##### NORMAN SHARK ### The Chinese Malware Complexes: # The Maudi Surveillance Operation ###### Snorre Fagerland, Principal Security Researcher ----- ###### Introduction Maudi is a series of small malwares that share similar configuration and behaviour. The naming of this family has not been very established, but some samples are detected by some vendors as Maudi or PoisonIvy. This is partly accurate as Maudi trojans in almost all cases install the well known PoisonIvy remote access trojan. These malwares are not particularly new - they have been in circulation for a long time, probably going back to at least 2009. Still, they provide a backdrop to other attacks that is interesting. Behaviour The malware itself is not very complex. These are small installers that create two files – one library (typically called msacm32.drv, ntshrui.dll or wdmaud.drv) in the Windows folder, and a raw PoisonIvy shellcode blob called user.dat, user.db, temp.db or something along those lines. The installer then spawns explorer.exe, which then automatically loads the malicious library through a mechanism called DLL hijacking aka DLL preloading (1). There are innocent libraries with the same names in the Windows System folder, but since the malicious libraries are placed in the Windows folder, they sneak in the queue and Explorer loads them first. The malicious library then reads and directly calls the PoisonIvy code in user.dat, which establishes an encrypted communication with the configured C&C server. When communication is established, the attacker has unauthorized access to the computer. ----- ###### Configuration PoisonIvy code blobs are preconfigured in the PoisonIvy builder program to contain information about which Command & Control server to contact, which port to establish connection on, and various other parameters. The PoisonIvy builder The Maudi PoisonIvy droppers contain their own small xor-encoded configuration block which overrides the default settings stored in the PoisonIvy blob. This usually contains the name of the C&C server, port and what corresponds to the PoisonIvy profile ID. Example Maudi configuration: Profile ID: xfish C&C: 171088046.gnway.org port: 0x0D84 = 3460 The ID xfish is used in many of these malwares and may be a default value, but there are many others in use. ----- ###### PoisonIvy uses the Camellia 256-bit block cipher for its encrypted communication. The password for this communication is usually hardcoded in the malware itself; the default value used by the builder is “admin”. The passwords used by Maudi droppers vary. Sometimes the default value is used, other times the password is set to longer strings. There seems to be an affinity for passwords of length 11 (0x0b). A few are shown below. 20110105110 12345678901 beijing2011 41232619820 20110228001 20110000000 11111111111 Some Maudi-PoisonIvy server passwords ----- ###### Certificates The interesting bit with these trojans is that practically all of them are digitally signed using self-made test certficates. These certificates vary somewhat, but most contain the recognizable string “WWW.CeleWare.NET” or “WWW.AeleWare.NET” in their Organizational Unit (OU) section. The CeleWare strings are default values left by the free code signing tool CeleSign.exe from Yonsm.NET. Though the tool itself seems innocent enough, many files signed by it are malicious. There were a number of different such certificates, and it may be that the varying certificates denote different campaigns, projects or other contexts – for example, all samples we have seen signed “DataBase@Hotmail.com” are droppers that install Maudi components signed “MogolSoft@Hotmail.com” or “SoftSign@HotMail.com”. ----- ###### Stolen certificates Though by far most of these malwares use test certificates, not all follow this pattern. A few are not signed at all, and in two cases we have seen the use of a stolen certificate. The certificate in question belongs to YNK Japan Inc. This is the configuration block from one of the YNK-signed Maudi samples. C&C is p.hannmaill.net, port is 3460 (0xD84), and tag is xfish. These two trojans are configured to connect to p.hannmaill.net and s.hiinet.net, respectively. These domains appear registered by the same entity (sofoxman@gmail.com). Both the domains and the certificate have been connected to targeted attack campaigns before. ----- ###### Infrastructure By combining certificates and command&control infrastructure we can construct a partial image of this malware operation Note: A high-resolution version of this graphic is appended to this report. In this diagram the samples are organized in clusters signed similarly. What quickly becomes obvious is that most of the samples are connected; either they use the same certificate, or their certificate cluster is connected with other clusters through common Command&Control servers. Some clusters (shown at the lower right and left side) seem unconnected beyond the fact that they use the same malware. The Command&Control servers used are in many cases organized through well-known dynamic DNS providers such as 3322.org, zapto.org and so on, but there are also a few seemingly directly registered second level domains. A full list of these is provided in the appendix. ----- ###### Targeting Local Chinese interests and human rights activists We do not have extensive data on which targets have been exposed to Maudi malware, but we have some examples which give decent hints. Some Maudi droppers display images, like the ones below: This picture was widely distributed in 2009, and allegedly showed results of violence during an Uighur riot. However, it was later reported to be taken from a car accident. This picture from Xinhuanet is reportedly from the 2008 riots in Lhasa, Tibet. ----- ###### These are classic examples of decoys used in targeted campaigns against activists working for the rights of ethnic minorities within the Chinese borders. Other decoy documents contain small messages in Chinese; and Chinese name listings. This gives the general impression that this family is used mostly against domestic Chinese targets and human rights activists. Other research has confirmed this impression. In his 2010 article “Human Rights and Malware Attacks” (2), security researcher Nart Villeneuve documents the use of Maudi as the downloaded payload of spearphishing attacks. The initial payload in that case was a mail attachment, an exploited PDF file (readme.pdf, md5 72bdca7dd12ed04b21dfa60c5c2ab6c4) which downloaded and decoded an encoded blob (md5 ec16143a14c091100e7af30de03fce1f) from the site www.humanright-watch.org, not to be confused with the legitimate Human Rights’ Watch website hrw.org. The decoded file was a Maudi dropper, self-signed using the name “soft@hotmail.com”, and the dropped component belonged to the “JinDiQIAO@hotmail.com”-signed cluster. Mongolia There are hints at other targets as well. A group of Maudis use domain names and other strings that seem to indicate a focus on a specific region, namely Mongolia. Mongolia is an interesting country. It is democratic with a multi-party system, and has a market-driven economy. It is squeezed between two very powerful nations – Russia to the North and China to the South. It is also a country rich on geological natural resources. The initial hints about this targeting are vague. Some of the Maudi samples are signed using self-signed certificate issued to “mogolsoft@hotmail.com”. Others use the Command & Control domain “mol-goverment.com”. This domain was registered by a known targeted attack actor, hlemonk@163.com, who has registered a string of other malware- connected domains – among others goodmongol.com. However, when looking more closely, more solid ties to Mongolian targets can be found. The Maudi domain bodologetee.com (registered by the email entity mongolianews@yahoo.com) can be documented used in other attacks on apparent Mongolian targets. For example, the malware dropper cc1a806d25982acdb35dd196ab8171bc, a WinRAR SFX executable installed through the use of the Word exploit CVE-2012-0158, contained a PlugX component configured to connect to ppt.bodologetee.com. This is documented in the Norman Shark blog post “The Chinese Malware Complexes: PlugX Used against Mongolian Targets”. (3) ----- ###### Connections to other attacks Indirectly, we see that the Maudi infrastructure shares parameters with several well known targeted attack campaigns. ## o qwer.wekby.com - domain ###### Three samples connect to qwer.wekby.com, known from the RSA breach in 2011 (4). These samples are (md5, profile ID): ``` 28b5241ca13603636dbf626792231161, qwerw 6a83dc3f53079e17ecc49cbc0dacc8f5, qwerw cf45dbdb3718b4b728c2dd894032464b, qwerw The malwares used in the RSA intrusion itself were also PoisonIvy, though used a different dropper mechanism and were signed using a different digital certificate. ## o jeno_1980@hotmail.com – domain registration ###### Two samples connect to ns2.adultstick.com. This domain was registered by jeno_1980@hotmail.com, an email address also used to register domains used both in the Mirage (5) and Sin Digoo (6) malware campaigns. 7d36ad6aafbf1f9496ccc6ac1a8bb57e, Irqdz 64718689ee3ff695c55ea1ec213434d1, Irqdz ## o enbtcd@yahoo.com.co – domain registration ###### Some Maudi samples connect to windows-liveupdate.com or windowsliveupdatecache.com, domains registered by the entity enbtcd@yahoo.com.co. This address has also registered domains used in Briba (aka c0d0so0) malware, which has been used for many targeted attacks. bd9a1fbd76c00015a59a3b5c93d4030e, zwdb c64aab79e5107fc8ffd4699288c2e3be, gzzx c9f33d544c5657d4ba55a92e06e38d06, Qbxt 49c7cae0fda8e5089e993a169c6c4197, krgqy 914fdaf7aa098ac00067a2b265fc91da, qq ``` ----- ## o hlemonk@163.com - domain registration ###### This address was used to register the Maudi domains mol-government.com and newsyandex.com, used to host C&C for these samples: ``` c93f8a7a899142db1e92138b76407588 227636fb88e19eca33a02cbb46f279fb 6e88c39c270e259c4472f6eceb8a241f 865fec48937686c2d0708847f30b1264 c07e857d2602d2a813fd23d711871571 a25e5bcc52c386eb046149799ed81b2b 3563c21cf5c46e8e39f17e733c2b9b1e, h511b0 e78d39d1862338e4c711238223618e44, h511b0 This registrant has also registered a great deal of other dodgy domains. Mol-government.com and these other domains have been used as C&C by Sogu/Thoper trojans in attacks on apparent Korean and Mongolian targets, as well as by other malwares like PcClient. ## o yt.bodologetee.com – domain ###### This domain has been used as Command & Control domain for a number of samples. It has also been documented used by PlugX malware in campaigns apparently against Mongolian targets (3). The same registration information was used to register yahoomesseges.com, which has been used by EvilGrab (7) malware. 0cf15b88b18cdedfaae598e9498768e3, beijingnew 1e60824de00ce3c1f62fddc54a9c5c93, jiagu c64dd5393a17226b208b049a4b766bd6, jiagu 646cfe960219f1948eac580e3bd836f8, text1 ef404a76bd11e1d675b7686775ed7f1c, nsc01 ## o YNK JAPAN Inc – digital certificate ###### As previously mentioned, two samples were digitally signed using a certificate belonging to YNK JAPAN Inc.; a subsidiary of a Korean game producer. This certificate has been used in several hundred samples spanning various campaigns and incidents. One of these was the SK intrusion (8) in 2011, where one of the initial malwares - a Sogu/Thoper trojan - was signed with it. 771a376df6aba0ce31e0c8e43cdf0800, xfish c3d14ee0bd01ebc9e5844578babe462f, xfish ``` ----- ###### Conclusion The Maudi malware family seems to have been mostly used against Chinese/South-East Asian targets. However, it shares some indicators (C&C domains, registration information) with other, more high-profile attacks. What these connections mean is unclear. It might be just sharing of information between groups; we know that there is quite a bit of sharing going on, particularly of malware and source code. Less is known about how much is shared in terms of infrastructure (ex. domains). It is our opinion, however, that the Maudi system hints at something else. There is for example a large amount of samples that use the same self-signed certificates in addition to overlaps in other indicators. Self-signed certificates have little value in the underground as they can be freely made; so there is little reason for sharing these. Instead the impression is that these malwares have been signed by the same malware creation system. Another aspect is the architecture where default PoisonIvy shellcode blobs are overridden with configuration information from the dropper. This also may indicate homegrown build tools, possibly to alleviate language issues with the PoisonIvy builder itself. There is a possibility that this indicates a large group of attackers, but might also be a part of a Digital Quartermaster function, as recently postulated by FireEye (9). ----- ###### References 1. Windows Incident Response. It's those darned DLLs again... . [Online] http://windowsir.blogspot.no/2010/08/its- those-darned-dlls-again.html. 2. Villeneuve, Nart. Human Rights and Malware Attacks. [Online] http://www.nartv.org/2010/07/29/human-rights-and- malware-attacks/. 3. Fagerland, Snorre. PlugX used against Mongolian targets. Norman Shark Blog. [Online] http://normanshark.com/blog/plugx-used-mongolian-targets/. 4. Branco, Rodrigo. Into the Darkness: Dissecting Targeted Attacks. [Online] https://community.qualys.com/blogs/securitylabs/2011/11/30/dissecting-targeted-attacks. 5. Cutler, Silas. The Mirage Campaign. [Online] http://www.secureworks.com/cyber-threat-intelligence/threats/the- mirage-campaign/. 6. Stewart, Joe. The Sin Digoo Affair. [Online] http://www.secureworks.com/cyber-threat-intelligence/threats/sindigoo/. 7. Trend Micro, Inc. 2Q Report on Targeted Attack Campaigns. [Online] http://about-threats.trendmicro.com/ent- primers/#2q-report-on-targeted-attack-campaigns. 8. Command Five Pty Ltd. Command and Control in the Fifth Domain. www.commandfive.com. [Online] http://www.commandfive.com/papers/C5_APT_C2InTheFifthDomain.pdf. 9. Moran, Ned and Bennett, James T. Supply Chain Analysis: From Quartermaster to Sunshop. [Online] http://www.fireeye.com/resources/pdfs/fireeye-malware-supply-chain.pdf. ----- `MD5` **C&C domain** **Signed** **PoisonIvy Profile ID** **Port** `14e04fcd7d769512b8a5e6e4905cd541` xboyu.dlinkddns.com 20120508 spy0611 8080 `68fbf9f48878ccd4d5addb255aea62d1` xboyu.dlinkddns.com 20120508 za_germany 8080 `bf50a4810e1bd9485822ec026fbcc176` xboyu.dlinkddns.com 20120508 201205 8080 `cc2397095e848f585970f1224bc24313` wang981200.3322.org 20120508 3460 `d049654602597df24ca07c3bce885e8d` updatewin.3322.org 13@CeleWare.NET h511b0+ 8000 `09d07702e68abcfd6ab092e3c07624a6` 127.0.0.1 360SE@hotmail.com xfish 3460 `4390c478c960c09c7a1a745a2fc14059` zeropan007.3322.org 360SE@hotmail.com 0912 80 `4b7f6d184952b6cd7a793b620d04f94d` 8852.vicp.cc 360SE@hotmail.com xfish 3461 `740828346fa3b403255fa50f24de0b33` qytianzheng.3322.org 360SE@hotmail.com xfish 3460 `937f44857ab11320e3f73bbde559d019` 220.175.13.250 360SE@hotmail.com xfish 8080 `a48bd91396b98124cc278221f96fdf7c` 127.0.0.1 360SE@hotmail.com xfish 9090 `ccbb7928ae3b53464690d523860fbeb4` zeropan007.3322.org 360SE@hotmail.com new 8080 `da7e73ad2092ecf4aba68d7934df6d85` 127.0.0.1 360SE@hotmail.com xfish 3460 `01c1481a275c11f16979cad33975205a` asiondragon2008.3322.org JinDiQIAO@hotmail.com v1752 3460 `03287af69ef4828b1d1e6664eafe7cc1` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `04f16f2729d7c3347deb747fb06c4e5a` mail.lufare.com JinDiQIAO@hotmail.com xz880 8080 `0c3963e90c6652b17f0f31c6821d41b0` bmw.webhop.net JinDiQIAO@hotmail.com xlsxx 80 `0f9d9caa21e3cf2dcdca14e3d7ccc337` q944642367.gicp.net JinDiQIAO@hotmail.com kor 6666 `0fc9ed37c5cca5bfb726718c77cb7b0d` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `106ae2f5128e9d54334b82f6e16ebd84` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `1321e4bbcf0ec423d2fd4c556c7a10a9` news.lufare.com JinDiQIAO@hotmail.com xnl80 80 `150aaf3de22afbb13a443be33123e411` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `216011f19981aedf78346d5a7e59d318` services.servebbs.org JinDiQIAO@hotmail.com IN 443 `22e81ed5f4b3e8bb109a328c43e50b78` cttwxsw.gicp.net JinDiQIAO@hotmail.com xfish 80 `24f1ccbc64587281be2ff87d3ef0c381` sophia.8800.org JinDiQIAO@hotmail.com mayul 8080 `28b5241ca13603636dbf626792231161` qwer.wekby.com JinDiQIAO@hotmail.com qwerw 80 `2977209445d17781f793e7a684be9bb8` jiang2368131.3322.org JinDiQIAO@hotmail.com dos 6666 `2addee24fabdcb6f210140bc7e65502b` black203.blogdns.com JinDiQIAO@hotmail.com lfish 3009 `2dca87e53573148ff4f8238f39004271` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `31e4783c9bdfe17d8fb6976b79127c77` 127.0.0.1 JinDiQIAO@hotmail.com xfish 3460 `343bea185561b5baad1da9b8a6c7e38e` infasd.crabdance.com JinDiQIAO@hotmail.com shego 80 `3783c0c404564fa2e7feef966ffa1d64` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `38f82f67cdb48ec33a39deba4a6444b7` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `3dcd1ea6a9943f99299bdeb6f38680de` 222.134.42.62 JinDiQIAO@hotmail.com 00001 3460 `3fc1ec32376569389ea6db6463d474a3` q944642367.gicp.net JinDiQIAO@hotmail.com heilo 3460 `401e2a036d9d4956805d67117697193b` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `4069a5690e64ffefbcae25ddef1f7017` wang2368131.gicp.net JinDiQIAO@hotmail.com 8888 8888 `40de9d48dd7add3001da8a6e81e75850` mail.sufare.com JinDiQIAO@hotmail.com sjx80 80 `4159f6ec7da5ac9e79f4463c0994ce39` surpriseing.homeftp.org JinDiQIAO@hotmail.com 628 443 `433f123423136569a8fcc8bad96638d0` 117.40.239.20 JinDiQIAO@hotmail.com xfisb 8081 `44937bb4dd5320f4225c0ae74587f28e` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `451a68f622493eb57f3450d3065a53e4` 123.151.193.236 JinDiQIAO@hotmail.com hack 80 `46029bb9623bb37698354a9b80a3c63d` df611.gicp.net JinDiQIAO@hotmail.com 12345 3460 `463d308a7b1b3e2279cf5ae724cb887c` zeropan007.3322.org JinDiQIAO@hotmail.com 1.75 8080 `46e14a7ad7dff5eb2b90c5ae1020df6f` 360liveupdate.com JinDiQIAO@hotmail.com 526 3460 `4a4dbfb626f3a04b152e5d702517f556` df611.gicp.net JinDiQIAO@hotmail.com 12345 3460 `4a8b86c8627b2a0da1a786a94c08a263` mail.lufare.com JinDiQIAO@hotmail.com kelu6 25 `4aa7f0c8980fe529594f52772693caca` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `4bf956e04d08640bf51cd60f887c7274` cttwxsw.gicp.net JinDiQIAO@hotmail.com xfish 80 `4c2df9200775d5e6f0cef469eb9f55a8` cttwxsw.gicp.net JinDiQIAO@hotmail.com xfish 80 `4d45559794e2f9a3385f84fb43bc199e` 127.0.0.1 JinDiQIAO@hotmail.com xfish 3460 `567eac46e43baa23d6f7f488e7cbc372` 360liveupdate.com JinDiQIAO@hotmail.com wzq 3460 `57ee371849907f6215a9642da189c2e5` dongtaiwang.vicp.net JinDiQIAO@hotmail.com xxxxx 3460 `6179bbfd346a0fa2a020dcee06efd91a` apple.buypn.com JinDiQIAO@hotmail.com xxapp 80 `627b3dcf0461b6ff388c0dac71074ee5` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 ----- `64c28ef1701a21e631c2089284eb6da5` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `65f9e138947d288c8e9426d820db6eea` cttwxsw.gicp.net JinDiQIAO@hotmail.com xfish 80 `6848f8440227d06a308655f7638a6bee` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 1009 `6a31e0f0a058e182aaebe512d12803d3` surpriseing.homeftp.org JinDiQIAO@hotmail.com 628 443 `6a4b549ca3689b71d26702335d95a842` qq907433815.3322.org JinDiQIAO@hotmail.com 99999 3460 `6a83dc3f53079e17ecc49cbc0dacc8f5` qwer.wekby.com JinDiQIAO@hotmail.com qwerw 80 `6aa3ba5dd70a19745de9a8558648ef2d` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `6af3587423d3afae735bebcd882d147a` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `6e13a34dcfefa70ba341759c6636a951` sm888.8800.org JinDiQIAO@hotmail.com stock 3460 `6e913d943a1e79af2990cc13d28344ac` 360liveupdate.com JinDiQIAO@hotmail.com ilove 3460 `71ca1cae7ad22313ed14ad7e312b432f` bmw.webhop.net JinDiQIAO@hotmail.com newuu 80 `74a83fa5c9698019204432e99ce60fae` mail.lufare.com JinDiQIAO@hotmail.com xml88 8080 `75b8916a63ec1b4bb46ffeb755bc6641` bmw.webhop.net JinDiQIAO@hotmail.com newuu 80 `77d94d99bf89bd2421efd0d66ebcf25a` bmw.webhop.net JinDiQIAO@hotmail.com newuu 80 `798d926306e2e328f8147dc31b37d148` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `7b13fd4d47c7e789a94bd304070af13a` okia.3322.org JinDiQIAO@hotmail.com zhanj 3460 `864fffd48523d9cbcd24917f7a54dc3d` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `8651d46164a52da00188ad7760342b23` wang2368131.gicp.net JinDiQIAO@hotmail.com 8888 8888 `86fa2e505cbbe4abf94b891caf46ec6e` 123.151.193.236 JinDiQIAO@hotmail.com hack 80 `884323fc4c51e4ce4cc258fce243672a` dnsxyz.webhop.net JinDiQIAO@hotmail.com 12345 80 `891d15fd331f79829acb489617333b79` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `8cd87b8d5ca0715d1605a70f500924bb` q944642367.gicp.net JinDiQIAO@hotmail.com kor 6666 `8f1073b2dba950152fd96a4c5057bc13` 127.0.0.1 JinDiQIAO@hotmail.com xfish 3460 `9322ff4e14f75fe3ea032714b5038c20` i_lied@3322.org JinDiQIAO@hotmail.com xfish 3460 `93a98e2049ffe3ba660b0eab8827f8bb` bmw.webhop.net JinDiQIAO@hotmail.com newuu 80 `96181a03770b612c5f4a57194018ef30` df611.gicp.net JinDiQIAO@hotmail.com 12345 3460 `97da1db01d59f2852989a3c152ed39c1` 222.134.42.62 JinDiQIAO@hotmail.com xfish 3460 `981f9c704c671dc36cf553c4bb620ea7` 117.40.239.20 JinDiQIAO@hotmail.com lwwn1 8071 `9c8f0ce512cdb21bf4e4953094bd1e46` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `9e2dfa8c509ee179d2283fbe8512b6dd` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `9f6143aa4b6f50d28f858c70388a3c73` 222.134.42.62 JinDiQIAO@hotmail.com 00001 3460 `a079ff3fd8fbc398f0361f9105e93733` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `a3bfba7870d87f726bb97a85db17942c` northsince.homelinux.org JinDiQIAO@hotmail.com MOFA 80 `a3ce301622f326fe436e3f275ab7d1be` asiondragon2008.3322.org JinDiQIAO@hotmail.com G1753 3460 `a51628c49fc15bec7363d598d749934d` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 1009 `a66fc5a5b1b7fe127140386d784a3e80` 360liveupdate.com JinDiQIAO@hotmail.com ilove 3460 `a77fe3562f1c89a1263edbbedec56ca4` bysex.mooo.com JinDiQIAO@hotmail.com xserv 80 `a791342a49c08d22b1a1bd7a93328d77` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `a84e6d38f43f0ca50c60731fa6f8f8cc` 360liveupdate.com JinDiQIAO@hotmail.com 526 3460 `ab8be1ed0d1c2ec03c847d43434551f0` 127.0.0.1 JinDiQIAO@hotmail.com xfish 3460 `aee71a96f11c183c0ddd424228376dbc` 123.151.193.236 JinDiQIAO@hotmail.com xfish 50 `b18f2c7c1631d94457e3c3226692a5b4` wang2368131.gicp.net JinDiQIAO@hotmail.com 8888 8888 `b52f72a86b621948f1b094334d23c50f` dongtaiwang.vicp.net JinDiQIAO@hotmail.com xfish 3460 `b7597172097e4105f027e2c65d2eaf64` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `b7fb766f3ab6926d9f42c91b649a2943` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `bbda06be8132e34c5d91e08e55a4d814` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `bf0aa8e722df5e1f8124d51021206622` cttwxsw.gicp.net JinDiQIAO@hotmail.com xfish 80 `bf87188b9af91a054053ec1becd6eaf0` dongtaiwang.vicp.net JinDiQIAO@hotmail.com xfish 3460 `c030d67c8696b9cbcc600867363ef9bd` bmw.webhop.net JinDiQIAO@hotmail.com newuu 80 `c7534dcb83991745ab5db0aba47d47cd` yahooforusa.vicp.net JinDiQIAO@hotmail.com 00001 443 `c839ab78db5a0b8715a4f829c845a9c2` q944642367.gicp.net JinDiQIAO@hotmail.com heilo 3460 `cc10483d846bffbe19f133f951eb908c` zeropan007.3322.org JinDiQIAO@hotmail.com 0630 8080 `cc5ba76ee1cf77f7547632f44c517673` qwer.crabdance.com JinDiQIAO@hotmail.com fanhe 80 `cf30b0d831d3123027a20520a213a09f` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10009 `cf45dbdb3718b4b728c2dd894032464b` qwer.wekby.com JinDiQIAO@hotmail.com qwerw 80 `cf7df0a7a87fa110262b26571438969d` 360liveupdate.com JinDiQIAO@hotmail.com wzq 3460 `d0bc80cb9522ff749185f5493b89dfa1` cttwxsw.gicp.net JinDiQIAO@hotmail.com xfish 80 `d52ef63fdc5c5452d9da23bd6d4bf0f5` 360liveupdate.com JinDiQIAO@hotmail.com 526 3460 ----- `d6dbf1ff2d93e95a4379ecc5c71eb709` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `d8097ba0e2077ebb841c7b98b48437fb` 360liveupdate.com JinDiQIAO@hotmail.com 526 3460 `db88d89c58f344308c37a08e913caf02` mail.lufare.com JinDiQIAO@hotmail.com xml88 8080 `dd016c17ea3e2dbdefe8bdcf73346cbd` qq907433815.3322.org JinDiQIAO@hotmail.com 60001 3460 `df41a63c679fe1374aa191ea892e5650` 127.0.0.1 JinDiQIAO@hotmail.com xfish 3460 `e10152dd505853dddf59ae570e0a3abb` surpriseing.homeftp.org JinDiQIAO@hotmail.com 628 443 `e120cdb2811407c48e94098d2190d4e2` surpriseing.homeftp.org JinDiQIAO@hotmail.com 628 443 `e1ac803a816265db2ace8140e06edad3` dongtaiwang.vicp.net JinDiQIAO@hotmail.com 10406 3460 `e3984f30a5362bd97a15915bb8ac3ea4` cttwxsw.gicp.net JinDiQIAO@hotmail.com xfish 80 `e3b16d46c81fc7ae23738795cf38f671` bmw.webhop.net JinDiQIAO@hotmail.com xlsxx 80 `e53f502d82d2ac5558ff59a6f8038db7` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `e6408b5120fb53769e8e6faa084966a3` mail.sufare.com JinDiQIAO@hotmail.com fax80 80 `e78ddb3a1c715a5c93d064bd053a570d` 360liveupdate.com JinDiQIAO@hotmail.com ilove 3460 `ea9ff690b68eac6904931b0ab1c60fd4` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10009 `ed517981e73a616ba4ab60a16c94cfe0` bmw.webhop.net JinDiQIAO@hotmail.com newuu 80 `f08ca265043bba868ff3133ca9bc74cc` yzkker.3322.org JinDiQIAO@hotmail.com shoes 3460 `f2414a1a3994faf0a2a6a68c5e02c7b2` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `f3b3438a1a69e7290823492c517a8ee7` 117.40.239.20 JinDiQIAO@hotmail.com lwwn1 8071 `f6df06b5d97cc9185a4b6d3bf36df8dd` qq907433815.3322.org JinDiQIAO@hotmail.com 99999 3460 `f71627384a8b41062de77ba9aa32928b` surpriseing.homeftp.org JinDiQIAO@hotmail.com 628 443 `f9eadd5762a634fa703956be48aa69c0` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `fa3e62ec64d10a9accb2fa8c580a2efa` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `fa72e26105b43349b4b50d127d3614a3` services.servebbs.org JinDiQIAO@hotmail.com IN 443 `fad40c701654454f2b1a4abc7c707c06` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `0344fb12551a2721ce1642ebbaded310` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `0b7c0a464f8eba9da0073bcafb61be88` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `128b4d567b1474949c4389785397cc1b` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `1b1d855a357c337ea3fdf015265b1445` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `1ddda11f7521c092ea6095ac3919676d` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `364c806a053f29f5dd175d09f373250a` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `391479e5579206b6831e00bbf7c99826` 117.40.239.20 JinDiQIAO@hotmail.com lwwn1 8071 `474da1e418763cf0c9fcc0ddecc99928` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `4e94978943a8c8d41c9b66fa4dc6cfaf` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `51de6aad847ba7b38cd7aca8783b1c81` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `5a953c5a922885ac0bbb3f8abbecdc2e` dnsxyz.webhop.net JinDiQIAO@hotmail.com 12345 80 `5da12bdd0c23862b68d9599faa4caad7` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `728365a26dc9600ef10b2abd5fa11afd` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `72c28b58aebc7ab97008f803ade71c76` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `7b019bd7e91874692b510fa8c218e5d9` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `8df121cd3b79db7ae772b32d70f6c9d8` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `90acf5aba3170978dc585640f34d74d3` wang2368131.gicp.net JinDiQIAO@hotmail.com 8888 8888 `a6fd61ed931dccc961635b8e43f35215` sm888.8800.org JinDiQIAO@hotmail.com stock 3460 `b6f732c391d34acba419f20eba8efebd` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `bb2185d8eae91fc105a4d92c6f9cec74` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `cddae65009d91d88b49fd6eebd0b28e7` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `dcf85cd73cca9fc032e055be18375d9a` q944642367.gicp.net JinDiQIAO@hotmail.com kor 6666 `f175f7598648471d085f1909d36390ce` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `f5c939f6973acae6160b92f32bb2dd27` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `f615afeffe7b8da50712f2ef40aff6b9` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com xfish 10012 `fca5b719d18b950e59c6bc66f71e7274` services.servebbs.org JinDiQIAO@hotmail.com IN 443 `17981807f7394d78f984b9104584e3ab` qwer.crabdance.com JinDiQIAO@hotmail.com fanhe 50 `2da5243310403b7fdedbf2911d09ec24` qwer.crabdance.com JinDiQIAO@hotmail.com fanhe 50 `559f72390ecb028d799b0aea594c9b7d` qwer.crabdance.com JinDiQIAO@hotmail.com fanhe 50 `070e0226f5d0d588731361c0b5569379` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `0f482f1acabe3a980705d66cd6e4bf52` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `16d2175d190bbbd572cb3e33079f7d72` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `5cc4daa7d3bd4b17c8067ec8a947ce83` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `84b5f0cfc4a787d013d8f0f605a876c3` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 ----- `a2ce5549749d258a3d53a19ebf0dfef9` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `acf4d4159bcb730a6c86469b74326181` yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10009 `f75009f6423433db2fc5673ab278e3d1` 2yanfengjiaoxp.gicp.net JinDiQIAO@hotmail.com yanf 10010 `68411315d3321b744552f50d15a97308` oa.sanymh.com JinDiQIAO@hotmail.com szc 3460 `008dc2e22ba7e6f96342a29083344512` apple.buypn.com soft@hotmail.com xappl 80 `00fd48c9ddeb7c7b9271f4a6e0ca4a16` black204.dyndns-work.com soft@hotmail.com 0504 80 `036a2da8bde3af55f8c492afeeddd65b` dyn-microsoft.blogdns.net soft@hotmail.com lfish 8080 `069120f92ffadbfb2a22c6e51a257236` boyfriend101.kicks-ass.org soft@hotmail.com xfish 5379 `06f788c2e5285e63545baad22af2e5ce` fh.buypn.com soft@hotmail.com fanhe 80 `06f9e365fe8bbe926c5fd992d1ff4b95` dongdong603.3322.org soft@hotmail.com xfish 7777 `09e49a46ffc9135682740ef0b709a28a` dongdong603.3322.org soft@hotmail.com xfish 7777 `0efb08ce780b5a50749f850805e2d663` black204.dyndns-work.com soft@hotmail.com 0623 80 `1d35952034267cb1a865ad4f8b76a22c` 220.175.13.250 soft@hotmail.com ie0da 8080 `1e8a59cd725d949a140497d0462b63c7` subscription.dyndns-home.com soft@hotmail.com in216 80 `21013250e90e559c0b5ab7fd5cd57722` dongdong603.3322.org soft@hotmail.com xfish 7777 `22b6fbae0b2ecfb51c194b98c1cff692` a5g17mail.3322.org soft@hotmail.com 1215 6200 `24f09152a40c5231f9e006ca3a27dbbb` user2011.8800.org soft@hotmail.com cfish 80 `2530c356ccaa7272a56145b7300daf80` cat.aumoni.com soft@hotmail.com xcm80 80 `269fa8fa755b6d067e9818f89b182042` www6.intarnetservice.com soft@hotmail.com 1f2s8 8080 `26eaf715124382f1ca0c29fc3661d00c` 220.175.13.250 soft@hotmail.com linze 8080 `2bd6d0231789b1b207bd18c93fe877bb` dnsxyz.dyndns.biz soft@hotmail.com yfish 80 `2c7ff79125c4b1f02a436010cfd71b21` 220.175.13.250 soft@hotmail.com ie0da 8080 `2defc101ebccce4baa9779f4fcef53bb` user2011.8800.org soft@hotmail.com fish 80 `304e3b07f1d1802488ed80a5be1eaf8d` www6.intarnetservice.com soft@hotmail.com 1f2s8 8080 `317da2fd6635b45570edb2c2df75b0fe` apple.buypn.com soft@hotmail.com xappl 80 `31b188114c8a75d117e129b2446a9310` wang2368131.gnway.net soft@hotmail.com xfish 7188 `320cd6bb76a8cb768de42ba6697e7590` wqdf.3322.org soft@hotmail.com xiaoc 3460 `3215133be590fa47089989502381ca31` dongdong603.3322.org soft@hotmail.com xfish 7777 `34156792fac87719e9c8a4665fe2f9b9` dongdong603.3322.org soft@hotmail.com xfish 7777 `36895b649536ed3905d3f90e2004f03b` 114.202.2.83 soft@hotmail.com xfish 7088 `375b6d4987d015ebf9414c19681001ba` p.hannmaill.net soft@hotmail.com xfish 3460 `37f95b4906fb3b6f5935e2a397f69e21` l2009l20091.3322.org soft@hotmail.com xfish 7750 `3c6cce8b6f8d55d931959d39044fab76` dongdong603.3322.org soft@hotmail.com xfish 7777 `40fcdebb382907cbbfaee44f154ecb02` mylover.dyndns-free.com soft@hotmail.com fish 80 `425ee721db80ce85b338a073b37c2e12` stop204.3322.org soft@hotmail.com 03 110 `45f569bc817a17f0e0487bb05ae71137` friend101.7766.org soft@hotmail.com nfish 1723 `485ecdaa0482b35f510f40f3b2f683ff` www.microsoft.com soft@hotmail.com update 80 `4c84d6447587330d544f5200196f2603` dongdong603.3322.org soft@hotmail.com xfish 7777 `4d0b6f59628d4d3fba569315140dedde` wang2368131.gnway.net soft@hotmail.com xfish 7788 `52dd8f9a8be5692014186af755a9257d` dongdong603.3322.org soft@hotmail.com xfish 7777 `574d3725d5f161b8f7615d8867ee427e` s.hiinet.net soft@hotmail.com xfish 3460 `605accc6bee731be5ac0f6531ac9e8d7` dongdong603.3322.org soft@hotmail.com xfish 7777 `66cfc9d3c6fa3107b0d004789384a6bd` black204.dyndns-work.com soft@hotmail.com bl 80 `6b009e689cad6896d28102af04569bf2` dongdong603.3322.org soft@hotmail.com xfish 7777 `6b475742f795fe8b6439bd931dccf045` wang2368131.gnway.net soft@hotmail.com xfish 7188 `6e218ced252ca18ea12a58e8c14ae618` dyn-microsoft.blogdns.net soft@hotmail.com lfish 8080 `747ad8a7bc8ded87169d1bd40d4f3aa3` dongdong603.3322.org soft@hotmail.com xfish 7777 `765b599cb055df9034b71e54c795193e` wang2368131.gnway.net soft@hotmail.com xfish 9900 `7ca3acf38cf256650aa8c15ef51fd7cc` friend101.7766.org soft@hotmail.com nfish 1723 `7ccaf82b2594c18f368aa94536448aa3` dongdong603.3322.org soft@hotmail.com xfish 7777 `83213cf9fe303d916789cef295d07b6b` dongdong603.3322.org soft@hotmail.com xfish 7777 `84c23286b9b141d2f501a55228de96ee` dongdong603.3322.org soft@hotmail.com xfish 7777 `8d6b5815157422ee97c01925d72a22ed` boyfriend101.kicks-ass.org soft@hotmail.com xfish 5379 `919e4ddef8f294dfeb798f7a5e34ba39` dongdong603.3322.org soft@hotmail.com xfish 7777 `9c29b5ab62f130dedb52e7661a8b3cb3` rabit.aumoni.com soft@hotmail.com syi21 21 `9ec832ed678e81a8e0a2c253beeadd00` manager.serveblog.net soft@hotmail.com in926 80 `9f55bc93d26ec674e754545be9513f3d` leftpaper.dyndns.biz soft@hotmail.com Lef726 80 `9ffd9fb7b493aec58f88b823a426d1b0` xk.buypn.com soft@hotmail.com serve 80 ----- `a122dfa22543b04322a4713c5a3a3fc1` mysql.sql01.com soft@hotmail.com 12 80 `a3cba2c23fccbe9944fbdeeb418a0cbb` dongdong603.3322.org soft@hotmail.com xfish 7777 `a4b299b309c2f9643bac07c379833b2a` dongdong603.3322.org soft@hotmail.com xfish 7777 `a54321aa3ff23aba7766f6aa7096d3b0` dongdong603.3322.org soft@hotmail.com xfish 7777 `a5526d3d01a287410f28b123f3d9688b` 114.202.2.83 soft@hotmail.com xfish 7088 `a676a1a444e63fe8d95b9cb1b17cfa4d` wuliao678.8866.org soft@hotmail.com xfish 12874 `a7db6b46945f322e8b78fc33e6819544` 114.202.2.83 soft@hotmail.com xfish 7088 `a9180562680acc35c41ba3e6578d9d7e` mysql.sql01.com soft@hotmail.com 1201 110 `afbe79c53bb5cd28345d9888667607ab` xc.winniqi.com soft@hotmail.com x1224 4000 `b1f611adc6402aa45770a2e7e1c1e0d8` dongdong603.3322.org soft@hotmail.com xfish 7777 `bf375d30d08fdecc270a0621d33b439f` dongdong603.3322.org soft@hotmail.com xfish 7777 `c113015b07587de8f55e6ba1f85a203a` mysql.sql01.com soft@hotmail.com 1201 110 `c30f036f67a82b38e653e07acba56246` black204.dyndns-work.com soft@hotmail.com bl 80 `c601b9da3c1761a691a74f525cf7b379` dongdong603.3322.org soft@hotmail.com xfish 7777 `c7653c7415c30d1eb7b8ce065b76cdc1` dyn-microsoft.blogdns.net soft@hotmail.com lfish 8080 `c9bf29d298862c708f2982e82f78c69f` single.dyndns.biz soft@hotmail.com jxt61 80 `cbf831cff50212e7cb2b9540204bda06` dongdong603.3322.org soft@hotmail.com xfish 7777 `cdce8791df7c971cb4e609b27a2b5f8f` dnsxyz.dyndns.biz soft@hotmail.com yfish 80 `cddd77de9de609568cf11b8cad35d2de` l2009l20091.3322.org soft@hotmail.com xfish 7750 `d374631c910fca5df9727d77b0c797ec` boyfriend101.kicks-ass.org soft@hotmail.com xfish 5379 `d4bdb78d43fd15cf76ded19216691459` dnsxyz.dyndns.biz soft@hotmail.com yfish 80 `d556399e1c541af75c39052aac9e6727` 220.175.13.250 soft@hotmail.com ie0da 8080 `d56cd7a068634fbe2f0d2cbccf2df763` mysql.sql01.com soft@hotmail.com 1014 80 `d68f4f986177ea3baafaabb54f7f3325` dongdong603.3322.org soft@hotmail.com xfish 7777 `d6e2f6c607564544116f491fc70faa08` bmw.webhop.net soft@hotmail.com 3 80 `d845ee0d409bd284eb0a8dee67c03f98` s.hiinet.net soft@hotmail.com xfish 3460 `de1a532e2e387d2003d9f7e82e4e6d35` xk.buypn.com soft@hotmail.com serve 80 `dee184d74a84cf138cc4caa8d3e1b32e` dongdong603.3322.org soft@hotmail.com xfish 7777 `e76d287a2bf8c4b466875e2da744596c` user2011.8800.org soft@hotmail.com xfish 80 `e79cbb7590744564c110284294273dac` dongdong603.3322.org soft@hotmail.com xfish 7777 `e7e48e4212822de6c1c685a1478d7ad5` yunlong123.3322.org soft@hotmail.com yl 3460 `ea46b3ce1187ea9de89a08c2756fccfc` yhm20060330.3322.org soft@hotmail.com 01 3460 `ec212491ac34169afe19be9272059c0d` wang2368131.gnway.net soft@hotmail.com xfish 7188 `ec2e8d3e1eeb65e873db7992311b560b` xk.buypn.com soft@hotmail.com serve 80 `ef5c8649251816dc77e121d68881cde6` dongdong603.3322.org soft@hotmail.com xfish 7777 `f0e3c8d6f2f9579ae3cfbad9ae2f6d32` dongdong603.3322.org soft@hotmail.com xfish 7777 `f1d4dc470b0a0a7ffd4f6bfacf9d1024` stop204.3322.org soft@hotmail.com 03 110 `f1f7672498128e0c4839ac9a1093b84c` xc.winniqi.com soft@hotmail.com x1224 4000 `f4fea7af0e7a6023f29a01aa06d37aa3` dongdong603.3322.org soft@hotmail.com xfish 7777 `f5d659ddf4ae5d52eafac621dddc1bab` dongdong603.3322.org soft@hotmail.com xfish 7777 `f7ee5dd3af96b8847134037b769988c4` dongdong603.3322.org soft@hotmail.com xfish 7777 `fbbe7e88cf53d225c299996aeb0cbf8f` p.hannmaill.net soft@hotmail.com xfish 3460 `fc1a61250356ddd94dceaf90169e8256` dongdong603.3322.org soft@hotmail.com xfish 7777 `ff9eb9ecdb1fc068312d1480354a4d85` 727609693.gnway.net soft@hotmail.com xfish 7777 `0958d15b1510b394d6a17a7b9f1db69b` leftpaper.dyndns.biz soft@hotmail.com Lef726 80 `0a06d8e4e77a822f47e2fc3ba83ccfe6` shinubi.chickenkiller.com soft@hotmail.com pk 443 `10bafddc35c32226171e32a3325a97e4` black204.dyndns-work.com soft@hotmail.com 0504 80 `11baf7fcbf963ddf8446366f749e7d9e` misson.mysq1.net soft@hotmail.com xfish 80 `2b6f563f8cf3b64c1425e04ba7743962` rabit.aumoni.com soft@hotmail.com syi21 21 `308af461eb46128af9c5589b550a7fb0` black204.dyndns-work.com soft@hotmail.com 0623 80 `3da84e6e2dd5ab898f6d31fda1d3148e` boyfriend101.kicks-ass.org soft@hotmail.com xfish 5379 `46b6a1239dce346b926b8f22521eb8bc` s.hiinet.net soft@hotmail.com xfish 3460 `55824c42743c6fde39f69dd790d640c3` cat.aumoni.com soft@hotmail.com xcm80 80 `55be601a18eeb89c0d1aedd5a49edae0` s.hiinet.net soft@hotmail.com xfish 3460 `6724cbd34516cf79c0361fdaf6a2d77f` user2011.8800.org soft@hotmail.com fish 80 `6951bedba7f9d7b8003b4c5aae83d0bb` dnsluck.3322.org soft@hotmail.com https 443 `6e4510000cc03366288c8f12d209d3d7` hostname.dyndns-mail.com soft@hotmail.com in248 80 `88f8eb2caf80e5a5e68e6813d2f75dc8` indiaarmy.djkcc.com soft@hotmail.com dj 80 ----- `9501dcad273c806a06818c8f648f4994` subscription.dyndns-home.com soft@hotmail.com in1206 80 `963ca2e9a82a9fd235de4895043144c0` 127.0.0.1 soft@hotmail.com DD 3460 `baee14a8acf0ef71ef0cbfdda79f0fd6` dnsluck.3322.org soft@hotmail.com Https 443 `cc87e0fe570488a38d76294e969eadc2` kfcmakelc.zapto.org soft@hotmail.com 789 80 `cfd49a32870abec83781249872ed6be4` mylover.dyndns-free.com soft@hotmail.com fish 80 `d52af4bd0c9a66411a562f5c681550a6` www.microsoft.com soft@hotmail.com update 80 `d8b8420ac6da7dee391c2e3a4ae3afdc` mysql.sql01.com soft@hotmail.com 1014 80 `d94fbcc1fa7c9245afba7a3568db61d6` worldnews.zapto.org soft@hotmail.com zfish 443 `e10d08a1fb8760881de3ee875240df1e` manager.serveblog.net soft@hotmail.com in926 80 `f3ed1321e8f2fd6f8c523136dbdb6dd9` blog.cnmgd.org soft@hotmail.com blog 80 `f563c267eab33a3e49a73f825e2c0846` 127.0.0.1 soft@hotmail.com xfish 3460 `f5d0803e3e4ad1d288ca4aedf5d26fba` dnsabcd.dyndns.biz soft@hotmail.com zfish 80 `6b2e6cecc45d3cb7c8d005f1698dcea0` qwer.crabdance.com soft@hotmail.com fanhe 80 `cf747c51da4d36a6055f48dc804ad9d6` qwer.crabdance.com soft@hotmail.com fanhe 80 `e4b84120c95335f6524dbb2f6b17bb52` l2009l20091.3322.org soft@hotmail.com xfish 7750 `14076b1b50be21f6c2f85acfee2bc24a` yhm20060330.3322.org soft@hotmail.com 01 3460 `4709cbdb3d990369fe35f1aed45be09e` fh.buypn.com soft@hotmail.com fanhe 80 `543bdf2a8665c9f5ca1bb0b1000c5856` fh.buypn.com soft@hotmail.com fanhe 80 `c6e01836ffd3b229dac4a98b595cb002` yunlong123.3322.org soft@hotmail.com yl 3460 `0d201e4b7679b99722abca1ed767f13a` hostname.dyndns-mail.com soft@hotmail.com in248 80 `0e95b864771484f833df294f4cbf4e06` shinubi.chickenkiller.com soft@hotmail.com pk 443 `3ce828f70dacc390164fcd921c5e8b98` mylover.dyndns-free.com soft@hotmail.com xfish 80 `48791d1cf2165c5d85680aa18b209190` single.dyndns.info soft@hotmail.com j0220 80 `4cfe7436fecb4a9e5a4621843fc25762` blog.cnmgd.org soft@hotmail.com blog 80 `5c107b4ff5f314623929fffd94021cba` blog.cnmgd.org soft@hotmail.com 05 80 `688d1ad103f00400b7f3b92329dd48b7` mysql.sql01.com soft@hotmail.com 45 110 `6b0609f80e5c37ded32d36380a0b2256` dnsabc.3322.org soft@hotmail.com bfish 80 `6bd265f6c8475fa0960c7d044a209ac7` dnsluck.3322.org soft@hotmail.com kfish 443 `6daed5c526ca48199055dd4ff9b7a224` 127.0.0.1 soft@hotmail.com DD 3460 `897f25fc7069584fe8ffeb0fa1354c7f` worldnews.zapto.org soft@hotmail.com zfish 443 `9f2bfebde725c45ea28293e565042791` dnsluck.3322.org soft@hotmail.com Https 443 `c4e655bd456286e33074848d678b75e2` hhcc365.zapto.org soft@hotmail.com 0216 443 `d430ac30417084c462d8fafea82f4988` boyfriend101.kicks-ass.org soft@hotmail.com xfish 5379 `d569bbf270f079587c3232a9dff7e62a` subscription.dyndns-home.com soft@hotmail.com in1206 80 `d943bcd358d0fe244565ad20e41213ff` bbs.avjkv.com soft@hotmail.com 0509 8080 `df383425f83184b8f4c1b33920d783bf` subscription.dyndns-home.com soft@hotmail.com in216 80 `e11591816b9da6e9ae8cf24a8a441f16` dnsluck.3322.org soft@hotmail.com https 443 `e37f67153e1c0de0254cd913ede07189` single.dyndns.biz soft@hotmail.com jxt1206 80 `ea95945fbc95db7789188a04c715b25d` mysql.sql01.com soft@hotmail.com 12 80 `ed71401d451bb2b870d1141bf1044055` indiaarmy.djkcc.com soft@hotmail.com dj 80 `f57cc074a44ad7d01bf8539aa2a7aa97` 127.0.0.1 soft@hotmail.com xfish 3460 `031bfe6310e55cf37b431895b4d6e7b1` p.hannmaill.net soft@hotmail.com xfish 3460 `06c6b86dd9e860a50babce8b30a9105c` wang2368131.gnway.net soft@hotmail.com xfish 7788 `0d912cc3eb75a84968f31d2dc3388309` dnsxyz.dyndns.biz soft@hotmail.com yfish 80 `122596ebc648be17f6c135a35aebff6c` mysql.sql01.com soft@hotmail.com xfish 80 `2f784ecdea8f367c923ec3e5ca31e4e1` friend101.7766.org soft@hotmail.com nfish 1723 `3357bbbf1919605cd1ecbbe8883a90b8` boyfriend101.kicks-ass.org soft@hotmail.com xfish 5379 `52c7f247f0ee37e50dc218c78fa0af6b` 127.0.0.1 soft@hotmail.com xfish 3460 `71f9eb0d957ab9a98cf7386f42802fc5` a5g17mail.3322.org soft@hotmail.com xfish 6200 `77de512dca26e078e866b2782809366d` misson.mysq1.net soft@hotmail.com xfish 80 `781987ff8f295bc70a35136aae9d44f0` black204.dyndns-work.com soft@hotmail.com bl 80 `7caaf2a6428f98f6b408ff687e681c34` a5g17mail.3322.org soft@hotmail.com IN 4014 `7d95d5a34e4cf1d11b4066c08d966bab` a5g17mail.3322.org soft@hotmail.com IOTY 6200 `7dcf1cbd989a3064631aea4cdfa057a7` wang2368131.gnway.net soft@hotmail.com xfish 9900 `90259884e04cb5cd9d511bec0b551f57` wang2368131.gnway.net soft@hotmail.com xfish 7188 `9beffe50ee0c4006724050b295928471` 171088046.gnway.net soft@hotmail.com wind 8899 `9ea6e2cb17154cc8e3e5a84bd81c6346` 114.202.2.83 soft@hotmail.com xfish 7088 `ad9349a84778094273f5efbc9779139a` limingliang1988.gnway.net soft@hotmail.com xfish 8899 ----- `d2c61fde3b73f7ee8203df78171587d1` a5g17mail.3322.org soft@hotmail.com 1215 6200 `2b849ee3af6557717282682e803cfef1` blog.cnmgd.org soft@hotmail.com 04 80 `2c34afcd76256fd8bdbe1129bd01897a` misson.mysq1.net soft@hotmail.com xfish 80 `360e5b617649a3b6c9a646aae1d2920a` 127.0.0.1 soft@hotmail.com xfish 3460 `6315c282ee83eeef8ea9508291f20a92` 171088046.gnway.org soft@hotmail.com xfish 3460 `889dbaeb54629fd311083bc828b13b6a` rich-yong.gnway.net soft@hotmail.com hl 3460 `9f8a187dbe2c8b06f542c4dc43fd1e80` misson.mysq1.net soft@hotmail.com xfish 80 `a90f5d080952426d3f16838d20de9f1d` mylover.dyndns-free.com soft@hotmail.com kfish 80 `ab23e48eb498a8f601e3c8ed52a7e712` rich-yong.gnway.net soft@hotmail.com hl 3460 `cc77bf82a6546039c14a37b18901e626` mysql.sql01.com soft@hotmail.com xfish 80 `e62560b1f03f3bebfd10726a4c0777bc` 171088046.gnway.net soft@hotmail.com wind 8899 `f007fa65ffe2f12524aced70c29abf2a` 371611121.gnway.net soft@hotmail.com aabbc 3460 `fe7ce50cbfbe8ca7bd601f49de648d84` 118.194.238.43 soft@hotmail.com xfish 3460 `0083267bc3d259028f6ccb4a2598e8c9` infasd.crabdance.com soft@hotmail.com sssss 80 `4c8690b04bb8c996e8ac384ed300f6e3` q944642367.gicp.net soft@hotmail.com hl 3460 `9d67585daed1a011634b3a53bf545f63` boyfriend101.kicks-ass.org soft@hotmail.com xfish 5379 `04fac410eefd0329d037dcaaf063a54c` imacarpe.dyndns.tv soft@hotmail.com 0419 80 `0f84951213319e0ab09f94d5eedd932f` hostname.webhop.net soft@hotmail.com IN01 80 `2940e44d8df1eeee9bd7f0a046cbd3bd` whitebird.dyndns.org soft@hotmail.com xfish 5496 `cde25bb92a592a806042629d7e2b8b4c` xc.winniqi.com soft@hotmail.com c1130 4000 `cfd8906425ffa8358e7300bbf468e40f` game.winniqi.com soft@hotmail.com s1115 31 `184b3cb15d5df6f9d8063e4ce197206d` configure.selfip.org soft@hotmail.com in819 443 `82e64f6dadde344885c60b02f488e3b3` a5g17mail.3322.org soft@hotmail.com xfish 6200 `f9b5f626a2587081c5cb008ac9ba2395` dnsabc.webhop.net soft@hotmail.com BINGO 80 `20d29980a228aad1058583d5b7dc413b` a5g17mail.3322.org soft@hotmail.com xfish 6200 `0136ea74a5194649ae8c760604a59cd9` wang2368131.gicp.net soft@hotmail.com 8888 8888 `0146877e42a63a65ebac61648e2605fe` yahooforusa.vicp.net soft@hotmail.com 00001 443 `3d409c193b4ee5336acaf0fb2d79e1f8` q944642367.gicp.net soft@hotmail.com kor 6666 `4018d44d810efcd3db260e94991ef3ee` news.lufare.com soft@hotmail.com xnl80 80 `640cc84d9f12ab2edd65eee6d6241a48` zeropan007.3322.org soft@hotmail.com 0630 8080 `6a5d2ab03b34009f497d186cc7d0aa8f` surpriseing.homeftp.org soft@hotmail.com 628 443 `7ebfbf3e1b8fe79b45f814174418f2f1` services.servebbs.org soft@hotmail.com IN 443 `9af111f0f35db2c234b83f2ac5da6289` wang2368131.gicp.net soft@hotmail.com 8888 8888 `b74a964fd5c8dea5b7cbe8a686708e00` 127.0.0.1 soft@hotmail.com xfish 3460 `b8276b916938d6f5ac156817817c728a` 117.40.239.20 soft@hotmail.com lwwn1 8071 `9e309be6824bc99429fe037f41587beb` oa.sanymh.com soft@hotmail.com szc 3460 `cdc6f442f8b576b7c461ea25891f2905` 220.175.13.250 SoftSign@HotMail.com 4khxb-do612 8080 `0cf15b88b18cdedfaae598e9498768e3` yt.bodologetee.com SoftSign@HotMail.com beijingnew 4500 `2b640b94a8abe4767ba17e4036e827f2` okia.3322.org SoftSign@HotMail.com 2011a 3480 `49c7cae0fda8e5089e993a169c6c4197` www.windowsliveupdatecache.com SoftSign@HotMail.com krgqy 3460 `7c27572d9ce8bd94ea044e7980a09a60` qqpass.kittyeah.com SoftSign@HotMail.com \xB6\xCE\xBA\xBA\xBD\xDC 35 `840e670aec18db73ae1c0db204eed229` qqpass.kittyeah.com SoftSign@HotMail.com \xC1\xD6\xCA\xC0\xB3\xE7 35 `914fdaf7aa098ac00067a2b265fc91da` www.windowsliveupdatecache.com SoftSign@HotMail.com qq 3460 `bd9a1fbd76c00015a59a3b5c93d4030e` www.windows-liveupdate.com SoftSign@HotMail.com zwdb 3460 `bdc80843e8c2da96880b752308307933` bbaolong.vicp.net SoftSign@HotMail.com 0417zhang 3460 `c64aab79e5107fc8ffd4699288c2e3be` www.windows-liveupdate.com SoftSign@HotMail.com gzzx 3460 `c9f33d544c5657d4ba55a92e06e38d06` www.windows-liveupdate.com SoftSign@HotMail.com Qbxt 3460 `037d6fbb28222321c6b0ace6305c41ef` a5g17mail.3322.org CeleSign@hotmail.com IN 4014 `1a473ae0967d141a6aadc6731663b37d` a5g17mail.3322.org CeleSign@hotmail.com xfish 6200 `1e60824de00ce3c1f62fddc54a9c5c93` yt.bodologetee.com CeleSign@hotmail.com jiagu 80 `3817374b73d31d46d74489f36f04b8e6` a5g17mail.3322.org CeleSign@hotmail.com 0427 6200 `3a29f097c281b82593220f2ed466f3d6` a5g17mail.3322.org CeleSign@hotmail.com IN 4014 `409580363a869a861c667c37fbf7212c` a5g17mail.3322.org CeleSign@hotmail.com bsbbs 6200 `434b3f6a2176290ba2980bb568bae6db` a5g17mail.3322.org CeleSign@hotmail.com xfish 6200 `46de60abab981fb29ed263a94002c8ff` a5g17mail.3322.org CeleSign@hotmail.com 0427 6200 `474ae7cb12e77f43e3b07423e8d2e707` a5g17mail.3322.org CeleSign@hotmail.com IN 4014 `48499fdbeab3277c3c2cd71e363535c7` 127.0.0.1 CeleSign@hotmail.com xfish 3460 `552b5252ff52be814e23b1506eeb50ee` a5g17mail.3322.org CeleSign@hotmail.com xfish 6200 ----- `5bcf43e49d6bfbc26ec1f1cd6968ed3e` a5g17mail.3322.org CeleSign@hotmail.com IN 4014 `5d2d6d9fe58355c01e31c0f12ab99bd3` 127.0.0.1 CeleSign@hotmail.com xfish 3460 `5db6e16c286363115454690bc5c3da77` a5g17mail.3322.org CeleSign@hotmail.com bsbbs 6200 `6648c9ffc4f4e705545daaa3c09373fd` a5g17mail.3322.org CeleSign@hotmail.com IOTY 6200 `69238872045ab0148c581bb8d99a6a1c` a5g17mail.3322.org CeleSign@hotmail.com xfish 6200 `6a71157ee541a78f580f5eebc53b86eb` a5g17mail.3322.org CeleSign@hotmail.com IN 4014 `6e7fc8bac73410b58d4d1b2ce0dcc44e` a5g17mail.3322.org CeleSign@hotmail.com IN 4014 `7fc18dedcc7728b3103d4108557e8fb4` a5g17mail.3322.org CeleSign@hotmail.com IN 4014 `8fff7ca54103d5de1734b940d165b871` a5g17mail.3322.org CeleSign@hotmail.com bsbbs 6200 `b443f9a521d7ea56b387d36484df1900` a5g17mail.3322.org CeleSign@hotmail.com xfish 6200 `b5ff5a76ab4cca4a8fc3d2c39b30c997` a5g17mail.3322.org CeleSign@hotmail.com IOTY 6200 `b756fb047aff38fb8a2f2778d4b2d392` a5g17mail.3322.org CeleSign@hotmail.com xfish 6200 `c64dd5393a17226b208b049a4b766bd6` yt.bodologetee.com CeleSign@hotmail.com jiagu 80 `cf8861ae0c0525d345a72ac43a767548` a5g17mail.3322.org CeleSign@hotmail.com 0427 6200 `d13e4ef3e3791927397baf292182c583` a5g17mail.3322.org CeleSign@hotmail.com IOTY 6200 `e1fe9adfc62dfe5aee7d7cf3d6e51c29` a5g17mail.3322.org CeleSign@hotmail.com IN 4014 `f52d6ba37ae65bd02ee5485309c87cdd` a5g17mail.3322.org CeleSign@hotmail.com xfish 6200 `f6edfa0c8d35f74374d62309a8436a46` a5g17mail.3322.org CeleSign@hotmail.com bsbbs 6200 `faffe9b9182709f62de4da91cffe3a5f` a5g17mail.3322.org CeleSign@hotmail.com xfish 6200 `e2a063d5afb6cf892431246013cc3919` zfyxu.gicp.net CeleSign@hotmail.com 301 1983 `01c142c7bfb0d8655f02eaac5cbe0baf` bbaolong.vicp.net DataBase@Hotmail.com 0417zhang 3460 `09cadcb2af2d06dae3a120ff43aa97ac` olk4.3322.org DataBase@Hotmail.com xzang 3460 `1a0ab794b8b590964c9c2d024956ad01` olk4.3322.org DataBase@Hotmail.com xfish 3460 `3d4545c40e4f359ad38dde0dae375f18` www.windowsliveupdatecache.com DataBase@Hotmail.com qq 3460 `52e8c0d7b2572054198b2d4dc401bc47` dog.aumoni.com DataBase@Hotmail.com d0306 1258 `538da437660a6a3ff64e9eba44d27423` okia.3322.org DataBase@Hotmail.com 2011a 3480 `55f75ea088c723958bf880391747b7a3` tigertigertiger.3322.org DataBase@Hotmail.com tiger 80 `5de88d845578b8782a570c1f808a164c` www.windows-liveupdate.com DataBase@Hotmail.com gzzx 3460 `64cd92c40c4249dfc03aa9e211605f55` www.windows-liveupdate.com DataBase@Hotmail.com Qbxt 3460 `68ac613a97afdd9a0c58c05908e15e82` liyanyanzy.3322.org DataBase@Hotmail.com juesh 80 `9335bbd44567f56d4f4027cf2d105156` tb801.co.cc DataBase@Hotmail.com hktbb 3460 `a085e20215ffed7056ddeb49b0fa8c8c` tigertigertiger.3322.org DataBase@Hotmail.com tiger 80 `a7756ffb6fafc866e9c6ba7a51f162e5` www.windows-liveupdate.com DataBase@Hotmail.com zwdb 3460 `a7a4fb56c8e7a74490e00146a14d641d` qqpass.kittyeah.com DataBase@Hotmail.com Lobsternz 5960 `be7ac4097e8740a280c2daabbc8aac2c` liyanyanzy.tk DataBase@Hotmail.com tkkkk 80 `cf3a539bd308964b357c6d7fdb8e77cd` qqpass.kittyeah.com DataBase@Hotmail.com \xB6\xCE\xBA\xBA\xBD\xDC 35 `d745cd51b8497638a8bc7d65f6aea302` sunnyrone.coyo.eu DataBase@Hotmail.com 12345 80 `da981c3c8acfdd7a4b1982ceb53d2105` okia.3322.org DataBase@Hotmail.com fant1 3480 `e2ccc17ad7428516b22d73d7f3d04c88` tb-20110112.3322.org DataBase@Hotmail.com tb 3460 `eb99559000fa4bffb09f0095b5771f64` yangjinxiu.vicp.net DataBase@Hotmail.com 12345 80 `f451140e7ad709b239bfe5b9a9e85ec7` liyanyanzy.3322.org DataBase@Hotmail.com shenf 80 `f7427898041410dec0d6ac1a2250838c` veidu.uicp.net DataBase@Hotmail.com 12345 80 `14259ca243aa80e733bdd7d65e518c6d` xyxf110.3322.org goodw@hotmail.com xfish 3460 `a27b30f1dedf64900eac64fdb22d51c9` csfox.3322.org goodw@hotmail.com BoerS 3460 `2fd59b0af3858688487aa5d98f5927d1` jiangshan2368131.3322.org laker@gmail.com xfish 3460 `31890debe88cd057c351a64e260682f8` 127.0.0.1 laker@gmail.com se 32 `3ec57887caa14d1c7b83a0f7a441b52a` yunlong123.3322.org laker@gmail.com xfish 5555 `41d985d0b3a9dfd79da0b39f9a1aa4bf` asiondragon2008.3322.org laker@gmail.com GM164 3460 `46ebbc42670e8e2a0a03654559d54983` bafeite518.vicp.net laker@gmail.com eeeee 3460 `60064d648bc533a38a708dbe5f759034` www.zone.qpoe.com laker@gmail.com 71 80 `60111cd0e8372f84df471e71ef9909a7` terry0707.vicp.cc laker@gmail.com xfish 3460 `64bc0eee75c62da0e997ca3f4e257cdb` bbaolong.vicp.net laker@gmail.com 1012 3460 `827604d4811d2dfbf34e7de87a48a08e` axna.5166.info laker@gmail.com xfish 3460 `8423599f6ffd07d5bc9cc02b3610b0f8` jiangshan2368131.3322.org laker@gmail.com xfish 3460 `86142a2eddfadb5d3d879e8a377bec7d` jiangshan2368131.3322.org laker@gmail.com xfish 3460 `8891b5aa1125c2b9b4e06158346b1f21` axna.5166.info laker@gmail.com xxx 3460 `936721205de8e825b02099f036ad1b61` jiangshan2368131.3322.org laker@gmail.com xfish 3460 `96f19f590ebc84ded2a7af4c052fccf2` jiangshan2368131.3322.org laker@gmail.com xfish 3460 ----- `97cba74ed66a650403c16c6aca96d608` bafeite518.vicp.net laker@gmail.com eeeee 3460 `9e890216c8c880c5c4859a77894c8210` axna.5166.info laker@gmail.com xfish 3460 `b13352f5a17d3eb3937ea9cbbdd142cf` bafeite518.vicp.net laker@gmail.com eeeee 3460 `b5ba974dadb886bcdd826a3692915d3a` bafeite518.vicp.net laker@gmail.com eeeee 3460 `bf973493fd8d7c097d26ecc1c1a75b96` bafeite518.vicp.net laker@gmail.com eeeee 3460 `c364c68e36f7d864dc78a1778eb0b262` axna.5166.info laker@gmail.com xfish 3460 `d0f62109a38e0dbafcc1a3fefecfd09c` atneh.vicp.net laker@gmail.com xfish 3600 `df5be665924cfd5898c189c91a79322f` terry0707.vicp.cc laker@gmail.com xfish 3460 `f07b20c47dee2362ea66b57a96acc7ed` bafeite518.vicp.net laker@gmail.com eeeee 3460 `c93f8a7a899142db1e92138b76407588` www.mol-government.com micro@CeleWare.NET 3460 `a25e5bcc52c386eb046149799ed81b2b` www.newsyandex.com microsoft@CeleWare.NET 80 `646cfe960219f1948eac580e3bd836f8` yt.bodologetee.com microsoft@hotmail.com text1 6006 `e3ef377d4ed4b8c0fca7b893f4074ce0` bafeite518.vicp.net xyblack@gmail.com shiww 3460 `04ce6965a52bb87cc070077678f5e323` jiangshan2368131.3322.org xyblack@gmail.com xfish 3460 `081e01fecdd47346a55e5a8a13b0720c` jiangshan2368131.3322.org xyblack@gmail.com xfish 3460 `0bdacf6e88263c85a669b84692a337b1` long1235.3322.org xyblack@gmail.com xfish 6000 `b030c0d878997350a7dd1f0533090846` long1235.3322.org xyblack@gmail.com xfish 6000 `e95432553f5d6ddaadad8a634a9a3e7d` long1235.3322.org xyblack@gmail.com xfish 6000 `ef1de280764dfa67abdfe3928932a6a2` long1235.3322.org xyblack@gmail.com xfish 6000 `da52a58fa6f45fd8ede22a0618cb7260` bafeite518.vicp.net xfish@hotmail.com fjian 3460 `103b21042f60d6904a819d504a7b1be1` monalisa88188.3322.org xfish@hotmail.com mengn 3480 `10cfadfb49b1ca15563b20e72ffde76f` 220.175.13.250 xfish@hotmail.com xfish 8080 `772447c014c0ef465313fb8865d3c501` asion-2009.gicp.net xfish@hotmail.com ND906 3460 `7d36ad6aafbf1f9496ccc6ac1a8bb57e` ns2.adultstick.com xfish@hotmail.com lrqdz 3460 `882b1e94652a6ee0377380d2b7c74de5` asion-2009.gicp.net xfish@hotmail.com ND906 3460 `1ce83eb64757f30737aebfc177ff681b` bafeite518.vicp.net xfish@hotmail.com minzh 3460 `429bc1afd27b39a26494c868a4013eaa` iamflying.3322.org xfish@hotmail.com baiyi 3460 `64718689ee3ff695c55ea1ec213434d1` ns2.adultstick.com xfish@hotmail.com lrqdz 3460 `8a3ca42ee9b67c4d030ee9d5193fd8b8` monalisa88188.3322.org xfish@hotmail.com mengn 3480 `8ae26d583509b9eea207126b29121459` asion-2009.gicp.net xfish@hotmail.com ND906 3460 `fda1664e10e36c833a1aceae3688fc73` xxxxxxxxxx xfish@hotmail.com xxxxx 94 `04045fd7863c2512da99d69bbe7ceb43` asiondragon2008.3322.org xfish@hotmail.com GM164 3460 `09a291e91adc6a994499fb27e7fae65c` yunlong123.3322.org xfish@hotmail.com xfish 5555 `1a087cdeac6ee8169fa9f0359403091b` axna.5166.info xfish@hotmail.com xfish 3460 `1f3065accfe697c56f45b641659f6418` bbaolong.vicp.net xfish@hotmail.com 1012 3460 `3e7ba528aa87d0ec6a24c643e5527391` axna.5166.info xfish@hotmail.com xxx 3460 `4b386d215a650280b685837e3a11b126` xyxf110.3322.org xfish@hotmail.com xfish 3460 `51c318d9f127a1f2fc112e22105cb5fb` xyxf110.3322.org xfish@hotmail.com new6 3460 `6abf57bc4621a8f5e3153cb3c10353a2` bafeite518.vicp.net xfish@hotmail.com eeeee 3460 `84ae8974750c2993aa409e048c940c69` 59.50.99.83 xfish@hotmail.com xfish 8080 `9f33a565837211d126ef48a518b14971` www.zone.qpoe.com xfish@hotmail.com 71 80 `a07f6cf0029adbf16e8b7c644c26ce81` csfox.3322.oRg xfish@hotmail.com TWB 3460 `aa056a0ac5d81d0fb7974702861ea827` jiangshan2368131.3322.org xfish@hotmail.com xfish 3460 `b38b53f6a04c2f42433bef80df18998a` 127.0.0.1 xfish@hotmail.com se 32 `b65f394d07a665dadab98b3fdcfec25f` CsFoX.3322.OrG xfish@hotmail.com foxtt 3460 `e866043cf627b6ef4d13a820e314a99c` jiangshan2368131.3322.org xfish@hotmail.com xfish 3460 `fe4df2b266a570fc041a1a1cdd5451f2` terry0707.vicp.cc xfish@hotmail.com xfish 3460 `0ca360ef2797bee54b53e5a34d47f3e4` jiangshan2368131.3322.org xfish@hotmail.com xfish 3460 `8f0b13f9111241132e1c0738f5b03227` long1235.3322.org xfish@hotmail.com xfish 6000 `6d869c47d1930ea7fc054f22d49402ff` bafeite518.vicp.net xfish@hotmail.com shiww 3460 `044d8a1f538cc875c4222272984a6193` csfox.3322.org xfish@hotmail.com R3461 3461 `0eb634f8e1ce366b8b7216024590df2b` bafeite518.vicp.net xfish@hotmail.com tuya 3460 `20aa76dcd2bb2925d8d5fda4a39f5947` csFOX.3322.orG xfish@hotmail.com T9158 3460 `2e81515f8323a4481e1bdcc4e5193d99` csfox.3322.oRg xfish@hotmail.com TWB 3460 `35c355c051d911d34bf9fae984973fb9` jiangshan2368131.3322.org xfish@hotmail.com xfish 3460 `48a8e6dc1e9b11a0c2aecf6fcd1d8d03` csFOX.3322.orG xfish@hotmail.com T9158 3460 `4dd04d65e16f6147a8427f548fd1f9a3` asion-2009.gicp.net xfish@hotmail.com GM1.6 3460 `55b2c4e0d2d036910a014167dab5c8f9` asion-2009.gicp.net xfish@hotmail.com GM1.6 3460 ----- `570a80412467a33ffddc94ad443b92fc` csfox.3322.org xfish@hotmail.com R3461 3461 `59c22dca8bfcae8a6c3f9f6c6834ad33` jiangshan2368131.3322.org xfish@hotmail.com xfish 3460 `5bb9ce4a13c1aab97a3923d8b857fdfd` jiangshan2368131.3322.org xfish@hotmail.com xfish 3460 `5d36836932d43389780b8100245b28d0` bafeite518.vicp.net xfish@hotmail.com mg 3460 `5fa7bbabb2463fcc56c13dae5826784a` xyxf110.3322.org xfish@hotmail.com xfish 3460 `615fe8b63bcb6575185dfc996ca18e04` CsFoX.3322.OrG xfish@hotmail.com foxtt 3460 `7279b27dfd686f41d212c06d40bc09a0` bafeite518.vicp.net xfish@hotmail.com tuya 3460 `89819111ce917666c5865b98041db9c4` csfox.3322.org xfish@hotmail.com R3461 3461 `ad317df6bcc6a9cd5ec08a5177d3300b` CsFoX.3322.OrG xfish@hotmail.com foxtt 3460 `b424b010732c6b21c3d811e26fdedeaf` jiangshan2368131.3322.org xfish@hotmail.com xfish 3460 `c9ee85547bca1825514e921c66fbc2fc` CSfox.3322.Org xfish@hotmail.com T5888 3460 `dca6b6a12df13964bc4d56a7a2e5690c` bafeite518.vicp.net xfish@hotmail.com tuya 3460 `e8fc2905195b38945649b38018c395e0` 59.50.99.83 xfish@hotmail.com xfish 8080 `4dcc921959c7769fdfe0e6a65bff29a3` paladin666.gicp.net wugong@hotmail.com palad 3460 `6a51c68b272fa6364cf812c6c488f399` paladin666.gicp.net wugong@hotmail.com palad 3460 `d75140218ffbba6663704b6a4be1d752` paladin666.gicp.net wugong@hotmail.com palad 3460 `03d576b3d29ea70714ca28a8704d2063` xyxf110.3322.org spring@hotmail.com xfish 3460 `0bd321879f9e7949ea2bf8c82496d404` sbwfn007.3322.org spring@hotmail.com hyrf 7975 `36af416dd751d2531f69877469b601d9` sbwfn007.3322.org spring@hotmail.com hyrf 7975 `4108daddc9cbc28e812c4325ae9c22de` freedom8964.ddns.info spring@hotmail.com WS 53 `b6ebe0a76cbf24bc4b0a8bf0b8f20205` xyxf110.3322.org spring@hotmail.com xfish 3460 `c067c295fa72381c0bdeea4273b4bb4c` sbwfn007.3322.org spring@hotmail.com hyrf 7975 `d26f9684c391f69fc6326fa3d71c1018` heiantiankong.gicp.net spring@hotmail.com xfish 3460 `ef4a862e2ba601053647a4b297d2b8b3` xyxf110.3322.org spring@hotmail.com xfish 3460 `f057ccc37f20cb8425b7f8975047bba8` csfox.3322.org spring@hotmail.com BoerS 3460 `fbfecc5078c3336ae53db41a148e8c74` sbwfn007.3322.org spring@hotmail.com hyrf 7975 `542f45c05e68e0884d25f3a2681b2235` 127.0.0.1 spring@hotmail.com xfish 3460 `86fa64581f38f423085339d0e0639a44` zeropan007.3322.org spring@hotmail.com new 8080 `dedc3879f1af489cbcf2b85b3b25f13f` zeropan007.3322.org spring@hotmail.com 0912 80 `fa1379f3e680dfe7b679cb38ac66b758` 123.151.192.105 spring@hotmail.com tibet 3460 `42c3cc80a11ad69afcaca051ce23392a` zfyxu.gicp.net spring@hotmail.com CN 3460 `5ad33406e1c7f36034b99ab4d820e39f` hh-mr.gicp.net spring@hotmail.com xfish 3460 `623e3db25c43184ec044d646dd1df4a2` qq907433815.3322.org spring@hotmail.com 99999 3460 `6d9234f17a16dabdc83c757fc7052849` fun010.vicp.net spring@hotmail.com xmddd 9090 `d2235d2276f0dc410db5422c6e0f716c` axna.5166.info spring@hotmail.com xfish 3460 `da203dcaee67c1b7d9094e77e0b61d21` iamflying.vicp.net spring@hotmail.com 1.730 80 `f0baccf99bae6fbdde4463b87e0e8733` fun010.vicp.net spring@hotmail.com xmddd 9090 `3f95b9dd7547044b23e31ee01745fd8f` paladin666.gicp.net qianming@CeleWare.NET palad 3460 `0db89a0cc2cf2a88c40ea8e76c7c0834` tigertigertiger mogolsoft@Hotmail.com tige1 80 `0f4d03353b172639ed43410061f5eb8f` tigertigertiger.3322.org mogolsoft@Hotmail.com tiger 80 `4d95a416bef7eeffee2837596755a476` liyanyanzy.3322.org mogolsoft@Hotmail.com juesh 80 `52427aabdf5bf61e818ca343ed35b5fd` liyanyanzy.tk mogolsoft@Hotmail.com tkkkk 80 `b8d0556df19fee8485f5581ddc4fea8c` tb-20110112.3322.org mogolsoft@Hotmail.com tb 3460 `e75150f613f593ffe8ade4ce3db6fc7e` liyanyanzy.3322.org mogolsoft@Hotmail.com shenf 80 `ef404a76bd11e1d675b7686775ed7f1c` yt.bodologetee.com mogolsoft@Hotmail.com nsc01 80 `3f795be50edfe011167a479e735078e2` 127.0.0.1 VerySign@CeleWare.NET xfish 80 `49dcf66fe12703789cf5074a5c222211` hqhaha.hk221.hqidc.net VerySign@CeleWare.NET flg 80 `74eabedd7a9bce6973f5ac5d2e1404c5` hqhaha.hk221.hqidc.net VerySign@CeleWare.NET pdf 80 `f554c212f314e15388e33a62ce88cd34` hqhaha.hk221.hqidc.net VerySign@CeleWare.NET zd 80 `1042efb418f845f362f302b63d4d3c77` yangjinxiu.vicp.net 12345 80 `d9203e00ff7b2edb01f52b378e3386be` 127.0.0.1 xfish 3460 `7d4d78d1dacfeaad46c6506522ad61c2` xiaoya.oicp.net 12345 80 `95881cd633b682cda181d22b5f5efc12` zooosi.com 12345 80 `ba9d43b3f1e81e0cca615e19a0f20bdc` veidu.uicp.net 12345 80 `f3f29866a50b82da0eee22b016af5bdc` sunnyrone.coyo.eu 12345 80 ----- ###### 1855 1st Ave., Suite 201 San Diego, CA 92101 USA 1.888.466.6267 ###### Strandveien 37 Lysaker, Norway +47.67.10.97.00 ###### www.normanshark.com ###### 24 | T h e C h i n e s e M a l w a r e C o m p l e x e s : M a u d i N o r m a n S h a r k ----- friendDJDTBBHHTorg tbVJDTcoTcc bmwTwebhopTnet # Th M di I f t t -----