Gen.Variant.Strictor.29584_a7a99907eb

by malwarelabrobot on June 9th, 2015 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Strictor.29584 (B) (Emsisoft), Gen:Variant.Strictor.29584 (AdAware), Backdoor.Win32.Farfli.FD, Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.IEDummy.FD, GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan-PSW, Trojan, Backdoor

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: a7a99907eb098fde3b5ec91c15ff1eb9
SHA1: f94f64204488ddbfac17c1d93fe75ad456b5c8b3
SHA256: d4cabe0e0390ae2cad660a4d3812accfe98f56884f4a7cc79aa479dc4b094e6b
SSDeep: 24576:ED9tl5 OzeVuDRXqYVnSbR VrKcSwV0vOVyNzKRBehm9dN3YvandAk hr7o8hM:EhfqGdVSbQNMOVsYs8dFYvanGVhr7C
Size: 2121728 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2015-03-03 22:43:52
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

attrib.exe:1236
attrib.exe:1840
attrib.exe:544
attrib.exe:1264
qudongrensheng.dat:1796
cacls.exe:1632
cacls.exe:1040
cacls.exe:1028
cacls.exe:940
cacls.exe:1012

The Trojan injects its code into the following process(es):

%original file name%.exe:1156
wscntmx.exe:244

Mutexes

The following mutexes were created/opened:

__DDrawCheckExclMode__
__DDrawExclMode__
DDrawWindowListMutex
DDrawDriverObjectListMutex
CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
ZonesLockedCacheCounterMutex
ZonesCacheCounterMutex
ZonesCounterMutex
WininetProxyRegistryMutex
WininetConnectionMutex
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
c:!documents and settings!adm!cookies!
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
RasPbFile
ShimCacheMutex

File activity

The process qudongrensheng.dat:1796 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hao123_res.tmp (35 bytes)

The process %original file name%.exe:1156 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (13991 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\6330cf46f68cd2c7c40a422626d1cb30[1].png (362 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (753 bytes)
%System%\drivers\etc\protocol (799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\game[1].htm (16716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2014052276129177[1].gif (832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\binglang[1].png (2149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\941pojie[1].htm (438 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\daosu[1].jpg (17388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\soso.hcjd56[1].htm (1201 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2014052276129177[1].gif (832 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\daofeng[1].png (1835 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\yinyue[1].png (4941 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sky25145.hbgyzs[1].htm (1600 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (519 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tianyi[1].png (3218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6330cf46f68cd2c7c40a422626d1cb30[1].png (1941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\kl[1].gif (4786 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].php (1073 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (13108 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tee5_net_logo[1].jpg (24983 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\miaosha[1].gif (12204 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\longtian[1].jpg (8453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\haobangshou[1].jpg (2195 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\footer[1].jpg (12388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\wangpai[1].jpg (48243 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (325 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\miaosha[1].png (2498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lingfeng[1].jpg (4462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\click[2].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\mojian[1].jpg (3321 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (326 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xgz[1].jpg (2658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tianlang[1].jpg (24673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgheader[1].gif (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lszwg[1].htm (10245 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\27[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6330cf46f68cd2c7c40a422626d1cb30[1] (2016 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gif008[1].gif (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bgtitle[1].gif (3 bytes)
%System%\drivers\etc\services (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\longshen[1].jpg (18297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\046bt[1].gif (1692 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\style[1].css (3893 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\miaosha[1].gif (12807 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sky25145.hbgyzs[2].htm (1600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\game[1].js (911 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\linggua[1].png (219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic2[1].gif (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gg[1].png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\top[1].png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\shicai[1].png (6215 bytes)
%System%\drivers\etc\lmhosts.sam (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jiaqun[1].htm (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[2].php (682 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style[1].css (258 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\click[1].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (9625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\weihu[1].jpg (10658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jisu[1].png (2769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\zsf[1].gif (10523 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\zsf[1].gif (23271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (753 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (406 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (404 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bgnav[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bg[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sansha[1].png (17181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gif008[2].gif (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[2].php (753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA5OWN9L.gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bgh[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jianhun[1].png (1923 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].php (1073 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%System%\drivers\etc\networks (407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qingtian[1].gif (8985 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bg[1].jpg (156378 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\anlong[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\game[2].htm (25649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yds[1].gif (7768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tianxunzhe[1].png (13455 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qijian[1].jpg (61723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jsq[1].png (6514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\046bt[1].gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\soso.hcjd56[1].htm (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic2[1].gif (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\6330cf46f68cd2c7c40a422626d1cb30[1] (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cb386.tmp (15 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\6330cf46f68cd2c7c40a422626d1cb30[1].png (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sky25145.hbgyzs[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\click[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\click[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic1[1].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bg[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tee5_net_logo[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\soso.hcjd56[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6330cf46f68cd2c7c40a422626d1cb30[1] (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\game[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sky25145.hbgyzs[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\game[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\group[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic2[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\6330cf46f68cd2c7c40a422626d1cb30[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cb386.tmp (0 bytes)

The process wscntmx.exe:244 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cj[1].txt (2948 bytes)
C:\b.bat (255 bytes)
%System%\drivers\etc\hosts.ics (17013 bytes)
C:\a.bat (356 bytes)
%System%\drivers\etc\hosts (16478 bytes)

Registry activity

The process attrib.exe:1236 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 8E 7C E1 72 58 A7 AF 64 8D 18 3B 26 D1 E3 9E"

The process attrib.exe:1840 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 86 E9 CD 6A 55 DE 50 72 50 83 F0 CA 45 53 32"

The process attrib.exe:544 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A E7 30 92 81 94 08 4D 86 11 12 06 09 F4 01 A1"

The process attrib.exe:1264 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC 67 5D 41 BF 04 94 72 0B 8F DB C4 41 CE 6A E9"

The process qudongrensheng.dat:1796 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 68 AC 58 6B E9 03 45 B8 2C 2E F2 13 CE C2 38"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\WinHelp32\Parameters]
"ServiceDll" = "%System%\ackupw.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"krnlsrvc" = "WinHelp32"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\WinHelp32\Parameters]
"seRVicemAIN" = "RunDllEntry"

[HKLM\System\CurrentControlSet\Services\WinHelp32]
"Description" = "Windows Help System for X32 windows desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process %original file name%.exe:1156 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1425415432"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 2C 18 A8 21 F3 18 5A 58 A2 CE 15 5E 83 C7 13"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process wscntmx.exe:244 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AD FE 4C 01 34 D3 1B A8 4C 03 2E 7D 17 45 CD E7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wscntmx" = "D:\\wscntmx.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process cacls.exe:1632 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 70 12 E9 55 70 20 45 FC 7A C5 DC 31 A6 A6 04"

The process cacls.exe:1040 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 96 F3 5D F0 35 86 FF D6 4F 16 2A 29 22 EE 01"

The process cacls.exe:1028 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 4B 18 FA 5F AA C6 A9 38 08 54 2B C4 8B 28 0C"

The process cacls.exe:940 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 DE 8A 9F E7 AA 96 BA E8 40 43 28 1D 80 E9 BC"

The process cacls.exe:1012 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 7A 44 13 7C A1 07 ED C8 BF 3D D6 5E 3D 8C 91"

Dropped PE files

MD5	File path
623cdebf1ed65aaba993745ad979881f	c:\WINDOWS\system32\ackupw.dll

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 65537 bytes in size. The following strings are added to the hosts file listed below:

23.234.20.24	988.pa579.com
23.234.20.24	5k.611739.com
23.234.20.24	h.081983.com
23.234.20.24	www.121578.com
23.234.20.24	b.memekr.com
23.234.20.24	www.zhaosf.com.cn
23.234.20.24	www.xr-1688.com
23.234.20.24	g.zhenhgw.com
23.234.20.24	v.zhenhgw.com
23.234.20.24	c.vbbse4.com
23.234.20.24	www1.memekr.com
23.234.20.24	www.kfb126.com
23.234.20.24	huikaimin.blog.163.com
23.234.20.24	k.memekr.com
23.234.20.24	p.veletuan.com
23.234.20.24	c.btg55.com
23.234.20.24	v.cpjp737.com
23.234.20.24	www.agou920.com
23.234.20.24	first.cpjp737.com
23.234.20.24	c.veletuan.com
23.234.20.24	head.memekr.com
23.234.20.24	g.veletuan.com
23.234.20.24	g.zhenhgw.com
23.234.20.24	v.cpjp737.com
23.234.20.24	s.vzhishu.com
23.234.20.24	memekr.com
23.234.20.24	v.zhenhgw.com
23.234.20.24	c.vbbse4.com
23.234.20.24	k.memekr.com
23.234.20.24	p.veletuan.com
23.234.20.24	www.schzhp.cn
23.234.20.24	memekr.com
23.234.20.24	www.jlwfbdc.com
23.234.20.24	t.vzhishu.com
23.234.20.24	8.zhenhgw.com
23.234.20.24	www.210cq.com
23.234.20.24	z.veletuan.com
23.234.20.24	1.zhenhgw.com
23.234.20.24	y.vzhishu.com
23.234.20.24	www.680sf.com
23.234.20.24	www.81945.com
23.234.20.24	www.45574.com
23.234.20.24	680sf.com
23.234.20.24	81945.com
23.234.20.24	45574.com
23.234.20.24	c.cpjp737.com
23.234.20.24	lm.363.com
23.234.20.24	v.wxyxe.com
23.234.20.24	www.ahzttz.com
23.234.20.24	xup.88448.com
23.234.20.24	www.88448.com
23.234.20.24	www.aaastor.com
23.234.20.24	www.delos-lighting.com
23.234.20.24	www.tlwz.org
23.234.20.24	www.zddiu.com
23.234.20.24	www.monthidc.com
23.234.20.24	www.chinawlf.com
23.234.20.24	www.blueanimalbio.com
23.234.20.24	www.dfac.com
23.234.20.24	www.glzyz.com
23.234.20.24	www.hxsiyuan.cn
23.234.20.24	www.wohuixue.com
23.234.20.24	wvw.1234pk.com
23.234.20.24	1234pk.com
23.234.20.24	www.nc334yy.com
23.234.20.24	www.cqjztc.com
23.234.20.24	www.cdsdsy.net
23.234.20.24	www.cjfans.com
23.234.20.24	www.jsfoundry.com
23.234.20.24	www.handanyz.com
23.234.20.24	www.lingxiao.com.cn
23.234.20.24	www.jfpgs.com
23.234.20.24	hjc.bingdaofz.com
23.234.20.24	www.romanting.com
23.234.20.24	dns.ic123.cc
23.234.20.24	ad.036yx.com
23.234.20.24	www.lingxiao.com.cn
23.234.20.24	www.hwxxkj.com
23.234.20.24	www.ypdzkj.com
23.234.20.24	www.starworldhk.com
23.234.20.24	www.nfgt.com
23.234.20.24	v.vzhishu.com
23.234.20.24	8.zhenhgw.com
23.234.20.24	www.blgmj.com
23.234.20.24	www.962sf.com
23.234.20.24	www.bingdaofz.com
23.234.20.24	bingdaofz.com
23.234.20.24	zhaof.icloud3g.com
23.234.20.24	www.326sf.com
23.234.20.24	www.813sf.com
23.234.20.24	www.45chuanqi45.com
23.234.20.24	www.1213sf.com
23.234.20.24	g.zhenhgw.com
23.234.20.24	as.xfgzs.net
23.234.20.24	b.memekr.com
23.234.20.24	n.veletuan.com
23.234.20.24	cdn.9377t.com
23.234.20.24	v.memekr.com
23.234.20.24	www.dnkbl.com
23.234.20.24	6.zhenhgw.com
23.234.20.24	j.cpjp737.com
23.234.20.24	1.veletuan.com
23.234.20.24	www.sjcjlb.cn
23.234.20.24	p.cpjp737.com
23.234.20.24	p.cpjp737.com
23.234.20.24	zhaof1.wgmtrade.com
23.234.20.24	www.xinjiasu.com
23.234.20.24	www.jwbjc.com
23.234.20.24	www.mmgyz.net
23.234.20.24	i.611739.com
23.234.20.24	www.eggtt.com
23.234.20.24	www.gm635.com
23.234.20.24	k.7it7.com
23.234.20.24	www.zizhixuke.com
23.234.20.24	www.nfgt.com
23.234.20.24	www.mmgyz.net
23.234.20.24	www.ku30.com
23.234.20.24	ku30.com
23.234.20.24	f.081983.com
23.234.20.24	7.081983.com
23.234.20.24	www.chuge8.com
23.234.20.24	www.wanms.com
23.234.20.24	1.kitefeung.com
23.234.20.24	1.liaochengjiayuan.com
23.234.20.24	www.foodzhan.com
23.234.20.24	eggtt.com
23.234.20.24	www.915youxi.com
23.234.20.24	915youxi.com
23.234.20.24	d.131f.com
23.234.20.24	y.118902.com
23.234.20.24	1.7it7.com
23.234.20.24	www.91wanfu.com
23.234.20.24	91wanfu.com
23.234.20.24	www.quwanfu.com
23.234.20.24	quwanfu.com
23.234.20.24	www.91wuc.com
23.234.20.24	www.zhaosf.com
23.234.20.24	www.gykailijx.com
23.234.20.24	q.611739.com
23.234.20.24	www.588by.com
23.234.20.24	duang.5com.cc
23.234.20.24	91wuc.com
23.234.20.24	www.sy170.com
23.234.20.24	tzlsofa.com
23.234.20.24	www.tzlsofa.com
23.234.20.24	k.v58d.com
23.234.20.24	www.119021.com
23.234.20.24	121578.com
23.234.20.24	www.cq7373.com
23.234.20.24	ht.80honey.com
23.234.20.24	www.hongbzn.com
23.234.20.24	www.cfbingyue.cc
23.234.20.24	www.zgjingyi.com
23.234.20.24	youxi.036yx.com
23.234.20.24	www.wxboao.com
23.234.20.24	jh.j550.com
23.234.20.24	33ok.com
23.234.20.24	www.52zhaosf.com
23.234.20.24	52zhaosf.com
23.234.20.24	www.zhaosf123.co
23.234.20.24	www.455151.com
23.234.20.24	455151.com
23.234.20.24	www.zhaosf.at
23.234.20.24	zhaosf.cc
23.234.20.24	www.zhaosf.cc
23.234.20.24	www.zhaosf.org.cn
23.234.20.24	www.mcjd.net
23.234.20.24	z.611739.com
23.234.20.24	www.911wanwan.com
23.234.20.24	www.517zg.com
23.234.20.24	www.dju8.com
23.234.20.24	www.kfb163.com
23.234.20.24	www.7t57.com
23.234.20.24	33ok.cm
23.234.20.24	www.33ok.com
23.234.20.24	www1.33ok.com
23.234.20.24	www2.33ok.com
23.234.20.24	www3.33ok.com
23.234.20.24	www4.33ok.com
23.234.20.24	www.520mc.cn
23.234.20.24	x.118902.com
23.234.20.24	www.2kfb.com
23.234.20.24	www.mcjiuju.cn
23.234.20.24	zgjingyi.com
23.234.20.24	aaa.xu98.com
23.234.20.24	pk05.90523.com
23.234.20.24	www.chasf.com
23.234.20.24	9.611739.com
23.234.20.24	m.611739.com
23.234.20.24	k.118902.com
23.234.20.24	www.338mu.com
23.234.20.24	first.611739.com
23.234.20.24	p.081983.com
23.234.20.24	www.sxrdwy.com
23.234.20.24	happy.118902.com
23.234.20.24	sxrdwy.com
23.234.20.24	www.zhxsjc.com
23.234.20.24	zhxsjc.com
23.234.20.24	bg.118902.com
23.234.20.24	www.234wy.com
23.234.20.24	ku.081983.com
23.234.20.24	1010fz.com
23.234.20.24	www.1000q.com
23.234.20.24	1000q.com
23.234.20.24	vip.h1995.com
23.234.20.24	www.1745.com
23.234.20.24	www.1010fz.com
23.234.20.24	www.hzmeixin.com
23.234.20.24	hzmeixin.com
23.234.20.24	g.mt30.net
23.234.20.24	www.miehunsha.com
23.234.20.24	miehunsha.com
23.234.20.24	www.miehunwg.com
23.234.20.24	miehunwg.com
23.234.20.24	www.qdcyrc.com
23.234.20.24	www.180sf.net
23.234.20.24	www.zhengzhouzp.cn
23.234.20.24	pd.mt30.net
23.234.20.24	j.118902.com
23.234.20.24	n.611739.com
23.234.20.24	www.988wanwan.com
23.234.20.24	www.909wanwan.com
23.234.20.24	www.999wanwan.com
23.234.20.24	www.57ab.com
23.234.20.24	kh.mt30.net
23.234.20.24	zhaof.ctc0.com
23.234.20.24	kd.611739.com
23.234.20.24	www.456yx.com
23.234.20.24	456yx.com
23.234.20.24	www.3355sf.com
23.234.20.24	xx.611739.com
23.234.20.24	3355sf.com
23.234.20.24	www.3355sf.com
23.234.20.24	ee.mt30.net
23.234.20.24	tb.25jx.net
23.234.20.24	ko.u25u.com
23.234.20.24	hc.25jx.net
23.234.20.24	kk.u25u.com
23.234.20.24	y.611739.com
23.234.20.24	co.118902.com
23.234.20.24	stat.5pk.com
23.234.20.24	sk.081983.com
23.234.20.24	ee.mt30.ne
23.234.20.24	bdtg.37.com
23.234.20.24	v.61173f9.com
23.234.20.24	to.118902.com
23.234.20.24	www.dfsj521.com
23.234.20.24	a.118902.com
23.234.20.24	x.081983.com
23.234.20.24	jc.mt30.net
23.234.20.24	www.vis752.com
23.234.20.24	dd.yang868.com
23.234.20.24	baidu.pk05.com
23.234.20.24	zhaof.3737wyx.cn
23.234.20.24	www.5336.com
23.234.20.24	www.kaifu1.com
23.234.20.24	a.611739.com
23.234.20.24	cx.j550.com
23.234.20.24	www.st945.com
23.234.20.24	st945.com
23.234.20.24	6x.u25u.com
23.234.20.24	9kk.wd258.com
23.234.20.24	kx.u25u.com
23.234.20.24	bx.25jx.net
23.234.20.24	www.chengdongsteel.com
23.234.20.24	ss.u25u.com
23.234.20.24	ye.25jx.net
23.234.20.24	pk.j550.com
23.234.20.24	7s.u25u.com
23.234.20.24	ss.u25u.com
23.234.20.24	p.u25u.com
23.234.20.24	x.j550.com
23.234.20.24	nl.25jx.net
23.234.20.24	sw.u25u.com
23.234.20.24	5.25jx.net
23.234.20.24	9.k1f.net
23.234.20.24	9k2.wd258.com
23.234.20.24	www.9377b.com
23.234.20.24	www.5ding.com
23.234.20.24	www.lyh23.com
23.234.20.24	x.25jx.net
23.234.20.24	cc.u25u.com
23.234.20.24	tg.95k.com
23.234.20.24	www.bjwcl.com
23.234.20.24	www.9377o.com
23.234.20.24	bdtg.9377e.com
23.234.20.24	bbs.121210.com
23.234.20.24	121210.com
23.234.20.24	www.121210.com
23.234.20.24	g.02qu.com
23.234.20.24	6.u25u.com
23.234.20.24	bbs.wg78.com
23.234.20.24	wg78.com
23.234.20.24	f.25jx.net
23.234.20.24	y.j550.com
23.234.20.24	1.nanyang2012.com
23.234.20.24	sx.fans8979.com
23.234.20.24	d.416191.com
23.234.20.24	vip.h1995.com
23.234.20.24	youxi.baidu.com
23.234.20.24	d.k1f.net
23.234.20.24	dd.yang898.com
23.234.20.24	dd.yang858.com
23.234.20.24	www.daishichuchen.com
23.234.20.24	www.yzshule.com
23.234.20.24	fb.98zsjm.com
23.234.20.24	www.hqa.cn.com
23.234.20.24	www.zx-cj.com
23.234.20.24	www.628552.com
23.234.20.24	y.02qu.com
23.234.20.24	d.416191.com
23.234.20.24	www.sith.cc
23.234.20.24	www.9377t.com
23.234.20.24	www.tianxiang-intl.com
23.234.20.24	www.yn30.com
23.234.20.24	1.bzhtwqx.com
23.234.20.24	www.zzhttex.com
23.234.20.24	haocq.131sf.com
23.234.20.24	zhaof.aassdd.net
23.234.20.24	zhaof.98zslc.com
23.234.20.24	zhaof.youxizx.net
23.234.20.24	www.300sf.com
23.234.20.24	www.45uc.com
23.234.20.24	www.chasf.com
23.234.20.24	999.wd258.com
23.234.20.24	yyy.wd258.com
23.234.20.24	go.sf999.com
23.234.20.24	www.haost.com
23.234.20.24	1.hhyouxi.net
23.234.20.24	cq.98zslc.com
23.234.20.24	www.112fu.com
23.234.20.24	www.kaiqu.com
23.234.20.24	1.youxizx.net
23.234.20.24	www.777sf.com
23.234.20.24	www.hdjddl.com
23.234.20.24	112fu.huashengshipin.com
23.234.20.24	58sf.58sf-1.com
23.234.20.24	www.yx19.com
23.234.20.24	www.yx31.com
23.234.20.24	dn.67cx.com
23.234.20.24	t.u25u.com
23.234.20.24	w.hsdbm.com
23.234.20.24	dd.yang808.com
23.234.20.24	iwan.baidu.com
23.234.20.24	www.83cq.com
23.234.20.24	1.aassdd.net
23.234.20.24	www.hfhybjgs.com
23.234.20.24	www.haoqj.com
23.234.20.24	www.haojuezhan.com
23.234.20.24	www.zskunshang.com
23.234.20.24	a.mt30.net
23.234.20.24	www.377f.com
23.234.20.24	t.25jx.net
23.234.20.24	d.be-real.cn
23.234.20.24	d.diaoyiyuan.cn
23.234.20.24	www.xlmqt.com
23.234.20.24	www.528day.com
23.234.20.24	www.789zt.com
23.234.20.24	6.shangwanghui.com
23.234.20.24	1.shangwanghui.com
23.234.20.24	yx.minyouxi.com
23.234.20.24	1.678bigfoot.com
23.234.20.24	45uc.0731gfang.com
23.234.20.24	d.baidudiyi.net
23.234.20.24	u1.yhwl88.net
23.234.20.24	pojie.wwpan.com
23.234.20.24	www.9945.com
23.234.20.24	www.23u.com
23.234.20.24	www.haofu.com
23.234.20.24	www.sf184.com
23.234.20.24	www.sfw.com
23.234.20.24	www.5pk.com
23.234.20.24	tg.applx85.com
23.234.20.24	aa.liaochengjiayuan.com
23.234.20.24	ht.v58d.com
23.234.20.24	45uc.pf8898.com
23.234.20.24	61.115163.com
23.234.20.24	haocq.0553dx.com
23.234.20.24	d.baidudiyi.net
23.234.20.24	1.baidudiyi.net
23.234.20.24	11.baidudiyi.net
23.234.20.24	www.hycartoon.com
23.234.20.24	6.115163.com
23.234.20.24	www.sybnzh.cn
23.234.20.24	aa.kitefeung.com
23.234.20.24	11s.pf8898.com
23.234.20.24	1.mt30.net
23.234.20.24	www.snzad.com
23.234.20.24	www.uq2558.com
23.234.20.24	www.hada5688.com
23.234.20.24	www.zzctech.com
23.234.20.24	www.kf521.com
23.234.20.24	ss99.927wz.com
23.234.20.24	zhaocq.aassdd.net
23.234.20.24	haocq.youxizx.net
23.234.20.24	160uc.600co.com
23.234.20.24	fa.oz9es.com
23.234.20.24	nx.5cn.cc
23.234.20.24	889tt.d3yy.cn
23.234.20.24	vip.jzc123.com
23.234.20.24	www.oryin.com
23.234.20.24	776tt.d3yy.cn
23.234.20.24	www.meihaomianjia.com
23.234.20.24	www.zgr999.com
23.234.20.24	www.yxzhaofu.com
23.234.20.24	pk6666.isitestar.cn
23.234.20.24	www.lwmoyu.com
23.234.20.24	www.pk515.com
23.234.20.24	www.uc277.com
23.234.20.24	www.uc828.com
23.234.20.24	885ok.52fanfou.com
23.234.20.24	www.pk05.com
23.234.20.24	3355t.jybz66.com
23.234.20.24	www.134p.com
23.234.20.24	88pkdxy.plpl123.com
23.234.20.24	rt.5cn.cc
23.234.20.24	www.521jjj.com
23.234.20.24	www.wst86.cn
23.234.20.24	1199t.kao77.com
23.234.20.24	6677y.szxmmw.com
23.234.20.24	www.weilai99.com
23.234.20.24	zhaocq.98zslc.com
23.234.20.24	lk.yhwl88.net
23.234.20.24	9911.9zph.com
23.234.20.24	z.67cx.com
23.234.20.24	www.longyi-group.com
23.234.20.24	www.genehi.com
23.234.20.24	www.362g.com
23.234.20.24	www.3sbl.net
23.234.20.24	www.herbalife888.cn
23.234.20.24	ns.78lc.net
23.234.20.24	dd.guidawang.com
23.234.20.24	3355t.jybz66.com
23.234.20.24	www.sf123uu.com
23.234.20.24	1.25jx.net
23.234.20.24	xd.qicaimofang.com
23.234.20.24	www.sz-lb.com
23.234.20.24	www.zo6knln.com
23.234.20.24	www.o68js.com
23.234.20.24	pk789a.52fanfou.com
23.234.20.24	zhaocq.700uc.com
23.234.20.24	www.06954.com
23.234.20.24	168tg.psc8.com
23.234.20.24	www.69945.com
23.234.20.24	160uc.600co.com
23.234.20.24	www.09846.com
23.234.20.24	88pkjx.mei12a.com
23.234.20.24	www.xhtk.net
23.234.20.24	www.45569.com
23.234.20.24	www.njzs58.com
23.234.20.24	8pk.mei12a.com
23.234.20.24	88pkh1.kkk21sd.com
23.234.20.24	88pkdxw.mei12a.com
23.234.20.24	88pkdxy.mei12a.com
23.234.20.24	www.anansf.com
23.234.20.24	www.haowz.com
23.234.20.24	999.23dpw.com
23.234.20.24	st.scdcyb.com
23.234.20.24	xs.qicaimofang.com
23.234.20.24	zhaosf.2866101.com
23.234.20.24	www.jyjyh.com
23.234.20.24	www.zhaohuajx.com
23.234.20.24	www.8iss.com
23.234.20.24	www.jnlvjie.com
23.234.20.24	sf123.21daikuan.com
23.234.20.24	zhaosf.2866101.com
23.234.20.24	tuiguang.8iss.com
23.234.20.24	tuiguang.8msm.com
23.234.20.24	fe.yueworld.net
23.234.20.24	920aa.changyc.com
23.234.20.24	xb.qicaimofang.com
23.234.20.24	www.yx003.com
23.234.20.24	www1.pkokok.com
23.234.20.24	cz.yueworld.net
23.234.20.24	tuiguang.muu9.com
23.234.20.24	haosf.98zsjm.com
23.234.20.24	www.75945.com
23.234.20.24	www.lpf010.com
23.234.20.24	www.6000pk.com
23.234.20.24	9pk.2766161.com
23.234.20.24	www.zhaof7.com
23.234.20.24	www.cqhr.org
23.234.20.24	www.ddzhe.com
23.234.20.24	pk789.52fanfou.com
23.234.20.24	160uc.com
23.234.20.24	www.1nhh.com
23.234.20.24	www.52sol.com
23.234.20.24	www.cpu500.com
23.234.20.24	www.2381sfcq.com
23.234.20.24	www.uc37.com
23.234.20.24	www.98pk97.com
23.234.20.24	www.hbcyly.com
23.234.20.24	haosf.lfweibo.com
23.234.20.24	cq.kgfanli.com
23.234.20.24	www.999yc.com
23.234.20.24	www1.jjj.com
23.234.20.24	zhaosf.acrmbs.com
23.234.20.24	www.uc900.com
23.234.20.24	www2.jjj.com
23.234.20.24	www3.jjj.com
162.211.182.3	1711ok.zz135.com
23.234.20.24	w13518.hr.jw.tczj.net
23.234.20.24	zhaofu7.com
23.234.20.24	tuiguang.592097.com
23.234.20.24	v.yueworld.net
23.234.20.24	zhaosf.ofyn.net
23.234.20.24	dk.qicaimofang.com
23.234.20.24	578101.com
23.234.20.24	www.578101.com
23.234.20.24	www.126disk.com
23.234.20.24	tui99.592097.com
23.234.20.24	tui99.8msm.com
23.234.20.24	dd.guidawang.com
23.234.20.24	bb.fushilu.com
23.234.20.24	www.zhaofu7.com
23.234.20.24	www.baiduzhaokf.com
23.234.20.24	www.haosf.com
23.234.20.24	www.jsl-cn.com
23.234.20.24	www.88858.com
23.234.20.24	www.heshilurong.com
23.234.20.24	www.168fm.com
23.234.20.24	www.artobrain.com
23.234.20.24	wwv.jb345.com
23.234.20.24	www.zhaosf9999.com
23.234.20.24	www.uc1000.com
23.234.20.24	www4.jjj.com
23.234.20.24	www.uc900.com
23.234.20.24	www.uc900.com
23.234.20.24	www.cctv-kowann.com
23.234.20.24	www5.jjj.com
23.234.20.24	www.artobrain.com
23.234.20.24	www.jxytqz.com
23.234.20.24	www.as9z.com
23.234.20.24	pk789.52fanfou.com:81
23.234.20.24	36cq.dg8681.com:3636
23.234.20.24	www.444yx.com
23.234.20.24	www.993yx.com
23.234.20.24	jjj.com
23.234.20.24	www1.99s.com
23.234.20.24	www2.99s.com
23.234.20.24	99s.com
23.234.20.24	www99s.com
23.234.20.24	www.uc1000.com
23.234.20.24	2410.eodfmr.cn
23.234.20.24	www.www99s.com
23.234.20.24	www.woool99s.com
23.234.20.24	www3.99s.com
23.234.20.24	9k1.pa579.com
23.234.20.24	new.fa111.com
23.234.20.24	www4.99s.com
23.234.20.24	www5.99s.com
23.234.20.24	www.09445.com
23.234.20.24	www.cdxxzs.com
23.234.20.24	www.angelsimple.cn
23.234.20.24	www.lida00.cn
23.234.20.24	www.zbzishen.com
23.234.20.24	www.86jiewang.cn
23.234.20.24	www.itcr.cn
23.234.20.24	www.99u.net.ru
23.234.20.24	www.wan345.com
23.234.20.24	www.525uc.com
23.234.20.24	www.1cq.com
23.234.20.24	www.jjj.com
23.234.20.24	www.99s.com
23.234.20.24	www.gm005.com
23.234.20.24	www.68kf.com
23.234.20.24	wwk.astbw.com
23.234.20.24	zz.sf163.com
23.234.20.24	www.sotrip.com
23.234.20.24	33k.pa579.com
23.234.20.24	www.555sf.com
23.234.20.24	www.66hst.com
23.234.20.24	66hst.com
23.234.20.24	www.xin45.com
23.234.20.24	xin45.com
23.234.20.24	www.zhaocq.com
23.234.20.24	1.52yanzheng.sinaapp.com
23.234.20.24	www.175sf.com
23.234.20.24	www.yxyhx.com
23.234.20.24	www.168fm.com
23.234.20.24	habourbiotech.com
23.234.20.24	www.pydwlm.com
23.234.20.24	www.ux99.com
23.234.20.24	www.hn17173.net
23.234.20.24	www.5s98.com
23.234.20.24	www.880s.com
23.234.20.24	www.118uc.com
23.234.20.24	www.zf777.com
23.234.20.24	81.2381f.com
23.234.20.24	www.njkaidu.com
23.234.20.24	www.9szf.com
23.234.20.24	www.999zsf.com
23.234.20.24	www.85zf.com
23.234.20.24	www.951pk.com
23.234.20.24	www.851pk.com
23.234.20.24	988.pa579.com
23.234.20.24	ad.97uu.com
23.234.20.24	www.i8pk.com
23.234.20.24	www.sf996.com
23.234.20.24	www.0579st.com
23.234.20.24	www.mc1314.com
23.234.20.24	gm016.comforum.php
23.234.20.24	www.whsfzx.com
23.234.20.24	dd.sh-tongy.com
23.234.20.24	111.kaihu365.com
23.234.20.24	www.dddgm.com
23.234.20.24	www.ok126.net
23.234.20.24	www.wanshituliao.com
23.234.20.24	www.zaxue.net
23.234.20.24	www.4006517008.com
23.234.20.24	www.tcrhy.com
23.234.20.24	www.vdisk.cnyy6018
23.234.20.24	www.sf383.com
23.234.20.24	www.001gm.net
23.234.20.24	www.006it.com
23.234.20.24	www.gm5555.com
23.234.20.24	www.yxyhx.com
23.234.20.24	www.3jidi-gz.com
23.234.20.24	www.100gczg.com
23.234.20.24	haosf.lgknow.com
23.234.20.24	habourbiotech.com
23.234.20.24	www.satsalt.com
23.234.20.24	tg1.37.com
23.234.20.24	pi.nuwa-mountain.org
23.234.20.24	www.jafdc.net
23.234.20.24	941pk.com
23.234.20.24	www.5iwowo.com
23.234.20.24	www.bonopt.com
23.234.20.24	www.jzdkfj.com
23.234.20.24	henuedu.cn
23.234.20.24	www.sdjialiang.com
23.234.20.24	www.10010cq.com
23.234.20.24	www.z0137cx.comkwcs
23.234.20.24	www.0512rc.net
23.234.20.24	www.dahanjg.com
23.234.20.24	www.ht-vision.com
23.234.20.24	www.3159wine.com
23.234.20.24	www.jfy8rv.comzjp6bw
23.234.20.24	www.yxyhx.com
23.234.20.24	www.9uzg.com
23.234.20.24	www.gm667.com
23.234.20.24	www.znspyq.com9dzf7w
23.234.20.24	www.18-81.net
23.234.20.24	www.ht-vision.com
23.234.20.24	www.gmwly.com
23.234.20.24	user.qzone.qq.com5674167
23.234.20.24	t.qq.comchuanqisf8997
23.234.20.24	www.njjqgck.com
23.234.20.24	www.hkalu.com
23.234.20.24	www.60sf.com
23.234.20.24	www.pk123.com
23.234.20.24	www.52anzu.com
23.234.20.24	www1.52anzu.com
23.234.20.24	52anzu.com
23.234.20.24	www.sopojie.com
23.234.20.24	www1.sopojie.com
23.234.20.24	sopojie.com
23.234.20.24	www.wf22.com
23.234.20.24	xingyoufz.wwpan.com
23.234.20.24	www.36ok.com
23.234.20.24	www.32fa.com
23.234.20.24	wws.99acc.com
23.234.20.24	www.916cq.com
23.234.20.24	1711ok.sh77577.com
23.234.20.24	www.18uc.com
23.234.20.24	18uc.com
23.234.20.24	88pk.com
23.234.20.24	www.88pk.com
23.234.20.24	162.212.180.86
23.234.20.24	36ok.com
23.234.20.24	118.99.26.156
23.234.20.24	23.234.60.34
23.234.20.24	www.52anzu.net
23.234.20.24	www.77250.com
23.234.20.24	77250.com
23.234.20.24	www1.52anzu.net
23.234.20.24	tt.1kuv.com
23.234.20.24	www.33ok.com
23.234.20.24	916cq.com
23.234.20.24	91ww.91fu.com
23.234.20.24	www1.pk777.com
23.234.20.24	www.sf999.com
23.234.20.24	www.yeahooo.net
23.234.20.24	1.townhall.cn
23.234.20.24	www.bjjijiubao.com
23.234.20.24	1.xa1314.com.cn
23.234.20.24	www.yvwtjf.com
23.234.20.24	www.stylepacking.com
23.234.20.24	www.cnfengye.com
23.234.20.24	www.zazgame.com
23.234.20.24	www.zrplay.com
23.234.20.24	www.yczdwj.com
23.234.20.24	www.zheyutegang.com
23.234.20.24	www.sf123.com
23.234.20.24	www.daqiandoor.com
23.234.20.24	www.77d8.com
23.234.20.24	www.3159wine.com
23.234.20.24	www.wwesf.com
23.234.20.24	www.7988ok.com
23.234.20.24	www.shfengyi.com
23.234.20.24	pg.iflu.com.cn
23.234.20.24	www.gdtrane.com
23.234.20.24	www.scxlm.com
23.234.20.24	www.kisspk.com
23.234.20.24	www.cqxz.com.cn
23.234.20.24	www.kanonsh.com
23.234.20.24	www.gm1208.com
23.234.20.24	www.provoxav.com
23.234.20.24	dgdimei.com
23.234.20.24	www.cntzdh.com
23.234.20.24	www.hanwise.com
23.234.20.24	www.mfttj.com
23.234.20.24	www.shenqi.com
23.234.20.24	www.52345.com
23.234.20.24	81f.hao899.com
23.234.20.24	www.sf123.com
23.234.20.24	www.3159wine.com
23.234.20.24	www.daqiandoor.com
23.234.20.24	www.941jb.com
23.234.20.24	2sogo.com
23.234.20.24	mobanbbs.com
23.234.20.24	91ww.555uc.com
23.234.20.24	www.99j.com
23.234.20.24	www.91ww.com
23.234.20.24	www.777uc.com
23.234.20.24	www.xbkdq.com
23.234.20.24	66sf.77zhao.com
23.234.20.24	www.184pk.com
23.234.20.24	www.sf999.com
23.234.20.24	www.pk777.com
23.234.20.24	www.alfatoyota.com
23.234.20.24	mobanbbs.com
23.234.20.24	www.stbshg.com
23.234.20.24	www.daqiandoor.com
23.234.20.24	www.1cq.com
23.234.20.24	www.xbkdq.com
23.234.20.24	www.sf123.com
23.234.20.24	www.3159wine.com
23.234.20.24	www.buyishijia.com
23.234.20.24	www.sf999.com
23.234.20.24	www.shenqi.com
23.234.20.24	www.52345.com
23.234.20.24	www.92045.com
23.234.20.24	www.926.com
23.234.20.24	www.99j.com
23.234.20.24	www.945pk.com
23.234.20.24	8uc.haosf33.com
23.234.20.24	www.91ww.com
23.234.20.24	www.8uu.com
23.234.20.24	81f.hao883.com
23.234.20.24	81f.hao979.com
23.234.20.24	81f.hao899.com
23.234.20.24	www.81f.com
23.234.20.24	www.nihao119.com
23.234.20.24	www.66sf.com
23.234.20.24	kkkfu.sylytz.com
23.234.20.24	83aa.sf078.com
23.234.20.24	521fu.9173uc.com
23.234.20.24	www.777uc.com
23.234.20.24	www.pk777.com
23.234.20.24	www.30ok-1.com
23.234.20.24	www.haocq.com
23.234.20.24	www.1000ok.com
23.234.20.24	wvw.rq23.com
23.234.20.24	wvw.2013wan.com
23.234.20.24	wvw.9377z.com
23.234.20.24	mmm.wopaijs.com
23.234.20.24	www.yyy279.com
23.234.20.24	wvw.9377s.com
23.234.20.24	www.zhujiutx.com
23.234.20.24	www.hbwxkj.com
23.234.20.24	www.sh-chengshan.com
23.234.20.24	zhaosfcq.com
23.234.20.24	www.subpig.net
23.234.20.24	www.jlzcfx.com
23.234.20.24	www.66sf.com
23.234.20.24	www.cdxxlh.com
23.234.20.24	www.83uc.com
23.234.20.24	www.shjwd.com
23.234.20.24	www.jingming-sh.com
23.234.20.24	www.aerosun.cn
23.234.20.24	www.qdhd.com.cn
23.234.20.24	www.flyxg.com
23.234.20.24	www.zggljt.com
23.234.20.24	www.99mc.com
23.234.20.24	www.138zg.com
23.234.20.24	www.523zg.com
23.234.20.24	www.98zg.com
23.234.20.24	www.78zg.cn
23.234.20.24	www.99ting.cn
23.234.20.24	www.27zg.com
23.234.20.24	www.92sanduo.com
23.234.20.24	www.527zg.com
23.234.20.24	www.xstylxx.com
23.234.20.24	www.xrsd-water.com
23.234.20.24	www.tttjsq.com
23.234.20.24	www.y1995.com
23.234.20.24	www.883sf.com
23.234.20.24	sf123.com
23.234.20.24	changjing.759rsq.com
23.234.20.24	xinqing.kqgf69.com
23.234.20.24	www.xahdc.com
23.234.20.24	www.haotl.com
23.234.20.24	www.chinajin-hui.com
23.234.20.24	www.fullkang.net.com
23.234.20.24	tanxian.u895.com
23.234.20.24	www.m526.com
23.234.20.24	www.majorsoul.com
23.234.20.24	changjing.pbbxy.com
23.234.20.24	sf225.com
23.234.20.24	www.haosf.com
23.234.20.24	www.tcrhy.com
23.234.20.24	www.001gm.net
23.234.20.24	cqdl321.com
23.234.20.24	www.b9jojo.com
23.234.20.24	www.9kf.com
23.234.20.24	www.sf138.com
23.234.20.24	www.628118.com
23.234.20.24	www.hezol.com
23.234.20.24	www.qjkutrgw.com
23.234.20.24	www.ashijia.com
23.234.20.24	www.1200sf.com
23.234.20.24	www.aarongj.com
23.234.20.24	www.53my.com
23.234.20.24	www.888cnc.com
23.234.20.24	www.sf3000.com
23.234.20.24	www.29u.in
23.234.20.24	www.96sf.com
23.234.20.24	www.3159wine.com
23.234.20.24	www.sf800.com
23.234.20.24	www.77mxd.com
23.234.20.24	www.9uzg.com
23.234.20.24	www.sf999.com.ru
23.234.20.24	www.szmajsy.com
23.234.20.24	www.jptea.cn
23.234.20.24	www.cqpk11.com
23.234.20.24	www.insdfjisd.com
23.234.20.24	www.828kk.com
23.234.20.24	www.irrchina.com
23.234.20.24	www.22nf.com
23.234.20.24	www.jiutianzs.com
23.234.20.24	www.103la.com
23.234.20.24	www.889ok.com
23.234.20.24	huanshou.8236r.com
23.234.20.24	www.1129f.com
23.234.20.24	345ye.861sf.com
23.234.20.24	www.861sf.com
23.234.20.24	861sf.com
23.234.20.24	www.sf985.com
23.234.20.24	www.bonopt.com
23.234.20.24	cq45.cn
23.234.20.24	www.cq45.cn
23.234.20.24	www.bgdtw.com
23.234.20.24	www.930t.com
23.234.20.24	www.tianhuao.com
23.234.20.24	www.99a.net.ru
23.234.20.24	www.hmyigou.com
23.234.20.24	www.fzjx.net
23.234.20.24	www.ez-max.net
23.234.20.24	www.zhuoranfm.com
23.234.20.24	www.ccadly.net
23.234.20.24	www.chinasysw.com
23.234.20.24	www.dyjkdd.com
23.234.20.24	www.cnbaoerte.com
23.234.20.24	www.sf895.com
23.234.20.24	www.joywei.com
23.234.20.24	www.yalincs.com
23.234.20.24	www.kkstar.com
23.234.20.24	www.949g.com
23.234.20.24	www.zhaosf.com.co
23.234.20.24	www.3000ok.com.cn
23.234.20.24	n813.com
23.234.20.24	uc88.com
23.234.20.24	qu45.com
23.234.20.24	www.aop9988.com
23.234.20.24	www.sdytgj.com
23.234.20.24	www.gzgien.com
23.234.20.24	www.chuanqige.com
23.234.20.24	51my8.com
23.234.20.24	www.99j.com.es
23.234.20.24	www.sf452.com
23.234.20.24	www.981sf.com
23.234.20.24	www.sf382.com
23.234.20.24	www.hldly.com
23.234.20.24	www.sf062.com
23.234.20.24	www.8345sf.com
23.234.20.24	www.sdfwesq.com
23.234.20.24	www.sjxt123.com
23.234.20.24	www.daqiandoor.com
23.234.20.24	www.125sf.com
23.234.20.24	www.xieqiyy.com
23.234.20.24	www.ldyeya.com
23.234.20.24	www.088sf.net
23.234.20.24	83so.com
23.234.20.24	www.sf421.com
23.234.20.24	www.4f920.com
23.234.20.24	www.tiaolou8.com
23.234.20.24	www.taocooler.com
23.234.20.24	www.wanpp.com
23.234.20.24	www.fhzsm.com
23.234.20.24	www.pt12319.com
23.234.20.24	www.hx-lace.com
23.234.20.24	www.jiagao.net
23.234.20.24	76776.com
23.234.20.24	www.htwjcy.com
23.234.20.24	www.win757.com
23.234.20.24	www.hnjxzz.cn
23.234.20.24	www.xmdvip.com
23.234.20.24	swqzp.com
23.234.20.24	www.tungsten-moly.com
23.234.20.24	jingyan.986jj.com
23.234.20.24	www.xxf888.com
23.234.20.24	www.cnrsyy.com
23.234.20.24	www.txingzuo.com
23.234.20.24	www.ykmir.com
23.234.20.24	www.xjxianping.cn
23.234.20.24	www.web01.cn
23.234.20.24	www.yijiaedu.cn
23.234.20.24	dushisuanlafen.cn
23.234.20.24	www.zzyichen.com
23.234.20.24	www.cnnoblelight.com
23.234.20.24	klkemu.net
23.234.20.24	www.faith-forever.com
23.234.20.24	www.bopuai.cn
23.234.20.24	www.xzchuitou.cn
23.234.20.24	www.ccxbzk.cn
23.234.20.24	www.915788.com
23.234.20.24	www.sdxtcnc.com
23.234.20.24	www.sz-stv.com
23.234.20.24	www.fjoss.com
23.234.20.24	www.204sf.com
23.234.20.24	www.tech-sss.com
23.234.20.24	www.mywowpl.com
23.234.20.24	www.shi-yi.net
23.234.20.24	www.hzlyfashion.com
23.234.20.24	www.freeshu.com
23.234.20.24	www.chinatianmei.com
23.234.20.24	00pk.com
23.234.20.24	www.tqb88.com
23.234.20.24	4593.9kf.com
23.234.20.24	www.120yi.com
23.234.20.24	www.hdmchina.com
23.234.20.24	www.zzfuxi.com
23.234.20.24	www.sdicl.com
23.234.20.24	www.ebontec.com
23.234.20.24	www.3000oksf.com
23.234.20.24	www.shqing8.com
23.234.20.24	www.666mir.com
23.234.20.24	www.adchy.com
23.234.20.24	www.pyprint.com
23.234.20.24	www.56chuanqi.com
23.234.20.24	www.simicc.com
23.234.20.24	www.a5zg.com
23.234.20.24	www.szhcgroup.com
23.234.20.24	www.57ssy.com
23.234.20.24	www.qingzhou8.com
23.234.20.24	tt292.com
23.234.20.24	www.jiatianneiyi.com
23.234.20.24	www.leeed.com
23.234.20.24	www.20020505.com
23.234.20.24	www.kl-chem.com
23.234.20.24	www.tjzssd.com
23.234.20.24	www.nnhxjh.com
23.234.20.24	www.dwmir.com
23.234.20.24	www.kk519.com
23.234.20.24	www.chinanewhope.net
23.234.20.24	www.yalimei-group.com
23.234.20.24	www.jiulongbelt.com
23.234.20.24	www.dushisuanlafen.cn
23.234.20.24	www.cn0796.com
23.234.20.24	www.hnfengyuan.com
23.234.20.24	www.yixinghai.com
23.234.20.24	www.zgtjsteel.com
23.234.20.24	www.51disky.com
23.234.20.24	www.zhybbs.com
23.234.20.24	www.91kaixue.com
23.234.20.24	www.fyplay.com
23.234.20.24	www.wowidc.com
23.234.20.24	www.jiahongtex.com
23.234.20.24	www.diselife.com
23.234.20.24	www.yygdz.com
23.234.20.24	www.kexingco.com
23.234.20.24	www.88fb.com
23.234.20.24	www.botaofan.com
23.234.20.24	www.zzhdjx.cn
23.234.20.24	www.cntuliao.com
23.234.20.24	www.m5y6.cn
23.234.20.24	www.songzhilu.com
23.234.20.24	zhaopeng.net
23.234.20.24	www.xiayunfei.com
23.234.20.24	soyoesd.cn
23.234.20.24	www.523zg.com
23.234.20.24	regongjixie.com
23.234.20.24	www.mir87.com
23.234.20.24	chinachengyang.cn
23.234.20.24	www.dgguanglin.com
23.234.20.24	www.huayuebz.com
23.234.20.24	www.xxsw028.com
23.234.20.24	www.myppchina.com
23.234.20.24	www.gzsuper.com
23.234.20.24	www.txhtc.com
23.234.20.24	www.cdcx1956.com
23.234.20.24	www.yaliwood.com
23.234.20.24	www.flower024.com
23.234.20.24	www.5ttb.com
23.234.20.24	www.i193.com
23.234.20.24	www.shweiheng.com
23.234.20.24	www.65wt.com
23.234.20.24	u17766.com
23.234.20.24	www.600sf.com
23.234.20.24	www.baodaobike.com
23.234.20.24	www.56fabu.com
23.234.20.24	www.pt12319.com
23.234.20.24	pk.sydahe.com
23.234.20.24	cnpeishi.cn
23.234.20.24	www.2-55.com
23.234.20.24	www.cdfufu.com
23.234.20.24	www.bzydzs.com
23.234.20.24	www.dhl.gov.cn
23.234.20.24	www.81cq.com
23.234.20.24	www.sxfyxyq.com
23.234.20.24	111wt.com
23.234.20.24	81sf.com
23.234.20.24	44dy.com
23.234.20.24	30wy.com
23.234.20.24	999wg.net
23.234.20.24	915m.com
23.234.20.24	66kf.net
23.234.20.24	www.qs930.com
23.234.20.24	www.shutu.cc
23.234.20.24	sf666.75gm.com
23.234.20.24	www.kkksf.com
23.234.20.24	www.zhao3f.com
23.234.20.24	6cq.cc
23.234.20.24	u7u73.com
23.234.20.24	sf923.com
23.234.20.24	oryin.com
23.234.20.24	gm777.com
23.234.20.24	gm333.com
23.234.20.24	cseht.com
23.234.20.24	520f.com
23.234.20.24	258x.com
23.234.20.24	57ww.com
23.234.20.24	57591.com
23.234.20.24	33sf.com
23.234.20.24	sf509.com
23.234.20.24	803cq.com
23.234.20.24	25930.com
23.234.20.24	812315.com
23.234.20.24	11cq.cn
23.234.20.24	94ww.com
23.234.20.24	777wt.com
23.234.20.24	www.99mc.com
23.234.20.24	980cq.com
23.234.20.24	hdhjgs.com
23.234.20.24	51zzsf.com
23.234.20.24	0574k.com
23.234.20.24	wjlon.cn
23.234.20.24	d518.com
23.234.20.24	sf29.com
23.234.20.24	222sf.com
23.234.20.24	23qianbao.com
23.234.20.24	195ca.com
23.234.20.24	118967.com
23.234.20.24	10000ok.com
23.234.20.24	72cq.com
23.234.20.24	5zaoxie.com
23.234.20.24	555beian.com
23.234.20.24	55hj.com
23.234.20.24	45758.com
23.234.20.24	41345.com
23.234.20.24	258sf.com
23.234.20.24	9000sf.com
23.234.20.24	87sf.com
23.234.20.24	89946.com
23.234.20.24	88f.com
23.234.20.24	86rs.com
23.234.20.24	77yu.com
23.234.20.24	81592.com
23.234.20.24	74981.com
23.234.20.24	818wy.com
23.234.20.24	9826w.com
23.234.20.24	www.myidc.cc
23.234.20.24	www.whygjt.com
23.234.20.24	www.nd-zk.com
23.234.20.24	haosf.com.cn
23.234.20.24	www.sf3000ok.com
23.234.20.24	www.145930.com
23.234.20.24	www.80ww.com
23.234.20.24	www.258x.com
23.234.20.24	www.sf509.com
23.234.20.24	www.tjklm.com
23.234.20.24	17sz.net
23.234.20.24	www.81sf.com
23.234.20.24	www.0663yh.com
23.234.20.24	whygjt.com
23.234.20.24	www.cc816.com
23.234.20.24	www.bohaomj.com
23.234.20.24	www.blbfg.com
23.234.20.24	jndd.com.cn
23.234.20.24	www.ba45.com
23.234.20.24	www.bjwztc.com
23.234.20.24	www.bangbangtuan.com
23.234.20.24	1.wzca.com.cn
23.234.20.24	www.51yygw.com
23.234.20.24	www.912kf.com
23.234.20.24	www.eduqc.com
23.234.20.24	www.ebssfp.com
23.234.20.24	www.dingfengtop.com
23.234.20.24	www.dc-superglue.com
23.234.20.24	www.daweilp.com
23.234.20.24	www.czacyq.com
23.234.20.24	www.cqxiexin.com
23.234.20.24	www.cltqgs.com
23.234.20.24	www.cnaxchem.com
23.234.20.24	www.chengdajc.com
23.234.20.24	www.cdztnt.com
23.234.20.24	www.chinawoollen.com
23.234.20.24	www.chinaenyu.com
23.234.20.24	www.ihc360.com
23.234.20.24	www.hrener.com
23.234.20.24	www.howelltoy.com
23.234.20.24	www.fzqmw.com
23.234.20.24	www.hongweimotor.com
23.234.20.24	www.gardenhn.com
23.234.20.24	www.fzghj.com
23.234.20.24	www.fhouse360.com
23.234.20.24	www.fdzyy.com
23.234.20.24	www.fujunsh.com
23.234.20.24	www.funkan.com
23.234.20.24	www.pxfangbao.com
23.234.20.24	www.pk138.com
23.234.20.24	www.oursuzuki.com
23.234.20.24	www.movfox.com
23.234.20.24	www.nbyongxiang.com
23.234.20.24	www.maoshanchem.com
23.234.20.24	www.longyundianli.com
23.234.20.24	www.linxiatravel.com
23.234.20.24	www.jhrace.com
23.234.20.24	www.jxytoys.com
23.234.20.24	www.kpaofeite.com
23.234.20.24	www.jiang456.com
23.234.20.24	www.szgargen.com
23.234.20.24	www.szelcc.com
23.234.20.24	www.sun-sand-sea.com
23.234.20.24	www.shzhuwang.com
23.234.20.24	www.ssbrakepad.com
23.234.20.24	www.shxianghao.com
23.234.20.24	www.shchenggang.com
23.234.20.24	www.quhi-tech.com
23.234.20.24	www.sh16pu.com
23.234.20.24	www.reach-way.com
23.234.20.24	www.sddzauto.com
23.234.20.24	www.yhszy.com
23.234.20.24	www.xinfengjixie.com
23.234.20.24	www.xiduanpress.com
23.234.20.24	www.xuyetrade.com
23.234.20.24	www.xaxhny.com
23.234.20.24	www.wzxiyin.com
23.234.20.24	www.wxlujia.com
23.234.20.24	www.usnaike.com
23.234.20.24	www.tyhzh.com
23.234.20.24	www.szhmxled.com
23.234.20.24	yaosf.net
23.234.20.24	www.zjyingguan.com
23.234.20.24	www.zzwzgn.com
23.234.20.24	www.zjtsmj.com
23.234.20.24	www.zjgujia.com
23.234.20.24	www.30fu.com
23.234.20.24	www.zgshunxing.com
23.234.20.24	www.zhcrane.com
23.234.20.24	www.zhao5f.com
23.234.20.24	www.ytjiangyou.com
23.234.20.24	www.yinghongjixie.com
23.234.20.24	www.zwyt.net
23.234.20.24	zzhdjx.cn
23.234.20.24	www.szmhk.com
23.234.20.24	www.ccggge.com
23.234.20.24	www.0007590.com
23.234.20.24	941qq.com
23.234.20.24	www4.29u.com
23.234.20.24	www.nlcoad.com
23.234.20.24	26ss.com
23.234.20.24	zhaohaosf.net
23.234.20.24	www.eanfang.com
23.234.20.24	www.ntwmyy.com
23.234.20.24	eanfang.com
23.234.20.24	www.88pknb.com
23.234.20.24	www.hh8gg.pw
23.234.20.24	www.hycygy.com
23.234.20.24	114code.com
23.234.20.24	www.legendpw.net
23.234.20.24	www.dgyuanyang.com
23.234.20.24	www.sf999.name
23.234.20.24	www.125kkk.com
23.234.20.24	go.sf999.com
23.234.20.24	wwww.017cq.com
23.234.20.24	cnc.sf999.com
23.234.20.24	www.xztd888.com
23.234.20.24	www.iyqxkcqw.com
23.234.20.24	www.fenfa1688.com
23.234.20.24	www.huahuiye.com
23.234.20.24	www.sdqinuo.com
23.234.20.24	www.njhxztz.com
23.234.20.24	www.qibone.com
23.234.20.24	www.aimkm.com
23.234.20.24	www.195eeweqsc.com
23.234.20.24	www.007sf.com
23.234.20.24	www.512qz.com
23.234.20.24	www.jxdpx.com
23.234.20.24	www.haosf.org
23.234.20.24	www.17123.com
23.234.20.24	999sf.com
23.234.20.24	www.7000hj.com
23.234.20.24	67pp.com
23.234.20.24	56chuanqi.com
23.234.20.24	www.k8765.com
23.234.20.24	www.haosf9999.com
23.234.20.24	www.fw000.com
23.234.20.24	www.gm333.com
23.234.20.24	www.anmeiexpo.com
23.234.20.24	www.999sf.com
23.234.20.24	www.95ok.com
23.234.20.24	sedio.cc
23.234.20.24	www.5d5y.com
23.234.20.24	www.gm777.com
23.234.20.24	zhaosf.88654.com
23.234.20.24	www.xifulei.com
23.234.20.24	www.sf903.com
23.234.20.24	www.syjm.net
23.234.20.24	www.sf7000.com
23.234.20.24	www.nbwanfeng.com
23.234.20.24	677g.com
23.234.20.24	sf63.com
23.234.20.24	www.91kang.com
23.234.20.24	cqniangzao.com
23.234.20.24	www.999ok.com
23.234.20.24	92gg.com
23.234.20.24	921ww.com
23.234.20.24	520sf.com
23.234.20.24	239ok.com
23.234.20.24	shdongqiao.com
23.234.20.24	sd-yuhui.com
23.234.20.24	meiri.vqkp35.com
23.234.20.24	moni.227y.com
23.234.20.24	gzonisi.cn
23.234.20.24	345cc.cn.com
23.234.20.24	chinayat.com
23.234.20.24	www.3f6f.com
23.234.20.24	www.258sf.com
23.234.20.24	www.13su.com
23.234.20.24	www.118967.com
23.234.20.24	www.sardar.cc
23.234.20.24	www.21sjzg.com
23.234.20.24	www.0769hongri.com
23.234.20.24	www.0574k.com
23.234.20.24	www.020rencai.net
23.234.20.24	uc99.com
23.234.20.24	www.001info.com
23.234.20.24	www.67pp.net
23.234.20.24	www.666666s.com
23.234.20.24	www.66kf.net
23.234.20.24	www.5zaoxie.com
23.234.20.24	www.55hj.com
23.234.20.24	www.520sf.com
23.234.20.24	www.51miehun.co
23.234.20.24	www.51huigo.com
23.234.20.24	www.45758.com
23.234.20.24	www.5199g.com
23.234.20.24	www.30wy.com
23.234.20.24	www.941qq.com
23.234.20.24	www.922gg.com
23.234.20.24	www.88f.com
23.234.20.24	www.88102888.com
23.234.20.24	www.921ww.com
23.234.20.24	www.89946.com
23.234.20.24	www.818wy.com
23.234.20.24	www.86rs.com
23.234.20.24	www.789sf.net
23.234.20.24	www.77yu.com
23.234.20.24	www.789is.com
23.234.20.24	www.6836999.com
23.234.20.24	www.boxianfengguan.com
23.234.20.24	www.allaboutprogram.com
23.234.20.24	www.avoio.com
23.234.20.24	www.autohid.com
23.234.20.24	www.aptx4869.net
23.234.20.24	www.art-verb.com
23.234.20.24	www.94haokan.com
23.234.20.24	www.dj149.com
23.234.20.24	www.dgdtw.com
23.234.20.24	www.digrj.com
23.234.20.24	www.dgzichi.com
23.234.20.24	www.cqsfcn.com
23.234.20.24	www.dfhero.com
23.234.20.24	www.dabanwu.com
23.234.20.24	www.chuanqisifu99.com
23.234.20.24	www.chinakelly.com
23.234.20.24	www.cfaninfo.com
23.234.20.24	www.cgxgf.com
23.234.20.24	www.byetee.com
23.234.20.24	www.idcdong.com
23.234.20.24	www.i-blinks.com
23.234.20.24	www.hnlangjie.com
23.234.20.24	www.hxfamily.com
23.234.20.24	www.hzruili.com
23.234.20.24	www.hnggfz.com
23.234.20.24	www.hzkjy.com
23.234.20.24	www.hlmodule.com
23.234.20.24	www.hbwyw.net
23.234.20.24	www.hbqdxjmf.com
23.234.20.24	www.gzxlzs.com
23.234.20.24	www.gzplay.com
23.234.20.24	www.gxxjl.com
23.234.20.24	www.guanhaiyujia.com
23.234.20.24	www.dqzypx.com
23.234.20.24	www.krksjx.com
23.234.20.24	www.lishi99.com
23.234.20.24	www.leiming-bulb.com
23.234.20.24	www.lanyue2003.com
23.234.20.24	www.laosf.com
23.234.20.24	www.jzfsk.com
23.234.20.24	www.knschina.com
23.234.20.24	www.jsxgm.com
23.234.20.24	www.jshhw.com
23.234.20.24	www.jka77.com
23.234.20.24	www.jn333.com
23.234.20.24	www.j8y.net
23.234.20.24	www.jieer.net
23.234.20.24	www.jietewq.com
23.234.20.24	www.i-dphoto.com
23.234.20.24	www.pgmary.com
23.234.20.24	www.pxfyzs.com
23.234.20.24	www.pai4f.com
23.234.20.24	www.njrybj.com
23.234.20.24	www.oshococo.com
23.234.20.24	www.nibou.net
23.234.20.24	www.newseaswan.com
23.234.20.24	www.myuheng.com
23.234.20.24	www.mzwq.info
23.234.20.24	www.lypfc.com
23.234.20.24	www.lzyinfeng.com
23.234.20.24	www.ly1000.com
23.234.20.24	www.lvislife.com
23.234.20.24	www.lx188.com
23.234.20.24	www.shundaglass.com
23.234.20.24	www.shyuanli.com
23.234.20.24	www.sh-liuxin.com
23.234.20.24	www.shi18.com
23.234.20.24	www.sf920.net
23.234.20.24	www.sea-reach.com
23.234.20.24	www.sertai.com
23.234.20.24	www.sf123-1.com
23.234.20.24	www.sf123.cc
23.234.20.24	www.saiyilong.com
23.234.20.24	www.scienthoer.com
23.234.20.24	www.ruichilida.com
23.234.20.24	www.qunhuan.net
23.234.20.24	www.qmxfw.com
23.234.20.24	www.qhsdkj.com
23.234.20.24	www.twdmly.com
23.234.20.24	www.szyangcai.com
23.234.20.24	www.tococi.com
23.234.20.24	www.tcbl88.com
23.234.20.24	www.sz-wells.com
23.234.20.24	www.szpangzhi.com
23.234.20.24	www.szjundaled.com
23.234.20.24	www.szcmon.com
23.234.20.24	www.szjlskj.com
23.234.20.24	www.szabj.com
23.234.20.24	www.syzwdj.com
23.234.20.24	www.syqtdz.com
23.234.20.24	www.sxhtdl.com
23.234.20.24	www.sougousf.com
23.234.20.24	www.zwnoon.com
23.234.20.24	www.zszhongzhi.com
23.234.20.24	www.z-sheng.com
23.234.20.24	www.zpmc-cz.com
23.234.20.24	www.zjtl.com
23.234.20.24	www.zjpages.com
23.234.20.24	www.zdhw-lighting.com
23.234.20.24	www.youxi119.com
23.234.20.24	www.ysmtc8.com
23.234.20.24	www.yongdingfm.com
23.234.20.24	www.yiqi163.com
23.234.20.24	www.yingxiangceliangyi.com
23.234.20.24	www.wjnmyy.com
23.234.20.24	www.wzcjyy.com
23.234.20.24	www.wudait.com
23.234.20.24	www.xhcsolar.com
23.234.20.24	www.kmnc.net
23.234.20.24	www2.8845sf.com
23.234.20.24	120sf.0755nk.net
23.234.20.24	www.muhon.com.cn
23.234.20.24	www1.8845sf.com
23.234.20.24	922gg.com
23.234.20.24	www.yts189.com
23.234.20.24	www.chakansdfj.com
23.234.20.24	www.steelrq.com
23.234.20.24	yindao.jfsm79.com
23.234.20.24	www.zx0411.com
23.234.20.24	www.kt516.com
23.234.20.24	66sf.69ao.com
23.234.20.24	www.lt925.com
23.234.20.24	www.45wj.com
23.234.20.24	www.tt371.com
23.234.20.24	www.goule88.com
23.234.20.24	www.ranwen.cm
23.234.20.24	www.verosale.com
23.234.20.24	grambox.com
23.234.20.24	down.16kbook.com
23.234.20.24	www.grambox.com
23.234.20.24	cq.51zzsf.com
23.234.20.24	www.ka688.com
23.234.20.24	www.hj010.com
23.234.20.24	www.64sf.com
23.234.20.24	www.921pk.com
23.234.20.24	kt516.com
23.234.20.24	www.gc771.com
23.234.20.24	www.su315.com
23.234.20.24	www.jindepower.com
23.234.20.24	88uc.sf19.cn
23.234.20.24	www.hrm123.net
23.234.20.24	www.bjyjy.com
23.234.20.24	www.uc99.com
23.234.20.24	wvw.9kf.com
23.234.20.24	97sf.com
23.234.20.24	www.70uc.com
23.234.20.24	www.zhaoqiqi.com
23.234.20.24	www.hnrbysc.com
23.234.20.24	www.69ao.com
23.234.20.24	32feef.11cq.cn
23.234.20.24	176.01kp.com
23.234.20.24	www.kuj8.com
23.234.20.24	81f.27-88.com
23.234.20.24	www.917se.com
23.234.20.24	www.fabumir.com
23.234.20.24	www.uc007.com
23.234.20.24	www.sf999.com.de
23.234.20.24	www.zhaosf.co
23.234.20.24	haosf12345.gm127.com
23.234.20.24	zhaosf.co
23.234.20.24	66sf.com
23.234.20.24	www.chuanqisf.com
23.234.20.24	zhuzaigua.com
23.234.20.24	www.1pk.com
23.234.20.24	28uc.com
23.234.20.24	chenmo.cc
23.234.20.24	www.sf22.com
23.234.20.24	www.sf405.com
23.234.20.24	www.cz45.com
23.234.20.24	115cq.com
23.234.20.24	www.803cq.com
23.234.20.24	www.25930.com
23.234.20.24	123f.com
23.234.20.24	hongxuda.com
23.234.20.24	haocqsf.com
23.234.20.24	www.100rcw.com
23.234.20.24	www.10000ok.com
23.234.20.24	www.05uc.com
23.234.20.24	www.23qianbao.com
23.234.20.24	www.222sf.com
23.234.20.24	www.72cq.com
23.234.20.24	www.ahmcks.com
23.234.20.24	www.90zzs.com
23.234.20.24	www.csqnw.com
23.234.20.24	www.dlz888.com
23.234.20.24	www.jx789.com
23.234.20.24	www.jsywg.com
23.234.20.24	www.tccyg.com
23.234.20.24	www.wcfm103.com
23.234.20.24	www.wjdhfz.com
23.234.20.24	www.zzz7.net
23.234.20.24	www.m3088tv.com
23.234.20.24	www.cxhdl.com
23.234.20.24	www.szbiaoyu.com
23.234.20.24	www.gzpioneer.com
23.234.20.24	www.mi-sc.com
23.234.20.24	www.hosisoft.com
23.234.20.24	www.huakangpc.com
23.234.20.24	www.zjkylsk.com
23.234.20.24	www.casscno.com
23.234.20.24	www.0808sf.com
23.234.20.24	www.jinhuachang.com
23.234.20.24	www.dongya888.com
23.234.20.24	www.fhxzd.com
23.234.20.24	www.sgwjg.com
23.234.20.24	www.pntfrc.com
23.234.20.24	www.sf9.cn
23.234.20.24	www.lxsqrfms.com
23.234.20.24	www.ygpkndz.com
23.234.20.24	www.jrxktdy.com
23.234.20.24	www.1007movie.net
23.234.20.24	30.9youwang.com
23.234.20.24	51huigo.com
23.234.20.24	51sf.com
23.234.20.24	520cq.com
23.234.20.24	520cq.net
23.234.20.24	765wg.com
23.234.20.24	789is.com
23.234.20.24	www.23vo.com
23.234.20.24	8aa.com
23.234.20.24	91545.com
23.234.20.24	941lt.com
23.234.20.24	99245.com
23.234.20.24	95sf.com
23.234.20.24	99ting.cn
23.234.20.24	99ting.com
23.234.20.24	aaa.xz667.com
23.234.20.24	ac198.com
23.234.20.24	aa.606wz.com
23.234.20.24	bbs.1x.la
23.234.20.24	dbconsys.com
23.234.20.24	gaosf.com
23.234.20.24	gg.herom2.net
23.234.20.24	hao-sf-123.com
23.234.20.24	haosf.org
23.234.20.24	hao119.com
23.234.20.24	laosf.com
23.234.20.24	search.sf999.com
23.234.20.24	sf3000.com
23.234.20.24	sf86.com
23.234.20.24	sf99.com
23.234.20.24	sf999.net
23.234.20.24	sfsf.d518.com
23.234.20.24	shenqi.com
23.234.20.24	www.fzrhcopper.com
23.234.20.24	www.008fy.com
23.234.20.24	www.022hs.com
23.234.20.24	www.123qf.com
23.234.20.24	www.13xp.com
23.234.20.24	www.163fb.com
23.234.20.24	www.450sf.com
23.234.20.24	23vo.com
23.234.20.24	www.1x.la
23.234.20.24	www.23bb.net
23.234.20.24	www.28uc.com
23.234.20.24	www.33sf.com
23.234.20.24	450sf.com
23.234.20.24	www.55ip.com
23.234.20.24	www.58751.com
23.234.20.24	www.6090sf.com
23.234.20.24	www.67pp.com
23.234.20.24	www.77145.com
23.234.20.24	www.707wz.com
23.234.20.24	www.7pv.net
23.234.20.24	www.78x8.com
23.234.20.24	www.810f.com
23.234.20.24	www.8u8uu.com
23.234.20.24	www.915m.com
23.234.20.24	www.941cq.com
23.234.20.24	www.96cs.com
23.234.20.24	www.92gg.com
23.234.20.24	www.99245.com
23.234.20.24	www.sfniu.com
23.234.20.24	www.sihai-musical.com
23.234.20.24	www.cq588.com
23.234.20.24	91084.com
23.234.20.24	www.dobgame.com
23.234.20.24	www.fireol.com
23.234.20.24	www.fei24.com
23.234.20.24	www.game-114.com
23.234.20.24	www.gaosf.com
23.234.20.24	www.gmhaosf.com
23.234.20.24	www.hao3a.com
23.234.20.24	www.haosf.bz
23.234.20.24	www.htdqsec.com
23.234.20.24	www.hzhswj.com
23.234.20.24	www.pk920.com
23.234.20.24	www.liwoma.com
23.234.20.24	7000uc.com
23.234.20.24	www.nwpbl.com
23.234.20.24	www.ok3000.com
23.234.20.24	www.23c.com
23.234.20.24	www.pk555.com
23.234.20.24	www.pk920.com
23.234.20.24	www.rbtvs.com
23.234.20.24	www.91084.com
23.234.20.24	www.sdzblj.com
23.234.20.24	www.sf121.com
23.234.20.24	www.sebxa.com
23.234.20.24	www.sf3000.com
23.234.20.24	www.sf86.com
23.234.20.24	www.sf999.net
23.234.20.24	www.shuo321.com
23.234.20.24	www.shuiguanyin.com
23.234.20.24	www.sxzkzx.com
23.234.20.24	www.uc88.com
23.234.20.24	www.weihuangsz.com
23.234.20.24	www.weizhixs.com
23.234.20.24	www.wodewww.com
23.234.20.24	www.wsf520.com
23.234.20.24	23c.com
23.234.20.24	www.xcwsg.com
23.234.20.24	www.xjlgc.com
23.234.20.24	www.zhuzaicq.com
23.234.20.24	www1.uc88.com
23.234.20.24	www2.520cq.com
23.234.20.24	www5.29u.com
23.234.20.24	www4.520cq.com
23.234.20.24	www5.520cq.com
23.234.20.24	3000ko.com
23.234.20.24	www.sdjnxy.com
23.234.20.24	sf999.com
23.234.20.24	www.51okf.com
23.234.20.24	www.iiwoool.com
23.234.20.24	www.rxshige.com
23.234.20.24	www.dghke.com
23.234.20.24	www.7kkb.net
23.234.20.24	www.789518.com
23.234.20.24	www.cqfff.com
23.234.20.24	www4.beer51.com
23.234.20.24	www.cseht.com
23.234.20.24	www.82926.com
23.234.20.24	8uc.558uc.com
23.234.20.24	www.99cangzhou.com
23.234.20.24	www.pjzbw.com
23.234.20.24	www.52375.com
23.234.20.24	www.xdhmotor.com
23.234.20.24	www.shmeigu168.com
23.234.20.24	www.comvod.com
23.234.20.24	www.gz-sc.com
23.234.20.24	www.stylepacking.com
23.234.20.24	www.hnfdczj.com
23.234.20.24	www.wfxycc.com
23.234.20.24	www.26ss.com
23.234.20.24	www.hezhihui.com
23.234.20.24	www.wuxihuaxia.com
23.234.20.24	www.nblongyi.com
23.234.20.24	www.7zcq.com
23.234.20.24	7ugg.com
23.234.20.24	www.dliuren.com
23.234.20.24	www.wmult.com
23.234.20.24	www.3159wine.com
23.234.20.24	www.sf5137.com
23.234.20.24	www.cxxcqp.com
23.234.20.24	www.qz92.com
23.234.20.24	www.stronger-filter.com
23.234.20.24	www1.65cf.com
23.234.20.24	i8pk.com
23.234.20.24	www.trnly.com
23.234.20.24	www.zhaokj.com
23.234.20.24	www.yaojuezhan.com
23.234.20.24	www.tt2sf.com
23.234.20.24	www.qupaike.com
23.234.20.24	www.luowenqi.com
23.234.20.24	qqfcwgw.com
23.234.20.24	www.taosf.com.ru
23.234.20.24	www.zj-xd.com
23.234.20.24	www.mgszyc.com
23.234.20.24	9pk.dgjt.net
23.234.20.24	www.2umm.com
23.234.20.24	www.yxyhx.com
23.234.20.24	zhaokf.com
23.234.20.24	www.sf010.com
23.234.20.24	www.sfdawang.com
23.234.20.24	www.17fg.com
23.234.20.24	abc.top258.cn
23.234.20.24	www.gm7.cc
23.234.20.24	9kf.rzsport.com
23.234.20.24	ss.sg368.com
23.234.20.24	www.yy-bags.com
23.234.20.24	video.shunlo.com
23.234.20.24	www.45yes.com
23.234.20.24	www.cnyongli.com
23.234.20.24	www.sf03.com
23.234.20.24	www.88kf.net
23.234.20.24	www.88kf.com
23.234.20.24	www.sf168.com
23.234.20.24	555sf.com
23.234.20.24	www.ourbep.com
23.234.20.24	www.manmank.com
23.234.20.24	sebxa.com
23.234.20.24	hchxh.com
23.234.20.24	z34.sf19.cn
23.234.20.24	www.mobilefad.com
23.234.20.24	www.sf22-2.com
23.234.20.24	www.tlsfwz.com
23.234.20.24	www.westmm.com
23.234.20.24	7080st.com
23.234.20.24	www.sf322.com
23.234.20.24	www.zyjms.com
23.234.20.24	yy.7080st.com
23.234.20.24	jcniao.com
23.234.20.24	letanju.com
23.234.20.24	soso.8kst.com
23.234.20.24	www.taleclub.com
23.234.20.24	008cqsf.com
23.234.20.24	112sf.com
23.234.20.24	114.75sf.cn
23.234.20.24	123sf.com
23.234.20.24	138bt.com
23.234.20.24	138sf.com
23.234.20.24	139.limulu.com
23.234.20.24	163.fuatw.com
23.234.20.24	168.w198.net
23.234.20.24	168.zh-db.com
23.234.20.24	178bifen.com
23.234.20.24	17fg.com
23.234.20.24	23c.com
23.234.20.24	23ok.com
23.234.20.24	28yes.com
23.234.20.24	29u.com
23.234.20.24	500sf.com
23.234.20.24	513ux.com
23.234.20.24	515.zh-db.com
23.234.20.24	51xunt.com
23.234.20.24	520.szgumi.com
23.234.20.24	52345.com
23.234.20.24	523sf.com
23.234.20.24	523u.com
23.234.20.24	55z5.com
23.234.20.24	666sf.com
23.234.20.24	66cq.com
23.234.20.24	73sf.com
23.234.20.24	777gm.com
23.234.20.24	7uc.com
23.234.20.24	81f.com
23.234.20.24	81fu.com
23.234.20.24	8845.com
23.234.20.24	88858.com
23.234.20.24	www.qizhu.cc
23.234.20.24	www.as9z.com
23.234.20.24	8uu.com
23.234.20.24	91ww.com
23.234.20.24	92045.com
23.234.20.24	920sf.com
23.234.20.24	926.com
23.234.20.24	92fu.com
23.234.20.24	999hj.com
23.234.20.24	99j.com
23.234.20.24	9kf.com
23.234.20.24	9pk.k197.com
23.234.20.24	9pk.u7u73.com
23.234.20.24	ad.97uu.com
23.234.20.24	haocq.com
23.234.20.24	pk123.com
23.234.20.24	plinm.com
23.234.20.24	qiqi530.com
23.234.20.24	qq.007uc.com
23.234.20.24	sf138.com
23.234.20.24	sf168.com
23.234.20.24	sf176.com
23.234.20.24	sf215.com
23.234.20.24	sf222.com
23.234.20.24	sf30.com
23.234.20.24	sf777.com
23.234.20.24	www.xhnano.com
23.234.20.24	sogou.1000ok.com
23.234.20.24	ww.1388fu.com
23.234.20.24	www.005sf.com
23.234.20.24	www.008n.com
23.234.20.24	www.015999.com
23.234.20.24	www.023cz.com
23.234.20.24	www.023toilet.com
23.234.20.24	www.027fruit.com
23.234.20.24	www.0313hybj.com
23.234.20.24	www.0532oa.com
23.234.20.24	www.055735.com
23.234.20.24	www.07186.com
23.234.20.24	www.1000gsf.com
23.234.20.24	www.112sf.com
23.234.20.24	www.114haosf.com
23.234.20.24	www.115cq.com
23.234.20.24	www.11811445.com
23.234.20.24	www.11cq.cn
23.234.20.24	www.120sf.com
23.234.20.24	www.123cq.com
23.234.20.24	www.123f.com
23.234.20.24	www.123hj.com
23.234.20.24	www.123sf.com
23.234.20.24	www.123uu.com
23.234.20.24	www.130136.com
23.234.20.24	www.134sf.com
23.234.20.24	www.138bt.com
23.234.20.24	www.145sf.com
23.234.20.24	www.15ss.com
23.234.20.24	www.16753.com
23.234.20.24	www.17fabu8.com
23.234.20.24	www.215pk.com
23.234.20.24	www.22j.com
23.234.20.24	www.234sfww.com
23.234.20.24	www.23c.com
23.234.20.24	www.23fu.com
23.234.20.24	www.23ok.com
23.234.20.24	www.23sfu.cn
23.234.20.24	www.27sf.com
23.234.20.24	www.28yes.com
23.234.20.24	www.29u.com
23.234.20.24	www.3000ok.cc
23.234.20.24	www.3000pk.com
23.234.20.24	www.31cqsf.com
23.234.20.24	www.31i.cn
23.234.20.24	300sf.com
23.234.20.24	www.3300sf.com
23.234.20.24	www.33345.com
23.234.20.24	www.333ok.com
23.234.20.24	www.33pk.com
23.234.20.24	www.33wt.com
23.234.20.24	www.361cq.com
23.234.20.24	www.365taoba.com
23.234.20.24	www.371cyw.com
23.234.20.24	www.37ok.com
23.234.20.24	www.3dmeibang.com
23.234.20.24	www.3qsf.com
23.234.20.24	www.418sf.in
23.234.20.24	www.425sf.com
23.234.20.24	www.44dy.com
23.234.20.24	www.45195.com
23.234.20.24	www.34ok.com
23.234.20.24	www.8cq.cc
23.234.20.24	www.45bang.com
23.234.20.24	34ok.com
23.234.20.24	www.45hs.com
23.234.20.24	www.4nic-dy.com
23.234.20.24	www.500sf.com
23.234.20.24	www.51sf.com
23.234.20.24	www.52058.com
23.234.20.24	www.520cq.com
23.234.20.24	www.520jy.com
23.234.20.24	zhaosf.hsdbm.com
23.234.20.24	www.523sf.com
23.234.20.24	www.523u.com
23.234.20.24	www.531U.com
23.234.20.24	www.533ok.com
23.234.20.24	www.53sf.com
23.234.20.24	www.53uc.com
23.234.20.24	www.53w.com.cn
23.234.20.24	www.54ss.net
23.234.20.24	www.pk920.com
23.234.20.24	www.55z5.com
23.234.20.24	www.565sf.com
23.234.20.24	www.56ss.com
23.234.20.24	cdchuanghui.com
23.234.20.24	www.57591.com
23.234.20.24	www.57f.com
23.234.20.24	www.57fg.com
23.234.20.24	www.57ww.com
23.234.20.24	www.5800sf.com
23.234.20.24	www.58sf.com
23.234.20.24	www.58uc.com
23.234.20.24	www.5index.net
23.234.20.24	www.5qu.com
23.234.20.24	www.64pk.com
23.234.20.24	www.6645.com
23.234.20.24	www.666sf.com
23.234.20.24	www.676711.com
23.234.20.24	www.677g.com
23.234.20.24	www.67m2.com
23.234.20.24	www.686f.com
23.234.20.24	www.697sf.com
23.234.20.24	www.6cq.cc
23.234.20.24	www.73sf.com
23.234.20.24	www.75sf.cn
23.234.20.24	www.777gm.com
23.234.20.24	www.77d8.com
23.234.20.24	www.77kl.com
23.234.20.24	www.79j.com
23.234.20.24	www.7j773.com
23.234.20.24	www.7uc.com
23.234.20.24	www.80845.com
23.234.20.24	www.812315.com
23.234.20.24	www.81267.com
23.234.20.24	www.81fu.com
23.234.20.24	www.823f.com
23.234.20.24	www.82506.com
23.234.20.24	www.860572.com
23.234.20.24	www.860580.com
23.234.20.24	www.87sf.com
23.234.20.24	www.8845.com
23.234.20.24	www.88845.com
23.234.20.24	www.88858.com
23.234.20.24	www.89176.com
23.234.20.24	www.8aa.com
23.234.20.24	www.8uc.com
23.234.20.24	www.900hj.com
23.234.20.24	www.909f.com
23.234.20.24	www.9100sf.com
23.234.20.24	www.915301.com
23.234.20.24	www.91545.com
23.234.20.24	www.91ff.com
23.234.20.24	www.91wuc.com
23.234.20.24	www.920666.com
23.234.20.24	www.920gg.com
23.234.20.24	www.920sf.com
23.234.20.24	www.923u.com
23.234.20.24	www.92fu.com
23.234.20.24	www.92ww.com
23.234.20.24	www.93sf.com
23.234.20.24	www.94432.com
23.234.20.24	www.95sf.com
23.234.20.24	www.96645.com
23.234.20.24	www.9800sf.com
23.234.20.24	www.980cq.com
23.234.20.24	www.99964.com
23.234.20.24	www.999hj.com
23.234.20.24	www.999wg.net
23.234.20.24	www.99a.com
23.234.20.24	www.99ji.com
23.234.20.24	www.99pk.com
23.234.20.24	www.apbfhl.com
23.234.20.24	www.aifugu.com
23.234.20.24	www.33pk.com
23.234.20.24	33pk.com
23.234.20.24	www.bjhdshengda.com
23.234.20.24	www.bjtdyz.com
23.234.20.24	www.bsfzjx.com
23.234.20.24	www.bsrcsc.com
23.234.20.24	www.cnycta.com
23.234.20.24	www.cq45.com
23.234.20.24	www.cq91530.com
23.234.20.24	www.cqy6.com
23.234.20.24	www.csrxj.com
23.234.20.24	www.cy4f.com
23.234.20.24	www.fy371.com
23.234.20.24	www.gm888.com
23.234.20.24	www.gxxgy.com
23.234.20.24	www.gzxing.com
23.234.20.24	www.heli-cn.com
23.234.20.24	www.hnyuhai.com
23.234.20.24	www.hstztc.com
23.234.20.24	www.hwhaosf.com
23.234.20.24	www.7000uc.com
23.234.20.24	www.ksd777.com
23.234.20.24	www.laisf.com
23.234.20.24	www.laohaosf.com
23.234.20.24	www.lovewg.com
23.234.20.24	www.luckysz.com
23.234.20.24	www.mai101.com
23.234.20.24	www.mikating.com
23.234.20.24	www.mtv110.com
23.234.20.24	www.nj-row.com
23.234.20.24	www.nybxm.com
23.234.20.24	www.ocerlight.com
23.234.20.24	www.oksf.net
23.234.20.24	www.pk123.com
23.234.20.24	www.plinm.com
23.234.20.24	www.qiqi530.com
23.234.20.24	www.qzrt.com
23.234.20.24	www.recairen.com
23.234.20.24	www.rexuesf.in
23.234.20.24	www.sf0058.com
23.234.20.24	www.sf1003.com
23.234.20.24	www.sf17.com
23.234.20.24	www.sf176.com
23.234.20.24	www.sf215.com
23.234.20.24	www.sf222.com
23.234.20.24	www.sf231.com
23.234.20.24	www.sf29.com
23.234.20.24	www.sf30.com
23.234.20.24	www.sf520.com.cn
23.234.20.24	www.sf555.com
23.234.20.24	www.sf5858.com
23.234.20.24	www.sf63.com
23.234.20.24	www.sf777.com
23.234.20.24	www.sf8500.com
23.234.20.24	www.sf92045.com
23.234.20.24	www.sf930.com
23.234.20.24	www.sf99.com
23.234.20.24	www.shaibar.com
23.234.20.24	www.shamandi.com
23.234.20.24	www.ksjxyy.com
23.234.20.24	www.sktpcbic.com
23.234.20.24	www.stkj66.com
23.234.20.24	www.tj-aote.com
23.234.20.24	www.haosf999.com
23.234.20.24	www.wan45.com
23.234.20.24	www.whjdwxw.com
23.234.20.24	www.whlinuo.com
23.234.20.24	www.worldkcc.com
23.234.20.24	www.wtcqsf.com
23.234.20.24	www.xiaomeisf.com
23.234.20.24	www.xihaihotel.com
23.234.20.24	www.xindudu.com
23.234.20.24	www.xinganchem.com
23.234.20.24	www.ovytgnby.com
23.234.20.24	www.xinsf.com
23.234.20.24	www.yeschongcao.com
23.234.20.24	www.ynyeer.com
23.234.20.24	www.ysguandao.com
23.234.20.24	www.yxzhidao.com
23.234.20.24	www.zhaochenmo.com
23.234.20.24	www.zhaofg.com
23.234.20.24	www.zhaohaosf.net
23.234.20.24	www.zhaokf.com
23.234.20.24	www.zhaosf88.com
23.234.20.24	www.zhaoss.com
23.234.20.24	www1.pk123.com
23.234.20.24	www10.138sf.com
23.234.20.24	xiaomeisf.com
23.234.20.24	xinsf.com
23.234.20.24	www.500ok.com
23.234.20.24	www.wancm.com
23.234.20.24	jjj.la
23.234.20.24	zhaochenmo.com
23.234.20.24	zuhukang.com
23.234.20.24	www.shangkequ.com
23.234.20.24	www.9527cqsf.com
23.234.20.24	www.tjtuliao.com
23.234.20.24	www.szplas.com
23.234.20.24	www.hlxyx.com
23.234.20.24	www.012sf.com
23.234.20.24	www.zhaosf.cc
23.234.20.24	www.07sf.com
23.234.20.24	www.duoduosf.com
23.234.20.24	www.sf66666.com
23.234.20.24	www.my7su.com
23.234.20.24	www.725sf.com
23.234.20.24	725sf.com
23.234.20.24	www.96sf.com
23.234.20.24	www.pk196.com
23.234.20.24	www.letanju.com
23.234.20.24	50ss.com
23.234.20.24	www.50ss.com
23.234.20.24	sfdawang.com
23.234.20.24	taocq.com
23.234.20.24	www.73uu.com
23.234.20.24	www.taocq.com
23.234.20.24	www.30uc.com
23.234.20.24	www.nz999.net
23.234.20.24	www.ww45.com
23.234.20.24	www.xt-dz.com
23.234.20.24	www.pk99.com
23.234.20.24	www.1e2w.cn
23.234.20.24	8845.678uc.com
23.234.20.24	cq.3q33.com
23.234.20.24	www.baojingqi.net
23.234.20.24	www.didihc.com
23.234.20.24	www.bangnijie.com
23.234.20.24	www.chenmo.cc
23.234.20.24	www.sina35.com
23.234.20.24	www.175sf.com
23.234.20.24	sf123.cc
23.234.20.24	www.shfiro.com
23.234.20.24	bjyocy.com
23.234.20.24	www.pochanlawyer.com
23.234.20.24	www.138sf.cc
23.234.20.24	99pk.com
23.234.20.24	www.22cq.com
23.234.20.24	www.888ww.com
23.234.20.24	www.2sifu.com
23.234.20.24	wvw.uc99.com
23.234.20.24	123.uc99.com
23.234.20.24	999ok.com
23.234.20.24	www.sf99.cc
23.234.20.24	www.80sf.com
23.234.20.24	www.33221.com
23.234.20.24	www.pk9090.com
23.234.20.24	pk9090.com
23.234.20.24	www2.uc88.com
23.234.20.24	www3.uc88.com
23.234.20.24	www4.uc88.com
23.234.20.24	88845.com
23.234.20.24	www.sf9.com
23.234.20.24	www.700sf.com
23.234.20.24	920gg.com
23.234.20.24	www.23c.com
23.234.20.24	www.021sx.com
23.234.20.24	www.sf78.com
23.234.20.24	www.qjfang.cn
23.234.20.24	23c.com
23.234.20.24	www.yaofg.com
23.234.20.24	www.07ket.com
23.234.20.24	www.17hhg.com
23.234.20.24	www.46cq.com
23.234.20.24	www.wan345.com
23.234.20.24	www.htlq.com
23.234.20.24	www.nbkst.com
23.234.20.24	www.meishipai.com
23.234.20.24	www.987pk.com
23.234.20.24	www.weisf.com
23.234.20.24	www.baqisf.com
23.234.20.24	www.91530.com
23.234.20.24	www.zhaohaosf.com
23.234.20.24	www.s400.com
23.234.20.24	www.aichenmo.com
23.234.20.24	www.sf315.com
23.234.20.24	425sf.com
23.234.20.24	www.23gg.com
23.234.20.24	yaofg.com
23.234.20.24	www.44woool.com
23.234.20.24	www.17166.com
23.234.20.24	www.wt789.com
23.234.20.24	www.591maimai.com
23.234.20.24	www.gggsf.com
23.234.20.24	www.cecri.com
23.234.20.24	www.cnpxba.com
23.234.20.24	www.cqrcxx.com
23.234.20.24	www.zhaowt.net
23.234.20.24	3000ak.com
23.234.20.24	www.3000ak.com
23.234.20.24	027gg.net
23.234.20.24	www.85sf.com
23.234.20.24	www.cnxinghang.com
23.234.20.24	www.sf19.com
23.234.20.24	www.uc600.com
23.234.20.24	www.255uc.com
23.234.20.24	255uc.com
23.234.20.24	111.kaihu365.com
23.234.20.24	www.3000ok-1.com
23.234.20.24	www.3000ok.com
23.234.20.24	www.sf588.com
23.234.20.24	www.jjj3000ok.com
23.234.20.24	1000ok.com
23.234.20.24	www.666923.com
23.234.20.24	www.920313.com
23.234.20.24	www.616st.com
23.234.20.24	www.53my.com
23.234.20.24	www.945176.net
23.234.20.24	www.999sf.cc
23.234.20.24	933gg.com
23.234.20.24	haosf.com
23.234.20.24	www.haosf.com.cn
23.234.20.24	tg.cnm78.com
23.234.20.24	www.1213sf.com
23.234.20.24	www.678sf.com
23.234.20.24	www.250sf.com
23.234.20.24	www.92188.com
23.234.20.24	888.hyds888.com
23.234.20.24	www.646sf.com
23.234.20.24	www.82cq.com
23.234.20.24	sf99.cc
23.234.20.24	www.50ww.com
23.234.20.24	sf590.com
23.234.20.24	www.sf590.com
23.234.20.24	www.35fg.com
23.234.20.24	www.sf526.com
23.234.20.24	www.18ux.com
23.234.20.24	www.520cq.net
23.234.20.24	www.haosf12345.com
23.234.20.24	sf22.com
23.234.20.24	pk99.com
23.234.20.24	79j.com
23.234.20.24	55sf.com
23.234.20.24	www.55sf.com
23.234.20.24	www.zm63.com
23.234.20.24	926.syslx.com
23.234.20.24	1000ok.cc
23.234.20.24	www.1000ok.cc
23.234.20.24	3000ok.isosf.com
23.234.20.24	3000ok.com
23.234.20.24	tt.syslx.com
23.234.20.24	www.zhaofq.com
23.234.20.24	2013.cqmdl.com
23.234.20.24	www.19fu.com
23.234.20.24	19fu.com
23.234.20.24	www.zhaosifu.com
23.234.20.24	www.kom999.com
23.234.20.24	www.ok777.com
23.234.20.24	www.757sf.com
23.234.20.24	www.50999.com
23.234.20.24	33345.com
23.234.20.24	999zg.com
23.234.20.24	www.13ss.com
23.234.20.24	www.520zf.com
23.234.20.24	88pk.com
23.234.20.24	www.990yx.com
23.234.20.24	www.cqacura.com
23.234.20.24	www.tldsny.com
23.234.20.24	www.wzggwz.com
23.234.20.24	www.tjnhey.com
23.234.20.24	www.51friends.com
23.234.20.24	aa.707wz.com
23.234.20.24	www.cn-skf.com
23.234.20.24	www.6sf.com
23.234.20.24	www.jianfeixy.com
23.234.20.24	www.shkingdu.com
23.234.20.24	www.707wz.com
23.234.20.24	www.suoyinm.com
23.234.20.24	www.zcmeter.com
23.234.20.24	www.115book.com
23.234.20.24	9kst.com
23.234.20.24	9u.7080st.com
23.234.20.24	www.118uc.om
23.234.20.24	www.haofwd.com
23.234.20.24	www.zhaowoool.com
23.234.20.24	www.gdhttz.com
23.234.20.24	www.fzdbdz.com
23.234.20.24	www.tianguhotel.com
23.234.20.24	www.chinahjly.com
23.234.20.24	tgaxved8.com
23.234.20.24	5a189.com
23.234.20.24	www.wuwoool.com
23.234.20.24	www.shitongdg.com
23.234.20.24	www.sbqcssf.com
23.234.20.24	www.51cssf.net.cn
23.234.20.24	www.65535cs.com
23.234.20.24	zhao.559woool.com
23.234.20.24	www.559woool.com
23.234.20.24	www.5sdl.com
23.234.20.24	www.dandong-window.com
23.234.20.24	www.xinyumen.com
23.234.20.24	www.ahzhishang.com
23.234.20.24	www.xd163.com
23.234.20.24	www.trm-china.com
23.234.20.24	www.aoyue168.com
23.234.20.24	www.gdcable.com
23.234.20.24	www.zhuwulong.com
23.234.20.24	www.szjapson.com
23.234.20.24	www.swan-storage.com
23.234.20.24	www.cseptc.com
23.234.20.24	www.zcgddz.com
23.234.20.24	www.dycssf.com
23.234.20.24	www.9965478.com
23.234.20.24	www.jshgzb.com
23.234.20.24	www.qd-qinggang.com
23.234.20.24	gzgm.27pyki.com
23.234.20.24	www.hcs888.com
23.234.20.24	www.woool578.com
23.234.20.24	www.jntex.com
23.234.20.24	917wool.cn
23.234.20.24	chuanqifj.com
23.234.20.24	www.lqgz.com
23.234.20.24	www.suwoool.com
23.234.20.24	www.45ci.com
23.234.20.24	www.sdyjt.com
23.234.20.24	www1.bai12.com
23.234.20.24	www.889cs.com
23.234.20.24	www.cjphb.com
23.234.20.24	www.szosun.com
23.234.20.24	www.garment5.com
23.234.20.24	www.gm66.com
23.234.20.24	www.com15.com
23.234.20.24	www.emc120.com
23.234.20.24	ktjia.com
23.234.20.24	www.05woool.com
23.234.20.24	www.cnsjjs.com
23.234.20.24	www.jnxsfr.com
23.234.20.24	www.99cishan.com
23.234.20.24	44woool.com
23.234.20.24	www.mm886.net
23.234.20.24	zhaosf.com
23.234.20.24	www.shyssteel.com
23.234.20.24	www.ywool.com
23.234.20.24	www.hao123woool.com
23.234.20.24	aixin168.com
23.234.20.24	www.wooolfbw.com
23.234.20.24	www.525pc.com
23.234.20.24	www.zhaowooolsf.com
23.234.20.24	www.cn-tyn.com
23.234.20.24	www.917wool.cn
23.234.20.24	www.hy225.com
23.234.20.24	www.10gamer.com
23.234.20.24	www.zv2o.com
23.234.20.24	www.411wed.com
23.234.20.24	www.lewoool.com
23.234.20.24	gtcc2008.com
23.234.20.24	945pk.com
23.234.20.24	pk777.com
23.234.20.24	www.168gamer.com
23.234.20.24	new.guguyu.com
23.234.20.24	web.longhoo.net
23.234.20.24	www.8090yxs.com
23.234.20.24	aszt.6268.com
23.234.20.24	kf.07073.com
23.234.20.24	www.mcncc.com
23.234.20.24	www.wudijz.com
23.234.20.24	lhzs.9377.com
23.234.20.24	lhzs.37wan.com
23.234.20.24	lhzs.yaowan.com
23.234.20.24	lhzs.49you.com
23.234.20.24	lhzs.8090yxs.com
23.234.20.24	wz.49you.com
23.234.20.24	wz.6711.com
23.234.20.24	asqx.yaowan.com
23.234.20.24	www.sifucun.com
23.234.20.24	bbs.to4f.com
23.234.20.24	www.pg666.cn
23.234.20.24	www.yeyoubbs.com
23.234.20.24	www.ucwawa.com
23.234.20.24	www.hgyouxi.net
23.234.20.24	www.xiaolou8.com
23.234.20.24	bbs.houdao.com
23.234.20.24	www.iopq.com
23.234.20.24	wangyesifu.com
23.234.20.24	ok1399.com
23.234.20.24	www.wy090.com
23.234.20.24	www.yx315.net
23.234.20.24	www.yrabc.com
23.234.20.24	67uc.com
23.234.20.24	www.yxsjqk.com
23.234.20.24	www.wangyesifu.com
23.234.20.24	bbs.games.qq.com
23.234.20.24	www.uc266.com
23.234.20.24	www.luanshi.net
23.234.20.24	www.180b.com
23.234.20.24	www.gamemx.com
23.234.20.24	www.9kld.com
23.234.20.24	bbs2.99nets.me
23.234.20.24	www.to4f.com
23.234.20.24	ejxx.jdjy.cn
23.234.20.24	www.920520.com
23.234.20.24	www.gifts52.com
23.234.20.24	www.jjj.com.co
23.234.20.24	www.cq200.com
23.234.20.24	www.239ok.com
23.234.20.24	www.97heji.com
23.234.20.24	www.173bt.com
23.234.20.24	www.1745.com
23.234.20.24	www.96sf.com
23.234.20.24	www.sffb.net
23.234.20.24	www.5uwl.net
23.234.20.24	www.qtgcjx.com
23.234.20.24	www.bdqn.net
	23.23

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: Chinese (Simplified, PRC)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	505655	507904	4.54078	1c4dc59cca6ae500ade9ebe798612e30
.rdata	512000	1506782	1507328	5.373	0dfd99a2a8aad8f4c7c920630b83976e
.data	2019328	242378	65536	3.50794	82da6aa345f8d1ef3605bcb0e0ff8e34
.rsrc	2265088	34688	36864	3.97453	4e86e6e868659ba8adafb0cfbc03a990

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://jc.941pojie.com/jiaqun.htm	125.88.186.134
hxxp://jc.941pojie.com/cxbt.txt	125.88.186.134
hxxp://jc.941pojie.com/zy.txt	125.88.186.134
hxxp://jc.941pojie.com/tc.txt	125.88.186.134
hxxp://jc.941pojie.com/	125.88.186.134
hxxp://jc.941pojie.com/img/gif008.gif	125.88.186.134
hxxp://jc.941pojie.com/css/style.css	125.88.186.134
hxxp://p21.tcdn.qq.com/wpa/images/group.png
hxxp://jc.941pojie.com/img/zsf.gif	125.88.186.134
hxxp://jc.941pojie.com/cj.txt	125.88.186.134
hxxp://jc.941pojie.com/img/miaosha.gif	125.88.186.134
hxxp://www.lszwg.com/	23.234.40.36
hxxp://www.lszwg.com/css/style.css	23.234.40.36
hxxp://jc.941pojie.com/pie.htc	125.88.186.134
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=5076676&show=pic2
hxxp://jc.941pojie.com/img/qingtian.gif	125.88.186.134
hxxp://www.lszwg.com/img/gif008.gif	23.234.40.36
hxxp://jc.941pojie.com/img/yds.gif	125.88.186.134
hxxp://www.lszwg.com/img/zsf.gif	23.234.40.36
hxxp://www.lszwg.com/img/miaosha.gif	23.234.40.36
hxxp://www.lszwg.com/pie.htc	23.234.40.36
hxxp://www.lszwg.com/img/2014052276129177.gif	23.234.40.36
hxxp://www.lszwg.com/img/046bt.gif	23.234.40.36
hxxp://www.lszwg.com/img/bg.gif	23.234.40.36
hxxp://jc.941pojie.com/img/kl.gif	125.88.186.134
hxxp://www.lszwg.com/img/bgheader.gif	23.234.40.36
hxxp://www.lszwg.com/img/bgnav.gif	23.234.40.36
hxxp://www.lszwg.com/img/bgh.gif	23.234.40.36
hxxp://www.lszwg.com/img/gg.png	23.234.40.36
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=5076676&show=pic2&t=z
hxxp://oz.cnzz.com/stat.htm?id=5076676&r=http://www.941pojie.com/&lg=en-us&ntime=none&cnzz_eid=455095186-1433777105-http://www.941pojie.com/&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1029977702	198.11.132.200
hxxp://oz.cnzz.com/stat.htm?id=5076676&r=&lg=en-us&ntime=none&cnzz_eid=369179300-1433777105-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=2004535038	198.11.132.200
hxxp://www.lszwg.com/img/1.jpg	23.234.40.36
hxxp://www.lszwg.com/img/2.jpg	23.234.40.36
hxxp://all.cnzz.com.danuoyi.tbcache.com/img/pic2.gif
hxxp://www.lszwg.com/img/top.png	23.234.40.36
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=3325108&show=pic1
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=34393770	42.120.219.171
hxxp://www.lszwg.com/img/logo.gif	23.234.40.36
hxxp://jc.941pojie.com/img/weihu.jpg	125.88.186.134
hxxp://www.lszwg.com/img/bgtitle.gif	23.234.40.36
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=3325108&show=pic1&t=z
hxxp://oz.cnzz.com/stat.htm?id=3325108&r=&lg=en-us&ntime=none&cnzz_eid=1076296874-1433777109-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=851769781	198.11.132.200
hxxp://cnzz.mmstat.com/app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8	42.120.219.171
hxxp://count46.51yes.com/click.aspx?id=460737107&logo=1	61.147.124.247
hxxp://oz.cnzz.com/stat.htm?id=3325108&r=http://www.941pojie.com/&lg=en-us&ntime=none&cnzz_eid=1649022423-1433777109-http://www.941pojie.com/&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1844789414	198.11.132.200
hxxp://count46.51yes.com/count1.gif	61.147.124.247
hxxp://jc.941pojie.com/img/2014052276129177.gif	125.88.186.134
hxxp://count46.51yes.com/sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)	61.147.124.247
hxxp://count46.51yes.com/sa.htm?id=460737107&refe=http://www.941pojie.com/&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)	61.147.124.247
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=967329697	42.120.219.171
hxxp://all.cnzz.com.danuoyi.tbcache.com/img/pic1.gif
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1417281194	42.120.219.171
hxxp://img.webscan.360.cn/status/pai/hash/6330cf46f68cd2c7c40a422626d1cb30	220.181.158.213
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=702683976	42.120.219.171
hxxp://zhanzhang.anquan.org/static/common/images/zhanzhang.png	183.60.243.220
hxxp://cnzz.mmstat.com/app.gif?&cna=2KH8DTH0XjQCAcGK9Ofwcxcp	42.120.219.171
hxxp://count26.51yes.com/click.aspx?id=261222598&logo=2	61.147.125.67
hxxp://count26.51yes.com/count2.gif	61.147.125.67
hxxp://count26.51yes.com/sa.htm?id=261222598&refe=http://soso.hcjd56.com:88/&location=http://sky25145.hbgyzs.com:83/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)	61.147.125.67
hxxp://count46.51yes.com/sa.htm?id=460737107&refe=http://www.lszwg.com/&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)	61.147.124.247
hxxp://jc.941pojie.com/img/046bt.gif	125.88.186.134
hxxp://jc.941pojie.com/ico/yinyue.png	125.88.186.134
hxxp://jc.941pojie.com/ico/jiechi.jpg	125.88.186.134
hxxp://jc.941pojie.com/ico/jsq.png	125.88.186.134
hxxp://jc.941pojie.com/ico/27.png	125.88.186.134
hxxp://jc.941pojie.com/ico/qijian.jpg	125.88.186.134
hxxp://jc.941pojie.com/ico/jianhun.png	125.88.186.134
hxxp://jc.941pojie.com/ico/haobangshou.jpg	125.88.186.134
hxxp://jc.941pojie.com/ico/wangpai.jpg	125.88.186.134
hxxp://jc.941pojie.com/ico/binglang.png	125.88.186.134
hxxp://jc.941pojie.com/ico/mojian.jpg	125.88.186.134
hxxp://jc.941pojie.com/ico/miaosha.png	125.88.186.134
hxxp://jc.941pojie.com/ico/anlong.png	125.88.186.134
hxxp://jc.941pojie.com/ico/tianlang.jpg	125.88.186.134
hxxp://jc.941pojie.com/ico/daosu.jpg	125.88.186.134
hxxp://jc.941pojie.com/ico/jisu.png	125.88.186.134
hxxp://jc.941pojie.com/ico/sansha.png	125.88.186.134
hxxp://jc.941pojie.com/ico/linggua.png	125.88.186.134
hxxp://jc.941pojie.com/ico/daofeng.png	125.88.186.134
hxxp://jc.941pojie.com/ico/shicai.png	125.88.186.134
hxxp://jc.941pojie.com/ico/longshen.jpg	125.88.186.134
hxxp://jc.941pojie.com/ico/tianxunzhe.png	125.88.186.134
hxxp://jc.941pojie.com/ico/lingfeng.jpg	125.88.186.134
hxxp://jc.941pojie.com/ico/longtian.jpg	125.88.186.134
hxxp://jc.941pojie.com/ico/xgz.jpg	125.88.186.134
hxxp://jc.941pojie.com/ico/tianyi.png	125.88.186.134
hxxp://www.941pojie.com/ico/daosu.jpg	125.88.186.134
hxxp://www.941pojie.com/ico/haobangshou.jpg	125.88.186.134
hxxp://www.941pojie.com/ico/anlong.png	125.88.186.134
hxxp://pcookie.cnzz.com/app.gif?&cna=2KH8DTH0XjQCAcGK9Ofwcxcp	42.120.219.171
hxxp://www.941pojie.com/ico/longtian.jpg	125.88.186.134
hxxp://www.941pojie.com/css/style.css	125.88.186.134
hxxp://pub.idqqimg.com/wpa/images/group.png	103.7.29.190
hxxp://www.941pojie.com/img/qingtian.gif	125.88.186.134
hxxp://c.cnzz.com/core.php?web_id=3325108&show=pic1&t=z	195.27.31.246
hxxp://cj.941pojie.com/zy.txt	125.88.186.134
hxxp://www.941pojie.com/	125.88.186.134
hxxp://www.941pojie.com/ico/wangpai.jpg	125.88.186.134
hxxp://www.941pojie.com/ico/xgz.jpg	125.88.186.134
hxxp://www.941pojie.com/ico/tianlang.jpg	125.88.186.134
hxxp://www.941pojie.com/ico/miaosha.png	125.88.186.134
hxxp://www.941pojie.com/ico/qijian.jpg	125.88.186.134
hxxp://www.941pojie.com/ico/jisu.png	125.88.186.134
hxxp://cj.941pojie.com/tc.txt	125.88.186.134
hxxp://www.941pojie.com/ico/jianhun.png	125.88.186.134
hxxp://pcookie.cnzz.com/app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8	42.120.219.171
hxxp://www.941pojie.com/ico/tianxunzhe.png	125.88.186.134
hxxp://s85.cnzz.com/stat.php?id=3325108&show=pic1	1.99.192.16
hxxp://www.941pojie.com/ico/longshen.jpg	125.88.186.134
hxxp://www.941pojie.com/img/2014052276129177.gif	125.88.186.134
hxxp://www.941pojie.com/ico/lingfeng.jpg	125.88.186.134
hxxp://www.941pojie.com/ico/27.png	125.88.186.134
hxxp://www.941pojie.com/img/zsf.gif	125.88.186.134
hxxp://www.941pojie.com/ico/shicai.png	125.88.186.134
hxxp://www.941pojie.com/ico/mojian.jpg	125.88.186.134
hxxp://icon.cnzz.com/img/pic2.gif	195.27.31.248
hxxp://c.cnzz.com/core.php?web_id=5076676&show=pic2&t=z	195.27.31.246
hxxp://www.941pojie.com/pie.htc	125.88.186.134
hxxp://s25.cnzz.com/stat.php?id=5076676&show=pic2	1.99.192.16
hxxp://www.941pojie.com/img/kl.gif	125.88.186.134
hxxp://www.941pojie.com/img/046bt.gif	125.88.186.134
hxxp://www.941pojie.com/img/yds.gif	125.88.186.134
hxxp://www.941pojie.com/ico/sansha.png	125.88.186.134
hxxp://www.941pojie.com/img/gif008.gif	125.88.186.134
hxxp://icon.cnzz.com/img/pic1.gif	195.27.31.248
hxxp://www.941pojie.com/img/miaosha.gif	125.88.186.134
hxxp://www.941pojie.com/ico/yinyue.png	125.88.186.134
hxxp://www.941pojie.com/ico/binglang.png	125.88.186.134
hxxp://www.941pojie.com/img/weihu.jpg	125.88.186.134
hxxp://www.941pojie.com/ico/jsq.png	125.88.186.134
hxxp://www.941pojie.com/ico/daofeng.png	125.88.186.134
hxxp://cj.941pojie.com/cxbt.txt	125.88.186.134
hxxp://www.941pojie.com/ico/linggua.png	125.88.186.134
sky25145.hbgyzs.com	115.231.174.114
soso.hcjd56.com	115.231.174.114
941pojie.meibu.net	110.28.187.170

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0
ET POLICY HTTP Request on Unusual Port Possibly Hostile

Traffic

GET /click.aspx?id=460737107&logo=1 HTTP/1.1

Accept: */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:20 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Type: text/html; charset=gb2312

Content-Length: 1777
..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(
endstr==-1) endstr=document.cookie.length;return document.cookie.subst
ring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.
length;var clen=document.cookie.length;var i=0;var j;while(i<clen) 
{j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=d
ocument.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..functio
n cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*360
00;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz
=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie
="cck_lasttime=" yesctime "; expires="   y_e.toGMTString()    "; path=
/";document.cookie="cck_count=0; expires="   y_e.toGMTString()    "; p
ath=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_c
ount");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y
_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctim
e "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count
=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var
 yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' esc
ape(document.location) '&color=' screen.colorDepth 'x&resolution=' scr
een.width 'x' screen.height '&returning=' cc_k() '&language=' navigato
r.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('
<a href="hXXp://countt.51yes.com/index.aspx?id=460737107" target=_b
lank><img width=20 height=20 border=0 hspace=0 vspace=0 src=<<< skipped >>>

GET /sa.htm?id=460737107&refe=http://VVV.941pojie.com/&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:23 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Length: 0
....


GET /sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:23 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Length: 0

HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:25:23 GMT..Server: Microsof
t-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Co
ntrol: private..Content-Length: 0..

GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 36800

Content-Type: text/html

Content-Location: hXXp://VVV.lszwg.com/index.html

Last-Modified: Mon, 08 Jun 2015 04:50:11 GMT

Accept-Ranges: bytes

ETag: "ec292b9aa6a1d01:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:11 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-eq
uiv="X-UA-Compatible" content="IE=EmulateIE7" />..<meta http-equ
iv="Content-Type" content="text/html; charset=gb2312" />..<title
>941......-........-VVV.941pojie.com</title>..<meta name="
keywords" content="..................................,............941.
.......941..........">..<meta name="description" content="941...
...,......................................,........,..................
..">..<link href="css/style.css" rel="stylesheet" type="text/css
" />..<link href="css/style.css" rel="stylesheet" type="text/css
" />..<style type="text/css">..<!--...down td { font-famil
y: Arial, Helvetica, sans-serif; height: 24px; line-height: 24px; padd
ing-left: 5px; }...down img { width: 87px; height: 24px; border: 0 }..
.STYLE1 { color: #FF0000 }...STYLE2 { color: #00FFFF }...STYLE3 { colo
r: #FF0000; font-weight: bold; }...STYLE4 { color: #0000FF }...STYLE5 
{ color: #FF3300 }...STYLE6 { color: #315500 }...STYLE7 { color: #FFFF
FF }...gf2 { font-family: "...."; font-size: 18px; font-weight: bold; 
color: #BD0000; float: right; line-height: 33px; }...gf3 { font-family
: "...."; font-size: 18px; font-weight: bold; color: #BD0000; float: l
eft; line-height: 33px; }...tp { background: url(img/zs.gif) repeat-y;
 overflow: hidden }...lf { float: left; }...rg { float: right; }..<<< skipped >>>

GET /img/gif008.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 565

Content-Type: image/gif

Content-Location: hXXp://VVV.lszwg.com/img/gif008.gif

Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT

Accept-Ranges: bytes

ETag: "05c92394b7cf1:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:12 GMT
GIF89a ..........R.......!..NETSCAPE2.0.....!.......,.... ....._....m.
..PZ.D.6.N...}Q)[email protected],.....|.... ..K.v.....-yJ.R6;....Tx...Y Y5i
......i...9......F..!.......,.... ....._........PZ.D.6.N...}Q)....M..1
@.i,.....|.... ..K.v.....-yJ.R6;....Tx...Y Y5i......i...9.....|E..!...
....,.... .....`........PZ.D.6.N...}Q)[email protected].<..h..0.
d..U....Q6S..U.5..r...R9i....[....r1.a.7......!.......,.... ....._....
....PZ.D.6.N...}Q)[email protected],.....|.... ..K.v.....-yJ.R6;....Tx...Y Y
5i......i...9.....|E..!.3Reduced 73% @ VVV.raspberryhill.com/gifwizard
.html..;....


GET /img/zsf.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 85308

Content-Type: image/gif

Content-Location: hXXp://VVV.lszwg.com/img/zsf.gif

Last-Modified: Thu, 14 Aug 2014 07:47:38 GMT

Accept-Ranges: bytes

ETag: "089c3494b7cf1:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:12 GMT
GIF89a..Z....9Z.(\.,e.4i.<`.Lr.Uv.Gk.Ae.:s. f.5j.;r.4k..l.,h.4m.8n.
2m.1g..p..q.5p.9q.=x.4s.;u.6x.<x.5u.:v.6x.:y.Lu.Bn.Bt.Dw.Q{.Qw.Eu.H
v.Dy.J{[email protected]|.I}.R}.C~.H..Y..f..r..v..l..w..i..z..E..L..M..Y..U..\.
.R..Y..T..[..S..\..Z..C..K..M..N..P..S..X..P..Y..M..N..T..\..^..R..Z..
^..e..a..h..d..c..k..e..l..k..q..t..y..v..`..b..i..d..j..`..k..a..s..y
.._..^..l..t..{..{..l..d..j..j..t..{..u..|..t..z..u..y..~..v..|.....~.
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..............CWz!.......!..NETSCAPE2.0.....,......Z......9....8..."&l
t;H..6....4.."...1b.hp.G...U...d... n....H...}.H...o8.e{.......=...g..
.....Si..B.=.:..P......S.R......S.2....Sw..P..v..9.(..S..-J.....r.{.8.
N...g..m.....'..-n.l;....x..l.!C.)...i.7cN.m....q&.M;.3..W...[&hh....-
<8...qos.:8.m.o.|.M.u...O.........gk..Z..'..7.pZ....^l).f.....t....
...tRC..._H$...}.zd.I.m.........N....Z....b..5....x&.g"A. d...\..A..'"
.".TcA..h.C...S......7.y..7....I..d.KF9..U*.%.O.)..\~.e.^.i&.\N...d...
!.$..cT9..`.$C...9..c.:......L.y.......L..0.h..*.h..:..".VZ)....i2...)
.........."..\.j..(..%...L"...H2......F.*,.......J.%.n.....b.".,.k".*.
.%.h....^.........,.M..$.H&......$.. . r.%...H..L.l"q...".[r.%.3.p.q2.
...S....X.1..ol.....g..../"...2"F....5.L..8..3.H....<[email protected]<<< skipped >>>

GET /pie.htc HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 404 Not Found

Content-Length: 1308

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:13 GMT
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "hXXp://VVV.w3.or
g/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>.....
.......</TITLE>..<META HTTP-EQUIV="Content-Type" Content="tex
t/html; charset=GB2312">..<STYLE type="text/css">..  BODY { f
ont: 9pt/12pt .... }..  H1 { font: 12pt/15pt .... }..  H2 { font: 9pt/
12pt .... }..  A:link { color: red }..  A:visited { color: maroon }..&
lt;/STYLE>..</HEAD><BODY><TABLE width=500 border=0 c
ellspacing=10><TR><TD>..<h1>............</h1&g
t;....................................................<hr>..<
p>................</p>..<ul>..<li>...............
.........................................</li>..<li>......
......................................................................
......</li>..<li>....<a href="javascript:history.back(1
)">....</a>....................</li>..</ul>..<
h2>HTTP .... 404 - ..................<br>Internet ........ (I
IS)</h2>..<hr>..<p>..............................<
;/p>..<ul>..<li>.... <a href="hXXp://go.microsoft.co
m/fwlink/?linkid=8180">Microsoft ............</a>..........&l
dquo;HTTP”..“404”........</li>..<li>....
“IIS ....”...... IIS ...... (inetmgr) ....................
....“........”..“............”..“.......
...........”........</li>..</ul>..</TD><<<< skipped >>>

GET /img/2014052276129177.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 832

Content-Type: image/gif

Content-Location: hXXp://VVV.lszwg.com/img/2014052276129177.gif

Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT

Accept-Ranges: bytes

ETag: "05c92394b7cf1:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:13 GMT

GIF89aX..................!..copyright. 1996 Charles H. Tupper  All rig
hts reserved. not to be used on another graphics download site or on s
oftware.  All other uses permitted.  hXXp://VVV.cyberspace.com/tup.!..
NETSCAPE2.0.....!.......,....X.....*.............0....H.........6.L...
.....? ..!.......,%...j...................<....H............!......
.,W...j...................<....H............!.......,....j.........
..........<....H............!.......,....j...................<..
..H............!.......,....j...................<....H............!
.......,....X.....*..................H...........L.........(..!.......
,1.........!..................H...........L...!.......,c.........!....
..............H...........L...!.......,..........!..................H.
..........L...!.......,....X.....)................n.H...........L.....
..>S..;....

GET /img/046bt.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 6215

Content-Type: image/gif

Content-Location: hXXp://VVV.lszwg.com/img/046bt.gif

Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT

Accept-Ranges: bytes

ETag: "05c92394b7cf1:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:13 GMT

GIF89aK....!......U.......$..$U.$..$..I..IU.I..I..m..mU.m..m......U...
........U...........U...........U......$..$.U$..$..$$.$$U$$.$$.$I.$IU$
I.$I.$m.$mU$m.$m.$..$.U$..$..$..$.U$..$..$..$.U$..$..$..$.U$..$..I..I.
UI..I..I$.I$UI$.I$.II.IIUII.II.Im.ImUIm.Im.I..I.UI..I..I..I.UI..I..I..
I.UI..I..I..I.UI..I..m..m.Um..m..m$.m$Um$.m$.mI.mIUmI.mI.mm.mmUmm.mm.m
..m.Um..m..m..m.Um..m..m..m.Um..m..m..m.Um..m.......U.......$..$U.$..$
..I..IU.I..I..m..mU.m..m......U...........U...........U...........U...
........U.......$..$U.$..$..I..IU.I..I..m..mU.m..m......U...........U.
..........U...........U...........U.......$..$U.$..$..I..IU.I..I..m..m
U.m..m......U...........U...........U...........U...........U.......$.
.$U.$..$..I..IU.I..I..m..mU.m..m......U...........U...........U.......
....U......!..NETSCAPE2.0.....!.......,....K..........H......*\......#
J.H..@`.1.$...9r....7..........cI........1........Ar.^.#...A0AR....]L.
K......Ux..!#.u$ ..........-..|.`f........ )R....I./1..A.(... .R..ML..
>|.....u.HP.J....s..*3.d..&.v....FO22.N...I.0A.4........r.R........
.Q.{`..{..n-p21t'.~4....@*..o...#)[email protected]<.r.....{`..!...|
..'^Xh.5[r....K..T.r..4. .......f\X.....e..QJPa..A....GC.(".fU...mEe.Z
K.FHf|.x..A.U!.a...J,iD.bo..]P.l...@...}$.(..3.W.MK.w.w..gV...&.._...A
.EG.B....}.t...J..P..1..L`.....6....F...!.......,....K..........H.....
.*\......#[email protected]``.%.E.#1r.......(...m.(0#I..<.$........C.
..I@:I....&.....l...O.:..C.. :.......).. ........H.b.8..V..H.$G.-I.f..
.*p%).Uk....%9.Z..........:...%..,I..L.......%...O.....jw......;..

<<< skipped >>>

GET /img/bg.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 1065

Content-Type: image/gif

Content-Location: hXXp://VVV.lszwg.com/img/bg.gif

Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT

Accept-Ranges: bytes

ETag: "05c92394b7cf1:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:13 GMT

GIF89a..................f..3..............f..3..............f..3....f.
.f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3....
..........f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3
............f..3..............f..3..............f..3..............f..3
....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...f..f..f..f.ff
.3f..f..f..f..f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3
ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3..3.f3.33..3..3..3..
3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.........
....f..3..............f..3..............f..3....f..f..f..ff.f3.f..3..3
..3..3f.33.3............f..3...f..e..d..a..`..Rn.Je.Id.Gb.Mg.Oi.Qk.Pj.
Zw.Vq.^|.Xs.\y.Yt.`}.a~._|.f..Fa.Hc.Kf.Nj.Lg.Pl.So.Vt.Tp.Yv._~.[x.Zw.c
..b..^{....!.......,...............H......*\.0..l..J.H......i...c.. C.
...d.~(S.\..%.m0a.|...M..r.....O............&=.....G.5e..j..X..... ..`
........h..]..m..p...;7..r.....W.......L.pa{.. 6.......I.L..e..2k.....
..A..=.....S.FM.....b..G.....r............;w.... ........I.N.zux..k..]
;.........|...;....

GET /img/bgheader.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 1978

Content-Type: image/gif

Content-Location: hXXp://VVV.lszwg.com/img/bgheader.gif

Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT

Accept-Ranges: bytes

ETag: "05c92394b7cf1:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:13 GMT
GIF89a.........................a}....BV..........Yu....Rk.^z....Ja.Nf.
=P.......... 8[xxxTo.......]x....I_....w..TVU...F[.d........3Ak...9M|.
...........[w....Vq.:Jw......IJK# ESm....e.._{.Uo....b..hhi4EoG]....OU
[email protected]....]dw
............Ys..........o~.............Pe.9Et...DX. <]...Mc........
..Xt.........._|.Pi.\i....Nj.......Qg....7Jx...'4Q...Jb...............
.........................Wq.b...................................... (C
..................Og....Zx............................................
........\y........................................Ph..................
.w..\a_`ab...1Dk............L_........................................
...DS....f..............\u.Kd.~~}...\s.sus>N}......]m.......Ql.....
.................,[email protected]...... C..I
....(S.\.....0c..I....8s...3e...]...a....s.`.....8."....S!.......;v.L1
.K....h..].....p...K....x............L...... ....c8.#.A..l...\0..u.R..
...104$H..j.......3..m.v...s...........N...... _.......K.N......k..=..
.:n.........i..O.v.....u..............t...k68...{..........D(...Vh...f
....v... .(..$.h..(....,....0.(..4.h..8~H..;..c;.....D.A...B. )...!.uD
iC.0L&......T....D...C.......D.A.l....p.)..t.i..x....|......*....j...&
....6....F*...Vj..i..............o.I.....H..Dd.S....U..0.E.u...5?x.F..
. ....k...&....6....F ...Vk...f....v..... ....k.......J....J......k..i
..f;D...... ..O...V]Xa..Dx0....1D...b...[.H..w... .,..$.l..(....,....0
.,..4.l..8....<[email protected]#=..IS....o|...[.K..4c...H....?.%<<< skipped >>>

GET /img/bgnav.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 3645

Content-Type: image/gif

Content-Location: hXXp://VVV.lszwg.com/img/bgnav.gif

Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT

Accept-Ranges: bytes

ETag: "05c92394b7cf1:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:14 GMT
GIF89aa.N.............................................................
............EQ.Tk.Ma.CT.8Fr.$;[email protected].;M}a~.Zt.Tm.Ri.N
e.DW.CW.9Jxb..]x.Qi.H][email protected]}....Xv.c..\z.Yu.Xt.Vq.To.Jb.3Cme.
.d..c..^{.Zv.Zv.Rl.E[.7Hu5Fqb.._|.Zw.Yv.Xt.Xs.Vp.CX.BV.>Q.`}.^z.^|.
Zu.Uo.Tm.I_.AU.Ka.J`.BV.)6U`}.Sg................[z.Le.Kd.Sp.La.{|~....
.....TVX..............................................................
...... ..)..2..6..7..>..C..J..S..T..o.............................!
..&..&..(.. .. ..,........5..6..9..9..=..>..[..]..]..e..g..m..p..q.
.|...............................................0..6..G..T..W........
......................................................................
......sqo.............................................................
....................!.......,....a.N........2d..%4.(....C a..xH... ...
...... C..h... a:Vq...........H.4:^[email protected].(..H."m...P.O..e..'..U
..$x....'D@.....,[email protected]?..K..].(....e...b.......%..|..C..#)R..<
..e..3G.......C.....\('&.Y....&P|d..BE./].x..{..............._.{w...1k
....j.W^....F..[b ..1e......7.........O.~|.....2.I.-.....=T.B.DXaDc0..
E.b.`....a..f.....vx.. ..a.$.!..(.xC..ZX.......*....O.. .G..C.c.......
.6..0..I6.d..<)..TVI%.On#N...1F......L=...b.Q.-.p..&.....t.i..x....
|...&.<2I!.x ..$....)...!.x"...T....f....v....^....x..1...C..f!....
.a.,.$..'...H'....... .... J([email protected]."..B.).| ....k...
..n(..B."..2L.t..D.)..C.!x.K)..R.1......'....7....#..*....)..........&
gt;.....4.J#.8..*,....0.,..4..r#&......Q..?dPm....H1.<.H1H3...P<<< skipped >>>

GET /img/bgh.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 5439

Content-Type: image/gif

Content-Location: hXXp://VVV.lszwg.com/img/bgh.gif

Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT

Accept-Ranges: bytes

ETag: "05c92394b7cf1:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:14 GMT
GIF89a.......Wr.Jb.\v.Gb....Id.To.Yt.Pi....Mb....Nh.`}.H^.Fa.Me.Yt.j..
Wr.Yv....t..DY.Rk.z..k..^|.Nf.Ys.Nf.Sl.n..m.....a..|.....Ok.^{.q.....P
j.{..Nc....v..^y.Rk.f.....CX.H\.Ri.o..Xo.Un.J`.Qe.f..Vt....Yu.Rj.G\.k.
.F[.Xo.Pg.CZ.l..Tk.f..d..b..b..a~.c..c..e..d..a..`}._|.c..\x.c.....e..
^z.Xs.d..[w.`{.Zv.^{.]y.Kf.Je.b..]z.\y.Yv.Rn.Up.Vq._z.`..`}.[x.Tp.a|.b
..Mg._|.So.f.._|.\x.Up._~.Hc.Nj.Zt.[w.a..Lg.Qm.Pl.Uq.Pl.Xs.a~.Hc....Vq
.a~.~..Tm.e..Sn....d.....Vr.Mg.Zw.}..Zt.c..p..b..^z.Wr.d.._{.`{.t..Ni.
[x.Lf.Vq.Wt.Xs.Vt.Lf.^}....w..x..e..]{.q..Yv.Rm.Zu.b}.Up.[u.e..p..e..[
u._{.......]{.Xu....Qm.^{.Kb.b..]|.]x.]z.Rn.Rl.b..Og.c..c.....Ur.c..Sn
....l..n..h..u..To.Qh.Pl.......]z.Ld....~..Tm.s..Vo.Zv....g..`~.w..\w.
l..x..c~....Xt.Od.y..]y.Qj.K_.b.....Kc.[v....g..f........Rn....`..o...
..Vq.......!.......,.............t...C."..).7...#i..Q.D..4......./....
...K.x..u.w...X|.0.h.....S.P....M3.pAS.&...vbH.E&.).1....#..G.}s.5MQ.H
g....)E.D.vL..../#..5`.jN.d.|.......S.-.W...U...........eZ..."..I^.XI.
461....sF..I..\3....9.T.E.....^.W-../Jh...{.U.................n.../'~.
Zv.S...........g.*..y.Sd.g..;z%.....^H<.].'.~.Y...L......h...|....4
X...N.`..>...\(......a&v.(.....!.*..H....bzU......P..9.h`.>.h!..
..a......H..$.?6...Q*[email protected][email protected]'.R
..g.|.)..q.Z.......{...".8.&.yFJ...ZJ...(*).......vjj..B..>....@G".
...v.:E...* ....k.Z.........Z..c....l..BK...2.,~.2....&k ..z.n..r....*
$...:K.T..K ..hQE.T.kG.........o..2r...../..v........`.;...?.o..7.q...
L...3...&.|..*....`.{L..t.H.........0.:..3.R.}s...|.4Z....I....M..<<< skipped >>>

GET /img/gg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 23328

Content-Type: image/png

Content-Location: hXXp://VVV.lszwg.com/img/gg.png

Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT

Accept-Ranges: bytes

ETag: "05c92394b7cf1:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:14 GMT
.PNG........IHDR.......'.............sRGB.........gAMA......a.... cHRM
..z&..............u0...`..:....p..Q<..Z.IDATx^....VG....T.tv..O./s2
.y..5..i...A00......j< ........b....2X..l...v.....,6x_0...,6`6.6^.J
......s...........O....D.._Fd&U..,.?cL.\..........P.?.).....2...y.....
..)....o./....E|DK.*4).._L......./?.T.w.....,....7z].Zj..r...\.o..o.?&
gt;.y:......c...Bu_...~..|..q...J......s...X.....R..{G[.;.;.....r...OG
O....T...........h.ok.....h/[email protected]...;.G.......9..ON...??......./.
.e....~..S.......Nz..$.....=..g..S....#..x..?W...,...y.c..8..~.....>
;..~}..W.t ./.u. .%..c.#.%lY..O...Y|.....N}E.....{.....&O.s....G.#G!.%
y...!...0t....C.N...........=.O.......=. .z.~..i......:..l..,.........
......=w@......}..^....k..w..e..o~.s.7..q.............;X..w'....[..[..
....lX.|."....R,.N.;G,F.<.....RX.=..a...|.,...a\"3.7...X....^..r..M
..x.....T0..g.. .B...i.?BlE.K......_..Mx..............1...c=....o.....
...{.>9..<?.-.1..g...Rr.j.......C.....{..va....:}.....;.._y)cm..
.I...h...[..z.6.K......1g.......cd,..5..n!.._...g...,....'N..{..$.....
..B.....'.:G...7!..q../N6......<./.7.V.z.h.0.{.0..?..q.....s.~v....
?....t.>@.j-'....o.E.G?w..V....d.....gP......x............O.=D>.
..D..q....`.w|q.l.....[..^........../OO.../w|...................>..
.i0.....1.k.U1N#...._._"..s.I._.|..g...O.4... .(>.n.&}..!..b.4.`..N
 >..!>....8.qs8..R8..M.'.......?..Cxa.6..<..{.....C.w....(..~
...KY*..[....|[email protected]..'a...7.H.s.<.C.....y...._.:.../a...I^....
.c.W<.....<.1y.|..).........'B>...V<.=.4..G.?....YN.&l<<< skipped >>>

GET /img/1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 404 Not Found

Content-Length: 1308

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:14 GMT
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "hXXp://VVV.w3.or
g/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>.....
.......</TITLE>..<META HTTP-EQUIV="Content-Type" Content="tex
t/html; charset=GB2312">..<STYLE type="text/css">..  BODY { f
ont: 9pt/12pt .... }..  H1 { font: 12pt/15pt .... }..  H2 { font: 9pt/
12pt .... }..  A:link { color: red }..  A:visited { color: maroon }..&
lt;/STYLE>..</HEAD><BODY><TABLE width=500 border=0 c
ellspacing=10><TR><TD>..<h1>............</h1&g
t;....................................................<hr>..<
p>................</p>..<ul>..<li>...............
.........................................</li>..<li>......
......................................................................
......</li>..<li>....<a href="javascript:history.back(1
)">....</a>....................</li>..</ul>..<
h2>HTTP .... 404 - ..................<br>Internet ........ (I
IS)</h2>..<hr>..<p>..............................<
;/p>..<ul>..<li>.... <a href="hXXp://go.microsoft.co
m/fwlink/?linkid=8180">Microsoft ............</a>..........&l
dquo;HTTP”..“404”........</li>..<li>....
“IIS ....”...... IIS ...... (inetmgr) ....................
....“........”..“............”..“.......
...........”........</li>..</ul>..</TD><<<< skipped >>>

GET /img/2.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 404 Not Found

Content-Length: 1308

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:14 GMT
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "hXXp://VVV.w3.or
g/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>.....
.......</TITLE>..<META HTTP-EQUIV="Content-Type" Content="tex
t/html; charset=GB2312">..<STYLE type="text/css">..  BODY { f
ont: 9pt/12pt .... }..  H1 { font: 12pt/15pt .... }..  H2 { font: 9pt/
12pt .... }..  A:link { color: red }..  A:visited { color: maroon }..&
lt;/STYLE>..</HEAD><BODY><TABLE width=500 border=0 c
ellspacing=10><TR><TD>..<h1>............</h1&g
t;....................................................<hr>..<
p>................</p>..<ul>..<li>...............
.........................................</li>..<li>......
......................................................................
......</li>..<li>....<a href="javascript:history.back(1
)">....</a>....................</li>..</ul>..<
h2>HTTP .... 404 - ..................<br>Internet ........ (I
IS)</h2>..<hr>..<p>..............................<
;/p>..<ul>..<li>.... <a href="hXXp://go.microsoft.co
m/fwlink/?linkid=8180">Microsoft ............</a>..........&l
dquo;HTTP”..“404”........</li>..<li>....
“IIS ....”...... IIS ...... (inetmgr) ....................
....“........”..“............”..“.......
...........”........</li>..</ul>..</TD><<<< skipped >>>

GET /img/top.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 23243

Content-Type: image/png

Content-Location: hXXp://VVV.lszwg.com/img/top.png

Last-Modified: Thu, 14 Aug 2014 07:47:38 GMT

Accept-Ranges: bytes

ETag: "089c3494b7cf1:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:15 GMT
.PNG........IHDR.......F......:\.....bKGD..............pHYs.......... 
.... .IDATx...{t..}.......nt..J .Q....M.z..-.....5Y..d.h...:.Lv}.MN2..
Y....&qv2.x.....8^;.# vlZR2.i..![[email protected].  ..4..zW...]....."myN....
QU}..}.......{....F.m..F...H?....F.m..F.q..s.m..F.m...f.m..F.m...C.9..
F.m...{.m..F.m..F..1..s.m..F.m...f.m..F.m...C.9..F.m...{.m..F.m..F..1.
.s.m..F.m...f.m..F.m...C.9..F.m...{.m..F.m..F..x....f.m..F.m....f.....
.......6.h...6.$..Q#...?....h..6.h.G.u(.m..F.m..F.?..C.n3.6.h..6.x.Ay.
...F....&o.qu..p.P..|..O.......(.Y|.Z.d?.......xy...".......n....l_D..
X.d....&n.......^..._.Mn%......-.Xg.~..~....Xg......_.7<#...S.W..R.
...Jb-.....G..D..U]Wm.q% ~..^..88....#........%...W.A.K/.uC.......... 
KL.....-......................u.g.x..;NA..@$.>...^O~.GJ<D`#.E$w.
.X....\b....]..O.u..].p....9v..^............*.......G.F.S..*.A].G~..o#
..1r.8C.M...w...M...<.........0/...U..g..&...06>.Ek.U.r....c[.$.
...aX..7_.......-.Z...x.m.R.O..Kl....u...\..'9:4..|......si.....{R@k..
.U5g....r...,{.ws...*..px.4..M.....4B.-.....-.<....]....K_...."Nj`.
.5C.)>..........5c1.....1..A..s.. (....}.[........:zo..5=.s..&.;7y#
.v.U..e.".........=........-.3...........C.L>.c[....L....g)A.t.|g.u
.....\..Q...?.. ......dE.j.-.;..;.i .......8.......q..w..k`G..|.?....g
..Y...~......'.._mT.b..j.....E.0~v....n...^.RXV.7...b... ...P(..=y..O_
................>.b...;.r.]Y....y.f... ..3c\...|..n..<.....W.6=K
....3.Y.0........R.g'.fX........ds....)...7vo[..~...............[S..4?
tK.b......._.n...;........n.6.....^.....s..........?}Y.i5..Y.....1<<< skipped >>>

GET /img/logo.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 4437

Content-Type: image/gif

Content-Location: hXXp://VVV.lszwg.com/img/logo.gif

Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT

Accept-Ranges: bytes

ETag: "05c92394b7cf1:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:15 GMT
GIF89a..F....a..a..b..c..c..d..d..d..d..e..e..e..e..e..f..f..f..f..g..
f..g..f..i..m..n..k..p..s..w..t..}..{..|....d..^..j..g..j..l..n..r..s.
.t..u..u..v..x..y..z..{..|..}..~......................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!.......,......F.....#..H.....%.\......#J.H.....!:......  J
P.....(S.\9q.I.....xL..r:`....g../=.......H3>P.r`[email protected]....
..`...{u...Q.V%.....Y ...taZ.;[email protected]....|.\.......#Kf....$.3K6r
.a..X14.C.4i.Yw.........c.p......7..."......>...H......4hd..`..\...
.V...i..%.....z...3..._...'1b.....}.`h.C.V...u.P..V.........%.,!..A..^
*....p..6..YyB.; l..<.YdS.)....,..b3.. ..,..F,*vaK.-.pK..^....UgI.`
...*_Y..<.\.AxL.(.;;\..r;P.....(..4.I#...S.09.P..z.b.#...b @:.W..%#
.k.E....qh.2.......a.&......X....`..MH.U..f..b.O.c.1..P...L.B..-..B.*.
.K..a..;...ZW ....]A...V..I*.........t."s....c...m`.M%Vt....h...0B..e.
...)^...)......)`A\9i%2]a..p.j....!{...Ze.%....k6....6.....fKb...Zn.(.
.j....."........K3....@\...&A.qNp.m.1p.[..&?.......C...v...!..j.'.<<< skipped >>>

GET /img/bgtitle.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 3274

Content-Type: image/gif

Content-Location: hXXp://VVV.lszwg.com/img/bgtitle.gif

Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT

Accept-Ranges: bytes

ETag: "05c92394b7cf1:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:15 GMT
GIF89a~.#....Z........W..~..|....Z..=..............B..o}....'|...."`..
..%T.....q. x..|.....{.......:........... ...|....kM..........!...~...
.!.........{............. }.... ......x.....{..}.......... ...........
.|....".. }..........G........"......{........z..y..z........\.....M..
z....................x....!^.......!...{........T..Y.......m..:.......
.p.....!..<..5........"...L....=o.*K..v..v..y.1.........i.!..... ..
H..#....._..o..6..L..N......{.6e.#.."..!..`.. ..l.."~....K.. .........
...t..K..~....*n.)......L..z....].."..>.."z..y..........8..Q.....-l
....bn....Cu.0...|....8..;L....?.. .....G............k.'..<........
......\........7..#.....J..Li..o..w....(..*..x..}..m...m.&W....$..%..&
..LQ....O~....2u..w....[.....8i.%k.$..&..... .....)........... .......
..}...........z.... ,....~.#......(.$H[.8l..X......#J.H.....3j...... C
..I....(S.\.....0c...h..l..%...]-Cz.<;.....H.*].....P.J.J....X.j...
...`...K....h..]..j.6...K..S)f.~]{ ........L...... ^......#K.L.....3k.
......C..M.....f.KG*..p.$.9......s...........N...... _.......K.N......
k....q...L..v..%p.....m.......O...............(....h...&....6....F(...
V..mK...;..b.3*H........(....,....0.(..4.h..8....<....@.)..D.i..H&.
..L6...*.0...\.....p..W.S..O.)..d.i..h....l....p....C,..#.ly..q......*
....j....yB=...'9..#...NJi=.f....v.....*....j...............*....j....
..................J..D>......F ...Vk...f....v..... ....k...........
... .....-.\\...= ..=....=..L...'....7....G,...Wl...g....w... .,..$.l.
.(....,[email protected].../[email protected]'...L7...PG-..TWm..Xg...<<< skipped >>>

GET /9.gif?abc=1&rnd=34393770 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive


HTTP/1.1 302 Found

Server: Tengine

Date: Mon, 08 Jun 2015 15:25:09 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; expires=Thu, 05-Jun-25 15:25:09 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=f7c655f7; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=9e4191ae19d103fd53d6abd5_1433777109; expires=Thu, 05-Jun-25 15:25:09 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Mon, 08 Jun 2015 15:25:09 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=1aH8DQnb D
gCAcGK9Od5gcj8; expires=Thu, 05-Jun-25 15:25:09 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=f7c655f7; path=/; domain=.cnzz.mmstat.com..
Set-Cookie: atpsida=9e4191ae19d103fd53d6abd5_1433777109; expires=Thu, 
05-Jun-25 15:25:09 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt
p://pcookie.cnzz.com/app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8..Expires: T
hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach
e..GIF89a.............!.......,...........L..;....


GET /9.gif?abc=1&rnd=967329697 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; sca=f7c655f7; atpsida=9e4191ae19d103fd53d6abd5_1433777109


HTTP/1.1 302 Found

Server: Tengine

Date: Mon, 08 Jun 2015 15:25:11 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: atpsida=9e4191ae19d103fd53d6abd5_1433777111; expires=Thu, 05-Jun-25 15:25:11 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;....


GET /9.gif?abc=1&rnd=702683976 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; sca=f7c655f7; atpsida=9e4191ae19d103fd53d6abd5_1433777109


HTTP/1.1 302 Found

Server: Tengine

Date: Mon, 08 Jun 2015 15:25:12 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: atpsida=9e4191ae19d103fd53d6abd5_1433777112; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache

GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Mon, 08 Jun 2015 15:25:12 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: atpsida=9e4191
ae19d103fd53d6abd5_1433777112; expires=Thu, 05-Jun-25 15:25:12 GMT; pa
th=/; domain=.cnzz.mmstat.com..Location: hXXp://pcookie.cnzz.com/app.g
if?&cna=1aH8DQnb DgCAcGK9Od5gcj8..Expires: Thu, 01 Jan 1970 00:00:01 G
MT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!...
....,...........L..;..

GET /stat.htm?id=3325108&r=http://VVV.941pojie.com/&lg=en-us&ntime=none&cnzz_eid=1649022423-1433777109-http://VVV.941pojie.com/&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1844789414 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Mon, 08 Jun 2015 15:25:10 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes

GIF89a.............!.......,...........D..;..

GET /core.php?web_id=5076676&show=pic2&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 753

Connection: keep-alive

Date: Mon, 08 Jun 2015 15:25:08 GMT

Last-Modified: Mon, 08 Jun 2015 15:25:08 GMT

Expires: Mon, 08 Jun 2015 15:40:08 GMT

Via: cache7.l2de1[313,200-0,M], cache10.l2de1[315,0], cache5.de1[314,200-0,H], cache4.de1[312,0]

Age: 0

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:08 GMT

X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="5076676",c="pic2",d="",e
="online_v3.php",f="zs25.cnzz.com",g="1",h="pic",i="z",j="站&
271;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m=
"0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h="
 f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k
.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createS
criptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?w
eb_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/i
mg/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><
;img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a h
ref='" q "' target=_blank title='" j "'>" j "</a>",k.createIc
on([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: applicati
on/javascript..Content-Length: 753..Connection: keep-alive..Date: Mon,
 08 Jun 2015 15:25:08 GMT..Last-Modified: Mon, 08 Jun 2015 15:25:08 GM
T..Expires: Mon, 08 Jun 2015 15:40:08 GMT..Via: cache7.l2de1[313,200-0
,M], cache10.l2de1[315,0], cache5.de1[314,200-0,H], cache4.de1[312,0].
.Age: 0..X-Cache: HIT TCP_MEM_HIT dirn:-2:-2..X-Swift-SaveTime: Mon, 0
8 Jun 2015 15:25:08 GMT..X-Swift-CacheTime: 900..!function(){var p,q,r
,a=encodeURIComponent,b="5076676",c="pic2",d="",e="online_v3.php",f="z
s25.cnzz.com",g="1",h="pic",i="z",j="站长统计"
,k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnz
z.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" <<< skipped >>>

GET /core.php?web_id=3325108&show=pic1&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 753

Connection: keep-alive

Date: Mon, 08 Jun 2015 15:25:11 GMT

Last-Modified: Mon, 08 Jun 2015 15:25:11 GMT

Expires: Mon, 08 Jun 2015 15:40:11 GMT

Via: cache16.l2de1[1611,200-0,M], cache4.l2de1[1612,0], cache2.de1[1612,200-0,H], cache4.de1[1441,0]

Age: 0

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:11 GMT

X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="3325108",c="pic1",d="",e
="online_v3.php",f="hzs2.cnzz.com",g="1",h="pic",i="z",j="站&
271;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m=
"0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h="
 f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k
.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createS
criptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?w
eb_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/i
mg/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><
;img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a h
ref='" q "' target=_blank title='" j "'>" j "</a>",k.createIc
on([p])))}();..

GET /core.php?web_id=5076676&show=pic2&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 753

Connection: keep-alive

Date: Mon, 08 Jun 2015 15:25:08 GMT

Last-Modified: Mon, 08 Jun 2015 15:25:08 GMT

Expires: Mon, 08 Jun 2015 15:40:08 GMT

Via: cache7.l2de1[313,200-0,M], cache10.l2de1[315,0], cache5.de1[314,200-0,M], cache5.de1[316,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:4:436988533

X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:08 GMT

X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="5076676",c="pic2",d="",e
="online_v3.php",f="zs25.cnzz.com",g="1",h="pic",i="z",j="站&
271;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m=
"0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h="
 f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k
.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createS
criptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?w
eb_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/i
mg/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><
;img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a h
ref='" q "' target=_blank title='" j "'>" j "</a>",k.createIc
on([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: applicati
on/javascript..Content-Length: 753..Connection: keep-alive..Date: Mon,
 08 Jun 2015 15:25:08 GMT..Last-Modified: Mon, 08 Jun 2015 15:25:08 GM
T..Expires: Mon, 08 Jun 2015 15:40:08 GMT..Via: cache7.l2de1[313,200-0
,M], cache10.l2de1[315,0], cache5.de1[314,200-0,M], cache5.de1[316,0].
.X-Cache: MISS TCP_REFRESH_MISS dirn:4:436988533..X-Swift-SaveTime: Mo
n, 08 Jun 2015 15:25:08 GMT..X-Swift-CacheTime: 900..!function(){var p
,q,r,a=encodeURIComponent,b="5076676",c="pic2",d="",e="online_v3.php",
f="zs25.cnzz.com",g="1",h="pic",i="z",j="站长统ť
45;",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online
.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("o<<< skipped >>>

GET /core.php?web_id=3325108&show=pic1&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 753

Connection: keep-alive

Date: Mon, 08 Jun 2015 15:25:11 GMT

Last-Modified: Mon, 08 Jun 2015 15:25:11 GMT

Expires: Mon, 08 Jun 2015 15:40:11 GMT

Via: cache16.l2de1[1611,200-0,M], cache4.l2de1[1612,0], cache2.de1[1612,200-0,M], cache5.de1[1614,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:4:829866476

X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:11 GMT

X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="3325108",c="pic1",d="",e
="online_v3.php",f="hzs2.cnzz.com",g="1",h="pic",i="z",j="站&
271;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m=
"0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h="
 f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k
.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createS
criptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?w
eb_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/i
mg/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><
;img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a h
ref='" q "' target=_blank title='" j "'>" j "</a>",k.createIc
on([p])))}();..

GET /zy.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: cj.941pojie.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:11 GMT

Content-Length: 26

Content-Type: text/plain

Content-Location: hXXp://cj.941pojie.com/zy.txt

Last-Modified: Sun, 26 Apr 2015 14:12:28 GMT

Accept-Ranges: bytes

ETag: "02ed062b80d01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

hXXp://soso.hcjd56.com:88/HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:2
5:11 GMT..Content-Length: 26..Content-Type: text/plain..Content-Locati
on: hXXp://cj.941pojie.com/zy.txt..Last-Modified: Sun, 26 Apr 2015 14:
12:28 GMT..Accept-Ranges: bytes..ETag: "02ed062b80d01:751dc"..Server: 
Microsoft-IIS/6.0..X-Powered-By: ASP.NET..hXXp://soso.hcjd56.com:88/..

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:10 GMT

Content-Length: 6398

Content-Type: text/html

Content-Encoding: gzip

Content-Location: hXXp://VVV.941pojie.com/index.html

Last-Modified: Mon, 08 Jun 2015 04:42:24 GMT

Accept-Ranges: bytes

ETag: "0386783a5a1d01:751dc"

Vary: Accept-Encoding

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
...........]{s....;[email protected]../P|H..Id.6..uZ...s'.$A....$h=:.02....T/R.)
J.HK..4%...~%q.k.m.4r.8s..A.$A....sk....q......g..C?8......?...`.;....
z....&.o.=&...........0......L..h.!.&........P.....g......t...~(......
S.4z8......x.......S....]..$.H.\..Gb..@........~......H.v.(.s..G1\....
.#.h...7.8p.T7{...pb ...Q....wbn?..P\..EX-.X.Gs.....2?.....0y}"..xs..5
@.C.{4et..C&!.D.!.T..K...aODAq...}..X.:<..|}~......J. .........".0.
..W...~.r^<W..[......|'..`.....W.6.'G._$rW..*d/....x......a....#.S.
......*[email protected]>.i/..... .... /[email protected].&..b
?...(.v..b..TC....N.O.>?...m..N.qH...B..C3>C...g6x.{....!j}...w`
N...3....p.f.....;o....n6...?<z....q.".l>...q..|.B=.D..6........
..8..,.U..].g..l.8.*_.?...nt<uc..\.0B.R....-R.e........$..C....Z...
y...M.dM.\.Qt..^_..2..,[email protected].>.{..8D..a..cOQaTd_...=..........&l
t;[email protected].!.tbA..1|.21T....Cw.(2....|*...02...r..9...Z...N..."N..
..............>.C..r.a..P....%$....(7....."~......`....2...3..A....
(W/..v[..=C......G..\Bm\.g!VPi. .P.O...([email protected]*..`7..h.
...q.-.c..|?UaRL!H.vE....L......B.K<...Q&._....1"....}....J.(.W...J
....Z.1.e...P.D...`....#]....*@hA.........h.C.w`..F.\?'W.B.j..E.V.9dts
.E.hj..J..l...*..0."..).P2...72..p.e!.Rj...D$..z#.h0..:#.x..U....`....
..@e\...V...t.N.md..K..G.aE.v....l..V..2[k2{..]P..H..Xh.^[..Q..MC....g
.2.'..6v[9Y.HY.fQ1jf%.........*%e....ki)[email protected].=#I...fVu..J
..l*..z......lqhj!..QHO.J..D......Z*.-......U.....[.A9......`.......P.
m..o.&R..Y.V..Q..YU.6..bo{.J...4Gl.J.v.m.U.C3a:P#,........%^[.1...<<< skipped >>>

GET /img/gif008.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:11 GMT

Content-Length: 565

Content-Type: image/gif

Content-Location: hXXp://VVV.941pojie.com/img/gif008.gif

Last-Modified: Thu, 14 Aug 2014 07:47:37 GMT

Accept-Ranges: bytes

ETag: "80f22a494b7cf1:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
GIF89a ..........R.......!..NETSCAPE2.0.....!.......,.... ....._....m.
..PZ.D.6.N...}Q)[email protected],.....|.... ..K.v.....-yJ.R6;....Tx...Y Y5i
......i...9......F..!.......,.... ....._........PZ.D.6.N...}Q)....M..1
@.i,.....|.... ..K.v.....-yJ.R6;....Tx...Y Y5i......i...9.....|E..!...
....,.... .....`........PZ.D.6.N...}Q)[email protected].<..h..0.
d..U....Q6S..U.5..r...R9i....[....r1.a.7......!.......,.... ....._....
....PZ.D.6.N...}Q)[email protected],.....|.... ..K.v.....-yJ.R6;....Tx...Y Y
5i......i...9.....|E..!.3Reduced 73% @ VVV.raspberryhill.com/gifwizard
.html..;....


GET /img/zsf.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:12 GMT

Content-Length: 85308

Content-Type: image/gif

Content-Location: hXXp://VVV.941pojie.com/img/zsf.gif

Last-Modified: Thu, 14 Aug 2014 07:47:38 GMT

Accept-Ranges: bytes

ETag: "089c3494b7cf1:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
GIF89a..Z....9Z.(\.,e.4i.<`.Lr.Uv.Gk.Ae.:s. f.5j.;r.4k..l.,h.4m.8n.
2m.1g..p..q.5p.9q.=x.4s.;u.6x.<x.5u.:v.6x.:y.Lu.Bn.Bt.Dw.Q{.Qw.Eu.H
v.Dy.J{[email protected]|.I}.R}.C~.H..Y..f..r..v..l..w..i..z..E..L..M..Y..U..\.
.R..Y..T..[..S..\..Z..C..K..M..N..P..S..X..P..Y..M..N..T..\..^..R..Z..
^..e..a..h..d..c..k..e..l..k..q..t..y..v..`..b..i..d..j..`..k..a..s..y
.._..^..l..t..{..{..l..d..j..j..t..{..u..|..t..z..u..y..~..v..|.....~.
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..............CWz!.......!..NETSCAPE2.0.....,......Z......9....8..."&l
t;H..6....4.."...1b.hp.G...U...d... n....H...}.H...o8.e{.......=...g..
.....Si..B.=.:..P......S.R......S.2....Sw..P..v..9.(..S..-J.....r.{.8.
N...g..m.....'..-n.l;....x..l.!C.)...i.7cN.m....q&.M;.3..W...[&hh....-
<8...qos.:8.m.o.|.M.u...O.........gk..Z..'..7.pZ....^l).f.....t....
...tRC..._H$...}.zd.I.m.........N....Z....b..5....x&.g"A. d...\..A..'"
.".TcA..h.C...S......7.y..7....I..d.KF9..U*.%.O.)..\~.e.^.i&.\N...d...
!.$..cT9..`.$C...9..c.:......L.y.......L..0.h..*.h..:..".VZ)....i2...)
.........."..\.j..(..%...L"...H2......F.*,.......J.%.n.....b.".,.k".*.
.%.h....^.........,.M..$.H&......$.. . r.%...H..L.l"q...".[r.%.3.p.q2.
...S....X.1..ol.....g..../"...2"F....5.L..8..3.H....<[email protected]<<< skipped >>>

GET /img/yds.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:16 GMT

Content-Length: 33312

Content-Type: image/gif

Content-Location: hXXp://VVV.941pojie.com/img/yds.gif

Last-Modified: Sun, 08 Feb 2015 14:08:25 GMT

Accept-Ranges: bytes

ETag: "80922ab4a843d01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
......JFIF.............7copyright(c)[email protected]_2512264
_220670....x....N.0.._...u.8.% ..T..A.U...IL.d.8s...bA%.]..M.7`..L....
.a.T*.........s>/..,c....v.....`.A"..........:..1SJ....(J%.<b3..
..)>.g..P?....Q..!\.:...V.v*.sL.iA0..{.47eY...d3.s&"%My$S......\..@
P....:..FH.*.r.|[..R.$k"..`.....65.uG.....C...../..O7.W.....2......<
;...y[...... .2l......T.e..(.j......Sm.5=....E.....VM.6......&[..7/Q5.
......X.m:./..../..a..O.6`.4.U..B..... &F..h`[email protected]&1{&
lt;...\..|>...d.....~.............Q..`8..,F..u.a........nO.........
8..=..q....o.......U.......o..71......................................
...%...#... , #&')*)..-0-(0%()(...........(...((((((((((((((((((((((((
((((((((((((((((((((((((((......Z.....................................
........................}........!1A..Qa."q.2....#B...R..$3br........%
&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..........................
......................................................................
......................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...........................
.........................................................?......(.....
.(......(......(......(......(......(......(......(......(......(.....
.(......(......(......(......(......(......(......(......(......(.....
.(......(......(......(......(......(......(......(......(......(.....
.s.o.j.W.u....%..j.n.....W...}..!...4..V...y.......U....X.o...W.i.).(.
..q^D6.c....{.9.:.f. .`...io......u...l..:B...(......(....x~-f.J..<<< skipped >>>

GET /img/weihu.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:22 GMT

Content-Length: 33376

Content-Type: image/jpeg

Content-Location: hXXp://VVV.941pojie.com/img/weihu.jpg

Last-Modified: Wed, 22 Apr 2015 11:34:35 GMT

Accept-Ranges: bytes

ETag: "8017d04ef07cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.....0Exif..MM.*.......1..............VVV.meitu.com....C..............
......................................................C...............
........................................................2.............
....................................................}........!1A..Qa."
q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwx
yz....................................................................
..........................................................w.......!1..
AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghi
jstuvwxyz.............................................................
.......................?........(......Oo.|F..t....#/.]c...p]..s......
.rT.X.n=..;..^k..El&2..%:.M(E..6.OG.....P.....u7............5...F...Z.
........3..........;......_xt.ZsB..gy,..d."].....r... ...J...1..`.S.w.
q.Z''.y..m...As3.j.X.(.......t...|W.o..Y.".u.b.M....%.&.c....F...q..s.
e\. ..h$.N..N.7..gf....E^I3.?........?...x'..3..O..y....$..D"(."E..d*.
.'h....k..ni.c.,^.K..........3vJ.v...gD...$.<...../.e..iB...[.....6
.4!.n.G...........&.........s.S.M........O...3.O..#.*[email protected].........
<..c.Fx5....-...kH.R..:....rx...........gp.....q.v|.R.v[4........G.
<...-.qCu4pM..U.R].w.<6.L.q_...QNJ..c...N.o.?...M......ok3....".
..#8'.....<...".NP....I..!.wc....../....m...i~=....Guq.M.....Q.....
.......)......x..b.x.e|$f...B......^..e}{j.%B)......./\...... ..Q.....
t....d.0$...7.....e=.?[.~-..e..(......]...k.t.*..n..!.G.5... ..5....kz
.. [E.#20R...(...W....6W..3.>ZpWn....7..$...m...z....N.........<<< skipped >>>

GET /img/046bt.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:25 GMT

Content-Length: 6215

Content-Type: image/gif

Content-Location: hXXp://VVV.941pojie.com/img/046bt.gif

Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT

Accept-Ranges: bytes

ETag: "05c92394b7cf1:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

GIF89aK....!......U.......$..$U.$..$..I..IU.I..I..m..mU.m..m......U...
........U...........U...........U......$..$.U$..$..$$.$$U$$.$$.$I.$IU$
I.$I.$m.$mU$m.$m.$..$.U$..$..$..$.U$..$..$..$.U$..$..$..$.U$..$..I..I.
UI..I..I$.I$UI$.I$.II.IIUII.II.Im.ImUIm.Im.I..I.UI..I..I..I.UI..I..I..
I.UI..I..I..I.UI..I..m..m.Um..m..m$.m$Um$.m$.mI.mIUmI.mI.mm.mmUmm.mm.m
..m.Um..m..m..m.Um..m..m..m.Um..m..m..m.Um..m.......U.......$..$U.$..$
..I..IU.I..I..m..mU.m..m......U...........U...........U...........U...
........U.......$..$U.$..$..I..IU.I..I..m..mU.m..m......U...........U.
..........U...........U...........U.......$..$U.$..$..I..IU.I..I..m..m
U.m..m......U...........U...........U...........U...........U.......$.
.$U.$..$..I..IU.I..I..m..mU.m..m......U...........U...........U.......
....U......!..NETSCAPE2.0.....!.......,....K..........H......*\......#
J.H..@`.1.$...9r....7..........cI........1........Ar.^.#...A0AR....]L.
K......Ux..!#.u$ ..........-..|.`f........ )R....I./1..A.(... .R..ML..
>|.....u.HP.J....s..*3.d..&.v....FO22.N...I.0A.4........r.R........
.Q.{`..{..n-p21t'.~4....@*..o...#)[email protected]<.r.....{`..!...|
..'^Xh.5[r....K..T.r..4. .......f\X.....e..QJPa..A....GC.(".fU...mEe.Z
K.FHf|.x..A.U!.a...J,iD.bo..]P.l...@...}$.(..3.W.MK.w.w..gV...&.._...A
.EG.B....}.t...J..P..1..L`.....6....F...!.......,....K..........H.....
.*\......#[email protected]``.%.E.#1r.......(...m.(0#I..<.$........C.
..I@:I....&.....l...O.:..C.. :.......).. ........H.b.8..V..H.$G.-I.f..
.*p%).Uk....%9.Z..........:...%..,I..L.......%...O.....jw......;..

<<< skipped >>>

GET /ico/yinyue.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:25 GMT

Content-Length: 21219

Content-Type: image/png

Content-Location: hXXp://VVV.941pojie.com/ico/yinyue.png

Last-Modified: Wed, 01 Apr 2015 15:47:40 GMT

Accept-Ranges: bytes

ETag: "0761a2f936cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.PNG........IHDR.............\r.f.. .IDATx...y.%.}.......2=..p.....A.\
.E.d..%....v$..t.....$Nl..899N.....8.......(.....D.LY....A.$...g..,=3=
.....7...U........~...}n....Wu....o.P.F..5j..Q.F..5j..Q.F..5j..Q.F..5j
..Q.F..5j..Q.F......T...7P............D>..kFPc70....f.9.{}.w.5a...F
..Qc.......}n.0...f.^n.&..Q..L"[email protected].....(...
.Laj..ia..f..".7.m;.o~.c.z...3...-..juN7[...a.8.......5.5.$^...*.h..4.
./.z..........[......`.A.1...=g.{..lD.>.7.D?...~.....].XX8.xgn.q.T.
..q..%h.....7..W...k..7O=.;..=,3p.!........K.P..}.o.m.......{..'..=.C.
f.\."..w..g.s..A..Y......>t.....x......}n.\.............x.*..^.{.h4
x...[...3......7..3.'...`O..^0.....0...>..G.../.8p.....:y...}......
...h5.......6...F..B...[.P.A`..0.......o...^.....gWW.....?.kO?..g...1.
.`.w..L".L.........C.......x.}...y.....=.z.S...k..."..l.".c.....$.ZkL.
.j..".R. ...!. ....f..F...B.o]Z. O>.W..<....:..../~.k.. _..'.u.*
..1....&Y........g?.......>....gN.....C.....k..`0..... "....]3.`.A.
=.....PJ!".3p-......v.v.:.h......kO.....'y...n...._..?.[o.......l0..9.
.................w.;.E..................,.w....z.>Q...qF.5j...#...F
.A..f~A1?o.B...~.U..o}..^....$../|.........`....D..m.P&~......S...G~..
-.8.Q...6...?..?.8..%..5X[.0.......kL#D$..Z....m.,...U....o.........X[
........Wo\......^....v..Lr.9]..{....~.....5.......c..O........Z......
.8.....LA)E....m...Y:....'...g.._........o>..........L.l$.U&...E.'.
&....C......<....o....j5.._........B.-.....n............k...F..C...
...f......g....^..Y8y..O..8.|.......)5I..b7$.I..........O....?....<<< skipped >>>

GET /ico/jsq.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:27 GMT

Content-Length: 16729

Content-Type: image/png

Content-Location: hXXp://VVV.941pojie.com/ico/jsq.png

Last-Modified: Wed, 01 Apr 2015 16:03:53 GMT

Accept-Ranges: bytes

ETag: "807ae73956cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.PNG........IHDR.............k.XT....gAMA......a.....PLTE...DDD...JJJ.
..```.........222.........$$$))).....................)))......bbb.....
....   111SSS......;;;...QQQzzz...FFF.........bbb...666.........mmm...
..................................x.YZZ..q.r=..[^__.."..K..!h8..q%.W..
K..n.....D..v..?..>..N.....d..J.!....Y.x...2......A..........r..DW)
.6......|.g-..[...O..<..)....}..T..V...~.................e....o....
......... ..y;.K .....j........s........|.....h..}..........._........
.....................d........j.....t..d..f...........{..a..v.........
.............444...333.y..t....<<<.........###222===???%%%$$$
888&&&......;;;555......>>>}}}{{{|||   SSS...PPPJJJMMMzzzoooV
VVvvvsssyyy   WWW...000rrr\\\jjj^^^___[[[]]]666......HHH'''...999)))XX
XYYYBBB,,,FFFDDDNNNKKKQQQ@@@ZZZTTTmmmkkkwwwtttppphhhfffdddbbb```""".b.
.........y......>tRNS......y....7...l..B..`.M.H....}I*.g.R(.\...=.p
...2.............Q.... .IDATx..}.\S......]....k..:.u *...7.....{o;nk..
.ek.uu..UA...4..d.H.!l.{..F.$$@H..........$.Pk.......>...>...s&.
.r.pu..s.].W-....w....y.....;.x...>..EW......7.....8..~........p...
..A..[...H.{.. ..yp...[.p.d.o...p.m(.9{.v...............g/....|.......
w..M.l.n............wt......"...!$..&.......~....T..~......\s..{..][.t
&2......7...9 ..d.o..Z=...3'......{..9|....A.dh.w8..o..o....:g...|.#..
.3.....:.....}...Y.8Y.~.............i.............)..5....Z*....H{....
....7..H.\......>.sx.._[.....:..t....|.4..*...F..;V.t)..^..]x...u..
./....t..W..(.....(.......T..1)....#G.......k.. ._.......Z.l.L.u..<<< skipped >>>

GET /ico/27.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:27 GMT

Content-Length: 2536

Content-Type: image/png

Content-Location: hXXp://VVV.941pojie.com/ico/27.png

Last-Modified: Wed, 01 Apr 2015 15:17:39 GMT

Accept-Ranges: bytes

ETag: "80ab9ffd8e6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs
..........o.d...}IDAThC..yt.w.....%.XS.$v...H. .DH.[#..1..........5..5
....*..E#.....AD$...F.A.g....M.kn2G..9~.|.='...|....}.Wy...kn,l..z.>
;.P...=>>.........c..|..s....a..<L...&E.012....b.......>2\
g....k~LA........;3.(.#..L.......6...R.....$..D ,....#.......q......P.
2.....K..B.&....o..).u......&......,..|.3.z..#7f`x......[...... ....XO
$.o(-...WL}...q.XF..._p.W.20.' d[6..MS..Zo.........EM..jM..L\."...R./.
..S..KF......da..T..0-:O..y`.\....),..sI\..Q\R...C/.3..)..p...1.. ..?.
.(.:[email protected].....=..E|.......s.{...$0x]......&F......$M..S..i......
I\R..,0.4........_../,......Q'~..9..Qy..C.....Ve..'3q..OqI=.8....:..Y}
.=.%Z...[..q.r.NI.";UKZj2..R...~.....G.!.......4x/I....6d..D.0..&DV...
.h.R..Z.">...........n_....k..`..........Q$D..~...G.U....x........@
.=@./R...%..&.|.7g..M..aL9HKz0..2....g...x.}L}/.......d......o.IS.l.2.
..&,[email protected]...[h.....0he..?<..c..W..eE.;...t.Jw.
........&..[.i...0.m>.l.../O...U....6HzQR...L.....HK.N;(..h..h..h..
x}}.Z.^A...'k.....K......{M.\#..^....) ..tkM......4..k....E._...3...'.
..=.oX.K..n$.,...a)....=,.n.R..y.....%..f.-CUZ~r....D.y.".f.~Jj1=.E;..
[...|.....R....Tu.@U{w....#..e...8.....^[email protected].`...!..s..%w..
1.....^..)....'..{...9.\r...L...Kkf.9L. ..0O..BT.j......PL..<.".]..
I......>.:N....J.)...........%.<.........(..DQ....z...w<.....
:.......)...\Pt|...........b........B.....X.....w...N...qS..4...3.p...
.....'7.....Q2. .......:.v.?x....dRDP.J..mI.........VO/I..S.T..(=C<<< skipped >>>

GET /ico/qijian.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:28 GMT

Content-Length: 201458

Content-Type: image/jpeg

Content-Location: hXXp://VVV.941pojie.com/ico/qijian.jpg

Last-Modified: Wed, 01 Apr 2015 15:17:40 GMT

Accept-Ranges: bytes

ETag: "04238fe8e6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
......JFIF.....H.H......Exif..MM.*.................V...........^.(....
.......1.........f.2.........t.i....................'.......'.VVV.meit
u.com.2010:06:18 09:46:38.............................................
.....................................(................................
.........H.......H.......C............................................
........................C.............................................
......................................................................
......................}........!1A..Qa."q.2....#B...R..$3br........%&'
()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz............................
......................................................................
............................w.......!1..AQ.aq."2...B.....#3R..br...$4.
%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.....................
...............................................................?...|..
....O...<......O...<......O...<......O...<......O...<..
....O...<......O...<......O...<......O...<......O...<..
....O...<......O...<......O...<......O...<......O...<..
....O...<......O...<......O...<......O...<......O...<..
....O...<......O...<......O...<......O...<......O...<..
....O...<......O...<......O...<......O...<......O...<..
....O...<......O...<......O...<......O...<......O...<..
....O...<......O...<......O...<......O...<......O...<..
....O...<......O...<......O...<......O...}[email protected].@..<<< skipped >>>

GET /ico/jianhun.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:34 GMT

Content-Length: 8924

Content-Type: image/png

Content-Location: hXXp://VVV.941pojie.com/ico/jianhun.png

Last-Modified: Wed, 01 Apr 2015 16:52:30 GMT

Accept-Ranges: bytes

ETag: "05bb93d9c6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.PNG........IHDR...@...@.....%.......bKGD..............pHYs.......... 
.... .IDATh.mz..\.q^w.s..}..c.....A...s.eZ."Y.,.J..I...... ...\v..D^d.
.)R"..... .....3...s......} ]....75...s.|[email protected]...
.DD.PAP...".".""!.1.......JH..4M.../.h..,....q.....QUPU.P.P.}S..U.....
.......1....Sg..F.q...G........" .Q.......0...A.TE$0.SU...P.....asg..{
..j....1J*......-.D.|``...D... .%..8......2....H`.,.d..D...H....e....H
..!...2....Xc=/..(......>Q.m9.e.r>..8a.U..fffI.d'.....2;v..&...0
.!V'[email protected]....""v..K....k.Ak<c<...G.
#GO.3........ ..R.8.x(.. ...OH..". *.KYUQ.Pwm...,...%.!M........%@P.E.
...{....../...{.o=k=.....Q.'i..I...z....>0.V*.....~.v>q....f..|.
P...|..}c.(.$I..K...!{.Yc.$A..p*[email protected]....%[email protected]\
............r...I.n.Z.V..i.....{..i..(..UI..A}./.....S...\......0..XUE
$q..x...9.......(..$.|.Q...O...o...",....k. G.8eM9a...4.=o8..........=
..D.......I..s.A.6..$.U..i.......wO.RQ......v..K...8N.4.D.Y..E$.. ...K
ScH.. *j.N....n.! D%........g=.[D..4M.$^. ..H..9IA.c.x...w............
.\.z...%D..Vz.N<...../\8......./7....z.8....D.....`.E..M.(...^....|
..&.....H.-(.......8."2.%k.T..1`}...|$T`2.{6MS...{.K..V.G.O........(..
k.vs.....'N...nln.}poskk0....=....T5.si..Q.......1M...2..*..kh$R"D.O..
.(.D...O. VavD.....(.4I......y.. j.-.....Q...j5.../..........Z}zb..K/.
M..... W.....k=. ....N.A.". LSg}/...1...~.....R..="...9V.'[email protected].Ú$.
.y..|c-..s.)....he.. .c#...?....|)...47R-.1.......[_.......:22.......n
....dbr\....9o8..t.......[odtTU.;;.86......sd..F..(*.!$.D.$.". ...<<< skipped >>>

GET /ico/haobangshou.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:34 GMT

Content-Length: 11638

Content-Type: image/jpeg

Content-Location: hXXp://VVV.941pojie.com/ico/haobangshou.jpg

Last-Modified: Wed, 01 Apr 2015 16:58:33 GMT

Accept-Ranges: bytes

ETag: "80c216169d6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
......JFIF.............C..............................................
......................C...............................................
......................................................................
.R.............................!a.1AQq.."2BRS........#$Ur...%'Vst..&34
CETbc..D.du..................................>.....................
....!.1Q.2Aq......."RSa..$3.#4Br................?.....mF..."..:c..p
.T..zk.L>Ni.....m;..d......yGk.....7..3<..5.|..L{......5.|..L...
....\w..........5.|..L.......\w..........5.|..L.......\w..........5.|.
.L.......\w..........5.|..L.......\w..........5.|..L.......\w.........
.5.|..L........>.M...lxX....<t..LF....I...N..u.\.s..B...Fi.Q.$E.
NCP.F..4...^.&.,E..q...##.}[email protected].\..k.E.Tt....4.2.....,..J ...(.
..4.."...,..9.l6..Y...fBn`].WV9..j21....e.5..m.Z....w.0.....E....t....
7m.o...?..4... ...... ...$F.c.s......Q..ctiD.E...Y.F.Ad].Q..tiD.E...Y.
[.j..t-..s...<X...cu.~.j)......X..3......30LLOT3uG.=.g4D.4Y#.T.]?)1
..$i.c..;24.0Y........?L.Fdi.`.3%.].v.F....u{.=..,...:..)....8.'\...d.
M8.....O."..{...z,.6.!..K........{.......qR..8...tF...!.!b.hu% JV...x.
.7,KC..IS.Z.8..h.|&.y....R....Z.$...&.S..I..\.M.A.C..$b.c.v.BO.......7
V..QJ.J..... .:..M..X..c./3#O.....~.,.....dfF...#2p....:.T{...7.}dY..)
.6|....4_.....5...[`._s.8..X.....b.#25.,..6...Km.KZ..S....4\..w.......
.-%3. ...c.=<..QZO..jj...Fy.<<..)Kh.H.H....E.I.L@.,..[...d.8f
^..;m.x..*9e...U.Q.S...~..;.9.....,.{g.<I.....u..33.l........s.^7..
..G[i.n.......y\..0M....Y...x-.....j..rq.v..GB.bac..,.U3y.=.FS..%m<<< skipped >>>

GET /ico/wangpai.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:34 GMT

Content-Length: 174607

Content-Type: image/jpeg

Content-Location: hXXp://VVV.941pojie.com/ico/wangpai.jpg

Last-Modified: Wed, 01 Apr 2015 15:17:40 GMT

Accept-Ranges: bytes

ETag: "04238fe8e6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
......JFIF.....`.`.....0Exif..MM.*.......1..............VVV.meitu.com.
...C..................................................................
..C...................................................................
......................................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?...(......(......(......(...
...(.....M.7..v...k.[h.....q..z....8.=ej.P..5c..>g.......,5(.d.....
g.~...^.'8!H#.S.;...R..N?...&.....].JI-^....r....N....t.....~.r.....}2
:.*`....8.q..<#N*....k ...b.9.{..t....G{.m...6..i.M....GN..@.>.t
.h........j.3>/.l....f.}*4.9..\m.8S.e*..UT..S|....:he..&|.Z5 ...!*.
N...9En.m.ZI.5.....4B.I.kMBs....m&....[h...Y.......}2..9.*....|....H}W
...F...(...J0...k..g.kk.7......1q..T...../.qw...S..........m_...#Lh>
;......W.^.y..........y.. ....i>[.U.K....sJ<..w...&......;;J.k..
.g......6....^..[..].rup...I?&.c.......K(.._.i.....T.......^.A.....?h.
...jG...).s...>..7....ekl...~...<...AU.b.M%..c.......m..][......
.1....SA...{m'Ew..r...........o...Y...^6..S.u*....q.i.I......~h.J>.
.%'..U.h...q.W..._^.6..X.'....._:...-.Z.......H............8.)K6..>
i9'J<.M.-6.wv./S...vEJ...2..,-...........>..E....|C._...?...<<< skipped >>>

GET /ico/binglang.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:40 GMT

Content-Length: 12029

Content-Type: image/png

Content-Location: hXXp://VVV.941pojie.com/ico/binglang.png

Last-Modified: Wed, 01 Apr 2015 15:17:42 GMT

Accept-Ranges: bytes

ETag: "06f69ff8e6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.PNG........IHDR...r...r........}....sRGB.........gAMA......a.....pHYs
..........o.d....IDATx^..k.u.].....%.....p1.Z"[email protected].(.h
.....h0'...^Z....b!A.....\.......m..Z.u9?......=.~.......w...>....c
...~.CO...>..'z.g...w=........4=...vz..........~.........{z.K_.....
...^.u{.Q..J.3O......._.....P. ..m...7~..../.../|.......h{.Gyu....O.O.
....:=...s.....7...~.V.5=....-.g}._=..s..K_...........M........._..{.i
_..%| }..O.........o...O...{..gO?..?vK...?{.......o|...>.i...I.vz..
.=.........x. N.y.-..../....2.mn..z6....@.|......Z...........o|.....?.
....~.G..z.9'..k..........u?y.....7.~.W....W.g....|....~..\......?....
..|.[v... .7...?............g`..`s...?.9....H..oz...x_<O.P...4.....
..}....c..K..Y...<./...e...m..m[@.....n.O...}...........nxi...~.?..
......_..GN.. .....=....o..}.?..}...w...k....`[email protected]|.-..
...?..-D .k........N.l.1.....@......'@...=.>.... .y.6...D..........
..^i.....|...^...|x.k.3>[email protected]......<...>0.
.......w[i y......G.....S.9Z.......]......... .(HG.sJ...mW....p.p.2.d.
[email protected].......;......@....~....9 .....oo...... .K..R..7o4~....=..8 ..
"...!.4./.3..c.5.'.sBd...7......y.]R>x..0H....z.>.V...j..& ..gL.
.b..m.Ql..........1..w..@....... .ya..7 ..............].i..../n<d..
i..f.....1z..b.#.y....e...}..#..4y0..8....H.........v.).,....~.......g
H...."../......(.n.....v.s{...4. ....Tc._p....Vu.......'.4.g\.0I...wK.
..1......0..E..m...H......(...4..p<K....... .`.;c...Oo$..I.... m...
[email protected].....;'.#...&D....zd[..i{..ye .Z...d..=<<< skipped >>>

GET /ico/mojian.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:41 GMT

Content-Length: 16185

Content-Type: image/jpeg

Content-Location: hXXp://VVV.941pojie.com/ico/mojian.jpg

Last-Modified: Wed, 01 Apr 2015 15:17:41 GMT

Accept-Ranges: bytes

ETag: "80d8d0fe8e6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
......JFIF.....H.H.....0Exif..MM.*.......1..............VVV.meitu.com.
...C..................................................................
..C...................................................................
....x.x...............................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?.......?.S.....c.>.......
.......|#.I...X.g.[.PY..M/Kk..h....{{..........\......5..xw\...6/.7..;
.......(..t............_..f][T.`.E.S;.u...=.?.<E..C....{..4;..O....
h..3X...N..^..Z......P~....u.}.Q.>5.J....a...>.....K.[...y.7..Q.
.DU....?.V..O...M.z.(..T~..........~0.D."3..G...........,.....o..T... 
Z....w.....T.. .wI[m...m..?.U.O.......u_...T..<...B.......'...U.E..
....g...b..Ns.....n.....o.......'?....9........8.|C...#.....D).UTg^I..
}...k....\ C.I.*t........E.....S...8..>=.....>!.F.1....,.1P6e.h@
.k.qT4.YMO..?y.5e..l.z.QqJ.j.....W..ME.)...9...'n]n..KF........w...;..
........[n..[}.......v....m.........T~...q......B.....m-X...?.........
:.........O........O  ..Z...l...... .n...........<.............5G.=
..G........./.hh...W..o"...g.TX][_X..........7Vw...~#[.Z.[..[..\C.D...
&D...u.).].YA..ml.w.Wk.Z.............'..K.<!.`|S......Y...~..#.<<< skipped >>>

GET /ico/miaosha.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:41 GMT

Content-Length: 13854

Content-Type: image/png

Content-Location: hXXp://VVV.941pojie.com/ico/miaosha.png

Last-Modified: Wed, 01 Apr 2015 16:31:40 GMT

Accept-Ranges: bytes

ETag: "07eaa54996cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.PNG........IHDR...J...K.....X.......bKGD..............pHYs.......... 
.... .IDATx.M.w..e.>..2}v?...WH....A.*M....U......W,`..^.xQ..JU..Hh
!..!.$9.IN.}..3o......|....=.........E.y...F...TE^..w.........P.9.i3.9
1>.{...G..C.1.=Vq..3.X..=..rujrR'J.R.r..Y......;z.Q..$.M...7..l6.$.
..9..HU.|&/.....J#....R.q.O..(.5....Z..x..w.wFN@%..*..C.m.^k.._,.S..A4
."..,......w.-UJ.s..8..8.W....:.T.EG...5........s.......w/9.d.<-...
..|........[...Qk:1.t.`..4Co... .B....RJ.....Z=..(.9..@....~....9.....
.ag{.....I...R<.F........nJ.. /[email protected]......^....o}m....]..
Z.^.2..e3..gw.......~_.*6 n.TU]...~......=] ..`....`......B."./")%....
.3.T.r..... ...nUU%.a....s..U.H.L&.6..P.\....'....,...`L.D..[...n...7.
..%..D.RbL)...-..r.i.t.I........._.t!g...|P/.....7..k.O.u..h.f8../d...
_^y.. ..;..!@[...}K...EL..D...l.,D.#.L.......1=>699.d..t:.P.l6...R.
...&RT?.f..Z.......l:H....N...l.<..Z. ...v..h4, ..[.<_p..).R(.|.
o4..@{..][email protected]. %....h(X..s..a...P.B.T..l.R@Q....
q.(.....".)...$...-\|.........Q!..i.4.j ..9.FFt..z...!.....f....Y.g,.b
 .c0mC.(!$.Iuww....:e.PU.c.9....h.8m.RX!....g....W....?Z.?v.).:....9.`
/........B0(...z);m(..*....`*'@.E... %P..&p..Ou..*`..........AD..E...r
.t.'LU..C...N..X...y..97.j.J......vC......q.EQ....rA.....Z(.TK.d.:%iD4
L.f...&..h#a.....F.i...wd$...x.G.N]..K..v`.......$.AX)V..O4.%.k.....!H
W.\>...c.:!$a1!DJ.8N..EQ.......K.B.....0..7.\...4M.n{:...)...2]....
3!!d||....8n....|>.9....hwO..i....5}'.m........92...U.V.w\.B......8
j./.=;...tr*../.E).....{.......8x.Q.U.u...M.T...C.G..==.q.".RJ....<<< skipped >>>

GET /ico/anlong.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:42 GMT

Content-Length: 6316

Content-Type: image/png

Content-Location: hXXp://VVV.941pojie.com/ico/anlong.png

Last-Modified: Wed, 01 Apr 2015 16:21:09 GMT

Accept-Ranges: bytes

ETag: "80888fdc976cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.PNG........IHDR...D...A........V....bKGD..............pHYs.......... 
.....LIDATh..zk.].u.....q_.._jI.n.=.$d!.F......*@.pel........85..3.G2U
I%..2.L....2.O.&.[.0...!.$!..,.%..z.Z-...o.{..{....9}.!.$.cN..........
.............Sb..~.i...!`-....l..C.>.}}....]....y...... |....W....Z
[email protected]..>ei.'..1....EJ......h....C_..R...t...K.*..g4&g
t;.33.....f.Kg...x.....{...?....o.....F.=td|\....[..............j.D`fk
....f...x........ch.W>..y..D\.Bk~...W.....(... ..W......01.1.v...e.
LZC.i.3q....g...%..\....b.}.....Rm.....,%..H.........n..D.....tt...xbb
.1L......E.....|..../...k.......`.........-.\x..%..Z^.t......../....nw
?...YbF......>:=5....<h.c..[...1#...m..[>.....o.....D........
R......10..e!Eb..g.f....6.......=[......J9./..t..=.....}.......d....!.
......u.Q..\....LL..9R'..}..q.cHJ..Z.....D,D.!)!D......3&..y....I/..Xk
hMB..-CD.Bk'..-.c.d....O~........8nk4..W*.k......FC.J.\....yV.........
GQ=..(jo4|c....ba..6..S..}[email protected]}t.h.R.AP&..
.W..W.8V.MNO.|..j.T.^.....Q.Q..c...e..`..............D.X&%..g,k...`a..
...%.6f......:88...W...DW...Q...5&...j=z......D..`....5......h..M.9.h!
@...7.^&.3g.'n.|.q.8...Y..uxx.1...!..at... ..R.q.`b|...H)..R).&..(7.6.
../_..;[email protected]].....i.........h .........R.I)....mB.
f67.....C.O..=.v....Z.(...g.{..kaL.......j.....C.:../m.....q......rydl
L....E.kr.3.........l6....9.q.Ic}..F.q...7.rQ..\No.x.....C._......c.P.
..^WJ.`[email protected]......[...[....(.3..&..)....1G.....3U*..n....022....@..
eW.m{..o|p0.....  .<......\}....%@.......KY7f......'y...D0...,.<<< skipped >>>

GET /ico/tianlang.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:42 GMT

Content-Length: 79911

Content-Type: image/jpeg

Content-Location: hXXp://VVV.941pojie.com/ico/tianlang.jpg

Last-Modified: Wed, 01 Apr 2015 15:17:40 GMT

Accept-Ranges: bytes

ETag: "04238fe8e6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.PNG........IHDR.............K.......gAMA....7.......bKGD.......X.....
.pHYs...H...H.F.k>....vpAg.........]..N....IDATx...g......=3.O"..s.
.D@..."(Q.((b.Q.... ........(.@.. H.9.N.03.~.^..^...<.N.v...L.LUW.S
U.....>.Q.{....J..hy.~.....([email protected]...*Y.u%s.T.M....?_D...?v.....
wH..V%.T%O.U.P_.....-.L.......q.s.....e... %#........*...C\.......0J*.
E .....6E.$m..jCT`...R....|. .xJ.8S..E....Z..v.:f...A.8qN.n../p..2.~..
........_.._..r.~?.DJ.%O..d...HT...J.........J.=.d.6...?x}Wq..........
xX..o)Y,^....*...%.(Y&C...C.}.>N.O;....>P..T......... J.g....k.O
|..G.:...711..lg;........v.~%O.T....]A%.VQ.@c%...>...w.>.....].U
..XW..........J...d.5...J......)._.....8o...;..w*Q.*@/z..e......Db.a.H
....D?...P.b....e..D..../.*T..w........../......|.e....49AN.`.[....../
[email protected]@>.r..........C..c......Le*S.ml...=...y...z...>p....)y\.
.....>=O..y.....z%....|.ip.W.......?...I......oS....5...Zz....Z..[.
%.8............n......Mo.3\..@iJc.. ....K]1^[email protected]).2......
.wr.H..F.!...h1.(@...((....h.....4O..jQKd.....W...I.$.2H..A.gyT....q.#
. [email protected].^.5.....$...........Y.....|[email protected]..?|g..0.).;..
,.........'..)..*=o.:.|t....E...J....C.i...:.......*..w.j..*..J ..!..~
]Rk....Zh2Ca...6B.............(.!......b...%)[email protected]...(.... ..._.
...2....xA..<......xQ..Q\..N.3..Y...n...F7. .E....x1..@Q..% ..."...
.....x.D....1T.....x.....|o.2....(..&.ar...... o.....`.;A..%... .e .w.
...2N..I...M&....,....2'..r?...".....<LG...... [...C..}.].%g..,..C.
L..e.\`/{9.t. 7.g9{.@.}]..P.w.Z..e....G.<.=.e.......KJf.V2.C...<<< skipped >>>

GET /ico/daosu.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:48 GMT

Content-Length: 46598

Content-Type: image/jpeg

Content-Location: hXXp://VVV.941pojie.com/ico/daosu.jpg

Last-Modified: Wed, 01 Apr 2015 15:17:41 GMT

Accept-Ranges: bytes

ETag: "80d8d0fe8e6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
......JFIF.....`.`.....0Exif..MM.*.......1..............VVV.meitu.com.
...C..................................................................
..C...................................................................
......................................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?.....h..;...O....03.:.......
..$K.x.WH..ol..;-:.^)u.bt{m6.a_....O..|. ....`......I..........c...U.Z
.N4.ZJr.%..YV'6.:8t..%:..........rwT..si.......|K....~....E...x.P._..x
...?.j.>...2.<..kv.E.}JY.....V.s.co...$...9..q.n.,6>x.O.....a
.....#.....j..5.......k'.Asa....r..Q...4.YS.Z...j......]x...........j.
.....3....-.j#.A.Si%.....f..V.....5.j.T.1.h....:..I>i97eg..$.Ku....
Ia0...F.QJ..Wz....Z....o..'.....M.'..K..~ f.Q.l........\.C.s..~>..c
..V.;..SM......v..T0i...t.\....uRM .......O...%.,.4..y.9.8.Q....2p6..h
y.rn..v..p..zx.t.......X..&..ni(............../.....7h..m...Z..%....k=
..,...m..s.}l,,........o(rF.,G..51..X.BM.Z.u...7d...knr..B>...Z...[
V...4.....s.m[...oog.?.Ix..M..........0......q]t*...63......Q.....}.}.
]|...r_W........y$....~........O....6....k..GR.N.H/.b."4#....uJ.&.../.
.m>j.o{Y]).%f.KMo.cjR....E]m...f.Wqv....U...5?....).W..$.c..:..<<< skipped >>>

GET /ico/jisu.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:51 GMT

Content-Length: 8504

Content-Type: image/png

Content-Location: hXXp://VVV.941pojie.com/ico/jisu.png

Last-Modified: Wed, 01 Apr 2015 17:06:40 GMT

Accept-Ranges: bytes

ETag: "0105d389e6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.PNG........IHDR...N...M......\......bKGD..............pHYs.......... 
.... .IDATx..|..$Gv.9.=2.........0.H..g....Ez...*.....}.>@f...h....
H.....l.......t7....2#..=zp.............p...{.........../..$R....H...0
.l.R...."i.4..q.p..."B..).-...P..q.T.PV.<$I....Po.@.!H.H..........@
..(...A....\.=.............E........A...%...?.Y.d4....>.Q.IV.......
....$..t.........RO.....i.~h..\..... !....I...W.3IRB@`.(h.z....8h.....
P...v.m..;.M"......].@yx....._^..."Dj.q...................F7.@...@.$P.
h..:[email protected][email protected]!!..'.....%.8.>..0&...!.
"HA.(..^...vVD."o....h.EL......5.l-.Q..y....V[d.N633..s#)"J)... D..J..
& (I.&.`..QMB..x...}$B....W.C. .~r3RIdH..R..m'...V3&.=..W...a(...D.E0.
.r2.6.....$.@=.q..$v..]....G-f*....#[email protected]~i..<Y.%<.
Q]..-...'.w...DH.YE5...d5E..7.....wg.Rx. ..Wo......M[..V....Km^vl..l..
/.."..Y. ..h.%....$LP0Db..5.lN.........."bk.....Cm.....SN.Y.s.P.a...b.
.>.$..Q.....0.ZS......ek ..s.$.j.jn2-G[.z...|.G.U.G#p..Q.)Y..Y.J).(
......P)....j.........$l..5El...p. .V...u....`[email protected].$N..
..&"...q......-...:.. ...=67.@%vl5....Du.P....R.}...E\"A..8..W..K..!..
.K....Z.#%......"".!.Al..q.`.D2<1...OHE2C.#[email protected]._.iyL.&8A.-
0...E........A... .4..C@D. P...;.d.tcr. dc....w7c...Q$.GW|_.dr.b0...mA
....<...%.L..G...b..qf.5... .c`.SC.@`...1.C.V.... .<..@.,...k...
.V.DP..."...9-.:3"k....f..@8..`.....N.f..^..g\..].r6_.............sX.A
....../..[...8}[email protected]"Cc.............`5Vl.a..[...i...k`'.n.
x.....y.rG..!.p.....z..w..E(.(H.....K.?}..'.....r...k..I.((.......<<< skipped >>>

GET /ico/sansha.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:51 GMT

Content-Length: 59148

Content-Type: image/png

Content-Location: hXXp://VVV.941pojie.com/ico/sansha.png

Last-Modified: Wed, 01 Apr 2015 17:10:38 GMT

Accept-Ranges: bytes

ETag: "0fb38c69e6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.PNG........IHDR.............N.j.....bKGD..............pHYs.......... 
.... .IDATx.l.i.m.U.8....s..y..z....I..q0!..L......&..TeT.....I.....P0
......)H0a....q.....7.....H..'=..k........{.....o<}.m..{5s.5.....}.
?..~.c?./[email protected].&..h......,.....H..#[email protected] .0........
..d.........T.....3.`.?@F... ......{.y...Rw.v(...8l...O....w...s..#...
...D.<[email protected]..(.,[email protected]
.W....[p.........{,6..!._z.....~.?.G..`.....7.DX0....hD X...\..."...Cd
...#.X.Qp..'@..0 ............I...c..../K.b.....\..,......p.....|]w.%..
.. 2vP.g.{...|.3.9.....N...V6Y......... .):..>....$.\.t...........d
.)R...DQ,o].A.a....8Y^.MD5...U.>..m.................[.o..7...?|..2)
 .F..36...5k...h..lz.i.........v....,G...:....". .A.....b1J.;0@..)!.-.
$.eb5|[email protected]..~.?.}......a.wp.. ...w...?.?......,.`.!....F...
....$.A.RB].@......#.%@......X@.`Q....@^....`&0.....E33...S.. d.P.....
.........i........X..F.$..u..`%..l....=.).\.,.; ..S8....L.IY.ss.H...d$
.h4.. .%....I/{[7.....G.I.=..t....>.6.1......7v.....'..bT: ....%...
..........?......`$..^[email protected].@...^.....t.
).9T\e...!.!X.B.,D.....4Z....].@.|/..E..%_q...hw.....Fd.zF.h.]..hd....
>.&...}.C.(..,..f$I#.d2...sY...K.,..d4F O"[email protected] .
X.=...Zh.....u..!..M..~.......F........P!......|.......f].F....X..A/..
.L..iF'.Fc[.J:..H..*....YBc ...'.......<.O.#..>...'_.4$O..$I..kf
'X..Y.D....].r..?n_....y[.......I.1..H;d..7)...4e.d.j,.r...M/X1R.v....
@......7........W.6%O.T`1.....p.)......k......%..........?.gQy..).<<< skipped >>>

GET /ico/linggua.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:57 GMT

Content-Length: 4410

Content-Type: image/png

Content-Location: hXXp://VVV.941pojie.com/ico/linggua.png

Last-Modified: Wed, 01 Apr 2015 17:21:34 GMT

Accept-Ranges: bytes

ETag: "0a33a4da06cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.PNG........IHDR...0...4.....C.,.....bKGD..............pHYs.......... 
......IDATX..YY.%.U]{.sNU......m.NH...2...<d.e.C..$... ..........".
.H....>P.......B0...&8q......o...TUg.........?......:{^.hy..L...z..
......{.E.Y.L..fP ..B.........p...q.....H..fV...............|Q.F.Jf.C.
C.....>......5.b.f...ef....@[email protected]`f...}...q.r.M....On5
.jl...u.Tw.......c..3._.G.A..#..OD...s.g]..@@......#..K.. ....Bd.T..".
...c..c........uP.Y......o_..}...,{E.q.,S`...BU!o%.... -.a..*..)8Je..1
S..y/._r)..U...x.PCF....e..U.\5.Tq...5......Q.Ix.....=..ES....^3.K...y
...A...Y&...L..."q...2V.B-Q...1..4.>z#-.eKF "...s...g.Ki=..3.9.....
..M...O.F..%.*..A-.m..3....T=.{.#..(.k..S)j%[_..X.,,.C<..m..g....,b
j%.f..."....cs...N...}[email protected]?...CX9.E.m..R..1.H.d......<..U.
1Z.-.....9.Y5....IM..!3.3-TR....JZ:..u....;.?./..Q......&....b.r..PJ[.
..3. .rE.}u...E_...u......n:.r.....Y<.H..g..^..2.UV....b..:'x.LVWU.
^r'..V....bs..I....V....c...:.jwq..oU.t....[\........m.7.K..o.>..cG
1cV...............~(....;/.....y.b.Z......O.....YS..X.3.$(...(z.e..F..
....l..!...Cg...;.....c...4....H.L.>.r(4".TA~Y.>.X..}...q..GS...
]..y.`...o.m..!0...E..U..a)......[o..!K..P...I...U...A.u0.......-{.]..
.t....`Q.I.)....j.....x.m..n9~...s..,.f...V...... ......]ImSk.F...K..%
.......XL2...<=U..........:5...W..\@nIR1{..'Sbt.....r.*...T..d.....
.n.A6.....A.....).@......;\........X...WfDy)/})~....^<a.b....F.|...
....~>|.l.....P_......8..c' 8..'d...'.v.v.......h....ubfLa......NL.
7~..W.~..X.X.Bb%.6>......|..f..'..........yV?.....p.u[S.......s<<< skipped >>>

GET /ico/daofeng.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:58 GMT

Content-Length: 5777

Content-Type: image/png

Content-Location: hXXp://VVV.941pojie.com/ico/daofeng.png

Last-Modified: Wed, 01 Apr 2015 17:15:07 GMT

Accept-Ranges: bytes

ETag: "801f8f669f6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.PNG........IHDR...N...N........J....bKGD..............pHYs.......... 
.....1IDATx..\Is.Wr......n....F ..Hj..b....;b...v.........8.....\..F.9
\[email protected]].[|..bc!%.E ....BU}/.e~..k.?........J.r............/.o......
.[..C..Z....7Q..A.?..u....P ..........2~2....7......7...8.0..^....@...
N....!..J).t..!.Rz.8..\.h.w\*....(..Zk.@(..%..QJi....!.......b).7w.A..
G...g.m...b..-..P.4.@...._..e......\o`.o.$.<......0.. ..^..a.J.z...
G.}.X].-[I.([email protected]*.........[i.............O.>}..Y..RJ....8e4......
._....V>.'.=K.....k......f1>...4.T)....?......I.....RiJ..8.l.P(.
[email protected]...\.....H)..T*[email protected]!..M. L2.p-....W..,...0.RB
.....!..d.(.d!-./..J..WJM.......!%..j3.U"8c&7....r.L.v]..V*...`.n...)N
B.RJc.&.0..u][email protected]*Wl...Zi.............F.4)cR.^
..._|..._.'c.Zt..RiM..!...6.....~..rc.u].;......Z..x....y.....JQB2.[..
=..c7.-...j..L..h<z.........v..)[email protected] .......%.R.VY.....[).o.R.R.H
&q4$..&..h..SFh...a..I.U.4h!.x<[email protected].$....}.:-?R.8..$..u.
Pg9B..K(!@@iB..8.R.Z...9B.P"I.(..$....}...2.X5.....6.....Jk....!.eU...
.....b.h...J.1..A..!R..B.9.!...~Df.PJ9...[.....y ....B.m..R.Z.frY.0...
.Z [email protected]'.[ D..B(c...aPJ...1.0......y.*.....U,.....J.2..O..... .C..
M.L9U.D..VJ \...o........{......J.RY2M.;1..d<.v:S.SJ....z.57:.2h...
Mi.4.........Nm...7..b..\).-.......i....Gq.k.qJ...v...b.. )....\.:7...
[email protected]:..}..B.$....[*....Zk....B6.e.j..H|........m%.?..~.T..9.
m.0MJ.. ..N..n...z....,. 7....]..Rf.......i)E...^..lN&.......[$..C..3.
[email protected]........[...c...M..9..<<< skipped >>>

GET /ico/shicai.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:58 GMT

Content-Length: 21714

Content-Type: image/png

Content-Location: hXXp://VVV.941pojie.com/ico/shicai.png

Last-Modified: Wed, 01 Apr 2015 17:25:23 GMT

Accept-Ranges: bytes

ETag: "8043b9d5a06cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.PNG........IHDR...o...l......3{.....bKGD..............pHYs.......... 
.... .IDATx.l.g.eI.%v....O.......3.\3.....h./k6......)"C<u......Y.M
.Y...v..qpp<h.....`r..9.......0..;..._o.....X%"'"..j..j^}[email protected]...|&
gt;f[D|w....c$s.(....O.i....v...... .y<.^.O..\...)t}.V...LK=^.i...s
..B.^f.6.}.i......Q .V3.BL.d...0.N .8..u.0z[............ r<.>.z3
........................w:.9Hs..a...4;k. F......7..:....if..V......2..
...mK..r...........g/...0.]"....G......3.j.....F......$P3S%... ...... 
.....'..i.g............Zw..........oV.{[email protected]"......q./.p)uaj...bbI
.8R.]...b.....T...~.S.....O.4..=..s.K&......)..8.O4fn.......]...3..H..
*.....I.j.i.I."bf.......6.1.a..].....Qo/.......~.X...n.......3.......;
..{.....8..^....]#..........P.Y...%.M/...tiS.i..n.AV..R.eP]j.....v .UL
/u.y9~.v.P9.v{.........k.B0#2.Uy\.T.Q..a....)H$r..-.........'#...?....
........d......LD........O.b...2N.<..%m.~.......`....8./...j.c&.UYk
_..r...m.7.<P)........*..........N.k9V.S....w..A.;....2...B..l....R
.a.]...B....-..FN ...p.W..'.....d.......r........f.7.$....d....@ .k..&
lt;..Y.S.o...L.`A=....1....'..D3.d.......Z.}..o7..._.i>J...S..<.
_...uz.v.~.r..j.YG.S....R8/...m.m..V....^O.8..!. 5..5..n.._.....|5..?.
....o...[..h.c.v.....-o:. f"...DoU......0..x9.%wq...n.H<..Jy*.....j
.H|aY.>....Z`"|....lv.h.a.&]Z....p....M.z............F...h..r..K..g
..f......z........,.....8$a2W...F..&.........V.2._..Mv..7..u.h.j......
....9..f.}....B..j.s.9.. .I!.........G...#.@6(&..Ye.I .kMn..Fxt..gp...
Ib..-.C..%...D..lvq..J 7.e.R.h........m..p...|.lQU...fd...L.....2.<<< skipped >>>

GET /ico/longshen.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:26:00 GMT

Content-Length: 45212

Content-Type: image/jpeg

Content-Location: hXXp://VVV.941pojie.com/ico/longshen.jpg

Last-Modified: Wed, 01 Apr 2015 15:17:40 GMT

Accept-Ranges: bytes

ETag: "04238fe8e6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
......JFIF.....i.......0Exif..MM.*.......1..............VVV.meitu.com.
...C..................................................................
..C...................................................................
......................................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?...(............?cO....s..&l
t;3...g.......U.?V....~.Y.x$...GV.........s......k>....{"Z.x.R...k.
v.).......shRr.W.._.|... .h../.......nu.......#g<7.q.O.g.o.g.......
..]x{..x&.....F.3....Nx.[.B.....O.......S........`........~...^..].e..
.>6.K........W>&.y. .^I...g.R....W,{/......?jo.9_....y>"...GE
.w...........7.......<..........Yv_r$........nW..g..'.Q...3.Z......
...Q....]...!...?jo.9O....y>"...........V.....^_?.K....6.|*.]v{.?..
._....7.......<...........u..........~....9.......O.^O.....w.....oM
^....?.?..?jo.9_....y>"...GN.....RIYh....k.....W.....O.....w...,./.
..5..M..G ......'._.h......]..................../..4t]..{....A...a.S..
............:......e. .........~?...........}.........X~...r......|E..
......ae.}.?..?jo.9_....y>"...GE.w...........7.......<..........
Yv_r..k.....W.....O.....w...,./...5..M..G ......'._.h......]...!..<<< skipped >>>

GET /ico/tianxunzhe.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:26:02 GMT

Content-Length: 44659

Content-Type: image/png

Content-Location: hXXp://VVV.941pojie.com/ico/tianxunzhe.png

Last-Modified: Wed, 01 Apr 2015 15:17:40 GMT

Accept-Ranges: bytes

ETag: "04238fe8e6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
.PNG........IHDR..............X......sRGB.........gAMA......a.....pHYs
..........o.d....IDATx^.....g..kp..wVVV.l.m.l6...... ......N h........
9.9_..|Tz.d!!.3.s........o.{?......]...W_a.........7.`...N.}..a...R...
g..m..!;;;..=.~......6lp..../.u.V.../.p.si..-.uX..Y.Z..5...[.o........
._~...}...._.>..k..... .b..|...X.j.V.^.5k....Z.n.a.._.Dq.xU.*~.x.{.
...3.=W..n..D)....>...........>p .....G..O?...c....a....Tq..U. .
...qI..=.....8 ...E..."L....&.....iS<..=.dS.uX.....,.R......[..l...
.,X...... ....3..H>Q..../Tm..F....~{X....bVR.*....E |...q7.9..Y.f..
..2g.....Eoja.!.D.V./.....{[email protected]...@....
c...M...Md..Z.V.c.....ON?...a...J...c.... Q....LB.1i.$.S.Lq.....J.T..C
.$.....v...Z.|..?..:...Y..@...$J.T.X.....1z.h.}..EVV../^.,F...J.(j....
..l....uX.k.4:.....j..Z*..E-\...F.B..W/...%K.=.H4.{.4........a....D..8
W..r..veT#F.@..{w.....`..T{...]..w.D_zX..w....[...Ae......d........z.e
7.......I.e.uX.G..(.e.2. ..Q....t...$Z.......d.(..:D..2..K........D...
..@Wu....._...../.e.*9\."@..... *X..rX..R\. [email protected].....
c..K.0....X9:H..9|[email protected]...^[...............S..w.w......DE...r...R.C.
..j.`....&...d.w.GZ^..k]:.Z..C..@2x.]:..._.:....~..0W.q<....._.,.V[
....u..z..|.j5>X....k..r..eX.d)./Y......g....?X.... ?...k...S.K...n
.?m.....CcN..w...a@..,U.o.>...6..........O..u..5k..>d./....0m.lL
.4...da..!....z.......G.......;4F..........M.S....={tA...1`[email protected]...
....mX.r...]......].A. h|`.?........3.0 ."i?(.Q.}..'X.V .....1m.Lde...
.#0l.@....}..E.....U.t.HG....U...E.'.....(..Z.\..)..U.5h.|.o.2...*<<< skipped >>>

GET /ico/lingfeng.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:26:04 GMT

Content-Length: 12122

Content-Type: image/jpeg

Content-Location: hXXp://VVV.941pojie.com/ico/lingfeng.jpg

Last-Modified: Wed, 01 Apr 2015 15:17:40 GMT

Accept-Ranges: bytes

ETag: "04238fe8e6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
......JFIF.....d.d......Ducky.......G......Adobe.d....................
......................................................................
......................................................................
......................................................................
...........!1A..Qa.q"....2B#..$.Vv...Rr.S..eu..b.3C.....%....4fW......
.....................!1QAaq."R.......2Br...s.....#St.b.3%...Cc.$T....4
5............?....L/W.F\....f.o..AvT...........'8.R..'H.......x.Sr...E
....Q.......3..Rp..:.* .6!....~Q..9...>.5\.~#u.......Ls..[...$.....
.n.:.!.Vhp..5F....V...W...2z.......8....].....!................4......
E..?|.....2z...._0.q.J....L.G....^....={q.j.2.q.F0k..3...?{.....2z....
_2.q.J....L.[.C...._.'..?-E./..4..]....|.~..w..d.....|.... .[..3.o.`..
]...=yq.j.2.q.F0K..3.o......~..........x...u.&z-.,............./..4..]
....|..{....2z...._2.q.G.%..........._.'..?-G./..4_.]....|.>..w..d.
....|......n...E...{....2z....>e.....[..3.o.n.."........O.a.Ou7....
LK...q.....>\..i...OqX.0....f.....id#.....G.g.....JiG..:.G..W..vE..
...~.*..oV..k.z.Lj.j...iq..m..!C..Q..T*$..7..P....6...4.....X........6
..2..w...4JkK.........][email protected].....%I$zS...{..r;.....^h5-[...u`s..
....&.....;.cQ*.V...Q.`G..RIN.:.B.....#..&.X..7Ei8!F.QZJ...QZJ...P..!F
.QZK........=* H...*... :T-!...P..B..B.....Gi$...Gi ...F.;I......^..A.
....rNB......T".d.Je<.}.G...T....hu*.b...Gi..7V....]-....Jl.z......
...N.6.^].....V9.:..i.).....@.,i.\.ot.p.....N..#......P..MA.%..mV.....
.gS;.W}y...m....\"V........,...D...$..d}>...K...qi.......~S.}..<<< skipped >>>

GET /ico/longtian.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:26:05 GMT

Content-Length: 36268

Content-Type: image/jpeg

Content-Location: hXXp://VVV.941pojie.com/ico/longtian.jpg

Last-Modified: Wed, 01 Apr 2015 15:17:41 GMT

Accept-Ranges: bytes

ETag: "80d8d0fe8e6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
......JFIF.....H.H.....0Exif..MM.*.......1..............VVV.meitu.com.
...C..................................................................
..C...................................................................
......................................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?...(............?c?....r...3
...k.......U.?V....~.Y.x$...GV.........s.......g.^....K[...Z...xj...~.
...._.WO.s^..|y.w.{.....YG.?..1...<...z.G..u......o.Z.y........<
....r..........m.^.jZ..I.E.z...k..C.o.....H..qus.i'.B.......p..S......
...~?................7.......<........o.].N..i...7.A[.......^..q,..
.g. s.x....i#.....P....\.N......7N..$'Q&.Nr...'$.)(.F-.:.u.!...... ...
*b......xb.a.s...k....(.*Q..R.}.'RQP.Jrjq........,-.[..=~.~2.,..f.....
t..st...m/O...!...V..._.&.b....)x.....C.........#...`(.wn.3..rs...V.;.
.c.)....9....2....~.....(.jI.9.n..a.%....3.[#.3..C....<...N......kK
.....5j....|..O....4.^..|M.....hi|...T....-..e..W.&....(o............X
.xu.n..R..(..IS.....15...X.T.WQ....C.. .[.~...|k...9.....{...b3.F^.b.^
*..T.<.....x...l.X.....9(..|}...I,,4.t=*.._...|j.V.{3@...]N....\...
Qqwo.E.=...O-|....O._..<.b..`....3.B.n...GN4....y....d..I.ow(..<<< skipped >>>

GET /ico/xgz.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:26:09 GMT

Content-Length: 9106

Content-Type: image/jpeg

Content-Location: hXXp://VVV.941pojie.com/ico/xgz.jpg

Last-Modified: Wed, 01 Apr 2015 15:17:40 GMT

Accept-Ranges: bytes

ETag: "04238fe8e6cd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
......JFIF.....&.&.....C..............................................
......................C...............................................
........................|.|.."........................................
.J...........................!."1AQ.2aq..B..#3br.....R.$%&CS.....45cds
.....................................=........................!.1.A.."
Qaq......2R...B..#3Crs.................?...............W.'u.v..-......
.z.#..}s..MZ.L.j. ..#$...X..W).... ..B..."T..w..qI...YI.A!P...P..d$...
:.7.2.....w.\...&..c.Rq....s...1)......._....c....A'f..zD."..fU.,!....
..7....z....Vz]...|C.A..)k.M....MJ2....t?08..../.%5...$.q........~.V..
..N.}}...i.|..B.. ...|[..<....A...l...{...8v.s........(.g..j.......
...g..ki=S....v..t....T.....!n...bpdH#........]..Km4..g....z.|...[kMe-
.Q..VK4...J./..6q..r.H....D*FT....)m....j...r.......7.S&.\.j*.:.l..7~w
.?.y..../O.KU]w..D........K&..fM...T.`..-... .l..."...X.b...1KQ{......
..E;B..^..a.$m....D......]'q.....^..b.4...S.0.....F.0...K2.wg.:9.Y8...
.A...y3b....2.Z.{u:..s..g.K,..g#f.....kP...*N?. ...&..Uu2..5.P<... 
.=...%..U.Rz....Rcfy...0...t.."...w.&.FFv........8.rx!.nNE)....T..T..-
U.D...d. ..8........>...'..k..:..w............k.\?eBbH.......1...=G
.}L...(.T.....)2/.j0...3..u....^.Ax.M_CA;...P........D.~Z...._m.x).0. 
..........YH....,./OkT.........{\.K...Q..n.I....7..7....p..T..9.F....l
....u0....2.. d.~..|.o.6.s..i:.e.....{K-U[.;.{4..L../X..`'xli_......ST
;<v.....g.X..... ..#.../n.T....B..S......{.....>......t......OP.
0..'X.......*q........R...&.j.....6>x.|5...Q\..S@D..@8>a....<<< skipped >>>

GET /stat.php?id=3325108&show=pic1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s85.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Date: Mon, 08 Jun 2015 15:25:09 GMT

Last-Modified: Mon, 08 Jun 2015 15:25:09 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache37.l2de1[789,200-0,M], cache3.l2de1[790,0], cache1.de1[789,200-0,M], cache5.de1[791,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:1:802275853

X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:09 GMT

X-Swift-CacheTime: 5400
4aa..(function(){function k(){this.c="3325108";this.R="z";this.N="pic1
";this.K="";this.M="";this.r="1433777109";this.P="oz.cnzz.com";this.L=
"";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnz
z_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};th
is.la()}function g(a,b){try{var c=.[];c.push("siteid=3325108");c.push(
"name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referre
r));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.u
serAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math
.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&
")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURI
Component,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),
this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),th
is.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),thi
s.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i fai
led")}},oa:function(){try{var a=this;e._czc={push:function(){return a.
B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{v
ar a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<
;a.length;b ..1104.. ){var c=a[b];switch(c[0]){case "_setAccount":e._c
z_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1])
;.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPa
geview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undef
ined"===typeof e._cz_account||e._cz_account===this.c){e._cz_accoun<<< skipped >>>

GET /img/pic2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: icon.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 431

Connection: keep-alive

Date: Mon, 08 Jun 2015 02:59:10 GMT

Last-Modified: Thu, 12 Feb 2015 08:15:09 GMT

Expires: Tue, 09 Jun 2015 02:59:10 GMT

Cache-Control: max-age=86400

Accept-Ranges: bytes

Via: cache61.l2de1[0,304-0,H], cache6.l2de1[0,0], cache4.de1[0,200-0,H], cache6.de1[0,0]

Age: 44758

X-Cache: HIT TCP_MEM_HIT dirn:2:948705605

X-Swift-SaveTime: Mon, 08 Jun 2015 02:59:19 GMT

X-Swift-CacheTime: 86400

GIF89aP.........eee000...........................e...00...0...........
.......................................!..Powered by AFEI.!.....S.,...
.P......` .di.h.....p,.tm.x..|....a..._..1i,...&3.\2...v{.-...xL.s.g.b
-h...5......;.=g......".......m......................m..............."
.........................".......m..............."..w.....u.n..m......
....".....H......*.Q.....#J.H.b...3j..Q... C..I......9.\)b...0c..I....
8[........;HTTP/1.1 200 OK..Server: Tengine..Content-Type: image/gif..
Content-Length: 431..Connection: keep-alive..Date: Mon, 08 Jun 2015 02
:59:10 GMT..Last-Modified: Thu, 12 Feb 2015 08:15:09 GMT..Expires: Tue
, 09 Jun 2015 02:59:10 GMT..Cache-Control: max-age=86400..Accept-Range
s: bytes..Via: cache61.l2de1[0,304-0,H], cache6.l2de1[0,0], cache4.de1
[0,200-0,H], cache6.de1[0,0]..Age: 44758..X-Cache: HIT TCP_MEM_HIT dir
n:2:948705605..X-Swift-SaveTime: Mon, 08 Jun 2015 02:59:19 GMT..X-Swif
t-CacheTime: 86400..GIF89aP.........eee000...........................e
...00...0..................................................!..Powered 
by AFEI.!.....S.,....P......` .di.h.....p,.tm.x..|....a..._..1i,...&3.
\2...v{.-...xL.s.g.b-h...5......;.=g......".......m...................
...m...............".........................".......m..............."
..w.....u.n..m..........".....H......*.Q.....#J.H.b...3j..Q... C..I...
...9.\)b...0c..I....8[........;....

<<< skipped >>>

GET /img/pic1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: icon.cnzz.com

Connection: Keep-Alive

Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8


HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 428

Connection: keep-alive

Date: Mon, 08 Jun 2015 07:39:10 GMT

Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT

Expires: Tue, 09 Jun 2015 07:39:10 GMT

Cache-Control: max-age=86400

Accept-Ranges: bytes

Via: cache3.l2de1[560,304-0,H], cache37.l2de1[561,0], cache4.de1[0,200-0,H], cache6.de1[0,0]

Age: 27961

X-Cache: HIT TCP_MEM_HIT dirn:6:814361188

X-Swift-SaveTime: Mon, 08 Jun 2015 07:39:10 GMT

X-Swift-CacheTime: 86400
GIF89a.......f..3...33.......................................!..NETSCA
PE2.0.....!..Powered by AFEI.!.......,.............I........08bX....d.
n...CS.3......_..`..H..H\8....)...S.b.UX.....(...r.L....tb]&"......#..
.o.V.a..D..o.V.a..........D..o.V.a..........D...........!.......,.....
........I........08bX....d.n...CS.3......_..`..H..H\8....).:[email protected]...
x ..........D.| .#.u.a....n~D..[....n..........D..[...n..........D....
.......;HTTP/1.1 200 OK..Server: Tengine..Content-Type: image/gif..Con
tent-Length: 428..Connection: keep-alive..Date: Mon, 08 Jun 2015 07:39
:10 GMT..Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT..Expires: Tue, 0
9 Jun 2015 07:39:10 GMT..Cache-Control: max-age=86400..Accept-Ranges: 
bytes..Via: cache3.l2de1[560,304-0,H], cache37.l2de1[561,0], cache4.de
1[0,200-0,H], cache6.de1[0,0]..Age: 27961..X-Cache: HIT TCP_MEM_HIT di
rn:6:814361188..X-Swift-SaveTime: Mon, 08 Jun 2015 07:39:10 GMT..X-Swi
ft-CacheTime: 86400..GIF89a.......f..3...33...........................
............!..NETSCAPE2.0.....!..Powered by AFEI.!.......,...........
..I........08bX....d.n...CS.3......_..`..H..H\8....)...S.b.UX.....(...
r.L....tb]&"......#...o.V.a..D..o.V.a..........D..o.V.a..........D....
.......!.......,.............I........08bX....d.n...CS.3......_..`..H.
.H\8....).:[email protected] ..........D.| .#.u.a....n~D..[....n..........D.
.[...n..........D...........;..<<< skipped >>>

GET /wpa/images/group.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pub.idqqimg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Cache-Control: max-age=2592000

Last-Modified: Fri, 12 Apr 2013 09:22:21 GMT

Content-Type: image/png

Content-Length: 1827

Keep-Alive: timeout=60

X-Cache-Lookup: Hit From MemCache
.PNG........IHDR...Z.........w.{'....PLTEV...dE)r.Ip..........F.......
.F..Kyy...r.....~E ......m..c..........d3.....S.....r...S1...#.....c..
......A..l3....d.............ynvc......"..][email protected]..............&..I
...\BH.....................rHh........z4$...X..0.....R.....s@6...{RL(.
......Xs.y......S........%.........vb...4......bW...[%..........L..t..
s..c>'...2..............wsw..i.............yM...WwaR...?-.fU...~K;.
`H...t..V..:..d...........h/#.......Z74..........pt5(...K...vb=......l
M.........N.kr......I A............pVs..k.....f'.p.....c..%...SG.J;..r
6......fBr..o=5...T..J...jB......5.....|......n^....XLm3#......y.f.}X.
...]6...,y....8..........q.D-Mt....^* z= y>#.dK...^...........>.
.s..J..............B....q...................xy...'..t.....7..M...~Re..
......s: .K(.rP`)..^=.........3......G:V......WE..2.....pHYs..........
.......IDAT8....T.U...lCs..It.....5r,*....I.K.].5p.d....2.4Fw.m}.....e
.v7r.........S.D.IVR.&.....y8G;.................N.r...9.t......p9.....
].......,Ko..i.......Mh.|@..hyw..9...n..qo-....C.....s.fpo..:{..vtQQG.
.......'..zmr.......H...m.u4.;..t...7....C.........a...?....{)...W..4.
..u......(....l..Q.|......R.u.3K.;.!..}vy([.e.~YhG[^. y......C...<.
...~.<-^I3......$..B....z...?$......u...S.7....qF$?.wF..G..lkC#...=
...A...C.......#x...Ea.yvS(..P..e..2..*....yD]]d.\.....{..h.....5.UK.@
J....ux7...>5.H_....}...T]2x,EO7SEmf.6.u:sk(..4...-.,...o6;B...Me. 
.\..._.]SSs..._....?g.,.x.$.tL...)..u.<Mv`4..Q<QiU.1O.X%......q.
.-.w.h... **.....e}..E...'...51t...0...0v....)^1.'.^..U.u`| 3.8l.)<<< skipped >>>

GET /static/common/images/zhanzhang.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: zhanzhang.anquan.org

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx/1.1.19

Date: Mon, 08 Jun 2015 15:25:13 GMT

Content-Type: image/png

Content-Length: 5075

Last-Modified: Wed, 03 Dec 2014 14:46:30 GMT

Connection: keep-alive

Expires: Mon, 08 Jun 2015 15:25:13 GMT

Cache-Control: max-age=0

Cache-Control: no-cache

Accept-Ranges: bytes
.PNG........IHDR...|.../.....!.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:12842C66B96C11E3B1D2FC24
D7F17EB2" xmpMM:DocumentID="xmp.did:12842C67B96C11E3B1D2FC24D7F17EB2"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:12842C64B96C11E3B1
D2FC24D7F17EB2" stRef:documentID="xmp.did:12842C65B96C11E3B1D2FC24D7F1
7EB2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.......GIDATx..\.t.......! K..... Bd., ..,.
.........r.xT.*.[...*...ZE.E.., ..a..v....v.^.7...7....d...=gN.Y.....{
..L..5~Wo"..[.E..,...{..~............4I.\.E1.$.=.5..~....<.^...Q...
^.R.s.....:....DJ].7_.Q......Q ...C*....MX.......v..no.......g.fl"....
.S%MJ'.w...y... c..F...{.cg...'Z.-i...5...K...K$=...IU.........FT.b...
......Q)..O.L......D..K..~<H.;7......jS..U...9....QR%AI...T"*w..{..
B...............I{........g;|..8..g...".T....a..>.`.a).^Y^t-..fE..n
...........E...-......`.....q...C.&0!....r.........(.H....8~..kk.uI...
.QY.m...o.IZ.E....Kr.|..eP...V.]...n..\n. ht...G..i;..k.3..SPb.{..<<< skipped >>>

GET /click.aspx?id=460737107&logo=1 HTTP/1.1

Accept: */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:19 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Type: text/html; charset=gb2312

Content-Length: 1777
..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(
endstr==-1) endstr=document.cookie.length;return document.cookie.subst
ring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.
length;var clen=document.cookie.length;var i=0;var j;while(i<clen) 
{j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=d
ocument.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..functio
n cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*360
00;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz
=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie
="cck_lasttime=" yesctime "; expires="   y_e.toGMTString()    "; path=
/";document.cookie="cck_count=0; expires="   y_e.toGMTString()    "; p
ath=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_c
ount");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y
_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctim
e "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count
=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var
 yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' esc
ape(document.location) '&color=' screen.colorDepth 'x&resolution=' scr
een.width 'x' screen.height '&returning=' cc_k() '&language=' navigato
r.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('
<a href="hXXp://countt.51yes.com/index.aspx?id=460737107" target=_b
lank><img width=20 height=20 border=0 hspace=0 vspace=0 src=<<< skipped >>>

GET /count1.gif HTTP/1.1

Accept: */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 715

Content-Type: image/gif

Last-Modified: Thu, 07 Apr 2005 17:25:22 GMT

Accept-Ranges: bytes

ETag: "02d4c7963bc51:38c2"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Mon, 08 Jun 2015 15:25:20 GMT
GIF89a.....~........n...............................B.....x..[.....(c.
...........................RS....wv...................Y.....~{....'...
........|........A.................ie.Z[.__..g.M.................v..sr
.`^.....................................>{.............&r....'.....
.........F......g.O.....lo.^..jj..........NN.............n...s........
.........m...................S..$~................!.....~.,...........
.~......stY..i..E@Tr9]9x~SM.4[z).V.R~JK*..W:0...0..nmA5&..Gy..%..^a?\.
11D>..k-...-%3NC..=d(.~Hg...L:3?o...}..~Ol....w4p}}(. .{.@.<.8..
..l(..p0a...<^....N...5L..1.....i)[email protected]`0B...!.....!..;.`P..A.5.
D..Qf...;. pa!...f..2b"......`A....8......R.M.`..F....(>`.. ....N.x
.HF...jx.s.F.1...H2.....#....;HTTP/1.1 200 OK..Content-Length: 715..Co
ntent-Type: image/gif..Last-Modified: Thu, 07 Apr 2005 17:25:22 GMT..A
ccept-Ranges: bytes..ETag: "02d4c7963bc51:38c2"..Server: Microsoft-IIS
/6.0..X-Powered-By: ASP.NET..Date: Mon, 08 Jun 2015 15:25:20 GMT..GIF8
9a.....~........n...............................B.....x..[.....(c.....
.......................RS....wv...................Y.....~{....'.......
....|........A.................ie.Z[.__..g.M.................v..sr.`^.
....................................>{.............&r....'.........
.....F......g.O.....lo.^..jj..........NN.............n...s............
.....m...................S..$~................!.....~.,............~..
....stY..i..E@Tr9]9x~SM.4[z).V.R~JK*..W:0...0..nmA5&..Gy..%..^a?\.11D&
gt;..k-...-%3NC..=d(.~Hg...L:3?o...}..~Ol....w4p}}(. .{.@.<.8..<<< skipped >>>

GET /css/style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 16918

Content-Type: text/css

Content-Location: hXXp://VVV.lszwg.com/css/style.css

Last-Modified: Fri, 25 Jul 2014 01:50:28 GMT

Accept-Ranges: bytes

ETag: "0a3acfaaa7cf1:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:11 GMT
/* CSS Document */..body{font-size:12px;font-family:Arial, "....";back
ground:url(../img/bg.gif) #6483d5 bottom repeat-x}..*{}..form,ul,li,p,
h1,h2,h3,h4,h5,h6{margin:0;padding:0;font-size:12px}..ul,li{list-style
-type:none}..img{border:0}..a{text-decoration:none}..a:hover{text-deco
ration:underline}...blank{clear:both}...dashed{clear:both;margin-top:3
0px;height:10px;border-top:#ccc 1px dashed}..#header,#menu,#center{mar
gin:0 auto;width:960px;height:100%}..#top{margin:0 auto;padding-right:
16px;width:944px;text-align:right;color:#fff}..#top a{color:#fff}..#he
ader{margin-top:5px;height:70px;background:url(../img/top.png) 390px 0
px no-repeat}..#header a{display:block;margin-left:55px;width:215px;he
ight:70px;background:url(../img/logo.gif) no-repeat}..#menu{height:48p
x;background:url(../img/bgheader.gif) bottom no-repeat}..#menu ul{marg
in-left:35px}..#menu li{float:left;height:39px;width:97px;background:u
rl(../img/bgnav.gif) 0 -39px no-repeat}..#menu li.active{background:ur
l(../img/bgnav.gif) 0 0 no-repeat}..#menu li a{display:block;padding-t
op:17px;height:22px;text-align:center;font-size:14px;font-weight:bold;
color:#345602}..#menu li a:hover{text-decoration:none;background:url(.
./img/bgnav.gif) 0 0 no-repeat}...leftbg{padding-left:8px;width:952px;
background:url(../img/bgh.gif) 0 0 no-repeat}...rightbg{padding-right:
7px;width:950px;background:url(../img/bgh.gif) right 0 no-repeat}...co
ntent{...width:944px;...min-height:800px;...background-color:#fff;..}.
..banner{margin-bottom:10px;height:215px;background:url(../img/ban<<< skipped >>>

GET /img/miaosha.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.lszwg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 46434

Content-Type: image/gif

Content-Location: hXXp://VVV.lszwg.com/img/miaosha.gif

Last-Modified: Fri, 20 Mar 2015 12:33:36 GMT

Accept-Ranges: bytes

ETag: "010c815a63d01:5b4"

Server: IIS

X-Powered-By: WAF/2.0

Date: Mon, 08 Jun 2015 15:25:12 GMT

GIF89a..(.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............................................q.-]..E]h.Z!\.Z!..-].....
..P0#..h.Z!!..NETSCAPE2.0.....!.......,......(..|6z....$.3..,3.(\.,c.-
^.=G.3k.4q.z<.M..^U.Ae.uF.jR.}z.rw.X\.LX.Mk.Gq.a\.jP.ql.jx.=..y..v.
.K..J..J..K..X..W..W..^..d..k..s..x..j..h..i..e..x..v..u..{..z..l..d..
m..t..u..x..........B.%V.0l.|w.q[.yq..../..11.2t.<G..8.L..O1.u..q3.
L[.W[.Vz.mZ.jw.OO.nL.ff.j{.ww.?..V..w..k..G..Q..c..l..q..g..i..r..y..\
..i..i..w..j..g..t..y..y..k..s..y..;..X..^..m..l..w..}..|..x...z..X..p
..Y..w..}..3..4.....1...../..S..r..Q..m..N..e..C..x..... ........P....
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /sa.htm?id=261222598&refe=http://soso.hcjd56.com:88/&location=http://sky25145.hbgyzs.com:83/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://sky25145.hbgyzs.com:83/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count26.51yes.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:24:49 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Length: 0
HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:24:49 GMT..Server: Microsof
t-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Co
ntrol: private..Content-Length: 0......


GET /sa.htm?id=261222598&refe=http://soso.hcjd56.com:88/&location=http://sky25145.hbgyzs.com:83/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://sky25145.hbgyzs.com:83/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count26.51yes.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:24:50 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Length: 0
HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:24:50 GMT..Server: Microsof
t-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Co
ntrol: private..Content-Length: 0......


GET /sa.htm?id=261222598&refe=http://soso.hcjd56.com:88/&location=http://sky25145.hbgyzs.com:83/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://sky25145.hbgyzs.com:83/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count26.51yes.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:24:51 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Length: 0

HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:24:51 GMT..Server: Microsof
t-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Co
ntrol: private..Content-Length: 0..

GET /cj.txt HTTP/1.1

Accept: */*

Accept-Language: en-us

If-Modified-Since: Thu, 01 Jan 1970 00:00:00 GMT

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: jc.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:12 GMT

Content-Length: 12753

Content-Type: text/plain

Content-Encoding: gzip

Content-Location: hXXp://jc.941pojie.com/cj.txt

Last-Modified: Mon, 08 Jun 2015 01:28:40 GMT

Accept-Ranges: bytes

ETag: "094f5728aa1d01:751dc"

Vary: Accept-Encoding

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
...........}i..8...n..Cn 0.....J..H...0..‡.*...y..*...?.......8..w..
A.....`.IV.b...../Z..)cYL.T....c...{.".d9A,....n..][email protected]^,...7..j
T.N..<4.|.........]].(..g............Bu..s.U......r.6IBNT....../o..
...3...Y=O...T.%.K.{..mx<&...6j#hp$.....>..7B]j....l..{]JAPW..s.
..[#...A.|s`........y..e.f..;..w.d.>...w...._.C.... ......R..^.... 
........97...DV.d^.n........W0-.%j..h..i\.&9....#.{..e.U|...K=........
..4u.}..J...d..........=w..#.{.(..}.h)>...u.F.3...".5.......Q......
.p.z......H.zn.......i....}..>...vJZ.........a.........k...,/H4 _.i
....\7 y....-.f@.*...F...hNw.....&c$..(.......P..}4..V....]...G.\.8#.M
q.jGr..8......r....x<3h=....v.../.....R..f......\....c..A.....I.ah.
.............i....!..R....4.K.syl].{....@).[Li.....A..>........q0$;
uz..j#%/...O.2jcw..LWO...B.}.T....C.d.I.,f5.<2..aD.......So.(..=...
.S...Q..o.*...5.{.R....\.</.._.]m...!......5'.(.^..L5G.#.v.W.Kt.0..
.T..S.Q..H...Z.<T.XA]h...B..jwg.N).......).}X....G9qJ.mU.&...q<!
.$. ;yH....tM.=..F.H4.?x.....F"<.....#.v7.V.R......S.Ca...B..l....I
....$.[K*]p....yh.....L.....8.4.].v=.m*Z.......,k...VP.?wa..a........|
2`R..w.....e.....7."wJ.)>..{.>.....j.$../6=~._.6<=.....,.....
........Z..6F|.P.Pi..S;.IM0.V....AWj....K...g..>.#....\...no.=\g.4.
[email protected]..*Hu_.g.Nh......$!..q.....o.*4....
.*.?S.)....uJ.g:....$&..[..$.'.tX..5..K8.6.i(.=......_.......r....o..G
.|i.%....Nk..).f.Zn.}."G...... ..%q."...z.g.7.@..........@|WX..e.PK...
..q..pXY)..a....C..cP..[............}.....^..G..c.MSt...[..Y...D..<<< skipped >>>

GET /img/pic2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: icon.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 431

Connection: keep-alive

Date: Mon, 08 Jun 2015 02:59:10 GMT

Last-Modified: Thu, 12 Feb 2015 08:15:09 GMT

Expires: Tue, 09 Jun 2015 02:59:10 GMT

Cache-Control: max-age=86400

Accept-Ranges: bytes

Via: cache61.l2de1[0,304-0,H], cache6.l2de1[0,0], cache4.de1[0,200-0,H], cache7.de1[0,0]

Age: 44758

X-Cache: HIT TCP_MEM_HIT dirn:2:948705605

X-Swift-SaveTime: Mon, 08 Jun 2015 02:59:19 GMT

X-Swift-CacheTime: 86400

GIF89aP.........eee000...........................e...00...0...........
.......................................!..Powered by AFEI.!.....S.,...
.P......` .di.h.....p,.tm.x..|....a..._..1i,...&3.\2...v{.-...xL.s.g.b
-h...5......;.=g......".......m......................m..............."
.........................".......m..............."..w.....u.n..m......
....".....H......*.Q.....#J.H.b...3j..Q... C..I......9.\)b...0c..I....
8[........;HTTP/1.1 200 OK..Server: Tengine..Content-Type: image/gif..
Content-Length: 431..Connection: keep-alive..Date: Mon, 08 Jun 2015 02
:59:10 GMT..Last-Modified: Thu, 12 Feb 2015 08:15:09 GMT..Expires: Tue
, 09 Jun 2015 02:59:10 GMT..Cache-Control: max-age=86400..Accept-Range
s: bytes..Via: cache61.l2de1[0,304-0,H], cache6.l2de1[0,0], cache4.de1
[0,200-0,H], cache7.de1[0,0]..Age: 44758..X-Cache: HIT TCP_MEM_HIT dir
n:2:948705605..X-Swift-SaveTime: Mon, 08 Jun 2015 02:59:19 GMT..X-Swif
t-CacheTime: 86400..GIF89aP.........eee000...........................e
...00...0..................................................!..Powered 
by AFEI.!.....S.,....P......` .di.h.....p,.tm.x..|....a..._..1i,...&3.
\2...v{.-...xL.s.g.b-h...5......;.=g......".......m...................
...m...............".........................".......m..............."
..w.....u.n..m..........".....H......*.Q.....#J.H.b...3j..Q... C..I...
...9.\)b...0c..I....8[........;....

<<< skipped >>>

GET /img/pic1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: icon.cnzz.com

Connection: Keep-Alive

Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8


HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 428

Connection: keep-alive

Date: Mon, 08 Jun 2015 07:39:10 GMT

Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT

Expires: Tue, 09 Jun 2015 07:39:10 GMT

Cache-Control: max-age=86400

Accept-Ranges: bytes

Via: cache3.l2de1[560,304-0,H], cache37.l2de1[561,0], cache4.de1[0,200-0,H], cache7.de1[0,0]

Age: 27961

X-Cache: HIT TCP_MEM_HIT dirn:6:814361188

X-Swift-SaveTime: Mon, 08 Jun 2015 07:39:10 GMT

X-Swift-CacheTime: 86400
GIF89a.......f..3...33.......................................!..NETSCA
PE2.0.....!..Powered by AFEI.!.......,.............I........08bX....d.
n...CS.3......_..`..H..H\8....)...S.b.UX.....(...r.L....tb]&"......#..
.o.V.a..D..o.V.a..........D..o.V.a..........D...........!.......,.....
........I........08bX....d.n...CS.3......_..`..H..H\8....).:[email protected]...
x ..........D.| .#.u.a....n~D..[....n..........D..[...n..........D....
.......;HTTP/1.1 200 OK..Server: Tengine..Content-Type: image/gif..Con
tent-Length: 428..Connection: keep-alive..Date: Mon, 08 Jun 2015 07:39
:10 GMT..Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT..Expires: Tue, 0
9 Jun 2015 07:39:10 GMT..Cache-Control: max-age=86400..Accept-Ranges: 
bytes..Via: cache3.l2de1[560,304-0,H], cache37.l2de1[561,0], cache4.de
1[0,200-0,H], cache7.de1[0,0]..Age: 27961..X-Cache: HIT TCP_MEM_HIT di
rn:6:814361188..X-Swift-SaveTime: Mon, 08 Jun 2015 07:39:10 GMT..X-Swi
ft-CacheTime: 86400..GIF89a.......f..3...33...........................
............!..NETSCAPE2.0.....!..Powered by AFEI.!.......,...........
..I........08bX....d.n...CS.3......_..`..H..H\8....)...S.b.UX.....(...
r.L....tb]&"......#...o.V.a..D..o.V.a..........D..o.V.a..........D....
.......!.......,.............I........08bX....d.n...CS.3......_..`..H.
.H\8....).:[email protected] ..........D.| .#.u.a....n~D..[....n..........D.
.[...n..........D...........;..<<< skipped >>>

GET /9.gif?abc=1&rnd=1417281194 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive


HTTP/1.1 302 Found

Server: Tengine

Date: Mon, 08 Jun 2015 15:25:12 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=2KH8DTH0XjQCAcGK9Ofwcxcp; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=b86e224b; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=0eb8d8df8d3ca1d9277f4f3f_1433777112; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=2KH8DTH0XjQCAcGK9Ofwcxcp

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Mon, 08 Jun 2015 15:25:12 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=2KH8DTH0Xj
QCAcGK9Ofwcxcp; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=b86e224b; path=/; domain=.cnzz.mmstat.com..
Set-Cookie: atpsida=0eb8d8df8d3ca1d9277f4f3f_1433777112; expires=Thu, 
05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt
p://pcookie.cnzz.com/app.gif?&cna=2KH8DTH0XjQCAcGK9Ofwcxcp..Expires: T
hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach
e..GIF89a.............!.......,...........L..;..

GET /status/pai/hash/6330cf46f68cd2c7c40a422626d1cb30 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.webscan.360.cn

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: 360Server

Date: Mon, 08 Jun 2015 15:25:12 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Content-Encoding: gzip
2669.............R&...PNG........IHDR......./......3......pHYs........
........MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y.
[email protected]....(.gA..Z.U\8.....}z............y.....&...j.
9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ..."....
.R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,...
...@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3...
..w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!......
...N..._....p...u.k.[..V.h..][email protected].<......%b..0..>.
[email protected][email protected]..#......)..4.\,...X..P"M.y.R.D!.
.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........
\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18
....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\
@.... [email protected].]...k....=.....K.ut.}..c..1.f..a\..E
`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z..
.xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ....
..O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-...
.igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.
*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c...
.F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!..
.{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.......
..G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b
.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6...<<< skipped >>>

GET /click.aspx?id=460737107&logo=1 HTTP/1.1

Accept: */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:22 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Type: text/html; charset=gb2312

Content-Length: 1777
..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(
endstr==-1) endstr=document.cookie.length;return document.cookie.subst
ring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.
length;var clen=document.cookie.length;var i=0;var j;while(i<clen) 
{j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=d
ocument.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..functio
n cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*360
00;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz
=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie
="cck_lasttime=" yesctime "; expires="   y_e.toGMTString()    "; path=
/";document.cookie="cck_count=0; expires="   y_e.toGMTString()    "; p
ath=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_c
ount");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y
_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctim
e "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count
=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var
 yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' esc
ape(document.location) '&color=' screen.colorDepth 'x&resolution=' scr
een.width 'x' screen.height '&returning=' cc_k() '&language=' navigato
r.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('
<a href="hXXp://countt.51yes.com/index.aspx?id=460737107" target=_b
lank><img width=20 height=20 border=0 hspace=0 vspace=0 src=<<< skipped >>>

GET /sa.htm?id=460737107&refe=http://VVV.lszwg.com/&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:23 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Length: 0

HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:25:23 GMT..Server: Microsof
t-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Co
ntrol: private..Content-Length: 0..

GET /stat.php?id=5076676&show=pic2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s25.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Date: Mon, 08 Jun 2015 15:25:06 GMT

Last-Modified: Mon, 08 Jun 2015 15:25:05 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache54.l2de1[806,200-0,M], cache17.l2de1[807,0], cache10.de1[807,200-0,H], cache6.de1[231,0]

Age: 0

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:06 GMT

X-Swift-CacheTime: 5400
29d..(function(){function k(){this.c="5076676";this.R="z";this.N="pic2
";this.K="";this.M="";this.r="1433777105";this.P="oz.cnzz.com";this.L=
"";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnz
z_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};th
is.la()}function g(a,b){try{var c=.[];c.push("siteid=5076676");c.push(
"name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referre
r));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.u
serAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math
.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&
")}catch(d){}}var h=document,e=window,f=enco..18bd..deURIComponent,l=d
ecodeURIComponent,n=unescape,p=escape;k.prototype={la:function(){try{t
his.U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this
.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.
da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(
a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function(){r
eturn a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function
(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var 
b=0;b<a.length;b  ){var c=a[b];switch(c[0]){case "_setAccount":e._c
z_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1])
;.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPa
geview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undef
ined"===typeof e._cz_account||e._cz_account===this.c){e._cz_accoun<<< skipped >>>

GET /click.aspx?id=261222598&logo=2 HTTP/1.1

Accept: */*

Referer: hXXp://sky25145.hbgyzs.com:83/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count26.51yes.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:24:48 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Type: text/html; charset=gb2312

Content-Length: 1777
..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(
endstr==-1) endstr=document.cookie.length;return document.cookie.subst
ring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.
length;var clen=document.cookie.length;var i=0;var j;while(i<clen) 
{j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=d
ocument.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..functio
n cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*360
00;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz
=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie
="cck_lasttime=" yesctime "; expires="   y_e.toGMTString()    "; path=
/";document.cookie="cck_count=0; expires="   y_e.toGMTString()    "; p
ath=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_c
ount");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y
_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctim
e "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count
=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var
 yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' esc
ape(document.location) '&color=' screen.colorDepth 'x&resolution=' scr
een.width 'x' screen.height '&returning=' cc_k() '&language=' navigato
r.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('
<a href="hXXp://countt.51yes.com/index.aspx?id=261222598" target=_b
lank><img width=20 height=20 border=0 hspace=0 vspace=0 src=<<< skipped >>>

GET /count2.gif HTTP/1.1

Accept: */*

Referer: hXXp://sky25145.hbgyzs.com:83/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count26.51yes.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Length: 1160

Content-Type: image/gif

Last-Modified: Thu, 07 Apr 2005 17:25:24 GMT

Accept-Ranges: bytes

ETag: "05a35c8963bc51:b3d"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Mon, 08 Jun 2015 15:24:49 GMT
GIF89a..................@J.#...........l...........e..~DD-T....c....NN
Y..M. .....G..f.....n..F..kBE5AA39__.Xb)))..^'%/.......RR.ww.._.......
.)U.....M.$..P..fb.......H..Mg........;. .....r..O........jva.n||8ZZ..
'?..l..ggn...gg<..6..([email protected]..]]]..G ..N.!AJJ..aK."uu...@
...rg{s..|.%c.5..Jx....?..R...AA...7..EBB..*'k....J.ELAggLQ5@&.....I8N
....;CNL.....)s.......O...qqR..e..k..@8'.ZZ`w.....V....G...&II...II*_.
 ;``..g$pp.::...ll*.....E]).tta..*X. ...9B8'...ESl.....A.&............
aam......q..X..v``...N#;i.G.....b..~`..B.(..6zgg...JJ....0PPo]z.....B:
dd..\..=%HH...JJ(..h...;^^.EH.._.W`..]..f..m..f.EJ\XX..d_....i..U.....
_\VV!cg...LL....k..JJ ...II-W.&..g.tt..i..F....EMy.A QQ.....jHH/!II.LP
p[v.....@{h..>>HVVEJJ..>f..GKJ/.1............................
.......................!.......,...............Hp.9kM*P .p`."`.li..`'Y
...1'C..\.............B.K.....Qu....{.|..I .A.LD.....S^D..B.Q.J.X..u.(
Q_.b..e...w........4...PP...=.Z..`.*.a...{.@....$..ZlW....-`0.....j.8.
 ...%..m.GD.wz......&.a.9#...)...d.T... ...h... 9l..8Q..5'op..v.[:`.tP
..o..?>..1$e.Ü..e[c.B.m...#U...R.....h.2p.B.H...2#y.`.<.4....x
".....M..0..*.$0P.L...:[email protected].$....<..C........N5..Q.'....;HTTP/1.1 
200 OK..Content-Length: 1160..Content-Type: image/gif..Last-Modified: 
Thu, 07 Apr 2005 17:25:24 GMT..Accept-Ranges: bytes..ETag: "05a35c8963
bc51:b3d"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Mon
, 08 Jun 2015 15:24:49 GMT..GIF89a..................@J.#...........l..
.........e..~DD-T....c....NNY..M. .....G..f.....n..F..kBE5AA39__.X<<< skipped >>>

GET /cxbt.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: cj.941pojie.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:09 GMT

Content-Length: 31

Content-Type: text/plain

Content-Location: hXXp://cj.941pojie.com/cxbt.txt

Last-Modified: Sun, 01 Mar 2015 05:20:17 GMT

Accept-Ranges: bytes

ETag: "eafeb367df53d01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

......................@............

GET /tc.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: cj.941pojie.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:09 GMT

Content-Length: 26

Content-Type: text/plain

Content-Location: hXXp://cj.941pojie.com/tc.txt

Last-Modified: Sun, 26 Apr 2015 14:12:08 GMT

Accept-Ranges: bytes

ETag: "246922fb2a80d01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

hXXp://soso.hcjd56.com:88/HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:2
5:09 GMT..Content-Length: 26..Content-Type: text/plain..Content-Locati
on: hXXp://cj.941pojie.com/tc.txt..Last-Modified: Sun, 26 Apr 2015 14:
12:08 GMT..Accept-Ranges: bytes..ETag: "246922fb2a80d01:751dc"..Server
: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..hXXp://soso.hcjd56.com:88/
..

GET /stat.htm?id=5076676&r=&lg=en-us&ntime=none&cnzz_eid=369179300-1433777105-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=2004535038 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Mon, 08 Jun 2015 15:25:08 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes

GIF89a.............!.......,...........D..;..

GET /sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:20 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Length: 0

HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:25:20 GMT..Server: Microsof
t-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Co
ntrol: private..Content-Length: 0..

GET /wpa/images/group.png HTTP/1.1

Accept: */*

Referer: hXXp://jc.941pojie.com/jiaqun.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pub.idqqimg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Cache-Control: max-age=2592000

Last-Modified: Fri, 12 Apr 2013 09:22:21 GMT

Content-Type: image/png

Content-Length: 1827

Keep-Alive: timeout=60

X-Cache-Lookup: Hit From MemCache
.PNG........IHDR...Z.........w.{'....PLTEV...dE)r.Ip..........F.......
.F..Kyy...r.....~E ......m..c..........d3.....S.....r...S1...#.....c..
......A..l3....d.............ynvc......"..][email protected]..............&..I
...\BH.....................rHh........z4$...X..0.....R.....s@6...{RL(.
......Xs.y......S........%.........vb...4......bW...[%..........L..t..
s..c>'...2..............wsw..i.............yM...WwaR...?-.fU...~K;.
`H...t..V..:..d...........h/#.......Z74..........pt5(...K...vb=......l
M.........N.kr......I A............pVs..k.....f'.p.....c..%...SG.J;..r
6......fBr..o=5...T..J...jB......5.....|......n^....XLm3#......y.f.}X.
...]6...,y....8..........q.D-Mt....^* z= y>#.dK...^...........>.
.s..J..............B....q...................xy...'..t.....7..M...~Re..
......s: .K(.rP`)..^=.........3......G:V......WE..2.....pHYs..........
.......IDAT8....T.U...lCs..It.....5r,*....I.K.].5p.d....2.4Fw.m}.....e
.v7r.........S.D.IVR.&.....y8G;.................N.r...9.t......p9.....
].......,Ko..i.......Mh.|@..hyw..9...n..qo-....C.....s.fpo..:{..vtQQG.
.......'..zmr.......H...m.u4.;..t...7....C.........a...?....{)...W..4.
..u......(....l..Q.|......R.u.3K.;.!..}vy([.e.~YhG[^. y......C...<.
...~.<-^I3......$..B....z...?$......u...S.7....qF$?.wF..G..lkC#...=
...A...C.......#x...Ea.yvS(..P..e..2..*....yD]]d.\.....{..h.....5.UK.@
J....ux7...>5.H_....}...T]2x,EO7SEmf.6.u:sk(..4...-.,...o6;B...Me. 
.\..._.]SSs..._....?g.,.x.$.tL...)..u.<Mv`4..Q<QiU.1O.X%......q.
.-.w.h... **.....e}..E...'...51t...0...0v....)^1.'.^..U.u`| 3.8l.)<<< skipped >>>

GET /jiaqun.htm HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: jc.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:11 GMT

Content-Length: 213

Content-Type: text/html

Content-Encoding: gzip

Content-Location: hXXp://jc.941pojie.com/jiaqun.htm

Last-Modified: Tue, 19 May 2015 16:30:53 GMT

Accept-Ranges: bytes

ETag: "80dc7a2c5192d01:751dc"

Vary: Accept-Encoding

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

..........l.Mn. .E.BX.."O..Ki>.......[{..^.I..E...ut..$..@2$...of.m
.dJ8vt.9.0vL.."... .....]....?;.X.8......2Bh.X.|.l..Rr!nbD,54.......T.
M..o..........#.g;...C............E..%.\...a....u.}|..q.$.....o.......
'g....HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:25:11 GMT..Content-Le
ngth: 213..Content-Type: text/html..Content-Encoding: gzip..Content-Lo
cation: hXXp://jc.941pojie.com/jiaqun.htm..Last-Modified: Tue, 19 May 
2015 16:30:53 GMT..Accept-Ranges: bytes..ETag: "80dc7a2c5192d01:751dc"
..Vary: Accept-Encoding..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.
NET............l.Mn. .E.BX.."O..Ki>.......[{..^.I..E...ut..$..@2$..
.of.m.dJ8vt.9.0vL.."... .....]....?;.X.8......2Bh.X.|.l..Rr!nbD,54....
...T.M..o..........#.g;...C............E..%.\...a....u.}|..q.$.....o..
.....'g......

GET /css/style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:12 GMT

Content-Length: 3923

Content-Type: text/css

Content-Encoding: gzip

Content-Location: hXXp://VVV.941pojie.com/css/style.css

Last-Modified: Fri, 25 Jul 2014 01:50:27 GMT

Accept-Ranges: bytes

ETag: "8073a1ceaaa7cf1:751dc"

Vary: Accept-Encoding

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
...........[K....^g`.C..!..{TRK..Y..c......uK.....V..........da."^..1.
y.L.d.../.&...N=..w<.L.VU.:u.W.U....[.~.._......G..>x.`U....>
..S.I....y.~n.}Y...l......../.y-]e....>......;.<......d[[email protected]..
1Z.m[.QS....?.........n..s5...q...]8.E..t..G...g..<,....yy..'./B...
..D^..U1no...P...HX.Vu...2 ?..-....X.M...A.....Y.8.dUES......U...v....
%Y......iW..e.....q..Dv.....%.....v.^..>>G...u. 2.:.".8...D%.').
...:.).v.\$...u...!ku...7.gBF...)yf...r{X......fy..l^pz(..w...,3....*.
. ='.....-H'D...1..^=.0/O.*.]..z.T..*6.2...B|..U..9.....;1z:....r.8..b
..:W.d3..4y.A....vI.$..Bkb60.!{........]..l......"...#s...\<.r.C.4.
.pSN....#Vu.KTE.8.Bc..}G.ez....He..v......u..i.Ou.v. ....P........DPD.
..........(.......3...$...*;....8..Gj.m..&.`.g....&oGy.......f....i.Wg
2.....(.nk.&'......QS.a8............|>...c.....\k29...h..9.....R..}
Q62~...{.;....BKL...f.*..:p.c. .....H?.K.Ue..Sh....9...uI5B.;.k.......
..n.-...b.T#......T..fr..}.......0..%....F.)........>.......VU1...T
c$9.M.....[%.h.uV.%..).G.q....q8....\.Ig..ri..P....d...6Q4`..m..v.].Y5
5.:......,.E..`../by.([email protected]... "@...1Po1..H..F..D[A.\.l6.d#....
.d.l.X..w..y.Yo...w...hs.d...'...!iOPnR........`..k.......Z:.U.C.\mb..
.!M%.........K...:........%....Z..2.l.Q...z...9..3..t,...2_.c......WE2
..I&*{jx;.#^^C.&..T...q"XN......n5-...TG.|E..q......_n~)3<......U..
@ ..7uM....=)(M.R..1V..[.'HYS.<k..8.Q(...s.eNGO....U.ad..f^.N}...d.
.#;W.-......''.}^.c`!] ......2)...k..p...62 ........mW=.....(.Y..jp...
.I,...=.v....<...).Mx...A.B...pNS..... ...U..6...v.l..3..X.)F;.<<< skipped >>>

GET /img/miaosha.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:12 GMT

Content-Length: 46434

Content-Type: image/gif

Content-Location: hXXp://VVV.941pojie.com/img/miaosha.gif

Last-Modified: Fri, 20 Mar 2015 12:33:36 GMT

Accept-Ranges: bytes

ETag: "010c815a63d01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

GIF89a..(.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............................................q.-]..E]h.Z!\.Z!..-].....
..P0#..h.Z!!..NETSCAPE2.0.....!.......,......(..|6z....$.3..,3.(\.,c.-
^.=G.3k.4q.z<.M..^U.Ae.uF.jR.}z.rw.X\.LX.Mk.Gq.a\.jP.ql.jx.=..y..v.
.K..J..J..K..X..W..W..^..d..k..s..x..j..h..i..e..x..v..u..{..z..l..d..
m..t..u..x..........B.%V.0l.|w.q[.yq..../..11.2t.<G..8.L..O1.u..q3.
L[.W[.Vz.mZ.jw.OO.nL.ff.j{.ww.?..V..w..k..G..Q..c..l..q..g..i..r..y..\
..i..i..w..j..g..t..y..y..k..s..y..;..X..^..m..l..w..}..|..x...z..X..p
..Y..w..}..3..4.....1...../..S..r..Q..m..N..e..C..x..... ........P....
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /pie.htc HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 404 Not Found

Date: Mon, 08 Jun 2015 15:25:14 GMT

Content-Length: 83

Content-Type: text/html

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
<html><head><title>Error</title></head>&
lt;body>........................</body></html>..
..


GET /img/qingtian.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:15 GMT

Content-Length: 34464

Content-Type: image/gif

Content-Location: hXXp://VVV.941pojie.com/img/qingtian.gif

Last-Modified: Tue, 03 Feb 2015 08:35:42 GMT

Accept-Ranges: bytes

ETag: "0c339658c3fd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
GIF89a..<.................#.. ..4..;..C..L..S..[..c..k..s..|.......
.....................?............................................/..'
..#..*..7..2..;.._..O..G..C..K..W..T..[..o..g..c..j..w..s..{...?.._..o
..w..{..s..g..k..c..O..W..[..S..G..K..C...../..7..;..3..'.. ..#.......
......................................................................
..................................................!.......!..NETSCAPE2
.0.....,......<.....#..............................................
....................................................."....."..."  ....
...........c%.0......L........<.!B........ ....64........0h.AC*....
H......d..P.A...8v,` ....~...s....2=@p.....*0.un.........@...\..pA....
.*.E..... .X.@......([email protected]...,..A...Wup..c...,p.p..D...q.`A.....\^.  
.u.6........#P...........H.L...(.|.....E........F^.X.9G..<....{....
(8..!...E=0...N..&.`.....#..R..i.O:..G.... .N........\.....W.1..v.t.Aw
B..T- |P.w.8."!.TX^G...]yDm..!....!.0.....7@[email protected]..
e.$5Hx.. SJ..w.j..X.H.l.@.....>.\4.P.,..0K.).........e.......Er.@:.
D .N&BE.....i....i..~z...8..G-ir..'!G...a.....@@v..#@[email protected]....
D.@[email protected]..% `.X.D.&....WP...k..., .&D.'@...F.;.m.Ii.r....
\...x%....1..J.*....7.p..."@@..9.l#.kd ..% ..$SU...V...$.....(T.. .Y^.
...ny.<5H......A.PTV.|..A."..s."..k#`.r........P.NVEP..}."B..L.3..V
.v...z......c..h3J...b`*.<....^.....I.j...0..K...{....U.9.bzw....W.
..=..A..LxN0....".\...3`..x:..'.<.....2.....9.bC.Y........".......^
. .}..4X....W...F...e#......%..!...<...r.T."%....Q*#..`w.V..(..<<< skipped >>>

GET /img/kl.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:18 GMT

Content-Length: 30696

Content-Type: image/gif

Content-Location: hXXp://VVV.941pojie.com/img/kl.gif

Last-Modified: Wed, 28 Jan 2015 13:58:58 GMT

Accept-Ranges: bytes

ETag: "0fda98f23bd01:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
GIF87a..Z................!"!...9311 )B;9...JDB)()RKJ101ZSR10)989)(!)#!
c\Z...kbcZZZ.AB......{qkBAB.........{}.sicRQJcYRcac.ys9<.kaZ.......
.{sjk.........{mkJIB....us......JA9sec..........}{RIB! .)$)......ZYR!.
!ZQJ...JIJ.........k]Z......cUR...{ts............ZMJ..................
...................|{...caZ.........RQR..............{.........kjk.ys.
...........BA9...Z].!..................... !....ac...............km..0
1),....981......................QR...{y{..............................
.............qssqs.qk........{.........JM................sqk..........
..kic...................................................kYR...{ys.....
...........us!!..........{ic11....B81.........! ..........)).scZ...)).
...!...........REBc]c......90)......)$.............Zac........{....}{.
..............,......Z........H......*\......#J|...E.. z..1c.. C..I...
.(S.\.....!=..Y.....fz....M.>...i.'..G.*]..)S.N........XA...5"W.X.v
.J....h..]K.#F.p......X...n...*.....v...`....uy.....#K.L..e.n.....'R.r
..-\..N..S.^......c..M....W3.DZ..^.qA..]..........9....C...........}.A
.....n......!._...L.m/..;.xG......T.....6.R.m7..<...v.6....>(...
V..x....Z2m..m....3$..V.&Rv.M.etW...$.f....T.......xS..B.....P..H&....
J....>)...V)V.Xf..e.....q...fcv...=....A5X..o2)...N)..v....<....
NF ..v.j...&.hV."..DH..(Jp.....f.iC...\A`.'S.p.i*`.>........QN.....
.9 ............. ....z...&{@..6.,J.e8)K..TmC.]9.......u.$.^. [email protected].
..h....eFo.U.F..W........ x ....k...Z.../....&.l..OL...<....w.q....
..7%...b...Y.Z...d.A...x..W.~4..E\.rFW. ..1z...Vm..C2....,......Wu<<< skipped >>>

GET /img/2014052276129177.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.941pojie.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:25:25 GMT

Content-Length: 832

Content-Type: image/gif

Content-Location: hXXp://VVV.941pojie.com/img/2014052276129177.gif

Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT

Accept-Ranges: bytes

ETag: "05c92394b7cf1:751dc"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

GIF89aX..................!..copyright. 1996 Charles H. Tupper  All rig
hts reserved. not to be used on another graphics download site or on s
oftware.  All other uses permitted.  hXXp://VVV.cyberspace.com/tup.!..
NETSCAPE2.0.....!.......,....X.....*.............0....H.........6.L...
.....? ..!.......,%...j...................<....H............!......
.,W...j...................<....H............!.......,....j.........
..........<....H............!.......,....j...................<..
..H............!.......,....j...................<....H............!
.......,....X.....*..................H...........L.........(..!.......
,1.........!..................H...........L...!.......,c.........!....
..............H...........L...!.......,..........!..................H.
..........L...!.......,....X.....)................n.H...........L.....
..>S..;....

GET /stat.htm?id=5076676&r=http://VVV.941pojie.com/&lg=en-us&ntime=none&cnzz_eid=455095186-1433777105-http://VVV.941pojie.com/&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1029977702 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Mon, 08 Jun 2015 15:25:08 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes

GIF89a.............!.......,...........D..;..

GET /stat.htm?id=3325108&r=&lg=en-us&ntime=none&cnzz_eid=1076296874-1433777109-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=851769781 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Mon, 08 Jun 2015 15:25:10 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes

GIF89a.............!.......,...........D..;..

GET /sa.htm?id=261222598&refe=http://soso.hcjd56.com:88/&location=http://sky25145.hbgyzs.com:83/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://sky25145.hbgyzs.com:83/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count26.51yes.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 15:24:49 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Length: 0

HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:24:49 GMT..Server: Microsof
t-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Co
ntrol: private..Content-Length: 0..

GET /stat.php?id=5076676&show=pic2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s25.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Date: Mon, 08 Jun 2015 15:25:06 GMT

Last-Modified: Mon, 08 Jun 2015 15:25:05 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache54.l2de1[806,200-0,M], cache17.l2de1[807,0], cache10.de1[807,200-0,M], cache1.de1[808,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:4:517450486

X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:06 GMT

X-Swift-CacheTime: 5400
29d..(function(){function k(){this.c="5076676";this.R="z";this.N="pic2
";this.K="";this.M="";this.r="1433777105";this.P="oz.cnzz.com";this.L=
"";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnz
z_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};th
is.la()}function g(a,b){try{var c=.[];c.push("siteid=5076676");c.push(
"name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referre
r));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.u
serAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math
.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&
")}catch(d){}}var h=document,e=window,f=enco..18bd..deURIComponent,l=d
ecodeURIComponent,n=unescape,p=escape;k.prototype={la:function(){try{t
his.U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this
.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.
da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(
a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function(){r
eturn a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function
(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var 
b=0;b<a.length;b  ){var c=a[b];switch(c[0]){case "_setAccount":e._c
z_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1])
;.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPa
geview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undef
ined"===typeof e._cz_account||e._cz_account===this.c){e._cz_accoun<<< skipped >>>

GET /app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pcookie.cnzz.com


HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 08 Jun 2015 15:25:10 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; expires=Thu, 05-Jun-25 15:25:10 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Mon, 08 Jun 2015 15:25:10 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=1aH8DQnb DgCA
cGK9Od5gcj8; expires=Thu, 05-Jun-25 15:25:10 GMT; path=/; domain=.cnzz
.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache.
.Pragma: no-cache..GIF89a.............!.......,...........L..;.
...

GET /app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pcookie.cnzz.com

Connection: Keep-Alive

Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8


HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 08 Jun 2015 15:25:12 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache

GIF89a.............!.......,...........L..;....

GET /app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pcookie.cnzz.com

Connection: Keep-Alive

Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8


HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 08 Jun 2015 15:25:12 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Mon, 08 Jun 2015 15:25:12 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=1aH8DQnb DgCA
cGK9Od5gcj8; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz
.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache.
.Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /app.gif?&cna=2KH8DTH0XjQCAcGK9Ofwcxcp HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8

Connection: Keep-Alive

Host: pcookie.cnzz.com


HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 08 Jun 2015 15:25:12 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=2KH8DTH0XjQCAcGK9Ofwcxcp; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Mon, 08 Jun 2015 15:25:12 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=2KH8DTH0XjQCA
cGK9Ofwcxcp; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz
.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache.
.Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /static/common/images/zhanzhang.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: zhanzhang.anquan.org

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx/1.1.19

Date: Mon, 08 Jun 2015 15:25:12 GMT

Content-Type: image/png

Content-Length: 5075

Last-Modified: Wed, 03 Dec 2014 14:46:30 GMT

Connection: keep-alive

Expires: Mon, 08 Jun 2015 15:25:12 GMT

Cache-Control: max-age=0

Cache-Control: no-cache

Accept-Ranges: bytes
.PNG........IHDR...|.../.....!.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:12842C66B96C11E3B1D2FC24
D7F17EB2" xmpMM:DocumentID="xmp.did:12842C67B96C11E3B1D2FC24D7F17EB2"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:12842C64B96C11E3B1
D2FC24D7F17EB2" stRef:documentID="xmp.did:12842C65B96C11E3B1D2FC24D7F1
7EB2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.......GIDATx..\.t.......! K..... Bd., ..,.
.........r.xT.*.[...*...ZE.E.., ..a..v....v.^.7...7....d...=gN.Y.....{
..L..5~Wo"..[.E..,...{..~............4I.\.E1.$.=.5..~....<.^...Q...
^.R.s.....:....DJ].7_.Q......Q ...C*....MX.......v..no.......g.fl"....
.S%MJ'.w...y... c..F...{.cg...'Z.-i...5...K...K$=...IU.........FT.b...
......Q)..O.L......D..K..~<H.;7......jS..U...9....QR%AI...T"*w..{..
B...............I{........g;|..8..g...".T....a..>.`.a).^Y^t-..fE..n
...........E...-......`.....q...C.&0!....r.........(.H....8~..kk.uI...
.QY.m...o.IZ.E....Kr.|..eP...V.]...n..\n. ht...G..i;..k.3..SPb.{..<<< skipped >>>

GET /stat.php?id=3325108&show=pic1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s85.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Date: Mon, 08 Jun 2015 15:25:09 GMT

Last-Modified: Mon, 08 Jun 2015 15:25:09 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache37.l2de1[789,200-0,M], cache3.l2de1[790,0], cache1.de1[789,200-0,H], cache4.de1[790,0]

Age: 0

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:09 GMT

X-Swift-CacheTime: 5400
4aa..(function(){function k(){this.c="3325108";this.R="z";this.N="pic1
";this.K="";this.M="";this.r="1433777109";this.P="oz.cnzz.com";this.L=
"";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnz
z_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};th
is.la()}function g(a,b){try{var c=.[];c.push("siteid=3325108");c.push(
"name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referre
r));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.u
serAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math
.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&
")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURI
Component,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),
this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),th
is.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),thi
s.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i fai
led")}},oa:function(){try{var a=this;e._czc={push:function(){return a.
B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{v
ar a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<
;a.length;b ..1104.. ){var c=a[b];switch(c[0]){case "_setAccount":e._c
z_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1])
;.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPa
geview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undef
ined"===typeof e._cz_account||e._cz_account===this.c){e._cz_accoun<<< skipped >>>

GET /status/pai/hash/6330cf46f68cd2c7c40a422626d1cb30 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.941pojie.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.webscan.360.cn

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: 360Server

Date: Mon, 08 Jun 2015 15:25:12 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Content-Encoding: gzip
2669.............R&...PNG........IHDR......./......3......pHYs........
........MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y.
[email protected]....(.gA..Z.U\8.....}z............y.....&...j.
9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ..."....
.R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,...
...@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3...
..w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!......
...N..._....p...u.k.[..V.h..][email protected].<......%b..0..>.
[email protected][email protected]..#......)..4.\,...X..P"M.y.R.D!.
.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........
\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18
....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\
@.... [email protected].]...k....=.....K.ut.}..c..1.f..a\..E
`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z..
.xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ....
..O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-...
.igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.
*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c...
.F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f.HTTP/1.1 200 OK..
Server: 360Server..Date: Mon, 08 Jun 2015 15:25:12 GMT..Content-Type: 
text/html..Transfer-Encoding: chunked..Connection: close..Content-Enco
ding: gzip..2669.............R&...PNG........IHDR......./......3..<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_1156:

.text

`.rdata

@.data

.rsrc

t$(SSh

~%UVW

u$SShe

kernel32.dll

shlwapi.dll

suming.dll

%System%\drivers\etc

%System%\drivers\etc\hosts

127.0.0.1 VVV.52anzu.com

127.0.0.1 www1.52anzu.com

127.0.0.1 52anzu.com

127.0.0.1 VVV.sopojie.com

127.0.0.1 www1.sopojie.com

127.0.0.1 sopojie.com

127.0.0.1 1.52yanzheng.sinaapp.com

%System%\drivers\etc\protocol

tcp 6 TCP # Transmission control protocol

udp 17 UDP # User datagram protocol

%System%\drivers\etc\services

# This file contains port numbers for well-known services defined by IANA

# <service name> <port number>/<protocol> [aliases...] [#<comment>]

echo 7/tcp

echo 7/udp

discard 9/tcp sink null

discard 9/udp sink null

systat 11/tcp users #Active users

daytime 13/tcp

daytime 13/udp

qotd 17/tcp quote #Quote of the day

qotd 17/udp quote #Quote of the day

chargen 19/tcp ttytst source #Character generator

chargen 19/udp ttytst source #Character generator

ftp-data 20/tcp #FTP, data

ftp 21/tcp #FTP. control

telnet 23/tcp

smtp 25/tcp mail #Simple Mail Transfer Protocol

time 37/tcp timserver

time 37/udp timserver

rlp 39/udp resource #Resource Location Protocol

nameserver 42/tcp name #Host Name Server

nameserver 42/udp name #Host Name Server

nicname 43/tcp whois

domain 53/tcp #Domain Name Server

domain 53/udp #Domain Name Server

bootps 67/udp dhcps #Bootstrap Protocol Server

bootpc 68/udp dhcpc #Bootstrap Protocol Client

tftp 69/udp #Trivial File Transfer

gopher 70/tcp

finger 79/tcp

http 80/tcp www www-http #World Wide Web

kerberos 88/tcp krb5 kerberos-sec #Kerberos

kerberos 88/udp krb5 kerberos-sec #Kerberos

hostname 101/tcp hostnames #NIC Host Name Server

iso-tsap 102/tcp #ISO-TSAP Class 0

rtelnet 107/tcp #Remote Telnet Service

pop2 109/tcp postoffice #Post Office Protocol - Version 2

pop3 110/tcp #Post Office Protocol - Version 3

sunrpc 111/tcp rpcbind portmap #SUN Remote Procedure Call

sunrpc 111/udp rpcbind portmap #SUN Remote Procedure Call

auth 113/tcp ident tap #Identification Protocol

uucp-path 117/tcp

nntp 119/tcp usenet #Network News Transfer Protocol

ntp 123/udp #Network Time Protocol

epmap 135/tcp loc-srv #DCE endpoint resolution

epmap 135/udp loc-srv #DCE endpoint resolution

netbios-ns 137/tcp nbname #NETBIOS Name Service

netbios-ns 137/udp nbname #NETBIOS Name Service

netbios-dgm 138/udp nbdatagram #NETBIOS Datagram Service

netbios-ssn 139/tcp nbsession #NETBIOS Session Service

imap 143/tcp imap4 #Internet Message Access Protocol

pcmail-srv 158/tcp #PCMail Server

snmp 161/udp #SNMP

snmptrap 162/udp snmp-trap #SNMP trap

print-srv 170/tcp #Network PostScript

bgp 179/tcp #Border Gateway Protocol

irc 194/tcp #Internet Relay Chat Protocol

ipx 213/udp #IPX over IP

ldap 389/tcp #Lightweight Directory Access Protocol

https 443/tcp MCom

https 443/udp MCom

microsoft-ds 445/tcp

microsoft-ds 445/udp

kpasswd 464/tcp # Kerberos (v5)

kpasswd 464/udp # Kerberos (v5)

isakmp 500/udp ike #Internet Key Exchange

exec 512/tcp #Remote Process Execution

biff 512/udp comsat

login 513/tcp #Remote Login

who 513/udp whod

cmd 514/tcp shell

syslog 514/udp

printer 515/tcp spooler

talk 517/udp

ntalk 518/udp

efs 520/tcp #Extended File Name Server

router 520/udp route routed

timed 525/udp timeserver

tempo 526/tcp newdate

courier 530/tcp rpc

conference 531/tcp chat

netnews 532/tcp readnews

netwall 533/udp #For emergency broadcasts

uucp 540/tcp uucpd

klogin 543/tcp #Kerberos login

kshell 544/tcp krcmd #Kerberos remote shell

new-rwho 550/udp new-who

remotefs 556/tcp rfs rfs_server

rmonitor 560/udp rmonitord

monitor 561/udp

ldaps 636/tcp sldap #LDAP over TLS/SSL

doom 666/tcp #Doom Id Software

doom 666/udp #Doom Id Software

kerberos-adm 749/tcp #Kerberos administration

kerberos-adm 749/udp #Kerberos administration

kerberos-iv 750/udp #Kerberos version IV

kpop 1109/tcp #Kerberos POP

phone 1167/udp #Conference calling

ms-sql-s 1433/tcp #Microsoft-SQL-Server

ms-sql-s 1433/udp #Microsoft-SQL-Server

ms-sql-m 1434/tcp #Microsoft-SQL-Monitor

ms-sql-m 1434/udp #Microsoft-SQL-Monitor

wins 1512/tcp #Microsoft Windows Internet Name Service

wins 1512/udp #Microsoft Windows Internet Name Service

ingreslock 1524/tcp ingres

l2tp 1701/udp #Layer Two Tunneling Protocol

pptp 1723/tcp #Point-to-point tunnelling protocol

radius 1812/udp #RADIUS authentication protocol

radacct 1813/udp #RADIUS accounting protocol

nfsd 2049/udp nfs #NFS server

knetd 2053/tcp #Kerberos de-multiplexor

man 9535/tcp #Remote Man Server

%System%\drivers\etc\lmhosts.sam

# This is a sample LMHOSTS file used by the Microsoft TCP/IP for Windows.

# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts

# \0xnn (non-printing character support)

# browser and logon services behave in TCP/IP environments. To preload

# be able to read the lmhosts file successfully. This key is under

# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE

# 102.54.94.97 rhino #PRE #DOM:networking #net group's DC

# 102.54.94.102 "appname \0x14" #special app server

# 102.54.94.123 popular #PRE #source server

# 102.54.94.117 localsrv #PRE #needed for the include

%System%\drivers\etc\networks

# campus 284.122.107

# london 284.122.108

D:\wscntmx.exe

`.data

@.vmp0

`.vmp1

.reloc

}~/%D(

.;6  (&%

1<76  '&

1=;;6  )%#

<;76  )%#

=<<7  ))%

=<<77  '%

=<<76 ))##

==<;7   '##

=<;76 ))##

=<<6  )'#

=<;76 ))#

==<;66 )'#

=<<66  (%

e{TP.cda8

U#ex'B-n}

MSVBVM60.DLL

user32.dll

5i.Id(HE

~32.bd~

.sKpK

.soAw?

.qT3<

D:\qudongrensheng.dat

__MSVCRT_HEAP_SELECT

KERNEL32.dll

USER32.dll

ShellExecuteExA

SHELL32.dll

GetCPInfo

@.reloc

<4,$?7/'

(3-!0,1'8"5.*2$

ADVAPI32.dll

WS2_32.dll

RegCloseKey

RegOpenKeyExA

RegSetKeySecurity

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

RegOpenKeyA

WinExec

ExitWindowsEx

MSVCRT.dll

ackpw.dll

SetImageFileKey

SOFTWARE\Microsoft\Windows NT\CurrentVersion

wininet.dll

C:\log.pif

ShellExecuteA

Shell32.dll

SYSTEM\CurrentControlSet\Services\%s\Parameters

RegOpenKeyEx(Svchost)

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost

m32\svchost.exe -k krnlsrvc

%SystemRoot%\Syste

SYSTEM\CurrentControlSet\Services\%s

Rundll32 %s,RunUninsta3l

\lockmedia.tmp

hXXp://

%u MB

%s SP%d

%d.%d.%d.%d

GetProcessHeap

GET / HTTP/1.1

Host: %s:%d

Host: %s

User-Agent: Mozilla/5.0 (compatible; Baiduspider/2.0;  hXXp://VVV.baidu.com/search/spider.html)

GET %s HTTP/1.1

Referer: hXXp://%s

GET %s?=%d HTTP/1.1

Mozilla/5.0 (compatible; Baiduspider/2.0;  hXXp://VVV.baidu.com/search/spider.html)

User-Agent: Mozilla/5.0 (compatible; Baiduspider/2.0;  hXXp://VVV.baidu.com/search/spider.html)

#%d<<<<<I@C<<<<<%s!

4!4,41474>4{4

> >(>8>=>

%s\hao123_res.tmp

%s\ack%cpw.dll

hXXp://VVV.941pojie.com/

hXXp://cj.941pojie.com/tc.txt

hXXp://cj.941pojie.com/zy.txt

hXXp://cj.941pojie.com/cxbt.txt

hXXp://cj.941pojie.com/wbzz.txtCreateFileA

.aspack

.adata

.xqrq

.pH`X|

.YON=

p*.LIAt

5].NQg

=.cw| r\

C @Qb%[email protected]

l(8i?ZiDf\.SQ

%C*pig

The procedure entry point %s could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

comctl32.dll

gdi32.dll

msimg32.dll

msvcrt.dll

msvfw32.dll

hXXp://VVV.eyybc.com

\skinh.she

M.GG^

%s T5

]E4%F(

.Funr

.yyw'

%sX@:`

J|.jv

p4%xcEm

.Jr1Z

7.YT"

.Uf!0

!a%U}

[I(3/#N0.bd

j"%u=w

q%Xn`

@|H.NI

.wdd!

S|%u4

5.ff)

;)?/\%~|/

U%D?~;

l2.Ue

9%crU

XKw-k}

zx/%FN[

LY.eo

z{.Do

%s=\RI

}j%c%Y)

Rx.GR

4o#.dM

IeS`%C

[n 4\.UY

,4.qO,

gQ'.Io

%cLur?

s%DHB

]I%%X

I %d)

.aEd(

Õ6m*

5r.US

:mD].tB

fJ.WM_

fTpe

.LLbX

f%fUZ

.fOuV12

*_.dC

&-N}<

({?.cQm

R>o2.YN>

.Cqx~c

.`.Qw

.Onwj

Tn&.hL

**.dU

%s;7*

0%x@w

%C^L:

CX%xm

!n]%x

%X,Cr

*.Ea]S

Q.CGo

tn!ay%F

2.kKX

Avi.CT

xhZ_6%U

%SY!8i

&.PFy{xh

sG.qmf

5.ZrW

%Ucda

n.BjCw

.um ZZE7L

/^p%u$

I.NoQY

zu.ew

D/.nT

z.LP"

.IRIx

"%Sh9

&;%sUwa

kBS%dR

VVV.meitu.com

M%u{$

;s.iF

9E.nV

X-.RP

>.xKA

uDPf

jc.941pojie.com/jiaqun.htm

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

ole32.dll

RASAPI32.dll

iphlpapi.dll

SHLWAPI.dll

MPR.dll

WINMM.dll

VERSION.dll

GetKeyState

GetViewportOrgEx

GDI32.dll

WINSPOOL.DRV

OLEAUT32.dll

COMCTL32.dll

oledlg.dll

WSOCK32.dll

HttpQueryInfoA

HttpSendRequestA

HttpOpenRequestA

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

%x.tmp

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

(*.htm;*.html)|*.htm;*.html

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

VVV.dywt.com.cn

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

.PAVCOleDispatchException@@

zcÁ

hXXp://soso.hcjd56.com:88/

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

360.cn

hosts2.exe

6.1.7601.17514 (winsp1_rtm.101119-1850)

Rasmedia.dll

Microsoft Windows Operating System

6.1.7601.17514

4.20.0

Uninstall.exe

1, 0, 6, 6

SkinH_EL.dll

(*.*)

1.0.0.0

(hXXp://VVV.eyuyan.com)

wscntmx.exe_244:

.text

`.data

.rsrc

@.vmp0

`.vmp1

.reloc

}~/%D(

.;6  (&%

1<76  '&

1=;;6  )%#

<;76  )%#

=<<7  ))%

=<<77  '%

=<<76 ))##

==<;7   '##

=<;76 ))##

=<<6  )'#

=<;76 ))#

==<;66 )'#

=<<66  (%

attrib -r -s -h %windir%\system32\drivers\etc\hosts.ics

attrib -r -s -h %windir%\system32\wbem\window\winxp.ics

#vb6chs.dll

%Program Files%\VB

\VB6.OLB

advapi32.dll

RegCloseKey

RegCreateKeyA

RegOpenKeyA

VBA6.DLL

e{TP.cda8

U#ex'B-n}

MSVBVM60.DLL

user32.dll

5i.Id(HE

~32.bd~

.sKpK

.soAw?

.qT3<

kernel32.dll

SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN

Microsoft.XMLHTTP

hXXp://jc.941pojie.com/cj.txt

%System%\drivers\etc

%System%\drivers\etc\hosts

c:\windows\system32\drivers\etc\hosts

c:\windows\system32\drivers\etc\hosts.ics

c:\a.bat

c:\b.bat

zhaosf.com

Adodb.Stream

360.cn

windows

hosts2.exe

wscntmx.exe_244_rwx_0041F000_00001000:

MSVBVM60.DLL

user32.dll

svchost.exe_1484:

.text

`.data

.rsrc

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

RPCRT4.dll

NETAPI32.dll

ole32.dll

ntdll.dll

RegCloseKey

RegOpenKeyExW

GetProcessHeap

NtOpenKey

svchost.pdb

\PIPE\

Software\Microsoft\Windows NT\CurrentVersion\Svchost

\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\

5.1.2600.5512 (xpsp.080413-2111)

svchost.exe

Windows

Operating System

5.1.2600.5512

wscntmx.exe_244_rwx_00426000_00001000:

.soAw?

.qT3<

kernel32.dll

iexplore.exe_476:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):

attrib.exe:1236
attrib.exe:1840
attrib.exe:544
attrib.exe:1264
qudongrensheng.dat:1796
cacls.exe:1632
cacls.exe:1040
cacls.exe:1028
cacls.exe:940
cacls.exe:1012
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:

%Documents and Settings%\%current user%\Local Settings\Temp\hao123_res.tmp (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (13991 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\6330cf46f68cd2c7c40a422626d1cb30[1].png (362 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (753 bytes)
%System%\drivers\etc\protocol (799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\game[1].htm (16716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2014052276129177[1].gif (832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\binglang[1].png (2149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\941pojie[1].htm (438 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\daosu[1].jpg (17388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\soso.hcjd56[1].htm (1201 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2014052276129177[1].gif (832 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\daofeng[1].png (1835 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\yinyue[1].png (4941 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sky25145.hbgyzs[1].htm (1600 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (519 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tianyi[1].png (3218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6330cf46f68cd2c7c40a422626d1cb30[1].png (1941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\kl[1].gif (4786 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].php (1073 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (13108 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tee5_net_logo[1].jpg (24983 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\miaosha[1].gif (12204 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\longtian[1].jpg (8453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\haobangshou[1].jpg (2195 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\footer[1].jpg (12388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\wangpai[1].jpg (48243 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (325 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\miaosha[1].png (2498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lingfeng[1].jpg (4462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\click[2].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\mojian[1].jpg (3321 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (326 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xgz[1].jpg (2658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tianlang[1].jpg (24673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgheader[1].gif (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lszwg[1].htm (10245 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\27[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gif008[1].gif (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bgtitle[1].gif (3 bytes)
%System%\drivers\etc\services (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\longshen[1].jpg (18297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\046bt[1].gif (1692 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\style[1].css (3893 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\miaosha[1].gif (12807 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sky25145.hbgyzs[2].htm (1600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\game[1].js (911 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\linggua[1].png (219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic2[1].gif (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gg[1].png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\top[1].png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\shicai[1].png (6215 bytes)
%System%\drivers\etc\lmhosts.sam (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jiaqun[1].htm (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[2].php (682 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style[1].css (258 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\click[1].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (9625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\weihu[1].jpg (10658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jisu[1].png (2769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\zsf[1].gif (10523 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\zsf[1].gif (23271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (753 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (406 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (404 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bgnav[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bg[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sansha[1].png (17181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gif008[2].gif (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[2].php (753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA5OWN9L.gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bgh[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jianhun[1].png (1923 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].php (1073 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%System%\drivers\etc\networks (407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qingtian[1].gif (8985 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bg[1].jpg (156378 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\anlong[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\game[2].htm (25649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yds[1].gif (7768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tianxunzhe[1].png (13455 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qijian[1].jpg (61723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jsq[1].png (6514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\046bt[1].gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\soso.hcjd56[1].htm (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic2[1].gif (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cb386.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cj[1].txt (2948 bytes)
C:\b.bat (255 bytes)
%System%\drivers\etc\hosts.ics (17013 bytes)
C:\a.bat (356 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wscntmx" = "D:\\wscntmx.exe"
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
127.0.0.1 localhost
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Gen.Variant.Strictor.29584_a7a99907eb

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Gen.Variant.Strictor.29584_a7a99907eb

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet