MD5: 20069696096089107067816004071bfd
SHA1: b733bc45b89e2b782e93155a0caaeb11740ed5f5
SHA256: 0918c983ce00c2002b91170e0810bcdf422b6e64827d24a7f9055b71e1715604
SSDeep: 24576:7NBaERO0P7v7vOi3FwV0vOVyNzKRBehm9dN3YvandAk hr7987A:7NBFVrLp3DOVsYs8dFYvanGVhr7r
Size: 2060288 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2015-05-24 08:23:11
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

attrib.exe:1884
attrib.exe:1692
attrib.exe:1208
attrib.exe:636
cacls.exe:612
cacls.exe:1976
cacls.exe:224
cacls.exe:1260
cacls.exe:592

The Trojan injects its code into the following process(es):

wscntmx.exe:1288
%original file name%.exe:1736

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process wscntmx.exe:1288 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\b.bat (255 bytes)
%System%\drivers\etc\hosts.ics (17013 bytes)
C:\a.bat (356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\cj[1].txt (4605 bytes)
%System%\drivers\etc\hosts (16478 bytes)

The process %original file name%.exe:1736 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\43881.tmp (15 bytes)
%System%\drivers\etc\protocol (799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\style[1].css (12015 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\game[1].htm (32375 bytes)
%System%\drivers\etc\networks (407 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (313 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\click[1].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\jiaqun[1].htm (254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\title-bg[1].jpg (1458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\bg[1].jpg (61672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\drivers\etc\lmhosts.sam (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6KG2B16F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEFGLIN\soso.hcjd56[1].htm (1199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WK6710RZ\count1[1].gif (715 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (788 bytes)
%System%\drivers\etc\services (7 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NOPHMW2Y\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\43881.tmp (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)

Registry activity

The process attrib.exe:1884 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 D2 58 95 FA 47 AB 73 0A A7 1C 10 44 95 B5 FE"

The process attrib.exe:1692 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 4E A5 D4 76 3B 69 E6 3F DE BE E1 C0 FD 7D E6"

The process attrib.exe:1208 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 A5 F0 9B 95 5A A2 CD 15 F5 D0 14 06 B9 60 F1"

The process attrib.exe:636 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 D5 31 63 D8 92 6B C8 C0 85 4D 96 EA AA 17 B6"

The process wscntmx.exe:1288 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF E4 EC 0D DB CE 28 1D 6C E1 5F DE 63 15 B7 94"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wscntmx" = "D:\\wscntmx.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1736 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 84 27 1F 6D BE 93 91 B2 8A 85 67 9A DD 8D F2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process cacls.exe:612 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 64 D6 8E 71 C3 6D B8 11 2E D4 5B ED C7 11 D4"

The process cacls.exe:1976 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 C6 69 F6 EF 92 B0 DA 63 21 D6 29 12 45 7D F9"

The process cacls.exe:224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B 89 C8 FC 2B B0 E3 91 27 83 ED 82 CC 42 1C BD"

The process cacls.exe:1260 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 DD EE 42 0B 2C 29 7A 6E 2F CE AA A4 CD 4E 21"

The process cacls.exe:592 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 67 03 8C 79 5D 3B 46 B6 CE 9F 41 C8 BA A4 00"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 65537 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://jc.941pojie.com/jiaqun.htm	125.88.186.134
hxxp://jc.941pojie.com/cj.txt	125.88.186.134
hxxp://jc.941pojie.com/zy.txt	125.88.186.134
hxxp://jc.941pojie.com/tc.txt	125.88.186.134
hxxp://p21.tcdn.qq.com/wpa/images/group.png
hxxp://jc.941pojie.com/cxbt.txt	125.88.186.134
hxxp://count46.51yes.com/click.aspx?id=460737107&logo=1	61.147.124.247
hxxp://count46.51yes.com/count1.gif	61.147.124.247
hxxp://count46.51yes.com/sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)	61.147.124.247
hxxp://cj.941pojie.com/tc.txt	125.88.186.134
hxxp://cj.941pojie.com/zy.txt	125.88.186.134
hxxp://cj.941pojie.com/cxbt.txt	125.88.186.134
hxxp://pub.idqqimg.com/wpa/images/group.png	103.7.29.190
soso.hcjd56.com	115.231.174.114
25145ko1.hbgyzs.com	115.231.174.114

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request on Unusual Port Possibly Hostile
ET POLICY Unsupported/Fake Windows NT Version 5.0

Traffic

GET /click.aspx?id=460737107&logo=1 HTTP/1.1

Accept: */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 30 Aug 2015 14:56:57 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Type: text/html; charset=gb2312

Content-Length: 1777
..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(
endstr==-1) endstr=document.cookie.length;return document.cookie.subst
ring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.
length;var clen=document.cookie.length;var i=0;var j;while(i<clen) 
{j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=d
ocument.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..functio
n cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*360
00;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz
=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie
="cck_lasttime=" yesctime "; expires="   y_e.toGMTString()    "; path=
/";document.cookie="cck_count=0; expires="   y_e.toGMTString()    "; p
ath=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_c
ount");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y
_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctim
e "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count
=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var
 yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' esc
ape(document.location) '&color=' screen.colorDepth 'x&resolution=' scr
een.width 'x' screen.height '&returning=' cc_k() '&language=' navigato
r.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('
<a href="hXXp://countt.51yes.com/index.aspx?id=460737107" target=_b
lank><img width=20 height=20 border=0 hspace=0 vspace=0 src=
<<< skipped >>>

GET /sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 30 Aug 2015 14:56:58 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Length: 0
HTTP/1.1 200 OK..Date: Sun, 30 Aug 2015 14:56:58 GMT..Server: Microsof
t-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Co
ntrol: private..Content-Length: 0..

GET /jiaqun.htm HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: jc.941pojie.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 30 Aug 2015 14:56:37 GMT

Content-Length: 217

Content-Type: text/html

Content-Encoding: gzip

Content-Location: hXXp://jc.941pojie.com/jiaqun.htm

Last-Modified: Sun, 30 Aug 2015 14:51:59 GMT

Accept-Ranges: bytes

ETag: "8091166c33e3d01:840bb"

Vary: Accept-Encoding

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
..........t.=R. .E.....y.....8.........]Y.he....v..z..-..9...!9.-}43..
%c...c....}...1.v[[email protected]{. .`..2.r
Y....#fK=..rJ.do.p...1..-..p.3..#.au..|~.R................d.g..v...o..
.......HTTP/1.1 200 OK..Date: Sun, 30 Aug 2015 14:56:37 GMT..Content-L
ength: 217..Content-Type: text/html..Content-Encoding: gzip..Content-L
ocation: hXXp://jc.941pojie.com/jiaqun.htm..Last-Modified: Sun, 30 Aug
 2015 14:51:59 GMT..Accept-Ranges: bytes..ETag: "8091166c33e3d01:840bb
"..Vary: Accept-Encoding..Server: Microsoft-IIS/6.0..X-Powered-By: ASP
.NET............t.=R. .E.....y.....8.........]Y.he....v..z..-..9...!9.
-}43..%c...c....}...1.v[[email protected]{. .
`..2.rY....#fK=..rJ.do.p...1..-..p.3..#.au..|~.R................d.g..v
...o...........

GET /wpa/images/group.png HTTP/1.1

Accept: */*

Referer: hXXp://jc.941pojie.com/jiaqun.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pub.idqqimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Cache-Control: max-age=259200

Last-Modified: Fri, 12 Apr 2013 09:22:21 GMT

Content-Type: image/png

Content-Length: 1827

Keep-Alive: timeout=60 

X-Cache-Lookup: Hit From MemCache
.PNG........IHDR...Z.........w.{'....PLTEV...dE)r.Ip..........F.......
.F..Kyy...r.....~E ......m..c..........d3.....S.....r...S1...#.....c..
......A..l3....d.............ynvc......"..][email protected]..............&..I
...\BH.....................rHh........z4$...X..0.....R.....s@6...{RL(.
......Xs.y......S........%.........vb...4......bW...[%..........L..t..
s..c>'...2..............wsw..i.............yM...WwaR...?-.fU...~K;.
`H...t..V..:..d...........h/#.......Z74..........pt5(...K...vb=......l
M.........N.kr......I A............pVs..k.....f'.p.....c..%...SG.J;..r
6......fBr..o=5...T..J...jB......5.....|......n^....XLm3#......y.f.}X.
...]6...,y....8..........q.D-Mt....^* z= y>#.dK...^...........>.
.s..J..............B....q...................xy...'..t.....7..M...~Re..
......s: .K(.rP`)..^=.........3......G:V......WE..2.....pHYs..........
.......IDAT8....T.U...lCs..It.....5r,*....I.K.].5p.d....2.4Fw.m}.....e
.v7r.........S.D.IVR.&.....y8G;.................N.r...9.t......p9.....
].......,Ko..i.......Mh.|@..hyw..9...n..qo-....C.....s.fpo..:{..vtQQG.
.......'..zmr.......H...m.u4.;..t...7....C.........a...?....{)...W..4.
..u......(....l..Q.|......R.u.3K.;.!..}vy([.e.~YhG[^. y......C...<.
...~.<-^I3......$..B....z...?$......u...S.7....qF$?.wF..G..lkC#...=
...A...C.......#x...Ea.yvS(..P..e..2..*....yD]]d.\.....{..h.....5.UK.@
J....ux7...>5.H_....}...T]2x,EO7SEmf.6.u:sk(..4...-.,...o6;B...Me. 
.\..._.]SSs..._....?g.,.x.$.tL...)..u.<Mv`4..Q<QiU.1O.X%......q.
.-.w.h... **.....e}..E...'...51t...0...0v....)^1.'.^..U.u`| 3.8l.)
<<< skipped >>>

GET /click.aspx?id=460737107&logo=1 HTTP/1.1

Accept: */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 30 Aug 2015 14:56:53 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Type: text/html; charset=gb2312

Content-Length: 1777
..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(
endstr==-1) endstr=document.cookie.length;return document.cookie.subst
ring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.
length;var clen=document.cookie.length;var i=0;var j;while(i<clen) 
{j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=d
ocument.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..functio
n cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*360
00;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz
=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie
="cck_lasttime=" yesctime "; expires="   y_e.toGMTString()    "; path=
/";document.cookie="cck_count=0; expires="   y_e.toGMTString()    "; p
ath=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_c
ount");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y
_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctim
e "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count
=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var
 yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' esc
ape(document.location) '&color=' screen.colorDepth 'x&resolution=' scr
een.width 'x' screen.height '&returning=' cc_k() '&language=' navigato
r.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('
<a href="hXXp://countt.51yes.com/index.aspx?id=460737107" target=_b
lank><img width=20 height=20 border=0 hspace=0 vspace=0 src=
<<< skipped >>>

GET /count1.gif HTTP/1.1

Accept: */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com