Dropped:Generic.Malware.Ydld.FA2E3F2E (BitDefender), HEUR:Trojan-Downloader.Win32.Generic (Kaspersky), Dropped:Generic.Malware.Ydld.FA2E3F2E (B) (Emsisoft), Suspicious.BredoLab (Symantec), Trojan-Spy.Gen2 (Ikarus), Dropped:Generic.Malware.Ydld.FA2E3F2E (FSecure), Cryptic.ERX (AVG), Win32:Packed-C [Heur] (Avast), PAK_Generic.005 (TrendMicro), Dropped:Generic.Malware.Ydld.FA2E3F2E (AdAware), Trojan-Downloader.Win32.Karagany.1.FD, Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, mzpefinder_pcap_file.YR, GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan-Spy, Trojan-PSW, Trojan, Packed, Malware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 8412aea0c55fa45fcc10caf8131704f6
SHA1: fa58682844be5a13ed2e56907b1d890d290ae019
SHA256: 7be9035ad1311dee2b2e3d89529793fa508049eb2c8653a78f6783f804c9e14a
SSDeep: 49152:GTWqOgRzC4Zbg6ptyGFh WLiseOIV2WeX8kWVhBx3jZ599AgZPEol:BMz9FpIVb9jTbZPE8
Size: 2808188 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Appinstallr
Created at: 2009-06-07 00:41:48
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
net1.exe:1436
net1.exe:1736
net1.exe:1988
net1.exe:1952
net.exe:428
net.exe:596
net.exe:1352
net.exe:1772
%original file name%.exe:1800
svchost06.exe:1200
The Trojan injects its code into the following process(es):
DNFµ¶¿ÃÂÂ0606A.exe:344
MZRTdKAQ.exe:1732
xslxtnl.exe:968
svchost06.exe:816
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process DNFµ¶¿ÃÂÂ0606A.exe:344 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (196 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\5a8ff7a6ad7e38ec83dcaa35f9967198_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (48 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\5f20925ad2c5776d06c97fc8ee4a524c_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (51 bytes)
The process MZRTdKAQ.exe:1732 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\123[1].txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\x666[1].txt (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\h666[1].txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hmsx[1].txt (126 bytes)
The process xslxtnl.exe:968 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[1].htm (3683 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ip.qq[1].txt (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MZRTdKAQ.exe (5442 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ip.qq[2].txt (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[2].htm (3683 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@ip.qq[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[1].htm (0 bytes)
The process %original file name%.exe:1800 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\svchost06.exe (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DNFµ¶¿ÃÂÂ0606A.exe (76913 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nse3F.tmp (0 bytes)
The process svchost06.exe:1200 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xslxtnl.exe (171767 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\HM[1].css (219603 bytes)
Registry activity
The process DNFµ¶¿ÃÂÂ0606A.exe:344 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCR\wn1107778097c.vch]
"(Default)" = "91 EA 48 9D 43 A2 61 FD 80 05 EF DB AF 28 AA 71"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 18 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E8 66 D1 EA E7 C9 42 FD 0D 54 B4 72 AB 09 E4 4A"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process net1.exe:1436 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F ED 28 EF E7 09 DD 53 EB 8F E4 2B AA FA 62 A5"
The process net1.exe:1736 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 E3 6B 91 8A E1 DC 89 E5 24 91 9F 44 4A 89 53"
The process net1.exe:1988 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 46 1D 8C 5A CB AD DA 0E 9C 5D EF 2F BB 28 5C"
The process net1.exe:1952 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 4A 79 33 01 82 FF 4E 2C A5 7F 21 DF 4B 70 2C"
The process net.exe:428 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD B6 CA 7A 65 F6 72 48 CA 00 09 C6 EF A0 6F 9A"
The process net.exe:596 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "90 51 E9 D0 5F 4D B9 E4 C1 95 7F 4B C1 92 DA 0A"
The process net.exe:1352 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F D6 6B 63 24 D1 43 39 AD B6 3E EA A4 BE 33 CC"
The process net.exe:1772 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB 54 90 A3 9F 95 BC E3 6A D5 53 BB 3A B3 31 75"
The process MZRTdKAQ.exe:1732 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B 57 E8 15 16 E1 33 AB 0D DE 10 60 D6 BB 5C DA"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process xslxtnl.exe:968 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 19 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 21 A9 13 36 9B A3 2F 89 31 B6 07 40 13 ED 33"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process %original file name%.exe:1800 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F CD B5 60 3B BB 4D E5 9E 52 24 C0 AC 0B B0 4E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"DNFµ¶¿ÃÂÂ0606A.exe" = "YY:5667"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"svchost06.exe" = "svchost06"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process svchost06.exe:1200 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8B 37 A3 78 F2 37 DA 72 5E D1 21 EC B2 32 44 78"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process svchost06.exe:816 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D9 82 61 CD 88 82 CA DB 18 BF F3 3F 0F 66 FF 13"
Dropped PE files
| MD5 | File path |
|---|---|
| 095c066ffd1a52ce6f969747aa693965 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\DNFµ¶¿ÃÂ0606A.exe |
| 25f43f53384bc2e7c2ce0ea73d18afa6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\MZRTdKAQ.exe |
| 83a58bb6e1f0494f5c968802f1900caa | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\xslxtnl.exe |
| 83a58bb6e1f0494f5c968802f1900caa | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\HM[1].css |
| 5ad6b152fa64bf3aa09fc1310dfe5c16 | c:\WINDOWS\637.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
net1.exe:1436
net1.exe:1736
net1.exe:1988
net1.exe:1952
net.exe:428
net.exe:596
net.exe:1352
net.exe:1772
%original file name%.exe:1800
svchost06.exe:1200 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (196 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\5a8ff7a6ad7e38ec83dcaa35f9967198_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (48 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\5f20925ad2c5776d06c97fc8ee4a524c_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (51 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\123[1].txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\x666[1].txt (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\h666[1].txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hmsx[1].txt (126 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[1].htm (3683 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ip.qq[1].txt (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MZRTdKAQ.exe (5442 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ip.qq[2].txt (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[2].htm (3683 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\svchost06.exe (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DNFµ¶¿ÃÂÂ0606A.exe (76913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xslxtnl.exe (171767 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\HM[1].css (219603 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 22738 | 23040 | 4.45908 | c69726ed422d3dcfdec9731986daa752 |
| .rdata | 28672 | 4496 | 4608 | 3.59034 | a2c7710fa66fcbb43c7ef0ab9eea5e9a |
| .data | 36864 | 110456 | 1024 | 3.20082 | e59cdcb732e4bfbc84cc61dd68354f78 |
| .ndata | 147456 | 32768 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .rsrc | 180224 | 286584 | 286720 | 3.12585 | 75f85eefcd0f9433fcf02cd46f93d4e5 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 2
7f819cc1e471371baed4715c2f0216dc
90a060fc6d8de441020e3e715f834db2
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://www.a.shifen.com/ | |
| hxxp://a1574.b.akamai.net/453198928/blog/1344939460 | |
| hxxp://ip.qq.com/cgi-bin/index | 112.90.83.44 |
| hxxp://user.qzone.qq.com/453198928/blog/1344939460 | 165.254.149.51 |
| hxxp://www.baidu.com/ | 180.76.3.151 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /453198928/blog/1344939460 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: user.qzone.qq.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: QZHTTP-2.38.18
X-Frame-Options: SAMEORIGIN
X-UA-Compatible: IE=Edge
Last-Modified: Thu, 03 Jul 2014 05:07:18 GMT
Cache-Control: max-age=0, no-transform, proxy-revalidate
Content-Type: text/html; charset=utf-8
Date: Thu, 03 Jul 2014 05:07:18 GMT
Content-Length: 26815
Connection: keep-alive
Set-Cookie: _qz_referrer=; expires=Mon, 26 Jul 1997 05:00:00 GMT; PATH=/; DOMAIN=qq.com
<!DOCTYPE HTML><html lang="zh-cn" class="skin-dark pg-profile"><head><noscript><meta http-equiv="refresh" content="0; url=hXXp://os.qzs.qq.com/qzone/v6/troubleshooter/noscript.html" /></noscript><meta charset="UTF-8" /><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><title>............... [hXXp://453198928.qzone.qq.com]</title><meta name="keywords" content="QQ......,......,............,............,QQ......,QQ......" /><meta name="description" content="..................@......!MY name Chief A20140126pig" /><script type="text/javascript"> var g_domain = "qq.com"; document.domain=g_domain; var _s_=new Date(),g_T={},siDomain="os.qzonestyle.gtimg.cn",imgcacheDomain="os.qzs." g_domain,g_iUin=453198928,g_iLoginUin=0;g_T.fwp=[_s_];document.namespaces&&document.namespaces.add&&(document.namespaces.add('qz', 'hXXp://qzone.qq.com/'),document.namespaces.add('x', 'http://qzone.qq.com/'));</script> <link href="hXXp://os.qzonestyle.gtimg.cn/aoi/old-qz_qzone_lv.css" rel="stylesheet" /><link href="hXXp://os.qzonestyle.gtimg.cn/aoi/skin/31.css" rel="stylesheet"/><link href="hXXp://os.qzonestyle.gtimg.cn/aoi/profile.css" rel="stylesheet"/><style id="mainJSTitleBar" type="text/css">.layout-head-inner {height:190px;}</style><style type="text/css"></style><style type="text/css" id="dynamicStyle">.ownermode{display:none;}.clientmode{display:;}.editmode{display:none;
<<
<<< skipped >>>
GET /453198928/blog/1344939460 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: user.qzone.qq.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: QZHTTP-2.38.18
X-Frame-Options: SAMEORIGIN
X-UA-Compatible: IE=Edge
Last-Modified: Thu, 03 Jul 2014 05:07:19 GMT
Cache-Control: max-age=0, no-transform, proxy-revalidate
Content-Type: text/html; charset=utf-8
Date: Thu, 03 Jul 2014 05:07:19 GMT
Content-Length: 26815
Connection: keep-alive
Set-Cookie: _qz_referrer=; expires=Mon, 26 Jul 1997 05:00:00 GMT; PATH=/; DOMAIN=qq.com
<!DOCTYPE HTML><html lang="zh-cn" class="skin-dark pg-profile"><head><noscript><meta http-equiv="refresh" content="0; url=hXXp://os.qzs.qq.com/qzone/v6/troubleshooter/noscript.html" /></noscript><meta charset="UTF-8" /><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><title>............... [hXXp://453198928.qzone.qq.com]</title><meta name="keywords" content="QQ......,......,............,............,QQ......,QQ......" /><meta name="description" content="..................@......!MY name Chief A20140126pig" /><script type="text/javascript"> var g_domain = "qq.com"; document.domain=g_domain; var _s_=new Date(),g_T={},siDomain="os.qzonestyle.gtimg.cn",imgcacheDomain="os.qzs." g_domain,g_iUin=453198928,g_iLoginUin=0;g_T.fwp=[_s_];document.namespaces&&document.namespaces.add&&(document.namespaces.add('qz', 'hXXp://qzone.qq.com/'),document.namespaces.add('x', 'http://qzone.qq.com/'));</script> <link href="hXXp://os.qzonestyle.gtimg.cn/aoi/old-qz_qzone_lv.css" rel="stylesheet" /><link href="hXXp://os.qzonestyle.gtimg.cn/aoi/skin/31.css" rel="stylesheet"/><link href="hXXp://os.qzonestyle.gtimg.cn/aoi/profile.css" rel="stylesheet"/><style id="mainJSTitleBar" type="text/css">.layout-head-inner {height:190px;}</style><style type="text/css"></style><style type="text/css" id="dynamicStyle">.ownermode{display:none;}.clientmode{display:;}.editmode{display:none;
<<
<<< skipped >>>
GET /453198928/blog/1344939460 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: user.qzone.qq.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: QZHTTP-2.38.18
X-Frame-Options: SAMEORIGIN
X-UA-Compatible: IE=Edge
Last-Modified: Thu, 03 Jul 2014 05:07:20 GMT
Cache-Control: max-age=0, no-transform, proxy-revalidate
Content-Type: text/html; charset=utf-8
Date: Thu, 03 Jul 2014 05:07:21 GMT
Content-Length: 26815
Connection: keep-alive
Set-Cookie: _qz_referrer=; expires=Mon, 26 Jul 1997 05:00:00 GMT; PATH=/; DOMAIN=qq.com
<!DOCTYPE HTML><html lang="zh-cn" class="skin-dark pg-profile"><head><noscript><meta http-equiv="refresh" content="0; url=hXXp://os.qzs.qq.com/qzone/v6/troubleshooter/noscript.html" /></noscript><meta charset="UTF-8" /><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><title>............... [hXXp://453198928.qzone.qq.com]</title><meta name="keywords" content="QQ......,......,............,............,QQ......,QQ......" /><meta name="description" content="..................@......!MY name Chief A20140126pig" /><script type="text/javascript"> var g_domain = "qq.com"; document.domain=g_domain; var _s_=new Date(),g_T={},siDomain="os.qzonestyle.gtimg.cn",imgcacheDomain="os.qzs." g_domain,g_iUin=453198928,g_iLoginUin=0;g_T.fwp=[_s_];document.namespaces&&document.namespaces.add&&(document.namespaces.add('qz', 'hXXp://qzone.qq.com/'),document.namespaces.add('x', 'http://qzone.qq.com/'));</script> <link href="hXXp://os.qzonestyle.gtimg.cn/aoi/old-qz_qzone_lv.css" rel="stylesheet" /><link href="hXXp://os.qzonestyle.gtimg.cn/aoi/skin/31.css" rel="stylesheet"/><link href="hXXp://os.qzonestyle.gtimg.cn/aoi/profile.css" rel="stylesheet"/><style id="mainJSTitleBar" type="text/css">.layout-head-inner {height:190px;}</style><style type="text/css"></style><style type="text/css" id="dynamicStyle">.ownermode{display:none;}.clientmode{display:;}.editmode{display:none;
<<
<<< skipped >>>
GET / HTTP/1.1
User-Agent: test
Host: VVV.baidu.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 03 Jul 2014 05:07:17 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: Keep-Alive
Vary: Accept-Encoding
Set-Cookie: BAIDUID=4D18A2D2641742024364B1CA13A18B7B:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com
Set-Cookie: BDSVRTM=0; path=/
Set-Cookie: H_PS_PSSID=7430_1420_5223_6995_7442_6506_7232_6018_7202_7133_7390_6888; path=/; domain=.baidu.com
P3P: CP=" OTI DSP COR IVA OUR IND COM "
Cache-Control: private
Cxy_all: baidu ca7061de80364c977b16aa643d875919
Expires: Thu, 03 Jul 2014 05:06:25 GMT
X-Powered-By: HPHP
Server: BWS/1.1
BDPAGETYPE: 1
BDQID: 0xc3792b130001226d
BDUSERID: 0
d088..<!DOCTYPE html><!--STATUS OK--><html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><link rel="dns-prefetch" href="//s1.bdstatic.com"/><link rel="dns-prefetch" href="//t1.baidu.com"/><link rel="dns-prefetch" href="//t2.baidu.com"/><link rel="dns-prefetch" href="//t3.baidu.com"/><link rel="dns-prefetch" href="//t10.baidu.com"/><link rel="dns-prefetch" href="//t11.baidu.com"/><link rel="dns-prefetch" href="//t12.baidu.com"/><title>...........................</title><style index="index" >html,body{height:100%}html{overflow-y:auto}#wrapper{position:relative;_position:;min-height:100%}#content{padding-bottom:100px;text-align:center}#ftCon{height:100px;position:absolute;bottom:44px;text-align:center;width:100%;margin:0 auto;z-index:0;overflow:hidden}#ftConw{width:720px;margin:0 auto}body{font:12px arial;text-align:;background:#fff}body,p,form,ul,li{margin:0;padding:0;list-style:none}body,form,#fm{position:relative}td{text-align:left}img{border:0}a{color:#00c}a:active{color:#f60}.bg{background-image:url(hXXp://s1.bdstatic.com/r/www/cache/static/global/img/icons_e540198d.png);background-repeat:no-repeat;_background-image:url(hXXp://s1.bdstatic.com/r/www/cache/static/global/img/icons_d2618985.gif)}.bg_tuiguang_browser{width:16px;height:16px;background-position:-600px 0;display:inline-block;vertical-align:text-bottom;font-style:normal;overflow:
<<
<<< skipped >>>
GET / HTTP/1.1
User-Agent: test
Host: VVV.baidu.com
Cache-Control: no-cache
Cookie: BAIDUID=4D18A2D2641742024364B1CA13A18B7B:FG=1; H_PS_PSSID=7430_1420_5223_6995_7442_6506_7232_6018_7202_7133_7390_6888; BDSVRTM=0
HTTP/1.1 200 OK
Date: Thu, 03 Jul 2014 05:07:20 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: Keep-Alive
Vary: Accept-Encoding
Cache-Control: private
Cxy_all: baidu c46ee175679f5ed3a8513c6a769a1aa8
Expires: Thu, 03 Jul 2014 05:07:18 GMT
X-Powered-By: HPHP
Server: BWS/1.1
BDPAGETYPE: 1
BDQID: 0xa0da8ce50000fd0c
BDUSERID: 0
Set-Cookie: BDSVRTM=0; path=/
Set-Cookie: H_PS_PSSID=7430_1420_5223_6995_7442_6506_7232_6018_7202_7133_7390_6888; path=/; domain=.baidu.com
d07e..<!DOCTYPE html><!--STATUS OK--><html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><link rel="dns-prefetch" href="//s1.bdstatic.com"/><link rel="dns-prefetch" href="//t1.baidu.com"/><link rel="dns-prefetch" href="//t2.baidu.com"/><link rel="dns-prefetch" href="//t3.baidu.com"/><link rel="dns-prefetch" href="//t10.baidu.com"/><link rel="dns-prefetch" href="//t11.baidu.com"/><link rel="dns-prefetch" href="//t12.baidu.com"/><title>...........................</title><style index="index" >html,body{height:100%}html{overflow-y:auto}#wrapper{position:relative;_position:;min-height:100%}#content{padding-bottom:100px;text-align:center}#ftCon{height:100px;position:absolute;bottom:44px;text-align:center;width:100%;margin:0 auto;z-index:0;overflow:hidden}#ftConw{width:720px;margin:0 auto}body{font:12px arial;text-align:;background:#fff}body,p,form,ul,li{margin:0;padding:0;list-style:none}body,form,#fm{position:relative}td{text-align:left}img{border:0}a{color:#00c}a:active{color:#f60}.bg{background-image:url(hXXp://s1.bdstatic.com/r/www/cache/static/global/img/icons_e540198d.png);background-repeat:no-repeat;_background-image:url(hXXp://s1.bdstatic.com/r/www/cache/static/global/img/icons_d2618985.gif)}.bg_tuiguang_browser{width:16px;height:16px;background-position:-600px 0;display:inline-block;vertical-align:text-bottom;font-style:normal;overflow:
<<
<<< skipped >>>
GET /cgi-bin/index HTTP/1.1
Referer: hXXp://ip.qq.com/cgi-bin/index
Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Host: ip.qq.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 03 Jul 2014 05:07:27 GMT
Server: Apache/2.4.2 (Unix)
Cache-Control: max-age=0, must-revalidate
Set-Cookie: ipqqcom_user_id=121871; Domain=ip.qq.com; Expires=Fri, 04 Jul 2014 05:07:27 GMT; Path=/; HTTPOnly
Transfer-Encoding: chunked
Content-Type: text/html
f4c..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>.. <meta http-equiv="Content-Type" content="text/html; charset=gb2312" />.. <link rel="stylesheet" type="text/css" href="/css/global.css" />.. <link rel="stylesheet" type="text/css" href="/css/ip.css" />.. <link rel="stylesheet" href="/css/thickbox.css" type="text/css" media="screen" />.. <link href="/css/help.css" rel="stylesheet" type="text/css" />.. <title>IP............</title>.. <script language="JavaScript" type="text/javascript" src="/js/jquery.js"></script>.. <script language="JavaScript" type="text/javascript" src="/js/showlayer.js"></script>.. <script language="JavaScript" type="text/javascript" src="/js/iplist_thickbox.js"></script>.. <script language="JavaScript" type="text/javascript" src="/js/public.js"></script>.. <script language="JavaScript" type="text/javascript" src="/js/geo.js"></script>..</head>..<body onload="setup();Change_Hide_bak(1);login_in(0);status();preselect('');">..<div class="header">.. <div class="padder">.. <a class="logo" title="...." style="background-image:url(/img/logo.jpg); width: 300px; height: 72px;"> </a>.. <div class="links">.. <div class="outerLink">..
<<
<<< skipped >>>
GET /cgi-bin/index HTTP/1.1
Referer: hXXp://ip.qq.com/cgi-bin/index
Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Host: ip.qq.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 03 Jul 2014 05:07:27 GMT
Server: Apache/2.4.2 (Unix)
Cache-Control: max-age=0, must-revalidate
Set-Cookie: ipqqcom_user_id=651030; Domain=ip.qq.com; Expires=Fri, 04 Jul 2014 05:07:27 GMT; Path=/; HTTPOnly
Transfer-Encoding: chunked
Content-Type: text/html
f4c..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>.. <meta http-equiv="Content-Type" content="text/html; charset=gb2312" />.. <link rel="stylesheet" type="text/css" href="/css/global.css" />.. <link rel="stylesheet" type="text/css" href="/css/ip.css" />.. <link rel="stylesheet" href="/css/thickbox.css" type="text/css" media="screen" />.. <link href="/css/help.css" rel="stylesheet" type="text/css" />.. <title>IP............</title>.. <script language="JavaScript" type="text/javascript" src="/js/jquery.js"></script>.. <script language="JavaScript" type="text/javascript" src="/js/showlayer.js"></script>.. <script language="JavaScript" type="text/javascript" src="/js/iplist_thickbox.js"></script>.. <script language="JavaScript" type="text/javascript" src="/js/public.js"></script>.. <script language="JavaScript" type="text/javascript" src="/js/geo.js"></script>..</head>..<body onload="setup();Change_Hide_bak(1);login_in(0);status();preselect('');">..<div class="header">.. <div class="padder">.. <a class="logo" title="...." style="background-image:url(/img/logo.jpg); width: 300px; height: 72px;"> </a>.. <div class="links">.. <div class="outerLink">..
<<
<<< skipped >>>
GET / HTTP/1.1
User-Agent: test
Host: VVV.baidu.com
Cache-Control: no-cache
Cookie: BAIDUID=4D18A2D2641742024364B1CA13A18B7B:FG=1; H_PS_PSSID=7430_1420_5223_6995_7442_6506_7232_6018_7202_7133_7390_6888; BDSVRTM=0
HTTP/1.1 200 OK
Date: Thu, 03 Jul 2014 05:07:19 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: Keep-Alive
Vary: Accept-Encoding
Cache-Control: private
Cxy_all: baidu 618145d1d528fd6e8aede38cee489f69
Expires: Thu, 03 Jul 2014 05:06:24 GMT
X-Powered-By: HPHP
Server: BWS/1.1
BDPAGETYPE: 1
BDQID: 0xa3ea36ba0000a149
BDUSERID: 0
Set-Cookie: BDSVRTM=0; path=/
Set-Cookie: H_PS_PSSID=7430_1420_5223_6995_7442_6506_7232_6018_7202_7133_7390_6888; path=/; domain=.baidu.com
d06a..<!DOCTYPE html><!--STATUS OK--><html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><link rel="dns-prefetch" href="//s1.bdstatic.com"/><link rel="dns-prefetch" href="//t1.baidu.com"/><link rel="dns-prefetch" href="//t2.baidu.com"/><link rel="dns-prefetch" href="//t3.baidu.com"/><link rel="dns-prefetch" href="//t10.baidu.com"/><link rel="dns-prefetch" href="//t11.baidu.com"/><link rel="dns-prefetch" href="//t12.baidu.com"/><title>...........................</title><style index="index" >html,body{height:100%}html{overflow-y:auto}#wrapper{position:relative;_position:;min-height:100%}#content{padding-bottom:100px;text-align:center}#ftCon{height:100px;position:absolute;bottom:44px;text-align:center;width:100%;margin:0 auto;z-index:0;overflow:hidden}#ftConw{width:720px;margin:0 auto}body{font:12px arial;text-align:;background:#fff}body,p,form,ul,li{margin:0;padding:0;list-style:none}body,form,#fm{position:relative}td{text-align:left}img{border:0}a{color:#00c}a:active{color:#f60}.bg{background-image:url(hXXp://s1.bdstatic.com/r/www/cache/static/global/img/icons_e540198d.png);background-repeat:no-repeat;_background-image:url(hXXp://s1.bdstatic.com/r/www/cache/static/global/img/icons_d2618985.gif)}.bg_tuiguang_browser{width:16px;height:16px;background-position:-600px 0;display:inline-block;vertical-align:text-bottom;font-style:normal;overflow:
<<
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
DNFµ¶¿Í0606A.exe_344:
.itext
.itext
`.data
`.data
.idata
.idata
.rsrc
.rsrc
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
psapi.dll
psapi.dll
comdlg32.dll
comdlg32.dll
advapi32.dll
advapi32.dll
kernel32.dll
kernel32.dll
user32.dll
user32.dll
ntdll.dll
ntdll.dll
Kernel32.dll
Kernel32.dll
EnumWindows
EnumWindows
CreateWindowStationA
CreateWindowStationA
CloseWindowStation
CloseWindowStation
NtYieldExecution
NtYieldExecution
GetProcessHeap
GetProcessHeap
{A068799B-7551-46b9-8CA8-EEF8357AFEA4}
{A068799B-7551-46b9-8CA8-EEF8357AFEA4}
csrss.exe
csrss.exe
20140126
20140126
http://user.qzone.qq.com/453198928/blog/1344939460
http://user.qzone.qq.com/453198928/blog/1344939460
klekle.cccpan.com
klekle.cccpan.com
vmp.exe
vmp.exe
.rdata
.rdata
P.rsrc
P.rsrc
@.reloc
@.reloc
oleaut32.dll
oleaut32.dll
'Z6Sv.Qo#=_DNc]H<^E;]D:\C9XB7WA6V@5T>3Q=2P<1N:/N;/TA5bP?
'Z6Sv.Qo#=_DNc]H<^E;]D:\C9XB7WA6V@5T>3Q=2P<1N:/N;/TA5bP?
ugJ_O8L8,G4)D1)A0'5I](?g2Jt,Lo ;_LQgoTImSGlQEkPEfNBeMAcK?bJ>`H<`H<dM><pre>cP{_OuZLtYKqVHpUGDQf&@f3Ot.Kp'AeW^p</pre><pre>eUGWh(?c.Jo3Vp</pre><pre>gXGWh 6[.Ip.Pp</pre><pre>qaN[n';b.Jn-Lj#=`\at</pre><pre>vfMZm&<`.Ip(Mk</pre><pre>{kKZn!.[.Io&Ll</pre><pre>~pM^p$2b.Jo/Pk">aO[xxuvwww{~w~</pre><pre>>Rx;Nr7Lw;Uy9Uw4Ss2St4Rs4Qr4Rr4Qq*Bh.Eo:Vw9Su<Uy9Xx8Vw5Ps5Qs2Oq><pre>w.fwEd</pre><pre><%C^A</pre><pre>E\6-s}$</pre><pre>-cg}k</pre><pre>.rqDKq</pre><pre>2.mC3</pre><pre>GÝg</pre><pre>KeY/_EF</pre><pre>UWG.Ps 4</pre><pre>?T?A.QN</pre><pre>4.o %S</pre><pre>.ZRAF!`</pre><pre>T.EIg</pre><pre>..yW~</pre><pre>r.KoQ</pre><pre>KcP4%U/</pre><pre>%F-J}</pre><pre>J.Ndyp</pre><pre>.uI2Em</pre><pre>q.dzO</pre><pre>.Iür</pre><pre>_X.wc</pre><pre>C|P%Sv</pre><pre>3.zC/</pre><pre>.xsxD</pre><pre>.jYRR</pre><pre>[E%u{</pre><pre>x<.HBR</pre><pre>'N.mI</pre><pre>CK.fP</pre><pre>.MP>(</pre><pre>R.pb>*</pre><pre>P".py</pre><pre>.Yhoj</pre><pre>:.de6qn</pre><pre>Õ0p</pre><pre>]Q.Jw3</pre><pre>.PcqvyeO`</pre><pre>..YGN</pre><pre>.ZF J</pre><pre>.qnHr</pre><pre>d.tD/</pre><pre>hz.tK~</pre><pre>4>A%F</pre><pre>?e%u4</pre><pre>v.pLWS${</pre><pre>}$PLH%X</pre><pre>u)%SSP</pre><pre>".zF/</pre><pre>`q.rb4</pre><pre>St%s8</pre><pre>$r!u.AL</pre><pre><7%Xr</pre><pre>3.lwK</pre><pre>o.GJ}</pre><pre>.KF12</pre><pre>-4;.lE</pre><pre>yt%cr%</pre><pre>_.Hp,</pre><pre>| J>"%F</pre><pre>].xS3gfG:</pre><pre>.Bu' ]H</pre><pre>.Gigr</pre><pre>u$/.xY</pre><pre>.Mo}_p</pre><pre>.VCK3~</pre><pre>=X%9U</pre><pre>D%X]T</pre><pre>D.qZl</pre><pre>}q.Scc</pre><pre>fg|%s</pre><pre>Gl_</pre><pre>\svchost.vmp.exe</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>@.vmp0</pre><pre>`.vmp1</pre><pre>cS%dR</pre><pre>\ B>.vd,</pre><pre>%UY]Q/</pre><pre>%d=|4_</pre><pre>QW .LE</pre><pre>.DmHi</pre><pre>POz.iLc</pre><pre>X.RZ.</pre><pre>^%xx,8</pre><pre>N.RD(</pre><pre>(stf.RWF/o</pre><pre>.Ya_q</pre><pre>y@%fz</pre><pre>.roFD</pre><pre>q*.qP</pre><pre>KV.me</pre><pre>w'IY.kgA</pre><pre>rA.mv</pre><pre>%uXkJE</pre><pre>GDI32.dll</pre><pre>KERNEL32.dll</pre><pre>COMCTL32.dll</pre><pre>oledlg.dll</pre><pre>iJcomdlg32.dll</pre><pre>aKWINSPOOL.DRV</pre><pre>:Urld</pre><pre>.aX`L</pre><pre>bX .lQ</pre><pre>/a.Oy</pre><pre>-F}bV{6:</pre><pre>.BrJ3</pre><pre>anV%S</pre><pre>Jl.leB ,U</pre><pre>.BN!V</pre><pre>! .Fr'</pre><pre>j.mJ #</pre><pre>/U.qE"</pre><pre>WINMM.dll</pre><pre>WS2_32.dll</pre><pre>mWSHELL32.dll</pre><pre>h.FrP`</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>OLEAUT32.dll</pre><pre>yUSER32.dll</pre><pre>ShellExecuteA</pre><pre>5%%cG</pre><pre>YY.exe</pre><pre>ImProtocol.dll</pre><pre>winmm.dll</pre><pre>ws2_32.dll</pre><pre>WinINet.dll</pre><pre>gdi32.dll</pre><pre>GLU32.DLL</pre><pre>aclui.dll</pre><pre>acsmib.dll</pre><pre>activeds.dll</pre><pre>AcXtrnal.dll</pre><pre>adimage.dll</pre><pre>adptif.dll</pre><pre>ADVAPI32.DLL</pre><pre>advpack.dll</pre><pre>atl.dll</pre><pre>authz.dll</pre><pre>avicap32.dll</pre><pre>avifil32.dll</pre><pre>browseui.dll</pre><pre>CABINET.DLL</pre><pre>clusapi.dll</pre><pre>comctl32.dll</pre><pre>comsvcs.dll</pre><pre>crtdll.dll</pre><pre>crypt32.dll</pre><pre>cryptnet.dll</pre><pre>D3DRM.DLL</pre><pre>dbghelp.dll</pre><pre>ddraw.dll</pre><pre>DHCPCSVC.DLL</pre><pre>digest.dll</pre><pre>DINPUT.DLL</pre><pre>dplay.dll</pre><pre>dplayx.dll</pre><pre>dsound.dll</pre><pre>dsprop.dll</pre><pre>dsuiext.dll</pre><pre>ftsrch.dll</pre><pre>gpedit.dll</pre><pre>hhctrl.ocx</pre><pre>hlink.dll</pre><pre>iasperf.dll</pre><pre>icm32.dll</pre><pre>ICMP.DLL</pre><pre>icmui.dll</pre><pre>idq.dll</pre><pre>iedkcs32.dll</pre><pre>iissuba.dll</pre><pre>IMAGEHLP.DLL</pre><pre>imm32.dll</pre><pre>inetcpl.cpl</pre><pre>IPHLPAPI.DLL</pre><pre>iprop.dll</pre><pre>KSUSER.DLL</pre><pre>loadperf.dll</pre><pre>lz32.dll</pre><pre>mapi32.dll</pre><pre>mgmtapi.dll</pre><pre>MOBSYNC.DLL</pre><pre>mpg4dmod.dll</pre><pre>mpr.dll</pre><pre>mprapi.dll</pre><pre>mqrt.dll</pre><pre>msacm32.dll</pre><pre>msafd.dll</pre><pre>mscms.dll</pre><pre>mscpxl32.dLL</pre><pre>msgina.dll</pre><pre>MSHTML.DLL</pre><pre>MSI.DLL</pre><pre>msimg32.dll</pre><pre>msorcl32.dll</pre><pre>MSPATCHA.DLL</pre><pre>msrating.dll</pre><pre>mstlsapi.dll</pre><pre>msvbvm50.dll</pre><pre>msvfw32.dll</pre><pre>MSWSOCK.DLL</pre><pre>MTXDM.DLL</pre><pre>MTXOCI.DLL</pre><pre>NDDEAPI.DLL</pre><pre>ndisnpp.dll</pre><pre>netapi32.dll</pre><pre>npptools.dll</pre><pre>ntdsapi.dll</pre><pre>ntdsbcli.dll</pre><pre>ntmsapi.dll</pre><pre>nwprovau.dll</pre><pre>odbc32.dll</pre><pre>ODBCBCP.DLL</pre><pre>odbccp32.dll</pre><pre>ODBCTRAC.DLL</pre><pre>OLEACC.DLL</pre><pre>olecli32.dll</pre><pre>olesvr32.dll</pre><pre>opengl32.dll</pre><pre>password.cpl</pre><pre>pdh.dll</pre><pre>Powrprof.dll</pre><pre>qosname.dll</pre><pre>query.dll</pre><pre>rasapi32.dll</pre><pre>raschap.dll</pre><pre>rasdlg.dll</pre><pre>rasman.dll</pre><pre>rassapi.dll</pre><pre>rastls.dll</pre><pre>resutils.dll</pre><pre>RICHED20.DLL</pre><pre>rpcns4.dll</pre><pre>rpcrt4.dll</pre><pre>RSRC32.dll</pre><pre>rtm.dll</pre><pre>rtutils.dll</pre><pre>scarddlg.dll</pre><pre>secur32.dll</pre><pre>SENSAPI.DLL</pre><pre>setupapi.dll</pre><pre>SFC.DLL</pre><pre>shdocvw.dll</pre><pre>shell32.dll</pre><pre>shlwapi.dll</pre><pre>snmpapi.dll</pre><pre>softpub.dll</pre><pre>spoolss.dll</pre><pre>SVRAPI.DLL</pre><pre>tapi32.dll</pre><pre>TLBINF32.dll</pre><pre>traffic.dll</pre><pre>url.dll</pre><pre>URLMON.DLL</pre><pre>userenv.dll</pre><pre>USP10.DLL</pre><pre>uxtheme.dll</pre><pre>VB5STKIT.DLL</pre><pre>vba6.dll</pre><pre>VDMDBG.DLL</pre><pre>version.dll</pre><pre>winfax.dll</pre><pre>wininet.dll</pre><pre>winscard.dll</pre><pre>winspool.dll</pre><pre>winspool.drv</pre><pre>wintrust.dll</pre><pre>wldap32.dll</pre><pre>WOW32.DLL</pre><pre>wsnmp32.dll</pre><pre>wtsapi32.dll</pre><pre>xolehlp.dll</pre><pre>cmd.exe /c del</pre><pre>ActivateKeyboardLayout</pre><pre>ArrangeIconicWindows</pre><pre>CallMsgFilter</pre><pre>CallMsgFilterA</pre><pre>CallMsgFilterW</pre><pre>CascadeChildWindows</pre><pre>CascadeWindows</pre><pre>CliImmSetHotKey</pre><pre>CreateDialogIndirectParamA</pre><pre>CreateDialogIndirectParamAorW</pre><pre>CreateDialogIndirectParamW</pre><pre>CreateWindowStationW</pre><pre>DisableProcessWindowsGhosting</pre><pre>DisplayExitWindowsWarnings</pre><pre>EnumChildWindows</pre><pre>EnumDesktopWindows</pre><pre>EnumThreadWindows</pre><pre>EnumWindowStationsA</pre><pre>EnumWindowStationsW</pre><pre>ExitWindowsEx</pre><pre>GetAsyncKeyState</pre><pre>GetKeyNameTextA</pre><pre>GetKeyNameTextW</pre><pre>GetKeyState</pre><pre>GetKeyboardLayout</pre><pre>GetKeyboardLayoutList</pre><pre>GetKeyboardLayoutNameA</pre><pre>GetKeyboardLayoutNameW</pre><pre>GetKeyboardState</pre><pre>GetKeyboardType</pre><pre>GetProcessWindowStation</pre><pre>LoadKeyboardLayoutA</pre><pre>LoadKeyboardLayoutEx</pre><pre>LoadKeyboardLayoutW</pre><pre>LockWindowStation</pre><pre>MapVirtualKeyA</pre><pre>MapVirtualKeyExA</pre><pre>MapVirtualKeyExW</pre><pre>MapVirtualKeyW</pre><pre>MsgWaitForMultipleObjects</pre><pre>MsgWaitForMultipleObjectsEx</pre><pre>OemKeyScan</pre><pre>OpenWindowStationA</pre><pre>OpenWindowStationW</pre><pre>RegisterErrorReportingDialog</pre><pre>RegisterHotKey</pre><pre>RegisterSessionPort</pre><pre>SetKeyboardState</pre><pre>SetProcessWindowStation</pre><pre>SetWindowStationUser</pre><pre>SetWindowsHookA</pre><pre>SetWindowsHookExA</pre><pre>SetWindowsHookExW</pre><pre>SetWindowsHookW</pre><pre>SfmDxReportPendingBindingsToDwm</pre><pre>TileChildWindows</pre><pre>TileWindows</pre><pre>UnhookWindowsHook</pre><pre>UnhookWindowsHookEx</pre><pre>UnloadKeyboardLayout</pre><pre>UnlockWindowStation</pre><pre>UnregisterHotKey</pre><pre>UnregisterSessionPort</pre><pre>VkKeyScanA</pre><pre>VkKeyScanExA</pre><pre>VkKeyScanExW</pre><pre>VkKeyScanW</pre><pre>WINNLSGetIMEHotkey</pre><pre>keybd_event</pre><pre>BaseCleanupAppcompatCacheSupport</pre><pre>BaseInitAppcompatCacheSupport</pre><pre>CallNamedPipeA</pre><pre>CallNamedPipeW</pre><pre>CmdBatNotification</pre><pre>ConnectNamedPipe</pre><pre>CreateIoCompletionPort</pre><pre>CreateMutexExA</pre><pre>CreateMutexExW</pre><pre>CreateNamedPipeA</pre><pre>CreateNamedPipeW</pre><pre>CreatePipe</pre><pre>DisconnectNamedPipe</pre><pre>EnumCalendarInfoExEx</pre><pre>EnumDateFormatsExEx</pre><pre>GetCPInfo</pre><pre>GetCPInfoExA</pre><pre>GetCPInfoExW</pre><pre>GetCalendarSupportedDateRange</pre><pre>GetConsoleAliasExesA</pre><pre>GetConsoleAliasExesLengthA</pre><pre>GetConsoleAliasExesLengthW</pre><pre>GetConsoleAliasExesW</pre><pre>GetConsoleInputExeNameA</pre><pre>GetConsoleInputExeNameW</pre><pre>GetConsoleKeyboardLayoutNameA</pre><pre>GetConsoleKeyboardLayoutNameW</pre><pre>GetConsoleOutputCP</pre><pre>GetLargestConsoleWindowSize</pre><pre>GetNamedPipeAttribute</pre><pre>GetNamedPipeClientComputerNameA</pre><pre>GetNamedPipeClientComputerNameW</pre><pre>GetNamedPipeClientProcessId</pre><pre>GetNamedPipeClientSessionId</pre><pre>GetNamedPipeHandleStateA</pre><pre>GetNamedPipeHandleStateW</pre><pre>GetNamedPipeInfo</pre><pre>GetNamedPipeServerProcessId</pre><pre>GetNamedPipeServerSessionId</pre><pre>GetProcessHandleCount</pre><pre>GetProcessHeaps</pre><pre>GetProcessShutdownParameters</pre><pre>GetSystemWindowsDirectoryA</pre><pre>GetSystemWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>GetWindowsDirectoryW</pre><pre>InitOnceExecuteOnce</pre><pre>NeedCurrentDirectoryForExePathA</pre><pre>NeedCurrentDirectoryForExePathW</pre><pre>PeekNamedPipe</pre><pre>RegCloseKey</pre><pre>RegCreateKeyExA</pre><pre>RegCreateKeyExW</pre><pre>RegDeleteKeyExA</pre><pre>RegDeleteKeyExW</pre><pre>RegEnumKeyExA</pre><pre>RegEnumKeyExW</pre><pre>RegFlushKey</pre><pre>RegGetKeySecurity</pre><pre>RegLoadKeyA</pre><pre>RegLoadKeyW</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>RegOpenKeyExW</pre><pre>RegQueryInfoKeyA</pre><pre>RegQueryInfoKeyW</pre><pre>RegRestoreKeyA</pre><pre>RegRestoreKeyW</pre><pre>RegSaveKeyExA</pre><pre>RegSaveKeyExW</pre><pre>RegSetKeySecurity</pre><pre>RegUnLoadKeyA</pre><pre>RegUnLoadKeyW</pre><pre>RegisterWowExec</pre><pre>SetConsoleInputExeNameA</pre><pre>SetConsoleInputExeNameW</pre><pre>SetConsoleKeyShortcuts</pre><pre>SetConsoleMaximumWindowSize</pre><pre>SetConsoleOutputCP</pre><pre>SetNamedPipeAttribute</pre><pre>SetNamedPipeHandleState</pre><pre>SetProcessShutdownParameters</pre><pre>SetThreadExecutionState</pre><pre>TransactNamedPipe</pre><pre>VDMConsoleOperation</pre><pre>VDMOperationStarted</pre><pre>WaitNamedPipeA</pre><pre>WaitNamedPipeW</pre><pre>WinExec</pre><pre>EtwpGetCpuSpeed</pre><pre>EvtIntReportAuthzEventAndSourceAsync</pre><pre>EvtIntReportEventAndSourceAsync</pre><pre>LdrOpenImageFileOptionsKey</pre><pre>LdrQueryImageFileExecutionOptions</pre><pre>LdrQueryImageFileExecutionOptionsEx</pre><pre>LdrQueryImageFileKeyOption</pre><pre>NtAcceptConnectPort</pre><pre>NtAlpcAcceptConnectPort</pre><pre>NtAlpcConnectPort</pre><pre>NtAlpcCreatePort</pre><pre>NtAlpcCreatePortSection</pre><pre>NtAlpcDeletePortSection</pre><pre>NtAlpcDisconnectPort</pre><pre>NtAlpcImpersonateClientOfPort</pre><pre>NtAlpcSendWaitReceivePort</pre><pre>NtCompactKeys</pre><pre>NtCompleteConnectPort</pre><pre>NtCompressKey</pre><pre>NtConnectPort</pre><pre>NtCreateKey</pre><pre>NtCreateKeyTransacted</pre><pre>NtCreateKeyedEvent</pre><pre>NtCreateNamedPipeFile</pre><pre>NtCreatePort</pre><pre>NtCreateWaitablePort</pre><pre>NtDelayExecution</pre><pre>NtDeleteKey</pre><pre>NtDeleteValueKey</pre><pre>NtEnumerateKey</pre><pre>NtEnumerateValueKey</pre><pre>NtFlushKey</pre><pre>NtImpersonateClientOfPort</pre><pre>NtListenPort</pre><pre>NtLoadKey</pre><pre>NtLoadKey2</pre><pre>NtLoadKeyEx</pre><pre>NtLockProductActivationKeys</pre><pre>NtLockRegistryKey</pre><pre>NtNotifyChangeKey</pre><pre>NtNotifyChangeMultipleKeys</pre><pre>NtOpenKey</pre><pre>NtOpenKeyEx</pre><pre>NtOpenKeyTransacted</pre><pre>NtOpenKeyTransactedEx</pre><pre>NtOpenKeyedEvent</pre><pre>NtQueryInformationPort</pre><pre>NtQueryKey</pre><pre>NtQueryMultipleValueKey</pre><pre>NtQueryOpenSubKeys</pre><pre>NtQueryOpenSubKeysEx</pre><pre>NtQueryPortInformationProcess</pre><pre>NtQueryValueKey</pre><pre>NtRegisterThreadTerminatePort</pre><pre>NtReleaseKeyedEvent</pre><pre>NtRenameKey</pre><pre>NtReplaceKey</pre><pre>NtReplyPort</pre><pre>NtReplyWaitReceivePort</pre><pre>NtReplyWaitReceivePortEx</pre><pre>NtReplyWaitReplyPort</pre><pre>NtRequestPort</pre><pre>NtRequestWaitReplyPort</pre><pre>NtRestoreKey</pre><pre>NtSaveKey</pre><pre>NtSaveKeyEx</pre><pre>NtSaveMergedKeys</pre><pre>NtSecureConnectPort</pre><pre>NtSetDefaultHardErrorPort</pre><pre>NtSetInformationKey</pre><pre>NtSetThreadExecutionState</pre><pre>NtSetValueKey</pre><pre>NtUnloadKey</pre><pre>NtUnloadKey2</pre><pre>NtUnloadKeyEx</pre><pre>NtWaitForKeyedEvent</pre><pre>RtlCheckRegistryKey</pre><pre>RtlCmDecodeMemIoResource</pre><pre>RtlComputeImportTableHash</pre><pre>RtlCreateRegistryKey</pre><pre>RtlEnumProcessHeaps</pre><pre>RtlExecuteUmsThread</pre><pre>RtlFormatCurrentUserKeyPath</pre><pre>RtlGetProcessHeaps</pre><pre>RtlIsCurrentThreadAttachExempt</pre><pre>RtlQueryProcessHeapInformation</pre><pre>RtlReportException</pre><pre>RtlReportSilentProcessExit</pre><pre>RtlReportSqmEscalation</pre><pre>RtlRunOnceExecuteOnce</pre><pre>RtlSendMsgToSm</pre><pre>RtlValidateProcessHeaps</pre><pre>RtlWerpReportException</pre><pre>RtlpCleanupRegistryKeys</pre><pre>RtlpExecuteUmsThread</pre><pre>RtlpNtCreateKey</pre><pre>RtlpNtEnumerateSubKey</pre><pre>RtlpNtMakeTemporaryKey</pre><pre>RtlpNtOpenKey</pre><pre>RtlpNtQueryValueKey</pre><pre>RtlpNtSetValueKey</pre><pre>RtlpUmsExecuteYieldThreadEnd</pre><pre>SbExecuteProcedure</pre><pre>ShipAssert</pre><pre>ShipAssertGetBufferInfo</pre><pre>ShipAssertMsgA</pre><pre>ShipAssertMsgW</pre><pre>TpCancelAsyncIoOperation</pre><pre>TpStartAsyncIoOperation</pre><pre>WerReportSQMEvent</pre><pre>ZwAcceptConnectPort</pre><pre>ZwAlpcAcceptConnectPort</pre><pre>ZwAlpcConnectPort</pre><pre>ZwAlpcCreatePort</pre><pre>ZwAlpcCreatePortSection</pre><pre>ZwAlpcDeletePortSection</pre><pre>ZwAlpcDisconnectPort</pre><pre>ZwAlpcImpersonateClientOfPort</pre><pre>ZwAlpcSendWaitReceivePort</pre><pre>ZwCompactKeys</pre><pre>ZwCompleteConnectPort</pre><pre>ZwCompressKey</pre><pre>ZwConnectPort</pre><pre>ZwCreateKey</pre><pre>ZwCreateKeyTransacted</pre><pre>ZwCreateKeyedEvent</pre><pre>ZwCreateNamedPipeFile</pre><pre>ZwCreatePort</pre><pre>ZwCreateWaitablePort</pre><pre>ZwDelayExecution</pre><pre>ZwDeleteKey</pre><pre>ZwDeleteValueKey</pre><pre>ZwEnumerateKey</pre><pre>ZwEnumerateValueKey</pre><pre>ZwFlushKey</pre><pre>ZwImpersonateClientOfPort</pre><pre>ZwListenPort</pre><pre>ZwLoadKey</pre><pre>ZwLoadKey2</pre><pre>ZwLoadKeyEx</pre><pre>ZwLockProductActivationKeys</pre><pre>ZwLockRegistryKey</pre><pre>ZwNotifyChangeKey</pre><pre>ZwNotifyChangeMultipleKeys</pre><pre>ZwOpenKey</pre><pre>ZwOpenKeyEx</pre><pre>ZwOpenKeyTransacted</pre><pre>ZwOpenKeyTransactedEx</pre><pre>ZwOpenKeyedEvent</pre><pre>ZwQueryInformationPort</pre><pre>ZwQueryKey</pre><pre>ZwQueryMultipleValueKey</pre><pre>ZwQueryOpenSubKeys</pre><pre>ZwQueryOpenSubKeysEx</pre><pre>ZwQueryPortInformationProcess</pre><pre>ZwQueryValueKey</pre><pre>ZwRegisterThreadTerminatePort</pre><pre>ZwReleaseKeyedEvent</pre><pre>ZwRenameKey</pre><pre>ZwReplaceKey</pre><pre>ZwReplyPort</pre><pre>ZwReplyWaitReceivePort</pre><pre>ZwReplyWaitReceivePortEx</pre><pre>ZwReplyWaitReplyPort</pre><pre>ZwRequestPort</pre><pre>ZwRequestWaitReplyPort</pre><pre>ZwRestoreKey</pre><pre>ZwSaveKey</pre><pre>ZwSaveKeyEx</pre><pre>ZwSaveMergedKeys</pre><pre>ZwSecureConnectPort</pre><pre>ZwSetDefaultHardErrorPort</pre><pre>ZwSetInformationKey</pre><pre>ZwSetThreadExecutionState</pre><pre>ZwSetValueKey</pre><pre>ZwUnloadKey</pre><pre>ZwUnloadKey2</pre><pre>ZwUnloadKeyEx</pre><pre>ZwWaitForKeyedEvent</pre><pre>ZwYieldExecution</pre><pre>D3DKMTAcquireKeyedMutex</pre><pre>D3DKMTCreateKeyedMutex</pre><pre>D3DKMTDestroyKeyedMutex</pre><pre>D3DKMTOpenKeyedMutex</pre><pre>D3DKMTReleaseKeyedMutex</pre><pre>DDCCIGetTimingReport</pre><pre>GetCertificate</pre><pre>GetCertificateSize</pre><pre>GetViewportExtEx</pre><pre>GetViewportOrgEx</pre><pre>OffsetViewportOrgEx</pre><pre>ScaleViewportExtEx</pre><pre>SetOPMSigningKeyAndSequenceNumbers</pre><pre>SetViewportExtEx</pre><pre>SetViewportOrgEx</pre><pre>UpdateICMRegKeyA</pre><pre>UpdateICMRegKeyW</pre><pre>CryptDeriveKey</pre><pre>CryptDestroyKey</pre><pre>CryptDuplicateKey</pre><pre>CryptExportKey</pre><pre>CryptGenKey</pre><pre>CryptGetKeyParam</pre><pre>CryptGetUserKey</pre><pre>CryptHashSessionKey</pre><pre>CryptImportKey</pre><pre>CryptSetKeyParam</pre><pre>ElfReportEventA</pre><pre>ElfReportEventAndSourceW</pre><pre>ElfReportEventW</pre><pre>EncryptedFileKeyInfo</pre><pre>FreeEncryptedFileKeyInfo</pre><pre>FreeEncryptionCertificateHashList</pre><pre>GetEventLogInformation</pre><pre>GetMultipleTrusteeOperationA</pre><pre>GetMultipleTrusteeOperationW</pre><pre>GetServiceKeyNameA</pre><pre>GetServiceKeyNameW</pre><pre>GetWindowsAccountDomainSid</pre><pre>ImpersonateNamedPipeClient</pre><pre>LogonUserExExW</pre><pre>MSChapSrvChangePassword</pre><pre>MSChapSrvChangePassword2</pre><pre>RegCreateKeyA</pre><pre>RegCreateKeyTransactedA</pre><pre>RegCreateKeyTransactedW</pre><pre>RegCreateKeyW</pre><pre>RegDeleteKeyA</pre><pre>RegDeleteKeyTransactedA</pre><pre>RegDeleteKeyTransactedW</pre><pre>RegDeleteKeyValueA</pre><pre>RegDeleteKeyValueW</pre><pre>RegDeleteKeyW</pre><pre>RegDisableReflectionKey</pre><pre>RegEnableReflectionKey</pre><pre>RegEnumKeyA</pre><pre>RegEnumKeyW</pre><pre>RegLoadAppKeyA</pre><pre>RegLoadAppKeyW</pre><pre>RegOpenKeyA</pre><pre>RegOpenKeyTransactedA</pre><pre>RegOpenKeyTransactedW</pre><pre>RegOpenKeyW</pre><pre>RegOverridePredefKey</pre><pre>RegQueryReflectionKey</pre><pre>RegRenameKey</pre><pre>RegReplaceKeyA</pre><pre>RegReplaceKeyW</pre><pre>RegSaveKeyA</pre><pre>RegSaveKeyW</pre><pre>RegSetKeyValueA</pre><pre>RegSetKeyValueW</pre><pre>ReportEventA</pre><pre>ReportEventW</pre><pre>SaferiIsExecutableFileType</pre><pre>SetUserFileEncryptionKey</pre><pre>SetUserFileEncryptionKeyEx</pre><pre>WmiExecuteMethodA</pre><pre>WmiExecuteMethodW</pre><pre>F%*.*f</pre><pre>CNotSupportedException</pre><pre>commctrl_DragListMsg</pre><pre>Afx:%x:%x:%x:%x:%x</pre><pre>Afx:%x:%x</pre><pre>COMCTL32.DLL</pre><pre>CCmdTarget</pre><pre>__MSVCRT_HEAP_SELECT</pre><pre>iphlpapi.dll</pre><pre>SHLWAPI.dll</pre><pre>MPR.dll</pre><pre>VERSION.dll</pre><pre>WSOCK32.dll</pre><pre>.PAVCException@@</pre><pre>.PAVCNotSupportedException@@</pre><pre>.PAVCFileException@@</pre><pre>(*.prn)|*.prn|</pre><pre>(*.*)|*.*||</pre><pre>Shell32.dll</pre><pre>Mpr.dll</pre><pre>Advapi32.dll</pre><pre>User32.dll</pre><pre>Gdi32.dll</pre><pre>(&07-034/)7 '</pre><pre>?? / %d]</pre><pre>%d / %d]</pre><pre>: %d]</pre><pre>(*.WAV;*.MID)|*.WAV;*.MID|WAV</pre><pre>(*.WAV)|*.WAV|MIDI</pre><pre>(*.MID)|*.MID|</pre><pre>(*.txt)|*.txt|</pre><pre>(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG</pre><pre>(*.JPG)|*.JPG|BMP</pre><pre>(*.BMP)|*.BMP|GIF</pre><pre>(*.GIF)|*.GIF|</pre><pre>(*.ICO)|*.ICO|</pre><pre>(*.CUR)|*.CUR|</pre><pre>%s:%d</pre><pre>windows</pre><pre>out.prn</pre><pre>%d.%d</pre><pre>%d / %d</pre><pre>%d/%d</pre><pre>Bogus message code %d</pre><pre>(%d-%d):</pre><pre>%ld%c</pre><pre>1.1.3</pre><pre>;3 #>6.&</pre><pre>'2, / 0&7!4-)1#</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)</pre><pre>HTTP/1.0</pre><pre>%s <%s></pre><pre>Reply-To: %s</pre><pre>From: %s</pre><pre>To: %s</pre><pre>Subject: %s</pre><pre>Date: %s</pre><pre>Cc: %s</pre><pre>%a, %d %b %Y %H:%M:%S</pre><pre>SMTP</pre><pre>http://www.baidu.com</pre><pre>%d%d%d</pre><pre>rundll32.exe shell32.dll,</pre><pre>.PAVCObject@@</pre><pre>.PAVCSimpleException@@</pre><pre>.PAVCMemoryException@@</pre><pre>.?AVCNotSupportedException@@</pre><pre>.PAVCResourceException@@</pre><pre>.PAVCUserException@@</pre><pre>.?AVCCmdTarget@@</pre><pre>.?AVCCmdUI@@</pre><pre>.?AVCTestCmdUI@@</pre><pre>.PAVCArchiveException@@</pre><pre>zcÁ</pre><pre>right-curly-bracket</pre><pre>left-curly-bracket</pre><pre>0123456789</pre><pre>SVCHOST06.EXE</pre><pre>C.EXE</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\DNF</pre><pre>0606A.exe</pre><pre>%xbN4</pre><pre>JfRp%X</pre><pre>t.Ht2Ht6Ht:Ht></pre><pre>F&{00000000-0000-0000-C000-000000000046}</pre><pre>3This binary has no widestrings support compiled in.</pre><pre>6This binary has no unicodestrings support compiled in.</pre><pre>ENoThreadSupport</pre><pre>ENoWideStringSupport</pre><pre>=?&{7B108C52-1D8F-4CDB-9CDF-57E071193D3F}$TMultiReadExclusiveWriteSynchronizer</pre><pre>ENoThreadSupportt</pre><pre>&{3FEEC8E1-E400-4A24-BCAC-1F01476439B1}</pre><pre>.Owner</pre><pre>1.2.5</pre><pre>sysconst.sabstracterror</pre><pre>sysconst.saccessdenied</pre><pre>sysconst.saccessviolation</pre><pre>Missing argument in format "%s"</pre><pre>sysconst.sargumentmissing</pre><pre>%s (%s, line %d)</pre><pre>sysconst.sasserterror</pre><pre>sysconst.sassertionfailed</pre><pre>sysconst.sbuserror</pre><pre>sysconst.scontrolc</pre><pre>sysconst.sdiskfull</pre><pre>sysconst.sdispatcherror</pre><pre>sysconst.sdivbyzero</pre><pre>sysconst.sendoffile</pre><pre>External exception %x</pre><pre>sysconst.sexternalexception</pre><pre>sysconst.sfilenotassigned</pre><pre>sysconst.sfilenotfound</pre><pre>sysconst.sfilenotopen</pre><pre>sysconst.sfilenotopenforinput</pre><pre>sysconst.sfilenotopenforoutput</pre><pre>sysconst.sinvalidfilename</pre><pre>sysconst.sintoverflow</pre><pre>Interface not supported</pre><pre>sysconst.sintfcasterror</pre><pre>Invalid argument index in format "%s"</pre><pre>sysconst.sinvalidargindex</pre><pre>sysconst.sinvalidcast</pre><pre>sysconst.sinvaliddrive</pre><pre>sysconst.sinvalidfilehandle</pre><pre>Invalid format specifier : "%s"</pre><pre>sysconst.sinvalidformat</pre><pre>sysconst.sinvalidinput</pre><pre>Invalid floating point operation</pre><pre>sysconst.sinvalidop</pre><pre>Invalid pointer operation</pre><pre>sysconst.sinvalidpointer</pre><pre>sysconst.sinvalidvarcast</pre><pre>Invalid variant operation</pre><pre>sysconst.sinvalidvarop</pre><pre>Threads not supported. Recompile program with thread driver.</pre><pre>sysconst.snothreadsupport</pre><pre>sysconst.smissingwstringmanager</pre><pre>sysconst.ssigquit</pre><pre>System error, (OS Code %d):</pre><pre>sysconst.soserror</pre><pre>sysconst.soutofmemory</pre><pre>sysconst.soverflow</pre><pre>sysconst.sprivilege</pre><pre>sysconst.srangeerror</pre><pre>sysconst.ssafecallexception</pre><pre>sysconst.siconverror</pre><pre>sysconst.stoomanyopenfiles</pre><pre>sysconst.sunknownruntimeerror</pre><pre>sysconst.sunderflow</pre><pre>An operating system call failed.</pre><pre>sysconst.sunkoserror</pre><pre>sysconst.svararraybounds</pre><pre>sysconst.svararraycreate</pre><pre>sysconst.svarnotarray</pre><pre>Ancestor class for "%s" not found.</pre><pre>rtlconsts.sancestornotfound</pre><pre>Cannot assign a %s to a %s.</pre><pre>rtlconsts.sassignerror</pre><pre>Class "%s" not found</pre><pre>rtlconsts.sclassnotfound</pre><pre>Duplicate name: A component named "%s" already exists</pre><pre>rtlconsts.sduplicatename</pre><pre>rtlconsts.sduplicatestring</pre><pre>rtlconsts.semptystreamillegalreader</pre><pre>rtlconsts.semptystreamillegalwriter</pre><pre>No variant support for properties. Please use the variants unit in your project and recompile</pre><pre>rtlconsts.serrnovariantsupport</pre><pre>Unable to create file "%s"</pre><pre>rtlconsts.sfcreateerror</pre><pre>Unable to open file "%s"</pre><pre>rtlconsts.sfopenerror</pre><pre>rtlconsts.sinvalidimage</pre><pre>"%s" is not a valid component name</pre><pre>rtlconsts.sinvalidname</pre><pre>rtlconsts.sinvalidpropertypath</pre><pre>rtlconsts.sinvalidpropertyvalue</pre><pre>List capacity (%d) exceeded.</pre><pre>rtlconsts.slistcapacityerror</pre><pre>List count (%d) out of bounds.</pre><pre>rtlconsts.slistcounterror</pre><pre>List index (%d) out of bounds</pre><pre>rtlconsts.slistindexerror</pre><pre>rtlconsts.smemorystreamerror</pre><pre>Error reading %s%s%s: %s</pre><pre>rtlconsts.spropertyexception</pre><pre>rtlconsts.sreaderror</pre><pre>rtlconsts.sreadonlyproperty</pre><pre>Resource "%s" not found</pre><pre>rtlconsts.sresnotfound</pre><pre>%s.Seek not implemented</pre><pre>rtlconsts.sseeknotimplemented</pre><pre>Operation not allowed on sorted list</pre><pre>rtlconsts.ssortedlisterror</pre><pre>Reading from %s is not supported</pre><pre>rtlconsts.sstreamnoreading</pre><pre>Writing to %s is not supported</pre><pre>rtlconsts.sstreamnowriting</pre><pre>Unknown property: "%s"</pre><pre>rtlconsts.sunknownproperty</pre><pre>Unknown property type %d</pre><pre>rtlconsts.sunknownpropertytype</pre><pre>Unsupported property variant type %d</pre><pre>rtlconsts.sunsupportedpropertyvarianttype</pre><pre>rtlconsts.swriteerror</pre><pre>inflate 1.2.5 Copyright 1995-2010 Mark Adler</pre><pre>ShellExecuteW</pre><pre>ay7|</pre><pre>.CN:?</pre><pre>b..cHp</pre><pre>%S ^ip</pre><pre>^V .Hy</pre><pre>F{.VFG</pre><pre>UZ.IQ</pre><pre>'.gOd^</pre><pre>P.Cl]</pre><pre>S%s(1P</pre><pre>bj</pre><pre>k5XO.JQ</pre><pre>XGm.fV</pre><pre>'.ARV/</pre><pre>|.LSK;</pre><pre>Y.er7e$</pre><pre>JI.SU</pre><pre>(uRLw</pre><pre>R#.Oy\</pre><pre>.NT%w</pre><pre>XÛCE</pre><pre>Xf.dJ</pre><pre>HV.Lq?</pre><pre>f4S%X</pre><pre>.nb6Df</pre><pre>*<=%sMD></pre><pre>GLWaL%F</pre><pre>tb)*.rh</pre><pre>fQo.vq</pre><pre>%u5[ir</pre><pre>v.ygt2f</pre><pre>4T==H,%x</pre><pre>zK.ax\</pre><pre>%8u#k</pre><pre>^RA[-:N%d:</pre><pre>N]ø</pre><pre>%.mPG</pre><pre>A`.cK-</pre><pre>IXMY%.F</pre><pre>.cZ 4</pre><pre>w$.Ne|</pre><pre>I/dz%C</pre><pre>]722=3>`5,</pre><pre>@h.Ze</pre><pre>s\.qYS</pre><pre>k:\V;</pre><pre>[W.oj</pre><pre>x.pq53_N</pre><pre>z.Wd1*</pre><pre>)[1%cu:Mm1</pre><pre>#I.ra</pre><pre>d:\8@</pre><pre>P.VLe</pre><pre>k<.zV</pre><pre>0?h%S</pre><pre>.yGY??</pre><pre>]5.GDA</pre><pre>cVßu</pre><pre>.Xj#,</pre><pre>0.wMK</pre><pre>, q.Po</pre><pre>No|%C</pre><pre>2:e(.ij</pre><pre>u!.HV</pre><pre>.EN &</pre><pre>O.slg7`</pre><pre>;Y%u^T</pre><pre>Q\K%u%</pre><pre>0:hAazH%C</pre><pre>H.pAl</pre><pre>V4%3U</pre><pre>X#.lm</pre><pre>%Fuj,</pre><pre>'oo39.nY</pre><pre>[vB%s</pre><pre>X5/.ca</pre><pre>}w%ci</pre><pre>^gGTÍV.]}</pre><pre>qPZ%S</pre><pre>\0%Cs</pre><pre>.yM^7</pre><pre>-:.UWzy"</pre><pre>$.YB-%</pre><pre>i.YRL</pre><pre>.sC'7i=</pre><pre>"Ud%X</pre><pre>~.mE </pre><pre>X.jK]un</pre><pre>=nk%C</pre><pre>.Oy-^</pre><pre>O 8%F</pre><pre>%R.qFi</pre><pre>Y.ZBT</pre><pre>D.RMQ</pre><pre>.jb9._V</pre><pre>=^d%u</pre><pre>ghR%CSld</pre><pre>%$%Sc</pre><pre>.VW1[</pre><pre>.SVtl</pre><pre>P.hW!</pre><pre>hs.nP</pre><pre>_dc.Om</pre><pre>v%S_G</pre><pre>/m|%f</pre><pre>.lq$;</pre><pre><kv><pre>LUj.BD</pre><pre>>4\.EQ|</pre><pre>u%DSeu</pre><pre>&{.XRn</pre><pre>o%U(!</pre><pre>J<%UEwb</pre><pre>-7SVH}L</pre><pre>:_.ZN</pre><pre>%dN{S</pre><pre>X/-K}</pre><pre>#%f`%</pre><pre>YK.OYr'</pre><pre>.UhM'</pre><pre>-:.Fe</pre><pre>l#%cxk$,</pre><pre>~D,%u7</pre><pre>.ovQ@</pre><pre>LUrl</pre><pre>.jaB?</pre><pre>%Ck]V</pre><pre>_26.Gr</pre><pre>'Dv.FK</pre><pre>TE%CU1.</pre><pre>%XnG]</pre><pre>N.R%.d?</pre><pre>x.WD;*</pre><pre>( .qQ</pre><pre>#SU.EX</pre><pre>&%U(fD</pre><pre>-n}}a7</pre><pre>;`D~.fW</pre><pre>MEXe</pre><pre>uRC%x</pre><pre>|.Rufu1</pre><pre>.iyC;</pre><pre>c%f)GY</pre><pre>.OZ<DZ><pre>%.DC_</pre><pre>B%7sH</pre><pre>.cF9|</pre><pre>El.Mk</pre><pre>!<.kQC</pre><pre>%x(gM</pre><pre>W=R%3U</pre><pre>&K.HN@</pre><pre>"4.BY r</pre><pre>R.MW0</pre><pre>X.Fo/L</pre><pre>R|.hX</pre><pre><'<.OAm\</pre><pre>OyÝX</pre><pre>USER32.DLL</pre><pre>|GDI32.dll</pre><pre>WINSPOOL.DRV</pre><pre>OLEAUT32.DLL</pre><pre>uKERNEL32.DLL</pre><pre>d~RASAPI32.dll</pre><pre>SHELL32.DLL</pre><pre>WININET.DLL</pre><pre>z*WS2_32.dll</pre><pre>ADVAPI32.dll</pre><pre>WYCOMDLG32.DLL</pre><pre>HttpQueryInfoA</pre><pre>HttpOpenRequestA</pre><pre>HttpSendRequestA</pre><pre>InternetCrackUrlA</pre><pre>InternetOpenUrlA</pre><pre>#include "l.chs\afxres.rc" // Standard components</pre><pre>1.12.52.41</pre><pre>123456789</pre><pre>(*.*)</pre><pre>1.2.0.0</pre><b>DNFµ¶¿Í0606A.exe_344_rwx_00401000_0050E000:</b><pre>t$(SSh</pre><pre>~%UVW</pre><pre>u$SShe</pre><pre>psapi.dll</pre><pre>comdlg32.dll</pre><pre>advapi32.dll</pre><pre>kernel32.dll</pre><pre>user32.dll</pre><pre>ntdll.dll</pre><pre>Kernel32.dll</pre><pre>EnumWindows</pre><pre>CreateWindowStationA</pre><pre>CloseWindowStation</pre><pre>NtYieldExecution</pre><pre>GetProcessHeap</pre><pre>{A068799B-7551-46b9-8CA8-EEF8357AFEA4}</pre><pre>csrss.exe</pre><pre>20140126</pre><pre>http://user.qzone.qq.com/453198928/blog/1344939460</pre><pre>klekle.cccpan.com</pre><pre>vmp.exe</pre><pre>.idata</pre><pre>.rdata</pre><pre>P.rsrc</pre><pre>@.reloc</pre><pre>oleaut32.dll</pre><pre>'Z6Sv.Qo#=_DNc]H<^E;]D:\C9XB7WA6V@5T>3Q=2P<1N:/N;/TA5bP?</pre><pre>ugJ_O8L8,G4)D1)A0'5I](?g2Jt,Lo ;_LQgoTImSGlQEkPEfNBeMAcK?bJ>`H<`H<dM><pre>cP{_OuZLtYKqVHpUGDQf&@f3Ot.Kp'AeW^p</pre><pre>eUGWh(?c.Jo3Vp</pre><pre>gXGWh 6[.Ip.Pp</pre><pre>qaN[n';b.Jn-Lj#=`\at</pre><pre>vfMZm&<`.Ip(Mk</pre><pre>{kKZn!.[.Io&Ll</pre><pre>~pM^p$2b.Jo/Pk">aO[xxuvwww{~w~</pre><pre>>Rx;Nr7Lw;Uy9Uw4Ss2St4Rs4Qr4Rr4Qq*Bh.Eo:Vw9Su<Uy9Xx8Vw5Ps5Qs2Oq><pre>w.fwEd</pre><pre><%C^A</pre><pre>E\6-s}$</pre><pre>-cg}k</pre><pre>.rqDKq</pre><pre>2.mC3</pre><pre>GÝg</pre><pre>KeY/_EF</pre><pre>UWG.Ps 4</pre><pre>?T?A.QN</pre><pre>4.o %S</pre><pre>.ZRAF!`</pre><pre>T.EIg</pre><pre>..yW~</pre><pre>r.KoQ</pre><pre>KcP4%U/</pre><pre>%F-J}</pre><pre>J.Ndyp</pre><pre>.uI2Em</pre><pre>q.dzO</pre><pre>.Iür</pre><pre>_X.wc</pre><pre>C|P%Sv</pre><pre>3.zC/</pre><pre>.xsxD</pre><pre>.jYRR</pre><pre>[E%u{</pre><pre>x<.HBR</pre><pre>'N.mI</pre><pre>CK.fP</pre><pre>.MP>(</pre><pre>R.pb>*</pre><pre>P".py</pre><pre>.Yhoj</pre><pre>:.de6qn</pre><pre>Õ0p</pre><pre>]Q.Jw3</pre><pre>.PcqvyeO`</pre><pre>..YGN</pre><pre>.ZF J</pre><pre>.qnHr</pre><pre>d.tD/</pre><pre>hz.tK~</pre><pre>4>A%F</pre><pre>?e%u4</pre><pre>v.pLWS${</pre><pre>}$PLH%X</pre><pre>u)%SSP</pre><pre>".zF/</pre><pre>`q.rb4</pre><pre>St%s8</pre><pre>$r!u.AL</pre><pre><7%Xr</pre><pre>3.lwK</pre><pre>o.GJ}</pre><pre>.KF12</pre><pre>-4;.lE</pre><pre>yt%cr%</pre><pre>_.Hp,</pre><pre>| J>"%F</pre><pre>].xS3gfG:</pre><pre>.Bu' ]H</pre><pre>.Gigr</pre><pre>u$/.xY</pre><pre>.Mo}_p</pre><pre>.VCK3~</pre><pre>=X%9U</pre><pre>D%X]T</pre><pre>D.qZl</pre><pre>}q.Scc</pre><pre>fg|%s</pre><pre>Gl_</pre><pre>\svchost.vmp.exe</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>@.vmp0</pre><pre>`.vmp1</pre><pre>cS%dR</pre><pre>\ B>.vd,</pre><pre>%UY]Q/</pre><pre>%d=|4_</pre><pre>QW .LE</pre><pre>.DmHi</pre><pre>POz.iLc</pre><pre>X.RZ.</pre><pre>^%xx,8</pre><pre>N.RD(</pre><pre>(stf.RWF/o</pre><pre>.Ya_q</pre><pre>y@%fz</pre><pre>.roFD</pre><pre>q*.qP</pre><pre>KV.me</pre><pre>w'IY.kgA</pre><pre>rA.mv</pre><pre>%uXkJE</pre><pre>GDI32.dll</pre><pre>KERNEL32.dll</pre><pre>COMCTL32.dll</pre><pre>oledlg.dll</pre><pre>iJcomdlg32.dll</pre><pre>aKWINSPOOL.DRV</pre><pre>:Urld</pre><pre>.aX`L</pre><pre>bX .lQ</pre><pre>/a.Oy</pre><pre>-F}bV{6:</pre><pre>.BrJ3</pre><pre>anV%S</pre><pre>Jl.leB ,U</pre><pre>.BN!V</pre><pre>! .Fr'</pre><pre>j.mJ #</pre><pre>/U.qE"</pre><pre>WINMM.dll</pre><pre>WS2_32.dll</pre><pre>mWSHELL32.dll</pre><pre>h.FrP`</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>OLEAUT32.dll</pre><pre>yUSER32.dll</pre><pre>ShellExecuteA</pre><pre>5%%cG</pre><pre>YY.exe</pre><pre>ImProtocol.dll</pre><pre>winmm.dll</pre><pre>ws2_32.dll</pre><pre>WinINet.dll</pre><pre>gdi32.dll</pre><pre>GLU32.DLL</pre><pre>aclui.dll</pre><pre>acsmib.dll</pre><pre>activeds.dll</pre><pre>AcXtrnal.dll</pre><pre>adimage.dll</pre><pre>adptif.dll</pre><pre>ADVAPI32.DLL</pre><pre>advpack.dll</pre><pre>atl.dll</pre><pre>authz.dll</pre><pre>avicap32.dll</pre><pre>avifil32.dll</pre><pre>browseui.dll</pre><pre>CABINET.DLL</pre><pre>clusapi.dll</pre><pre>comctl32.dll</pre><pre>comsvcs.dll</pre><pre>crtdll.dll</pre><pre>crypt32.dll</pre><pre>cryptnet.dll</pre><pre>D3DRM.DLL</pre><pre>dbghelp.dll</pre><pre>ddraw.dll</pre><pre>DHCPCSVC.DLL</pre><pre>digest.dll</pre><pre>DINPUT.DLL</pre><pre>dplay.dll</pre><pre>dplayx.dll</pre><pre>dsound.dll</pre><pre>dsprop.dll</pre><pre>dsuiext.dll</pre><pre>ftsrch.dll</pre><pre>gpedit.dll</pre><pre>hhctrl.ocx</pre><pre>hlink.dll</pre><pre>iasperf.dll</pre><pre>icm32.dll</pre><pre>ICMP.DLL</pre><pre>icmui.dll</pre><pre>idq.dll</pre><pre>iedkcs32.dll</pre><pre>iissuba.dll</pre><pre>IMAGEHLP.DLL</pre><pre>imm32.dll</pre><pre>inetcpl.cpl</pre><pre>IPHLPAPI.DLL</pre><pre>iprop.dll</pre><pre>KSUSER.DLL</pre><pre>loadperf.dll</pre><pre>lz32.dll</pre><pre>mapi32.dll</pre><pre>mgmtapi.dll</pre><pre>MOBSYNC.DLL</pre><pre>mpg4dmod.dll</pre><pre>mpr.dll</pre><pre>mprapi.dll</pre><pre>mqrt.dll</pre><pre>msacm32.dll</pre><pre>msafd.dll</pre><pre>mscms.dll</pre><pre>mscpxl32.dLL</pre><pre>msgina.dll</pre><pre>MSHTML.DLL</pre><pre>MSI.DLL</pre><pre>msimg32.dll</pre><pre>msorcl32.dll</pre><pre>MSPATCHA.DLL</pre><pre>msrating.dll</pre><pre>mstlsapi.dll</pre><pre>msvbvm50.dll</pre><pre>msvfw32.dll</pre><pre>MSWSOCK.DLL</pre><pre>MTXDM.DLL</pre><pre>MTXOCI.DLL</pre><pre>NDDEAPI.DLL</pre><pre>ndisnpp.dll</pre><pre>netapi32.dll</pre><pre>npptools.dll</pre><pre>ntdsapi.dll</pre><pre>ntdsbcli.dll</pre><pre>ntmsapi.dll</pre><pre>nwprovau.dll</pre><pre>odbc32.dll</pre><pre>ODBCBCP.DLL</pre><pre>odbccp32.dll</pre><pre>ODBCTRAC.DLL</pre><pre>OLEACC.DLL</pre><pre>olecli32.dll</pre><pre>olesvr32.dll</pre><pre>opengl32.dll</pre><pre>password.cpl</pre><pre>pdh.dll</pre><pre>Powrprof.dll</pre><pre>qosname.dll</pre><pre>query.dll</pre><pre>rasapi32.dll</pre><pre>raschap.dll</pre><pre>rasdlg.dll</pre><pre>rasman.dll</pre><pre>rassapi.dll</pre><pre>rastls.dll</pre><pre>resutils.dll</pre><pre>RICHED20.DLL</pre><pre>rpcns4.dll</pre><pre>rpcrt4.dll</pre><pre>RSRC32.dll</pre><pre>rtm.dll</pre><pre>rtutils.dll</pre><pre>scarddlg.dll</pre><pre>secur32.dll</pre><pre>SENSAPI.DLL</pre><pre>setupapi.dll</pre><pre>SFC.DLL</pre><pre>shdocvw.dll</pre><pre>shell32.dll</pre><pre>shlwapi.dll</pre><pre>snmpapi.dll</pre><pre>softpub.dll</pre><pre>spoolss.dll</pre><pre>SVRAPI.DLL</pre><pre>tapi32.dll</pre><pre>TLBINF32.dll</pre><pre>traffic.dll</pre><pre>url.dll</pre><pre>URLMON.DLL</pre><pre>userenv.dll</pre><pre>USP10.DLL</pre><pre>uxtheme.dll</pre><pre>VB5STKIT.DLL</pre><pre>vba6.dll</pre><pre>VDMDBG.DLL</pre><pre>version.dll</pre><pre>winfax.dll</pre><pre>wininet.dll</pre><pre>winscard.dll</pre><pre>winspool.dll</pre><pre>winspool.drv</pre><pre>wintrust.dll</pre><pre>wldap32.dll</pre><pre>WOW32.DLL</pre><pre>wsnmp32.dll</pre><pre>wtsapi32.dll</pre><pre>xolehlp.dll</pre><pre>cmd.exe /c del</pre><pre>ActivateKeyboardLayout</pre><pre>ArrangeIconicWindows</pre><pre>CallMsgFilter</pre><pre>CallMsgFilterA</pre><pre>CallMsgFilterW</pre><pre>CascadeChildWindows</pre><pre>CascadeWindows</pre><pre>CliImmSetHotKey</pre><pre>CreateDialogIndirectParamA</pre><pre>CreateDialogIndirectParamAorW</pre><pre>CreateDialogIndirectParamW</pre><pre>CreateWindowStationW</pre><pre>DisableProcessWindowsGhosting</pre><pre>DisplayExitWindowsWarnings</pre><pre>EnumChildWindows</pre><pre>EnumDesktopWindows</pre><pre>EnumThreadWindows</pre><pre>EnumWindowStationsA</pre><pre>EnumWindowStationsW</pre><pre>ExitWindowsEx</pre><pre>GetAsyncKeyState</pre><pre>GetKeyNameTextA</pre><pre>GetKeyNameTextW</pre><pre>GetKeyState</pre><pre>GetKeyboardLayout</pre><pre>GetKeyboardLayoutList</pre><pre>GetKeyboardLayoutNameA</pre><pre>GetKeyboardLayoutNameW</pre><pre>GetKeyboardState</pre><pre>GetKeyboardType</pre><pre>GetProcessWindowStation</pre><pre>LoadKeyboardLayoutA</pre><pre>LoadKeyboardLayoutEx</pre><pre>LoadKeyboardLayoutW</pre><pre>LockWindowStation</pre><pre>MapVirtualKeyA</pre><pre>MapVirtualKeyExA</pre><pre>MapVirtualKeyExW</pre><pre>MapVirtualKeyW</pre><pre>MsgWaitForMultipleObjects</pre><pre>MsgWaitForMultipleObjectsEx</pre><pre>OemKeyScan</pre><pre>OpenWindowStationA</pre><pre>OpenWindowStationW</pre><pre>RegisterErrorReportingDialog</pre><pre>RegisterHotKey</pre><pre>RegisterSessionPort</pre><pre>SetKeyboardState</pre><pre>SetProcessWindowStation</pre><pre>SetWindowStationUser</pre><pre>SetWindowsHookA</pre><pre>SetWindowsHookExA</pre><pre>SetWindowsHookExW</pre><pre>SetWindowsHookW</pre><pre>SfmDxReportPendingBindingsToDwm</pre><pre>TileChildWindows</pre><pre>TileWindows</pre><pre>UnhookWindowsHook</pre><pre>UnhookWindowsHookEx</pre><pre>UnloadKeyboardLayout</pre><pre>UnlockWindowStation</pre><pre>UnregisterHotKey</pre><pre>UnregisterSessionPort</pre><pre>VkKeyScanA</pre><pre>VkKeyScanExA</pre><pre>VkKeyScanExW</pre><pre>VkKeyScanW</pre><pre>WINNLSGetIMEHotkey</pre><pre>keybd_event</pre><pre>BaseCleanupAppcompatCacheSupport</pre><pre>BaseInitAppcompatCacheSupport</pre><pre>CallNamedPipeA</pre><pre>CallNamedPipeW</pre><pre>CmdBatNotification</pre><pre>ConnectNamedPipe</pre><pre>CreateIoCompletionPort</pre><pre>CreateMutexExA</pre><pre>CreateMutexExW</pre><pre>CreateNamedPipeA</pre><pre>CreateNamedPipeW</pre><pre>CreatePipe</pre><pre>DisconnectNamedPipe</pre><pre>EnumCalendarInfoExEx</pre><pre>EnumDateFormatsExEx</pre><pre>GetCPInfo</pre><pre>GetCPInfoExA</pre><pre>GetCPInfoExW</pre><pre>GetCalendarSupportedDateRange</pre><pre>GetConsoleAliasExesA</pre><pre>GetConsoleAliasExesLengthA</pre><pre>GetConsoleAliasExesLengthW</pre><pre>GetConsoleAliasExesW</pre><pre>GetConsoleInputExeNameA</pre><pre>GetConsoleInputExeNameW</pre><pre>GetConsoleKeyboardLayoutNameA</pre><pre>GetConsoleKeyboardLayoutNameW</pre><pre>GetConsoleOutputCP</pre><pre>GetLargestConsoleWindowSize</pre><pre>GetNamedPipeAttribute</pre><pre>GetNamedPipeClientComputerNameA</pre><pre>GetNamedPipeClientComputerNameW</pre><pre>GetNamedPipeClientProcessId</pre><pre>GetNamedPipeClientSessionId</pre><pre>GetNamedPipeHandleStateA</pre><pre>GetNamedPipeHandleStateW</pre><pre>GetNamedPipeInfo</pre><pre>GetNamedPipeServerProcessId</pre><pre>GetNamedPipeServerSessionId</pre><pre>GetProcessHandleCount</pre><pre>GetProcessHeaps</pre><pre>GetProcessShutdownParameters</pre><pre>GetSystemWindowsDirectoryA</pre><pre>GetSystemWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>GetWindowsDirectoryW</pre><pre>InitOnceExecuteOnce</pre><pre>NeedCurrentDirectoryForExePathA</pre><pre>NeedCurrentDirectoryForExePathW</pre><pre>PeekNamedPipe</pre><pre>RegCloseKey</pre><pre>RegCreateKeyExA</pre><pre>RegCreateKeyExW</pre><pre>RegDeleteKeyExA</pre><pre>RegDeleteKeyExW</pre><pre>RegEnumKeyExA</pre><pre>RegEnumKeyExW</pre><pre>RegFlushKey</pre><pre>RegGetKeySecurity</pre><pre>RegLoadKeyA</pre><pre>RegLoadKeyW</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>RegOpenKeyExW</pre><pre>RegQueryInfoKeyA</pre><pre>RegQueryInfoKeyW</pre><pre>RegRestoreKeyA</pre><pre>RegRestoreKeyW</pre><pre>RegSaveKeyExA</pre><pre>RegSaveKeyExW</pre><pre>RegSetKeySecurity</pre><pre>RegUnLoadKeyA</pre><pre>RegUnLoadKeyW</pre><pre>RegisterWowExec</pre><pre>SetConsoleInputExeNameA</pre><pre>SetConsoleInputExeNameW</pre><pre>SetConsoleKeyShortcuts</pre><pre>SetConsoleMaximumWindowSize</pre><pre>SetConsoleOutputCP</pre><pre>SetNamedPipeAttribute</pre><pre>SetNamedPipeHandleState</pre><pre>SetProcessShutdownParameters</pre><pre>SetThreadExecutionState</pre><pre>TransactNamedPipe</pre><pre>VDMConsoleOperation</pre><pre>VDMOperationStarted</pre><pre>WaitNamedPipeA</pre><pre>WaitNamedPipeW</pre><pre>WinExec</pre><pre>EtwpGetCpuSpeed</pre><pre>EvtIntReportAuthzEventAndSourceAsync</pre><pre>EvtIntReportEventAndSourceAsync</pre><pre>LdrOpenImageFileOptionsKey</pre><pre>LdrQueryImageFileExecutionOptions</pre><pre>LdrQueryImageFileExecutionOptionsEx</pre><pre>LdrQueryImageFileKeyOption</pre><pre>NtAcceptConnectPort</pre><pre>NtAlpcAcceptConnectPort</pre><pre>NtAlpcConnectPort</pre><pre>NtAlpcCreatePort</pre><pre>NtAlpcCreatePortSection</pre><pre>NtAlpcDeletePortSection</pre><pre>NtAlpcDisconnectPort</pre><pre>NtAlpcImpersonateClientOfPort</pre><pre>NtAlpcSendWaitReceivePort</pre><pre>NtCompactKeys</pre><pre>NtCompleteConnectPort</pre><pre>NtCompressKey</pre><pre>NtConnectPort</pre><pre>NtCreateKey</pre><pre>NtCreateKeyTransacted</pre><pre>NtCreateKeyedEvent</pre><pre>NtCreateNamedPipeFile</pre><pre>NtCreatePort</pre><pre>NtCreateWaitablePort</pre><pre>NtDelayExecution</pre><pre>NtDeleteKey</pre><pre>NtDeleteValueKey</pre><pre>NtEnumerateKey</pre><pre>NtEnumerateValueKey</pre><pre>NtFlushKey</pre><pre>NtImpersonateClientOfPort</pre><pre>NtListenPort</pre><pre>NtLoadKey</pre><pre>NtLoadKey2</pre><pre>NtLoadKeyEx</pre><pre>NtLockProductActivationKeys</pre><pre>NtLockRegistryKey</pre><pre>NtNotifyChangeKey</pre><pre>NtNotifyChangeMultipleKeys</pre><pre>NtOpenKey</pre><pre>NtOpenKeyEx</pre><pre>NtOpenKeyTransacted</pre><pre>NtOpenKeyTransactedEx</pre><pre>NtOpenKeyedEvent</pre><pre>NtQueryInformationPort</pre><pre>NtQueryKey</pre><pre>NtQueryMultipleValueKey</pre><pre>NtQueryOpenSubKeys</pre><pre>NtQueryOpenSubKeysEx</pre><pre>NtQueryPortInformationProcess</pre><pre>NtQueryValueKey</pre><pre>NtRegisterThreadTerminatePort</pre><pre>NtReleaseKeyedEvent</pre><pre>NtRenameKey</pre><pre>NtReplaceKey</pre><pre>NtReplyPort</pre><pre>NtReplyWaitReceivePort</pre><pre>NtReplyWaitReceivePortEx</pre><pre>NtReplyWaitReplyPort</pre><pre>NtRequestPort</pre><pre>NtRequestWaitReplyPort</pre><pre>NtRestoreKey</pre><pre>NtSaveKey</pre><pre>NtSaveKeyEx</pre><pre>NtSaveMergedKeys</pre><pre>NtSecureConnectPort</pre><pre>NtSetDefaultHardErrorPort</pre><pre>NtSetInformationKey</pre><pre>NtSetThreadExecutionState</pre><pre>NtSetValueKey</pre><pre>NtUnloadKey</pre><pre>NtUnloadKey2</pre><pre>NtUnloadKeyEx</pre><pre>NtWaitForKeyedEvent</pre><pre>RtlCheckRegistryKey</pre><pre>RtlCmDecodeMemIoResource</pre><pre>RtlComputeImportTableHash</pre><pre>RtlCreateRegistryKey</pre><pre>RtlEnumProcessHeaps</pre><pre>RtlExecuteUmsThread</pre><pre>RtlFormatCurrentUserKeyPath</pre><pre>RtlGetProcessHeaps</pre><pre>RtlIsCurrentThreadAttachExempt</pre><pre>RtlQueryProcessHeapInformation</pre><pre>RtlReportException</pre><pre>RtlReportSilentProcessExit</pre><pre>RtlReportSqmEscalation</pre><pre>RtlRunOnceExecuteOnce</pre><pre>RtlSendMsgToSm</pre><pre>RtlValidateProcessHeaps</pre><pre>RtlWerpReportException</pre><pre>RtlpCleanupRegistryKeys</pre><pre>RtlpExecuteUmsThread</pre><pre>RtlpNtCreateKey</pre><pre>RtlpNtEnumerateSubKey</pre><pre>RtlpNtMakeTemporaryKey</pre><pre>RtlpNtOpenKey</pre><pre>RtlpNtQueryValueKey</pre><pre>RtlpNtSetValueKey</pre><pre>RtlpUmsExecuteYieldThreadEnd</pre><pre>SbExecuteProcedure</pre><pre>ShipAssert</pre><pre>ShipAssertGetBufferInfo</pre><pre>ShipAssertMsgA</pre><pre>ShipAssertMsgW</pre><pre>TpCancelAsyncIoOperation</pre><pre>TpStartAsyncIoOperation</pre><pre>WerReportSQMEvent</pre><pre>ZwAcceptConnectPort</pre><pre>ZwAlpcAcceptConnectPort</pre><pre>ZwAlpcConnectPort</pre><pre>ZwAlpcCreatePort</pre><pre>ZwAlpcCreatePortSection</pre><pre>ZwAlpcDeletePortSection</pre><pre>ZwAlpcDisconnectPort</pre><pre>ZwAlpcImpersonateClientOfPort</pre><pre>ZwAlpcSendWaitReceivePort</pre><pre>ZwCompactKeys</pre><pre>ZwCompleteConnectPort</pre><pre>ZwCompressKey</pre><pre>ZwConnectPort</pre><pre>ZwCreateKey</pre><pre>ZwCreateKeyTransacted</pre><pre>ZwCreateKeyedEvent</pre><pre>ZwCreateNamedPipeFile</pre><pre>ZwCreatePort</pre><pre>ZwCreateWaitablePort</pre><pre>ZwDelayExecution</pre><pre>ZwDeleteKey</pre><pre>ZwDeleteValueKey</pre><pre>ZwEnumerateKey</pre><pre>ZwEnumerateValueKey</pre><pre>ZwFlushKey</pre><pre>ZwImpersonateClientOfPort</pre><pre>ZwListenPort</pre><pre>ZwLoadKey</pre><pre>ZwLoadKey2</pre><pre>ZwLoadKeyEx</pre><pre>ZwLockProductActivationKeys</pre><pre>ZwLockRegistryKey</pre><pre>ZwNotifyChangeKey</pre><pre>ZwNotifyChangeMultipleKeys</pre><pre>ZwOpenKey</pre><pre>ZwOpenKeyEx</pre><pre>ZwOpenKeyTransacted</pre><pre>ZwOpenKeyTransactedEx</pre><pre>ZwOpenKeyedEvent</pre><pre>ZwQueryInformationPort</pre><pre>ZwQueryKey</pre><pre>ZwQueryMultipleValueKey</pre><pre>ZwQueryOpenSubKeys</pre><pre>ZwQueryOpenSubKeysEx</pre><pre>ZwQueryPortInformationProcess</pre><pre>ZwQueryValueKey</pre><pre>ZwRegisterThreadTerminatePort</pre><pre>ZwReleaseKeyedEvent</pre><pre>ZwRenameKey</pre><pre>ZwReplaceKey</pre><pre>ZwReplyPort</pre><pre>ZwReplyWaitReceivePort</pre><pre>ZwReplyWaitReceivePortEx</pre><pre>ZwReplyWaitReplyPort</pre><pre>ZwRequestPort</pre><pre>ZwRequestWaitReplyPort</pre><pre>ZwRestoreKey</pre><pre>ZwSaveKey</pre><pre>ZwSaveKeyEx</pre><pre>ZwSaveMergedKeys</pre><pre>ZwSecureConnectPort</pre><pre>ZwSetDefaultHardErrorPort</pre><pre>ZwSetInformationKey</pre><pre>ZwSetThreadExecutionState</pre><pre>ZwSetValueKey</pre><pre>ZwUnloadKey</pre><pre>ZwUnloadKey2</pre><pre>ZwUnloadKeyEx</pre><pre>ZwWaitForKeyedEvent</pre><pre>ZwYieldExecution</pre><pre>D3DKMTAcquireKeyedMutex</pre><pre>D3DKMTCreateKeyedMutex</pre><pre>D3DKMTDestroyKeyedMutex</pre><pre>D3DKMTOpenKeyedMutex</pre><pre>D3DKMTReleaseKeyedMutex</pre><pre>DDCCIGetTimingReport</pre><pre>GetCertificate</pre><pre>GetCertificateSize</pre><pre>GetViewportExtEx</pre><pre>GetViewportOrgEx</pre><pre>OffsetViewportOrgEx</pre><pre>ScaleViewportExtEx</pre><pre>SetOPMSigningKeyAndSequenceNumbers</pre><pre>SetViewportExtEx</pre><pre>SetViewportOrgEx</pre><pre>UpdateICMRegKeyA</pre><pre>UpdateICMRegKeyW</pre><pre>CryptDeriveKey</pre><pre>CryptDestroyKey</pre><pre>CryptDuplicateKey</pre><pre>CryptExportKey</pre><pre>CryptGenKey</pre><pre>CryptGetKeyParam</pre><pre>CryptGetUserKey</pre><pre>CryptHashSessionKey</pre><pre>CryptImportKey</pre><pre>CryptSetKeyParam</pre><pre>ElfReportEventA</pre><pre>ElfReportEventAndSourceW</pre><pre>ElfReportEventW</pre><pre>EncryptedFileKeyInfo</pre><pre>FreeEncryptedFileKeyInfo</pre><pre>FreeEncryptionCertificateHashList</pre><pre>GetEventLogInformation</pre><pre>GetMultipleTrusteeOperationA</pre><pre>GetMultipleTrusteeOperationW</pre><pre>GetServiceKeyNameA</pre><pre>GetServiceKeyNameW</pre><pre>GetWindowsAccountDomainSid</pre><pre>ImpersonateNamedPipeClient</pre><pre>LogonUserExExW</pre><pre>MSChapSrvChangePassword</pre><pre>MSChapSrvChangePassword2</pre><pre>RegCreateKeyA</pre><pre>RegCreateKeyTransactedA</pre><pre>RegCreateKeyTransactedW</pre><pre>RegCreateKeyW</pre><pre>RegDeleteKeyA</pre><pre>RegDeleteKeyTransactedA</pre><pre>RegDeleteKeyTransactedW</pre><pre>RegDeleteKeyValueA</pre><pre>RegDeleteKeyValueW</pre><pre>RegDeleteKeyW</pre><pre>RegDisableReflectionKey</pre><pre>RegEnableReflectionKey</pre><pre>RegEnumKeyA</pre><pre>RegEnumKeyW</pre><pre>RegLoadAppKeyA</pre><pre>RegLoadAppKeyW</pre><pre>RegOpenKeyA</pre><pre>RegOpenKeyTransactedA</pre><pre>RegOpenKeyTransactedW</pre><pre>RegOpenKeyW</pre><pre>RegOverridePredefKey</pre><pre>RegQueryReflectionKey</pre><pre>RegRenameKey</pre><pre>RegReplaceKeyA</pre><pre>RegReplaceKeyW</pre><pre>RegSaveKeyA</pre><pre>RegSaveKeyW</pre><pre>RegSetKeyValueA</pre><pre>RegSetKeyValueW</pre><pre>ReportEventA</pre><pre>ReportEventW</pre><pre>SaferiIsExecutableFileType</pre><pre>SetUserFileEncryptionKey</pre><pre>SetUserFileEncryptionKeyEx</pre><pre>WmiExecuteMethodA</pre><pre>WmiExecuteMethodW</pre><pre>F%*.*f</pre><pre>CNotSupportedException</pre><pre>commctrl_DragListMsg</pre><pre>Afx:%x:%x:%x:%x:%x</pre><pre>Afx:%x:%x</pre><pre>COMCTL32.DLL</pre><pre>CCmdTarget</pre><pre>__MSVCRT_HEAP_SELECT</pre><pre>iphlpapi.dll</pre><pre>SHLWAPI.dll</pre><pre>MPR.dll</pre><pre>VERSION.dll</pre><pre>WSOCK32.dll</pre><pre>.PAVCException@@</pre><pre>.PAVCNotSupportedException@@</pre><pre>.PAVCFileException@@</pre><pre>(*.prn)|*.prn|</pre><pre>(*.*)|*.*||</pre><pre>Shell32.dll</pre><pre>Mpr.dll</pre><pre>Advapi32.dll</pre><pre>User32.dll</pre><pre>Gdi32.dll</pre><pre>(&07-034/)7 '</pre><pre>?? / %d]</pre><pre>%d / %d]</pre><pre>: %d]</pre><pre>(*.WAV;*.MID)|*.WAV;*.MID|WAV</pre><pre>(*.WAV)|*.WAV|MIDI</pre><pre>(*.MID)|*.MID|</pre><pre>(*.txt)|*.txt|</pre><pre>(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG</pre><pre>(*.JPG)|*.JPG|BMP</pre><pre>(*.BMP)|*.BMP|GIF</pre><pre>(*.GIF)|*.GIF|</pre><pre>(*.ICO)|*.ICO|</pre><pre>(*.CUR)|*.CUR|</pre><pre>%s:%d</pre><pre>windows</pre><pre>out.prn</pre><pre>%d.%d</pre><pre>%d / %d</pre><pre>%d/%d</pre><pre>Bogus message code %d</pre><pre>(%d-%d):</pre><pre>%ld%c</pre><pre>1.1.3</pre><pre>;3 #>6.&</pre><pre>'2, / 0&7!4-)1#</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)</pre><pre>HTTP/1.0</pre><pre>%s <%s></pre><pre>Reply-To: %s</pre><pre>From: %s</pre><pre>To: %s</pre><pre>Subject: %s</pre><pre>Date: %s</pre><pre>Cc: %s</pre><pre>%a, %d %b %Y %H:%M:%S</pre><pre>SMTP</pre><pre>http://www.baidu.com</pre><pre>%d%d%d</pre><pre>rundll32.exe shell32.dll,</pre><pre>.PAVCObject@@</pre><pre>.PAVCSimpleException@@</pre><pre>.PAVCMemoryException@@</pre><pre>.?AVCNotSupportedException@@</pre><pre>.PAVCResourceException@@</pre><pre>.PAVCUserException@@</pre><pre>.?AVCCmdTarget@@</pre><pre>.?AVCCmdUI@@</pre><pre>.?AVCTestCmdUI@@</pre><pre>.PAVCArchiveException@@</pre><pre>zcÁ</pre><pre>right-curly-bracket</pre><pre>left-curly-bracket</pre><pre>0123456789</pre><pre>SVCHOST06.EXE</pre><pre>C.EXE</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\DNF</pre><pre>0606A.exe</pre><pre>%xbN4</pre><pre>JfRp%X</pre><pre>t.Ht2Ht6Ht:Ht></pre><pre>F&{00000000-0000-0000-C000-000000000046}</pre><pre>3This binary has no widestrings support compiled in.</pre><pre>6This binary has no unicodestrings support compiled in.</pre><pre>ENoThreadSupport</pre><pre>ENoWideStringSupport</pre><pre>=?&{7B108C52-1D8F-4CDB-9CDF-57E071193D3F}$TMultiReadExclusiveWriteSynchronizer</pre><pre>ENoThreadSupportt</pre><pre>&{3FEEC8E1-E400-4A24-BCAC-1F01476439B1}</pre><pre>.Owner</pre><pre>1.2.5</pre><pre>sysconst.sabstracterror</pre><pre>sysconst.saccessdenied</pre><pre>sysconst.saccessviolation</pre><pre>Missing argument in format "%s"</pre><pre>sysconst.sargumentmissing</pre><pre>%s (%s, line %d)</pre><pre>sysconst.sasserterror</pre><pre>sysconst.sassertionfailed</pre><pre>sysconst.sbuserror</pre><pre>sysconst.scontrolc</pre><pre>sysconst.sdiskfull</pre><pre>sysconst.sdispatcherror</pre><pre>sysconst.sdivbyzero</pre><pre>sysconst.sendoffile</pre><pre>External exception %x</pre><pre>sysconst.sexternalexception</pre><pre>sysconst.sfilenotassigned</pre><pre>sysconst.sfilenotfound</pre><pre>sysconst.sfilenotopen</pre><pre>sysconst.sfilenotopenforinput</pre><pre>sysconst.sfilenotopenforoutput</pre><pre>sysconst.sinvalidfilename</pre><pre>sysconst.sintoverflow</pre><pre>Interface not supported</pre><pre>sysconst.sintfcasterror</pre><pre>Invalid argument index in format "%s"</pre><pre>sysconst.sinvalidargindex</pre><pre>sysconst.sinvalidcast</pre><pre>sysconst.sinvaliddrive</pre><pre>sysconst.sinvalidfilehandle</pre><pre>Invalid format specifier : "%s"</pre><pre>sysconst.sinvalidformat</pre><pre>sysconst.sinvalidinput</pre><pre>Invalid floating point operation</pre><pre>sysconst.sinvalidop</pre><pre>Invalid pointer operation</pre><pre>sysconst.sinvalidpointer</pre><pre>sysconst.sinvalidvarcast</pre><pre>Invalid variant operation</pre><pre>sysconst.sinvalidvarop</pre><pre>Threads not supported. Recompile program with thread driver.</pre><pre>sysconst.snothreadsupport</pre><pre>sysconst.smissingwstringmanager</pre><pre>sysconst.ssigquit</pre><pre>System error, (OS Code %d):</pre><pre>sysconst.soserror</pre><pre>sysconst.soutofmemory</pre><pre>sysconst.soverflow</pre><pre>sysconst.sprivilege</pre><pre>sysconst.srangeerror</pre><pre>sysconst.ssafecallexception</pre><pre>sysconst.siconverror</pre><pre>sysconst.stoomanyopenfiles</pre><pre>sysconst.sunknownruntimeerror</pre><pre>sysconst.sunderflow</pre><pre>An operating system call failed.</pre><pre>sysconst.sunkoserror</pre><pre>sysconst.svararraybounds</pre><pre>sysconst.svararraycreate</pre><pre>sysconst.svarnotarray</pre><pre>Ancestor class for "%s" not found.</pre><pre>rtlconsts.sancestornotfound</pre><pre>Cannot assign a %s to a %s.</pre><pre>rtlconsts.sassignerror</pre><pre>Class "%s" not found</pre><pre>rtlconsts.sclassnotfound</pre><pre>Duplicate name: A component named "%s" already exists</pre><pre>rtlconsts.sduplicatename</pre><pre>rtlconsts.sduplicatestring</pre><pre>rtlconsts.semptystreamillegalreader</pre><pre>rtlconsts.semptystreamillegalwriter</pre><pre>No variant support for properties. Please use the variants unit in your project and recompile</pre><pre>rtlconsts.serrnovariantsupport</pre><pre>Unable to create file "%s"</pre><pre>rtlconsts.sfcreateerror</pre><pre>Unable to open file "%s"</pre><pre>rtlconsts.sfopenerror</pre><pre>rtlconsts.sinvalidimage</pre><pre>"%s" is not a valid component name</pre><pre>rtlconsts.sinvalidname</pre><pre>rtlconsts.sinvalidpropertypath</pre><pre>rtlconsts.sinvalidpropertyvalue</pre><pre>List capacity (%d) exceeded.</pre><pre>rtlconsts.slistcapacityerror</pre><pre>List count (%d) out of bounds.</pre><pre>rtlconsts.slistcounterror</pre><pre>List index (%d) out of bounds</pre><pre>rtlconsts.slistindexerror</pre><pre>rtlconsts.smemorystreamerror</pre><pre>Error reading %s%s%s: %s</pre><pre>rtlconsts.spropertyexception</pre><pre>rtlconsts.sreaderror</pre><pre>rtlconsts.sreadonlyproperty</pre><pre>Resource "%s" not found</pre><pre>rtlconsts.sresnotfound</pre><pre>%s.Seek not implemented</pre><pre>rtlconsts.sseeknotimplemented</pre><pre>Operation not allowed on sorted list</pre><pre>rtlconsts.ssortedlisterror</pre><pre>Reading from %s is not supported</pre><pre>rtlconsts.sstreamnoreading</pre><pre>Writing to %s is not supported</pre><pre>rtlconsts.sstreamnowriting</pre><pre>Unknown property: "%s"</pre><pre>rtlconsts.sunknownproperty</pre><pre>Unknown property type %d</pre><pre>rtlconsts.sunknownpropertytype</pre><pre>Unsupported property variant type %d</pre><pre>rtlconsts.sunsupportedpropertyvarianttype</pre><pre>rtlconsts.swriteerror</pre><pre>inflate 1.2.5 Copyright 1995-2010 Mark Adler</pre><pre>ShellExecuteW</pre><pre>ay7|</pre><pre>.CN:?</pre><pre>b..cHp</pre><pre>%S ^ip</pre><pre>^V .Hy</pre><pre>F{.VFG</pre><pre>UZ.IQ</pre><pre>'.gOd^</pre><pre>P.Cl]</pre><pre>S%s(1P</pre><pre>bj</pre><pre>k5XO.JQ</pre><pre>XGm.fV</pre><pre>'.ARV/</pre><pre>|.LSK;</pre><pre>Y.er7e$</pre><pre>JI.SU</pre><pre>(uRLw</pre><pre>R#.Oy\</pre><pre>.NT%w</pre><pre>XÛCE</pre><pre>Xf.dJ</pre><pre>HV.Lq?</pre><pre>f4S%X</pre><pre>.nb6Df</pre><pre>*<=%sMD></pre><pre>GLWaL%F</pre><pre>tb)*.rh</pre><pre>fQo.vq</pre><pre>%u5[ir</pre><pre>v.ygt2f</pre><pre>4T==H,%x</pre><pre>zK.ax\</pre><pre>%8u#k</pre><pre>^RA[-:N%d:</pre><pre>N]ø</pre><pre>%.mPG</pre><pre>A`.cK-</pre><pre>IXMY%.F</pre><pre>.cZ 4</pre><pre>w$.Ne|</pre><pre>I/dz%C</pre><pre>]722=3>`5,</pre><pre>@h.Ze</pre><pre>s\.qYS</pre><pre>k:\V;</pre><pre>[W.oj</pre><pre>x.pq53_N</pre><pre>z.Wd1*</pre><pre>)[1%cu:Mm1</pre><pre>#I.ra</pre><pre>d:\8@</pre><pre>P.VLe</pre><pre>k<.zV</pre><pre>0?h%S</pre><pre>.yGY??</pre><pre>]5.GDA</pre><pre>cVßu</pre><pre>.Xj#,</pre><pre>0.wMK</pre><pre>, q.Po</pre><pre>No|%C</pre><pre>2:e(.ij</pre><pre>u!.HV</pre><pre>.EN &</pre><pre>O.slg7`</pre><pre>;Y%u^T</pre><pre>Q\K%u%</pre><pre>0:hAazH%C</pre><pre>H.pAl</pre><pre>V4%3U</pre><pre>X#.lm</pre><pre>%Fuj,</pre><pre>'oo39.nY</pre><pre>[vB%s</pre><pre>X5/.ca</pre><pre>}w%ci</pre><pre>^gGTÍV.]}</pre><pre>qPZ%S</pre><pre>\0%Cs</pre><pre>.yM^7</pre><pre>-:.UWzy"</pre><pre>$.YB-%</pre><pre>i.YRL</pre><pre>.sC'7i=</pre><pre>"Ud%X</pre><pre>~.mE </pre><pre>X.jK]un</pre><pre>=nk%C</pre><pre>.Oy-^</pre><pre>O 8%F</pre><pre>%R.qFi</pre><pre>Y.ZBT</pre><pre>D.RMQ</pre><pre>.jb9._V</pre><pre>=^d%u</pre><pre>ghR%CSld</pre><pre>%$%Sc</pre><pre>.VW1[</pre><pre>.SVtl</pre><pre>P.hW!</pre><pre>hs.nP</pre><pre>_dc.Om</pre><pre>v%S_G</pre><pre>/m|%f</pre><pre>.lq$;</pre><pre><kv><pre>LUj.BD</pre><pre>>4\.EQ|</pre><pre>u%DSeu</pre><pre>&{.XRn</pre><pre>o%U(!</pre><pre>J<%UEwb</pre><pre>-7SVH}L</pre><pre>:_.ZN</pre><pre>%dN{S</pre><pre>X/-K}</pre><pre>#%f`%</pre><pre>YK.OYr'</pre><pre>.UhM'</pre><pre>-:.Fe</pre><pre>l#%cxk$,</pre><pre>~D,%u7</pre><pre>.ovQ@</pre><pre>LUrl</pre><pre>.jaB?</pre><pre>%Ck]V</pre><pre>_26.Gr</pre><pre>'Dv.FK</pre><pre>TE%CU1.</pre><pre>%XnG]</pre><pre>N.R%.d?</pre><pre>x.WD;*</pre><pre>( .qQ</pre><pre>#SU.EX</pre><pre>&%U(fD</pre><pre>-n}}a7</pre><pre>;`D~.fW</pre><pre>MEXe</pre><pre>uRC%x</pre><pre>|.Rufu1</pre><pre>.iyC;</pre><pre>c%f)GY</pre><pre>.OZ<DZ><pre>%.DC_</pre><pre>B%7sH</pre><pre>.cF9|</pre><pre>El.Mk</pre><pre>!<.kQC</pre><pre>%x(gM</pre><pre>W=R%3U</pre><pre>&K.HN@</pre><pre>"4.BY r</pre><pre>R.MW0</pre><pre>X.Fo/L</pre><pre>R|.hX</pre><pre><'<.OAm\</pre><pre>OyÝX</pre><pre>1.12.52.41</pre><pre>123456789</pre><b>svchost06.exe_816:</b><pre>.kb!Y</pre><pre>f9z.vk</pre><pre>cmd /c net stop alg /y&net stop sharedaccess</pre><pre>dnf.exe</pre><pre>\hfnto.exe</pre><pre>\bvfi.exe</pre><pre>123456789</pre><pre>123456789</pre><pre>Microsoft.XMLHTTP</pre><pre>%WinDir%\</pre><pre>{00000117-0000-0000-C000-000000000046}</pre><pre>D@kernel32.dll</pre><pre>urlmon</pre><pre>user32.dll</pre><pre>atl.dll</pre><pre>ole32.dll</pre><pre>MsgWaitForMultipleObjects</pre><pre>URLDownloadToFileA</pre><pre>program internal error number is %d. (0x%Xh)</pre><pre>:"%s"</pre><pre>:"%s".</pre><pre>GetProcessHeap</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>cmd /c net</pre><pre>cess*dnf.exe</pre><pre>urlm</pre><pre>URLDownG</pre><pre>s %d. (0x%Xh)<</pre><pre>_`.rd</pre><pre>KERNEL32.DLL</pre><pre>ATL.DLL</pre><pre>MSVCRT.dll</pre><pre>OLEAUT32.dll</pre><pre>USER32.dll</pre><b>svchost06.exe_816_rwx_00401000_00019000:</b><pre>f9z.vk</pre><pre>cmd /c net stop alg /y&net stop sharedaccess</pre><pre>dnf.exe</pre><pre>\hfnto.exe</pre><pre>\bvfi.exe</pre><pre>123456789</pre><pre>123456789</pre><pre>Microsoft.XMLHTTP</pre><pre>%WinDir%\</pre><pre>{00000117-0000-0000-C000-000000000046}</pre><pre>D@kernel32.dll</pre><pre>urlmon</pre><pre>user32.dll</pre><pre>atl.dll</pre><pre>ole32.dll</pre><pre>MsgWaitForMultipleObjects</pre><pre>URLDownloadToFileA</pre><pre>program internal error number is %d. (0x%Xh)</pre><pre>:"%s"</pre><pre>:"%s".</pre><pre>GetProcessHeap</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><b>xslxtnl.exe_968:</b><pre>`.rsrc</pre><pre>t$(SSh</pre><pre>~%UVW</pre><pre>u$SShe</pre><pre>wininet.dll</pre><pre>kernel32.dll</pre><pre>user32.dll</pre><pre>ole32.dll</pre><pre>advapi32.dll</pre><pre>HttpOpenRequestA</pre><pre>HttpSendRequestA</pre><pre>HttpQueryInfoA</pre><pre>EnumWindows</pre><pre>GetProcessHeap</pre><pre>MsgWaitForMultipleObjects</pre><pre>http://</pre><pre>https://</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)</pre><pre>http=</pre><pre>HTTP/1.1</pre><pre>Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*</pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>@Client.exe</pre><pre>ptlogin4.game.qq.com</pre><pre>&s_url=http://dnf.qq.com/act/a20090219dltb/&f_url=&ptlang=2052&ptredirect=101&aid=21000127&daid=8&j_later=0&low_login_hour=0®master=0&pt_login_type=1&pt_aid=0&pt_aaid=0&pt_light=0</pre><pre>&service=login&nodirect=0&ptsig=</pre><pre>http://ptlogin4.game.qq.com/check_sig?pttype=1&uin=</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)</pre><pre>0@\DNF.exe</pre><pre>\TCLS\config\LoginQ.dat</pre><pre>LastLogin=</pre><pre>$@LastLogin=(\d*)</pre><pre>LastLogin=(\d*)</pre><pre>http://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=dnf&area=</pre><pre>&msg=</pre><pre>&Pass=</pre><pre>ftb.exe</pre><pre>\dlipms.exe</pre><pre>.rsrc</pre><pre>RU.LZ'</pre><pre>.HEL`pV</pre><pre>B%S2H\pS2%S</pre><pre>\\%SHK</pre><pre>%fpmCl</pre><pre>\UWSSHh</pre><pre>$%FNH</pre><pre>7.ovt</pre><pre>T.JX$</pre><pre>~Lh"4%D$</pre><pre>%FK%t</pre><pre>\.yjS</pre><pre>"&HK.fv</pre><pre>_.oh=x</pre><pre>G:.HH</pre><pre>n.WD7\2/x</pre><pre>ac 5ld%X</pre><pre>Þ[(</pre><pre>.mh)d:</pre><pre> $.CwB</pre><pre>57$]<#<*</pre><pre>.uP.u</pre><pre>t;.tMlaw</pre><pre>%FGlC</pre><pre>C.kwFt</pre><pre>%uTi'%,m</pre><pre>92r@h$`s.PtQ8</pre><pre>E.ppU`</pre><pre>Wr%S(Px</pre><pre>Msg!ForMultip.Objects</pre><pre>cmd.exe</pre><pre>.rdataU</pre><pre>%u?#3</pre><pre>P %s could</pre><pre>%*.*f</pre><pre>_CmdT"</pre><pre>nxJ.oE0</pre><pre>ELECTE,.MS</pre><pre>VCRTgr</pre><pre>%D]-D</pre><pre>(&07-034/)7</pre><pre>7%s:%dkQ</pre><pre>zcÁ</pre><pre>?l.chs\S</pre><pre>mpon%s</pre><pre>c.AA%</pre><pre>g]Key</pre><pre>KERNEL32.DLL</pre><pre>ADVAPI32.dll</pre><pre>COMCTL32.dll</pre><pre>comdlg32.dll</pre><pre>GDI32.dll</pre><pre>OLEAUT32.dll</pre><pre>SHELL32.dll</pre><pre>USER32.dll</pre><pre>WINMM.dll</pre><pre>WINSPOOL.DRV</pre><pre>WS2_32.dll</pre><pre>RegCloseKey</pre><pre>ShellExecuteA</pre><pre>DNF.exe</pre><pre>TASLogin.exe</pre><pre>I?}%X</pre><pre>w"%CH</pre><pre>$8%S2%<@2%S2DHLS2%SPTX%S2%\`2%S2dhlR2%Sp|[</pre><pre>)J.Ijn</pre><pre><O><pre>X&.RM</pre><pre>s<\%S{</pre><pre>Y%u9]</pre><pre>%f<C></C></pre><pre>Qa>.GZ@</pre><pre>Z.AxU</pre><pre>x.ht!</pre><pre>?Ú"</pre><pre>.Be$>;</pre><pre>vF08{%D^k</pre><pre>Y,t.Kk</pre><pre>\7%Cl</pre><pre>9.gO#</pre><pre>J .HT</pre><pre>A.tCD</pre><pre>.im=L</pre><pre><A><pre>$,",0044</pre><pre>~g%XH</pre><pre>Rt%3s</pre><pre>ùp`t</pre><pre>FQ-8Y}P</pre><pre>RdØ</pre><pre>.KH#I#</pre><pre>:{.osCg</pre><pre>afT.Aga</pre><pre>W].Fh</pre><pre>kadvapi32.dll</pre><pre>%xOatl</pre><pre>OLEACC.DLL</pre><pre>Http5F</pre><pre>'lTcpyn</pre><pre>xKeyk</pre><pre>h2://dnf.qq.com/act</pre><pre>g.btn.5}g</pre><pre>forum.phpI</pre><pre>HTTPV</pre><pre>.MLo%</pre><pre>:/</pre><pre><(($%>);,(</pre><pre>L.pr("\\x" s@sub</pre><pre>.toUpL</pre><pre>6Áî</pre><pre>pz.Bi</pre><pre>Ft0ó</pre><pre>&'$-. 02-24/350</pre><pre>,/0 * ("#</pre><pre>"%F#^>;</pre><pre>%u@H./!</pre><pre>JlA%U</pre><pre>G1Î3</pre><pre>J%A%S-</pre><pre>!U9%UV</pre><pre>aD'kM jM(hK.fI1L-</pre><pre>prO%X-</pre><pre>IiK%fL&</pre><pre>xU%DN</pre><pre>|32:<745</pre><pre>02.sTml#mk0</pre><pre>.onjBYXTK:</pre><pre>R9!T<"W=#X@#ZB#^E$^F%bH%cI&eL'hM</pre><pre>\:-];.]:</pre><pre>.vo:m</pre><pre>.">&"$%0$;</pre><pre>\.eF*v</pre><pre>6%F, 7</pre><pre>6# 3&$%xzu</pre><pre>4=,*;û@</pre><pre>(*7)*5()</pre><pre>/(.A.BAL</pre><pre>/~..Jw</pre><pre>hD`A-4z[= tR.tP</pre><pre>.BV9"Z|Z/</pre><pre>{Z)~\.bE</pre><pre>V6{c%S~</pre><pre>s %d.</pre><pre>x%Xh)7</pre><pre>`.rd9a</pre><pre>MSVCRT]</pre><pre>n?.mD</pre><pre>\H%U8 U:-JWS</pre><pre>D-b%x:F</pre><pre>*9.(6-&7.'</pre><pre>v.uA`XybZ</pre><pre>6,8-wB.yC</pre><pre>)*Í?</pre><pre>&( .0(1:$</pre><pre>(0 #6,";2&=</pre><pre>):@.KV</pre><pre>*;C.LI2U </pre><pre>^.HL)</pre><pre>B BG.GI.FF.C(5</pre><pre>o&5A*BH.IG.</pre><pre>F.SE.QD-P(</pre><pre>MF.UC/S.OI.Q</pre><pre>J.D.YC.VA,TA VB</pre><pre>Ã?r`m)_</pre><pre>90z6.tB7</pre><pre>6.lC9~C8</pre><pre>B/v> qB.uH.</pre><pre>P9}E.pH3tXD</pre><pre>H.yK/y[></pre><pre>!3~#5~)9</pre><pre>#.Sma</pre><pre>"X.DP</pre><pre>O>PL=OH6ND0K?-FE.KZ7^}N~uTukRjaHP</pre><pre>HB.IJ5NV0Tx#s</pre><pre>T*V@.DB0DC0E?.B</pre><pre> @9((<7';6&;7</pre><pre>52$96(=9 ?</pre><pre>81&:1$:3$<;</pre><pre>,3 *0#12'9/#9</pre><pre>.8%/3&50%8</pre><pre>7'$;($<,&:-</pre><pre>9)!6,$:,</pre><pre>"1,$7".'</pre><pre>&6-.UNKmgh0</pre><pre>-&!3("4' 5%</pre><pre>,% 2'"4(!5</pre><pre>&D(5Z ?n.Dx/H</pre><pre>9$!/(!3%"5&</pre><pre>$? $=)!8%!5</pre><pre>A..UGW</pre><pre>l^Tp`Xt.POLlVR{[V</pre><pre>.WSmOMgGC_]Vsa[xRMmFBc9<[06U%*M</pre><pre>_.QNiIFcXVsQQp8=d! U</pre><pre>B. 33Ÿ# 2</pre><pre>1*(2*'3'!</pre><pre>.KwHh</pre><pre>8)'1)&2(#"</pre><pre>.% 11,=B<L><pre>{MT{9;g#%S</pre><pre>=7I.MIZ</pre><pre>@÷H</pre><pre>;&$ '%,$! </pre><pre>&$#)&%4.& /&</pre><pre>0)#-)$.*%/(#/&"&</pre><pre>-( ,(!,)"</pre><pre>*' (",(</pre><pre>*.'"-$ -# ,#!-'%4</pre><pre>TPa^[lXUh.QOcJI]^^s^]tO</pre><pre>!7&#-*%& %$)' </pre><pre>$)& &&,%&-</pre><pre>02&-4*/-*3"</pre><pre>4Bh8Hm.Bp7P</pre><pre>3 %5(#2$</pre><pre> #-3)1:0972:</pre><pre>(! /!!5"</pre><pre>o>%D@:HEDUVX</pre><pre>.CY(:PHXzANw4At*6n</pre><pre>;i.XE</pre><pre>k(WWkTVkOSfGK`W\rW[rPUn%S</pre><pre>!2#"-.'.0%.</pre><pre>&-',-& ! </pre><pre>.yYZzJOp9Gh2Ej?Y</pre><pre>&1-#-," </pre><pre> ..-0<8</pre><pre>),$,2$.3"/4"16</pre><pre>/&-1&/3%/6&26#23!27%9>.AA5C:0:7/</pre><pre>!."*.!*/</pre><pre>,1#08 67</pre><pre>.Cx(9i6Js</pre><pre>.Ky*Kv(Iv,K}</pre><pre>;.PTJ/</pre><pre>D%0W%Dv(N</pre><pre>`@.Oe</pre><pre>.FBSnH]</pre><pre>9Jj.Bh-A</pre><pre>?k.Df</pre><pre>Hj.LwHa</pre><pre>%D~7Q</pre><pre>R %uA</pre><pre>#Cb.JoMg</pre><pre>%U*DkR</pre><pre>*Gd%DnNo</pre><pre>*U.IzNk</pre><pre>(@q%Co=^</pre><pre>.hhe1. </pre><pre>@7nN%s</pre><pre>-B}AU</pre><pre>r%X^'LI'O?(N< K;.J~</pre><pre>.AvHP</pre><pre>1Iw<MyOU><pre>':p%9k(=r.Bx9H</pre><pre>A#,:%Dr</pre><pre>;u.OtfA0m</pre><pre>J.GG?</pre><pre>4[.Ls8]</pre><pre>/!-T<</pre><pre>@A>01.YYV{{xaa^X</pre><pre>=T{.Cl</pre><pre>%.;=557/()$</pre><pre>_`];<9* (</pre><pre> U.Do?]</pre><pre>%Xj)_</pre><pre>%C=TwVp</pre><pre>vn.ed_ab]]_WZ</pre><pre>TQITNJXPMSGJFCWFg</pre><pre>%CnHn</pre><pre>))*001#&(</pre><pre><TqJbz8Wh><pre>O4>j:BjPWs</pre><pre>(H=Po?Xw.Hk<[</pre><pre>9`.Jo&Fi0Sx0V</pre><pre>b.Ob`s</pre><pre>.BeRa~u</pre><pre> TŒ#5d'7j7I|8M~Xp</pre><pre>Fs4N{.Lu1RyPp</pre><pre>Id.MS</pre><pre>7j.JtKm</pre><pre>8Gc 9[3Bj8Ht.Cq2Jz<</pre><pre>*<l><pre>?n.Dv</pre><pre>(Ez%Cw/O</pre><pre>GnN^v.Xp</pre><pre>J.hDDjJU</pre><pre>=&}:#{3$</pre><pre>.GnKb~</pre><pre>*:w%9s</pre><pre>>}1El$<g><pre>;n.Hy\&</pre><pre>-0-(0%()(</pre><pre>Cjm.eb</pre><pre>'9=82<.342</pre><pre>%.dn.</pre><pre>-o.SRx-</pre><pre>.Xmw[p</pre><pre>OSQ%c|<</pre><pre>FQf.xwB</pre><pre>\`.cu</pre><pre>m:\JcH</pre><pre>;y$F%flr==G^</pre><pre>.BRC&</pre><pre>o.gQ<</pre><pre>wz|.DFM</pre><pre>Pm.Ac</pre><pre>v/D.Fu</pre><pre>.ml@fBT</pre><pre>JO.OPX</pre><pre>CNotSupportedExceptionk</pre><pre>COMLZ.DL</pre><pre>CmdT"</pre><pre>~.INI</pre><pre>.MSVCRTg8U</pre><pre>.PAVGHTh</pre><pre>-f.De</pre><pre>7%s:%d</pre><pre>xX</pre><pre>mEZ.YM</pre><pre>%fpoj</pre><pre>.Quip</pre><pre>oledlg.dll</pre><pre>notepad1.exe</pre><pre>183.57.57.192</pre><pre>http://ip.qq.com/cgi-bin/index</pre><pre>Microsoft Windows 95</pre><pre>Microsoft Windows 98</pre><pre>Microsoft Windows Millenium Edition</pre><pre>Microsoft Windows 2003</pre><pre>Microsoft Windows XP</pre><pre>Microsoft Windows 2000</pre><pre>Microsoft Windows NT 3.51</pre><pre>Microsoft Windows NT 4.0</pre><pre>Microsoft Windows Vista</pre><pre>Microsoft Windows 7</pre><pre>TP3Helper.exe</pre><pre>http://aq.qq.com/cn2/unionverify/unionverify_jump?jumpname=bind_qqtoken_revry&PTime=0.2534901067286</pre><pre>http://aq.qq.com/cn2/unionverify/pc/pc_uv_send_sms</pre><pre>b@.txt</pre><pre>/hmsx.txt</pre><pre>http://captcha.qq.com/getimage?aid=21000127&r=</pre><pre>http://aq.qq.com/cn2/unionverify/unionverify_jump?jumpname=modifymobile&PTime=0.01982586313531</pre><pre>http://aq.qq.com/cn2/unionverify/pc/pc_uv_verify</pre><pre>window.location.href='(.*)';</pre><pre>?Action=Bind&Type=°ó¶¨Ãܱ£ÊÖ»ú&User=</pre><pre>dxfpz.ini</pre><pre>http://aq.qq.com/cn2/manage/mobile/query_same_mobile_ajax</pre><pre>http://aq.qq.com/cn2/manage/mobile/query_bind_uins_ajax</pre><pre>http://aq.qq.com/cn2/manage/mobile/query_station_ajax</pre><pre>http://aq.qq.com/cn2/manage/mobile/active_sms_ajax?flow_type=change&mobile_number=</pre><pre>http://aq.qq.com/cn2/manage/mobile/verify_mobile_ajax</pre><pre>{result:-1}</pre><pre>http://aq.qq.com/cn2/manage/mobile/change_mobile</pre><pre>QQ.exe</pre><pre>?Action=Bind&Type=°ó¶¨QQÁîÅÆ&User=</pre><pre>http://aq.qq.com/cn2/manage/qqtoken/bind_qqtoken?tlbox_src_id=0</pre><pre>http://aq.qq.com/cn2/unionverify/pc/pc_uv_sms_query</pre><pre>http://captcha.qq.com/getimage?uin=http://tenxunnimabi/sema&aid=21000127&0.8854733550862719</pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_show?type=8</pre><pre>&aid=21000127&u1=http://dnf.qq.com/act/a20090219dltb/&h=1&ptredirect=1&ptlang=2052&daid=8&from_ui=1&dumy=&low_login_enable=0®master=&fp=loginerroralert&action=16-116-1389436820937&mibao_css=&t=2&g=1&js_ver=10063&js_type=1&login_sig=knHhTNFwQthq*GSFdpsyF6EaS8*jMteBFqJBsJiCmMR8bkYQuLD6LJlF-7k4h0Qx&pt_rsa=0</pre><pre>http://ptlogin2.qq.com/login?u=</pre><pre>http://ui.ptlogin2.qq.com/cgi-bin/mibao_vry</pre><pre>http://aq.qq.com/cn/services/abnormal/abnormal_index</pre><pre>&s_url</pre><pre>var hexcase=1;var b64pad="";var chrsz=8;var mode=32;function md5(A){return hex_md5(A)}function hex_md5(A){return binl2hex(core_md5(str2binl(A),A.length*chrsz))}function str_md5(A){return binl2str(core_md5(str2binl(A),A.length*chrsz))}function hex_hmac_md5(A,B){return binl2hex(core_hmac_md5(A,B))}function b64_hmac_md5(A,B){return binl2b64(core_hmac_md5(A,B))}function str_hmac_md5(A,B){return binl2str(core_hmac_md5(A,B))}function core_md5(K,F){K[F>>5]|=128<<((F)2);K[(((F 64)>>>9)<<4) 14]=F;var J=1732584193;var I=-271733879;var H=-1732584194;var G=271733878;for(var C=0;C<K>16){E=core_md5(E,C.length*chrsz)}var A=Array(16),D=Array(16);for(var B=0;B<16;B ){A[B]=E[B]^909522486;D[B]=E[B]^1549556828}var G=core_md5(A.concat(str2binl(F)),512 F.length*chrsz);return core_md5(D.concat(G),512 128)}function safe_add(A,D){var C=(A&65535) (D&65535);var B=(A>>16) (D>>16) (C>>16);return(B<<16)|(C&65535)}function bit_rol(A,B){return(A<<B)|(A>>>(32-B))}function str2binl(D){var C=Array();var A=(1<<chrsz)-1;for(var B=0;B<D>>5]|=(D.charCodeAt(B/chrsz)&A)<<(B2)}return C}function binl2str(C){var D="";var A=(1<<chrsz)-1;for(var B=0;B<C>>5]>>>(B2))&A)}return D}function binl2hex(C){var B=hexcase?"0123456789ABCDEF":"0123456789abcdef";var D="";for(var A=0;A<C>>2]>>((A%4)*8 4))&15) B.charAt((C[A>>2]>>((A%4)*8))&15)}return D}function binl2b64(D){var C="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /";var F="";for(var B=0;B<D>>2]>>8*(B%4))&255)<<16)|(((D[B 1>>2]>>8*((B 1)%4))&255)<<8)|((D[B 2>>2]>>8*((B 2)%4))&255);for(var A=0;A<4;A ){if(B*8 A*6>D.length*32){F =b64pad}else{F =C.charAt((E>>6*(3-A))&63)}}}return F}function hexchar2bin(str){var arr=[];for(var i=0;i<str><pre>GetPassword</pre><pre>http://aq.qq.com/cn2/index</pre><pre>WinHttp.WinHttpRequest.5.1</pre><pre>MSXML2.ServerXMLHTTP.6.0</pre><pre>MSXML2.ServerXMLHTTP.5.0</pre><pre>User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)</pre><pre>Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*</pre><pre>Y@&msg</pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_show?type=2</pre><pre><dd>(\d.*)<.dd></dd></pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_dtmsg_query</pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_verify</pre><pre>http://check.ptlogin2.qq.com/check?uin=</pre><pre>VBScript.RegExp</pre><pre>"&$&&$&&$&&</pre><pre>"$%&$%&$%&</pre><pre>"&$&&$&&</pre><pre>$%&$%&$%&</pre><pre>&3<$%&$&&$%&</pre><pre>"!&$%&$%&</pre><pre>"!&!%&$%&</pre><pre>"!&$%&!%&</pre><pre>"!&!%&!%&</pre><pre>999999999999999</pre><pre>999999999999</pre><pre>.J~-J}-I|-I|,I{,Hz,Gz,Gy,Gw Gw*Fw*Fu*Eu*Eu*Es*Ds)Ds)Cr)Cq(Cq'Cp'Bp'Bo'Ao&@n&@m&?m%?m%>l%>l%>j%>j%>i%>i$=h$=h$<h><pre>IU%ct</pre><pre>IV%ct</pre><pre>JW%ct</pre><pre><s><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "7($<)$/$#% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "1$</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% ",!</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% ":&</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "' !`=)</pre><pre>]/< #(!"% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "1"</pre><pre>12$58(.3"</pre><pre>`*gA%U4</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% ".</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "1# \8</pre><pre>)0-&8 -E%U</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% ".#!`7#</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "2#</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "' !G0%d@)</pre><pre>% "% "% "% "% "% "% "% "% "% " !</pre><pre>% "% "% "% "% "% "% "% "% "-"</pre><pre>% "% "% "% "% "% "% "% "% "3&#</pre><pre>% "% "% "% "% "% "% "% "% "?-%</pre><pre>\,\8$1%"% "% "% "% "% "% "% "% "</pre><pre>% "% "% "% "% "% "% "% ":*$</pre><pre>% "% "% "% "% "% "% "5'"</pre><pre>% "% "% "% "% "% "*!</pre><pre>% "% "% "% "% "% "0#</pre><pre>% "% "% "% "% "% "6&!</pre><pre>% "% "% "% "% "% "> "</pre><pre>% "% "% "% "% "</pre><pre>% "% "% "% "% "*""</pre><pre>% "% "% "% "% ",""</pre><pre>% "% "% "% "% "-##</pre><pre>% "% "% "% "% ",#"</pre><pre>[(9)"% "% "% "% "% "</pre><pre>% "% "% "% "% " #"</pre><pre>[(9*"% "% "% "% "% "</pre><pre>Y%uM*</pre><pre>[*:*"% "% "% "% "% "</pre><pre>% "% "% "% "% "(!"</pre><pre>^-9)"% "% "% "% "% "</pre><pre>% "% "% "% "% ")""</pre><pre>^-<*"% "% "% "% "% "</pre><pre>^-> "% "% "% "% "% "</pre><pre>% "% "% "% "% "-$"</pre><pre>% "% "% "% "% "-#"</pre><pre>% "% "% "% "% "/$"</pre><pre>% "% "% "% "% "0$"</pre><pre>% "% "% "% "% "0$!</pre><pre>" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "</pre><pre>" " " " " " " " " " " " " " "</pre><pre>" " " " " "</pre><pre>" " " " " " #! "</pre><pre>" " " " #! "</pre><pre>" " " " " " #!!"</pre><pre>" " " " #!!" " #! "</pre><pre>" " " ! "</pre><pre>""" """ """ """ """ """ ""# """ ""# ""# """ """ """ ""# """ ""# ""# """ """ """ ""# """ ""# !! #$</pre><pre>"#!!!!"#</pre><pre>"#!!!!"" "#</pre><pre>!$!"'!!####!#$!#$ "$!"&!!#"##!#$!#$ "$!#$</pre><pre>!$!"'!!####!#$!#$ "$!"&!!####!#$!#$!#$!#$</pre><pre>!$!"(!!####!#$!#$ "$!"&!!####!#$!#$!#$!#$</pre><pre>!$!"(!!#"##!#$!#$</pre><pre>!$!"(!"#!"$!#$</pre><pre>!$!"(!!#"## #&</pre><pre>$#% &!"&#! $!</pre><pre>'"!&! '#"%#"</pre><pre>#$ '($ "</pre><pre>&"!$#"$#"$""&! )!</pre><pre>&"!$#"%"!%""&"!&</pre><pre>&"!$#"$#"$#"&"!&</pre><pre>&"!$#"%"!&</pre><pre>0*#0$".!</pre><pre> '"*"" $'' #)#$*!</pre><pre>'$ (# )"</pre><pre>&"!)$"&%#%&#%&"'</pre><pre>'"!)$"&%#%%"&&"'"!'! (</pre><pre>'"!)$"&%#%&#%&"'"!'! (</pre><pre>&"!)$"&%"&#!'! (</pre><pre>&"!)%"&#"'! (</pre><pre>#$ #$"#$"%#"$#</pre><pre>$"!#"""%##%##'#(&"(' '&"(*#*($)*$)'#()#('#()")'#))! '" )! '" '#(%$&'#(%$&(#('"*)! '" '#(%$&'#(%$&'$&'$&'$&&#%'"$(&&($''$&'$&&#%'"$(&&)$'&$&'$&'$&'$&&#%'"$(&&*%&(#$)$% &' &')$%*%'*$)*$)*$& &')$%*%'*$)*$))#&)$& &' &')$%*$()#'*%'*$)*$))#()#(*$))#*'#')$'*$))#(*$))#*'#')$'*$)*$))#()#()$)("(*$))#*&#)&"('"(("(*$))#*&#)$"(</pre><pre>#'$)("&*$))#*%"(#!&%"(("&*$))#*&#)$"(</pre><pre>#%"(&!%)$))#*%"(#!&%"(("&*$))#*&#)$"(</pre><pre>#%"($ $'$)%"(</pre><pre>#&"('%*#"'</pre><pre>#$"&$%) #&</pre><pre>88,,/ $'</pre><pre>.6 (0&#*# 1,%*)% *#. #0(%0('0&'/$'0#&0#$0$"0% /'%3-#3,</pre><pre>F%*.*f</pre><pre>CNotSupportedException</pre><pre>commctrl_DragListMsg</pre><pre>Afx:%x:%x:%x:%x:%x</pre><pre>Afx:%x:%x</pre><pre>COMCTL32.DLL</pre><pre>CCmdTarget</pre><pre>__MSVCRT_HEAP_SELECT</pre><pre>iphlpapi.dll</pre><pre>SHLWAPI.dll</pre><pre>MPR.dll</pre><pre>VERSION.dll</pre><pre>WININET.dll</pre><pre>.PAVCException@@</pre><pre>.PAVCNotSupportedException@@</pre><pre>.PAVCFileException@@</pre><pre>(*.prn)|*.prn|</pre><pre>(*.*)|*.*||</pre><pre>Shell32.dll</pre><pre>Mpr.dll</pre><pre>Advapi32.dll</pre><pre>User32.dll</pre><pre>Gdi32.dll</pre><pre>Kernel32.dll</pre><pre>(&07-034/)7 '</pre><pre>?? / %d]</pre><pre>%d / %d]</pre><pre>: %d]</pre><pre>(*.WAV;*.MID)|*.WAV;*.MID|WAV</pre><pre>(*.WAV)|*.WAV|MIDI</pre><pre>(*.MID)|*.MID|</pre><pre>(*.txt)|*.txt|</pre><pre>(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG</pre><pre>(*.JPG)|*.JPG|BMP</pre><pre>(*.BMP)|*.BMP|GIF</pre><pre>(*.GIF)|*.GIF|</pre><pre>(*.ICO)|*.ICO|</pre><pre>(*.CUR)|*.CUR|</pre><pre>%s:%d</pre><pre>windows</pre><pre>out.prn</pre><pre>%d.%d</pre><pre>%d / %d</pre><pre>%d/%d</pre><pre>Bogus message code %d</pre><pre>(%d-%d):</pre><pre>%ld%c</pre><pre>1.1.3</pre><pre>;3 #>6.&</pre><pre>'2, / 0&7!4-)1#</pre><pre>USER32.DLL</pre><pre>.PAVCObject@@</pre><pre>.PAVCSimpleException@@</pre><pre>.PAVCMemoryException@@</pre><pre>.?AVCNotSupportedException@@</pre><pre>.PAVCResourceException@@</pre><pre>.PAVCUserException@@</pre><pre>.?AVCCmdTarget@@</pre><pre>.?AVCCmdUI@@</pre><pre>.?AVCTestCmdUI@@</pre><pre>.PAVCArchiveException@@</pre><pre>q.com</pre><pre>651030; Domain=ip.qq.com; Expires=Fri, 04 Jul 2014 05:07:27 GMT; Path=/; HTTPOnly</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\xslxtnl.exe</pre><pre>#include "l.chs\afxres.rc" // Standard components</pre><pre>WinExec</pre><pre>GetCPInfo</pre><pre>RegOpenKeyExA</pre><pre>RegCreateKeyExA</pre><pre>GetViewportExtEx</pre><pre>GetViewportOrgEx</pre><pre>ScaleViewportExtEx</pre><pre>SetViewportExtEx</pre><pre>OffsetViewportOrgEx</pre><pre>SetViewportOrgEx</pre><pre>GetKeyState</pre><pre>CreateDialogIndirectParamA</pre><pre>UnhookWindowsHookEx</pre><pre>SetWindowsHookExA</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>cbKey</pre><pre>(*.*)</pre><b>xslxtnl.exe_968_rwx_00401000_00289000:</b><pre>t$(SSh</pre><pre>~%UVW</pre><pre>u$SShe</pre><pre>wininet.dll</pre><pre>kernel32.dll</pre><pre>user32.dll</pre><pre>ole32.dll</pre><pre>advapi32.dll</pre><pre>HttpOpenRequestA</pre><pre>HttpSendRequestA</pre><pre>HttpQueryInfoA</pre><pre>EnumWindows</pre><pre>GetProcessHeap</pre><pre>MsgWaitForMultipleObjects</pre><pre>http://</pre><pre>https://</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)</pre><pre>http=</pre><pre>HTTP/1.1</pre><pre>Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*</pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>@Client.exe</pre><pre>ptlogin4.game.qq.com</pre><pre>&s_url=http://dnf.qq.com/act/a20090219dltb/&f_url=&ptlang=2052&ptredirect=101&aid=21000127&daid=8&j_later=0&low_login_hour=0®master=0&pt_login_type=1&pt_aid=0&pt_aaid=0&pt_light=0</pre><pre>&service=login&nodirect=0&ptsig=</pre><pre>http://ptlogin4.game.qq.com/check_sig?pttype=1&uin=</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)</pre><pre>0@\DNF.exe</pre><pre>\TCLS\config\LoginQ.dat</pre><pre>LastLogin=</pre><pre>$@LastLogin=(\d*)</pre><pre>LastLogin=(\d*)</pre><pre>http://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=dnf&area=</pre><pre>&msg=</pre><pre>&Pass=</pre><pre>ftb.exe</pre><pre>\dlipms.exe</pre><pre>.rsrc</pre><pre>RU.LZ'</pre><pre>.HEL`pV</pre><pre>B%S2H\pS2%S</pre><pre>\\%SHK</pre><pre>%fpmCl</pre><pre>\UWSSHh</pre><pre>$%FNH</pre><pre>7.ovt</pre><pre>T.JX$</pre><pre>~Lh"4%D$</pre><pre>%FK%t</pre><pre>\.yjS</pre><pre>"&HK.fv</pre><pre>_.oh=x</pre><pre>G:.HH</pre><pre>n.WD7\2/x</pre><pre>ac 5ld%X</pre><pre>Þ[(</pre><pre>.mh)d:</pre><pre> $.CwB</pre><pre>57$]<#<*</pre><pre>.uP.u</pre><pre>t;.tMlaw</pre><pre>%FGlC</pre><pre>C.kwFt</pre><pre>%uTi'%,m</pre><pre>92r@h$`s.PtQ8</pre><pre>E.ppU`</pre><pre>Wr%S(Px</pre><pre>Msg!ForMultip.Objects</pre><pre>cmd.exe</pre><pre>.rdataU</pre><pre>%u?#3</pre><pre>P %s could</pre><pre>%*.*f</pre><pre>_CmdT"</pre><pre>nxJ.oE0</pre><pre>ELECTE,.MS</pre><pre>VCRTgr</pre><pre>%D]-D</pre><pre>(&07-034/)7</pre><pre>7%s:%dkQ</pre><pre>zcÁ</pre><pre>?l.chs\S</pre><pre>mpon%s</pre><pre>c.AA%</pre><pre>g]Key</pre><pre>KERNEL32.DLL</pre><pre>ADVAPI32.dll</pre><pre>COMCTL32.dll</pre><pre>comdlg32.dll</pre><pre>GDI32.dll</pre><pre>OLEAUT32.dll</pre><pre>SHELL32.dll</pre><pre>USER32.dll</pre><pre>WINMM.dll</pre><pre>WINSPOOL.DRV</pre><pre>WS2_32.dll</pre><pre>RegCloseKey</pre><pre>ShellExecuteA</pre><pre>DNF.exe</pre><pre>TASLogin.exe</pre><pre>I?}%X</pre><pre>w"%CH</pre><pre>$8%S2%<@2%S2DHLS2%SPTX%S2%\`2%S2dhlR2%Sp|[</pre><pre>)J.Ijn</pre><pre><O><pre>X&.RM</pre><pre>s<\%S{</pre><pre>Y%u9]</pre><pre>%f<C></C></pre><pre>Qa>.GZ@</pre><pre>Z.AxU</pre><pre>x.ht!</pre><pre>?Ú"</pre><pre>.Be$>;</pre><pre>vF08{%D^k</pre><pre>Y,t.Kk</pre><pre>\7%Cl</pre><pre>9.gO#</pre><pre>J .HT</pre><pre>A.tCD</pre><pre>.im=L</pre><pre><A><pre>$,",0044</pre><pre>~g%XH</pre><pre>Rt%3s</pre><pre>ùp`t</pre><pre>FQ-8Y}P</pre><pre>RdØ</pre><pre>.KH#I#</pre><pre>:{.osCg</pre><pre>afT.Aga</pre><pre>W].Fh</pre><pre>kadvapi32.dll</pre><pre>%xOatl</pre><pre>OLEACC.DLL</pre><pre>Http5F</pre><pre>'lTcpyn</pre><pre>xKeyk</pre><pre>h2://dnf.qq.com/act</pre><pre>g.btn.5}g</pre><pre>forum.phpI</pre><pre>HTTPV</pre><pre>.MLo%</pre><pre>:/</pre><pre><(($%>);,(</pre><pre>L.pr("\\x" s@sub</pre><pre>.toUpL</pre><pre>6Áî</pre><pre>pz.Bi</pre><pre>Ft0ó</pre><pre>&'$-. 02-24/350</pre><pre>,/0 * ("#</pre><pre>"%F#^>;</pre><pre>%u@H./!</pre><pre>JlA%U</pre><pre>G1Î3</pre><pre>J%A%S-</pre><pre>!U9%UV</pre><pre>aD'kM jM(hK.fI1L-</pre><pre>prO%X-</pre><pre>IiK%fL&</pre><pre>xU%DN</pre><pre>|32:<745</pre><pre>02.sTml#mk0</pre><pre>.onjBYXTK:</pre><pre>R9!T<"W=#X@#ZB#^E$^F%bH%cI&eL'hM</pre><pre>\:-];.]:</pre><pre>.vo:m</pre><pre>.">&"$%0$;</pre><pre>\.eF*v</pre><pre>6%F, 7</pre><pre>6# 3&$%xzu</pre><pre>4=,*;û@</pre><pre>(*7)*5()</pre><pre>/(.A.BAL</pre><pre>/~..Jw</pre><pre>hD`A-4z[= tR.tP</pre><pre>.BV9"Z|Z/</pre><pre>{Z)~\.bE</pre><pre>V6{c%S~</pre><pre>s %d.</pre><pre>x%Xh)7</pre><pre>`.rd9a</pre><pre>MSVCRT]</pre><pre>n?.mD</pre><pre>\H%U8 U:-JWS</pre><pre>D-b%x:F</pre><pre>*9.(6-&7.'</pre><pre>v.uA`XybZ</pre><pre>6,8-wB.yC</pre><pre>)*Í?</pre><pre>&( .0(1:$</pre><pre>(0 #6,";2&=</pre><pre>):@.KV</pre><pre>*;C.LI2U </pre><pre>^.HL)</pre><pre>B BG.GI.FF.C(5</pre><pre>o&5A*BH.IG.</pre><pre>F.SE.QD-P(</pre><pre>MF.UC/S.OI.Q</pre><pre>J.D.YC.VA,TA VB</pre><pre>Ã?r`m)_</pre><pre>90z6.tB7</pre><pre>6.lC9~C8</pre><pre>B/v> qB.uH.</pre><pre>P9}E.pH3tXD</pre><pre>H.yK/y[></pre><pre>!3~#5~)9</pre><pre>#.Sma</pre><pre>"X.DP</pre><pre>O>PL=OH6ND0K?-FE.KZ7^}N~uTukRjaHP</pre><pre>HB.IJ5NV0Tx#s</pre><pre>T*V@.DB0DC0E?.B</pre><pre> @9((<7';6&;7</pre><pre>52$96(=9 ?</pre><pre>81&:1$:3$<;</pre><pre>,3 *0#12'9/#9</pre><pre>.8%/3&50%8</pre><pre>7'$;($<,&:-</pre><pre>9)!6,$:,</pre><pre>"1,$7".'</pre><pre>&6-.UNKmgh0</pre><pre>-&!3("4' 5%</pre><pre>,% 2'"4(!5</pre><pre>&D(5Z ?n.Dx/H</pre><pre>9$!/(!3%"5&</pre><pre>$? $=)!8%!5</pre><pre>A..UGW</pre><pre>l^Tp`Xt.POLlVR{[V</pre><pre>.WSmOMgGC_]Vsa[xRMmFBc9<[06U%*M</pre><pre>_.QNiIFcXVsQQp8=d! U</pre><pre>B. 33Ÿ# 2</pre><pre>1*(2*'3'!</pre><pre>.KwHh</pre><pre>8)'1)&2(#"</pre><pre>.% 11,=B<L><pre>{MT{9;g#%S</pre><pre>=7I.MIZ</pre><pre>@÷H</pre><pre>;&$ '%,$! </pre><pre>&$#)&%4.& /&</pre><pre>0)#-)$.*%/(#/&"&</pre><pre>-( ,(!,)"</pre><pre>*' (",(</pre><pre>*.'"-$ -# ,#!-'%4</pre><pre>TPa^[lXUh.QOcJI]^^s^]tO</pre><pre>!7&#-*%& %$)' </pre><pre>$)& &&,%&-</pre><pre>02&-4*/-*3"</pre><pre>4Bh8Hm.Bp7P</pre><pre>3 %5(#2$</pre><pre> #-3)1:0972:</pre><pre>(! /!!5"</pre><pre>o>%D@:HEDUVX</pre><pre>.CY(:PHXzANw4At*6n</pre><pre>;i.XE</pre><pre>k(WWkTVkOSfGK`W\rW[rPUn%S</pre><pre>!2#"-.'.0%.</pre><pre>&-',-& ! </pre><pre>.yYZzJOp9Gh2Ej?Y</pre><pre>&1-#-," </pre><pre> ..-0<8</pre><pre>),$,2$.3"/4"16</pre><pre>/&-1&/3%/6&26#23!27%9>.AA5C:0:7/</pre><pre>!."*.!*/</pre><pre>,1#08 67</pre><pre>.Cx(9i6Js</pre><pre>.Ky*Kv(Iv,K}</pre><pre>;.PTJ/</pre><pre>D%0W%Dv(N</pre><pre>`@.Oe</pre><pre>.FBSnH]</pre><pre>9Jj.Bh-A</pre><pre>?k.Df</pre><pre>Hj.LwHa</pre><pre>%D~7Q</pre><pre>R %uA</pre><pre>#Cb.JoMg</pre><pre>%U*DkR</pre><pre>*Gd%DnNo</pre><pre>*U.IzNk</pre><pre>(@q%Co=^</pre><pre>.hhe1. </pre><pre>@7nN%s</pre><pre>-B}AU</pre><pre>r%X^'LI'O?(N< K;.J~</pre><pre>.AvHP</pre><pre>1Iw<MyOU><pre>':p%9k(=r.Bx9H</pre><pre>A#,:%Dr</pre><pre>;u.OtfA0m</pre><pre>J.GG?</pre><pre>4[.Ls8]</pre><pre>/!-T<</pre><pre>@A>01.YYV{{xaa^X</pre><pre>=T{.Cl</pre><pre>%.;=557/()$</pre><pre>_`];<9* (</pre><pre> U.Do?]</pre><pre>%Xj)_</pre><pre>%C=TwVp</pre><pre>vn.ed_ab]]_WZ</pre><pre>TQITNJXPMSGJFCWFg</pre><pre>%CnHn</pre><pre>))*001#&(</pre><pre><TqJbz8Wh><pre>O4>j:BjPWs</pre><pre>(H=Po?Xw.Hk<[</pre><pre>9`.Jo&Fi0Sx0V</pre><pre>b.Ob`s</pre><pre>.BeRa~u</pre><pre> TŒ#5d'7j7I|8M~Xp</pre><pre>Fs4N{.Lu1RyPp</pre><pre>Id.MS</pre><pre>7j.JtKm</pre><pre>8Gc 9[3Bj8Ht.Cq2Jz<</pre><pre>*<l><pre>?n.Dv</pre><pre>(Ez%Cw/O</pre><pre>GnN^v.Xp</pre><pre>J.hDDjJU</pre><pre>=&}:#{3$</pre><pre>.GnKb~</pre><pre>*:w%9s</pre><pre>>}1El$<g><pre>;n.Hy\&</pre><pre>-0-(0%()(</pre><pre>Cjm.eb</pre><pre>'9=82<.342</pre><pre>%.dn.</pre><pre>-o.SRx-</pre><pre>.Xmw[p</pre><pre>OSQ%c|<</pre><pre>FQf.xwB</pre><pre>\`.cu</pre><pre>m:\JcH</pre><pre>;y$F%flr==G^</pre><pre>.BRC&</pre><pre>o.gQ<</pre><pre>wz|.DFM</pre><pre>Pm.Ac</pre><pre>v/D.Fu</pre><pre>.ml@fBT</pre><pre>JO.OPX</pre><pre>CNotSupportedExceptionk</pre><pre>COMLZ.DL</pre><pre>CmdT"</pre><pre>~.INI</pre><pre>.MSVCRTg8U</pre><pre>.PAVGHTh</pre><pre>-f.De</pre><pre>7%s:%d</pre><pre>xX</pre><pre>mEZ.YM</pre><pre>%fpoj</pre><pre>.Quip</pre><pre>oledlg.dll</pre><pre>notepad1.exe</pre><pre>183.57.57.192</pre><pre>http://ip.qq.com/cgi-bin/index</pre><pre>Microsoft Windows 95</pre><pre>Microsoft Windows 98</pre><pre>Microsoft Windows Millenium Edition</pre><pre>Microsoft Windows 2003</pre><pre>Microsoft Windows XP</pre><pre>Microsoft Windows 2000</pre><pre>Microsoft Windows NT 3.51</pre><pre>Microsoft Windows NT 4.0</pre><pre>Microsoft Windows Vista</pre><pre>Microsoft Windows 7</pre><pre>TP3Helper.exe</pre><pre>http://aq.qq.com/cn2/unionverify/unionverify_jump?jumpname=bind_qqtoken_revry&PTime=0.2534901067286</pre><pre>http://aq.qq.com/cn2/unionverify/pc/pc_uv_send_sms</pre><pre>b@.txt</pre><pre>/hmsx.txt</pre><pre>http://captcha.qq.com/getimage?aid=21000127&r=</pre><pre>http://aq.qq.com/cn2/unionverify/unionverify_jump?jumpname=modifymobile&PTime=0.01982586313531</pre><pre>http://aq.qq.com/cn2/unionverify/pc/pc_uv_verify</pre><pre>window.location.href='(.*)';</pre><pre>?Action=Bind&Type=°ó¶¨Ãܱ£ÊÖ»ú&User=</pre><pre>dxfpz.ini</pre><pre>http://aq.qq.com/cn2/manage/mobile/query_same_mobile_ajax</pre><pre>http://aq.qq.com/cn2/manage/mobile/query_bind_uins_ajax</pre><pre>http://aq.qq.com/cn2/manage/mobile/query_station_ajax</pre><pre>http://aq.qq.com/cn2/manage/mobile/active_sms_ajax?flow_type=change&mobile_number=</pre><pre>http://aq.qq.com/cn2/manage/mobile/verify_mobile_ajax</pre><pre>{result:-1}</pre><pre>http://aq.qq.com/cn2/manage/mobile/change_mobile</pre><pre>QQ.exe</pre><pre>?Action=Bind&Type=°ó¶¨QQÁîÅÆ&User=</pre><pre>http://aq.qq.com/cn2/manage/qqtoken/bind_qqtoken?tlbox_src_id=0</pre><pre>http://aq.qq.com/cn2/unionverify/pc/pc_uv_sms_query</pre><pre>http://captcha.qq.com/getimage?uin=http://tenxunnimabi/sema&aid=21000127&0.8854733550862719</pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_show?type=8</pre><pre>&aid=21000127&u1=http://dnf.qq.com/act/a20090219dltb/&h=1&ptredirect=1&ptlang=2052&daid=8&from_ui=1&dumy=&low_login_enable=0®master=&fp=loginerroralert&action=16-116-1389436820937&mibao_css=&t=2&g=1&js_ver=10063&js_type=1&login_sig=knHhTNFwQthq*GSFdpsyF6EaS8*jMteBFqJBsJiCmMR8bkYQuLD6LJlF-7k4h0Qx&pt_rsa=0</pre><pre>http://ptlogin2.qq.com/login?u=</pre><pre>http://ui.ptlogin2.qq.com/cgi-bin/mibao_vry</pre><pre>http://aq.qq.com/cn/services/abnormal/abnormal_index</pre><pre>&s_url</pre><pre>var hexcase=1;var b64pad="";var chrsz=8;var mode=32;function md5(A){return hex_md5(A)}function hex_md5(A){return binl2hex(core_md5(str2binl(A),A.length*chrsz))}function str_md5(A){return binl2str(core_md5(str2binl(A),A.length*chrsz))}function hex_hmac_md5(A,B){return binl2hex(core_hmac_md5(A,B))}function b64_hmac_md5(A,B){return binl2b64(core_hmac_md5(A,B))}function str_hmac_md5(A,B){return binl2str(core_hmac_md5(A,B))}function core_md5(K,F){K[F>>5]|=128<<((F)2);K[(((F 64)>>>9)<<4) 14]=F;var J=1732584193;var I=-271733879;var H=-1732584194;var G=271733878;for(var C=0;C<K>16){E=core_md5(E,C.length*chrsz)}var A=Array(16),D=Array(16);for(var B=0;B<16;B ){A[B]=E[B]^909522486;D[B]=E[B]^1549556828}var G=core_md5(A.concat(str2binl(F)),512 F.length*chrsz);return core_md5(D.concat(G),512 128)}function safe_add(A,D){var C=(A&65535) (D&65535);var B=(A>>16) (D>>16) (C>>16);return(B<<16)|(C&65535)}function bit_rol(A,B){return(A<<B)|(A>>>(32-B))}function str2binl(D){var C=Array();var A=(1<<chrsz)-1;for(var B=0;B<D>>5]|=(D.charCodeAt(B/chrsz)&A)<<(B2)}return C}function binl2str(C){var D="";var A=(1<<chrsz)-1;for(var B=0;B<C>>5]>>>(B2))&A)}return D}function binl2hex(C){var B=hexcase?"0123456789ABCDEF":"0123456789abcdef";var D="";for(var A=0;A<C>>2]>>((A%4)*8 4))&15) B.charAt((C[A>>2]>>((A%4)*8))&15)}return D}function binl2b64(D){var C="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /";var F="";for(var B=0;B<D>>2]>>8*(B%4))&255)<<16)|(((D[B 1>>2]>>8*((B 1)%4))&255)<<8)|((D[B 2>>2]>>8*((B 2)%4))&255);for(var A=0;A<4;A ){if(B*8 A*6>D.length*32){F =b64pad}else{F =C.charAt((E>>6*(3-A))&63)}}}return F}function hexchar2bin(str){var arr=[];for(var i=0;i<str><pre>GetPassword</pre><pre>http://aq.qq.com/cn2/index</pre><pre>WinHttp.WinHttpRequest.5.1</pre><pre>MSXML2.ServerXMLHTTP.6.0</pre><pre>MSXML2.ServerXMLHTTP.5.0</pre><pre>User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)</pre><pre>Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*</pre><pre>Y@&msg</pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_show?type=2</pre><pre><dd>(\d.*)<.dd></dd></pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_dtmsg_query</pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_verify</pre><pre>http://check.ptlogin2.qq.com/check?uin=</pre><pre>VBScript.RegExp</pre><pre>"&$&&$&&$&&</pre><pre>"$%&$%&$%&</pre><pre>"&$&&$&&</pre><pre>$%&$%&$%&</pre><pre>&3<$%&$&&$%&</pre><pre>"!&$%&$%&</pre><pre>"!&!%&$%&</pre><pre>"!&$%&!%&</pre><pre>"!&!%&!%&</pre><pre>999999999999999</pre><pre>999999999999</pre><pre>.J~-J}-I|-I|,I{,Hz,Gz,Gy,Gw Gw*Fw*Fu*Eu*Eu*Es*Ds)Ds)Cr)Cq(Cq'Cp'Bp'Bo'Ao&@n&@m&?m%?m%>l%>l%>j%>j%>i%>i$=h$=h$<h><pre>IU%ct</pre><pre>IV%ct</pre><pre>JW%ct</pre><pre><s><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "7($<)$/$#% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "1$</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% ",!</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% ":&</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "' !`=)</pre><pre>]/< #(!"% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "1"</pre><pre>12$58(.3"</pre><pre>`*gA%U4</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% ".</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "% "1# \8</pre><pre>)0-&8 -E%U</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "% ".#!`7#</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "% "% "2#</pre><pre>% "% "% "% "% "% "% "% "% "% "% "% "' !G0%d@)</pre><pre>% "% "% "% "% "% "% "% "% "% " !</pre><pre>% "% "% "% "% "% "% "% "% "-"</pre><pre>% "% "% "% "% "% "% "% "% "3&#</pre><pre>% "% "% "% "% "% "% "% "% "?-%</pre><pre>\,\8$1%"% "% "% "% "% "% "% "% "</pre><pre>% "% "% "% "% "% "% "% ":*$</pre><pre>% "% "% "% "% "% "% "5'"</pre><pre>% "% "% "% "% "% "*!</pre><pre>% "% "% "% "% "% "0#</pre><pre>% "% "% "% "% "% "6&!</pre><pre>% "% "% "% "% "% "> "</pre><pre>% "% "% "% "% "</pre><pre>% "% "% "% "% "*""</pre><pre>% "% "% "% "% ",""</pre><pre>% "% "% "% "% "-##</pre><pre>% "% "% "% "% ",#"</pre><pre>[(9)"% "% "% "% "% "</pre><pre>% "% "% "% "% " #"</pre><pre>[(9*"% "% "% "% "% "</pre><pre>Y%uM*</pre><pre>[*:*"% "% "% "% "% "</pre><pre>% "% "% "% "% "(!"</pre><pre>^-9)"% "% "% "% "% "</pre><pre>% "% "% "% "% ")""</pre><pre>^-<*"% "% "% "% "% "</pre><pre>^-> "% "% "% "% "% "</pre><pre>% "% "% "% "% "-$"</pre><pre>% "% "% "% "% "-#"</pre><pre>% "% "% "% "% "/$"</pre><pre>% "% "% "% "% "0$"</pre><pre>% "% "% "% "% "0$!</pre><pre>" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "</pre><pre>" " " " " " " " " " " " " " "</pre><pre>" " " " " "</pre><pre>" " " " " " #! "</pre><pre>" " " " #! "</pre><pre>" " " " " " #!!"</pre><pre>" " " " #!!" " #! "</pre><pre>" " " ! "</pre><pre>""" """ """ """ """ """ ""# """ ""# ""# """ """ """ ""# """ ""# ""# """ """ """ ""# """ ""# !! #$</pre><pre>"#!!!!"#</pre><pre>"#!!!!"" "#</pre><pre>!$!"'!!####!#$!#$ "$!"&!!#"##!#$!#$ "$!#$</pre><pre>!$!"'!!####!#$!#$ "$!"&!!####!#$!#$!#$!#$</pre><pre>!$!"(!!####!#$!#$ "$!"&!!####!#$!#$!#$!#$</pre><pre>!$!"(!!#"##!#$!#$</pre><pre>!$!"(!"#!"$!#$</pre><pre>!$!"(!!#"## #&</pre><pre>$#% &!"&#! $!</pre><pre>'"!&! '#"%#"</pre><pre>#$ '($ "</pre><pre>&"!$#"$#"$""&! )!</pre><pre>&"!$#"%"!%""&"!&</pre><pre>&"!$#"$#"$#"&"!&</pre><pre>&"!$#"%"!&</pre><pre>0*#0$".!</pre><pre> '"*"" $'' #)#$*!</pre><pre>'$ (# )"</pre><pre>&"!)$"&%#%&#%&"'</pre><pre>'"!)$"&%#%%"&&"'"!'! (</pre><pre>'"!)$"&%#%&#%&"'"!'! (</pre><pre>&"!)$"&%"&#!'! (</pre><pre>&"!)%"&#"'! (</pre><pre>#$ #$"#$"%#"$#</pre><pre>$"!#"""%##%##'#(&"(' '&"(*#*($)*$)'#()#('#()")'#))! '" )! '" '#(%$&'#(%$&(#('"*)! '" '#(%$&'#(%$&'$&'$&'$&&#%'"$(&&($''$&'$&&#%'"$(&&)$'&$&'$&'$&'$&&#%'"$(&&*%&(#$)$% &' &')$%*%'*$)*$)*$& &')$%*%'*$)*$))#&)$& &' &')$%*$()#'*%'*$)*$))#()#(*$))#*'#')$'*$))#(*$))#*'#')$'*$)*$))#()#()$)("(*$))#*&#)&"('"(("(*$))#*&#)$"(</pre><pre>#'$)("&*$))#*%"(#!&%"(("&*$))#*&#)$"(</pre><pre>#%"(&!%)$))#*%"(#!&%"(("&*$))#*&#)$"(</pre><pre>#%"($ $'$)%"(</pre><pre>#&"('%*#"'</pre><pre>#$"&$%) #&</pre><pre>88,,/ $'</pre><pre>.6 (0&#*# 1,%*)% *#. #0(%0('0&'/$'0#&0#$0$"0% /'%3-#3,</pre><pre>F%*.*f</pre><pre>CNotSupportedException</pre><pre>commctrl_DragListMsg</pre><pre>Afx:%x:%x:%x:%x:%x</pre><pre>Afx:%x:%x</pre><pre>COMCTL32.DLL</pre><pre>CCmdTarget</pre><pre>__MSVCRT_HEAP_SELECT</pre><pre>iphlpapi.dll</pre><pre>SHLWAPI.dll</pre><pre>MPR.dll</pre><pre>VERSION.dll</pre><pre>WININET.dll</pre><pre>.PAVCException@@</pre><pre>.PAVCNotSupportedException@@</pre><pre>.PAVCFileException@@</pre><pre>(*.prn)|*.prn|</pre><pre>(*.*)|*.*||</pre><pre>Shell32.dll</pre><pre>Mpr.dll</pre><pre>Advapi32.dll</pre><pre>User32.dll</pre><pre>Gdi32.dll</pre><pre>Kernel32.dll</pre><pre>(&07-034/)7 '</pre><pre>?? / %d]</pre><pre>%d / %d]</pre><pre>: %d]</pre><pre>(*.WAV;*.MID)|*.WAV;*.MID|WAV</pre><pre>(*.WAV)|*.WAV|MIDI</pre><pre>(*.MID)|*.MID|</pre><pre>(*.txt)|*.txt|</pre><pre>(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG</pre><pre>(*.JPG)|*.JPG|BMP</pre><pre>(*.BMP)|*.BMP|GIF</pre><pre>(*.GIF)|*.GIF|</pre><pre>(*.ICO)|*.ICO|</pre><pre>(*.CUR)|*.CUR|</pre><pre>%s:%d</pre><pre>windows</pre><pre>out.prn</pre><pre>%d.%d</pre><pre>%d / %d</pre><pre>%d/%d</pre><pre>Bogus message code %d</pre><pre>(%d-%d):</pre><pre>%ld%c</pre><pre>1.1.3</pre><pre>;3 #>6.&</pre><pre>'2, / 0&7!4-)1#</pre><pre>USER32.DLL</pre><pre>.PAVCObject@@</pre><pre>.PAVCSimpleException@@</pre><pre>.PAVCMemoryException@@</pre><pre>.?AVCNotSupportedException@@</pre><pre>.PAVCResourceException@@</pre><pre>.PAVCUserException@@</pre><pre>.?AVCCmdTarget@@</pre><pre>.?AVCCmdUI@@</pre><pre>.?AVCTestCmdUI@@</pre><pre>.PAVCArchiveException@@</pre><pre>q.com</pre><pre>651030; Domain=ip.qq.com; Expires=Fri, 04 Jul 2014 05:07:27 GMT; Path=/; HTTPOnly</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\xslxtnl.exe</pre><pre>#include "l.chs\afxres.rc" // Standard components</pre><pre>WinExec</pre><pre>GetCPInfo</pre><pre>RegOpenKeyExA</pre><pre>RegCreateKeyExA</pre><pre>GetViewportExtEx</pre><pre>GetViewportOrgEx</pre><pre>ScaleViewportExtEx</pre><pre>SetViewportExtEx</pre><pre>OffsetViewportOrgEx</pre><pre>SetViewportOrgEx</pre><pre>GetKeyState</pre><pre>CreateDialogIndirectParamA</pre><pre>UnhookWindowsHookEx</pre><pre>SetWindowsHookExA</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>cbKey</pre><pre>(*.*)</pre><b>MZRTdKAQ.exe_1732:</b><pre>`.rsrc</pre><pre>t$(SSh</pre><pre>~%UVW</pre><pre>u$SShe</pre><pre>advapi32.dll</pre><pre>kernel32.dll</pre><pre>wininet.dll</pre><pre>user32.dll</pre><pre>ole32.dll</pre><pre>atl.dll</pre><pre>OLEACC.DLL</pre><pre>gdi32.dll</pre><pre>MsgWaitForMultipleObjects</pre><pre>GetProcessHeap</pre><pre>HttpOpenRequestA</pre><pre>HttpSendRequestA</pre><pre>HttpQueryInfoA</pre><pre>EnumWindows</pre><pre>RegCreateKeyA</pre><pre>RegOpenKeyA</pre><pre>RegEnumKeyA</pre><pre>RegCloseKey</pre><pre>RegFlushKey</pre><pre>RegDeleteKeyA</pre><pre>{E5000198-4471-40e2-92BC-D0BA075BDBB2}</pre><pre>http://dnf.qq.com/act/a20110523safe/?ADTAG=ied.client.btn.safe</pre><pre>http://dnf.gamebbs.qq.com/forum.php?ADTAG=ied.client.btn.bbs</pre><pre>127.0.0.1</pre><pre>http://117.27.251.199:8082/xia/123.txt</pre><pre>http://</pre><pre>/hmsx.txt</pre><pre>/x666.txt</pre><pre>https://</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)</pre><pre>http=</pre><pre>HTTP/1.1</pre><pre>Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*</pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>http://crm2.qq.com/page/portalpage/wpa.php?uin=40012345&f=1&ty=1&ap=000011:400994:|m:11|f:Gdnf2</pre><pre>http://check.ptlogin2.qq.com/check?uin=</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)</pre><pre>http://captcha.qq.com/getimage?uin=http://tenxunnimabi/sema&aid=21000127&0.8854733550862719</pre><pre>Client.exe</pre><pre>&Pass=</pre><pre>&s_url=http://dnf.qq.com/act/a20090219dltb/&f_url=&ptlang=2052&ptredirect=101&aid=21000127&daid=8&j_later=0&low_login_hour=0®master=0&pt_login_type=1&pt_aid=0&pt_aaid=0&pt_light=0</pre><pre>&service=login&nodirect=0&ptsig=</pre><pre>http://ptlogin4.game.qq.com/check_sig?pttype=1&uin=</pre><pre>http://aq.qq.com/cn2/unionverify/unionverify_jump?jumpname=bind_qqtoken_revry&PTime=0.2534901067286</pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_show?type=8</pre><pre>http://aq.qq.com/cn2/unionverify/unionverify_jump?jumpname=verifyque_risk&PTime=0.04489820876613</pre><pre>https://aq.qq.com/cn2/manage/question/set_question_sel?mb_flow_type=dna&PcacheTime=1394608667</pre><pre>&aid=21000127&u1=http://dnf.qq.com/act/a20090219dltb/&h=1&ptredirect=1&ptlang=2052&daid=8&from_ui=1&dumy=&low_login_enable=0®master=&fp=loginerroralert&action=16-116-1389436820937&mibao_css=&t=2&g=1&js_ver=10063&js_type=1&login_sig=knHhTNFwQthq*GSFdpsyF6EaS8*jMteBFqJBsJiCmMR8bkYQuLD6LJlF-7k4h0Qx&pt_rsa=0</pre><pre>http://ptlogin2.qq.com/login?u=</pre><pre>http://ui.ptlogin2.qq.com/cgi-bin/mibao_vry</pre><pre>http://aq.qq.com/cn/services/abnormal/abnormal_index</pre><pre>&s_url</pre><pre>var hexcase=1;var b64pad="";var chrsz=8;var mode=32;function md5(A){return hex_md5(A)}function hex_md5(A){return binl2hex(core_md5(str2binl(A),A.length*chrsz))}function str_md5(A){return binl2str(core_md5(str2binl(A),A.length*chrsz))}function hex_hmac_md5(A,B){return binl2hex(core_hmac_md5(A,B))}function b64_hmac_md5(A,B){return binl2b64(core_hmac_md5(A,B))}function str_hmac_md5(A,B){return binl2str(core_hmac_md5(A,B))}function core_md5(K,F){K[F>>5]|=128<<((F)2);K[(((F 64)>>>9)<<4) 14]=F;var J=1732584193;var I=-271733879;var H=-1732584194;var G=271733878;for(var C=0;C<K>16){E=core_md5(E,C.length*chrsz)}var A=Array(16),D=Array(16);for(var B=0;B<16;B ){A[B]=E[B]^909522486;D[B]=E[B]^1549556828}var G=core_md5(A.concat(str2binl(F)),512 F.length*chrsz);return core_md5(D.concat(G),512 128)}function safe_add(A,D){var C=(A&65535) (D&65535);var B=(A>>16) (D>>16) (C>>16);return(B<<16)|(C&65535)}function bit_rol(A,B){return(A<<B)|(A>>>(32-B))}function str2binl(D){var C=Array();var A=(1<<chrsz)-1;for(var B=0;B<D>>5]|=(D.charCodeAt(B/chrsz)&A)<<(B2)}return C}function binl2str(C){var D="";var A=(1<<chrsz)-1;for(var B=0;B<C>>5]>>>(B2))&A)}return D}function binl2hex(C){var B=hexcase?"0123456789ABCDEF":"0123456789abcdef";var D="";for(var A=0;A<C>>2]>>((A%4)*8 4))&15) B.charAt((C[A>>2]>>((A%4)*8))&15)}return D}function binl2b64(D){var C="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /";var F="";for(var B=0;B<D>>2]>>8*(B%4))&255)<<16)|(((D[B 1>>2]>>8*((B 1)%4))&255)<<8)|((D[B 2>>2]>>8*((B 2)%4))&255);for(var A=0;A<4;A ){if(B*8 A*6>D.length*32){F =b64pad}else{F =C.charAt((E>>6*(3-A))&63)}}}return F}function hexchar2bin(str){var arr=[];for(var i=0;i<str><pre>GetPassword</pre><pre>http://aq.qq.com/cn2/index</pre><pre>WinHttp.WinHttpRequest.5.1</pre><pre>MSXML2.ServerXMLHTTP.6.0</pre><pre>MSXML2.ServerXMLHTTP.5.0</pre><pre>User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)</pre><pre>Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*</pre><pre>&keyindex=9&pt_aid=21000127&daid=8&u1=http://dnf.qq.com/act/a20090219dltb/&ptopt=1</pre><pre>&clientkey=</pre><pre>http://ptlogin2.qq.com/jump?clientuin=</pre><pre>&Index=³¬¼¶ÁîÅÆģʽ</pre><pre>http://aq.qq.com/cn2/unionverify/unionverify_jump?jumpname=modifymobile&PTime=0.2534901067286</pre><pre>http://aq.qq.com/cn2/unionverify/pc/pc_uv_show?type=2</pre><pre>http://aq.qq.com/cn2/unionverify/pc/pc_uv_send_sms</pre><pre>http://aq.qq.com/cn2/unionverify/unionverify_jump?jumpname=dnasetmobile&PTime=3660091457787</pre><pre>http://xui.ptlogin2.qq.com/cgi-bin/qlogin?domain=qq.com&lang=2052&qtarget=0&jumpname=&ptcss=¶m=u1%3Dhttp%253A%252F%252Fwww.qq.com%252Fqq2012%252FloginSuccess.htm&css=&mibao_css=&low_login=0</pre><pre>javascript:for(var C=0;C<q_aUinList><pre>http://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=dnf&area=</pre><pre>msg:'ok'</pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_dtmsg_query</pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_verify</pre><pre>window.location.href='(.*)';</pre><pre>dxfpz.ini</pre><pre>?Action=Bind&Type=°ó¶¨QQÁîÅÆ&User=</pre><pre>888888888888</pre><pre>https://aq.qq.com/cn2/manage/question/set_question_sel?mb_flow_type=dna&PcacheTime=139509</pre><pre>http://aq.qq.com/cn2/manage/qqtoken/bind_qqtoken?tlbox_src_id=0</pre><pre>QQ.exe</pre><pre>application/x-www-form-urlencoded</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; QQDownload 663; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727)</pre><pre>DNF.exe</pre><pre>TASLogin.exe</pre><pre>http://dnf.qq.com/comm-htdocs/pay/new_index.htm?t=dnf&ADTAG=IED.GameClient.button.pay</pre><pre>\TCLS\config\LoginQ.dat</pre><pre>\DNF.exe</pre><pre>LastLogin=</pre><pre>LastLogin=(\d*)</pre><pre>23.ac[wvq:;6</pre><pre>9& 9& ;&</pre><pre><<4=<754/#$</pre><pre>'(#--3 63 ?<466.</pre><pre>:'!<&!<&!:(</pre><pre>9& 9& 8%</pre><pre>4" 5#!5$</pre><pre>5#!5#!3$</pre><pre>8% 6% 6% 7$</pre><pre>9& 8'!9& <&!<&!9& :(</pre><pre><&!<&!<&!=( =( =( >'</pre><pre>:'!:'!<&!<&!:(</pre><pre>:'!:'!9& 9& 8%</pre><pre>8% 8% 7& :'!<&!='"9& :'!<&!<&!<'</pre><pre>?'"=( =( >'</pre><pre>33 99154/## !"</pre><pre>**"22*44,44,66-11)</pre><pre>00(44,34/#$</pre><pre>'(#..&63 65055-44,/.)</pre><pre>..&33 44,34/</pre><pre>&( 00(74,46.77/51-.-(</pre><pre>W>1\?.\@1W@5C-#C-#C-#A-#A-#C-#D.$D.$B,"D.$E.$F/%G0&E.$E.$E.$F/%F/%E.$C,$C,$C-#= ">'</pre><pre>=( A !D,$E-%E-%E/%E.&E/%C-#C-#E.$G0&H1&I2(I2(G0&E/%@ #C-#C-#C-#A-#A-#E.#Z>/\>0Z=0<"</pre><pre>W>1\?.\@1W@5C-#C-#C-#A-#A-#C-#D-%D.$B,"D.$E.$F/%G0&E.$E-%E-%F.&F.&E-%C,$C,$B #? !?)</pre><pre>,-(13 44,</pre><pre>(( 33 74-57.66.51-.,)</pre><pre>X=0^?.\@1\E:F/%F/%G0&F0%H2'G0&H1'G0%G0%G0%G1&I2'L2(K1(I2(H1'H1'K1(K1(I2(F/'D-%A,$A)!;$</pre><pre>@* E.#H1'H1'K1(L5*K4*I2(I2(H1'J0'K1(J3(N4*O5 N4*I3(G1'F/%F/%F/%E/%E/%H1&Y?0[?0X=0<"</pre><pre>X=0^?.\@1\E:F/%F/%G0&F0%H2'G0&H1'G0&G0&G0%G1&I2'L2)K1(I2(H1'H1'K1(K1(H1'F/'D-%@,"?)</pre><pre>=( D-%G0&J0'K1(L5 K4*K1(I2(H1'H1'K1(J3(N4*O5 N4*I3(G1'F/%F/%F/%E/%E/%H1&Y?0[?0X=0<"</pre><pre>Y>1`?.aA3~aTN4 L5 N4 N4*N4*N4 N4*N4*P6,R8.U9/V:0Y;2aB6gG9gF5bD6_A7Y=3V:0W;1Y;1Q7-F/$7%</pre><pre>Y>1`?.aA3~aTN4 L5 N4 N4*N4*N4 N4*N4*P6,R8.U9/V:1Y;2aA8gG9gE7bC7_A7X<2V:0X<2Y;1S9/L0&?(</pre><pre>,.‰400-</pre><pre>W>1`?.dC2</pre><pre> .4/00-</pre><pre>W>1`?.gC3</pre><pre>..&34///,</pre><pre>W>1`?.gC2</pre><pre>..&34/.. </pre><pre>..&34/,,)</pre><pre>W=3`?.jF5</pre><pre>..&650,,)</pre><pre>..&761,,)</pre><pre>X?2c?.pG5</pre><pre>..&983 (</pre><pre>..&54/))&</pre><pre>..&54/ )&</pre><pre>0-&54/ )&</pre><pre>..&43.))&</pre><pre>..&650))&</pre><pre>..&761))&</pre><pre>..&872))&</pre><pre>..&650''$</pre><pre>..&54/&&#</pre><pre>..&54/''$</pre><pre>..&650&&#</pre><pre>//'650''$</pre><pre>,,$761''$</pre><pre>**"54/''$</pre><pre> #54/''$</pre><pre> #54/((%</pre><pre> #43.''$</pre><pre> #650''$</pre><pre> #872''$</pre><pre> #761$$!</pre><pre> #43.##</pre><pre> #54/$$!</pre><pre>,,$761$$!</pre><pre>,,$872##</pre><pre> #650!!</pre><pre> #54/!!</pre><pre>[<%uXA:$</pre><pre> -g2!!</pre><pre>[<%sXA:$</pre><pre>4$"4% 1&</pre><pre>3%"4$"1$#</pre><pre>3%"3%"1$#</pre><pre>1%"4$"1%"</pre><pre>1$#4##-&"</pre><pre>/%"4$"1%"</pre><pre>3%"6$"1%"</pre><pre>/%"3%"1%"</pre><pre>1%"3%"/%"</pre><pre>1$#4$"1%"</pre><pre>3$#4$"1$#</pre><pre>1%"6$"1%"</pre><pre>/%"3%"4$"</pre><pre>1%"4$"3$#</pre><pre>3%"3%"-&"</pre><pre>/%"4$"3%"</pre><pre>4$"4$"1$#</pre><pre>1$#6##-&"</pre><pre>1%"4$"3%"</pre><pre>6% 6% 3& !</pre><pre>4$"8$"4##</pre><pre>8% 6$"3$#</pre><pre>4$"8$"4$"</pre><pre>3%":#"/%"</pre><pre>3%"8$"4$"</pre><pre>6$"8$"3%"</pre><pre>4$"8$"3%"</pre><pre>3$#8$"4$"</pre><pre>3%":#"4$"</pre><pre>1%"6$":#"</pre><pre>4% 8$"4##</pre><pre>3$#8$"4%</pre><pre>6$"8$"1%"</pre><pre>3%":#"6$"</pre><pre>4$"<#"/%"</pre><pre>4$"6$"3%"</pre><pre>3%"6$"4$"</pre><pre>1%"4$"-&"</pre><pre>0$"3%"</pre><pre>/%"1%".&$</pre><pre>0%"1%"</pre><pre>1%"3%"0&#</pre><pre>0%$4$"3%"</pre><pre>/%"1%".'#</pre><pre>-&"3%"/%"</pre><pre>1%"4$"/%"</pre><pre>.&$1$#4$"</pre><pre>/& 3%"0%$</pre><pre>.&$1%"/&</pre><pre>3$#3$#0%$</pre><pre>0%$4##3$#</pre><pre>3& 1%".&$</pre><pre>/%"3%"/%"</pre><pre>1%"6$"-&"</pre><pre>2%$3%"/%"</pre><pre>/$#4##3%"</pre><pre>1%"3$#1$#</pre><pre>4% 3%"/$#</pre><pre>(*"34/**'</pre><pre>(*"34/))&</pre><pre>(*"450))&</pre><pre>(*"23.((%</pre><pre>(*"561))&</pre><pre>(*"561%%"</pre><pre>S8%U;)E0#3$</pre><pre>R7%U;)E/#3$</pre><pre>S8%U;)E/#4$</pre><pre>S8%U;)E0#4$</pre><pre>G1Î3X;&>'</pre><pre>R7%U;)E/#5#</pre><pre>S8%U;*E/$4#</pre><pre>-(".'".&".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'"/(#3)%/$!</pre><pre>R7%U;)E0$5$</pre><pre>S8%U;)E.#4$</pre><pre>S7%U9*E/$4$</pre><pre>S8%U;*E.#4#</pre><pre>S7%U;*E/$4$</pre><pre>S8%U;)E.#5$</pre><pre>S8%U;)E/"4#</pre><pre>S8%U;(E/#3"</pre><pre>S8%U;)E/!1"</pre><pre>S8%U;)E/#2!</pre><pre>S8%U;)E/#3#</pre><pre>O4"O3"P4"P4!U9%U8&U9%T8&T8&T8&V9%T8&T8&T8&T9%T9%T8&T8&T8&V9%T9%T8&T9%T8&T8&T8&V9%T8&T8&T8&T9%T9%T8&T8&T8&V9%T9%T8&V9%T8&T8&T8&T9%T9%T8&T8&T9%T8%T7&T7&T7&S6%Q4"O4!N3!M2</pre><pre>N3 Q5!Q5!S5#U7&U7%U8$U8$T7%T7&T7%T8$T8$T7%V8$T7%T7%T7%T7%U7#S4"P3!N1</pre><pre>N3 N3 P5"Q6#R5#Q6#P5"P5"N5"Q6#R7$T6$T7#U8$U8$W7%W7%W8$T8$T8$V7%U8$U7%U7%U7%W8$U7%U7%T7%T8$T8$T7%T7%T7%V8$U9%T7%T8$T7%T7%T7%V8$T7%T7%T7%T8$T8$T7%T7%T7%V8$T8$T7%T8$T7%T7%T7%V8$T7%T7%T7%T8$T8$T7%T7%T7%V8$T8$T7%T8$T7%T7%O2!O3 O2!N2!M1 K0</pre><pre>! $&!')!', &,</pre><pre>"' "'!"&""%"!"</pre><pre>%- '.% 1).2')*</pre><pre>#$!$$"%$"$$</pre><pre>aD'kM jM(hK.fI1L-</pre><pre>vU%sR(S5!/</pre><pre>hK.vT&~[&</pre><pre>c1vU%xV$</pre><pre>jL8z[=nL%xV/</pre><pre>p.wT*1</pre><pre>IiK%fL&</pre><pre>R:%uW1</pre><pre>&'"&'"!"</pre><pre> *%1-).-(</pre><pre>')!33 41*.-(</pre><pre>68055-55-12-</pre><pre>33*41*.-(</pre><pre>&( 46.33 55-</pre><pre>33*41*- (</pre><pre>()$.0(44,22*"#</pre><pre>//'3/ (</pre><pre>()$./*44,33 )(#"#</pre><pre>, &) &#$!</pre><pre>''$/0 55-44,0/*12-</pre><pre>''$./*55-55-983</pre><pre>) #13 55,==5??7</pre><pre>"?.6;54/</pre><pre>(*27033000</pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_show?type=2</pre><pre><dd>(\d.*)<.dd></dd></pre><pre>aq.qq.com/cn2/manage/question/set_question_sel</pre><pre>aq.qq.com/cn2/manage/question/set_question_vry</pre><pre>aq.qq.com/cn2/manage/question/dna_question_imp</pre><pre>aq.qq.com/cn2/manage/question/set_question_sel?mb_flow_type=setdir&outurl=setdir&mb_up_from=from_set_question&</pre><pre>aq.qq.com/cn2/manage/question/set_question_mobile</pre><pre>aq.qq.com/cn2/manage/question/setdir_question_imp</pre><pre>aq.qq.com/cn2/unionverify/pc/pc_uv_show?</pre><pre>aq.qq.com/cn2/manage/question/vry_question_imp</pre><pre>http://dnf.qq.com/?ADTAG=ied.client.btn.index</pre><pre>\TCLS\Client.exe</pre><pre>http://dnf.qq.com/cp/a20140106mzhd/page02.shtml#mk04</pre><pre>http://captcha.qq.com/getimage?aid=21000127&r=</pre><pre>(&–2XUQZYU,)%</pre><pre>=:6>;652-&#</pre><pre>('#. &41,52->;6540</pre><pre>41-:7263.&#</pre><pre>$"!)($30 52-52-74/10,</pre><pre>/.*52-63.$#</pre><pre>'&"-,(52-63.63.52-.-)</pre><pre>-,(41,52-43/</pre><pre>'&"1.*63.74/85030 -,(</pre><pre>-,(41,52-</pre><pre>)&"41-63.85074/41-- *</pre><pre> ($52.onjQPLYXTHGC/-,</pre><pre>H0 I2 M4 N5!Q8"R9!T<"W=#X@#ZB#^E$^F%bH%cI&eL'hM)iN'kP)oR*sV*tW*uX*w[ z\*{] }`,</pre><pre> ,(<9410,</pre><pre> ,(63.0/ </pre><pre>-,(740//)</pre><pre>?( ?( ?( >'</pre><pre>-,(:73--'</pre><pre>?( ?( ?( =( >'</pre><pre>=( =( >'</pre><pre>-,(851**$</pre><pre>@)!B(!A*"A*"B #D*#E $B #B #D*#F,%F-#F-#E $C,$B #A*"A*"A*"A*"A*"A*"D !Z=/Z=/X<15"</pre><pre>@)!A*"@)!A*"B #D*#C,$B #B #D*#F,%F-#F-#E $C,$B #A*"A*"A*"A*"A*"A*"D !Z=/Z=/X<15"</pre><pre>-,(63/**$</pre><pre>X=3[>0\>3Z@4E $C,$C,$C,$C,$C,$D-%D-%B #D-%F,%G-&H.'F,%F,%F,%G-&G-&F,%C,$C,$C,$A*"<'</pre><pre>?( A*"E $F,%F,%G-&G-&G-&E $E $F,%H.'I0&J1'J1'H.'G-&B #C,$C,$C,$C,$C,$F-#Z=/[>0X<15"</pre><pre>X=3[>0\>3Z@4E $C,$C,$C,$C,$C,$D-%D-%B #D-%F,%G-&H.'F,%F,%F,%G-&G-&F,%C,$C,$B #A ?)</pre><pre>- *63/*)%</pre><pre>W<2[>0\>3_E9G-&G-&H/%H/%J1'H/%I0&H/%H/%H/%I0&J1'M2(L1'J1'I0&K0&L1'L1'J1'H.'D-%C,$>)!9#</pre><pre>|oQ5*O4*N3)P5 P5 O4*O4*O4*O4*O4*P5 O4*R5,W9.dB5uRDySGtL@oI=nJ@fC9\;2S6-K1*> $aRO</pre><pre>|oQ5*O4*N3)P5 P5 O4*O4*O4*O4*O4*P5 O4*R5,W9.cA4uRDxSEtM?oI=nK>fC9^>3X90Q6,H.'6$</pre><pre>H/%X;2[<3_>5eE:iI>hH=dD9dD9dD9cC8cC8fD7oM@jH;iG:cC6aA4`B7Y;0aC8S7,Q7 S7,[>0[>0Z=45"</pre><pre>vR6 P5 Q6,P5 P5 Q6,P5 P5 P5 P5 P5 Q6,Q7 Q5*W9.aA4</pre><pre>S5*P5 M4*N5 O4*O4*M4*M4*O4*O4*Q6,Q6,O4*O4*O4*Q5*[8.zWJ~ZJvO@xQCoL?bB7P3*@)!2"</pre><pre>; %> $>)!8&</pre><pre>Z8 Z8 Z8 Y7*Z8 Z8 Z8 Z8 [8.Z7-Z7-X8-Z7-X8-Z7-X8-Z7-Z7-Z7-Z8 a?2eD5dC4`@3^>1^>3]=2W7,U5*T4)V6 S5*R4)Q3(Q3(W9.S5*X8-\:-];.]:0Y9.W7,U5*T4)T4)U5*W7,^>3Z:/W7*U5(V3)Y7*\:-^<pre>Z8 Z8 Z8 Y7*Z8 Z8 Z8 Z8 [8.Z7-Z7-X8-Z7-X8-Z7-X8-Z7-Z7-Z7-Z8 a?2eD5bB5`@3^>1\?1Z=/R7)Q3(Q3(R4)S5*S5*R4)S5*Y;0W7,X8-W:,X;-Y9.X8-V6 T4)Q3(Q3(Q3(R4)X:/R6 O3(O1&Q1&S3&U5(X8 _=0^</[9,[9,\:-\:-\:-\:-\:-Z8 \8.\9,Z8 [9,W7*Y9.Y9.X8 Z9*Z9*Y7*\:-a?2_=0];.V4'];.bB5]A65"</pre><pre>- *740*)%</pre><pre>- *962*)%</pre><pre>- *851('#</pre><pre>- *63/('#</pre><pre>-,(63/(("</pre><pre>-,(74/(("</pre><pre>, '850(("</pre><pre>*)t/(("</pre><pre>*)c.(("</pre><pre>*)R-(("</pre><pre>*)…0(("</pre><pre>*)–1''!</pre><pre>*)…0%$</pre><pre>*)c/%$</pre><pre>:"#Q6.kVG'</pre><pre>7! P6.mVG0</pre><pre>()c/%$</pre><pre>()–2%$</pre><pre>)*&962$#</pre><pre>7#"9$ 9%</pre><pre> *&740"!</pre><pre>*)c/"!</pre><pre>*)c/#"</pre><pre>, '851$!</pre><pre> *&851-*&</pre><pre> *&740,)%</pre><pre> *&63/,)%</pre><pre>,*)740,)%</pre><pre>'(&740)&"</pre><pre>!9 #:!$; #8</pre><pre>"4 !4 !6</pre><pre>#4 !4 !6</pre><pre>#4 !5"!8!!8!!7 8"":!$9 #8</pre><pre>\.eF*5</pre><pre>32.ZYU</pre><pre>'&"&%! "</pre><pre> *&-,(,*)</pre><pre>('#41-41,-,(</pre><pre>'%$96263.63.30 </pre><pre>&%!52-30 , '</pre><pre>'%$74030 63.</pre><pre>&%!41,30 , '</pre><pre>)'&1.*63/30,%"</pre><pre>0-(2/*, '!</pre><pre>)($1.*63/41-*'##!</pre><pre> *&, '(%!</pre><pre>('#1.*63/52-1.*20/</pre><pre>(("1.*63/63.:73</pre><pre>*)A,63.>;7>=9</pre><pre>32.ba]utp=:6</pre><pre>(&v2UTP[ZV,('</pre><pre>;84;:6$#</pre><pre> *&, '#"</pre><pre>*'#. '41,52->;6740</pre><pre>21-660$$</pre><pre> ($30,52-52-74/30 </pre><pre>0/ 33-$$</pre><pre>'&", '($#</pre><pre>'&"-,(33-63.63.52-0-(</pre><pre>/.*33-44.</pre><pre>'&"//)44.74/85041,/,'</pre><pre>'&"52-52-85174011 /,'</pre><pre>-,(43//.*</pre><pre>-,(32.-,(</pre><pre>-,(43/.-)</pre><pre>-,(43/*)%</pre><pre>-,(32.*)%</pre><pre>-,(43/ *&</pre><pre>-,(540*)%</pre><pre>-,(651*)%</pre><pre>-,(762)($</pre><pre>-,(540)($</pre><pre>-,(43/('#</pre><pre>-,(32.('#</pre><pre>.-)43/('#</pre><pre>-,(540('#</pre><pre>.-)540('#</pre><pre>-,(651('#</pre><pre>*)e1('#</pre><pre>*)C/('#</pre><pre>*)2.('#</pre><pre>,)e1('#</pre><pre>,)v2('#</pre><pre>,)t0&%!</pre><pre>,)C/%$</pre><pre> ($43/%$</pre><pre>*)C/%$</pre><pre>*)R.%$</pre><pre>*)…1%$</pre><pre>*)–2$#</pre><pre>*)t0"!</pre><pre>*)C/"!</pre><pre> *&43/"!</pre><pre>*)D."!</pre><pre>*)D.""</pre><pre>)($44."!</pre><pre> *&32."!</pre><pre> *&762#"</pre><pre>@)À,'</pre><pre>@)ó.(</pre><pre>A*ó-(</pre><pre>. 0 !/!!.!!/!!. !. !- -</pre><pre>. / !/!!/! / !0"!0!!0"!0""2#"2$#3$"3$#4$#5&$6&$4%$4$#3##0#!/"!.</pre><pre>2!!2!!3!!2! 2!!2!!4 !2 2 2 3!!2 2 0</pre><pre>mO2rR)uS%zX*wS%uR&</pre><pre>[= tR.tP*_?</pre><pre>\.eF*7</pre><pre> *&/,(1.*/,(</pre><pre>.-)1.)//)-,(</pre><pre>('#41-52.41-/,(</pre><pre>, '2/*63.</pre><pre>'&"52-41,22,-,(</pre><pre>'&"2/*2/*#"</pre><pre>o1/.vuq</pre><pre>&%!41,52-33-, '</pre><pre>)($0-)41,%$</pre><pre>0-(52-30,, '</pre><pre>)($1.*52-'&"('#</pre><pre>/,'2/ -,(&$#</pre><pre>('#1.*41,)($</pre><pre> *&.-)'%$</pre><pre>('#1.*2/*, '</pre><pre>*)0,1.)</pre><pre>, '21-10,</pre><pre>0/ - *$"!</pre><pre>'&"/.*/.*</pre><pre>'&"21-*)%"</pre><pre>32.ba]usr=98</pre><pre>984984$#</pre><pre>*)%, '#"</pre><pre>('#-,(41,52->;663/</pre><pre>21-651$#</pre><pre>"#!)($30 52-52-74/41,</pre><pre>0.-52.&#</pre><pre>'&".-)&%!</pre><pre>('#/,'52-63.63.53 0-(</pre><pre>/-,52.63/</pre><pre>)&"1.)63.74/85041,/,'</pre><pre>)&"41,63.85074/41,0-(</pre><pre>)($52.pmiONJVUQGD@1.*</pre><pre>- *740:95</pre><pre>- *52. *&</pre><pre>., 32.*)%</pre><pre>- *32.*)%</pre><pre> ,*32.*)%</pre><pre>- *63/ *&</pre><pre>- *52.*)%</pre><pre>-,(63/*)%</pre><pre>.-)962*)%</pre><pre>-,(850('#</pre><pre>-,(63.('#</pre><pre>-,(63/)($</pre><pre>-,(63/('#</pre><pre>-,(74/('#</pre><pre>, '850('#</pre><pre>*)c.('#</pre><pre>*)c.)($</pre><pre>*)…0('#</pre><pre>*)–1'&"</pre><pre>)($740%$</pre><pre>*('63/%$</pre><pre> )(962%$</pre><pre> )(962#"</pre><pre>*('63/"!</pre><pre>D-%S@6,</pre><pre> )(740"!</pre><pre>E*#E %F,'G-(E %F $A( ?&</pre><pre>"6 !7!"7! 4</pre><pre>^@&qQ.sR ]=</pre><pre>bA {Z)~\.bE-3</pre><pre>`.iI'9</pre><pre>p:\<!0><pre> %/,'1.*0-)</pre><pre>.-)1.*1.*-,(</pre><pre>('#41,52-41-/,(</pre><pre>&%!41,41,21-/,(</pre><pre>'&"2/ 2/*"!</pre><pre>&%!41,52-41-. '</pre><pre>)($1.*30,&%!</pre><pre>0-)52-30,. '</pre><pre>'(&1.*52.'&"('#</pre><pre>-,(1.*/,(&$#</pre><pre>&'#1.*41-)($</pre><pre>,)%.-)'%$</pre><pre>('#1.*2/ , '</pre><pre>*)%2/*1.)</pre><pre>, '30 30 </pre><pre>0/ , '$#</pre><pre>)&"1.*1.*</pre><pre>'%$32.*)% !</pre><pre>~}ylkgVUQED@<;765154032.32.43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/54043/43/43/43/54043/43/43/43/43/43/43/43/32.43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/651984BA=RPOged}|x</pre><pre>http://aq.qq.com/cn2/unionverify/pc/pc_uv_sms_query</pre><pre>http://aq.qq.com/cn2/unionverify/pc/pc_uv_verify</pre><pre>?Action=Bind&Type=°ó¶¨Ãܱ£ÊÖ»ú&User=</pre><pre>88888888888</pre><pre>http://aq.qq.com/cn2/manage/mobile/query_same_mobile_ajax</pre><pre>http://aq.qq.com/cn2/manage/mobile/query_bind_uins_ajax</pre><pre>http://aq.qq.com/cn2/manage/mobile/query_station_ajax</pre><pre>http://aq.qq.com/cn2/manage/mobile/active_sms_ajax?flow_type=change&mobile_number=</pre><pre>http://aq.qq.com/cn2/manage/mobile/verify_mobile_ajax</pre><pre>{result:-1}</pre><pre>http://aq.qq.com/cn2/manage/mobile/change_mobile</pre><pre>http://aq.qq.com/cn2/unionverify/unionverify_jump?jumpname=modifymobile&PTime=0.01982586313531</pre><pre>\TCLS\ui\DNFClient.swf</pre><pre>V6{c%S~</pre><pre>s %d. (0x%Xh)7</pre><pre>ProcessHeap?H.l</pre><pre>.text</pre><pre>`.rd9a</pre><pre>KERNEL32.DLL</pre><pre>ATL.DLL</pre><pre>MSVCRT.dll</pre><pre>OLEAUT32.dll</pre><pre>USER32.dll</pre><pre>CreateActiveX.dll</pre><pre>VBScript.RegExp</pre><pre>javascript:document.onsdragstart=document.onselectstart=document.oncontextmenu=function(){return true}</pre><pre>javascript:document.onselectstart = document.oncontextmenu = document.onmousedown = document.onkeydown = function(){return true;};</pre><pre>var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');</pre><pre>text|password|file</pre><pre>comdlg32.dll</pre><pre>WarnOnHTTPSToHTTPRedirect</pre><pre>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings</pre><pre>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings</pre><pre>%System%\Macromed\Flash\Flash10q.ocx</pre><pre>%System%\Macromed\Flash\Flash10s.ocx</pre><pre>{D27CDB6E-AE6D-11CF-96B8-444553540000}</pre><pre>ProfilePort</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_USERS</pre><pre>H2~F0}E/|C0{B/zE.zE.}E/~F0|D.xC,t? s> s> q? q?*q?*r=)s>*r@ r@ t? wA.wA-v@-t>.t?,s>*t?,s=-t=-s> q?*q?*xB.</pre><pre>G1zE.vE-p@,p@,o? o?*n>)q?*sA-p@,o? r@,w@0vA.u@-sA-sA-q?*q? p=,o< p>*n>*n>*xB.</pre><pre>G1yE.rB.qA-p@,p@ qA-sA-r@,n>*o? r?.u?/uC/uC/vD0tB-qA,o? m>-o>-p@,m? m>-yD1</pre><pre>WCl?-m? n@,m@.m@.n?.mA,n?.n?.n?.n?.o@/qB1qB1q@/p?.q@/r@1qA2o@/m>-p?.mB0~D.</pre><pre>J6{F2rB.n?.qA-sC/uE1tC2sB1rA0n?.q@/s?0tD0uE1tF2sE1qC/n?.m>-m>-m? l?-l>.xF2</pre><pre>[Gi>,m@.l?-j?-k@.nA/nA/nA/o@/n?.m@.nA/qB1sC4tB3qA2o?0p@1qA2rB3pA0rA0jC3</pre><pre>gSwG3vF2uD3qB1oC.lA/k?/zH4</pre><pre>R;yG2mB0i?/l>.qD2pC1lA/j?-lA/qD2~L8</pre><pre>R<zJ5mC><pre>N;~N:sE1oC.qD2vJ5uG3uF5sD3uF5vH4{K7</pre><pre>F0&J0&F/'A,$F0&G0%G0%D/'F0&G1&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&G0&G0&G0&G0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&2</pre><pre>E0(G0&F0&A-#G1'G0&F/%F/'F/'F0&G0&G0&G0&F0&F0&F0&G0&G0&G0&G0&G0&G0&G0&G0&F0&F0ð&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&G0&G0&F0&F0&G0&F0&G1'F0&F0&F0&F0&G1'F0&F0&F0&F0&F0&G0&G0&G0&F/'E0(F0&G0&F0&F0&F0&G0&G0&F0&F0&G1'H1'G1'G1'G1'H1&H1'H1'G1'G1'G1'F0&H1'G0&F0&F0&F0&G0&G0&G0&E0(-</pre><pre>@* >* @* @)</pre><pre>A* A !B,"B,"C-#B,"? !? !@,"C-#E.#E.$E/%C-#B,"A !@* A* A* @* >* @* H1'H0(D/'.</pre><pre>@* B !D-"C-"G0%F/%E.$D.#B,!C-"C,$H/"I/%H1&F/$D.#B,"B !B !A !A !B,"A* I2(G1'D/'.</pre><pre>? !B !B,"@,"A-#C,$C-#D-#D-#C-#C-#C-#E/ð&E/ð&D-#G-$F/ð&D.$B,"A*</pre><pre>C,"H.%F/%H1&G0%E.$F/%H1&H2$J3(J0'K0#L1$T8.hNDK1'H1&H1&E.$D.$C-#C-#D-#H1'F0&D0&,</pre><pre>=( C #C #D-#E/%D.$B,"B,"D.$G0%N4*T8.R7*T6,jLB</pre><pre>?*"C,"A !?*"?*"C*%C-#D.$E.&E.&E/%E/%F/$M3)Q6)Q5 R6,L2)F/%G0%J3(H1&C,"8%</pre><pre>?( @)!A*"@)!E/%D.$C-#@,"D-%F/%M3)U8 U:-T8.W9/X:0Y<pre>?*"A !B,"?*"?)$A)$@ #C,$D-%C,$E/%G0&G0&O5 V:0T8.R6,O5 I2'E.#G0&J0'C-#9& 0</pre><pre>@,"@ #>)!?*"B #E/%D.$C-#B,"B,"D.$M3*Q5 V;.S7-Q5 S7-S7-S7-K1'G-$E-%D-%C,$D-%H1'F0&C.& </pre><pre>@,"D0&>* =( B #E/%E.#F/$D.$C-#F/%H1'L1*W<pre>? !G1'G1'B #C-#I2'J0&J0&H1&J3(L2(K1(I.'T8)Y<pre>C/%C/%;-$"</pre><pre>;) ;("='"?)</pre><pre>@,!E/$F/%C.&*</pre><pre>C/%C/$9 "</pre><pre>;) ;) ;*</pre><pre>=( ='";) 9) =)</pre><pre>A*"F.&L2)T:0R9,K1(G/'F0&C/%@,"@ #B-%C-(G0&I2(R;1H1&I2'H1&J3)D-#L6,>* ;*</pre><pre>;) ;) ?)</pre><pre>=( =( @)</pre><pre>? !D.$H.%G-#G.!H.$F/%E.$D-"D-"C,"B*"C #D-#E.$D-#F/%D-"M3)L2(M3*G-$B !?)</pre><pre>F/%F.&8)#</pre><pre>>* >)!>'</pre><pre>=( ;) ;) :)</pre><pre>=,!< ? !>* ;*</pre><pre>B C,!B,!A A A C-#F/%F/%H.$I0#E/!B,!A B,"B,!B,!B,!? @*</pre><pre>C,"C,"B,"? !? A E.#F/%C.&)</pre><pre>>* >* @)</pre><pre>7& 9) :*!= "?-$>,#?-$>,#= "; "; "; "= "= "= "= "?*":*!:*!:*!;) = "= "<*!>,#?-$>,#= "@ #E/ð&D/'*</pre><pre>D.zE.|C0</pre><pre>M9t?,t> s> p>*q? t> q?*s>*s> t? r@ r@ t?,r=*q? r@,s>*s>*q?*o?*q? s> r@ t? u@,vA-wB.yC/</pre><pre>H2|C0xB.sA-r@,s=-q>-q? q?*r=)s> r@,r@ r@ vA-wA-v@-t>.t?,s>*t?,s=-t=-s> q?*q?*xB.</pre><pre>P<n>*q? q? o>-o? q? o? q? q? o? p@,sA-r@,r@,o? p@,sA-r=*q? o? p@,p@,p@,vA.wA-zD0~E2</n></pre><pre>G4zD0wB.r@,p?.o>-o? n>*q? sA-r@,o? r@,vA.vA.u@-sA-sA-q?*q? p=,o< p>*n>*n>*xB.</pre><pre>H2zD0tB.qA-p@,p@,qA-sA-r@,p>*o? p?.s@/uC/uC/vD0tB-qA,o? m>-o>-p@,m? m>-yD1</pre><pre>WCl?-m? n@,m@.m@.n?.mA,n?.n?.n?.m@.o@/qB1sB1q@/n?.o@/p@1qA2o@/m>-p?.qB1|C0</pre><pre>J3~E2qB1o@/qA-sB1sD3tC2sC/rB.n?.o@/q@/tD0uE1tF2sE1qC/n?.m>-m>-m? l?-l>.xF2</pre><pre>[Gi>,m@.l?-j?-k@.nA/nA/nA/nA/m@.m@.nA/pC1sC4qA2rB3o?0oA1pB2rB3pA0rA0rE3}G3</pre><pre>L6tF6l@1n?.qB1nA/j>.m?/nA/rD0{K7</pre><pre>K5rE3l@0m>-rC2nC1j@0j>.lA/qE0~L8</pre><pre>E0(G0&F0&A-#G1'G0&F/%F/'F/'F0&G0&G0&G0&F0&F0&F0&G0&G0&H1'G0&G0&G0&G0&G0&F0&F0&F0ð&F0&G0&G0&F0&F0&F0&G0%G0%G0&F0&F0&F0&F0&E/$F/'G1'F0&F0&F0&F0&G1'F0ðð%G0&G0&G0&G0&F0ð%F/'F0&F0&F0&G0&H1'G0&G0&G0&G0&H1'H1'G1'G1'G1'G1'H1'H1'G1'G1'G1'F0&H1'G0&F0&F0&F0&G0&G0&G0&E0(-</pre><pre>@* @* @,"B,"C-#B,"A !? !B,"C-#E.#E.$E/%C-#B,"A !@* A* A* @* >* @* H1'H0(D/'.</pre><pre>B D-"D-"G0%F/%E.$E.$C,!D-"C-#H/"I/%H1&F/$D.#B,"B !B !A !A !B,"A* I2(G1'D/'.</pre><pre>? !B !B,"@,"A-#C,$C-#C-#C-#C-#C-#C-#E/ð&E/%E/%D-#G-$F/%G0&D.$B,"@)</pre><pre>A !F/%F/%H1&G0%E.$F/%H1'J0&L2(J0'K0#L1$T8.hNDK1'H1&H1&E.$D.$C-#C-#D-#H1'F0&D0&,</pre><pre>?*"C,"A !?*"?*"C*%C-#D.$E/%E/%E/%E/%F/%M3)Q5 Q5 Q5 L2)F/%G0&J3)H1'C-"8'</pre><pre>@)!A)$C.&D.$C-#@,"B-%E/%O3)U7-U:-T8.W9/X:0Y<pre>?*"A !B,"?*"?)$A)$@,"C,$D-%D-#E/%G0&G0&O5 W;1T8.R6,O5 I2'F/%G0&J3)E.#:(</pre><pre>>)!@*%C.&D.$C-#@,"@ #D.$M3)S5 V;.S7-Q5 S7-S7-S7-K1'G-$E-%D-%C,$D-%H1'F0&C.& </pre><pre>=( @ #E/%E.#F/%D.$C-#F/$J0'L2)W<pre>B,"A !C-#I2'L0&J0&H1'J3(L2(K1(I/&T8)Y<pre>B C,!F/%F.&E.$D-"C-"C,"B !C,"C-#E.$D-#F/%D-"M3)L2(M3*G-$B !?)</pre><pre>=,!>-"?*"@* E.#F0%C/%B.$@,"@,"=,!? !>)!< >* D/'G0(D.$>* ;*</pre><pre>9) :*!>-">,#>,#; "; "= "?*"?*"= "= "= ":*!:*!:*!;) = "= "<*!>,#?-$>,#= "@ #E/ð&D/'*</pre><pre>F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%?)</pre><pre>Y>1^?.[?0U;1@* A !@* ? ? !A !F/%F/%A !B C,!E.#D-"C,!C,!E !D-"C,!A @*</pre><pre>F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%? !C,!Z>/]>-Z=0:#</pre><pre>W>1\?.\@1W@5C-#C-#C-#A-#A-#F/%F/%F/%F/%D.$E.$F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%A-#E.#Z>/\>0Z=0<"</pre><pre>X=0^?.\@1\E:F/%F/%G0&F0%</pre><pre>G1&F/%F/%F/%</pre><pre>F/%F/%F/%F/%F/%F/%</pre><pre>F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%</pre><pre>F/%F/%</pre><pre>F/%F/%F/%F/%</pre><pre>F/%F/%F/%F/%E/%H1&Y?0[?0X=0<"</pre><pre>F/%F/%F/%F/%F/%F/%F/%F/%</pre><pre>F/%F/%F/%F/%F/%</pre><pre>F/%F/%F/%</pre><pre>F/%F/%F/%J3(L2(Y?0[?0X=0:#</pre><pre>F/%F/%F/%K4)L3&[?0\>0Y>1:#</pre><pre>F/%F/%F/%L5*O6)\>0]?1Y=3:#</pre><pre>Y>1`?.aA3~aTN4 L5 F/%F/%F/%</pre><pre>F/%F/%F/%F/%F/%F/%F/%</pre><pre>F/%F/%F/%M6 R7*[?0\=1Z>4:#</pre><pre>h\P4*N4 F/%F/%F/%F/%</pre><pre>F/%F/%F/%P6,T9,[?0Z=0Y>1<"</pre><pre>F/%F/%F/%O5 S8 [?0\>0Y>1:#</pre><pre>}oQ6)N4*F/%F/%</pre><pre>F/%F/%F/%F/%F/%P6,Q8 \>0^?.Z?2:#</pre><pre>vR7*O5 F/%F/%F/%</pre><pre>F/%F/%F/%F/%F/%P6,S7-Z>/\@1W>1:#</pre><pre>Q6)N7-F/%F/%</pre><pre>F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%</pre><pre>F/%F/%F/%F/%F/%N7,Q7-Y>1\@1Y>1<"</pre><pre>Q6)M6,F/%F/%F/%F/%F/%</pre><pre>F/%F/%F/%F/%F/%M6,P6,Y>1\@1Y>1<"</pre><pre>F/%F/%F/%F/%F/%O5,Q5 \=1\?2Y=39"</pre><pre>F/%F/%F/%S5 P4 N4 S5 ]>2]?1X>48#</pre><pre>N2(G3)H2(I2'I2'H2'J3)I3)H2(H1&F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%O5 L5 K4*O5 ]>2^@2Y=38$</pre><pre>M1'F2(E1'I2'H1&F0&H0(G0(G1'G1'F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%L5*N4*L5 H2(J3(^B3_A3[@3:$</pre><pre>F/%F/%F/%F/%F/%F/%F/%F/%F/%B(</pre><pre>F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%I0#I/%N2(Q4'O4'K2%L1$^B3`C2\A4:#</pre><pre>Y:)]9)[:)X8*Y9 [8,Y:)Y9 \:,Y8,Y8,Y8,Y8,Y8,Y8,Y8,[8,Y8,Y8,Y9 `A0fE4cD3aB1_?1_?1^>0Z8*X6(W5'W7)S7(R6'R4&T4&\:,V5)W8,_; ^<.^;/\9-Z7 V6(U4(U5'V6(V7 ]>2Y;-X9(X7%W5'F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%Y9 Y:)Y:)Z8*]:.b@2`>0\<.U5'^=,cD3]B5:#</pre><pre>14:50:59</pre><pre>)*Í?</pre><pre>8:29;3#% $$!* &,-(#$</pre><pre>()$/.)44,55->>6761</pre><pre>23.680$&</pre><pre>#% )*3 55-55-77/32-</pre><pre>01,66.#%</pre><pre>'(#,-(&'"</pre><pre>''$-.)55-55,66-55-./*</pre><pre>/0 55-66. !</pre><pre>)'$10 66.77.88/44,,,)</pre><pre>)'$43.66.88077/43.--*</pre><pre>.0 23.GGD</pre><pre>,.)35-/0 </pre><pre>,.)35--.)</pre><pre>,/'35--/'</pre><pre>,/'35,-/'</pre><pre>,/'46--/'</pre><pre>-/'66-//'</pre><pre>-/'66.//'</pre><pre>-/'66./.)</pre><pre>-/'66--.)</pre><pre>-/'66-/.)</pre><pre>,/'66./.)</pre><pre>-.)66./.)</pre><pre>--*982/-*</pre><pre>0 #6,";2&=3)90$3,</pre><pre>6):@.KG1RE2RG4TG4TF3SG4TI4R</pre><pre>7*;C.LI2UE2RF3SF3SF3SI3TG4T</pre><pre>8 9D.HL3PJ3PL3PK2OK1LJ1JI0H</pre><pre>6)6B BG.GI.FF.CH/GG.FI0HK0H</pre><pre>5(6?)CF/LG1KH1IF/GI.GI.GI0H</pre><pre>5(6@*DI0MI2JJ3KI0II.GM0IH0E</pre><pre>6&5A*BH.IG.GH/GJ/HH-FL/HH0E</pre><pre>6&5@'@F-FE,DF-EI.GI.GJ/HH/G</pre><pre>6&5@)AF,GF-FG.GG-HH.II/JH/H</pre><pre>4'8>)FF/MG.KH/LH/LH/LH/LI0M</pre><pre>5(9@ HG0NI0MI0MG.KH/LH0JH/L</pre><pre>5(6?)CG.KG.KG.KH/LI0MH1NI0N</pre><pre>6):?-JF.SE.QD-PG/PG/PG0NF/M</pre><pre>7'=A*MF.UC/QG/PH.OI.QF.OE0N</pre><pre>5':?(KE-RD-PF.OG-NF-PF.OD/M</pre><pre>3%8='HE,OF.OH.OG/PG.QG0SG/P</pre><pre>5':>)GF-PF.OF.OF-PF-PG.QE/P</pre><pre>6(;?)JH/RG.QE/PE.QG.QH/RG1R</pre><pre>3&<=)KD,SE.QE.QF,QF,QH,QB-Q</pre><pre>3&<=)KE-RF/RG-RF,SF,SF.SE-R</pre><pre>2&9<)ID,QD,QG-RE-TE-TF.SF.S</pre><pre>2&9<)IE-RE-RE-RE-TF.UF.SF.S</pre><pre>4'==)KE-TE-RF.SD/UF.UH.UF.U</pre><pre>%D;Cqfr</pre><pre>2%;<(LE,UE-TE-TE-TD,SH.UF.U</pre><pre>2%;<(LB,WC-UE-TG-TE-TC.TE-T</pre><pre>4%;=(LC-UC-UE-TG-TE-TC.TE-T</pre><pre>2'?;(PB,WB.TB-UB,WC,WC-UC.T</pre><pre>1&>;(PD.YC.VA,TA VC,WB,TB-Q</pre><pre>Ã?r`m)</pre><pre>90z6.tB7</pre><pre>;3u6.lC9~C8</pre><pre>B/v> qB.uH.</pre><pre>P9}E.pH3tXD</pre><pre>H.yK/y[></pre><pre>!3~#5~)9</pre><pre>iXp[FZXAUO>PL=OH6ND0K?-FE.KZ7^}N~uTukRjaHbgQrcQy\R</pre><pre>KDrJ8KQ:ET9MR8PJ6PC3M?.J?-I?-HB.IJ5NV0Tx#s</pre><pre>T*V@.DB0DC0E?.B:*>9*=:)>;)?;*@=-BG6KE5ORHhZStZRvRJoQGm_TydWzdSyhTzjW|hW{cV{XOxMFsIHyW[</pre><pre>P*Q@.DB/EB/E>-B;*?9)=8'=9'>9(>E4I\K`bQl_Sv]Sz\QyWLtK?f\OtaRtdQuiTvjUvjXyhZ{\SvQJqIEqIJ{Wb</pre><pre>_/_D4GC4F?1E<,D='D;Ä";,</pre><pre> *"5,%9,%9,$9'</pre><pre>- #8,%9*"7'</pre><pre>(( 4,$9*"7)"7 "9'</pre><pre>&6-.UNKmgh0</pre><pre>-&!3("4' 4' 5%</pre><pre>,% 2'"4(!5(!5'</pre><pre>0:{);}%;</pre><pre>0(!4)"5)"6)!7)</pre><pre>/'!4)"6(!6(!7*!9)</pre><pre>&D(5Z ?n.Dx/H</pre><pre>/)"6(!6%</pre><pre>1*"7)!7$</pre><pre>2)"7( 6$</pre><pre>,( 1$!4&!4'!5* 7 7 </pre><pre>A..UGW</pre><pre>9'#;'"7"</pre><pre>1*(2*'3'!3'</pre><pre>4( 4(!4("4(!3$</pre><pre>.KwHh</pre><pre>8)'1)&2(#4'!4'!4'!4'!4(!4(!3& 2#</pre><pre>2& 2' 2' 2&</pre><pre>.)#5>8J?9KLGYOL^QWjU^tRZ{MT{9;g#%S</pre><pre>1' 2' 2%</pre><pre>.( 2(!2&</pre><pre>/) 2)!2&</pre><pre>/' 0(!1( 3%</pre><pre>;&$ '%,$! </pre><pre>/' 0(!1)!4&</pre><pre>&$#)&% '%.& /&</pre><pre>0' 0' 0' 0(!0'!1'"2#</pre><pre>,! '$")'$.)#1(!/(!/(!0(!0'!0' 0& 0&!1#</pre><pre>8-!3)!-( ,(!,)"-(#.&".#</pre><pre>*' (",&"-#</pre><pre>*(",'"-$ -# ,#!-'%4D<<MABTHI[^_qU[v;T</pre><pre>!7&#-*%& %$)' &% !!'</pre><pre>02&-4*/-*3"#.</pre><pre>$,"0,"1#</pre><pre>"M&4`4Bh8Hm.Bp7P</pre><pre>$(" ,#1(</pre><pre>!'! *#2& 0#</pre><pre>&%"-*$/*$3 %5(#2$</pre><pre>#$"/(#1*"2,%4(#3#</pre><pre>,"!.$!/(!0%</pre><pre>(! /!!5"!5("0)!/'</pre><pre>.! 4" 4& .%</pre><pre>.,"/) )%</pre><pre>0 "/)",*",(</pre><pre>/&!.)!.."2.</pre><pre>.*!.)!2)!3*</pre><pre>OA.ENIWGCRNJ\]Xma\tZWqRRrEIl'3X</pre><pre>-)!.(!2'</pre><pre>%( *)!-( .&</pre><pre>o>%D@:HEDUVXnTXxJOsHMqMSuNVnLVmCQl2Cc#:f;W</pre><pre>( "..%3.4 :2):%</pre><pre>$-$$-)!- </pre><pre>/ !1.&5'#.!</pre><pre>$0%#- !/-</pre><pre>/. 1/"2%</pre><pre>.CY(:PHXzANw4At*6n</pre><pre> )!,*$-& *%</pre><pre>*)". %.&!)%</pre><pre>)("-*$,& ('</pre><pre>*'!,'"*%</pre><pre> ' .' -$</pre><pre>(!% !,) ,' -%</pre><pre>!2#"-.'.0%.- /)</pre><pre>% &-',-& ! )</pre><pre>1% /'"/'"/'"/'"/'"/("/)"/(!-$</pre><pre>*(!-*!-'</pre><pre>1% .'".'".'".'".'".(".)!-(!-%</pre><pre>5(!0)"-)"-)"-)"-)"-*"-*!,*!,,#/,#/ ". "/,#0*!-)</pre><pre>,)"-)"-)"-)"-)"-*"-*!,(</pre><pre> ) ,*!.) -(</pre><pre> ) ,1'59,?-</pre><pre>*,", ", ", ", "- "- "-,#/*!.) -&</pre><pre>)-&1-#-," " " ", "- "-) &</pre><pre>,$* "* #*/&-1&/3%/6&26#23!27%9>.AA5C:0:7/90(370<93A4/=A=LLHX- <0.AKJ]HI]QRghh~aaw\]q]_q]as\auEPh'5S"7d/G~?_</pre><pre>>.BfXjbVh_Vk]VmXUmVUnSRlRQlRRmIJc7@T8CTT^k`iuR\jDQb<Pm><pre>.Cx(9i6JsI]</pre><pre>.Ky*Kv(Iv,K}.K</pre><pre>D%0W%Dv(N</pre><pre>.FBSnH]</pre><pre>9Jj.Bh-Am*@x%;w</pre><pre>Hj.LwHa</pre><pre>%D~7Q</pre><pre>#Cb.JoMg</pre><pre>%U*DkRo</pre><pre>*Gd%DnNo</pre><pre>*U.IzNk</pre><pre>(@q%Co=^</pre><pre>@7nN%s</pre><pre>23.jjg ,)</pre><pre>-B}AU</pre><pre>r%X^'LI'O?(N< K;.J?2NB5QD7SC6R?/N?-NA-PC-RC-RD.SD.SC,QF)RI(SN(US(VX'W^%[j#b~ t</pre><pre>.AvHP</pre><pre>%F~$Bu</pre><pre>':p%9k(=r.Bx9H</pre><pre>#,:%Dr</pre><pre>4[.Ls8]</pre><pre>/!-T<</pre><pre>@A>01.YYV{{xaa^</pre><pre>=T{.Cl</pre><pre>---666350./,((%''$00-&&#</pre><pre> U.Do?]</pre><pre>)*'%&#/3/12/---/0 22////,,,***%&#&'$12/,,)""</pre><pre>350&'$.. -. </pre><pre>)*'* ($$!#$!()&</pre><pre>%C=TwVp</pre><pre>"W'*?54045035-65064166.65065054/66.66.54/54/55-66.65053054/66.55-54/66.54/54/65066.66.65065056.66.55064165066.66.65055-65065065066.66.65065066.66.65064165066.66.65055.65065065066.66.65065066.66.65053054/66.66.65066.54/65054/66.55-54/65066.66.65064165066.66.65066.65054/65066.66.65065055-66.65064165066.66.54/66.65065065066.55-65065066.66.65064165066.66.54/66.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65046.65084065046.66.65065046.46.65065045046.46.65046.65065065046.46.65065046.46.65064165046.46.76166.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65046.65065066.46.54/42/31.</pre><pre>"# '&&))&**'##</pre><pre>000 ,)#$!</pre><pre>-/'32-53065066.44,32-/-*</pre><pre>0/*32-31./.)* &"#</pre><pre>$ * (***</pre><pre>! '&&%&#</pre><pre>32-55-65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.221-3AESmR`}(-H));42565066.66.65066.43.48?Ha}Wz</pre><pre>#$!.. 20-20- (</pre><pre>* &44155255244122//..!%!</pre><pre>HWTMOIUTOUTOTTLVTMVTMTQITNJXPMSGJFCWFg</pre><pre>((Ï>_`[yzu</pre><pre>%CnHn</pre><pre>))*001#&&</pre><pre>01.EEBJJGMNIOOLFFC&&#</pre><pre>"Dl&Cd<TqJbz8Wh><pre>O4>j:BjPWs</pre><pre>(H=Po?Xw.Hk<[</pre><pre>HHE01.YZW</pre><pre>9`.Jo&Fi0Sx0V</pre><pre>.BeRa~u</pre><pre>.Bz)ArLf</pre><pre> TŒ#5d'7j7I|8M~Xp</pre><pre>,W&=j.Fs4N{.Lu1RyPp</pre><pre>4M|.JtKm</pre><pre>\n|8Gc 9[3Bj8Ht.Cq2Jz9U</pre><pre>*<l><pre>.Ns(Km(Lm-Op)Gh#:[&<[(B]*Fa$@c</pre><pre>(Ez%Cw/O</pre><pre>6^v.Xp6`xKt</pre><pre>J.hDDjJU</pre><pre>%D|#Bw$Bu'Cs</pre><pre>.GnKb~</pre><pre>0z#2y*:w%9s</pre><pre>%D~$F</pre><pre>\%uD;lF\</pre><pre> Ax.EyE^</pre><pre>I%x2Gu'@t1M</pre><pre>T>}1El$<g><pre>;n.Hy\&v</pre><pre>.comment {color:green}</pre><pre>, #&')*)</pre><pre>-0-(0%()(</pre><pre>.rzz{V</pre><pre>ÿRT</pre><pre>Cjm.eb</pre><pre>(7),01444</pre><pre>'9=82<.342</pre><pre>%.dn.</pre><pre>-o.SRx-</pre><pre>PQIE%d</pre><pre>.Xmw[p</pre><pre>OSQ%c|<gVV><pre>Qf.xwB</pre><pre>-BK}B</pre><pre>:!.erK</pre><pre>m:\JcH</pre><pre>%flr==G^</pre><pre>.BRC&</pre><pre>w=.ek</pre><pre>o.gQ<</pre><pre>wz|.DFM</pre><pre>Pm.Ac</pre><pre>.ml@fBT</pre><pre>F%D,3</pre><pre>%*.*f</pre><pre>CNotSupportedException</pre><pre>commctrl_DragListMsg</pre><pre>Afx:%x:%x:%x:%x:%x</pre><pre>Afx:%x:%x</pre><pre>COMCTL32.DLL</pre><pre>CCmdTarget</pre><pre>MSWHEEL_ROLLMSG</pre><pre>__MSVCRT_HEAP_SELECT</pre><pre>iphlpapi.dll</pre><pre>SHLWAPI.dll</pre><pre>MPR.dll</pre><pre>VERSION.dll</pre><pre>WININET.dll</pre><pre>.PAVCException@@</pre><pre>.PAVCNotSupportedException@@</pre><pre>.PAVCFileException@@</pre><pre>(*.prn)|*.prn|</pre><pre>(*.*)|*.*||</pre><pre>Shell32.dll</pre><pre>Mpr.dll</pre><pre>Advapi32.dll</pre><pre>User32.dll</pre><pre>Gdi32.dll</pre><pre>Kernel32.dll</pre><pre>(&07-034/)7 '</pre><pre>?? / %d]</pre><pre>%d / %d]</pre><pre>: %d]</pre><pre>(*.WAV;*.MID)|*.WAV;*.MID|WAV</pre><pre>(*.WAV)|*.WAV|MIDI</pre><pre>(*.MID)|*.MID|</pre><pre>(*.txt)|*.txt|</pre><pre>(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG</pre><pre>(*.JPG)|*.JPG|BMP</pre><pre>(*.BMP)|*.BMP|GIF</pre><pre>(*.GIF)|*.GIF|</pre><pre>(*.ICO)|*.ICO|</pre><pre>(*.CUR)|*.CUR|</pre><pre>%s:%d</pre><pre>windows</pre><pre>out.prn</pre><pre>%d.%d</pre><pre>%d / %d</pre><pre>%d/%d</pre><pre>Bogus message code %d</pre><pre>(%d-%d):</pre><pre>%ld%c</pre><pre>www.dywt.com.cn</pre><pre>USER32.DLL</pre><pre>(*.htm;*.html)|*.htm;*.html</pre><pre>its:%s::%s</pre><pre><tr><td bgcolor="buttonface">Y</td><td bgcolor="white">%d</td></tr></pre><pre><tr><td bgcolor="buttonface">X</td><td bgcolor="white">%d</td></tr></pre><pre><tr><td bgcolor="buttonface">Height</td><td bgcolor="white">%d</td></tr></pre><pre><tr><td bgcolor="buttonface">Width</td><td bgcolor="white">%d</td></tr></pre><pre><tr><td bgcolor="buttonface">RECT</td><td bgcolor="white">(%d, %d)-(%d, %d)</td></tr></pre><pre><tr><td bgcolor="buttonface">Styles</td><td bgcolor="white">0xX</td></tr></pre><pre><tr><td bgcolor="buttonface">Control ID</td><td bgcolor="white">%d</td></tr></pre><pre><tr><td bgcolor="buttonface">Handle</td><td bgcolor="white">0xX</td></tr></pre><pre><table><tr><td><icon handle="0x%X"></icon></td><td>%s</td></tr></table></pre><pre>burlywood</pre><pre>\winhlp32.exe</pre><pre>.PAVCOleException@@</pre><pre>.PAVCObject@@</pre><pre>.PAVCSimpleException@@</pre><pre>.PAVCMemoryException@@</pre><pre>.?AVCNotSupportedException@@</pre><pre>.PAVCResourceException@@</pre><pre>.PAVCUserException@@</pre><pre>.?AVCCmdTarget@@</pre><pre>.?AVCCmdUI@@</pre><pre>.?AVCTestCmdUI@@</pre><pre>.PAVCOleDispatchException@@</pre><pre>.PAVCArchiveException@@</pre><pre>zcÁ</pre><pre>right-curly-bracket</pre><pre>left-curly-bracket</pre><pre>client.exe</pre><pre>c.exe</pre><pre>66.txt</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\MZRTdKAQ.exe</pre><pre>#include "l.chs\afxres.rc" // Standard components</pre><pre>GetCPInfo</pre><pre>GetWindowsDirectoryA</pre><pre>WinExec</pre><pre>RegOpenKeyExA</pre><pre>RegCreateKeyExA</pre><pre>GetViewportExtEx</pre><pre>GetViewportOrgEx</pre><pre>ScaleViewportExtEx</pre><pre>SetViewportExtEx</pre><pre>OffsetViewportOrgEx</pre><pre>SetViewportOrgEx</pre><pre>ShellExecuteA</pre><pre>GetKeyState</pre><pre>SetWindowsHookExA</pre><pre>UnhookWindowsHookEx</pre><pre>CreateDialogIndirectParamA</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>.Quip</pre><pre>ADVAPI32.dll</pre><pre>COMCTL32.dll</pre><pre>GDI32.dll</pre><pre>oledlg.dll</pre><pre>SHELL32.dll</pre><pre>WINMM.dll</pre><pre>WINSPOOL.DRV</pre><pre>WS2_32.dll</pre><pre>(*.*)</pre><b>MZRTdKAQ.exe_1732_rwx_00401000_008BD000:</b><pre>t$(SSh</pre><pre>~%UVW</pre><pre>u$SShe</pre><pre>advapi32.dll</pre><pre>kernel32.dll</pre><pre>wininet.dll</pre><pre>user32.dll</pre><pre>ole32.dll</pre><pre>atl.dll</pre><pre>OLEACC.DLL</pre><pre>gdi32.dll</pre><pre>MsgWaitForMultipleObjects</pre><pre>GetProcessHeap</pre><pre>HttpOpenRequestA</pre><pre>HttpSendRequestA</pre><pre>HttpQueryInfoA</pre><pre>EnumWindows</pre><pre>RegCreateKeyA</pre><pre>RegOpenKeyA</pre><pre>RegEnumKeyA</pre><pre>RegCloseKey</pre><pre>RegFlushKey</pre><pre>RegDeleteKeyA</pre><pre>{E5000198-4471-40e2-92BC-D0BA075BDBB2}</pre><pre>http://dnf.qq.com/act/a20110523safe/?ADTAG=ied.client.btn.safe</pre><pre>http://dnf.gamebbs.qq.com/forum.php?ADTAG=ied.client.btn.bbs</pre><pre>127.0.0.1</pre><pre>http://117.27.251.199:8082/xia/123.txt</pre><pre>http://</pre><pre>/hmsx.txt</pre><pre>/x666.txt</pre><pre>https://</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)</pre><pre>http=</pre><pre>HTTP/1.1</pre><pre>Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*</pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>http://crm2.qq.com/page/portalpage/wpa.php?uin=40012345&f=1&ty=1&ap=000011:400994:|m:11|f:Gdnf2</pre><pre>http://check.ptlogin2.qq.com/check?uin=</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)</pre><pre>http://captcha.qq.com/getimage?uin=http://tenxunnimabi/sema&aid=21000127&0.8854733550862719</pre><pre>Client.exe</pre><pre>&Pass=</pre><pre>&s_url=http://dnf.qq.com/act/a20090219dltb/&f_url=&ptlang=2052&ptredirect=101&aid=21000127&daid=8&j_later=0&low_login_hour=0®master=0&pt_login_type=1&pt_aid=0&pt_aaid=0&pt_light=0</pre><pre>&service=login&nodirect=0&ptsig=</pre><pre>http://ptlogin4.game.qq.com/check_sig?pttype=1&uin=</pre><pre>http://aq.qq.com/cn2/unionverify/unionverify_jump?jumpname=bind_qqtoken_revry&PTime=0.2534901067286</pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_show?type=8</pre><pre>http://aq.qq.com/cn2/unionverify/unionverify_jump?jumpname=verifyque_risk&PTime=0.04489820876613</pre><pre>https://aq.qq.com/cn2/manage/question/set_question_sel?mb_flow_type=dna&PcacheTime=1394608667</pre><pre>&aid=21000127&u1=http://dnf.qq.com/act/a20090219dltb/&h=1&ptredirect=1&ptlang=2052&daid=8&from_ui=1&dumy=&low_login_enable=0®master=&fp=loginerroralert&action=16-116-1389436820937&mibao_css=&t=2&g=1&js_ver=10063&js_type=1&login_sig=knHhTNFwQthq*GSFdpsyF6EaS8*jMteBFqJBsJiCmMR8bkYQuLD6LJlF-7k4h0Qx&pt_rsa=0</pre><pre>http://ptlogin2.qq.com/login?u=</pre><pre>http://ui.ptlogin2.qq.com/cgi-bin/mibao_vry</pre><pre>http://aq.qq.com/cn/services/abnormal/abnormal_index</pre><pre>&s_url</pre><pre>var hexcase=1;var b64pad="";var chrsz=8;var mode=32;function md5(A){return hex_md5(A)}function hex_md5(A){return binl2hex(core_md5(str2binl(A),A.length*chrsz))}function str_md5(A){return binl2str(core_md5(str2binl(A),A.length*chrsz))}function hex_hmac_md5(A,B){return binl2hex(core_hmac_md5(A,B))}function b64_hmac_md5(A,B){return binl2b64(core_hmac_md5(A,B))}function str_hmac_md5(A,B){return binl2str(core_hmac_md5(A,B))}function core_md5(K,F){K[F>>5]|=128<<((F)2);K[(((F 64)>>>9)<<4) 14]=F;var J=1732584193;var I=-271733879;var H=-1732584194;var G=271733878;for(var C=0;C<K>16){E=core_md5(E,C.length*chrsz)}var A=Array(16),D=Array(16);for(var B=0;B<16;B ){A[B]=E[B]^909522486;D[B]=E[B]^1549556828}var G=core_md5(A.concat(str2binl(F)),512 F.length*chrsz);return core_md5(D.concat(G),512 128)}function safe_add(A,D){var C=(A&65535) (D&65535);var B=(A>>16) (D>>16) (C>>16);return(B<<16)|(C&65535)}function bit_rol(A,B){return(A<<B)|(A>>>(32-B))}function str2binl(D){var C=Array();var A=(1<<chrsz)-1;for(var B=0;B<D>>5]|=(D.charCodeAt(B/chrsz)&A)<<(B2)}return C}function binl2str(C){var D="";var A=(1<<chrsz)-1;for(var B=0;B<C>>5]>>>(B2))&A)}return D}function binl2hex(C){var B=hexcase?"0123456789ABCDEF":"0123456789abcdef";var D="";for(var A=0;A<C>>2]>>((A%4)*8 4))&15) B.charAt((C[A>>2]>>((A%4)*8))&15)}return D}function binl2b64(D){var C="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /";var F="";for(var B=0;B<D>>2]>>8*(B%4))&255)<<16)|(((D[B 1>>2]>>8*((B 1)%4))&255)<<8)|((D[B 2>>2]>>8*((B 2)%4))&255);for(var A=0;A<4;A ){if(B*8 A*6>D.length*32){F =b64pad}else{F =C.charAt((E>>6*(3-A))&63)}}}return F}function hexchar2bin(str){var arr=[];for(var i=0;i<str><pre>GetPassword</pre><pre>http://aq.qq.com/cn2/index</pre><pre>WinHttp.WinHttpRequest.5.1</pre><pre>MSXML2.ServerXMLHTTP.6.0</pre><pre>MSXML2.ServerXMLHTTP.5.0</pre><pre>User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)</pre><pre>Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*</pre><pre>&keyindex=9&pt_aid=21000127&daid=8&u1=http://dnf.qq.com/act/a20090219dltb/&ptopt=1</pre><pre>&clientkey=</pre><pre>http://ptlogin2.qq.com/jump?clientuin=</pre><pre>&Index=³¬¼¶ÁîÅÆģʽ</pre><pre>http://aq.qq.com/cn2/unionverify/unionverify_jump?jumpname=modifymobile&PTime=0.2534901067286</pre><pre>http://aq.qq.com/cn2/unionverify/pc/pc_uv_show?type=2</pre><pre>http://aq.qq.com/cn2/unionverify/pc/pc_uv_send_sms</pre><pre>http://aq.qq.com/cn2/unionverify/unionverify_jump?jumpname=dnasetmobile&PTime=3660091457787</pre><pre>http://xui.ptlogin2.qq.com/cgi-bin/qlogin?domain=qq.com&lang=2052&qtarget=0&jumpname=&ptcss=¶m=u1%3Dhttp%253A%252F%252Fwww.qq.com%252Fqq2012%252FloginSuccess.htm&css=&mibao_css=&low_login=0</pre><pre>javascript:for(var C=0;C<q_aUinList><pre>http://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=dnf&area=</pre><pre>msg:'ok'</pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_dtmsg_query</pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_verify</pre><pre>window.location.href='(.*)';</pre><pre>dxfpz.ini</pre><pre>?Action=Bind&Type=°ó¶¨QQÁîÅÆ&User=</pre><pre>888888888888</pre><pre>https://aq.qq.com/cn2/manage/question/set_question_sel?mb_flow_type=dna&PcacheTime=139509</pre><pre>http://aq.qq.com/cn2/manage/qqtoken/bind_qqtoken?tlbox_src_id=0</pre><pre>QQ.exe</pre><pre>application/x-www-form-urlencoded</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; QQDownload 663; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727)</pre><pre>DNF.exe</pre><pre>TASLogin.exe</pre><pre>http://dnf.qq.com/comm-htdocs/pay/new_index.htm?t=dnf&ADTAG=IED.GameClient.button.pay</pre><pre>\TCLS\config\LoginQ.dat</pre><pre>\DNF.exe</pre><pre>LastLogin=</pre><pre>LastLogin=(\d*)</pre><pre>23.ac[wvq:;6</pre><pre>9& 9& ;&</pre><pre><<4=<754/#$</pre><pre>'(#--3 63 ?<466.</pre><pre>:'!<&!<&!:(</pre><pre>9& 9& 8%</pre><pre>4" 5#!5$</pre><pre>5#!5#!3$</pre><pre>8% 6% 6% 7$</pre><pre>9& 8'!9& <&!<&!9& :(</pre><pre><&!<&!<&!=( =( =( >'</pre><pre>:'!:'!<&!<&!:(</pre><pre>:'!:'!9& 9& 8%</pre><pre>8% 8% 7& :'!<&!='"9& :'!<&!<&!<'</pre><pre>?'"=( =( >'</pre><pre>33 99154/## !"</pre><pre>**"22*44,44,66-11)</pre><pre>00(44,34/#$</pre><pre>'(#..&63 65055-44,/.)</pre><pre>..&33 44,34/</pre><pre>&( 00(74,46.77/51-.-(</pre><pre>W>1\?.\@1W@5C-#C-#C-#A-#A-#C-#D.$D.$B,"D.$E.$F/%G0&E.$E.$E.$F/%F/%E.$C,$C,$C-#= ">'</pre><pre>=( A !D,$E-%E-%E/%E.&E/%C-#C-#E.$G0&H1&I2(I2(G0&E/%@ #C-#C-#C-#A-#A-#E.#Z>/\>0Z=0<"</pre><pre>W>1\?.\@1W@5C-#C-#C-#A-#A-#C-#D-%D.$B,"D.$E.$F/%G0&E.$E-%E-%F.&F.&E-%C,$C,$B #? !?)</pre><pre>,-(13 44,</pre><pre>(( 33 74-57.66.51-.,)</pre><pre>X=0^?.\@1\E:F/%F/%G0&F0%H2'G0&H1'G0%G0%G0%G1&I2'L2(K1(I2(H1'H1'K1(K1(I2(F/'D-%A,$A)!;$</pre><pre>@* E.#H1'H1'K1(L5*K4*I2(I2(H1'J0'K1(J3(N4*O5 N4*I3(G1'F/%F/%F/%E/%E/%H1&Y?0[?0X=0<"</pre><pre>X=0^?.\@1\E:F/%F/%G0&F0%H2'G0&H1'G0&G0&G0%G1&I2'L2)K1(I2(H1'H1'K1(K1(H1'F/'D-%@,"?)</pre><pre>=( D-%G0&J0'K1(L5 K4*K1(I2(H1'H1'K1(J3(N4*O5 N4*I3(G1'F/%F/%F/%E/%E/%H1&Y?0[?0X=0<"</pre><pre>Y>1`?.aA3~aTN4 L5 N4 N4*N4*N4 N4*N4*P6,R8.U9/V:0Y;2aB6gG9gF5bD6_A7Y=3V:0W;1Y;1Q7-F/$7%</pre><pre>Y>1`?.aA3~aTN4 L5 N4 N4*N4*N4 N4*N4*P6,R8.U9/V:1Y;2aA8gG9gE7bC7_A7X<2V:0X<2Y;1S9/L0&?(</pre><pre>,.‰400-</pre><pre>W>1`?.dC2</pre><pre> .4/00-</pre><pre>W>1`?.gC3</pre><pre>..&34///,</pre><pre>W>1`?.gC2</pre><pre>..&34/.. </pre><pre>..&34/,,)</pre><pre>W=3`?.jF5</pre><pre>..&650,,)</pre><pre>..&761,,)</pre><pre>X?2c?.pG5</pre><pre>..&983 (</pre><pre>..&54/))&</pre><pre>..&54/ )&</pre><pre>0-&54/ )&</pre><pre>..&43.))&</pre><pre>..&650))&</pre><pre>..&761))&</pre><pre>..&872))&</pre><pre>..&650''$</pre><pre>..&54/&&#</pre><pre>..&54/''$</pre><pre>..&650&&#</pre><pre>//'650''$</pre><pre>,,$761''$</pre><pre>**"54/''$</pre><pre> #54/''$</pre><pre> #54/((%</pre><pre> #43.''$</pre><pre> #650''$</pre><pre> #872''$</pre><pre> #761$$!</pre><pre> #43.##</pre><pre> #54/$$!</pre><pre>,,$761$$!</pre><pre>,,$872##</pre><pre> #650!!</pre><pre> #54/!!</pre><pre>[<%uXA:$</pre><pre> -g2!!</pre><pre>[<%sXA:$</pre><pre>4$"4% 1&</pre><pre>3%"4$"1$#</pre><pre>3%"3%"1$#</pre><pre>1%"4$"1%"</pre><pre>1$#4##-&"</pre><pre>/%"4$"1%"</pre><pre>3%"6$"1%"</pre><pre>/%"3%"1%"</pre><pre>1%"3%"/%"</pre><pre>1$#4$"1%"</pre><pre>3$#4$"1$#</pre><pre>1%"6$"1%"</pre><pre>/%"3%"4$"</pre><pre>1%"4$"3$#</pre><pre>3%"3%"-&"</pre><pre>/%"4$"3%"</pre><pre>4$"4$"1$#</pre><pre>1$#6##-&"</pre><pre>1%"4$"3%"</pre><pre>6% 6% 3& !</pre><pre>4$"8$"4##</pre><pre>8% 6$"3$#</pre><pre>4$"8$"4$"</pre><pre>3%":#"/%"</pre><pre>3%"8$"4$"</pre><pre>6$"8$"3%"</pre><pre>4$"8$"3%"</pre><pre>3$#8$"4$"</pre><pre>3%":#"4$"</pre><pre>1%"6$":#"</pre><pre>4% 8$"4##</pre><pre>3$#8$"4%</pre><pre>6$"8$"1%"</pre><pre>3%":#"6$"</pre><pre>4$"<#"/%"</pre><pre>4$"6$"3%"</pre><pre>3%"6$"4$"</pre><pre>1%"4$"-&"</pre><pre>0$"3%"</pre><pre>/%"1%".&$</pre><pre>0%"1%"</pre><pre>1%"3%"0&#</pre><pre>0%$4$"3%"</pre><pre>/%"1%".'#</pre><pre>-&"3%"/%"</pre><pre>1%"4$"/%"</pre><pre>.&$1$#4$"</pre><pre>/& 3%"0%$</pre><pre>.&$1%"/&</pre><pre>3$#3$#0%$</pre><pre>0%$4##3$#</pre><pre>3& 1%".&$</pre><pre>/%"3%"/%"</pre><pre>1%"6$"-&"</pre><pre>2%$3%"/%"</pre><pre>/$#4##3%"</pre><pre>1%"3$#1$#</pre><pre>4% 3%"/$#</pre><pre>(*"34/**'</pre><pre>(*"34/))&</pre><pre>(*"450))&</pre><pre>(*"23.((%</pre><pre>(*"561))&</pre><pre>(*"561%%"</pre><pre>S8%U;)E0#3$</pre><pre>R7%U;)E/#3$</pre><pre>S8%U;)E/#4$</pre><pre>S8%U;)E0#4$</pre><pre>G1Î3X;&>'</pre><pre>R7%U;)E/#5#</pre><pre>S8%U;*E/$4#</pre><pre>-(".'".&".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'".'"/(#3)%/$!</pre><pre>R7%U;)E0$5$</pre><pre>S8%U;)E.#4$</pre><pre>S7%U9*E/$4$</pre><pre>S8%U;*E.#4#</pre><pre>S7%U;*E/$4$</pre><pre>S8%U;)E.#5$</pre><pre>S8%U;)E/"4#</pre><pre>S8%U;(E/#3"</pre><pre>S8%U;)E/!1"</pre><pre>S8%U;)E/#2!</pre><pre>S8%U;)E/#3#</pre><pre>O4"O3"P4"P4!U9%U8&U9%T8&T8&T8&V9%T8&T8&T8&T9%T9%T8&T8&T8&V9%T9%T8&T9%T8&T8&T8&V9%T8&T8&T8&T9%T9%T8&T8&T8&V9%T9%T8&V9%T8&T8&T8&T9%T9%T8&T8&T9%T8%T7&T7&T7&S6%Q4"O4!N3!M2</pre><pre>N3 Q5!Q5!S5#U7&U7%U8$U8$T7%T7&T7%T8$T8$T7%V8$T7%T7%T7%T7%U7#S4"P3!N1</pre><pre>N3 N3 P5"Q6#R5#Q6#P5"P5"N5"Q6#R7$T6$T7#U8$U8$W7%W7%W8$T8$T8$V7%U8$U7%U7%U7%W8$U7%U7%T7%T8$T8$T7%T7%T7%V8$U9%T7%T8$T7%T7%T7%V8$T7%T7%T7%T8$T8$T7%T7%T7%V8$T8$T7%T8$T7%T7%T7%V8$T7%T7%T7%T8$T8$T7%T7%T7%V8$T8$T7%T8$T7%T7%O2!O3 O2!N2!M1 K0</pre><pre>! $&!')!', &,</pre><pre>"' "'!"&""%"!"</pre><pre>%- '.% 1).2')*</pre><pre>#$!$$"%$"$$</pre><pre>aD'kM jM(hK.fI1L-</pre><pre>vU%sR(S5!/</pre><pre>hK.vT&~[&</pre><pre>c1vU%xV$</pre><pre>jL8z[=nL%xV/</pre><pre>p.wT*1</pre><pre>IiK%fL&</pre><pre>R:%uW1</pre><pre>&'"&'"!"</pre><pre> *%1-).-(</pre><pre>')!33 41*.-(</pre><pre>68055-55-12-</pre><pre>33*41*.-(</pre><pre>&( 46.33 55-</pre><pre>33*41*- (</pre><pre>()$.0(44,22*"#</pre><pre>//'3/ (</pre><pre>()$./*44,33 )(#"#</pre><pre>, &) &#$!</pre><pre>''$/0 55-44,0/*12-</pre><pre>''$./*55-55-983</pre><pre>) #13 55,==5??7</pre><pre>"?.6;54/</pre><pre>(*27033000</pre><pre>https://aq.qq.com/cn2/unionverify/pc/pc_uv_show?type=2</pre><pre><dd>(\d.*)<.dd></dd></pre><pre>aq.qq.com/cn2/manage/question/set_question_sel</pre><pre>aq.qq.com/cn2/manage/question/set_question_vry</pre><pre>aq.qq.com/cn2/manage/question/dna_question_imp</pre><pre>aq.qq.com/cn2/manage/question/set_question_sel?mb_flow_type=setdir&outurl=setdir&mb_up_from=from_set_question&</pre><pre>aq.qq.com/cn2/manage/question/set_question_mobile</pre><pre>aq.qq.com/cn2/manage/question/setdir_question_imp</pre><pre>aq.qq.com/cn2/unionverify/pc/pc_uv_show?</pre><pre>aq.qq.com/cn2/manage/question/vry_question_imp</pre><pre>http://dnf.qq.com/?ADTAG=ied.client.btn.index</pre><pre>\TCLS\Client.exe</pre><pre>http://dnf.qq.com/cp/a20140106mzhd/page02.shtml#mk04</pre><pre>http://captcha.qq.com/getimage?aid=21000127&r=</pre><pre>(&–2XUQZYU,)%</pre><pre>=:6>;652-&#</pre><pre>('#. &41,52->;6540</pre><pre>41-:7263.&#</pre><pre>$"!)($30 52-52-74/10,</pre><pre>/.*52-63.$#</pre><pre>'&"-,(52-63.63.52-.-)</pre><pre>-,(41,52-43/</pre><pre>'&"1.*63.74/85030 -,(</pre><pre>-,(41,52-</pre><pre>)&"41-63.85074/41-- *</pre><pre> ($52.onjQPLYXTHGC/-,</pre><pre>H0 I2 M4 N5!Q8"R9!T<"W=#X@#ZB#^E$^F%bH%cI&eL'hM)iN'kP)oR*sV*tW*uX*w[ z\*{] }`,</pre><pre> ,(<9410,</pre><pre> ,(63.0/ </pre><pre>-,(740//)</pre><pre>?( ?( ?( >'</pre><pre>-,(:73--'</pre><pre>?( ?( ?( =( >'</pre><pre>=( =( >'</pre><pre>-,(851**$</pre><pre>@)!B(!A*"A*"B #D*#E $B #B #D*#F,%F-#F-#E $C,$B #A*"A*"A*"A*"A*"A*"D !Z=/Z=/X<15"</pre><pre>@)!A*"@)!A*"B #D*#C,$B #B #D*#F,%F-#F-#E $C,$B #A*"A*"A*"A*"A*"A*"D !Z=/Z=/X<15"</pre><pre>-,(63/**$</pre><pre>X=3[>0\>3Z@4E $C,$C,$C,$C,$C,$D-%D-%B #D-%F,%G-&H.'F,%F,%F,%G-&G-&F,%C,$C,$C,$A*"<'</pre><pre>?( A*"E $F,%F,%G-&G-&G-&E $E $F,%H.'I0&J1'J1'H.'G-&B #C,$C,$C,$C,$C,$F-#Z=/[>0X<15"</pre><pre>X=3[>0\>3Z@4E $C,$C,$C,$C,$C,$D-%D-%B #D-%F,%G-&H.'F,%F,%F,%G-&G-&F,%C,$C,$B #A ?)</pre><pre>- *63/*)%</pre><pre>W<2[>0\>3_E9G-&G-&H/%H/%J1'H/%I0&H/%H/%H/%I0&J1'M2(L1'J1'I0&K0&L1'L1'J1'H.'D-%C,$>)!9#</pre><pre>|oQ5*O4*N3)P5 P5 O4*O4*O4*O4*O4*P5 O4*R5,W9.dB5uRDySGtL@oI=nJ@fC9\;2S6-K1*> $aRO</pre><pre>|oQ5*O4*N3)P5 P5 O4*O4*O4*O4*O4*P5 O4*R5,W9.cA4uRDxSEtM?oI=nK>fC9^>3X90Q6,H.'6$</pre><pre>H/%X;2[<3_>5eE:iI>hH=dD9dD9dD9cC8cC8fD7oM@jH;iG:cC6aA4`B7Y;0aC8S7,Q7 S7,[>0[>0Z=45"</pre><pre>vR6 P5 Q6,P5 P5 Q6,P5 P5 P5 P5 P5 Q6,Q7 Q5*W9.aA4</pre><pre>S5*P5 M4*N5 O4*O4*M4*M4*O4*O4*Q6,Q6,O4*O4*O4*Q5*[8.zWJ~ZJvO@xQCoL?bB7P3*@)!2"</pre><pre>; %> $>)!8&</pre><pre>Z8 Z8 Z8 Y7*Z8 Z8 Z8 Z8 [8.Z7-Z7-X8-Z7-X8-Z7-X8-Z7-Z7-Z7-Z8 a?2eD5dC4`@3^>1^>3]=2W7,U5*T4)V6 S5*R4)Q3(Q3(W9.S5*X8-\:-];.]:0Y9.W7,U5*T4)T4)U5*W7,^>3Z:/W7*U5(V3)Y7*\:-^<pre>Z8 Z8 Z8 Y7*Z8 Z8 Z8 Z8 [8.Z7-Z7-X8-Z7-X8-Z7-X8-Z7-Z7-Z7-Z8 a?2eD5bB5`@3^>1\?1Z=/R7)Q3(Q3(R4)S5*S5*R4)S5*Y;0W7,X8-W:,X;-Y9.X8-V6 T4)Q3(Q3(Q3(R4)X:/R6 O3(O1&Q1&S3&U5(X8 _=0^</[9,[9,\:-\:-\:-\:-\:-Z8 \8.\9,Z8 [9,W7*Y9.Y9.X8 Z9*Z9*Y7*\:-a?2_=0];.V4'];.bB5]A65"</pre><pre>- *740*)%</pre><pre>- *962*)%</pre><pre>- *851('#</pre><pre>- *63/('#</pre><pre>-,(63/(("</pre><pre>-,(74/(("</pre><pre>, '850(("</pre><pre>*)t/(("</pre><pre>*)c.(("</pre><pre>*)R-(("</pre><pre>*)…0(("</pre><pre>*)–1''!</pre><pre>*)…0%$</pre><pre>*)c/%$</pre><pre>:"#Q6.kVG'</pre><pre>7! P6.mVG0</pre><pre>()c/%$</pre><pre>()–2%$</pre><pre>)*&962$#</pre><pre>7#"9$ 9%</pre><pre> *&740"!</pre><pre>*)c/"!</pre><pre>*)c/#"</pre><pre>, '851$!</pre><pre> *&851-*&</pre><pre> *&740,)%</pre><pre> *&63/,)%</pre><pre>,*)740,)%</pre><pre>'(&740)&"</pre><pre>!9 #:!$; #8</pre><pre>"4 !4 !6</pre><pre>#4 !4 !6</pre><pre>#4 !5"!8!!8!!7 8"":!$9 #8</pre><pre>\.eF*5</pre><pre>32.ZYU</pre><pre>'&"&%! "</pre><pre> *&-,(,*)</pre><pre>('#41-41,-,(</pre><pre>'%$96263.63.30 </pre><pre>&%!52-30 , '</pre><pre>'%$74030 63.</pre><pre>&%!41,30 , '</pre><pre>)'&1.*63/30,%"</pre><pre>0-(2/*, '!</pre><pre>)($1.*63/41-*'##!</pre><pre> *&, '(%!</pre><pre>('#1.*63/52-1.*20/</pre><pre>(("1.*63/63.:73</pre><pre>*)A,63.>;7>=9</pre><pre>32.ba]utp=:6</pre><pre>(&v2UTP[ZV,('</pre><pre>;84;:6$#</pre><pre> *&, '#"</pre><pre>*'#. '41,52->;6740</pre><pre>21-660$$</pre><pre> ($30,52-52-74/30 </pre><pre>0/ 33-$$</pre><pre>'&", '($#</pre><pre>'&"-,(33-63.63.52-0-(</pre><pre>/.*33-44.</pre><pre>'&"//)44.74/85041,/,'</pre><pre>'&"52-52-85174011 /,'</pre><pre>-,(43//.*</pre><pre>-,(32.-,(</pre><pre>-,(43/.-)</pre><pre>-,(43/*)%</pre><pre>-,(32.*)%</pre><pre>-,(43/ *&</pre><pre>-,(540*)%</pre><pre>-,(651*)%</pre><pre>-,(762)($</pre><pre>-,(540)($</pre><pre>-,(43/('#</pre><pre>-,(32.('#</pre><pre>.-)43/('#</pre><pre>-,(540('#</pre><pre>.-)540('#</pre><pre>-,(651('#</pre><pre>*)e1('#</pre><pre>*)C/('#</pre><pre>*)2.('#</pre><pre>,)e1('#</pre><pre>,)v2('#</pre><pre>,)t0&%!</pre><pre>,)C/%$</pre><pre> ($43/%$</pre><pre>*)C/%$</pre><pre>*)R.%$</pre><pre>*)…1%$</pre><pre>*)–2$#</pre><pre>*)t0"!</pre><pre>*)C/"!</pre><pre> *&43/"!</pre><pre>*)D."!</pre><pre>*)D.""</pre><pre>)($44."!</pre><pre> *&32."!</pre><pre> *&762#"</pre><pre>@)À,'</pre><pre>@)ó.(</pre><pre>A*ó-(</pre><pre>. 0 !/!!.!!/!!. !. !- -</pre><pre>. / !/!!/! / !0"!0!!0"!0""2#"2$#3$"3$#4$#5&$6&$4%$4$#3##0#!/"!.</pre><pre>2!!2!!3!!2! 2!!2!!4 !2 2 2 3!!2 2 0</pre><pre>mO2rR)uS%zX*wS%uR&</pre><pre>[= tR.tP*_?</pre><pre>\.eF*7</pre><pre> *&/,(1.*/,(</pre><pre>.-)1.)//)-,(</pre><pre>('#41-52.41-/,(</pre><pre>, '2/*63.</pre><pre>'&"52-41,22,-,(</pre><pre>'&"2/*2/*#"</pre><pre>o1/.vuq</pre><pre>&%!41,52-33-, '</pre><pre>)($0-)41,%$</pre><pre>0-(52-30,, '</pre><pre>)($1.*52-'&"('#</pre><pre>/,'2/ -,(&$#</pre><pre>('#1.*41,)($</pre><pre> *&.-)'%$</pre><pre>('#1.*2/*, '</pre><pre>*)0,1.)</pre><pre>, '21-10,</pre><pre>0/ - *$"!</pre><pre>'&"/.*/.*</pre><pre>'&"21-*)%"</pre><pre>32.ba]usr=98</pre><pre>984984$#</pre><pre>*)%, '#"</pre><pre>('#-,(41,52->;663/</pre><pre>21-651$#</pre><pre>"#!)($30 52-52-74/41,</pre><pre>0.-52.&#</pre><pre>'&".-)&%!</pre><pre>('#/,'52-63.63.53 0-(</pre><pre>/-,52.63/</pre><pre>)&"1.)63.74/85041,/,'</pre><pre>)&"41,63.85074/41,0-(</pre><pre>)($52.pmiONJVUQGD@1.*</pre><pre>- *740:95</pre><pre>- *52. *&</pre><pre>., 32.*)%</pre><pre>- *32.*)%</pre><pre> ,*32.*)%</pre><pre>- *63/ *&</pre><pre>- *52.*)%</pre><pre>-,(63/*)%</pre><pre>.-)962*)%</pre><pre>-,(850('#</pre><pre>-,(63.('#</pre><pre>-,(63/)($</pre><pre>-,(63/('#</pre><pre>-,(74/('#</pre><pre>, '850('#</pre><pre>*)c.('#</pre><pre>*)c.)($</pre><pre>*)…0('#</pre><pre>*)–1'&"</pre><pre>)($740%$</pre><pre>*('63/%$</pre><pre> )(962%$</pre><pre> )(962#"</pre><pre>*('63/"!</pre><pre>D-%S@6,</pre><pre> )(740"!</pre><pre>E*#E %F,'G-(E %F $A( ?&</pre><pre>"6 !7!"7! 4</pre><pre>^@&qQ.sR ]=</pre><pre>bA {Z)~\.bE-3</pre><pre>`.iI'9</pre><pre>p:\<!0><pre> %/,'1.*0-)</pre><pre>.-)1.*1.*-,(</pre><pre>('#41,52-41-/,(</pre><pre>&%!41,41,21-/,(</pre><pre>'&"2/ 2/*"!</pre><pre>&%!41,52-41-. '</pre><pre>)($1.*30,&%!</pre><pre>0-)52-30,. '</pre><pre>'(&1.*52.'&"('#</pre><pre>-,(1.*/,(&$#</pre><pre>&'#1.*41-)($</pre><pre>,)%.-)'%$</pre><pre>('#1.*2/ , '</pre><pre>*)%2/*1.)</pre><pre>, '30 30 </pre><pre>0/ , '$#</pre><pre>)&"1.*1.*</pre><pre>'%$32.*)% !</pre><pre>~}ylkgVUQED@<;765154032.32.43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/54043/43/43/43/54043/43/43/43/43/43/43/43/32.43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/43/651984BA=RPOged}|x</pre><pre>http://aq.qq.com/cn2/unionverify/pc/pc_uv_sms_query</pre><pre>http://aq.qq.com/cn2/unionverify/pc/pc_uv_verify</pre><pre>?Action=Bind&Type=°ó¶¨Ãܱ£ÊÖ»ú&User=</pre><pre>88888888888</pre><pre>http://aq.qq.com/cn2/manage/mobile/query_same_mobile_ajax</pre><pre>http://aq.qq.com/cn2/manage/mobile/query_bind_uins_ajax</pre><pre>http://aq.qq.com/cn2/manage/mobile/query_station_ajax</pre><pre>http://aq.qq.com/cn2/manage/mobile/active_sms_ajax?flow_type=change&mobile_number=</pre><pre>http://aq.qq.com/cn2/manage/mobile/verify_mobile_ajax</pre><pre>{result:-1}</pre><pre>http://aq.qq.com/cn2/manage/mobile/change_mobile</pre><pre>http://aq.qq.com/cn2/unionverify/unionverify_jump?jumpname=modifymobile&PTime=0.01982586313531</pre><pre>\TCLS\ui\DNFClient.swf</pre><pre>V6{c%S~</pre><pre>s %d. (0x%Xh)7</pre><pre>ProcessHeap?H.l</pre><pre>.text</pre><pre>`.rd9a</pre><pre>KERNEL32.DLL</pre><pre>ATL.DLL</pre><pre>MSVCRT.dll</pre><pre>OLEAUT32.dll</pre><pre>USER32.dll</pre><pre>CreateActiveX.dll</pre><pre>VBScript.RegExp</pre><pre>javascript:document.onsdragstart=document.onselectstart=document.oncontextmenu=function(){return true}</pre><pre>javascript:document.onselectstart = document.oncontextmenu = document.onmousedown = document.onkeydown = function(){return true;};</pre><pre>var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');</pre><pre>text|password|file</pre><pre>comdlg32.dll</pre><pre>WarnOnHTTPSToHTTPRedirect</pre><pre>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings</pre><pre>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings</pre><pre>%System%\Macromed\Flash\Flash10q.ocx</pre><pre>%System%\Macromed\Flash\Flash10s.ocx</pre><pre>{D27CDB6E-AE6D-11CF-96B8-444553540000}</pre><pre>ProfilePort</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_USERS</pre><pre>H2~F0}E/|C0{B/zE.zE.}E/~F0|D.xC,t? s> s> q? q?*q?*r=)s>*r@ r@ t? wA.wA-v@-t>.t?,s>*t?,s=-t=-s> q?*q?*xB.</pre><pre>G1zE.vE-p@,p@,o? o?*n>)q?*sA-p@,o? r@,w@0vA.u@-sA-sA-q?*q? p=,o< p>*n>*n>*xB.</pre><pre>G1yE.rB.qA-p@,p@ qA-sA-r@,n>*o? r?.u?/uC/uC/vD0tB-qA,o? m>-o>-p@,m? m>-yD1</pre><pre>WCl?-m? n@,m@.m@.n?.mA,n?.n?.n?.n?.o@/qB1qB1q@/p?.q@/r@1qA2o@/m>-p?.mB0~D.</pre><pre>J6{F2rB.n?.qA-sC/uE1tC2sB1rA0n?.q@/s?0tD0uE1tF2sE1qC/n?.m>-m>-m? l?-l>.xF2</pre><pre>[Gi>,m@.l?-j?-k@.nA/nA/nA/o@/n?.m@.nA/qB1sC4tB3qA2o?0p@1qA2rB3pA0rA0jC3</pre><pre>gSwG3vF2uD3qB1oC.lA/k?/zH4</pre><pre>R;yG2mB0i?/l>.qD2pC1lA/j?-lA/qD2~L8</pre><pre>R<zJ5mC><pre>N;~N:sE1oC.qD2vJ5uG3uF5sD3uF5vH4{K7</pre><pre>F0&J0&F/'A,$F0&G0%G0%D/'F0&G1&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&G0&G0&G0&G0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&2</pre><pre>E0(G0&F0&A-#G1'G0&F/%F/'F/'F0&G0&G0&G0&F0&F0&F0&G0&G0&G0&G0&G0&G0&G0&G0&F0&F0ð&F0&F0&F0&F0&F0&F0&F0&F0&F0&F0&G0&G0&F0&F0&G0&F0&G1'F0&F0&F0&F0&G1'F0&F0&F0&F0&F0&G0&G0&G0&F/'E0(F0&G0&F0&F0&F0&G0&G0&F0&F0&G1'H1'G1'G1'G1'H1&H1'H1'G1'G1'G1'F0&H1'G0&F0&F0&F0&G0&G0&G0&E0(-</pre><pre>@* >* @* @)</pre><pre>A* A !B,"B,"C-#B,"? !? !@,"C-#E.#E.$E/%C-#B,"A !@* A* A* @* >* @* H1'H0(D/'.</pre><pre>@* B !D-"C-"G0%F/%E.$D.#B,!C-"C,$H/"I/%H1&F/$D.#B,"B !B !A !A !B,"A* I2(G1'D/'.</pre><pre>? !B !B,"@,"A-#C,$C-#D-#D-#C-#C-#C-#E/ð&E/ð&D-#G-$F/ð&D.$B,"A*</pre><pre>C,"H.%F/%H1&G0%E.$F/%H1&H2$J3(J0'K0#L1$T8.hNDK1'H1&H1&E.$D.$C-#C-#D-#H1'F0&D0&,</pre><pre>=( C #C #D-#E/%D.$B,"B,"D.$G0%N4*T8.R7*T6,jLB</pre><pre>?*"C,"A !?*"?*"C*%C-#D.$E.&E.&E/%E/%F/$M3)Q6)Q5 R6,L2)F/%G0%J3(H1&C,"8%</pre><pre>?( @)!A*"@)!E/%D.$C-#@,"D-%F/%M3)U8 U:-T8.W9/X:0Y<pre>?*"A !B,"?*"?)$A)$@ #C,$D-%C,$E/%G0&G0&O5 V:0T8.R6,O5 I2'E.#G0&J0'C-#9& 0</pre><pre>@,"@ #>)!?*"B #E/%D.$C-#B,"B,"D.$M3*Q5 V;.S7-Q5 S7-S7-S7-K1'G-$E-%D-%C,$D-%H1'F0&C.& </pre><pre>@,"D0&>* =( B #E/%E.#F/$D.$C-#F/%H1'L1*W<pre>? !G1'G1'B #C-#I2'J0&J0&H1&J3(L2(K1(I.'T8)Y<pre>C/%C/%;-$"</pre><pre>;) ;("='"?)</pre><pre>@,!E/$F/%C.&*</pre><pre>C/%C/$9 "</pre><pre>;) ;) ;*</pre><pre>=( ='";) 9) =)</pre><pre>A*"F.&L2)T:0R9,K1(G/'F0&C/%@,"@ #B-%C-(G0&I2(R;1H1&I2'H1&J3)D-#L6,>* ;*</pre><pre>;) ;) ?)</pre><pre>=( =( @)</pre><pre>? !D.$H.%G-#G.!H.$F/%E.$D-"D-"C,"B*"C #D-#E.$D-#F/%D-"M3)L2(M3*G-$B !?)</pre><pre>F/%F.&8)#</pre><pre>>* >)!>'</pre><pre>=( ;) ;) :)</pre><pre>=,!< ? !>* ;*</pre><pre>B C,!B,!A A A C-#F/%F/%H.$I0#E/!B,!A B,"B,!B,!B,!? @*</pre><pre>C,"C,"B,"? !? A E.#F/%C.&)</pre><pre>>* >* @)</pre><pre>7& 9) :*!= "?-$>,#?-$>,#= "; "; "; "= "= "= "= "?*":*!:*!:*!;) = "= "<*!>,#?-$>,#= "@ #E/ð&D/'*</pre><pre>D.zE.|C0</pre><pre>M9t?,t> s> p>*q? t> q?*s>*s> t? r@ r@ t?,r=*q? r@,s>*s>*q?*o?*q? s> r@ t? u@,vA-wB.yC/</pre><pre>H2|C0xB.sA-r@,s=-q>-q? q?*r=)s> r@,r@ r@ vA-wA-v@-t>.t?,s>*t?,s=-t=-s> q?*q?*xB.</pre><pre>P<n>*q? q? o>-o? q? o? q? q? o? p@,sA-r@,r@,o? p@,sA-r=*q? o? p@,p@,p@,vA.wA-zD0~E2</n></pre><pre>G4zD0wB.r@,p?.o>-o? n>*q? sA-r@,o? r@,vA.vA.u@-sA-sA-q?*q? p=,o< p>*n>*n>*xB.</pre><pre>H2zD0tB.qA-p@,p@,qA-sA-r@,p>*o? p?.s@/uC/uC/vD0tB-qA,o? m>-o>-p@,m? m>-yD1</pre><pre>WCl?-m? n@,m@.m@.n?.mA,n?.n?.n?.m@.o@/qB1sB1q@/n?.o@/p@1qA2o@/m>-p?.qB1|C0</pre><pre>J3~E2qB1o@/qA-sB1sD3tC2sC/rB.n?.o@/q@/tD0uE1tF2sE1qC/n?.m>-m>-m? l?-l>.xF2</pre><pre>[Gi>,m@.l?-j?-k@.nA/nA/nA/nA/m@.m@.nA/pC1sC4qA2rB3o?0oA1pB2rB3pA0rA0rE3}G3</pre><pre>L6tF6l@1n?.qB1nA/j>.m?/nA/rD0{K7</pre><pre>K5rE3l@0m>-rC2nC1j@0j>.lA/qE0~L8</pre><pre>E0(G0&F0&A-#G1'G0&F/%F/'F/'F0&G0&G0&G0&F0&F0&F0&G0&G0&H1'G0&G0&G0&G0&G0&F0&F0&F0ð&F0&G0&G0&F0&F0&F0&G0%G0%G0&F0&F0&F0&F0&E/$F/'G1'F0&F0&F0&F0&G1'F0ðð%G0&G0&G0&G0&F0ð%F/'F0&F0&F0&G0&H1'G0&G0&G0&G0&H1'H1'G1'G1'G1'G1'H1'H1'G1'G1'G1'F0&H1'G0&F0&F0&F0&G0&G0&G0&E0(-</pre><pre>@* @* @,"B,"C-#B,"A !? !B,"C-#E.#E.$E/%C-#B,"A !@* A* A* @* >* @* H1'H0(D/'.</pre><pre>B D-"D-"G0%F/%E.$E.$C,!D-"C-#H/"I/%H1&F/$D.#B,"B !B !A !A !B,"A* I2(G1'D/'.</pre><pre>? !B !B,"@,"A-#C,$C-#C-#C-#C-#C-#C-#E/ð&E/%E/%D-#G-$F/%G0&D.$B,"@)</pre><pre>A !F/%F/%H1&G0%E.$F/%H1'J0&L2(J0'K0#L1$T8.hNDK1'H1&H1&E.$D.$C-#C-#D-#H1'F0&D0&,</pre><pre>?*"C,"A !?*"?*"C*%C-#D.$E/%E/%E/%E/%F/%M3)Q5 Q5 Q5 L2)F/%G0&J3)H1'C-"8'</pre><pre>@)!A)$C.&D.$C-#@,"B-%E/%O3)U7-U:-T8.W9/X:0Y<pre>?*"A !B,"?*"?)$A)$@,"C,$D-%D-#E/%G0&G0&O5 W;1T8.R6,O5 I2'F/%G0&J3)E.#:(</pre><pre>>)!@*%C.&D.$C-#@,"@ #D.$M3)S5 V;.S7-Q5 S7-S7-S7-K1'G-$E-%D-%C,$D-%H1'F0&C.& </pre><pre>=( @ #E/%E.#F/%D.$C-#F/$J0'L2)W<pre>B,"A !C-#I2'L0&J0&H1'J3(L2(K1(I/&T8)Y<pre>B C,!F/%F.&E.$D-"C-"C,"B !C,"C-#E.$D-#F/%D-"M3)L2(M3*G-$B !?)</pre><pre>=,!>-"?*"@* E.#F0%C/%B.$@,"@,"=,!? !>)!< >* D/'G0(D.$>* ;*</pre><pre>9) :*!>-">,#>,#; "; "= "?*"?*"= "= "= ":*!:*!:*!;) = "= "<*!>,#?-$>,#= "@ #E/ð&D/'*</pre><pre>F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%?)</pre><pre>Y>1^?.[?0U;1@* A !@* ? ? !A !F/%F/%A !B C,!E.#D-"C,!C,!E !D-"C,!A @*</pre><pre>F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%? !C,!Z>/]>-Z=0:#</pre><pre>W>1\?.\@1W@5C-#C-#C-#A-#A-#F/%F/%F/%F/%D.$E.$F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%A-#E.#Z>/\>0Z=0<"</pre><pre>X=0^?.\@1\E:F/%F/%G0&F0%</pre><pre>G1&F/%F/%F/%</pre><pre>F/%F/%F/%F/%F/%F/%</pre><pre>F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%</pre><pre>F/%F/%</pre><pre>F/%F/%F/%F/%</pre><pre>F/%F/%F/%F/%E/%H1&Y?0[?0X=0<"</pre><pre>F/%F/%F/%F/%F/%F/%F/%F/%</pre><pre>F/%F/%F/%F/%F/%</pre><pre>F/%F/%F/%</pre><pre>F/%F/%F/%J3(L2(Y?0[?0X=0:#</pre><pre>F/%F/%F/%K4)L3&[?0\>0Y>1:#</pre><pre>F/%F/%F/%L5*O6)\>0]?1Y=3:#</pre><pre>Y>1`?.aA3~aTN4 L5 F/%F/%F/%</pre><pre>F/%F/%F/%F/%F/%F/%F/%</pre><pre>F/%F/%F/%M6 R7*[?0\=1Z>4:#</pre><pre>h\P4*N4 F/%F/%F/%F/%</pre><pre>F/%F/%F/%P6,T9,[?0Z=0Y>1<"</pre><pre>F/%F/%F/%O5 S8 [?0\>0Y>1:#</pre><pre>}oQ6)N4*F/%F/%</pre><pre>F/%F/%F/%F/%F/%P6,Q8 \>0^?.Z?2:#</pre><pre>vR7*O5 F/%F/%F/%</pre><pre>F/%F/%F/%F/%F/%P6,S7-Z>/\@1W>1:#</pre><pre>Q6)N7-F/%F/%</pre><pre>F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%</pre><pre>F/%F/%F/%F/%F/%N7,Q7-Y>1\@1Y>1<"</pre><pre>Q6)M6,F/%F/%F/%F/%F/%</pre><pre>F/%F/%F/%F/%F/%M6,P6,Y>1\@1Y>1<"</pre><pre>F/%F/%F/%F/%F/%O5,Q5 \=1\?2Y=39"</pre><pre>F/%F/%F/%S5 P4 N4 S5 ]>2]?1X>48#</pre><pre>N2(G3)H2(I2'I2'H2'J3)I3)H2(H1&F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%O5 L5 K4*O5 ]>2^@2Y=38$</pre><pre>M1'F2(E1'I2'H1&F0&H0(G0(G1'G1'F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%L5*N4*L5 H2(J3(^B3_A3[@3:$</pre><pre>F/%F/%F/%F/%F/%F/%F/%F/%F/%B(</pre><pre>F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%I0#I/%N2(Q4'O4'K2%L1$^B3`C2\A4:#</pre><pre>Y:)]9)[:)X8*Y9 [8,Y:)Y9 \:,Y8,Y8,Y8,Y8,Y8,Y8,Y8,[8,Y8,Y8,Y9 `A0fE4cD3aB1_?1_?1^>0Z8*X6(W5'W7)S7(R6'R4&T4&\:,V5)W8,_; ^<.^;/\9-Z7 V6(U4(U5'V6(V7 ]>2Y;-X9(X7%W5'F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%F/%Y9 Y:)Y:)Z8*]:.b@2`>0\<.U5'^=,cD3]B5:#</pre><pre>14:50:59</pre><pre>)*Í?</pre><pre>8:29;3#% $$!* &,-(#$</pre><pre>()$/.)44,55->>6761</pre><pre>23.680$&</pre><pre>#% )*3 55-55-77/32-</pre><pre>01,66.#%</pre><pre>'(#,-(&'"</pre><pre>''$-.)55-55,66-55-./*</pre><pre>/0 55-66. !</pre><pre>)'$10 66.77.88/44,,,)</pre><pre>)'$43.66.88077/43.--*</pre><pre>.0 23.GGD</pre><pre>,.)35-/0 </pre><pre>,.)35--.)</pre><pre>,/'35--/'</pre><pre>,/'35,-/'</pre><pre>,/'46--/'</pre><pre>-/'66-//'</pre><pre>-/'66.//'</pre><pre>-/'66./.)</pre><pre>-/'66--.)</pre><pre>-/'66-/.)</pre><pre>,/'66./.)</pre><pre>-.)66./.)</pre><pre>--*982/-*</pre><pre>0 #6,";2&=3)90$3,</pre><pre>6):@.KG1RE2RG4TG4TF3SG4TI4R</pre><pre>7*;C.LI2UE2RF3SF3SF3SI3TG4T</pre><pre>8 9D.HL3PJ3PL3PK2OK1LJ1JI0H</pre><pre>6)6B BG.GI.FF.CH/GG.FI0HK0H</pre><pre>5(6?)CF/LG1KH1IF/GI.GI.GI0H</pre><pre>5(6@*DI0MI2JJ3KI0II.GM0IH0E</pre><pre>6&5A*BH.IG.GH/GJ/HH-FL/HH0E</pre><pre>6&5@'@F-FE,DF-EI.GI.GJ/HH/G</pre><pre>6&5@)AF,GF-FG.GG-HH.II/JH/H</pre><pre>4'8>)FF/MG.KH/LH/LH/LH/LI0M</pre><pre>5(9@ HG0NI0MI0MG.KH/LH0JH/L</pre><pre>5(6?)CG.KG.KG.KH/LI0MH1NI0N</pre><pre>6):?-JF.SE.QD-PG/PG/PG0NF/M</pre><pre>7'=A*MF.UC/QG/PH.OI.QF.OE0N</pre><pre>5':?(KE-RD-PF.OG-NF-PF.OD/M</pre><pre>3%8='HE,OF.OH.OG/PG.QG0SG/P</pre><pre>5':>)GF-PF.OF.OF-PF-PG.QE/P</pre><pre>6(;?)JH/RG.QE/PE.QG.QH/RG1R</pre><pre>3&<=)KD,SE.QE.QF,QF,QH,QB-Q</pre><pre>3&<=)KE-RF/RG-RF,SF,SF.SE-R</pre><pre>2&9<)ID,QD,QG-RE-TE-TF.SF.S</pre><pre>2&9<)IE-RE-RE-RE-TF.UF.SF.S</pre><pre>4'==)KE-TE-RF.SD/UF.UH.UF.U</pre><pre>%D;Cqfr</pre><pre>2%;<(LE,UE-TE-TE-TD,SH.UF.U</pre><pre>2%;<(LB,WC-UE-TG-TE-TC.TE-T</pre><pre>4%;=(LC-UC-UE-TG-TE-TC.TE-T</pre><pre>2'?;(PB,WB.TB-UB,WC,WC-UC.T</pre><pre>1&>;(PD.YC.VA,TA VC,WB,TB-Q</pre><pre>Ã?r`m)</pre><pre>90z6.tB7</pre><pre>;3u6.lC9~C8</pre><pre>B/v> qB.uH.</pre><pre>P9}E.pH3tXD</pre><pre>H.yK/y[></pre><pre>!3~#5~)9</pre><pre>iXp[FZXAUO>PL=OH6ND0K?-FE.KZ7^}N~uTukRjaHbgQrcQy\R</pre><pre>KDrJ8KQ:ET9MR8PJ6PC3M?.J?-I?-HB.IJ5NV0Tx#s</pre><pre>T*V@.DB0DC0E?.B:*>9*=:)>;)?;*@=-BG6KE5ORHhZStZRvRJoQGm_TydWzdSyhTzjW|hW{cV{XOxMFsIHyW[</pre><pre>P*Q@.DB/EB/E>-B;*?9)=8'=9'>9(>E4I\K`bQl_Sv]Sz\QyWLtK?f\OtaRtdQuiTvjUvjXyhZ{\SvQJqIEqIJ{Wb</pre><pre>_/_D4GC4F?1E<,D='D;Ä";,</pre><pre> *"5,%9,%9,$9'</pre><pre>- #8,%9*"7'</pre><pre>(( 4,$9*"7)"7 "9'</pre><pre>&6-.UNKmgh0</pre><pre>-&!3("4' 4' 5%</pre><pre>,% 2'"4(!5(!5'</pre><pre>0:{);}%;</pre><pre>0(!4)"5)"6)!7)</pre><pre>/'!4)"6(!6(!7*!9)</pre><pre>&D(5Z ?n.Dx/H</pre><pre>/)"6(!6%</pre><pre>1*"7)!7$</pre><pre>2)"7( 6$</pre><pre>,( 1$!4&!4'!5* 7 7 </pre><pre>A..UGW</pre><pre>9'#;'"7"</pre><pre>1*(2*'3'!3'</pre><pre>4( 4(!4("4(!3$</pre><pre>.KwHh</pre><pre>8)'1)&2(#4'!4'!4'!4'!4(!4(!3& 2#</pre><pre>2& 2' 2' 2&</pre><pre>.)#5>8J?9KLGYOL^QWjU^tRZ{MT{9;g#%S</pre><pre>1' 2' 2%</pre><pre>.( 2(!2&</pre><pre>/) 2)!2&</pre><pre>/' 0(!1( 3%</pre><pre>;&$ '%,$! </pre><pre>/' 0(!1)!4&</pre><pre>&$#)&% '%.& /&</pre><pre>0' 0' 0' 0(!0'!1'"2#</pre><pre>,! '$")'$.)#1(!/(!/(!0(!0'!0' 0& 0&!1#</pre><pre>8-!3)!-( ,(!,)"-(#.&".#</pre><pre>*' (",&"-#</pre><pre>*(",'"-$ -# ,#!-'%4D<<MABTHI[^_qU[v;T</pre><pre>!7&#-*%& %$)' &% !!'</pre><pre>02&-4*/-*3"#.</pre><pre>$,"0,"1#</pre><pre>"M&4`4Bh8Hm.Bp7P</pre><pre>$(" ,#1(</pre><pre>!'! *#2& 0#</pre><pre>&%"-*$/*$3 %5(#2$</pre><pre>#$"/(#1*"2,%4(#3#</pre><pre>,"!.$!/(!0%</pre><pre>(! /!!5"!5("0)!/'</pre><pre>.! 4" 4& .%</pre><pre>.,"/) )%</pre><pre>0 "/)",*",(</pre><pre>/&!.)!.."2.</pre><pre>.*!.)!2)!3*</pre><pre>OA.ENIWGCRNJ\]Xma\tZWqRRrEIl'3X</pre><pre>-)!.(!2'</pre><pre>%( *)!-( .&</pre><pre>o>%D@:HEDUVXnTXxJOsHMqMSuNVnLVmCQl2Cc#:f;W</pre><pre>( "..%3.4 :2):%</pre><pre>$-$$-)!- </pre><pre>/ !1.&5'#.!</pre><pre>$0%#- !/-</pre><pre>/. 1/"2%</pre><pre>.CY(:PHXzANw4At*6n</pre><pre> )!,*$-& *%</pre><pre>*)". %.&!)%</pre><pre>)("-*$,& ('</pre><pre>*'!,'"*%</pre><pre> ' .' -$</pre><pre>(!% !,) ,' -%</pre><pre>!2#"-.'.0%.- /)</pre><pre>% &-',-& ! )</pre><pre>1% /'"/'"/'"/'"/'"/("/)"/(!-$</pre><pre>*(!-*!-'</pre><pre>1% .'".'".'".'".'".(".)!-(!-%</pre><pre>5(!0)"-)"-)"-)"-)"-*"-*!,*!,,#/,#/ ". "/,#0*!-)</pre><pre>,)"-)"-)"-)"-)"-*"-*!,(</pre><pre> ) ,*!.) -(</pre><pre> ) ,1'59,?-</pre><pre>*,", ", ", ", "- "- "-,#/*!.) -&</pre><pre>)-&1-#-," " " ", "- "-) &</pre><pre>,$* "* #*/&-1&/3%/6&26#23!27%9>.AA5C:0:7/90(370<93A4/=A=LLHX- <0.AKJ]HI]QRghh~aaw\]q]_q]as\auEPh'5S"7d/G~?_</pre><pre>>.BfXjbVh_Vk]VmXUmVUnSRlRQlRRmIJc7@T8CTT^k`iuR\jDQb<Pm><pre>.Cx(9i6JsI]</pre><pre>.Ky*Kv(Iv,K}.K</pre><pre>D%0W%Dv(N</pre><pre>.FBSnH]</pre><pre>9Jj.Bh-Am*@x%;w</pre><pre>Hj.LwHa</pre><pre>%D~7Q</pre><pre>#Cb.JoMg</pre><pre>%U*DkRo</pre><pre>*Gd%DnNo</pre><pre>*U.IzNk</pre><pre>(@q%Co=^</pre><pre>@7nN%s</pre><pre>23.jjg ,)</pre><pre>-B}AU</pre><pre>r%X^'LI'O?(N< K;.J?2NB5QD7SC6R?/N?-NA-PC-RC-RD.SD.SC,QF)RI(SN(US(VX'W^%[j#b~ t</pre><pre>.AvHP</pre><pre>%F~$Bu</pre><pre>':p%9k(=r.Bx9H</pre><pre>#,:%Dr</pre><pre>4[.Ls8]</pre><pre>/!-T<</pre><pre>@A>01.YYV{{xaa^</pre><pre>=T{.Cl</pre><pre>---666350./,((%''$00-&&#</pre><pre> U.Do?]</pre><pre>)*'%&#/3/12/---/0 22////,,,***%&#&'$12/,,)""</pre><pre>350&'$.. -. </pre><pre>)*'* ($$!#$!()&</pre><pre>%C=TwVp</pre><pre>"W'*?54045035-65064166.65065054/66.66.54/54/55-66.65053054/66.55-54/66.54/54/65066.66.65065056.66.55064165066.66.65055-65065065066.66.65065066.66.65064165066.66.65055.65065065066.66.65065066.66.65053054/66.66.65066.54/65054/66.55-54/65066.66.65064165066.66.65066.65054/65066.66.65065055-66.65064165066.66.54/66.65065065066.55-65065066.66.65064165066.66.54/66.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65046.65084065046.66.65065046.46.65065045046.46.65046.65065065046.46.65065046.46.65064165046.46.76166.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65046.65065066.46.54/42/31.</pre><pre>"# '&&))&**'##</pre><pre>000 ,)#$!</pre><pre>-/'32-53065066.44,32-/-*</pre><pre>0/*32-31./.)* &"#</pre><pre>$ * (***</pre><pre>! '&&%&#</pre><pre>32-55-65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.66.65065066.66.65064165066.66.65066.65065065066.221-3AESmR`}(-H));42565066.66.65066.43.48?Ha}Wz</pre><pre>#$!.. 20-20- (</pre><pre>* &44155255244122//..!%!</pre><pre>HWTMOIUTOUTOTTLVTMVTMTQITNJXPMSGJFCWFg</pre><pre>((Ï>_`[yzu</pre><pre>%CnHn</pre><pre>))*001#&&</pre><pre>01.EEBJJGMNIOOLFFC&&#</pre><pre>"Dl&Cd<TqJbz8Wh><pre>O4>j:BjPWs</pre><pre>(H=Po?Xw.Hk<[</pre><pre>HHE01.YZW</pre><pre>9`.Jo&Fi0Sx0V</pre><pre>.BeRa~u</pre><pre>.Bz)ArLf</pre><pre> TŒ#5d'7j7I|8M~Xp</pre><pre>,W&=j.Fs4N{.Lu1RyPp</pre><pre>4M|.JtKm</pre><pre>\n|8Gc 9[3Bj8Ht.Cq2Jz9U</pre><pre>*<l><pre>.Ns(Km(Lm-Op)Gh#:[&<[(B]*Fa$@c</pre><pre>(Ez%Cw/O</pre><pre>6^v.Xp6`xKt</pre><pre>J.hDDjJU</pre><pre>%D|#Bw$Bu'Cs</pre><pre>.GnKb~</pre><pre>0z#2y*:w%9s</pre><pre>%D~$F</pre><pre>\%uD;lF\</pre><pre> Ax.EyE^</pre><pre>I%x2Gu'@t1M</pre><pre>T>}1El$<g><pre>;n.Hy\&v</pre><pre>.comment {color:green}</pre><pre>, #&')*)</pre><pre>-0-(0%()(</pre><pre>.rzz{V</pre><pre>ÿRT</pre><pre>Cjm.eb</pre><pre>(7),01444</pre><pre>'9=82<.342</pre><pre>%.dn.</pre><pre>-o.SRx-</pre><pre>PQIE%d</pre><pre>.Xmw[p</pre><pre>OSQ%c|<gVV><pre>Qf.xwB</pre><pre>-BK}B</pre><pre>:!.erK</pre><pre>m:\JcH</pre><pre>%flr==G^</pre><pre>.BRC&</pre><pre>w=.ek</pre><pre>o.gQ<</pre><pre>wz|.DFM</pre><pre>Pm.Ac</pre><pre>.ml@fBT</pre><pre>F%D,3</pre><pre>%*.*f</pre><pre>CNotSupportedException</pre><pre>commctrl_DragListMsg</pre><pre>Afx:%x:%x:%x:%x:%x</pre><pre>Afx:%x:%x</pre><pre>COMCTL32.DLL</pre><pre>CCmdTarget</pre><pre>MSWHEEL_ROLLMSG</pre><pre>__MSVCRT_HEAP_SELECT</pre><pre>iphlpapi.dll</pre><pre>SHLWAPI.dll</pre><pre>MPR.dll</pre><pre>VERSION.dll</pre><pre>WININET.dll</pre><pre>.PAVCException@@</pre><pre>.PAVCNotSupportedException@@</pre><pre>.PAVCFileException@@</pre><pre>(*.prn)|*.prn|</pre><pre>(*.*)|*.*||</pre><pre>Shell32.dll</pre><pre>Mpr.dll</pre><pre>Advapi32.dll</pre><pre>User32.dll</pre><pre>Gdi32.dll</pre><pre>Kernel32.dll</pre><pre>(&07-034/)7 '</pre><pre>?? / %d]</pre><pre>%d / %d]</pre><pre>: %d]</pre><pre>(*.WAV;*.MID)|*.WAV;*.MID|WAV</pre><pre>(*.WAV)|*.WAV|MIDI</pre><pre>(*.MID)|*.MID|</pre><pre>(*.txt)|*.txt|</pre><pre>(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG</pre><pre>(*.JPG)|*.JPG|BMP</pre><pre>(*.BMP)|*.BMP|GIF</pre><pre>(*.GIF)|*.GIF|</pre><pre>(*.ICO)|*.ICO|</pre><pre>(*.CUR)|*.CUR|</pre><pre>%s:%d</pre><pre>windows</pre><pre>out.prn</pre><pre>%d.%d</pre><pre>%d / %d</pre><pre>%d/%d</pre><pre>Bogus message code %d</pre><pre>(%d-%d):</pre><pre>%ld%c</pre><pre>www.dywt.com.cn</pre><pre>USER32.DLL</pre><pre>(*.htm;*.html)|*.htm;*.html</pre><pre>its:%s::%s</pre><pre><tr><td bgcolor="buttonface">Y</td><td bgcolor="white">%d</td></tr></pre><pre><tr><td bgcolor="buttonface">X</td><td bgcolor="white">%d</td></tr></pre><pre><tr><td bgcolor="buttonface">Height</td><td bgcolor="white">%d</td></tr></pre><pre><tr><td bgcolor="buttonface">Width</td><td bgcolor="white">%d</td></tr></pre><pre><tr><td bgcolor="buttonface">RECT</td><td bgcolor="white">(%d, %d)-(%d, %d)</td></tr></pre><pre><tr><td bgcolor="buttonface">Styles</td><td bgcolor="white">0xX</td></tr></pre><pre><tr><td bgcolor="buttonface">Control ID</td><td bgcolor="white">%d</td></tr></pre><pre><tr><td bgcolor="buttonface">Handle</td><td bgcolor="white">0xX</td></tr></pre><pre><table><tr><td><icon handle="0x%X"></icon></td><td>%s</td></tr></table></pre><pre>burlywood</pre><pre>\winhlp32.exe</pre><pre>.PAVCOleException@@</pre><pre>.PAVCObject@@</pre><pre>.PAVCSimpleException@@</pre><pre>.PAVCMemoryException@@</pre><pre>.?AVCNotSupportedException@@</pre><pre>.PAVCResourceException@@</pre><pre>.PAVCUserException@@</pre><pre>.?AVCCmdTarget@@</pre><pre>.?AVCCmdUI@@</pre><pre>.?AVCTestCmdUI@@</pre><pre>.PAVCOleDispatchException@@</pre><pre>.PAVCArchiveException@@</pre><pre>zcÁ</pre><pre>right-curly-bracket</pre><pre>left-curly-bracket</pre><pre>client.exe</pre><pre>c.exe</pre><pre>66.txt</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\MZRTdKAQ.exe</pre><pre>#include "l.chs\afxres.rc" // Standard components</pre><pre>GetCPInfo</pre><pre>GetWindowsDirectoryA</pre><pre>WinExec</pre><pre>RegOpenKeyExA</pre><pre>RegCreateKeyExA</pre><pre>GetViewportExtEx</pre><pre>GetViewportOrgEx</pre><pre>ScaleViewportExtEx</pre><pre>SetViewportExtEx</pre><pre>OffsetViewportOrgEx</pre><pre>SetViewportOrgEx</pre><pre>ShellExecuteA</pre><pre>GetKeyState</pre><pre>SetWindowsHookExA</pre><pre>UnhookWindowsHookEx</pre><pre>CreateDialogIndirectParamA</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>(*.*)</pre><b>MZRTdKAQ.exe_1732_rwx_10000000_00017000:</b><pre>program internal error number is %d. (0x%Xh)</pre><pre>GetProcessHeap</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>.reloc</pre><pre>V6{c%S~</pre><pre>s %d. (0x%Xh)7</pre><pre>ProcessHeap?H.l</pre><pre>`.rd9a</pre><pre>KERNEL32.DLL</pre><pre>ATL.DLL</pre><pre>MSVCRT.dll</pre><pre>ole32.dll</pre><pre>OLEAUT32.dll</pre><pre>USER32.dll</pre><pre>CreateActiveX.dll</pre></pre></gVV></pre></g></pre></l></pre></TqJbz8Wh></pre></pre></Pm></pre></pre></pre></pre></pre></pre></pre></zJ5mC></pre></!0></pre></pre></q_aUinList></pre></str></D></C></C></D></K></pre></pre></gVV></pre></g></pre></l></pre></TqJbz8Wh></pre></pre></Pm></pre></pre></pre></pre></pre></pre></pre></zJ5mC></pre></!0></pre></pre></q_aUinList></pre></str></D></C></C></D></K></pre></s></pre></h></pre></str></D></C></C></D></K></pre></pre></pre></g></pre></l></pre></pre></TqJbz8Wh></pre></pre></MyOU></pre></L></pre></A></pre></O></pre></s></pre></h></pre></str></D></C></C></D></K></pre></pre></pre></g></pre></l></pre></pre></TqJbz8Wh></pre></pre></MyOU></pre></L></pre></A></pre></O></pre></DZ></pre></kv></pre></Uy9Xx8Vw5Ps5Qs2Oq></pre></dM></pre></DZ></pre></kv></pre></Uy9Xx8Vw5Ps5Qs2Oq></pre></dM>