i..E@Tr9]9x~SM.4[z).V.R~JK*..W:0...0..nmA5&..Gy..%..^a?\.11D>..k-...-%3NC..=d(.~Hg...L:3?o...}..~Ol....w4p}}(. .{.@.<.8....l(..p0a...<^....N...5L..1.....i)..@C...D`0B...!.....!..;.`P..A.5.D..Qf...;. pa!...f..2b"......`A....8......R.M.`..F....(>`.. ....N.x.HF...jx.s.F.1...H2.....#....;HTTP/1.1 200 OK..Content-Length: 715..Content-Type: image/gif..Last-Modified: Thu, 07 Apr 2005 17:25:22 GMT..Accept-Ranges: bytes..ETag: "02d4c7963bc51:3f4c"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Sun, 30 Aug 2015 14:56:54 GMT..GIF89a.....~........n...............................B.....x..[.....(c............................RS....wv...................Y.....~{....'...........|........A.................ie.Z[.__..g.M.................v..sr.`^.....................................>{.............&r....'..............F......g.O.....lo.^..jj..........NN.............n...s.................m...................S..$~................!.....~.,............~......stY..i..E@Tr9]9x~SM.4[z).V.R~JK*..W:0...0..nmA5&..Gy..%..^a?\.11D>..k-...-%3NC..=d(.~Hg...L:3?o...}..~Ol....w4p}}(. .{.@.<.8..
<<< skipped >>>
GET /cj.txt HTTP/1.1
Accept: */*
Accept-Language: en-us
If-Modified-Since: Thu, 01 Jan 1970 00:00:00 GMT
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: jc.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 30 Aug 2015 14:56:36 GMT
Content-Length: 12977
Content-Type: text/plain
Content-Encoding: gzip
Content-Location: hXXp://jc.941pojie.com/cj.txt
Last-Modified: Sun, 23 Aug 2015 18:38:27 GMT
Accept-Ranges: bytes
ETag: "809346e6d2ddd01:840b3"
Vary: Accept-Encoding
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
...........}Y..8.....j.9..Bp....DH.D..\..?..G.s.-O...Q.q..jL&k.Eq... .....}..f(......./$.....j%h.....@L...((.."h .Z#.a.?...N|.R|.. ...C.4.....M......%F.G..u&,M.p.ntk.WC.\...OK/...:.l..4C.4......$8d;....x.\.A....Q~....O..._s....h>.|.G.Nc.6.....1h7........~......4f.m{.. }}}X...=.....dqH......c.&.ZM[Cr....$.._.x}..|&h.~..^&d..J..n....z.v.U.j.C<v.y.....4kQPc).<.y.QSL..b,...Y.u)...A..q...[....#..G.4.%.P...0gE.....,.......Ad.K.. .x....!)Y..D.. ...6.7..N.Y.k...:..Ksj.~...7W.jv$..D.`o.u...v..Z.|.....o.K[.,....W...........7x.n.<.'..5.%G....9.30^.L[.QR...Y=O...T.%.K.{..............?..[..u)B...U..u)...x....O............g0......4 !..&L2j......{....!.......yT.`.k]).... ........97...DV.d^.n.ju,.....LKC.p)5..a.W.I...I.G..ho.~....ZX.......M..H.U........OV....I_...............t..i....4.....m.G.$...m.....*5..2..#............j..b....Ao_.........N...gMS.a...?......... ..|.. .w.nV...sy[....T........n;.w.[.....C.;......R...... ..h^x......1(.,...{... )}8....\&...A .....g.K}....O...s=...$...l.D......Y......WP5.."y?.qB.].^.&{i{......<..s........5..2..h.SS.{.Z..!...kUW.)y...|..Q...'f.z..e......%....2.1I.,f.T8.!.|._...@..Q.s..Q1..{.u.~..).>.......>....yI]...j.$..)~.....9YF1.z.f.9R.!....\B...VF.Y...(RV.Q.E.A..i...4.My!n...3O...J...b...>,.SY...8...*h..Z.8....D..<....V.&..b...$..o..)w......<4k..g.h%.].....S.Ca...B..l....I....$.[K*]p....yh.....L...p.....].t..Vo... ='......9...........<......:...8.6.-.o....9..S.L.y......x..T. .l~.....Z......!.S....9P.(.a.A.C]C..:K.%&504q..*..Fq...i.?.7.........no_...&...."...D
<<< skipped >>>
GET /cxbt.txt HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: cj.941pojie.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 30 Aug 2015 14:56:40 GMT
Content-Length: 31
Content-Type: text/plain
Content-Location: hXXp://cj.941pojie.com/cxbt.txt
Last-Modified: Sun, 01 Mar 2015 05:20:17 GMT
Accept-Ranges: bytes
ETag: "eafeb367df53d01:840bb"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
......................@........HTTP/1.1 200 OK..Date: Sun, 30 Aug 2015 14:56:40 GMT..Content-Length: 31..Content-Type: text/plain..Content-Location: hXXp://cj.941pojie.com/cxbt.txt..Last-Modified: Sun, 01 Mar 2015 05:20:17 GMT..Accept-Ranges: bytes..ETag: "eafeb367df53d01:840bb"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET........................@..........
GET /sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://soso.hcjd56.com:88/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count46.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sun, 30 Aug 2015 14:56:54 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Length: 0
HTTP/1.1 200 OK..Date: Sun, 30 Aug 2015 14:56:54 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Control: private..Content-Length: 0..
GET /zy.txt HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: cj.941pojie.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 30 Aug 2015 14:56:38 GMT
Content-Length: 26
Content-Type: text/plain
Content-Location: hXXp://cj.941pojie.com/zy.txt
Last-Modified: Sun, 26 Apr 2015 14:12:28 GMT
Accept-Ranges: bytes
ETag: "02ed062b80d01:840bb"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
hXXp://soso.hcjd56.com:88/....
GET /tc.txt HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: cj.941pojie.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 30 Aug 2015 14:56:38 GMT
Content-Length: 26
Content-Type: text/plain
Content-Location: hXXp://cj.941pojie.com/tc.txt
Last-Modified: Sun, 26 Apr 2015 14:12:08 GMT
Accept-Ranges: bytes
ETag: "246922fb2a80d01:840bb"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
hXXp://soso.hcjd56.com:88/HTTP/1.1 200 OK..Date: Sun, 30 Aug 2015 14:56:38 GMT..Content-Length: 26..Content-Type: text/plain..Content-Location: hXXp://cj.941pojie.com/tc.txt..Last-Modified: Sun, 26 Apr 2015 14:12:08 GMT..Accept-Ranges: bytes..ETag: "246922fb2a80d01:840bb"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..hXXp://soso.hcjd56.com:88/..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1736:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
shlwapi.dll
shlwapi.dll
kernel32.dll
kernel32.dll
00414599
00414599
%System%\drivers\etc
%System%\drivers\etc
%System%\drivers\etc\hosts
%System%\drivers\etc\hosts
127.0.0.1 VVV.52anzu.com
127.0.0.1 VVV.52anzu.com
127.0.0.1 www1.52anzu.com
127.0.0.1 www1.52anzu.com
127.0.0.1 52anzu.com
127.0.0.1 52anzu.com
127.0.0.1 VVV.sopojie.com
127.0.0.1 VVV.sopojie.com
127.0.0.1 www1.sopojie.com
127.0.0.1 www1.sopojie.com
127.0.0.1 sopojie.com
127.0.0.1 sopojie.com
127.0.0.1 1.52yanzheng.sinaapp.com
127.0.0.1 1.52yanzheng.sinaapp.com
%System%\drivers\etc\protocol
%System%\drivers\etc\protocol
tcp 6 TCP # Transmission control protocol
tcp 6 TCP # Transmission control protocol
udp 17 UDP # User datagram protocol
udp 17 UDP # User datagram protocol
%System%\drivers\etc\services
%System%\drivers\etc\services
# This file contains port numbers for well-known services defined by IANA
# This file contains port numbers for well-known services defined by IANA
# / [aliases...] [#]
# / [aliases...] [#]
echo 7/tcp
echo 7/tcp
echo 7/udp
echo 7/udp
discard 9/tcp sink null
discard 9/tcp sink null
discard 9/udp sink null
discard 9/udp sink null
systat 11/tcp users #Active users
systat 11/tcp users #Active users
daytime 13/tcp
daytime 13/tcp
daytime 13/udp
daytime 13/udp
qotd 17/tcp quote #Quote of the day
qotd 17/tcp quote #Quote of the day
qotd 17/udp quote #Quote of the day
qotd 17/udp quote #Quote of the day
chargen 19/tcp ttytst source #Character generator
chargen 19/tcp ttytst source #Character generator
chargen 19/udp ttytst source #Character generator
chargen 19/udp ttytst source #Character generator
ftp-data 20/tcp #FTP, data
ftp-data 20/tcp #FTP, data
ftp 21/tcp #FTP. control
ftp 21/tcp #FTP. control
telnet 23/tcp
telnet 23/tcp
smtp 25/tcp mail #Simple Mail Transfer Protocol
smtp 25/tcp mail #Simple Mail Transfer Protocol
time 37/tcp timserver
time 37/tcp timserver
time 37/udp timserver
time 37/udp timserver
rlp 39/udp resource #Resource Location Protocol
rlp 39/udp resource #Resource Location Protocol
nameserver 42/tcp name #Host Name Server
nameserver 42/tcp name #Host Name Server
nameserver 42/udp name #Host Name Server
nameserver 42/udp name #Host Name Server
nicname 43/tcp whois
nicname 43/tcp whois
domain 53/tcp #Domain Name Server
domain 53/tcp #Domain Name Server
domain 53/udp #Domain Name Server
domain 53/udp #Domain Name Server
bootps 67/udp dhcps #Bootstrap Protocol Server
bootps 67/udp dhcps #Bootstrap Protocol Server
bootpc 68/udp dhcpc #Bootstrap Protocol Client
bootpc 68/udp dhcpc #Bootstrap Protocol Client
tftp 69/udp #Trivial File Transfer
tftp 69/udp #Trivial File Transfer
gopher 70/tcp
gopher 70/tcp
finger 79/tcp
finger 79/tcp
http 80/tcp www www-http #World Wide Web
http 80/tcp www www-http #World Wide Web
kerberos 88/tcp krb5 kerberos-sec #Kerberos
kerberos 88/tcp krb5 kerberos-sec #Kerberos
kerberos 88/udp krb5 kerberos-sec #Kerberos
kerberos 88/udp krb5 kerberos-sec #Kerberos
hostname 101/tcp hostnames #NIC Host Name Server
hostname 101/tcp hostnames #NIC Host Name Server
iso-tsap 102/tcp #ISO-TSAP Class 0
iso-tsap 102/tcp #ISO-TSAP Class 0
rtelnet 107/tcp #Remote Telnet Service
rtelnet 107/tcp #Remote Telnet Service
pop2 109/tcp postoffice #Post Office Protocol - Version 2
pop2 109/tcp postoffice #Post Office Protocol - Version 2
pop3 110/tcp #Post Office Protocol - Version 3
pop3 110/tcp #Post Office Protocol - Version 3
sunrpc 111/tcp rpcbind portmap #SUN Remote Procedure Call
sunrpc 111/tcp rpcbind portmap #SUN Remote Procedure Call
sunrpc 111/udp rpcbind portmap #SUN Remote Procedure Call
sunrpc 111/udp rpcbind portmap #SUN Remote Procedure Call
auth 113/tcp ident tap #Identification Protocol
auth 113/tcp ident tap #Identification Protocol
uucp-path 117/tcp
uucp-path 117/tcp
nntp 119/tcp usenet #Network News Transfer Protocol
nntp 119/tcp usenet #Network News Transfer Protocol
ntp 123/udp #Network Time Protocol
ntp 123/udp #Network Time Protocol
epmap 135/tcp loc-srv #DCE endpoint resolution
epmap 135/tcp loc-srv #DCE endpoint resolution
epmap 135/udp loc-srv #DCE endpoint resolution
epmap 135/udp loc-srv #DCE endpoint resolution
netbios-ns 137/tcp nbname #NETBIOS Name Service
netbios-ns 137/tcp nbname #NETBIOS Name Service
netbios-ns 137/udp nbname #NETBIOS Name Service
netbios-ns 137/udp nbname #NETBIOS Name Service
netbios-dgm 138/udp nbdatagram #NETBIOS Datagram Service
netbios-dgm 138/udp nbdatagram #NETBIOS Datagram Service
netbios-ssn 139/tcp nbsession #NETBIOS Session Service
netbios-ssn 139/tcp nbsession #NETBIOS Session Service
imap 143/tcp imap4 #Internet Message Access Protocol
imap 143/tcp imap4 #Internet Message Access Protocol
pcmail-srv 158/tcp #PCMail Server
pcmail-srv 158/tcp #PCMail Server
snmp 161/udp #SNMP
snmp 161/udp #SNMP
snmptrap 162/udp snmp-trap #SNMP trap
snmptrap 162/udp snmp-trap #SNMP trap
print-srv 170/tcp #Network PostScript
print-srv 170/tcp #Network PostScript
bgp 179/tcp #Border Gateway Protocol
bgp 179/tcp #Border Gateway Protocol
irc 194/tcp #Internet Relay Chat Protocol
irc 194/tcp #Internet Relay Chat Protocol
ipx 213/udp #IPX over IP
ipx 213/udp #IPX over IP
ldap 389/tcp #Lightweight Directory Access Protocol
ldap 389/tcp #Lightweight Directory Access Protocol
https 443/tcp MCom
https 443/tcp MCom
https 443/udp MCom
https 443/udp MCom
microsoft-ds 445/tcp
microsoft-ds 445/tcp
microsoft-ds 445/udp
microsoft-ds 445/udp
kpasswd 464/tcp # Kerberos (v5)
kpasswd 464/tcp # Kerberos (v5)
kpasswd 464/udp # Kerberos (v5)
kpasswd 464/udp # Kerberos (v5)
isakmp 500/udp ike #Internet Key Exchange
isakmp 500/udp ike #Internet Key Exchange
exec 512/tcp #Remote Process Execution
exec 512/tcp #Remote Process Execution
biff 512/udp comsat
biff 512/udp comsat
login 513/tcp #Remote Login
login 513/tcp #Remote Login
who 513/udp whod
who 513/udp whod
cmd 514/tcp shell
cmd 514/tcp shell
syslog 514/udp
syslog 514/udp
printer 515/tcp spooler
printer 515/tcp spooler
talk 517/udp
talk 517/udp
ntalk 518/udp
ntalk 518/udp
efs 520/tcp #Extended File Name Server
efs 520/tcp #Extended File Name Server
router 520/udp route routed
router 520/udp route routed
timed 525/udp timeserver
timed 525/udp timeserver
tempo 526/tcp newdate
tempo 526/tcp newdate
courier 530/tcp rpc
courier 530/tcp rpc
conference 531/tcp chat
conference 531/tcp chat
netnews 532/tcp readnews
netnews 532/tcp readnews
netwall 533/udp #For emergency broadcasts
netwall 533/udp #For emergency broadcasts
uucp 540/tcp uucpd
uucp 540/tcp uucpd
klogin 543/tcp #Kerberos login
klogin 543/tcp #Kerberos login
kshell 544/tcp krcmd #Kerberos remote shell
kshell 544/tcp krcmd #Kerberos remote shell
new-rwho 550/udp new-who
new-rwho 550/udp new-who
remotefs 556/tcp rfs rfs_server
remotefs 556/tcp rfs rfs_server
rmonitor 560/udp rmonitord
rmonitor 560/udp rmonitord
monitor 561/udp
monitor 561/udp
ldaps 636/tcp sldap #LDAP over TLS/SSL
ldaps 636/tcp sldap #LDAP over TLS/SSL
doom 666/tcp #Doom Id Software
doom 666/tcp #Doom Id Software
doom 666/udp #Doom Id Software
doom 666/udp #Doom Id Software
kerberos-adm 749/tcp #Kerberos administration
kerberos-adm 749/tcp #Kerberos administration
kerberos-adm 749/udp #Kerberos administration
kerberos-adm 749/udp #Kerberos administration
kerberos-iv 750/udp #Kerberos version IV
kerberos-iv 750/udp #Kerberos version IV
kpop 1109/tcp #Kerberos POP
kpop 1109/tcp #Kerberos POP
phone 1167/udp #Conference calling
phone 1167/udp #Conference calling
ms-sql-s 1433/tcp #Microsoft-SQL-Server
ms-sql-s 1433/tcp #Microsoft-SQL-Server
ms-sql-s 1433/udp #Microsoft-SQL-Server
ms-sql-s 1433/udp #Microsoft-SQL-Server
ms-sql-m 1434/tcp #Microsoft-SQL-Monitor
ms-sql-m 1434/tcp #Microsoft-SQL-Monitor
ms-sql-m 1434/udp #Microsoft-SQL-Monitor
ms-sql-m 1434/udp #Microsoft-SQL-Monitor
wins 1512/tcp #Microsoft Windows Internet Name Service
wins 1512/tcp #Microsoft Windows Internet Name Service
wins 1512/udp #Microsoft Windows Internet Name Service
wins 1512/udp #Microsoft Windows Internet Name Service
ingreslock 1524/tcp ingres
ingreslock 1524/tcp ingres
l2tp 1701/udp #Layer Two Tunneling Protocol
l2tp 1701/udp #Layer Two Tunneling Protocol
pptp 1723/tcp #Point-to-point tunnelling protocol
pptp 1723/tcp #Point-to-point tunnelling protocol
radius 1812/udp #RADIUS authentication protocol
radius 1812/udp #RADIUS authentication protocol
radacct 1813/udp #RADIUS accounting protocol
radacct 1813/udp #RADIUS accounting protocol
nfsd 2049/udp nfs #NFS server
nfsd 2049/udp nfs #NFS server
knetd 2053/tcp #Kerberos de-multiplexor
knetd 2053/tcp #Kerberos de-multiplexor
man 9535/tcp #Remote Man Server
man 9535/tcp #Remote Man Server
%System%\drivers\etc\lmhosts.sam
%System%\drivers\etc\lmhosts.sam
# This is a sample LMHOSTS file used by the Microsoft TCP/IP for Windows.
# This is a sample LMHOSTS file used by the Microsoft TCP/IP for Windows.
# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
# \0xnn (non-printing character support)
# \0xnn (non-printing character support)
# browser and logon services behave in TCP/IP environments. To preload
# browser and logon services behave in TCP/IP environments. To preload
# be able to read the lmhosts file successfully. This key is under
# be able to read the lmhosts file successfully. This key is under
# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
# 102.54.94.97 rhino #PRE #DOM:networking #net group's DC
# 102.54.94.97 rhino #PRE #DOM:networking #net group's DC
# 102.54.94.102 "appname \0x14" #special app server
# 102.54.94.102 "appname \0x14" #special app server
# 102.54.94.123 popular #PRE #source server
# 102.54.94.123 popular #PRE #source server
# 102.54.94.117 localsrv #PRE #needed for the include
# 102.54.94.117 localsrv #PRE #needed for the include
%System%\drivers\etc\networks
%System%\drivers\etc\networks
# campus 284.122.107
# campus 284.122.107
# london 284.122.108
# london 284.122.108
D:\wscntmx.exe
D:\wscntmx.exe
`.data
`.data
@.vmp0
@.vmp0
`.vmp1
`.vmp1
.reloc
.reloc
}~/%D(
}~/%D(
.;6 (&%
.;6 (&%
1
1
1=;;6 )%#
1=;;6 )%#
=
=
=
=
=
=
==
==
=
=
=
=
=
=
==
==
=
=
e{TP.cda8
e{TP.cda8
U#ex'B-n}
U#ex'B-n}
MSVBVM60.DLL
MSVBVM60.DLL
user32.dll
user32.dll
5i.Id(HE
5i.Id(HE
~32.bd~
~32.bd~
.sKpK
.sKpK
.soAw?
.soAw?
.qT3
.qT3
hXXp://cj.941pojie.com/tc.txt
hXXp://cj.941pojie.com/tc.txt
hXXp://cj.941pojie.com/zy.txt
hXXp://cj.941pojie.com/zy.txt
hXXp://cj.941pojie.com/cxbt.txt
hXXp://cj.941pojie.com/cxbt.txt
hXXp://cj.941pojie.com/wbzz.txt
hXXp://cj.941pojie.com/wbzz.txt
.aspack
.aspack
.adata
.adata
.xqrq
.xqrq
.pH`X|
.pH`X|
.YON=
.YON=
p*.LIAt
p*.LIAt
5].NQg
5].NQg
=.cw| r\
=.cw| r\
C @Qb%3Ua@.5
C @Qb%3Ua@.5
l(8i?ZiDf\.SQ
l(8i?ZiDf\.SQ
%C*pig
%C*pig
The procedure entry point %s could not be located in the dynamic link library %s
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
comctl32.dll
comctl32.dll
gdi32.dll
gdi32.dll
msimg32.dll
msimg32.dll
msvcrt.dll
msvcrt.dll
msvfw32.dll
msvfw32.dll
hXXp://VVV.eyybc.com
hXXp://VVV.eyybc.com
\skinh.she
\skinh.she
M.GG^
M.GG^
%s T5
%s T5
]E4%F(
]E4%F(
.Funr
.Funr
.yyw'
.yyw'
%sX@:`
%sX@:`
J|.jv
J|.jv
p4%xcEm
p4%xcEm
.Jr1Z
.Jr1Z
7.YT"
7.YT"
.Uf!0
.Uf!0
!a%U}
!a%U}
[I(3/#N0.bd
[I(3/#N0.bd
j"%u=w
j"%u=w
q%Xn`
q%Xn`
@|H.NI
@|H.NI
.wdd!
.wdd!
S|%u4
S|%u4
5.ff)
5.ff)
;)?/\%~|/
;)?/\%~|/
U%D?~;
U%D?~;
l2.Ue
l2.Ue
9%crU
9%crU
XKw-k}
XKw-k}
zx/%FN[
zx/%FN[
LY.eo
LY.eo
z{.Do
z{.Do
%s=\RI
%s=\RI
}j%c%Y)
}j%c%Y)
Rx.GR
Rx.GR
4o#.dM
4o#.dM
IeS`%C
IeS`%C
[n 4\.UY
[n 4\.UY
,4.qO,
,4.qO,
gQ'.Io
gQ'.Io
%cLur?
%cLur?
s%DHB
s%DHB
]I%%X
]I%%X
I %d)
I %d)
.aEd(
.aEd(
Õ6m*
Õ6m*
5r.US
5r.US
:mD].tB
:mD].tB
fJ.WM_
fJ.WM_
fTpe
fTpe
.LLbX
.LLbX
f%fUZ
f%fUZ
.fOuV12
.fOuV12
*_.dC
*_.dC
&-N}
&-N}
({?.cQm
({?.cQm
R>o2.YN>
R>o2.YN>
.Cqx~c
.Cqx~c
.`.Qw
.`.Qw
.Onwj
.Onwj
Tn&.hL
Tn&.hL
**.dU
**.dU
%s;7*
%s;7*
0%x@w
0%x@w
%C^L:
%C^L:
CX%xm
CX%xm
!n]%x
!n]%x
%X,Cr
%X,Cr
*.Ea]S
*.Ea]S
Q.CGo
Q.CGo
tn!ay%F
tn!ay%F
2.kKX
2.kKX
Avi.CT
Avi.CT
xhZ_6%U
xhZ_6%U
%SY!8i
%SY!8i
&.PFy{xh
&.PFy{xh
sG.qmf
sG.qmf
5.ZrW
5.ZrW
%Ucda
%Ucda
n.BjCw
n.BjCw
.um ZZE7L
.um ZZE7L
/^p%u$
/^p%u$
I.NoQY
I.NoQY
zu.ew
zu.ew
D/.nT
D/.nT
z.LP"
z.LP"
.IRIx
.IRIx
"%Sh9
"%Sh9
&;%sUwa
&;%sUwa
kBS%dR
kBS%dR
VVV.meitu.com
VVV.meitu.com
M%u{$
M%u{$
;s.iF
;s.iF
9E.nV
9E.nV
X-.RP
X-.RP
>.xKA
>.xKA
uDPf
uDPf
jc.941pojie.com/jiaqun.htm
jc.941pojie.com/jiaqun.htm
F%*.*f
F%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
ole32.dll
ole32.dll
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
RASAPI32.dll
RASAPI32.dll
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WINMM.dll
WINMM.dll
WS2_32.dll
WS2_32.dll
VERSION.dll
VERSION.dll
GetProcessHeap
GetProcessHeap
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
GetKeyState
GetKeyState
USER32.dll
USER32.dll
GetViewportOrgEx
GetViewportOrgEx
GDI32.dll
GDI32.dll
WINSPOOL.DRV
WINSPOOL.DRV
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
OLEAUT32.dll
OLEAUT32.dll
COMCTL32.dll
COMCTL32.dll
oledlg.dll
oledlg.dll
WSOCK32.dll
WSOCK32.dll
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
WININET.dll
WININET.dll
GetCPInfo
GetCPInfo
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
comdlg32.dll
comdlg32.dll
%x.tmp
%x.tmp
.PAVCException@@
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
VVV.dywt.com.cn
VVV.dywt.com.cn
.PAVCOleException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
zcÃ
zcÃ
c:\%original file name%.exe
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
360.cn
360.cn
hosts2.exe
hosts2.exe
1, 0, 6, 6
1, 0, 6, 6
SkinH_EL.dll
SkinH_EL.dll
(*.*)
(*.*)
1.0.0.0
1.0.0.0
(hXXp://VVV.eyuyan.com)
(hXXp://VVV.eyuyan.com)
wscntmx.exe_1288:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.vmp0
@.vmp0
`.vmp1
`.vmp1
.reloc
.reloc
}~/%D(
}~/%D(
.;6 (&%
.;6 (&%
1
1
1=;;6 )%#
1=;;6 )%#
=
=
=
=
=
=
==
==
=
=
=
=
=
=
==
==
=
=
attrib -r -s -h %windir%\system32\drivers\etc\hosts.ics
attrib -r -s -h %windir%\system32\drivers\etc\hosts.ics
attrib -r -s -h %windir%\system32\wbem\window\winxp.ics
attrib -r -s -h %windir%\system32\wbem\window\winxp.ics
#vb6chs.dll
#vb6chs.dll
%Program Files%\VB
%Program Files%\VB
\VB6.OLB
\VB6.OLB
advapi32.dll
advapi32.dll
RegCloseKey
RegCloseKey
RegCreateKeyA
RegCreateKeyA
RegOpenKeyA
RegOpenKeyA
VBA6.DLL
VBA6.DLL
e{TP.cda8
e{TP.cda8
U#ex'B-n}
U#ex'B-n}
MSVBVM60.DLL
MSVBVM60.DLL
user32.dll
user32.dll
5i.Id(HE
5i.Id(HE
~32.bd~
~32.bd~
.sKpK
.sKpK
.soAw?
.soAw?
.qT3
.qT3
kernel32.dll
kernel32.dll
SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Microsoft.XMLHTTP
Microsoft.XMLHTTP
hXXp://jc.941pojie.com/cj.txt
hXXp://jc.941pojie.com/cj.txt
%System%\drivers\etc
%System%\drivers\etc
%System%\drivers\etc\hosts
%System%\drivers\etc\hosts
c:\windows\system32\drivers\etc\hosts
c:\windows\system32\drivers\etc\hosts
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\drivers\etc\hosts.ics
c:\a.bat
c:\a.bat
c:\b.bat
c:\b.bat
zhaosf.com
zhaosf.com
Adodb.Stream
Adodb.Stream
360.cn
360.cn
windows
windows
hosts2.exe
hosts2.exe
wscntmx.exe_1288_rwx_0041F000_00001000:
MSVBVM60.DLL
MSVBVM60.DLL
user32.dll
user32.dll
iexplore.exe_484:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.fg>
IIIIIB(II<.fg>
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512
wscntmx.exe_1288_rwx_00426000_00001000:
.soAw?
.soAw?
.qT3
.qT3
kernel32.dll
kernel32.dll