分析任务

分析类型 虚拟机标签 开始时间 结束时间 持续时间
文件 (Windows) win7-sp1-x64-app01-1 2017-03-17 08:29:56 2017-03-17 08:32:29 153 秒

魔盾分数

10.0

Adware病毒

文件详细信息

文件名 cbcq_Y_905908_feitian.exe
文件大小 1526504 字节
文件类型 PE32 executable (GUI) Intel 80386, for MS Windows
MD5 541b568e01894cbefbe03b247989d533
SHA1 d5b7ee9cb32cdacbdab0a0853a2d5e86b3da6bce
SHA256 228919a72faadd78a4e6346e837268c01b63f796a3f679b42b2a1a8c5ea3fdd8
SHA512 7dbb2ebfbbafc3502953b2a4826e3c337a93c41d3f25ef2d19a450fee6f2df97ba0b89dcf511f6fd70034f4e05e0f582fbfa19040c2a9ab3789c1b80763d1e6c
CRC32 17F834EC
Ssdeep 24576:HzA2nxhCKmwURYdkYfpCczB/S3evj3+BH75UBfX7st5DHsYIBvxUcyOovy/dd:TPxh3dURYdJbzZS3er3+R75UBjodme1+
Yara 登录查看Yara规则
样本下载 提交误报

登录查看威胁特征

运行截图


访问主机纪录 (可点击查询WPING实时安全评级)

直接 IP 安全评级 地理位置
23.41.75.27 美国
23.41.69.163 美国
183.60.225.49 中国
183.60.123.113 中国
14.18.237.132 中国
14.18.237.129 中国
125.88.190.16 中国
101.96.10.75 中国
101.227.98.134 中国
101.227.66.207 中国

域名解析 (可点击查询WPING实时安全评级)

域名 安全评级 响应
aia1.wosign.com CNAME 60aa66a1576a008e.360safedns.com
A 125.88.190.16
a.clickdata.37wan.com A 121.201.30.167
A 183.60.123.113
gameapp.37.com CNAME newgameapp.37.com
A 14.18.237.129
A 121.201.25.129
img1.37wanimg.com CNAME 37w.xdwscache.ourglb0.com
CNAME img1.37wanimg.com.wscdns.com
A 101.227.66.207
A 101.227.98.134
ptres.37.com CNAME ptres.37.com.wscdns.com
my.37.com A 14.18.237.132
CNAME allmy.37.com
A 121.201.25.132
cm.he2d.com A 61.188.87.111
A 183.60.225.49
A 115.231.95.107
CNAME p.ggmm777.com
A 14.18.238.176
A 116.10.189.226
cookiem.37.com CNAME p.huluwa8.com
crl.geotrust.com A 23.41.69.163
CNAME e6845.dscb1.akamaiedge.net
CNAME crl-ds.ws.symantec.com.edgekey.net
g2.symcb.com A 23.41.75.27
CNAME ocsp-ds.ws.symantec.com.edgekey.net
CNAME e8218.dscb1.akamaiedge.net
g1.symcb.com

摘要

登录查看详细行为信息

PE 信息

初始地址 0x00400000
入口地址 0x0040323c
声明校验值 0x0017f439
实际校验值 0x0017f439
最低操作系统版本要求 4.0
编译时间 2009-12-06 06:50:46
载入哈希 099c0646ea7282d232219f8807883be0

版本信息

LegalCopyright
InternalName
FileVersion
CompanyName
ProductName
ProductVersion
FileDescription
Translation

微软证书验证 (Sign Tool)

SHA1 时间戳 有效性 错误
7476bf4c6b03a11233e5d755cd8fde7169503062 Fri Sep 16 23:20:01 2016
A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
证书链 Certificate Chain 1
发行给 Certification Authority of WoSign
发行人 Certification Authority of WoSign
有效期 Mon Aug 08 090001 2039
SHA1 哈希 b94294bf91ea8fb64be61097c7fb001359b676cb
证书链 Certificate Chain 2
发行给 WoSign Class 3 Code Signing CA G2
发行人 Certification Authority of WoSign
有效期 Thu Nov 08 085858 2029
SHA1 哈希 fdf066448e05e060b1b14e542f6de002b59b0c71
证书链 Certificate Chain 3
发行给 Mianyang Yiqu Technology Co. Ltd
发行人 WoSign Class 3 Code Signing CA G2
有效期 Fri Jul 20 171943 2018
SHA1 哈希 de8def1ffceeccc5d3c6be421657f4ba45556a14
证书链 Timestamp Chain 1
发行给 Thawte Timestamping CA
发行人 Thawte Timestamping CA
有效期 Fri Jan 01 075959 2021
SHA1 哈希 be36a4562fb2ee05dbb3d32323adf445084ed656
证书链 Timestamp Chain 2
发行给 Symantec Time Stamping Services CA - G2
发行人 Thawte Timestamping CA
有效期 Thu Dec 31 075959 2020
SHA1 哈希 6c07453ffdda08b83707c09b82fb3d15f35336b1
证书链 Timestamp Chain 3
发行给 Symantec Time Stamping Services Signer - G4
发行人 Symantec Time Stamping Services CA - G2
有效期 Wed Dec 30 075959 2020
SHA1 哈希 65439929b67973eb192d6ff243e6767adf0834e4

PE 数据组成

名称 虚拟地址 虚拟大小 原始数据大小 特征 熵(Entropy)
.text 0x00001000 0x00005a5a 0x00005c00 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.42
.rdata 0x00007000 0x00001190 0x00001200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 5.18
.data 0x00009000 0x0001af98 0x00000400 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4.71
.ndata 0x00024000 0x00014000 0x00000000 IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00
.rsrc 0x00038000 0x00015238 0x00015400 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3.09

导入

库: KERNEL32.dll:
0x407060 CompareFileTime
0x407064 SearchPathA
0x407068 GetShortPathNameA
0x40706c GetFullPathNameA
0x407070 MoveFileA
0x407078 GetFileAttributesA
0x40707c GetLastError
0x407080 CreateDirectoryA
0x407084 SetFileAttributesA
0x407088 Sleep
0x40708c GetTickCount
0x407090 CreateFileA
0x407094 GetFileSize
0x407098 GetModuleFileNameA
0x40709c GetCurrentProcess
0x4070a0 CopyFileA
0x4070a4 ExitProcess
0x4070a8 SetFileTime
0x4070ac GetTempPathA
0x4070b0 GetCommandLineA
0x4070b4 SetErrorMode
0x4070b8 LoadLibraryA
0x4070bc lstrcpynA
0x4070c0 GetDiskFreeSpaceA
0x4070c4 GlobalUnlock
0x4070c8 GlobalLock
0x4070cc CreateThread
0x4070d0 CreateProcessA
0x4070d4 RemoveDirectoryA
0x4070d8 GetTempFileNameA
0x4070dc lstrlenA
0x4070e0 lstrcatA
0x4070e4 GetSystemDirectoryA
0x4070e8 GetVersion
0x4070ec CloseHandle
0x4070f0 lstrcmpiA
0x4070f4 lstrcmpA
0x4070fc GlobalFree
0x407100 GlobalAlloc
0x407104 WaitForSingleObject
0x407108 GetExitCodeProcess
0x40710c GetModuleHandleA
0x407110 LoadLibraryExA
0x407114 GetProcAddress
0x407118 FreeLibrary
0x40711c MultiByteToWideChar
0x407128 WriteFile
0x40712c ReadFile
0x407130 MulDiv
0x407134 SetFilePointer
0x407138 FindClose
0x40713c FindNextFileA
0x407140 FindFirstFileA
0x407144 DeleteFileA
库: USER32.dll:
0x40716c EndDialog
0x407170 ScreenToClient
0x407174 GetWindowRect
0x407178 EnableMenuItem
0x40717c GetSystemMenu
0x407180 SetClassLongA
0x407184 IsWindowEnabled
0x407188 SetWindowPos
0x40718c GetSysColor
0x407190 GetWindowLongA
0x407194 SetCursor
0x407198 LoadCursorA
0x40719c CheckDlgButton
0x4071a0 GetMessagePos
0x4071a4 LoadBitmapA
0x4071a8 CallWindowProcA
0x4071ac IsWindowVisible
0x4071b0 CloseClipboard
0x4071b4 SetClipboardData
0x4071b8 EmptyClipboard
0x4071bc RegisterClassA
0x4071c0 TrackPopupMenu
0x4071c4 AppendMenuA
0x4071c8 CreatePopupMenu
0x4071cc GetSystemMetrics
0x4071d0 SetDlgItemTextA
0x4071d4 GetDlgItemTextA
0x4071d8 MessageBoxIndirectA
0x4071dc CharPrevA
0x4071e0 DispatchMessageA
0x4071e4 PeekMessageA
0x4071e8 DestroyWindow
0x4071ec CreateDialogParamA
0x4071f0 SetTimer
0x4071f4 SetWindowTextA
0x4071f8 PostQuitMessage
0x4071fc SetForegroundWindow
0x407200 wsprintfA
0x407204 SendMessageTimeoutA
0x407208 FindWindowExA
0x407210 CreateWindowExA
0x407214 GetClassInfoA
0x407218 DialogBoxParamA
0x40721c CharNextA
0x407220 OpenClipboard
0x407224 ExitWindowsEx
0x407228 IsWindow
0x40722c GetDlgItem
0x407230 SetWindowLongA
0x407234 LoadImageA
0x407238 GetDC
0x40723c EnableWindow
0x407240 InvalidateRect
0x407244 SendMessageA
0x407248 DefWindowProcA
0x40724c BeginPaint
0x407250 GetClientRect
0x407254 FillRect
0x407258 DrawTextA
0x40725c EndPaint
0x407260 ShowWindow
库: GDI32.dll:
0x40703c SetBkColor
0x407040 GetDeviceCaps
0x407044 DeleteObject
0x407048 CreateBrushIndirect
0x40704c CreateFontIndirectA
0x407050 SetBkMode
0x407054 SetTextColor
0x407058 SelectObject
库: SHELL32.dll:
0x407154 SHBrowseForFolderA
0x407158 SHGetFileInfoA
0x40715c ShellExecuteA
0x407160 SHFileOperationA
库: ADVAPI32.dll:
0x407000 RegQueryValueExA
0x407004 RegSetValueExA
0x407008 RegEnumKeyA
0x40700c RegEnumValueA
0x407010 RegOpenKeyExA
0x407014 RegDeleteKeyA
0x407018 RegDeleteValueA
0x40701c RegCloseKey
0x407020 RegCreateKeyExA
库: COMCTL32.dll:
0x407028 ImageList_AddMasked
0x40702c ImageList_Destroy
0x407030 None
0x407034 ImageList_Create
库: ole32.dll:
0x407278 CoTaskMemFree
0x40727c OleInitialize
0x407280 OleUninitialize
0x407284 CoCreateInstance
库: VERSION.dll:
0x40726c GetFileVersionInfoA
0x407270 VerQueryValueA

.text
`.rdata
@.data
.ndata
.rsrc
Phts@
v95LpA
#Vh;+@
WhPpA
WhPpA
ihE:@
u49-,?B
9-l6B
9-l6B
9-,?B
9-,?B
9-,?B
9- ?B
9-l6B
9-x6B
RichEdit
RichEdit20A
RichEd32
RichEd20
.DEFAULT\Control Panel\International
Control Panel\Desktop\ResourceLocale
Software\Microsoft\Windows\CurrentVersion
\Microsoft\Internet Explorer\Quick Launch
MulDiv
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
SetFilePointer
ReadFile
WriteFile
GetPrivateProfileStringA
WritePrivateProfileStringA
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
lstrcmpA
lstrcmpiA
CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
KERNEL32.dll
EndPaint
DrawTextA
FillRect
GetClientRect
BeginPaint
DefWindowProcA
SendMessageA
InvalidateRect
EnableWindow
GetDC
LoadImageA
SetWindowLongA
GetDlgItem
IsWindow
FindWindowExA
SendMessageTimeoutA
wsprintfA
ShowWindow
SetForegroundWindow
PostQuitMessage
SetWindowTextA
SetTimer
CreateDialogParamA
DestroyWindow
ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
USER32.dll
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
GDI32.dll
SHFileOperationA
ShellExecuteA
SHGetFileInfoA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHELL32.dll
RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
ADVAPI32.dll
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
COMCTL32.dll
CoCreateInstance
OleUninitialize
OleInitialize
CoTaskMemFree
ole32.dll
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VERSION.dll
verifying installer: %d%%
unpacking data: %d%%
... %d%%
http://nsis.sf.net/NSIS_Error
Error writing temporary file. Make sure your temp folder is valid.
Error launching installer
SeShutdownPrivilege
~nsu.tmp
\Temp
NSIS Error
%u.%u%s%s
SHGetFolderPathA
SHFOLDER
SHAutoComplete
SHLWAPI
GetUserDefaultUILanguage
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyExA
ADVAPI32
MoveFileExA
GetDiskFreeSpaceExA
KERNEL32
*?|<>/":
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>
NullsoftInstLw
C1lw([N
x"%IIm
;Lkra
I 16#
?L Bm__wO
?ED&x\
no`P>,
-H0'1}z&
]*|!zG
GochP-
'gNLS]
(|4Rg`
W.m-q
BARcHw
zhZvi
6j@"~gj
2`:,9J
cFvm>
/^bc;
c>Q~Z*
KMLa+R
HK_xqU
Psdg`
EHkq)
R<YjG
1|?nL
O%~Yd
$e3(i
;*hMhq
/5eDzt
O9yb^+G
ia*uXFe
z0LK^
?gDr]
WuzzA
#_3eb
7&fO.
aj$Hg
!]nu]
wY/"
g-/Xh
!5h8a
msctls_progress32
SysListView32
Please wait while Setup is loading...
VS_VERSION_INFO
StringFileInfo
080403a8
CompanyName
FileDescription
FileVersion
2.0.0.0
InternalName
LegalCopyright
ProductName
ProductVersion
2.0.0.0
VarFileInfo
Translation
防病毒引擎/厂商 病毒名/规则匹配 病毒库日期
Bkav W32.HfsAdware.BD5E 20170316
MicroWorld-eScan 未发现病毒 20170316
nProtect 未发现病毒 20170316
CMC 未发现病毒 20170316
CAT-QuickHeal 未发现病毒 20170316
ALYac 未发现病毒 20170316
Malwarebytes 未发现病毒 20170316
Zillya Adware.Wews87CRTD.Win32.3633 20170314
K7AntiVirus Adware ( 004c59d01 ) 20170316
K7GW Adware ( 004c59d01 ) 20170316
TheHacker 未发现病毒 20170315
Arcabit 未发现病毒 20170316
Invincea trojan.win32.patched.ao 20170203
Baidu Win32.Trojan.WisdomEyes.16070401.9500.9988 20170316
F-Prot 未发现病毒 20170316
Symantec ML.Attribute.HighConfidence 20170315
ESET-NOD32 a variant of Win32/Wews87.C potentially unwanted 20170316
TrendMicro-HouseCall 未发现病毒 20170316
Avast 未发现病毒 20170316
ClamAV 未发现病毒 20170316
GData 未发现病毒 20170316
Kaspersky 未发现病毒 20170316
BitDefender 未发现病毒 20170316
NANO-Antivirus 未发现病毒 20170316
ViRobot 未发现病毒 20170316
AegisLab 未发现病毒 20170316
Tencent 未发现病毒 20170316
Ad-Aware 未发现病毒 20170316
Emsisoft 未发现病毒 20170316
Comodo 未发现病毒 20170316
F-Secure 未发现病毒 20170316
DrWeb 未发现病毒 20170316
VIPRE 未发现病毒 20170316
TrendMicro 未发现病毒 20170316
McAfee-GW-Edition 未发现病毒 20170316
Sophos 未发现病毒 20170316
SentinelOne 未发现病毒 20170315
Cyren 未发现病毒 20170316
Jiangmin AdWare.Wews87.b 20170316
Webroot W32.Trojan.Gen 20170316
Avira APPL/Wews87.AI 20170316
Antiy-AVL 未发现病毒 20170316
Kingsoft 未发现病毒 20170316
Endgame malicious (high confidence) 20170222
SUPERAntiSpyware PUP.Wews87/Variant 20170316
ZoneAlarm 未发现病毒 20170316
Microsoft 未发现病毒 20170316
AhnLab-V3 未发现病毒 20170316
McAfee 未发现病毒 20170316
AVware 未发现病毒 20170316
VBA32 未发现病毒 20170316
Panda 未发现病毒 20170315
Zoner 未发现病毒 20170316
Rising 未发现病毒 20170316
Yandex 未发现病毒 20170315
Ikarus 未发现病毒 20170316
Fortinet 未发现病毒 20170316
AVG 未发现病毒 20170316
Paloalto 未发现病毒 20170316
CrowdStrike malicious_confidence_62% (D) 20170130
Qihoo-360 未发现病毒 20170316

进程树


cbcq_Y_905908_feitian.exe, PID: 2444, 上一级进程 PID: 2264
cav_vcs.exe, PID: 2680, 上一级进程 PID: 2444
cav_vcs.exe, PID: 2740, 上一级进程 PID: 2444
rundll32.exe, PID: 2768, 上一级进程 PID: 2444

访问主机纪录 (可点击查询WPING实时安全评级)

直接 IP 安全评级 地理位置
23.41.75.27 美国
23.41.69.163 美国
183.60.225.49 中国
183.60.123.113 中国
14.18.237.132 中国
14.18.237.129 中国
125.88.190.16 中国
101.96.10.75 中国
101.227.98.134 中国
101.227.66.207 中国

TCP

源地址 源端口 目标地址 目标端口
192.168.122.201 49168 101.227.66.207 img1.37wanimg.com 80
192.168.122.201 49169 101.227.66.207 img1.37wanimg.com 80
192.168.122.201 49181 101.227.66.207 img1.37wanimg.com 80
192.168.122.201 49170 101.227.98.134 img1.37wanimg.com 80
192.168.122.201 49171 101.227.98.134 img1.37wanimg.com 80
192.168.122.201 49177 101.96.10.75 80
192.168.122.201 49159 125.88.190.16 aia1.wosign.com 80
192.168.122.201 49167 14.18.237.129 gameapp.37.com 80
192.168.122.201 49173 14.18.237.132 my.37.com 443
192.168.122.201 49166 183.60.123.113 a.clickdata.37wan.com 80
192.168.122.201 49172 183.60.123.113 a.clickdata.37wan.com 80
192.168.122.201 49174 183.60.225.49 cm.he2d.com 80
192.168.122.201 49175 183.60.225.49 cm.he2d.com 80
192.168.122.201 49176 23.41.69.163 crl.geotrust.com 80
192.168.122.201 49180 23.41.69.163 crl.geotrust.com 80
192.168.122.201 49178 23.41.75.27 g2.symcb.com 80
192.168.122.201 49179 23.41.75.27 g2.symcb.com 80

UDP

源地址 源端口 目标地址 目标端口
192.168.122.201 50039 192.168.122.1 53
192.168.122.201 52394 192.168.122.1 53
192.168.122.201 54867 192.168.122.1 53
192.168.122.201 56644 192.168.122.1 53
192.168.122.201 56760 192.168.122.1 53
192.168.122.201 56856 192.168.122.1 53
192.168.122.201 59211 192.168.122.1 53
192.168.122.201 59218 192.168.122.1 53
192.168.122.201 63544 192.168.122.1 53
192.168.122.201 63860 192.168.122.1 53
192.168.122.201 65014 192.168.122.1 53

域名解析 (可点击查询WPING实时安全评级)

域名 安全评级 响应
aia1.wosign.com CNAME 60aa66a1576a008e.360safedns.com
A 125.88.190.16
a.clickdata.37wan.com A 121.201.30.167
A 183.60.123.113
gameapp.37.com CNAME newgameapp.37.com
A 14.18.237.129
A 121.201.25.129
img1.37wanimg.com CNAME 37w.xdwscache.ourglb0.com
CNAME img1.37wanimg.com.wscdns.com
A 101.227.66.207
A 101.227.98.134
ptres.37.com CNAME ptres.37.com.wscdns.com
my.37.com A 14.18.237.132
CNAME allmy.37.com
A 121.201.25.132
cm.he2d.com A 61.188.87.111
A 183.60.225.49
A 115.231.95.107
CNAME p.ggmm777.com
A 14.18.238.176
A 116.10.189.226
cookiem.37.com CNAME p.huluwa8.com
crl.geotrust.com A 23.41.69.163
CNAME e6845.dscb1.akamaiedge.net
CNAME crl-ds.ws.symantec.com.edgekey.net
g2.symcb.com A 23.41.75.27
CNAME ocsp-ds.ws.symantec.com.edgekey.net
CNAME e8218.dscb1.akamaiedge.net
g1.symcb.com

TCP

源地址 源端口 目标地址 目标端口
192.168.122.201 49168 101.227.66.207 img1.37wanimg.com 80
192.168.122.201 49169 101.227.66.207 img1.37wanimg.com 80
192.168.122.201 49181 101.227.66.207 img1.37wanimg.com 80
192.168.122.201 49170 101.227.98.134 img1.37wanimg.com 80
192.168.122.201 49171 101.227.98.134 img1.37wanimg.com 80
192.168.122.201 49177 101.96.10.75 80
192.168.122.201 49159 125.88.190.16 aia1.wosign.com 80
192.168.122.201 49167 14.18.237.129 gameapp.37.com 80
192.168.122.201 49173 14.18.237.132 my.37.com 443
192.168.122.201 49166 183.60.123.113 a.clickdata.37wan.com 80
192.168.122.201 49172 183.60.123.113 a.clickdata.37wan.com 80
192.168.122.201 49174 183.60.225.49 cm.he2d.com 80
192.168.122.201 49175 183.60.225.49 cm.he2d.com 80
192.168.122.201 49176 23.41.69.163 crl.geotrust.com 80
192.168.122.201 49180 23.41.69.163 crl.geotrust.com 80
192.168.122.201 49178 23.41.75.27 g2.symcb.com 80
192.168.122.201 49179 23.41.75.27 g2.symcb.com 80

UDP

源地址 源端口 目标地址 目标端口
192.168.122.201 50039 192.168.122.1 53
192.168.122.201 52394 192.168.122.1 53
192.168.122.201 54867 192.168.122.1 53
192.168.122.201 56644 192.168.122.1 53
192.168.122.201 56760 192.168.122.1 53
192.168.122.201 56856 192.168.122.1 53
192.168.122.201 59211 192.168.122.1 53
192.168.122.201 59218 192.168.122.1 53
192.168.122.201 63544 192.168.122.1 53
192.168.122.201 63860 192.168.122.1 53
192.168.122.201 65014 192.168.122.1 53

HTTP 请求

URI HTTP数据
URL专业沙箱检测 -> http://aia1.wosign.com/ca1g2-code3.cer
GET /ca1g2-code3.cer HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: aia1.wosign.com

URL专业沙箱检测 -> http://a.clickdata.37wan.com/controller/istat.controller.php?item=8133tay6p9&platform=37wan&game_id=275&ext_1=2&ext_2=feitian_wd&ext_3=905908&ext_4=00C1658A208C4DF686A137C1E2C88748&ext_5=36cbb0c4629952ac273acb5562691b31&ext_6=2&browser_type=3102
GET /controller/istat.controller.php?item=8133tay6p9&platform=37wan&game_id=275&ext_1=2&ext_2=feitian_wd&ext_3=905908&ext_4=00C1658A208C4DF686A137C1E2C88748&ext_5=36cbb0c4629952ac273acb5562691b31&ext_6=2&browser_type=3102 HTTP/1.1
User-Agent: HTTPDownloader
Host: a.clickdata.37wan.com

URL专业沙箱检测 -> http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
GET /controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3 HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: gameapp.37.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://img1.37wanimg.com/mir/css/client/game3.css?t=1489710637
GET /mir/css/client/game3.css?t=1489710637 HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: img1.37wanimg.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://img1.37wanimg.com/mir/js/client/game3.js?t=1489710637
GET /mir/js/client/game3.js?t=1489710637 HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: img1.37wanimg.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://ptres.37.com/js/sq/lib/sq.core.js?t=20140304
GET /js/sq/lib/sq.core.js?t=20140304 HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: ptres.37.com
Connection: Keep-Alive
Cookie: sq_client_data=a%253A8%253A%257Bs%253A7%253A%2522game_id%2522%253Bs%253A3%253A%2522275%2522%253Bs%253A7%253A%2522version%2522%253Bs%253A4%253A%25223102%2522%253Bs%253A5%253A%2522refer%2522%253Bs%253A10%253A%2522feitian_wd%2522%253Bs%253A3%253A%2522uid%2522%253Bs%253A6%253A%2522905908%2522%253Bs%253A13%253A%2522showlogintype%2522%253Bs%253A1%253A%25223%2522%253Bs%253A8%253A%2522tpl_type%2522%253Bs%253A5%253A%2522game3%2522%253Bs%253A11%253A%2522installtime%2522%253Bs%253A8%253A%252220161117%2522%253Bs%253A10%253A%2522thirdlogin%2522%253Bs%253A1%253A%25220%2522%253B%257D; client_type=3

URL专业沙箱检测 -> http://ptres.37.com/js/sq/widget/sq.login.js?t=20170302100408
GET /js/sq/widget/sq.login.js?t=20170302100408 HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: ptres.37.com
Connection: Keep-Alive
Cookie: sq_client_data=a%253A8%253A%257Bs%253A7%253A%2522game_id%2522%253Bs%253A3%253A%2522275%2522%253Bs%253A7%253A%2522version%2522%253Bs%253A4%253A%25223102%2522%253Bs%253A5%253A%2522refer%2522%253Bs%253A10%253A%2522feitian_wd%2522%253Bs%253A3%253A%2522uid%2522%253Bs%253A6%253A%2522905908%2522%253Bs%253A13%253A%2522showlogintype%2522%253Bs%253A1%253A%25223%2522%253Bs%253A8%253A%2522tpl_type%2522%253Bs%253A5%253A%2522game3%2522%253Bs%253A11%253A%2522installtime%2522%253Bs%253A8%253A%252220161117%2522%253Bs%253A10%253A%2522thirdlogin%2522%253Bs%253A1%253A%25220%2522%253B%257D; client_type=3

URL专业沙箱检测 -> http://ptres.37.com/js/sq/widget/sq.tab.js
GET /js/sq/widget/sq.tab.js HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: ptres.37.com
Connection: Keep-Alive
Cookie: sq_client_data=a%253A8%253A%257Bs%253A7%253A%2522game_id%2522%253Bs%253A3%253A%2522275%2522%253Bs%253A7%253A%2522version%2522%253Bs%253A4%253A%25223102%2522%253Bs%253A5%253A%2522refer%2522%253Bs%253A10%253A%2522feitian_wd%2522%253Bs%253A3%253A%2522uid%2522%253Bs%253A6%253A%2522905908%2522%253Bs%253A13%253A%2522showlogintype%2522%253Bs%253A1%253A%25223%2522%253Bs%253A8%253A%2522tpl_type%2522%253Bs%253A5%253A%2522game3%2522%253Bs%253A11%253A%2522installtime%2522%253Bs%253A8%253A%252220161117%2522%253Bs%253A10%253A%2522thirdlogin%2522%253Bs%253A1%253A%25220%2522%253B%257D; client_type=3

URL专业沙箱检测 -> http://ptres.37.com/js/sq/widget/sq.statis.js
GET /js/sq/widget/sq.statis.js HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: ptres.37.com
Connection: Keep-Alive
Cookie: sq_client_data=a%253A8%253A%257Bs%253A7%253A%2522game_id%2522%253Bs%253A3%253A%2522275%2522%253Bs%253A7%253A%2522version%2522%253Bs%253A4%253A%25223102%2522%253Bs%253A5%253A%2522refer%2522%253Bs%253A10%253A%2522feitian_wd%2522%253Bs%253A3%253A%2522uid%2522%253Bs%253A6%253A%2522905908%2522%253Bs%253A13%253A%2522showlogintype%2522%253Bs%253A1%253A%25223%2522%253Bs%253A8%253A%2522tpl_type%2522%253Bs%253A5%253A%2522game3%2522%253Bs%253A11%253A%2522installtime%2522%253Bs%253A8%253A%252220161117%2522%253Bs%253A10%253A%2522thirdlogin%2522%253Bs%253A1%253A%25220%2522%253B%257D; client_type=3

URL专业沙箱检测 -> http://ptres.37.com/js/sq/widget/sq.clientclass2.js?t=1489710637
GET /js/sq/widget/sq.clientclass2.js?t=1489710637 HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: ptres.37.com
Connection: Keep-Alive
Cookie: sq_client_data=a%253A8%253A%257Bs%253A7%253A%2522game_id%2522%253Bs%253A3%253A%2522275%2522%253Bs%253A7%253A%2522version%2522%253Bs%253A4%253A%25223102%2522%253Bs%253A5%253A%2522refer%2522%253Bs%253A10%253A%2522feitian_wd%2522%253Bs%253A3%253A%2522uid%2522%253Bs%253A6%253A%2522905908%2522%253Bs%253A13%253A%2522showlogintype%2522%253Bs%253A1%253A%25223%2522%253Bs%253A8%253A%2522tpl_type%2522%253Bs%253A5%253A%2522game3%2522%253Bs%253A11%253A%2522installtime%2522%253Bs%253A8%253A%252220161117%2522%253Bs%253A10%253A%2522thirdlogin%2522%253Bs%253A1%253A%25220%2522%253B%257D; client_type=3

URL专业沙箱检测 -> http://img1.37wanimg.com/mir/css/client/game3/bg8.jpg
GET /mir/css/client/game3/bg8.jpg HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: img1.37wanimg.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://img1.37wanimg.com/mir/css/client/game3/rem_on.png
GET /mir/css/client/game3/rem_on.png HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: img1.37wanimg.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://img1.37wanimg.com/mir/css/client/game3/logo.png
GET /mir/css/client/game3/logo.png HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: img1.37wanimg.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://a.clickdata.37wan.com/controller/istat.controller.php?platform=37wan&item=u3tfl5ftfl&game_id=275&sid=&position=1&ext_1=1&ext_2=feitian_wd&ext_3=905908&ext_4=&ext_5=gy&ext_6=&login_account=&browser_type=&user_ip=&refer=feitian_wd&uid=905908&page=1&t=1479370269365
GET /controller/istat.controller.php?platform=37wan&item=u3tfl5ftfl&game_id=275&sid=&position=1&ext_1=1&ext_2=feitian_wd&ext_3=905908&ext_4=&ext_5=gy&ext_6=&login_account=&browser_type=&user_ip=&refer=feitian_wd&uid=905908&page=1&t=1479370269365 HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: a.clickdata.37wan.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://cm.he2d.com/1/
GET /1/ HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: cm.he2d.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://a.clickdata.37wan.com/controller/istat.controller.php?item=8133tay6p9&platform=37wan&game_id=275&ext_1=5&ext_2=feitian_wd&ext_3=905908&ext_4=00C1658A208C4DF686A137C1E2C88748&ext_5=36cbb0c4629952ac273acb5562691b31&ext_6=2&browser_type=3102
GET /controller/istat.controller.php?item=8133tay6p9&platform=37wan&game_id=275&ext_1=5&ext_2=feitian_wd&ext_3=905908&ext_4=00C1658A208C4DF686A137C1E2C88748&ext_5=36cbb0c4629952ac273acb5562691b31&ext_6=2&browser_type=3102 HTTP/1.1
User-Agent: HTTPDownloader
Host: a.clickdata.37wan.com
Cookie: PHPSESSID=ek64ibtt5lk0m6qh0ssvue8vd6

URL专业沙箱检测 -> http://img1.37wanimg.com/www2015/images/common/third-logo-24.png
GET /www2015/images/common/third-logo-24.png HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: img1.37wanimg.com
Connection: Keep-Alive

URL专业沙箱检测 -> http://cookiem.37.com/sys/?u=My7LWN49GKUBAAAA3QZY&fdata=
GET /sys/?u=My7LWN49GKUBAAAA3QZY&fdata= HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Cookie: sq_client_data=a%253A8%253A%257Bs%253A7%253A%2522game_id%2522%253Bs%253A3%253A%2522275%2522%253Bs%253A7%253A%2522version%2522%253Bs%253A4%253A%25223102%2522%253Bs%253A5%253A%2522refer%2522%253Bs%253A10%253A%2522feitian_wd%2522%253Bs%253A3%253A%2522uid%2522%253Bs%253A6%253A%2522905908%2522%253Bs%253A13%253A%2522showlogintype%2522%253Bs%253A1%253A%25223%2522%253Bs%253A8%253A%2522tpl_type%2522%253Bs%253A5%253A%2522game3%2522%253Bs%253A11%253A%2522installtime%2522%253Bs%253A8%253A%252220161117%2522%253Bs%253A10%253A%2522thirdlogin%2522%253Bs%253A1%253A%25220%2522%253B%257D; client_type=3; 37wanrefer=feitian_wd%7C905908%7C%7C%7C
Connection: Keep-Alive
Host: cookiem.37.com

URL专业沙箱检测 -> http://crl.geotrust.com/crls/secureca.crl
GET /crls/secureca.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.geotrust.com

URL专业沙箱检测 -> http://101.96.10.75/crl.geotrust.com/crls/secureca.crl
GET /crl.geotrust.com/crls/secureca.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: 101.96.10.75

URL专业沙箱检测 -> http://g2.symcb.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6bw%3D%3D
GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6bw%3D%3D HTTP/1.1
Cache-Control: max-age = 523954
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sun, 22 Jan 2017 17:40:36 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: g2.symcb.com

URL专业沙箱检测 -> http://g2.symcb.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6bw%3D%3D
GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6bw%3D%3D HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: g2.symcb.com

URL专业沙箱检测 -> http://g1.symcb.com/crls/gtglobal.crl
GET /crls/gtglobal.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: g1.symcb.com

URL专业沙箱检测 -> http://img1.37wanimg.com/mir/css/client/game3/sprite.png
GET /mir/css/client/game3/sprite.png HTTP/1.1
Accept: */*
Referer: http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&refer=feitian_wd&uid=905908&version=3102&installtime=20161117&runcount=2&curtime=20161117083006&showlogintype=3
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Host: img1.37wanimg.com
Connection: Keep-Alive

SMTP 流量

无SMTP流量.

IRC 流量

无IRC请求.

ICMP 流量

源地址 目标地址 ICMP类型 数据
14.18.237.132 192.168.122.201 3
14.18.237.132 192.168.122.201 3
14.18.237.132 192.168.122.201 3
14.18.237.132 192.168.122.201 3
14.18.237.132 192.168.122.201 3
14.18.237.132 192.168.122.201 3
14.18.237.132 192.168.122.201 3

CIF 报告

无 CIF 结果

网络警报

无警报

TLS

No TLS

Suricata HTTP

No Suricata HTTP

未发现网络提取文件
文件名 \xe8\xb6\x85\xe9\x9c\xb8\xe4\xbc\xa0\xe5\xa5\x87.lnk
相关文件
C:\Users\test\Desktop\\xe8\xb6\x85\xe9\x9c\xb8\xe4\xbc\xa0\xe5\xa5\x87.lnk
文件大小 988 字节
文件类型 MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Sep 16 07:20:00 2016, mtime=Wed Nov 16 16:30:01 2016, atime=Fri Sep 16 07:20:00 2016, length=1418376, window=hide
MD5 801d68a5d9ad888b317eccc68504ec94
SHA1 ac3630ae41ef12f0ea6f7498dcc5d529ab71c7ca
SHA256 6dc2ce1e42a74cd5c8f4d6b4c27aa0f28f6d8c0a8c92d2cbd3403c1b052819c0
CRC32 9A244A4B
Ssdeep 24:8mZACdOEaTfMCHAI1qspTydRd6UPqhrrPra:8mZACdOHTgIqQTydRdbyk
下载提交魔盾安全分析
文件名 5024A99DB487E61F859A7848B9CAE2C4
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5024A99DB487E61F859A7848B9CAE2C4
文件大小 665 字节
文件类型 data
MD5 cdfed412ffc55736da7d26dd6e325304
SHA1 6a50496674b8509c15278dbbbbf8be7c61e0572c
SHA256 24a1d5713ecfcf8d2eb85f5230e51c63b3967f20b4a22f4c1060d7e9231443be
CRC32 E8715A3B
Ssdeep 12:MOSvxFApYJTUncXAteV3OFbflTUFB5jZhKpnpdix64VwljckZY2LQk1YCXhsr5iF:MOmxaYJYnuAoV+zTgxK5zuY9LdYvr5wD
下载提交魔盾安全分析
文件名 \xe8\xb6\x85\xe9\x9c\xb8\xe4\xbc\xa0\xe5\xa5\x87.lnk
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\\xe8\xb6\x85\xe9\x9c\xb8\xe4\xbc\xa0\xe5\xa5\x87\\xe8\xb6\x85\xe9\x9c\xb8\xe4\xbc\xa0\xe5\xa5\x87.lnk
文件大小 1024 字节
文件类型 MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Sep 16 07:20:00 2016, mtime=Wed Nov 16 16:30:01 2016, atime=Fri Sep 16 07:20:00 2016, length=1418376, window=hide
MD5 2b7a3d17f994c5c43906c2d56a5ee773
SHA1 3a7fc169895dfe9c3c8c523d8ea9e14b588fa068
SHA256 7ea3c23fc1d472a0025dbe6c80f86b693de92ed73f437f47d508b4456b1e784d
CRC32 FDA047F2
Ssdeep 24:8mZACdOEaTfMCHAI1qspTMdRd6UPqhrrPra:8mZACdOHTgIqQTMdRdbyk
下载提交魔盾安全分析
文件名 sq.login[1].js
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDL4J1KW\sq.login[1].js
文件大小 30677 字节
文件类型 HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
MD5 befd2975edaa6e7b69909ac4902701e7
SHA1 d0e6879aef7f454aeff2131fecdb01906b9ce904
SHA256 726f3ae05fd639e7664c3bbd1116d11bf207194caebfa8d151460203baedfe77
CRC32 3A54D81D
Ssdeep 768:mckBB5Pd4cGYBk707ZVWV6VAlKfMiQb9TZXihYfC4n:nI6SVWViQlkYfC4n
下载提交魔盾安全分析显示文本
!function($,SQ,undefined){if(window.bHTTPSEnabled=0,window.jumpLoginPage=0,SQ&&(!SQ.Login||!SQ.Login.version)){var jumpDomains=["bbs.37.com","kf.37.com","chat.online.kf.37.com"];$(document).ready(function(){$.inArray(location.hostname,jumpDomains)>-1?window.jumpLoginPage=!0:window.document.domain="37.com",window.httpsStatis=function(a){var b="http://pt.clickdata.37wan.com/ps.gif?id=21&la={la}&ck={ck}&cf={cf}&rf={rf}&ext={e}".replace("{ck}",SQ.cookie("tg_uv")).replace("{cf}",encodeURIComponent(location.hostname+location.pathname)).replace("{rf}",encodeURIComponent(document.referrer)).replace("{e}",a),c=new Image,d=SQ.cookie("passport_37wan_com"),e="";d&&d.indexOf("|")>0&&(e=d.split("|")[1]),c.src=b.replace("{la}",e)+"&t="+Math.random()};var a=new Image,b=0;a.src="https://my.37.com/httpsEnable.gif?t="+(new Date).getTime(),window.proxyDisabledSc=function(){window.httpsStatis(2),$.ajaxHttps=window.frames.sqProxyiframe.window.$.ajax},a.onload=function(){window.bHTTPSEnabled=!0,window.jumpLoginPage=!1,a.onload=null},a.onerror=function(){0===b&&(window.jumpLoginPage||(window.httpsStatis(1),window.bHTTPSEnabled=!1,$(document.body).append('<iframe src="http://my.37.com/proxy.html" style="display:none" name="sqProxyiframe"></iframe>'),b=1,a.onerror=null))}}),eval(function(a,b,c,d,e,f){if(e=function(a){return(b>a?"":e(parseInt(a/b)))+((a%=b)>35?String.fromCharCode(a+29):a.toString(36))},!"".replace(/^/,String)){for(;c--;)f[e(c)]=d[c]||e(c);d=[function(a){return f[a]}],e=function(){return"\\w+"},c=1}for(;c--;)d[c]&&(a=a.replace(new RegExp("\\b"+e(c)+"\\b","g"),d[c]));return a}('e 5="F+/";m q(d){e 1,i,c;e 9,b,g;c=d.l;i=0;1="";x(i<c){9=d.k(i++)&v;f(i==c){1+=5.8(9>>2);1+=5.8((9&h)<<4);1+="==";r}b=d.k(i++);f(i==c){1+=5.8(9>>2);1+=5.8(((9&h)<<4)|((b&s)>>4));1+=5.8((b&n)<<2);1+="=";r}g=d.k(i++);1+=5.8(9>>2);1+=5.8(((9&h)<<4)|((b&s)>>4));1+=5.8(((b&n)<<2)|((g&y)>>6));1+=5.8(g&z)}p 1}m G(a){e t=5.l-2,w=[];H(i=0;i<E;i++){w.j(5.8(u.B(u.D()*t)));f(i===7){w.j(a.o(0,3))}f(i===C){w.j(a.o(3))}}p q(w.A(""))}',44,44,"|out||||ch|||charAt|c1||c2|len|str|var|if|c3|0x3||push|charCodeAt|length|function|0xF|substr|return|__rsa|break|0xF0|maxPos|Math|0xff||while|0xC0|0x3F|join|floor|12|random|15|ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789|td|for".split("|"),0,{}));var L,verifyCode,t='<style type="text/css">.r-cover {display:none;overflow:hidden;z-index:100;width:100%;position:absolute;left:0;top:0;height:100%;background:#000;opacity:0.5;filter:alpha(opacity=50);}.r-dialog {display:none;top:40px;padding-top:27px;_padding-top:25px;border:1px solid #bbc9d4;z-index:101;width:393px;font-size:14px;border-radius:2px;position:absolute;left:50%;margin-left:-196px;background:#fff url(http://img1.37wanimg.com/www/css/images/common/bg-dialog-banner.jpg) no-repeat;}.r-dialog .ico {vertical-align:middle;}.r-dialog-t {border-bottom:1px solid #a1bdc4;}.r-dialog-t .r-dialog-t-f {margin-left:125px;}.r-dialog-t li {float:left;margin-left:10px;_display:inline;}.r-dialog-t a {color:#007596;display:block;height:20px;background-color:#98e5f4;border:1px solid #b7ccd0;border-bottom:none;padding:6px 30px;border-top-left-radius:1px;border-top-right-radius:1px;_display:inline-block;}.r-dialog-t .focus, .r-dialog-t a:hover {text-decoration:none;background-color:#fff;border-color:#acc6cd;}.r-dialog-t .focus {position:relative;top:1px;cursor:default;color:#006388;}.r-dialog-text {font-size:16px;color:#4e4e4c;border:1px solid #d0dcde;background-color:#e9f8ff;padding:3px 5px;width:214px;border-radius:2px;}.r-dialog-text:focus {border:1px solid #00e7ff;box-shadow:inset 0 0 4px #d6e5ea;}.r-dialog-text-error {border-color:#efb7bc;}.r-dialog-text-error:focus{border-color:#f78690;box-shadow:inset 0 0 2px #efb7bc;background-color:#ecd5db;}.r-dialog-panel{display:none;position:relative;padding:10px 20px;}.r-dialog-panel-log .r-dialog-tip{color:#f00;}.r-dialog-panel-log p {margin-bottom:13px;}.r-dialog-panel-log .r-right {width:73px;}.r-dialog .btn-s-2 {margin-top:5px;}.r-right {display:inline-block;width:83px;text-align:right;margin-right:12px;font-family:SimSun;}.r-dialog-panel-reg{padding-top:25px;padding-bottom:23px;}.r-dialog-tip-error{color:#f00;}.r-dialog-panel .r-dialog-tip {height:17px;font-family:SimSun;margin-left:95px;margin-bottom:2px;}.r-dialog-panel-log .r-dialog-tip{margin-left:85px;font-size:12px;padding-bottom:5px;padding-top:10px;}.r-dialog-panel-reg .r-dialog-tip{font-size:12px;margin-bottom:5px;}.r-dialog-keep {font-size:12px;margin-left:85px;margin-right:78px;cursor:pointer;*margin-left:82px;*margin-right:73px;}.r-dialog .r-dialog-forget{font-size:12px;color:#46a9f2;}.r-dialog-close {right:3px;top:-2px;font:16px "Comic Sans MS", Arial, Helvetica, sans-serif;position:absolute;transition:0.3s;color:#006fd3;text-align:center;}.r-dialog-close:hover {text-decoration:none;color:#ffa500;}.r-dialog-protocol{text-indent:50px;}.r-dialog-protocol label{cursor:pointer;}.r-dialog-protocol a{color:#46a9f2}.r-checkbox{margin-left:0;position:relative;top:-1px;margin-right:2px;}.r-dialog-ico{display:inline-block;width:16px;height:16px;position:relative;top:4px;left:10px;*top:-1px;_top:3px;}.r-dialog-ico-error,.r-dialog-ico-right{background:transparent url(http://img1.37wanimg.com/www/css/images/common/ico.png) no-repeat;}.r-dialog-ico-error{background-position:0 -679px;}.r-dialog-ico-right{background-position:0 -659px;}.r-dialog-ico-pending{background:transparent url(http://img1.37wanimg.com/www/css/images/common/loading-16x16.gif) no-repeat;}.r-dialog-verify-img{vertical-align:middle;cursor:pointer;width:71px;height:28px;}</style><div class="r-cover" id="r-cover"></div><div id="r-dialog" class="r-dialog"><a href="#" title="\xe5\x85\xb3\xe9\x97\xad" class="r-dialog-close">X</a><ul class="r-dialog-t cf"><li class="r-dialog-t-f"><a data-order="0" href="#">\xe7\x94\xa8\xe6\x88\xb7\xe7\x99\xbb\xe5\xbd\x95</a></li><li><a data-order="1" href="#">\xe7\x94\xa8\xe6\x88\xb7\xe6\xb3\xa8\xe5\x86\x8c</a></li></ul><div class="r-dialog-panel r-dialog-panel-log"><p class="r-dialog-tip"></p><p><label class="r-right" for="r-username">\xe5\xb8\x90\xe5\x8f\xb7</label><input name="login_account" type="text" class="r-dialog-text" data-rule="username" id="r-username" /></p><p data-vc><label class="r-right" for="r-password">\xe5\xaf\x86\xe7\xa0\x81</label><input name="password" type="password" class="r-dialog-text" data-rule="password" id="r-password" /></p><p><label class="r-dialog-keep" for="r-dialog-keep"><input name="save_state" id="r-dialog-keep" class="r-checkbox" checked type="checkbox" />\xe4\xb8\x8b\xe6\xac\xa1\xe8\x87\xaa\xe5\x8a\xa8\xe7\x99\xbb\xe5\xbd\x95</label><a title="\xe6\x89\xbe\xe5\x9b\x9e\xe5\xaf\x86\xe7\xa0\x81" class="r-dialog-forget" target="_blank" href="http://my.37.com/forgetpwd/">\xe5\xbf\x98\xe8\xae\xb0\xe5\xaf\x86\xe7\xa0\x81\xef\xbc\x9f</a></p><p class="ac"><a href="#" id="tj-r-btn-log" class="btn btn-s-2">\xe9\xa9\xac\xe4\xb8\x8a\xe7\x99\xbb\xe5\xbd\x95</a></p><div class="sq-qr sq-qr-top" id="sq-qr-top"></div></div><div class="r-dialog-panel r-dialog-panel-reg"><p><label class="r-right" for="rr-username">\xe5\xb8\x90\xe5\x8f\xb7</label><input data-rule="username" name="login_account" type="text" class="r-dialog-text" id="rr-username" /><span class="r-dialog-ico"></span></p><p class="r-dialog-tip"></p><p><label class="r-right" for="rr-password">\xe5\xaf\x86\xe7\xa0\x81</label><input data-rule="password" data-strict_="same,continual" name="password" type="password" class="r-dialog-text" id="rr-password" /><span class="r-dialog-ico"></span></p><p class="r-dialog-tip"></p><p><label class="r-right" for="rr-rpassword">\xe7\xa1\xae\xe8\xae\xa4\xe5\xaf\x86\xe7\xa0\x81</label><input data-rule="eq" data-target="#rr-password" name="rpassword" data-error="\xe4\xb8\xa4\xe6\xac\xa1\xe5\xaf\x86\xe7\xa0\x81\xe4\xb8\x8d\xe4\xb8\x80\xe8\x87\xb4" type="password" class="r-dialog-text" id="rr-rpassword" /><span class="r-dialog-ico"></span></p><p class="r-dialog-tip"></p>{realname}<p class="r-dialog-protocol"><input class="r-checkbox" type="checkbox" checked data-rule="checkbox" id="r-dialog-protocol" /><label for="r-dialog-protocol">\xe6\x88\x91\xe5\xb7\xb2\xe9\x98\x85\xe8\xaf\xbb\xe5\xb9\xb6\xe5\x90\x8c\xe6\x84\x8f</label><a href="http://my.37.com/user_agreement.html" target="_blank">\xe3\x80\x8a\xe7\x94\xa8\xe6\x88\xb7\xe6\xb3\xa8\xe5\x86\x8c\xe6\x9c\x8d\xe5\x8a\xa1\xe5\x8d\x8f\xe8\xae\xae\xe3\x80\x8b</a><span class="r-dialog-ico"></span><p class="r-dialog-tip"></p></p><p class="ac"><a href="#" id="tj-r-btn-reg" class="btn btn-s-2">\xe6\x8e\xa5\xe5\x8f\x97\xe5\x8d\x8f\xe8\xae\xae\xe5\xb9\xb6\xe6\xb3\xa8\xe5\x86\x8c</a></p></div></div>',realName='<p><label class="r-right" for="rr-realname">\xe7\x9c\x9f\xe5\xae\x9e\xe5\xa7\x93\xe5\x90\x8d</label><input name="name" data-rule="realname" type="text" class="r-dialog-text" id="rr-realname" /><span class="r-dialog-ico"></span></ <truncated>
文件名 \xe8\xb6\x85\xe9\x9c\xb8\xe4\xbc\xa0\xe5\xa5\x87.lnk
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\xe8\xb6\x85\xe9\x9c\xb8\xe4\xbc\xa0\xe5\xa5\x87.lnk
文件大小 1012 字节
文件类型 MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Sep 16 07:20:00 2016, mtime=Wed Nov 16 16:30:01 2016, atime=Fri Sep 16 07:20:00 2016, length=1418376, window=hide
MD5 028cf0b4666da5c66960179766e827bf
SHA1 311d10eae4ab8e9db7e55b5c5f76d9c5c815fc84
SHA256 b5ab9831a72e12d85c408803ae1363f2547d0d9151be7b733a6972c3ee5ca797
CRC32 156E4DF1
Ssdeep 24:8mZACdOEaTfMCHAI1qspTDCdRd6UPqhrrPra:8mZACdOHTgIqQTGdRdbyk
下载提交魔盾安全分析
文件名 nplog.dll
相关文件
C:\Users\test\AppData\Local\Temp\nplog.dll
文件大小 331415 字节
文件类型 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 c6c0c449fc2d2b12d82681c96b1e5dbe
SHA1 e60ba00edea00dff0f1f6cfb99bd2e1127e9421a
SHA256 0129c17f435cdafeea486c94bec40e0fa2b9a1ba546ce011c253ea42ef2ccae9
CRC32 C729DC66
Ssdeep 6144:gWmG063YeTEml05wqqPC2IkQN6PGxnUB6OHJ3heS+FF2IUZkAa1ZxP:gD6IeTEml05dlk26ex0ReS+fnAS
Yara
  • Look for MD5 constants
下载提交魔盾安全分析
文件名 sprite[1].png
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EHDRIWWS\sprite[1].png
文件大小 138740 字节
文件类型 PNG image data, 366 x 186, 8-bit/color RGBA, non-interlaced
MD5 a21602493513b5a67e3c1f489ef45700
SHA1 1c7a8b923349f4c75820b694447ec4913feffd40
SHA256 c3e137ccba3c0c416603c17eb312178181473b562998f6ef628583c01f4f3e42
CRC32 0D09BDCE
Ssdeep 3072:xC9mznA94c3xXdsMy1Ij9eV9KmdwwhYOiHQ3wd7oBeZ:xJa4c3xdsTye/ywYw3wd7V
下载提交魔盾安全分析
文件名 0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875
文件大小 1377 字节
文件类型 data
MD5 a9b35b85213a519c2a3d2a655145b390
SHA1 147f0db4cbc34cff75ae91cc646664e91eca8142
SHA256 e8684f350286f3e05a55eba06e3867687381f0a946ab626c5fb53518895d2276
CRC32 D5B7F945
Ssdeep 24:43mktgH+Uz47kSOmxa/dXHXb7EKoowm55a2STv+ijS+E6:ow+Uz5GatHXnVokSTv+ijSj6
下载提交魔盾安全分析
文件名 Lander.ini
相关文件
C:\Program Files (x86)\legend\Lander.ini
文件大小 328 字节
文件类型 ASCII text, with CRLF line terminators
MD5 b0b7f68e2deb398175c6b6b1cbb50830
SHA1 a4a86aa8848585ff5cfb07762872842438143039
SHA256 2448e288b90a106f8b0d5a2505acd2c2557c1143d0ae8991f019536a1e8d0dde
CRC32 A7621B1E
Ssdeep 6:RhclkSmtMbXIzO1KCK3NNXJeqzbeXn23i+qCXRcrKO/0+wDu2+yn:0qMTIi1KCKXMWbIn9+RBcrKO/9wOy
下载提交魔盾安全分析显示文本
[Common]
GameKey=cqby
Refer=feitian_wd
UID=905908
IconTips=0
ShowDeskTop=1
DesktopShortCut=1
AutoRun=0
IconAnimate=0
TaskbarShortCut=1
RunAfterSetup=1
TopMost=0
GameCloseStyle=0
IsSilent=1
RunCount=2
ActiveCount=1
[Install]
InstallType=0
InstallTime=2016-11-17 08:30:06
GUID=00C1658A208C4DF686A137C1E2C88748
文件名 sq.core[1].js
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDL4J1KW\sq.core[1].js
文件大小 102589 字节
文件类型 HTML document, UTF-8 Unicode text, with very long lines
MD5 a713ce88f7da8e4619f9c6ca44c8b6bd
SHA1 929715509c1ab2fc9839ae064b40a0f922cbdc27
SHA256 ca9ee1280ddac55e29e6f8a53c78bc912b832b04a72c0c770cbd587490034d19
CRC32 1023C69E
Ssdeep 1536:Xp4okW2d5x7YojMgWa63jGBRXiczV+2OjfgwRENbUFRS0ohGTRaDHZY5bB864fkd:z/0BO9KINKXOZKUtCuz
下载提交魔盾安全分析显示文本
!function(a,b){function c(a){var b=ob[a]={};return $.each(a.split(bb),function(a,c){b[c]=!0}),b}function d(a,c,d){if(d===b&&1===a.nodeType){var e="data-"+c.replace(qb,"-$1").toLowerCase();if(d=a.getAttribute(e),"string"==typeof d){try{d="true"===d?!0:"false"===d?!1:"null"===d?null:+d+""===d?+d:pb.test(d)?$.parseJSON(d):d}catch(f){}$.data(a,c,d)}else d=b}return d}function e(a){var b;for(b in a)if(("data"!==b||!$.isEmptyObject(a[b]))&&"toJSON"!==b)return!1;return!0}function f(){return!1}function g(){return!0}function h(a){return!a||!a.parentNode||11===a.parentNode.nodeType}function i(a,b){do a=a[b];while(a&&1!==a.nodeType);return a}function j(a,b,c){if(b=b||0,$.isFunction(b))return $.grep(a,function(a,d){var e=!!b.call(a,d,a);return e===c});if(b.nodeType)return $.grep(a,function(a){return a===b===c});if("string"==typeof b){var d=$.grep(a,function(a){return 1===a.nodeType});if(Kb.test(b))return $.filter(b,d,!c);b=$.filter(b,d)}return $.grep(a,function(a){return $.inArray(a,b)>=0===c})}function k(a){var b=Nb.split("|"),c=a.createDocumentFragment();if(c.createElement)for(;b.length;)c.createElement(b.pop());return c}function l(a,b){return a.getElementsByTagName(b)[0]||a.appendChild(a.ownerDocument.createElement(b))}function m(a,b){if(1===b.nodeType&&$.hasData(a)){var c,d,e,f=$._data(a),g=$._data(b,f),h=f.events;if(h){delete g.handle,g.events={};for(c in h)for(d=0,e=h[c].length;e>d;d++)$.event.add(b,c,h[c][d])}g.data&&(g.data=$.extend({},g.data))}}function n(a,b){var c;1===b.nodeType&&(b.clearAttributes&&b.clearAttributes(),b.mergeAttributes&&b.mergeAttributes(a),c=b.nodeName.toLowerCase(),"object"===c?(b.parentNode&&(b.outerHTML=a.outerHTML),$.support.html5Clone&&a.innerHTML&&!$.trim(b.innerHTML)&&(b.innerHTML=a.innerHTML)):"input"===c&&Xb.test(a.type)?(b.defaultChecked=b.checked=a.checked,b.value!==a.value&&(b.value=a.value)):"option"===c?b.selected=a.defaultSelected:"input"===c||"textarea"===c?b.defaultValue=a.defaultValue:"script"===c&&b.text!==a.text&&(b.text=a.text),b.removeAttribute($.expando))}function o(a){return"undefined"!=typeof a.getElementsByTagName?a.getElementsByTagName("*"):"undefined"!=typeof a.querySelectorAll?a.querySelectorAll("*"):[]}function p(a){Xb.test(a.type)&&(a.defaultChecked=a.checked)}function q(a,b){if(b in a)return b;for(var c=b.charAt(0).toUpperCase()+b.slice(1),d=b,e=rc.length;e--;)if(b=rc[e]+c,b in a)return b;return d}function r(a,b){return a=b||a,"none"===$.css(a,"display")||!$.contains(a.ownerDocument,a)}function s(a,b){for(var c,d,e=[],f=0,g=a.length;g>f;f++)c=a[f],c.style&&(e[f]=$._data(c,"olddisplay"),b?(e[f]||"none"!==c.style.display||(c.style.display=""),""===c.style.display&&r(c)&&(e[f]=$._data(c,"olddisplay",w(c.nodeName)))):(d=cc(c,"display"),e[f]||"none"===d||$._data(c,"olddisplay",d)));for(f=0;g>f;f++)c=a[f],c.style&&(b&&"none"!==c.style.display&&""!==c.style.display||(c.style.display=b?e[f]||"":"none"));return a}function t(a,b,c){var d=kc.exec(b);return d?Math.max(0,d[1]-(c||0))+(d[2]||"px"):b}function u(a,b,c,d){for(var e=c===(d?"border":"content")?4:"width"===b?1:0,f=0;4>e;e+=2)"margin"===c&&(f+=$.css(a,c+qc[e],!0)),d?("content"===c&&(f-=parseFloat(cc(a,"padding"+qc[e]))||0),"margin"!==c&&(f-=parseFloat(cc(a,"border"+qc[e]+"Width"))||0)):(f+=parseFloat(cc(a,"padding"+qc[e]))||0,"padding"!==c&&(f+=parseFloat(cc(a,"border"+qc[e]+"Width"))||0));return f}function v(a,b,c){var d="width"===b?a.offsetWidth:a.offsetHeight,e=!0,f=$.support.boxSizing&&"border-box"===$.css(a,"boxSizing");if(0>=d||null==d){if(d=cc(a,b),(0>d||null==d)&&(d=a.style[b]),lc.test(d))return d;e=f&&($.support.boxSizingReliable||d===a.style[b]),d=parseFloat(d)||0}return d+u(a,b,c||(f?"border":"content"),e)+"px"}function w(a){if(nc[a])return nc[a];var b=$("<"+a+">").appendTo(P.body),c=b.css("display");return b.remove(),("none"===c||""===c)&&(dc=P.body.appendChild(dc||$.extend(P.createElement("iframe"),{frameBorder:0,width:0,height:0})),ec&&dc.createElement||(ec=(dc.contentWindow||dc.contentDocument).document,ec.write("<!doctype html><html><body>"),ec.close()),b=ec.body.appendChild(ec.createElement(a)),c=cc(b,"display"),P.body.removeChild(dc)),nc[a]=c,c}function x(a,b,c,d){var e;if($.isArray(b))$.each(b,function(b,e){c||uc.test(a)?d(a,e):x(a+"["+("object"==typeof e?b:"")+"]",e,c,d)});else if(c||"object"!==$.type(b))d(a,b);else for(e in b)x(a+"["+e+"]",b[e],c,d)}function y(a){return function(b,c){"string"!=typeof b&&(c=b,b="*");var d,e,f,g=b.toLowerCase().split(bb),h=0,i=g.length;if($.isFunction(c))for(;i>h;h++)d=g[h],f=/^\+/.test(d),f&&(d=d.substr(1)||"*"),e=a[d]=a[d]||[],e[f?"unshift":"push"](c)}}function z(a,c,d,e,f,g){f=f||c.dataTypes[0],g=g||{},g[f]=!0;for(var h,i=a[f],j=0,k=i?i.length:0,l=a===Kc;k>j&&(l||!h);j++)h=i[j](c,d,e),"string"==typeof h&&(!l||g[h]?h=b:(c.dataTypes.unshift(h),h=z(a,c,d,e,h,g)));return!l&&h||g["*"]||(h=z(a,c,d,e,"*",g)),h}function A(a,c){var d,e,f=$.ajaxSettings.flatOptions||{};for(d in c)c[d]!==b&&((f[d]?a:e||(e={}))[d]=c[d]);e&&$.extend(!0,a,e)}function B(a,c,d){var e,f,g,h,i=a.contents,j=a.dataTypes,k=a.responseFields;for(f in k)f in d&&(c[k[f]]=d[f]);for(;"*"===j[0];)j.shift(),e===b&&(e=a.mimeType||c.getResponseHeader("content-type"));if(e)for(f in i)if(i[f]&&i[f].test(e)){j.unshift(f);break}if(j[0]in d)g=j[0];else{for(f in d){if(!j[0]||a.converters[f+" "+j[0]]){g=f;break}h||(h=f)}g=g||h}return g?(g!==j[0]&&j.unshift(g),d[g]):void 0}function C(a,b){var c,d,e,f,g=a.dataTypes.slice(),h=g[0],i={},j=0;if(a.dataFilter&&(b=a.dataFilter(b,a.dataType)),g[1])for(c in a.converters)i[c.toLowerCase()]=a.converters[c];for(;e=g[++j];)if("*"!==e){if("*"!==h&&h!==e){if(c=i[h+" "+e]||i["* "+e],!c)for(d in i)if(f=d.split(" "),f[1]===e&&(c=i[h+" "+f[0]]||i["* "+f[0]])){c===!0?c=i[d]:i[d]!==!0&&(e=f[0],g.splice(j--,0,e));break}if(c!==!0)if(c&&a["throws"])b=c(b);else try{b=c(b)}catch(k){return{state:"parsererror",error:c?k:"No conversion from "+h+" to "+e}}}h=e}return{state:"success",data:b}}function D(){try{return new a.XMLHttpRequest}catch(b){}}function E(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function F(){return setTimeout(function(){Vc=b},0),Vc=$.now()}function G(a,b){$.each(b,function(b,c){for(var d=(_c[b]||[]).concat(_c["*"]),e=0,f=d.length;f>e;e++)if(d[e].call(a,b,c))return})}function H(a,b,c){var d,e=0,f=$c.length,g=$.Deferred().always(function(){delete h.elem}),h=function(){for(var b=Vc||F(),c=Math.max(0,i.startTime+i.duration-b),d=c/i.duration||0,e=1-d,f=0,h=i.tweens.length;h>f;f++)i.tweens[f].run(e);return g.notifyWith(a,[i,e,c]),1>e&&h?c:(g.resolveWith(a,[i]),!1)},i=g.promise({elem:a,props:$.extend({},b),opts:$.extend(!0,{specialEasing:{}},c),originalProperties:b,originalOptions:c,startTime:Vc||F(),duration:c.duration,tweens:[],createTween:function(b,c){var d=$.Tween(a,i.opts,b,c,i.opts.specialEasing[b]||i.opts.easing);return i.tweens.push(d),d},stop:function(b){for(var c=0,d=b?i.tweens.length:0;d>c;c++)i.tweens[c].run(1);return b?g.resolveWith(a,[i,b]):g.rejectWith(a,[i,b]),this}}),j=i.props;for(I(j,i.opts.specialEasing);f>e;e++)if(d=$c[e].call(i,a,j,i.opts))return d;return G(i,j),$.isFunction(i.opts.start)&&i.opts.start.call(a,i),$.fx.timer($.extend(h,{anim:i,queue:i.opts.queue,elem:a})),i.progress(i.opts.progress).done(i.opts.done,i.opts.complete).fail(i.opts.fail).always(i.opts.always)}function I(a,b){var c,d,e,f,g;for(c in a)if(d=$.camelCase(c),e=b[d],f=a[c],$.isArray(f)&&(e=f[1],f=a[c]=f[0]),c!==d&&(a[d]=f,delete a[c]),g=$.cssHooks[d],g&&"expand"in g){f=g.expand(f),delete a[d];for(c in f)c in a||(a[c]=f[c],b[c]=e)}else b[d]=e}function J(a,b,c){var d,e,f,g,h,i,j,k,l,m=this,n=a.style,o={},p=[],q=a.nodeType&&r(a);c.queue||(k=$._queueHooks(a,"fx"),null==k.unqueued&&(k.unqueued=0,l=k.empty.fire,k.empty.fire=function(){k.unqueued||l()}),k.unqueued++,m.always(function(){m.always(function(){k.unqueued--,$.queue(a,"fx").length||k.empty.fire()})})),1===a.nodeType&&("height"in b||"width"in b)&&(c.overflow=[n.overflow,n.overflowX,n.overflowY],"inline"===$.css(a,"display")&&"none"===$.css(a,"float")&&($.support.inlineBlockNeedsLayout&&"inline"!==w(a.nodeName)?n.zoom=1:n.display="inline-block")),c.overflow&&(n.overflow="hidden",$.support.shrinkWrapBlocks||m.done(function(){n.overflow=c.overflo <truncated>
文件名 23B523C9E7746F715D33C6527C18EB9D
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D
文件大小 200 字节
文件类型 data
MD5 2aad967a5f0d53c2a22f1a10ee490b42
SHA1 34f5969fb19ee979ad274e338dee6527aa757a8c
SHA256 f1cdd414d9ef759fb3b8fd5063b9fd54f86148620920c913874942d603b2bfc4
CRC32 8D9CDC38
Ssdeep 3:kkFklMk8/ntt3kty/sl9llursal/LW7UtnRlR84jpU+IGorTlj:kKA8vUtOEIsaRW7cnRHj21Goj
下载提交魔盾安全分析
文件名 sq.clientclass2[1].js
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HEL4YQ7U\sq.clientclass2[1].js
文件大小 25617 字节
文件类型 UTF-8 Unicode text, with very long lines, with no line terminators
MD5 66ef832ac38fb77c380a9bfa9992416e
SHA1 391e8f473cdbf68b68ecc7f1c80b0feaeb07efc0
SHA256 97e69edbce449206a47ea5ce9ca56490f8544f1a2f1526a3d3e10aa3d10afa82
CRC32 E578892C
Ssdeep 384:2c2YIlIrWgdmzRRf9e4XOv9xEmCivmw4uEhpbiPto3Y3Bgel81N1:X0V9aFxEIPto3QBnCN1
下载提交魔盾安全分析显示文本
var hosts="37.com";!function($){function WebSuperCall(a,b){var c=null;try{c=$.parseJSON(b)}catch(d){c=null}CC["pcDef"+a]&&CC["pcDef"+a].fn.apply(CC["pcDef"+a].def,[a,c])}function DoSuperCall(a,b){try{var c={1:function(){return{name:"getcookie"}}};b=b||c[a](),window.external.DoSuperCall(a,stringify(b))}catch(d){}}function stringify(a,b){var c,d,e,f,g,h=/["\\\x00-\x1f\x7f-\x9f]/g;switch(typeof a){case"string":return h.test(a)?'"'+a.replace(h,function(a){var b=m[a];return b?b:(b=a.charCodeAt(),"\\u00"+Math.floor(b/16).toString(16)+(b%16).toString(16))})+'"':'"'+a+'"';case"number":return isFinite(a)?String(a):"null";case"boolean":case"null":return String(a);case"object":if(!a)return"null";if("function"==typeof a.toJSON)return stringify(a.toJSON());if(c=[],"number"==typeof a.length&&!a.propertyIsEnumerable("length")){for(f=a.length,d=0;f>d;d+=1)c.push(stringify(a[d],b)||"null");return"["+c.join(",")+"]"}if(b)for(f=b.length,d=0;f>d;d+=1)e=b[d],"string"==typeof e&&(g=stringify(a[e],b),g&&c.push(stringify(e)+":"+g));else for(e in a)"string"==typeof e&&(g=stringify(a[e],b),g&&c.push(stringify(e)+":"+g));return"{"+c.join(",")+"}"}}var CC=new SQ.Class(SQ.Widget),sqLogin=SQ.Login,sqAlert=SQ.alert;CC.include($.extend({init:function(a){CC.options=this.options=$.extend(!0,{},{gameId:0,data:null,gameName:"",pageSize:0,logEvent:CC.logEvent,regEvent:CC.regEvent,regType:"",testTagShow:!1,testTagName:"",testTagType:"2",clientUrl:"",gameUrl:""},a),CC.gameName=this.gameName=this.options.gameName,CC.gameId=this.gameId=this.options.gameId,CC.data=this.data=this.options.data,this.options.clientUrl&&(CC.url=this.options.clientUrl),this.options.gameUrl&&(CC.gameUrl=this.options.gameUrl),this.events(),SQ.Statis.setReferer()},events:function(){var a;$(document).on("focusin.login.register",".log-form input, .reg-form input",function(){$(this).addClass("input-focus")}).on("focusout.login.register",".log-form input, .reg-form input",function(){$(this).removeClass("input-focus")}).on("focusout.login","#log-username",function(){(a=sqLogin.checkUsername($(this).val()))!==!0?CC.inputStatus($(this),"status-w"):CC.inputStatus($(this),"status-r")}).on("focusout.login","#log-password",function(){(a=sqLogin.checkPassword($(this).val()))!==!0?CC.inputStatus($(this),"status-w"):CC.inputStatus($(this),"status-r")}).on("focusout.register","#reg-username",function(){(a=sqLogin.checkUsername($(this).val(),!0))!==!0?CC.inputStatus($(this),"status-w"):CC.inputStatus($(this),"status-r")}).on("focusout.register","#reg-password",function(){(a=sqLogin.checkPassword($(this).val()))!==!0?CC.inputStatus($(this),"status-w"):CC.inputStatus($(this),"status-r")}).on("focusout.register","#reg-password2",function(){$(this).val()!==$("#reg-password").val()||(a=sqLogin.checkPassword($(this).val()))!==!0?CC.inputStatus($(this),"status-w"):CC.inputStatus($(this),"status-r")})},login:{init:function(a){var b=CC.data;CC.statis({game_id:CC.gameId,refer:b.refer,uid:b.uid,page:1}),this.dom=$.extend({u_dom:"#log-username",p_dom:"#log-password",c_dom:"#checkbox",a_dom:"a.btn-log",l_dom:".checkbox-label"},a),this.username=$(this.dom.u_dom),this.password=$(this.dom.p_dom),this.checkbox=$(this.dom.c_dom),sqLogin.getUsername(this.username),""===this.username.val()?this.username.focus().addClass("input-focus"):this.password.focus().addClass("input-focus"),$("#log-kv").length&&this.kv(),"1"===b.thirdlogin&&CC.thirdLogBtn($(".client-third-link"),"log"),this.events()},events:function(){var a=this;$(document).on("click.login",this.dom.a_dom,function(b){b.preventDefault(),a.toLog()}).on("keypress.game",this.dom.u_dom+", "+this.dom.p_dom,function(b){13===b.keyCode&&a.toLog()}).on("click.check",this.dom.c_dom+", "+this.dom.l_dom,function(b){b.preventDefault(),a.checkbox.toggleClass("checked")})},kv:function(){new SQ.Tab({tabs:"#log-kv .log-kv-nav:first a",panels:"#log-kv .log-kv-panel",auto:!0})},toLog:function(){var a,b,c,d,e={login_account:this.username.val(),password:this.password.val(),gameid:CC.gameId,remember_me:this.checkbox.hasClass("checked")?1:0,ltype:2};return a=e.login_account,(c=sqLogin.checkUsername(a))!==!0?(CC.inputStatus(this.username,"status-w"),void(sqAlert?sqAlert(c):alert(c))):(CC.inputStatus(this.username,"status-r"),b=e.password,(d=sqLogin.checkPassword(b))!==!0?(CC.inputStatus(this.password,"status-w"),void(sqAlert?sqAlert(d):alert(d))):(CC.inputStatus(this.password,"status-r"),CC.paramOptions=$.extend({success:function(){CC.options.logEvent.suc()},fail:function(a){a&&a.msg&&("safe_true"!==a.data||-7!==a.code&&-11!==a.code?CC.options.logEvent.fai(a):CC.vc.isOpen?CC.vc.refreshImg():CC.vc.open())}},e),CC.paramOptions.funName="toLog",void sqLogin.toLog(CC.paramOptions)))}},register:{init:function(a){this.dom=$.extend({u_dom:"#reg-username",p_dom:"#reg-password",p2_dom:"#reg-password2",c_dom:"#checkboxname",a_dom:"a.btn-reg"},a),this.username=$(this.dom.u_dom),this.password=$(this.dom.p_dom),this.password1=$(this.dom.p2_dom),this.checkbox=$(this.dom.c_dom),this.username.focus().addClass("input-focus"),this.events();var b=CC.data;"1"===b.thirdlogin&&CC.thirdLogBtn($(".client-third-link"),"reg",CC.options.regType),CC.statis({game_id:CC.gameId,refer:b.refer,uid:b.uid,page:4})},events:function(){var a=this;$(document).on("keypress.game",this.dom.u_dom+", "+this.dom.p_dom+", "+this.dom.p2_dom,function(b){13===b.keyCode&&a.toReg()}).on("click.register",this.dom.a_dom,function(b){b.preventDefault(),a.toReg()}).on("click.check",this.dom.c_dom,function(b){b.preventDefault(),a.checkbox.toggleClass("check-on")})},toReg:function(){var a,b,c=1,d={login_account:this.username.val(),password:this.password.val(),password1:this.password1.val()};return(a=sqLogin.checkUsername(d.login_account,!0))!==!0?(CC.inputStatus(this.username,"status-w"),void(sqAlert?sqAlert(a):alert(a))):(CC.inputStatus(this.username,"status-r"),(b=sqLogin.checkPassword(d.password,d.login_account))!==!0?(CC.inputStatus(this.password,"status-w"),void(sqAlert?sqAlert(b):alert(b))):(CC.inputStatus(this.password,"status-r"),d.password!==d.password1?(CC.inputStatus(this.password1,"status-w"),void(sqAlert?sqAlert("\xe4\xb8\xa4\xe6\xac\xa1\xe5\xaf\x86\xe7\xa0\x81\xe8\xbe\x93\xe5\x85\xa5\xe4\xb8\x8d\xe4\xb8\x80\xe8\x87\xb4"):alert("\xe4\xb8\xa4\xe6\xac\xa1\xe5\xaf\x86\xe7\xa0\x81\xe8\xbe\x93\xe5\x85\xa5\xe4\xb8\x8d\xe4\xb8\x80\xe8\x87\xb4"))):(CC.inputStatus(this.password1,"status-r"),this.checkbox.length>0&&(c=this.checkbox.hasClass("check-on")?1:0),void(c&&this["toRegPost"+CC.options.regType]($.extend(d,CC.data))))))},toRegPost:function(a){a.abrefer=a.refer+"|"+(a.uid||"")+"|"+(a.version||""),a.ltype=2,CC.paramOptions=$.extend({success:function(){CC.options.regEvent.suc(a)},fail:function(a){a&&a.msg&&(-10===a.code?CC.vc.isOpen||CC.vc.open():(CC.vc.isOpen&&CC.vc.refreshImg(),CC.options.regEvent.fai(a.msg)))}},a),CC.paramOptions.funName="toReg",sqLogin.toReg(CC.paramOptions)},toRegPostAd:function(a){var b=CC.regUrl.replace("{login_account}",encodeURIComponent(a.login_account)).replace("{password}",encodeURIComponent(a.password)).replace("{password1}",encodeURIComponent(a.password1)).replace("{refer}",a.refer).replace("{uid}",a.uid||"").replace("{version}",a.version||"").replace("{installtime}",a.installtime).replace("{game_id}",a.game_id).replace("{server_id}",a.server_id);CC.Jsonp(b,{success:function(b){b.is_hg&&1===+b.is_hg&&(a.is_hg=b.is_hg),CC.options.regEvent.suc(a)},fail:function(a){a&&a.msg&&CC.options.regEvent.fai(a.msg)}})}},history:{init:function(){var a=CC.data;CC.statis({game_id:CC.gameId,refer:a.refer,uid:a.uid,page:5}),this.events()},events:function(){$(document).on("click.history",".logout",function(a){a.preventDefault(),sqLogin.toOut(function(){location.href=CC.url+(/\?/.test(CC.url)?"&":"?")+$.param({game_id:CC.gameId,tpl_type:CC.data.tpl_type,showlogintype:CC.data.showlogintype})})})}},server:{page:1,focus:0,isLoadingCache:{},init:function(a){var b=CC.data,c=$("#server-list");CC.statis({game_id:CC.gameId,refer:b.refer,uid:b.uid,page:2}),this.options=$.extend({totalPage:0,firstTab:"\xe6\x9c\x80\xe6\x96\xb0\xe6\x8e\xa8\xe8\x8d\x90",totalServer:"",fastinVal:0,fastinFun:null},a),this.tabsTitle=c.children("ul"),this.tabsPanelWrap=c.find(".server-list-p"),this.loading=c.find("div.list-loading"),this.events()},events:function(){var a=this;$(document).on("click.fastin",".btn-fastin",function(b){b.preventDefault(),CC.fastIn($(this).prev().v <truncated>
文件名 game3[1].css
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CB4GP22D\game3[1].css
文件大小 11685 字节
文件类型 assembler source, UTF-8 Unicode text
MD5 5aa4a49bc14acee272c4900435bbf3d0
SHA1 9d0b84f965a27696f1cff6d59dfc64ba0ba45cfe
SHA256 f4a34fe55cc9122e1960336726f1f282f367abff6ccb1658d7e7211d2d0bd8a3
CRC32 093E78EF
Ssdeep 192:6jlTdz6AgRwWLyOms/3l+bgkPEolTQrGrtxgdeq6eV87OIB0vugIoDMm3Y6ESTFC:mkFsBjAzdWkBtYnWjLek5NDBThIUs
下载提交魔盾安全分析显示文本
@charset "utf-8";

html, body, div, span, iframe,h1, h2, p, blockquote, pre,abbr, em, img, samp,small, strong, sub,b, i,dl, dt, dd, ul, li,
fieldset, form, label, legend,table, caption, tbody, tfoot, thead, tr, th, td,article, aside, canvas, details, figcaption, 
figure, footer, header,hgroup, menu, nav, section, summary {margin:0;padding:0;border:0;outline:0;}
a, input, button {padding:0;margin:0;outline:0;border:none;}
body {font-size:12px;font-family:"\xe5\xbe\xae\xe8\xbd\xaf\xe9\x9b\x85\xe9\xbb\x91";}
ul {list-style:none;}
a {text-decoration:none;}
a:hover {text-decoration:underline;}
table {border-collapse:collapse;border-spacing:0;}
input,select,img {vertical-align:middle;}
.clearfix {zoom:1;}
.clearfix:after {clear:both;display:block;content:"";}


/* function */
.relative {position:relative;}
.left {float:left;_display:inline;}
.right {float:right;_display:inline;}
.placeholder {color:#6f5850 !important;}
.hide {display:none;}
.checkbox, .check {display:inline-block;width:14px;height:14px;vertical-align:middle;position:relative;background:transparent url(game3/rem.png) no-repeat;}
.checked, .check-on {background:transparent url(game3/rem_on.png) no-repeat;}
.btn-s {float:left;_display:inline;margin:0 6px 6px 5px;display:block;width:152px;height:28px;line-height:28px;text-align:center;background:url(game3/server-btn.jpg) no-repeat;color:#f5e5ba;}
.btn-s:hover {background:url(game3/server-btn-on.jpg) no-repeat;}

/* layout x:84px;y:197px;*/
.container {width:896px;height:487px;overflow:hidden;color:#606056;background:#000;}
.log {background:url(game3/bg8.jpg) no-repeat;}
.reg {background:url(game3/bg8.jpg) no-repeat;}
.history {background:url(game3/server4.jpg) no-repeat;}
.server {background:url(game3/loged.jpg) no-repeat;}

/* log */

/* kv */
.kv-focus {width:487px;height:375px;overflow:hidden;position:absolute;top:56px;left:34px;border:none;padding:0;}
.log-kv {position:relative;width:487px;height:375px;overflow:hidden;}
.log-kv img {vertical-align:bottom;width:487px;height:375px;}
.log-kv-nav {position:absolute;bottom:0;right:5px;}
.log-kv-nav a {float:left;display:block;background:url(game3/kv-ico.png) no-repeat;color:#000;padding:6px;margin-right:5px;_display:inline;text-indent:-9999px;font-size:0;}
.log-kv-nav .focus, .log-kv-nav a:hover {background:url(game3/kv-ico.png) no-repeat -16px 0;color:#fff;text-decoration:none;}

/* news */
.news {width:320px;height:144px;overflow:hidden;position:absolute;top:60px;left:538px;}
.news li {padding:0 5px;height:26px;border:none;line-height:22px;background:none;}
.news li a {float:left;display:inline-block;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;width:200px;color:#c7b480;}
.news li span.cate {float:left;display:inline-block;width:30px;height:18px;margin:2px 0;padding-right:2px;color:#e36c4b;line-height:18px;background:url(game3/news_span.jpg) no-repeat;text-align:center;}
.news li span.news-date {float:left;display:inline;color:#c7b480;}

.fh {width:1002px;height:562px;position:absolute;top:0;left:0;z-index:1;}
.text {position:absolute;bottom:60px;right:60px;}
/* log-form */
.log-form, .reg-form {width:250px;height:337px;overflow:hidden;top:92px;left:598px;*zoom:1;z-index:10;}
.log-form p, .reg-form p {width:250px;height:22px;overflow:hidden;padding:26px 0 0;}
.log-form p.p-l-usr {padding:56px 0 0;}
.log-form p.p-l-pwd {}
.log-form label, .reg-form label {float:left;display:inline-block;width:89px;height:22px;text-indent:-999px;}
.log-form input, .reg-form input {float:left;width:138px;height:22px;padding:0 5px;background:none;border:none;color:#fff;line-height:22px;}
.log-form span.status, .reg-form span.status {display:none;width:6px;height:24px;float:left;padding:0;}
.log-form span.status-r, .reg-form span.status-r {background:url(game3/input-status.png) no-repeat 9px -4px;}
.log-form span.status-w, .reg-form span.status-w {background:url(game3/input-status.png) no-repeat 9px -36px;}

.log-form p.log-form-footer {padding:14px 0 0 32px;height:19px;background:none;}
.log-form-footer .checkbox {margin:0 6px 0 0;}
.log-form-footer .checkbox-label {color:#f7e9df;}
.log-form-footer .forget {margin:0 0 0 18px;color:#f1e0d3;}

.btn {display:block;position:absolute;}
.btn-log, .btn-reg {width:183px;height:65px;left:39px;top:196px;}
.btn-log:hover {background:url(game3/sprite.png) no-repeat 0 -65px;}
.btn-log:active {background:url(game3/sprite.png) no-repeat 0 0;}
.btn-reg-short, .btn-log-short {width:109px;height:28px;left:76px;top:275px;}
.btn-reg-short:hover {background:url(game3/sprite.png) no-repeat -109px -130px;}
/*.btn-reg-short:active {background:url(game3/sprite.png) no-repeat 0 -130px;}*/


/* reg */
.reg-form {background:url(game3/reg.jpg) no-repeat;}
.reg-form p.p-r-usr {padding:56px 0 0;}
.reg-form .reg-tip {display:none;}
.reg-form p.sc {padding:10px 0 0 10px;height:16px;line-height:16px;background:none;}
.reg-form p.sc a{color:#ab6f35;}

.btn-reg {top:217px;}
.btn-reg:hover {background:url(game3/sprite.png) no-repeat -183px -65px;}
.btn-reg:active {background:url(game3/sprite.png) no-repeat -183px 0;}
.btn-log-short {top:296px;}
.btn-log-short:hover {background:url(game3/sprite.png) no-repeat 0 -158px;}
/*.btn-log-short:active {background:url(game3/sprite.png) no-repeat -218px -130px;}*/

/* third x:789;y:331*/ 
.third .log-form {background:url(game4/th_log.jpg) no-repeat;}
.third .btn-log {top:176px;}
.third .btn-reg-short, .third .btn-log-short {width:80px;height:20px;left:92px;top:252px;}
.third .btn-reg-short {background:url(game4/th-reg-short.jpg) no-repeat;}
.third .btn-reg-short:hover {background:url(game4/th-reg-short-h.jpg) no-repeat;}

.third .reg-form {background:url(game4/th_reg.jpg) no-repeat;}
.third .reg-form p {padding:21px 0 0;}
.third .reg-form p.p-r-usr {padding:47px 0 0;}
.third .reg-form p.sc {padding:10px 0 0 10px;}
.third .btn-reg {top:195px;}
.third .btn-log-short {background:url(game4/th-log-short.jpg) no-repeat;top:266px;}
.third .btn-log-short:hover {background:url(game4/th-log-short-h.jpg) no-repeat;}

.client-third {position:absolute;height:24px;line-height:24px;display:none;left:12px;top:282px;}
.reg-form .client-third {top:295px;}
.client-third span {display:block;float:left;color:#9c8b83;}
.third-logo {width:24px;height:24px;float:left;display:inline;margin:0 10px;background-image: url(http://img1.37wanimg.com/www2015/images/common/third-logo-24.png);_background-image:url(http://img1.37wanimg.com/www2015/images/common/third-logo-24-8.png)}
.third-logo-qq {background-position: 0 0;}
.third-logo-wechat {background-position: 0 -40px;}
.third-logo-weibo {background-position: 0 -80px;}

/* server */

.welcome {width:576px;height:22px;line-height:22px;color:#e1a021;position:absolute;top:18px;left:25px;text-align:left;}
.welcome .account, .welcome-hty .account {color:#fff4d6;margin-right:10px;}
.welcome a, .welcome-hty a {color:#d81313;}

.lately, .best {width:152px;height:28px;line-height:28px;position:absolute;top:347px;left:543px;text-align:center;color:#fff;}
.lately a, .best a {width:152px;float:left;_display:inline;margin:0;display:block;height:28px;line-height:28px;text-align:center;background:url(game3/server-btn.jpg) no-repeat;color:#f5e5ba;}
.lately a:hover, .best a:hover {background:url(game3/server-btn-on.jpg) no-repeat;}
.lately span {top:202px;left:6px;}
.best {left:543px;top:260px;}

.choose {width:250px;height:22px;position:absolute;top:16px;left:589px;line-height:22px;color:#554d40;z-index:10;}
.server-fastin {width:43px;height:18px;display:inline;text-align:center;background:#5e432e;border:none;color:#d8d6d6;}
.btn-fastin-d {width:62px;height:22px;display:inline-block;background:url(game3/fastin.jpg) no-repeat;vertical-align:middle;}

.select-dom {width:82px;height:16px;float:left;display:inline;padding:2px 0;background:#5e432e;border:1px solid #050404;line-height:16px;}
.select-con {width:58px;height:16px;float:left;display:inline;padding:0 0 0 3px;color:#c6bdb1;}
.select-btn {float:left;width:16px;height:16px;display:inline;margin-right:3px;cursor:pointer;_font-size:0;overflow:hidden;background:url(game3/select-btn.jpg) no-repeat;}
.option-bg {position:absolute;top:37px;
    right: 223px;padding:2px 0 0;z-index:15;display:none;height: 173px;}
.opti <truncated>
文件名 sq.tab[1].js
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HEL4YQ7U\sq.tab[1].js
文件大小 1679 字节
文件类型 ASCII text, with very long lines, with no line terminators
MD5 6307cfff3a79c1debdfbb74e362d2bd9
SHA1 2f16c517cd6ec52c2a6a978ebbff8861412c006e
SHA256 bf8cf01a18233cf567e7638e3115c7145ac0b09698a2ec85980e23826366d784
CRC32 FBE8F905
Ssdeep 48:N7E5oWKa11hrRBMfxx/aT+W1u+DLYIAu6qVl:tvWKa5rsbaiKfqu6qT
下载提交魔盾安全分析显示文本
!function(a,b,c){var d=new c.Class(c.Widget);d.include({init:function(b){this.options={el:"body",tabs:"li",panels:"div",eventType:"click",index:0,auto:!1,interval:5e3,animate:{show:"show",hide:"hide"},currentClass:"focus"},a.extend(this.options,b||{}),this.el=a(this.options.el),this.tabs=a(this.options.tabs,this.el),this.panels=a(this.options.panels,this.el),this.el.attr("data-kid",this.id),this.change(this.options.index),this._events(),this.options.auto&&this.auto()},change:function(a){var b=this.options.currentClass;this.tabs.filter("."+b).removeClass(b),this.tabs.eq(a).addClass(b),this.panels.hide().eq(a)[this.options.animate.show](),this.currentIndex=a,this.trigger("change",a,this)},_events:function(){this.tabs.bind(this.options.eventType,this.proxy(this._eventHandler)),this.options.auto&&(this.tabs.bind("mouseenter",this.proxy(this.stop)),this.tabs.bind("mouseleave",this.proxy(this.auto)),this.panels.bind("mouseenter",this.proxy(this.stop)),this.panels.bind("mouseleave",this.proxy(this.auto)))},_eventHandler:function(a){var b=a.currentTarget;if(!(b.className.indexOf(this.options.currentClass)>-1)){var c=0;return this.tabs.each(function(a){return b===this?(c=a,!1):void 0}),this.change(c),!1}},auto:function(){this.timerId=b.setInterval(this.proxy(this._autoHandler),this.options.interval),this.trigger("auto",this)},_autoHandler:function(){var a=this.currentIndex+1;a>=this.tabs.size()&&(a=0),this.change(a)},stop:function(){this.timerId&&(b.clearInterval(this.timerId),this.trigger("stop",this))},_destroying:function(){this.stop(),this.el.removeAttr("data-kid"),this.tabs.unbind(this.options.eventType),this.panels.unbind()}}),c.Tab=d}(jQuery,window,SQ);
文件名 rem_on[1].png
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CB4GP22D\rem_on[1].png
文件大小 1979 字节
文件类型 PNG image data, 14 x 14, 8-bit colormap, non-interlaced
MD5 43095e7e7fa46635e48bc31ea3e3fadb
SHA1 a255ad8fae45fc667cb7f31c1a283e95ace91911
SHA256 9958adf0c26aa55e5e27b659170237ad048bc30a0e2ea06bfc3d2037f18d865d
CRC32 5F14947E
Ssdeep 24:E1h4SHWwjx82lY2T3UVs5DayJ3VHpGXaRn6Nh49YdIwgd3VN:KKS2Nn2wCthJ3zEI6SYdIwgVVN
下载提交魔盾安全分析
文件名 game3[1].js
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HEL4YQ7U\game3[1].js
文件大小 35004 字节
文件类型 UTF-8 Unicode text, with CRLF line terminators
MD5 2545a76165ef1b5e72cf017c99a447b5
SHA1 7f00cf77b7992e466182437501d3da9c8133adb1
SHA256 96f9bc698427c45e5aee205ab20484674f56e892d10377598818d8f95a909901
CRC32 3A31BE65
Ssdeep 384:CotUhcrltKp7zQjNYbTlCQgqh4SqhZSGphhfLm3:hL7e7zQCUPqh4SqhZSGphhfLW
下载提交魔盾安全分析显示文本
/*
 * client  game.js
 * @author hanzh
 * @date 2014-04-17
 */
(function( $, SQ, undefined ){
    var Panel_id_mx = 10,user_refer = "";
    //\xe4\xbc\xa0\xe5\xa5\x87\xe9\x9c\xb8\xe4\xb8\x9auser_refer\xe4\xbd\x9c\xe7\x89\xb9\xe6\xae\x8a\xe5\xa4\x84\xe7\x90\x86\xef\xbc\x8c\xe5\xa6\x82\xe6\x9e\x9curl\xe5\xad\x98\xe5\x9c\xa8\xef\xbc\x8c\xe5\x88\x99\xe5\xb8\xa6\xe4\xb8\x8a\xe6\xad\xa4user_refer
    user_refer =  ( SQ.getParam("user_refer") == "cbqctq" ) ? "&user_refer=cbqctq" : "";
    user_refer && $(".btn-log-short").attr("href","http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3"+user_refer);
    user_refer && $(".btn-reg-short").attr("href","http://gameapp.37.com/controller/client.php?game_id=275&tpl_type=game3&action=register"+user_refer);
    var page = "",
        clientC,
        game = {
            init: function() {
                if (SQ.getParam( "pagetype" ) == "1" ) {
                    page = "";
                }
                clientC = new SQ.ClientClass({
                    gameId: DefaultGameId,
                    data: DefaultDataMeta,
                    gameName: DefaultGameName,
                    pageSize: 1500,
                    logEvent: {
                        suc: function() {
                            SQ.ClientClass.skipToServer( {} );
                        },
                        fai: function( res ) {
                            alert( res.msg );
                        }
                    },
                    regEvent: {
                        suc: function( options ) {
                            if ( options.is_hg && +options.is_hg === 1 ) {
                                var hgurl = "http://game.37.com/mir_play.php?" + $.param( {
                                    action: "play",
                                    sid: options.sid,
                                    client: "pc",
                                    wd_entergame: 1,
                                    wd_server: "S" + options.sid,
                                    wd_username: options.login_account,
                                    game_id: DefaultGameId,
                                    showlogintype: DefaultDataMeta.showlogintype
                                } );
                                location.href = hgurl + user_refer;
                                return;
                            }
                            if ( options.server_id ) {
                                SQ.ClientClass.enterGame( options.sid, options.login_account );
                            } else {
                                SQ.ClientClass.skipToServer();
                            }
                        },
                        fai: function( msg ) {
                            alert( msg );
                        }
                    },
                    testTagShow: true,
                    regType: "Ad",
                    gameUrl: "http://gameapp.37.com/controller/client.php?action=play&sid={sid}&client=pc&wd_entergame=1&wd_server=S{sid}&wd_username={login_account}"+user_refer,
                    clientUrl:"http://gameapp.37.com/controller/client.php?game_id="+DefaultGameId+"&tpl_type=game"+user_refer
                });
                this.login();
                this.register();
                this.history.init();
                this.server.init();
            },

            login: function() {
                var $div = $( ".log-form" );
                if ( !$div.length ) {
                    return;
                }
                clientC.login.init();
            },
            register: function() {
                var $div = $( ".reg-form" );
                if ( !$div.length ) {
                    return;
                }
                clientC.register.init();
            },

            kv: function() {
                var currentIndex = 0,
                    tab = new SQ.Tab({
                        el: ".content",
                        tabs: ".con-tab li",
                        panels: ".con-li"
                    }),
                    $welcome = $(".welcome");

                $( '#arrow-right' ).on( 'click', function() {
                    currentIndex = $( ".con-tab" ).find( ".focus" ).index() + 1;
                    if( currentIndex > tab.tabs.length - 1 ){
                        currentIndex = 0;
                    }
                    if(currentIndex == tab.tabs.length - 1) {
                        $welcome.hide();
                    }else {
                        $welcome.show();
                    }
                    tab.change( currentIndex );
                    var $dom = $( ".con-li" ).eq(currentIndex),
                        $img = $dom.find("img");
                    if($img.eq(0).attr("src") == "http://img1.37wanimg.com/mir/css/client/game/btn_bg.jpg"){
                        $img.each(function( i, e ) {
                            var imgUrl = $( e ).attr( "lazy-src" );
                            var img = new Image();
                            img.onload = function(){
                                //SQ.log(img);
                                $( e ).attr( "src", imgUrl );
                            };
                            img.src = imgUrl;
                        });
                    }
                });

                $( '#arrow-left' ).on( 'click', function() {
                    currentIndex = $( ".con-tab" ).find( ".focus" ).index() - 1;
                    if( currentIndex < 0  ){
                        currentIndex = tab.tabs.length - 1;
                    }
                    if(currentIndex == tab.tabs.length - 1) {
                        $welcome.hide();
                    }else {
                        $welcome.show();
                    }
                    tab.change( currentIndex );
                    var $dom = $( ".con-li" ).eq(currentIndex),
                        $img = $dom.find("img");
                    if($img.eq(0).attr("src") == "http://img1.37wanimg.com/mir/css/client/game/btn_bg.jpg"){
                        $img.each(function( i, e ) {
                            var imgUrl = $( e ).attr( "lazy-src" );
                            var img = new Image();
                            img.onload = function(){
                                //SQ.log(img);
                                $( e ).attr( "src", imgUrl );
                            };
                            img.src = imgUrl;
                        });
                    }
                });

            },

            history: {
                init: function() {
                    var $welcomeHty = $( ".content" );
                    if( !$welcomeHty.length ) {
                        return;
                    }
                    game.kv();
                    clientC.history.init();
                    var that = this;

                    SQ.Login.getUserInfo({
                        gameid: clientC.gameId
                    }, function( res ) {
                        that.parse( res );
                    });
                },

                parse: function( res ) {
                    // \xe7\x94\xa8\xe6\x88\xb7\xe5\x90\x8d
                    SQ.byId( "account" ).innerHTML = res.LOGIN_ACCOUNT;
                    SQ.ClientClass.LOGIN_ACCOUNT = res.LOGIN_ACCOUNT;
                    return;
                    var h = res.HISTORY_HOT_GAMESERVER,
                        $latelyHty = $( ".lately-hty" );
                    $bestHty = $( "#best-hty" );
                    $btnLatest = $( "#btn-latest" ),
                        t = "<a href=\"{url}\" class=\"\">{SERVER_NAME}</a>";

                    if(!h[0]){
                        $bestHty.show();

                        SQ.ClientClass.getServerList({
                            page: 1,
                            page_size: clientC.options.pageSize,
                            game_id: clientC.gameId,
                            server_type: 0,
                            success: function( res ) {
                                SQ.ClientClass.totalServer = res.msg;
                                var l = res.data[0];
           <truncated>
文件名 \xe5\x8d\xb8\xe8\xbd\xbd\xe8\xb6\x85\xe9\x9c\xb8\xe4\xbc\xa0\xe5\xa5\x87.lnk
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\\xe8\xb6\x85\xe9\x9c\xb8\xe4\xbc\xa0\xe5\xa5\x87\\xe5\x8d\xb8\xe8\xbd\xbd\xe8\xb6\x85\xe9\x9c\xb8\xe4\xbc\xa0\xe5\xa5\x87.lnk
文件大小 1889 字节
文件类型 MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Fri Sep 16 07:20:02 2016, mtime=Wed Nov 16 16:30:01 2016, atime=Fri Sep 16 07:20:02 2016, length=137440, window=hide
MD5 916e0e8051a8642c361a289020dd1ae0
SHA1 e6cba2a8a732b8364a9bb178437c960e6f3d9c63
SHA256 be869e115829f72c7e727202900cf836fa5de8c272585cb2f21c5231148d81ab
CRC32 DEB501D5
Ssdeep 24:8/ICdOEaskyDAT1qsfdM8dDdMUO2MkUPqharPaa:8/ICdOHsjk5qcdM8dDdM6MxyQ
下载提交魔盾安全分析
文件名 cav_vcs.exe
相关文件
C:\Program Files (x86)\legend\cav_vcs.exe
文件大小 1418376 字节
文件类型 PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d8d5637e5e109f94b5a4149f05e9b44d
SHA1 30b3fd20a0ea01d0828d3efd6d51456cb30a7e6b
SHA256 9d1e42f8feb307ef96b724e34829f69421fd459a22259828fee4341c1989e794
CRC32 6A124A34
Ssdeep 24576:UYKaDtKd9Kk2r5zyVprooO9MIZSKOCbUghyAjQ6qr:xDtKd9K5r4VpEorIbOufjQ6qr
Yara
  • Look for MD5 constants
下载提交魔盾安全分析
文件名 test@37[1].txt
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Windows\Cookies\test@37[1].txt
文件大小 81 字节
文件类型 ASCII text
MD5 90f3d6dbcb1ee38fa96dced31bebbbcf
SHA1 d429da159738db3c5f46c34667fa064647a08564
SHA256 70b5f28932948dd542a9fd24bbb4b47351a3d31359d14f69a0847dafc200f2f6
CRC32 52ECC4F2
Ssdeep 3:8j1iXkkjIKvUVXJU3VdFTWoaXV6pz/:s1iXRjItVXIuKj
下载提交魔盾安全分析显示文本
tg_uv
My7LWN49GKUBAAAA3QZY
37.com/
1024
1844640640
31314660
664736320
30556330
*
文件名 MSIMGSIZ.DAT
相关文件
C:\Users\test\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT
文件大小 16384 字节
文件类型 data
MD5 021ddaf81af79246b46e2da007c81559
SHA1 501922b8c6f4d2dbf21fc97f6d20d18b5f453e9a
SHA256 3203eb4e477ee41d40a93cb9635e6b517e1d7c002e474a7f753d08b2988a3cf9
CRC32 D2D75060
Ssdeep 24:jYlIoF7mi7s+BCVKwNazuCIp3NasW9+9K8trW0DXakBrHaFLRR+DkMfiu+wJiUd2:j8NV7s+BCVKqaIaz+9K8VTFBr6pwd2
下载提交魔盾安全分析
文件名 logo[1].png
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CB4GP22D\logo[1].png
文件大小 2347 字节
文件类型 PNG image data, 60 x 20, 8-bit colormap, non-interlaced
MD5 6142cd2a65df15c394d940971446a722
SHA1 37f121f4aa57a10bde16fd2679e1e5402a933510
SHA256 a96b1e39f020cc90d078c3bcdb001a5e290a26b49d9aed95e1650a9c6c33d8f1
CRC32 35618280
Ssdeep 48:KKS2Nn2w1vZ4J3ZZXAZ5EAPXZz3KWCd+lYlY5SJTAO+IR6HOd72tJ:RSK2gWFUEEXq2AAO+IRsYY
下载提交魔盾安全分析
文件名 httpsEnable[1].gif
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDL4J1KW\httpsEnable[1].gif
文件大小 43 字节
文件类型 GIF image data, version 89a, 1 x 1
MD5 b4491705564909da7f9eaf749dbbfbb1
SHA1 279315d507855c6a4351e1e2c2f39dd9cd2fccd8
SHA256 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
CRC32 0516692F
Ssdeep 3:CUkxl7/lHh/:slf/
下载提交魔盾安全分析
文件名 sq.statis[1].js
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HEL4YQ7U\sq.statis[1].js
文件大小 6303 字节
文件类型 C source, UTF-8 Unicode text, with very long lines, with no line terminators
MD5 664e871748cfe7ea7fadc501fa8344bb
SHA1 f1cc78c11f96d6292797b1f08a2e571dea35db4f
SHA256 a33d3a42d598d659faf83ee96c6860e22894a28ed9a11cef08374e1ac166575f
CRC32 3F69BE49
Ssdeep 96:t6dApENyytOcgxUbNfRV7QCC7cnD2bZaF+F8UIqufNw7MomKyb8iKyO:tuApENyytkUbtxCkF+uUpT7vXOJKh
下载提交魔盾安全分析显示文本
!function(a,b,c){var d,e={version:"1.2.2",Track:{},Trigger:{url:"http://a.clickdata.37wan.com/controller/istat.controller.php",defaults:{platform:"37wan",item:"",game_id:"",sid:"",position:"",ext_1:"",ext_2:"",ext_3:"",ext_4:"",ext_5:"",ext_6:"",login_account:"",browser_type:"",user_ip:""}},convertMap:{baidu_pinpai:"baidu_ppzq"},getDocReferrer:function(a){var b="",c=a||document.referrer;return c&&(b=c.split("://")[1].split("/"),b=a?b[0]+"/"+b[1]:b[0]),b},convertPathToDomain:function(a){var b="",c=/^www.37.com\/([0-9a-z]+)$/;return a=this.getDocReferrer(a),c.test(a)&&(b=a.split("/")[1]+".37.com"),b},addDom:function(b,c,d){c=c||"script",this.d&&d&&document.body.removeChild(this.d),b&&(this.d=document.createElement(c),"script"===c?this.d.type="text/javascript":this.d.style.display="none",this.d.src=b+(b.indexOf("?")>-1?"&t=":"?t=")+a.now(),document.body.appendChild(this.d))},referCookie:"37wanrefer",setReferer:function(a,c){var d,e,f,g,h,i,j,k,l,m,n=document.referrer,o=top.window.location.search,p=/^https?:\/\/(?:www|search)\.(baidu|soso|sogou|google|so|youdao|jike|panguso).+(?:\?|&)(?:wd|q|query)=([^&]+)/;if(/(\?|&)(source|refer(er)?)=\S+/.test(o)){for(h=["refer","uid","ad_param","wd","ad_type"],i=0,j=h.length,g=[],l=b.queryToJson(o),i;j>i;i++)d=l[h[i]],0===i&&(d=d||l.referer||l.source,d=this.convertMap[d]||d),2===i&&(d=d||l.ab_param),4===i&&(d=d||l.ab_type),g.push(d||"");g=g.join("|")}else c?g=c:(k=this.getDocReferrer(),k?(f=k.split("."),e=f.length,"37.com"!==f.splice(e-2,2).join(".")?(m=p.exec(n),g=m&&m[1]&&m[2]?k+"|||"+m[2]+"|":k):g=""):g=a?this.convertPathToDomain(window.location.href):window.location.host);return g&&b.cookie(this.referCookie,g,{path:"/",domain:"37.com"}),g},getReferer:function(){return b.cookie(this.referCookie)},updateReferer:function(a,c){var d=this.getReferer();d&&(d=d.split("|"),d[a]=c,b.cookie(this.referCookie,d.join("|"),{path:"/",domain:"37.com"}))},hasAdReferer:function(a){var b=this.getReferer();return/(\?|&)(source|refer(er)?)=\S+/.test(a||window.location.href)||b&&b.indexOf("|")>-1&&-1===b.split("|")[0].indexOf(".")},delReferer:function(){b.cookie(this.referCookie,null,{path:"/",domain:"37.com"})},setADcookie:function(){a("body").append("<div style='display:none'><img src='http://cm.he2d.com/1/' /></div>")}};e.Source=b.Class.create({dataUrl:"http://ptres.37.com/js/sq/modules/game_source.js",sourceCookie:"37tg_param",init:function(c,e,f,g){var h=b.cookie(this.sourceCookie),i=b.getParam("source");this.cookieParam=b.queryToJson(h),this.param=f||[],this.$link=c,this.source=i||this.cookieParam.source,g=g||this.dataUrl,c&&c.length&&e&&this.source&&a.getScript(g,a.proxy(function(){this.targetUrl=d[e][this.source],h?this._getCookie():this._setCookie()},this))},_getCookie:function(){delete this.cookieParam.source,this._setBtn(this.cookieParam)},_setCookie:function(){b.cookie(this.sourceCookie,"?source="+this.source+"&"+this._parseParam(),{path:"/"}),this._setBtn()},_setBtn:function(a){this.$link.prop("href",this._addParam(a))},_addParam:function(a){return this.targetUrl?this.targetUrl.indexOf("?")>-1?this.targetUrl+"&"+this._parseParam(a):this.targetUrl+"?"+this._parseParam(a):b.log&&b.log("\xe6\xb3\xa8\xe5\x86\x8c\xe6\x8c\x89\xe9\x92\xae\xef\xbc\x9a\xe6\x89\xbe\xe4\xb8\x8d\xe5\x88\xb0\xe5\xaf\xb9\xe5\xba\x94\xe7\x9a\x84 url ")},_parseParam:function(c){var d,e=0,f=this.param,g=f.length;if(c=c||{},a.isEmptyObject(c))for(;g>e;e++)d=f[e],c[d]=b.getParam(d);return a.param(c)}},{getSource:function(a){d=a}}),e.Track.Ad=b.Class.create({param:["click_type","web_r"],adUrl:"http://www.37.com/test/checkin.php",paramReferrer:"web_urlrefer",init:function(a,b){this.url=b||window.location.href,this.param=a||this.param,this._parseParam(this.param)},_parseParam:function(a){for(var c,d=0,f=a.length,g={};f>d;d++)c=a[d],g[c]=b.getParam(c,this.url);g[this.paramReferrer]=e.getDocReferrer(),this._request(g)},_request:function(b){e.addDom(this.adUrl+"?"+a.param(b))}}),e.Trigger.Download=b.Class.create({init:function(c,d,f){this.downLoadUrl=f||c.attr("data-url"),c.on("click",a.proxy(function(c){if(c.preventDefault(),"string"==typeof d)return void this._download(d);var f=a.extend({},e.Trigger.defaults,d);return f.item?void this._download(e.Trigger.url+"?"+a.param(f)):b.log&&b.log("\xe6\xb2\xa1\xe6\x9c\x89\xe7\xbb\x9f\xe8\xae\xa1\xe5\x85\xb3\xe9\x94\xae\xe5\x8f\x82\xe6\x95\xb0 item")},this))},_download:function(a){e.addDom(a),e.addDom(this.downLoadUrl,"iframe")}}),e.Trigger.Click=b.Class.create({init:function(b,c){b.on("click",a.proxy(function(d){var f=b.attr("target");if(a.nodeName(b[0],"a")&&!f&&(d.preventDefault(),this.refresh=b[0].href),"string"==typeof c)return void this._request(c);var g=a.extend({},e.Trigger.defaults,c);return g.item?void this._request(e.Trigger.url+"?"+a.param(g)):alert("\xe6\xb2\xa1\xe6\x9c\x89\xe7\xbb\x9f\xe8\xae\xa1\xe5\x85\xb3\xe9\x94\xae\xe5\x8f\x82\xe6\x95\xb0 item")},this))},_request:function(a){e.addDom(a),this.refresh&&(window.location.href=this.refresh,this.refresh="")}}),e.Trigger.Load=b.Class.create({init:function(b){if("string"==typeof b)return void this._request(b);var c=a.extend({},e.Trigger.defaults,b);return c.item?void this._request(e.Trigger.url+"?"+a.param(c)):alert("\xe6\xb2\xa1\xe6\x9c\x89\xe7\xbb\x9f\xe8\xae\xa1\xe5\x85\xb3\xe9\x94\xae\xe5\x8f\x82\xe6\x95\xb0 item")},_request:function(a){e.addDom(a)}}),e.ImgStatis=b.Class.create({statis:function(){b.log(this.opt.e4);var c=this.url+"?"+a.param(this.opt),d=new Image;d.src=c},init:function(c,d,e){return"object"!=typeof c?void b.log("param error!"):(this.url=d||"http://pt.clickdata.37.com/ps.gif",this.interval=e||60,this.opt={la:"",gid:"",sid:"",e1:"",e2:"",e3:0,e4:0,e5:1,e6:"",e7:"",ext:""},a.extend(this.opt,c),(!this.opt.e4||isNaN(this.opt.e4))&&(this.opt.e4=0),void this.run())},run:function(){var a=this;a.statis(),a.opt.e4+=a.interval,window.setTimeout(function(){a.run()},1e3*this.interval)}}),e.Online=b.Class.create({init:function(c){if("object"!=typeof c)return void b.log("param error!");var d=a.extend({},{login_account:"",game_server_id:"",ext:""},c);if(!d.login_account||!d.game_server_id)return void b.log("\xe6\xb2\xa1\xe6\x9c\x89\xe7\xbb\x9f\xe8\xae\xa1\xe5\x85\xb3\xe9\x94\xae\xe5\x8f\x82\xe6\x95\xb0 login_account\xe6\x88\x96game_server_id");this.interval=6e4,d.login_account=encodeURIComponent(d.login_account),d.game_server_id=parseInt(d.game_server_id,10);var e="http://ol.37wan.com/checkin?"+a.param(d);this.run(e)},run:function(a){e.addDom(a,"script",1);var b=this;window.setTimeout(function(){b.run(a)},b.interval)}}),b.Statis=e;var f=b.byId("sq-statis-refer");f&&b.Statis.setReferer(f.getAttribute("data-path")),a(document).ready(function(){b.Statis.setADcookie()})}(jQuery,SQ);
文件名 System.dll
相关文件
C:\Users\test\AppData\Local\Temp\nsdA0C3.tmp\System.dll
文件大小 11264 字节
文件类型 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
CRC32 BFEE9B1E
Ssdeep 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
魔盾安全分析结果 0.5分析时间:2016-11-13 09:44:58查看分析报告
下载提交魔盾安全分析
文件名 uninst.exe
相关文件
C:\Program Files (x86)\legend\uninst.exe
文件大小 137440 字节
文件类型 PE32 executable (GUI) Intel 80386, for MS Windows
MD5 12f4f08f61322ff9c2ab71879deca6a6
SHA1 bb26bd8ce59406098f5cf0a8ca60761eaa070c47
SHA256 e1b3177391519673a1b00c04d196c00f5e1d3ad19c74dc1577d9427b9179fa0b
CRC32 68113652
Ssdeep 3072:eQIURTXJMDxghetE1sNevwHXhXq98iHIhrbilU40Uu8:esSyFxvwHXA2h/iu4Tu8
下载提交魔盾安全分析
文件名 test@he2d[1].txt
相关文件
C:\Users\test\AppData\Roaming\Microsoft\Windows\Cookies\test@he2d[1].txt
文件大小 85 字节
文件类型 ASCII text
MD5 034b3f3a86e2a04d73ac8099119616a5
SHA1 157332b6123630e446fb012a8da99356e5c7eb53
SHA256 9d223af58cd68c84ecbe7f2d615017882bea40169058c34e8588bcdafd94994d
CRC32 0161BA8A
Ssdeep 3:AaciXkkJ4GK/v7YcdTRVdFTW8VSpz/:AaciXRJ4GKjdN8j
下载提交魔盾安全分析显示文本
u
My7LWN49GKUBAAAA3QZY
he2d.com/
2147484672
1844640640
31314660
662856320
30556330
*
文件名 5024A99DB487E61F859A7848B9CAE2C4
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5024A99DB487E61F859A7848B9CAE2C4
文件大小 284 字节
文件类型 data
MD5 d9d6090360d59783ddad1069acb0130f
SHA1 febb962bbf2fb5bdab418e24ee04fd203049d1a1
SHA256 32264dac92af2f110931b5e0e85d8c543e086edb1d0c8458a032221942a145ec
CRC32 94198A49
Ssdeep 6:kKplUVw2sV3yzwwRGlKopZpRMcelTDUT+DhUag:DofUXWnBDUTyDg
下载提交魔盾安全分析
文件名 third-logo-24[1].png
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EHDRIWWS\third-logo-24[1].png
文件大小 1604 字节
文件类型 PNG image data, 24 x 104, 8-bit colormap, non-interlaced
MD5 a1ef4405c7942e6b466a7c569d5ba411
SHA1 776980e31cac1b79d394bc3531aed7c73c6b36c8
SHA256 320f68140664f8cb91e164d87d816e646954dafb94c99512922f70019d4400d8
CRC32 7018AA99
Ssdeep 48:gtcGGGGGGGGGGWw5DltSDKwqvU/+lWh5ULrDv:qcGGGGGGGGGx44KH5l25urDv
下载提交魔盾安全分析
文件名 23B523C9E7746F715D33C6527C18EB9D
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D
文件大小 325 字节
文件类型 data
MD5 4d22081bc256ade1b0c26e17fdbb904c
SHA1 3d3cb5ef7dcd564c5d863b97588f7b6bfea6cd5d
SHA256 b53790f3b3870239b567b97be53f9428fb80d407847fc3ebdd8c68a6bf446a4d
CRC32 5DC993E9
Ssdeep 6:3vMVRQ+mm6/eVeVQ7AWe3j6QGd1fD/utmUTmuNk3hcfMskFxChT:fMnQu6/K1AWe2FDGtMdSfVOxw
下载提交魔盾安全分析
文件名 0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875
相关文件
C:\Users\test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875
文件大小 358 字节
文件类型 data
MD5 9b50ee5ccfb8719300de5793e83b247d
SHA1 d415913973c31fb67b213f9990ccebdd6e6284b3
SHA256 bea5d88e81e965b2c1d041ed311edcc5b60a408dc604ef3d55cbf04a63601334
CRC32 48883E5E
Ssdeep 6:kK4XySoaRGlK0IqEdMClroFHF9fKprxGfDWDmu86XtlrpSlAMlsMJn:wyA7FDsFXC0rAXdHksMJ
下载提交魔盾安全分析
文件名 bg8[1].jpg
相关文件
C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EHDRIWWS\bg8[1].jpg
文件大小 762920 字节
文件类型 PNG image data, 895 x 487, 8-bit/color RGB, non-interlaced
MD5 c7959d10b252b78d32d3a4dc32de7d67
SHA1 9286d519421223acc5c0e79e058fed960ed902c8
SHA256 cb2fa937b39968c4ad17c62be4618f5fd4043333666548e9640f3a7708b56703
CRC32 8F3BC1C0
Ssdeep 12288:BkPAVPHZe51ePxdsFCK/8ahzB0EpMq+e9mAWUUXjcBf+zMj/dFvHd+OI:BkPAl5e51ePrsFP/toaMGgcBGzMj/Td8
下载提交魔盾安全分析
没有发现相似的分析.
HTML 总结报告
(需15-60分钟同步)
下载

Processing ( 230.71 seconds )

  • 211.647 NetworkAnalysis
  • 7.206 Dropped
  • 5.723 Static
  • 2.512 VirusTotal
  • 2.403 BehaviorAnalysis
  • 0.526 peid
  • 0.329 TargetInfo
  • 0.182 Strings
  • 0.119 AnalysisInfo
  • 0.057 Debug
  • 0.003 Memory
  • 0.003 config_decoder

Signatures ( 2.201 seconds )

  • 1.038 md_bad_drop
  • 0.208 antiav_detectreg
  • 0.106 stealth_timeout
  • 0.079 infostealer_ftp
  • 0.047 infostealer_im
  • 0.044 antianalysis_detectreg
  • 0.033 infostealer_mail
  • 0.031 antivm_generic_scsi
  • 0.03 stealth_file
  • 0.029 bootkit
  • 0.029 antivm_generic_disk
  • 0.027 antiav_detectfile
  • 0.024 mimics_filetime
  • 0.024 virus
  • 0.023 antiemu_wine_func
  • 0.023 md_domain_bl
  • 0.021 dridex_behavior
  • 0.02 reads_self
  • 0.018 infostealer_bitcoin
  • 0.015 antivm_generic_services
  • 0.015 heapspray_js
  • 0.015 geodo_banking_trojan
  • 0.012 kibex_behavior
  • 0.011 infostealer_browser
  • 0.011 stealth_network
  • 0.011 shifu_behavior
  • 0.011 antivm_vbox_files
  • 0.011 recon_fingerprint
  • 0.01 virtualcheck_js
  • 0.01 betabot_behavior
  • 0.01 persistence_autorun
  • 0.01 darkcomet_regkeys
  • 0.01 ransomware_files
  • 0.009 sets_autoconfig_url
  • 0.007 antiav_avast_libs
  • 0.007 antivm_generic_diskreg
  • 0.006 injection_createremotethread
  • 0.006 antivm_vbox_libs
  • 0.005 antisandbox_sunbelt_libs
  • 0.005 disables_wfp
  • 0.005 network_torgateway
  • 0.004 hawkeye_behavior
  • 0.004 disables_spdy
  • 0.004 tinba_behavior
  • 0.004 antisandbox_sboxie_libs
  • 0.004 antiav_bitdefender_libs
  • 0.004 antidbg_devices
  • 0.004 antisandbox_productid
  • 0.004 disables_browser_warn
  • 0.004 network_http
  • 0.004 packer_armadillo_regkey
  • 0.003 office_dl_write_exe
  • 0.003 network_tor
  • 0.003 kazybot_behavior
  • 0.003 java_js
  • 0.003 antidbg_windows
  • 0.003 vawtrak_behavior
  • 0.003 injection_runpe
  • 0.003 silverlight_js
  • 0.003 antivm_vbox_acpi
  • 0.003 antivm_vbox_keys
  • 0.003 antivm_vmware_keys
  • 0.003 antivm_vpc_keys
  • 0.003 modify_proxy
  • 0.003 browser_security
  • 0.003 bypass_firewall
  • 0.003 rat_pcclient
  • 0.003 recon_programs
  • 0.002 clickfraud_cookies
  • 0.002 exec_crash
  • 0.002 js_phish
  • 0.002 antivm_generic_bios
  • 0.002 antivm_generic_cpu
  • 0.002 antivm_generic_system
  • 0.002 antivm_vmware_files
  • 0.002 modify_uac_prompt
  • 0.002 sniffer_winpcap
  • 0.002 targeted_flame
  • 0.001 internet_dropper
  • 0.001 browser_scanbox
  • 0.001 network_anomaly
  • 0.001 antivm_vmware_libs
  • 0.001 injection_explorer
  • 0.001 js_suspicious_redirect
  • 0.001 antianalysis_detectfile
  • 0.001 antivm_vpc_files
  • 0.001 banker_cridex
  • 0.001 banker_zeus_mutex
  • 0.001 bot_drive
  • 0.001 bot_drive2
  • 0.001 browser_addon
  • 0.001 disables_system_restore
  • 0.001 maldun_blacklist
  • 0.001 md_url_bl
  • 0.001 modify_security_center_warnings
  • 0.001 network_cnc_http
  • 0.001 network_tor_service
  • 0.001 office_security
  • 0.001 ransomware_extensions
  • 0.001 rat_spynet
  • 0.001 stealth_hiddenreg
  • 0.001 stealth_hide_notifications

Reporting ( 0.721 seconds )

  • 0.697 ReportHTMLSummary
  • 0.024 Malheur
Task ID 84947
Mongo ID 58cb2f982e063351afec715c
Cuckoo release 1.4-Maldun