MD5: a88fd51dde1e355009d337a1f84659b7
SHA1: e5ab390acc4d80f853e795ae8e96c9856aaf2cca
SHA256: ccd1d31c7eeb42d1457823a33ba57cac65fdb027c24452353a4816cf525690d0
SSDeep: 49152:846hi9cnbNEKa/tgrYJUGfZC3wA6EylfwEaFW9:R6hiSuptLxC3sEwwM9
Size: 2354752 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Sogou.com Inc.
Created at: 2015-12-11 10:50:56
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.

Payload

No specific payload has been found.

Process activity

The Trojan-Downloader creates the following process(es):

ThunderFW.exe:660
ExternalApp.exe:1800
minidownload.exe:140
regsvr32.exe:888
UpdateService.exe:240
UpdateService.exe:460
%original file name%.exe:1328
MiniTPFw.exe:700

The Trojan-Downloader injects its code into the following process(es):

SogouSoftware.exe:1080
MiniThunderPlatform.exe:1296

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process SogouSoftware.exe:1080 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\link[4].png (392 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\cache\LocalInfo.xml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery-1.7.2.min[1].js (49189 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ie-css3[1].htc (1115 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\link[2].png (1168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\recommend[1].css (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\741430117543639[1].png (17104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\link[1].png (3055 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CC1430117533187[1].png (14923 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\link[2].png (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\link[3].png (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\link[1].png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\link[5].png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\link[3].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\link[1].jpg (3344 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\cache\PCID.xml (685 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\sogousoftware.db (149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\link[3].png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\scroll[1].js (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\SogouSoftwareExternalApp[1].exe (1104620 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (494 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\link[1].png (6155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\link[3].png (1513 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (135 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\381427456234840[1].jpg (10822 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\cache\SilentParaReponse.xml (97 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ie-css3[1].htc (4387 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\sogousoftware.db-journal (86 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\loading[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\link[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-1.11.1.min[1].js (46785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ranking-ico[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ranking[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\link[2].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\link[4].png (7360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\link[2].png (776 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\cache\NewVersionReponse.xml (1 bytes)
%Program Files%\SogouSoftware\tmp\ExternalApp.exe (670671 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\cache\OnlineIconReponse.xml (359 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\cache\SoftInfo.xml (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan-Downloader deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\sogousoftware.db-journal (0 bytes)
%Program Files%\SogouSoftware\tmp\ExternalApp.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\link[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ie-css3[1].htc (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\link[2].png (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\link[1].png (0 bytes)

The process ExternalApp.exe:1800 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):

%Program Files%\SogouSoftware\3.1.13.79\skin\upgrade_stable_list_item.xml (5 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\button.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\continuebtn.png (819 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\edit.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\option_bk.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\white.png (163 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\9.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\beginexp.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\confirm_dlg.xml (2 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\update_nor.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\hover̬.png (17 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\uninstall_dwn.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\ËÑË÷ɾ³ý.png (17 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\USB.png (7 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\radio.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\combo_hot.png (350 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\AdbWinUsbApi.dll (2628 bytes)
%Program Files%\SogouSoftware\3.1.13.79\IEHint.dll (10252 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\newbutton.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\dlgClose_nor.png (1 bytes)
%Program Files%\SogouSoftware\update\USBDT.dll (14494 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\5.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\aapt.exe (22008 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\combo_right.png (1 bytes)
%Program Files%\SogouSoftware\update\UpdateService.exe (6928 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\follow_tip.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\grin.png (24 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\DrvInst32\DrvInst_x86.exe (10321 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\3.0.0.0\apktool.ini (44 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\combo_mask.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\DrvInst64\DrvInst_x64.exe (10382 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\logo3636.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\menu.xml (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\update_list_dlg_otherfont.xml (5 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\dlgClose_dwn.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\ScrollBar\scrollH.png (909 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\search_delete.png (17 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\info.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\SogouPhoneService.exe (22004 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\ins_progress_bg.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\upgrade_beta_list_item.xml (5 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\scroll_bk.png (3 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\update_hov.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\ins_progress_bk.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\recommend_hov.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\closebtn_hover.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\dlg_feedback.xml (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\recommend_selected.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\info_icon.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\beginbtn.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\tips_down.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\smallbtn.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\progress_bk.png (952 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\smalldlg_shadow.png (3 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\search_bar_nor.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\feedback_nor.png (17 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\check.png (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Èí¼þÖúÊÖ\жÔØÈí¼þÖúÊÖ.lnk (501 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\bottombk.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\combo_sel.png (347 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\4.png (18 bytes)
%Program Files%\SogouSoftware\update\SogouPDAInfo.sqlite3 (3624 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\classify_btn_pushed.png (130 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\apostrophe.gif (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\closebtn_normal.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\soft_search_list.xml (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\group_list_item.xml (693 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\downloading.gif (7 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\button140.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\phone_normal.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\allow_debug.png (2712 bytes)
%Program Files%\SogouSoftware\Èí¼þÖúÊÖ.lnk (1284 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\update_dwn.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\DrvInst32\DIFxAPI.dll (12309 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\left_btn_mask.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\tab.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\menubtn.png (3 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\wait_dev.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\ins_confirm.png (632 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\progress_fore.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\close_act.png (17 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\download_hov.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\Õýʽ°æÑ¡ÖÐ״̬.png (15476 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\all_updated.png (9 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\download_bind_checkbox.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\setting_act.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\connect_dev.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\uninstall_list_item.xml (3 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\dlgClose_act.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\feedback_dwn.png (17 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\shy.png (5 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\update_info.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\ApkTool.xml (1568 bytes)
%Program Files%\SogouSoftware\3.1.13.79\CommonState.dll (1332 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\continuebtn_small.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\upgrade_ignore_list_item.xml (3 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\progress_bk.png (17660 bytes)
%Program Files%\SogouSoftware\3.1.13.79\npdownload.dll (8748 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\dlgshadow.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\icon_success.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\downloadComplete_list_item.xml (4 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\closebtn_normal_dlg.png (415 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\ins_title.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\down_smt.png (3 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\combo_left.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\setting_nor.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\SogouSoftware.dll (25317 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\SogouApkTool.exe (47860 bytes)
%Documents and Settings%\All Users\Desktop\Èí¼þÖúÊÖ.lnk (720 bytes)
%Program Files%\SogouSoftware\manifest.cfg (30 bytes)
%Program Files%\SogouSoftware\3.1.13.79\sqlite3.dll (10053 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\ins_app2phone_arrow.png (2 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\AdbWinApi.dll (4250 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\1.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\menu_bk.png (2 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\combo_simple_up.png (15 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\download_nor.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\IEHint64.dll (10878 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\download_dwn.png (18 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Èí¼þÖúÊÖ\Èí¼þÖúÊÖ.lnk (734 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\tab_bk.png (2 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\tooltip.png (2 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\default_pkgicon.png (2 bytes)
%Program Files%\SogouSoftware\3.1.13.79\npdownload64.dll (9079 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\phone_unconnected.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\combo_mid.png (939 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\7.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\GIF\loading.gif (494 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\logo.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\setting_dwn.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\uninstall_nor.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\search_bar_act.png (17 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\combo.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\ins_progress.gif (9 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\warning_icon.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\3.0.0.0\SogouPDAInfo.sqlite3 (3624 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\close_dwn.png (17 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\btn_3state.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\progress_fore.gif (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\confirm_closebtn.png (4 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\progress_fore.png (15817 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\download_bind_list_item.xml (2 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\scroll_thu.png (2 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\dlg_settings.xml (6 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\logo4848default.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\update_hand.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\scroll_trs.png (938 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\update_list_dlg.xml (5 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\combo_simple.png (285 bytes)
%Program Files%\SogouSoftware\3.1.13.79\DuiLib.dll (17602 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\update_dlg_otherfont.xml (3 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\2.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\ready_icon.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\progress_pause.png (17448 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\6.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\9 .png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\item_icon2.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\smallbtn_shadow.png (3 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\uninstall_hov.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\web_external_browser_dlg.xml (318 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\tooltips_dlg.xml (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\download_list_item.xml (2 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\ins_app2phone.png (16 bytes)
%Program Files%\SogouSoftware\uninst.exe (794 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\ins_banner.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\3.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\loading.gif (2 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\checkbox.png (3 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\ScrollBar\scroll.png (13 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\magnifier_search.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\8.png (18 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\feedback_act.png (17 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\closebtn_active.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\bigbtn_shadow.png (3 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\install_driver.gif (1568 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\tips.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\apk.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\finishbtn.png (817 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\SogouAapt.exe (24085 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\button160.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\confirm_bk.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\Ñ¡ÖÐ̬.png (17 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\item_icon_5.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\APKlogo.ico (2610 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\menu_item.png (3 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\update_dlg.xml (3 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\item_icon_4.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\close_nor.png (17 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\MySoftwareManager.xml (24 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\ins_ready.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\search_bar_act_focus.png (17 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\guide_smt.png (2712 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\download_bind_bg.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\phone_connected.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\adbdll.dll (2430 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\update_confirm_dlg.xml (2 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\button.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\android_ver.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk4.tmp\System.dll (11 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\closebtn.png (4 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\ConfirmDlg.xml (2 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\PNG\close_search.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\item_icon.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\DrvInst64\DIFxAPI.dll (11174 bytes)
%Program Files%\SogouSoftware\3.1.13.79\skin\recommend_classify_table.xml (4 bytes)
%Program Files%\SogouSoftware\3.1.13.79\ApkTool\extheme\ApkTool\item_icon_3.png (1 bytes)

The Trojan-Downloader deletes the following file(s):

%Program Files%\SogouSoftware\Èí¼þÖúÊÖ.lnk (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk4.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp (0 bytes)

The process MiniThunderPlatform.exe:1296 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Thunder Network\DownloadLib\pub_store.dat (405 bytes)
%Documents and Settings%\All Users\Application Data\Thunder Network\Mini_downloadlib\ODAwMDAzNzI=\Version_3_2_1_42\Profiles\stat.dat (63 bytes)
%Documents and Settings%\All Users\Application Data\Thunder Network\Mini_downloadlib\ODAwMDAzNzI=\Version_3_2_1_42\Profiles\asyn_frame.dat (1467 bytes)
%Documents and Settings%\All Users\Application Data\Thunder Network\Mini_downloadlib\ODAwMDAzNzI=\Version_3_2_1_42\Profiles\error.dat (283 bytes)
C:\SogouDownload\300_v0.2.406.zip.td.cfg (1784 bytes)
%Documents and Settings%\All Users\Application Data\Thunder Network\Mini_downloadlib\ODAwMDAzNzI=\200U (39 bytes)
%Documents and Settings%\All Users\Application Data\Thunder Network\Mini_downloadlib\ODAwMDAzNzI=\Version_3_2_1_42\Profiles\download.cfg (1007 bytes)

The process minidownload.exe:140 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):

%Program Files%\SogouSoftware\crash\ExceptionReport.exe (3718 bytes)
%Program Files%\SogouSoftware\download\download\MiniTPFw.exe (1633 bytes)
%Program Files%\SogouSoftware\download\download\id.dat (40 bytes)
%Program Files%\SogouSoftware\download\download\download_engine.dll (75696 bytes)
%Program Files%\SogouSoftware\download\download\zlib1.dll (3170 bytes)
%Program Files%\SogouSoftware\download\xldl.dll (9424 bytes)
%Program Files%\SogouSoftware\download\download\MiniThunderPlatform.exe (7951 bytes)
%Program Files%\SogouSoftware\download\download\ThunderFW.exe (3053 bytes)
%Program Files%\SogouSoftware\download\download\msvcp71.dll (10930 bytes)
%Program Files%\SogouSoftware\SogouSoftware.exe (6896 bytes)
%Program Files%\SogouSoftware\download\download\atl71.dll (2201 bytes)
%Program Files%\SogouSoftware\SogouSoftwareLoader.dll (10291 bytes)
%Program Files%\SogouSoftware\download\download\dl_peer_id.dll (2910 bytes)
%Program Files%\SogouSoftware\download\download\msvcr71.dll (12773 bytes)

The Trojan-Downloader deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf1.tmp (0 bytes)

The process regsvr32.exe:888 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):

%System%\GroupPolicy\gpt.ini (315 bytes)
%System%\GroupPolicy\Machine\Registry.pol (268 bytes)

The process %original file name%.exe:1328 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (124 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\minidownload.exe (12289 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (309 bytes)

The Trojan-Downloader deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (0 bytes)

Registry activity

The process ThunderFW.exe:660 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B 3A 7B BE 66 7E F2 87 B8 B8 B5 16 82 5A F9 4F"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\SogouSoftware\download\download]
"MiniThunderPlatform.exe" = "%Program Files%\SogouSoftware\download\download\MiniThunderPlatform.exe:*:Enabled:MiniThunderPlatform2016-05-2213:40:59"

The process SogouSoftware.exe:1080 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1449823775"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016052220160523]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016052220160523]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "SogouSoftware.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016052220160523]
"CachePrefix" = ":2016052220160523:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016052220160523]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\SogouSoftware\tmp]
"ExternalApp.exe" = "软件助手安装包"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\SogouSoftware]
"FirstRun" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "64 EA 81 E3 F9 6B E6 6B F8 FD 37 A3 FA 5A 24 F7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016052220160523]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016052220160523\"

The Trojan-Downloader modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-Downloader modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan-Downloader deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The Trojan-Downloader deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process ExternalApp.exe:1800 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\SogouSoftware\download\download]
"MiniTPFw.exe" = "MiniTPFw Application"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D4D786E8-0535-41DB-91F8-B18ABBCCDE6C}]
"AppPath" = ""

[HKLM\SOFTWARE\SogouSoftware]
"InstallTime" = "BA 8C 41 57 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SogouSoftware]
"DisplayIcon" = "%Program Files%\SogouSoftware\SogouSoftware.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKU\S-1-5-19\Software\SogouSoftware\Download]
"DownloadPath" = "C:\SogouDownload"

[HKU\.DEFAULT\Software\SogouSoftware\Download]
"DownloadPath" = "C:\SogouDownload"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKU\S-1-5-19_CLASSES\SOFTWARE\SogouSoftware\Download]
"DownloadPath" = "C:\SogouDownload"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SogouSoftware]
"UninstallString" = "%Program Files%\SogouSoftware\uninst.exe"

[HKCR\CLSID\{D4D786E8-0535-41DB-91F8-B18ABBCCDE6C}\LocalServer32]
"(Default)" = "%Program Files%\SogouSoftware\SogouSoftware.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SogouSoftware]
"Publisher" = "Sogou.com"

[HKLM\SOFTWARE\SogouSoftware]
"InstallPath" = "%Program Files%\SogouSoftware"
"HWID" = "43 9C 2B FF A1 3F 3A 49 4B 96 9E 2E F7 6D 66 0B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\SogouSoftware]
"ProgrameModulesDir" = "%Program Files%\SogouSoftware\3.1.13.79"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SogouSoftware]
"DisplayVersion" = "3.1.13.79"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\SogouSoftware]
"LaunchAppPath" = "%Program Files%\SogouSoftware\SogouSoftware.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKU\S-1-5-20\Software\SogouSoftware\Download]
"DownloadPath" = "C:\SogouDownload"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D 64 6B CF D2 28 E0 9F 48 5C C6 F2 13 65 9B 14"

[HKLM\SOFTWARE\SogouSoftware]
"Version" = "3.1.13.79"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\SogouSoftware\Download]
"DownloadPath" = "C:\SogouDownload"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D4D786E8-0535-41DB-91F8-B18ABBCCDE6C}]
"AppName" = ""
"Policy" = "3"

[HKU\S-1-5-20_CLASSES\SOFTWARE\SogouSoftware\Download]
"DownloadPath" = "C:\SogouDownload"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SogouSoftware]
"DisplayName" = "Èí¼þÖúÊÖ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Classes\Software\SogouSoftware\Download]
"DownloadPath" = "C:\SogouDownload"

The Trojan-Downloader modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan-Downloader adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SogouSoftware" = "%Program Files%\SogouSoftware\SogouSoftware.exe /AutoRun"

The Trojan-Downloader deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process MiniThunderPlatform.exe:1296 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AB C9 10 09 BD 85 03 2D B6 BE E9 9B 4C 9A BF 16"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan-Downloader modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-Downloader modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan-Downloader deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process minidownload.exe:140 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 56 73 75 D1 B3 9F 06 1F EB D0 98 DE 1C 17 BA"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process regsvr32.exe:888 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:

[HKCR\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\HELPDIR]
"(Default)" = "%Program Files%\SogouSoftware\3.1.13.79"

[HKCR\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}]
"(Default)" = "IGameDownload"

[HKCR\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{2C195A20-0E5E-4255-ABFE-464A816974AC}Machine\SOFTWARE\Policies\Google\Chrome\EnabledPlugins]
"1" = "搜狗高速下载助手"

[HKLM\SOFTWARE\MozillaPlugins\@sogou.com/SGDownloadPlugin]
"Descripton" = "搜狗高速下载控件"

[HKCR\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\TypeLib]
"(Default)" = "{13D91BAE-B37C-41C3-AE86-463E53990546}"

[HKCR\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\MozillaPlugins\@sogou.com/SGDownloadPlugin]
"Path" = "%Program Files%\SogouSoftware\3.1.13.79\npdownload.dll"

[HKCR\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\TypeLib]
"(Default)" = "{13D91BAE-B37C-41C3-AE86-463E53990546}"

[HKCR\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}]
"(Default)" = "DownLoadBHO Class"

[HKCR\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\MozillaPlugins\@sogou.com/SGDownloadPlugin]
"ProductName" = "搜狗高速下载助手"

[HKLM\SOFTWARE\Policies\Google\Chrome\EnabledPlugins]
"1" = "搜狗高速下载助手"

[HKCR\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}]
"(Default)" = "IDownLoadBHO"

[HKCR\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\TypeLib]
"(Default)" = "{13D91BAE-B37C-41C3-AE86-463E53990546}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0C CC 60 62 CF 51 81 B8 F1 1C 3A 5F E5 9F F8 65"

[HKLM\SOFTWARE\MozillaPlugins\@sogou.com/SGDownloadPlugin]
"Version" = "3.1.13.79"

[HKCR\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0]
"(Default)" = "SogouDownLoadLib"

[HKCR\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\0\win32]
"(Default)" = "%Program Files%\SogouSoftware\3.1.13.79\npdownload.dll"

[HKLM\SOFTWARE\MozillaPlugins\@sogou.com/SGDownloadPlugin]
"vendor" = "Sogou.com Inc."

[HKCR\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Version]
"(Default)" = "1.0"

[HKCR\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32]
"(Default)" = "%Program Files%\SogouSoftware\3.1.13.79\npdownload.dll"

The Trojan-Downloader deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{2C195A20-0E5E-4255-ABFE-464A816974AC}Machine\SOFTWARE\Policies\Google\Chrome\EnabledPlugins]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{2C195A20-0E5E-4255-ABFE-464A816974AC}Machine]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{2C195A20-0E5E-4255-ABFE-464A816974AC}Machine\SOFTWARE\Policies]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{2C195A20-0E5E-4255-ABFE-464A816974AC}Machine\SOFTWARE\Policies\Google\Chrome]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{2C195A20-0E5E-4255-ABFE-464A816974AC}Machine\SOFTWARE]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{2C195A20-0E5E-4255-ABFE-464A816974AC}Machine\SOFTWARE\Policies\Google]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{2C195A20-0E5E-4255-ABFE-464A816974AC}User]

The process UpdateService.exe:240 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 5C EE 1F F0 E9 58 BB BF 89 83 4D 22 86 7B 2E"

The process UpdateService.exe:460 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 67 F0 C3 A0 F3 F0 BB B7 55 7B 11 23 39 43 4E"

The process %original file name%.exe:1328 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\SogouSoftware]
"unc" = "sogousoftware_game"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"minidownload.exe" = "软件助手安装包"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 38 C5 3B 70 A2 64 F3 5C 41 4E DF FE 62 77 AB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\SogouSoftware]
"SogouSoftware.exe" = "软件助手"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan-Downloader modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-Downloader modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan-Downloader deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process MiniTPFw.exe:700 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D9 E0 9B 89 78 38 A5 7D 06 3C FC 6A 23 6A A9 AA"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\SogouSoftware\download\download]
"ThunderFW.exe" = "ThunderFW"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan-Downloader modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Sogou.com Inc.
Product Name: ????
Product Version: 3.1.8.97
Legal Copyright: (c) 2014 Sogou.com Inc. All rights reserved.
Legal Trademarks:
Original Filename: MiniDownLoad.exe
Internal Name: MiniDownLoad.exe
File Version: 3.1.8.97
File Description: ????
Comments:
Language: English (United Kingdom)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 6
d24088c2f7a85191c7725cb1d59905ef
9481467c07328760ab1d6c529195c701
14fec33d557d6522dacd4e2423b1c8aa
d55da748301ef9fd8e3a21fab5af2341
d1b85715a93954f5a66a9899bb34bca3
b9f349fa92ab35bdbfe8937387b1d162

URLs

URL	IP
hxxp://proxy.sogou.com/appinfo?num=16777252
hxxp://ping.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2N0000o30f--&unc=sogousoftware_game&t=10&rand=1463913643
hxxp://sogou.ndlmix.ourdvs.com/externalapp/SogouSoftwareExternalApp.exe
hxxp://ping.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=1&rand=1463913659
hxxp://ping.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=801&rand=1463913661
hxxp://proxy.sogou.com/handleUserIdDb?userid=439c2bffa13f3a494b969e2ef76d660b&unc=sogousoftware_game&mode=recommend
hxxp://proxy.sogou.com/pc_assist/install_check.php
hxxp://proxy.sogou.com/pc_assist/local_info.php
hxxp://proxy.sogou.com/handleUserIdDb256?userid=439c2bffa13f3a494b969e2ef76d660b&downloadtype=game&unc=sogousoftware_game&pcid=9223372036854775807&mode=recommend
hxxp://ping.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=4&activatetype=download&rand=1463913663
hxxp://proxy.sogou.com/pc_assist/newversion_info.php
hxxp://proxy.sogou.com/softRecommend
hxxp://ping.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=5&servicestate=4&rand=1463913664
hxxp://proxy.sogou.com/pc_assist/silent_install.php
hxxp://proxy.sogou.com/softRanking
hxxp://ping.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=800&sogousoftware=1&updateservice=1&rand=1463913664
hxxp://proxy.sogou.com/pc_assist/soft_info.php?fields=logo_url
hxxp://proxy.sogou.com/softassis/css/recommend.css?vs=1.0
hxxp://ping.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=11&sogousoftware=1&updateservice=1&rand=1463913664
hxxp://proxy.sogou.com/softassis/js/jquery-1.7.2.min.js
hxxp://ping.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=310&num=1&rand=1463913664
hxxp://sogou.ndlmix.ourdvs.com/pc_logo/7638937123950702413.png
hxxp://sogou.ndlmix.ourdvs.com/128128.png
hxxp://proxy.sogou.com/softassis/css/ranking.css
hxxp://proxy.sogou.com/js/jquery-1.11.1.min.js
hxxp://proxy.sogou.com/js/scroll.js?vs=03
hxxp://img01.sogoucdn.com.stage.cdntip.com/app/a/10190001/381427456234840	220.195.17.25
hxxp://proxy.sogou.com/img/recommend-btn.png
hxxp://proxy.sogou.com/redirectdownload.jsp?u=http://300hero.download.jumpwgame.com/client/300_v0.2.406.zip&pcid=12110057764174543756&downloadtype=game&filename=300_v0.2.406.zip
hxxp://proxy.sogou.com/net/a/66/link?appid=66&url=http://dl.app.sogou.com/pc_logo/zhuanti_58_640x260.jpg&r=
hxxp://proxy.sogou.com/net/a/66/link?appid=66&url=http://dl.app.sogou.com/pc_logo/yijianchongzhuang_745x240.png&r=
hxxp://img01.sogoucdn.com.stage.cdntip.com/app/a/10190001/741430117543639	220.195.17.25
hxxp://ping.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=100&tasktype=2&pcid=9223372036854775807&downloadtype=game&softname=300英雄&extension=zip&rand=1463913667
hxxp://sogou.ndlmix.ourdvs.com/cooperation/popuprecommend/installfinishbind-qqbrowser.xml
hxxp://sogou.ndlmix.ourdvs.com/cooperation/popuprecommend/cooperation/install_finish_qqbrowser.html
hxxp://ping.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=230&bindtype=installfinishbind&bindname=QQBrowser&weight=0&scheme=a&rand=1463913667
hxxp://c16b09.sandai.net/
hxxp://cnchub5sr.sandai.net/
hxxp://cnchubstat.sandai.net/
hxxp://img01.sogoucdn.com.stage.cdntip.com/app/a/10190001/CC1430117533187	220.195.17.25
hxxp://proxy.sogou.com/ie-css3.htc
hxxp://proxy.sogou.com/softassis/img/loading.gif
hxxp://proxy.sogou.com/update_platform/update.php?appname=sogoudownload_bindsecontrol&v=1.0.0.0
hxxp://proxy.sogou.com/ajax/loadItem
hxxp://proxy.sogou.com/update_platform/done.php?v=1.0.0.0&appname=sogoudownload_bindsecontrol&state=1
hxxp://c01.i07.rpnic.lv3.cloudglb.com/client/300_v0.2.406.zip
hxxp://proxy.sogou.com/softRanking/loadMore?pageSize=10&pageNo=1
hxxp://proxy.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-3080605666447722537.png&r=null
hxxp://proxy.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-3726774318030095000.png&r=null
hxxp://proxy.sogou.com/softassis/img/ranking-ico.png
hxxp://proxy.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/5632829225944923461.png&r=null
hxxp://proxy.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/8623308865128809051.png&r=null
hxxp://proxy.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-1433550905860313072.png&r=null
hxxp://proxy.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/6940656908449948330.png&r=null
hxxp://proxy.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/4669602030091557924.png&r=null
hxxp://cnchub5pr.sandai.net/
hxxp://imhub5pr.sandai.net/
hxxp://hub5p.sandai.net/
hxxp://c04023.sandai.net/
hxxp://proxy.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/1882834511144817344.png&r=null
hxxp://proxy.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/4871856506745242874.png&r=null
hxxp://proxy.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-3230604409881581210.png&r=null
hxxp://proxy.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-7654919934142823378.png&r=null
hxxp://proxy.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-6699374927030488929.png&r=null
hxxp://proxy.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/2040683535505104749.png&r=null
hxxp://proxy.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-6542522661282298716.png&r=null
hxxp://111.7.131.67/cache/300hero.download.jumpwgame.com/client/300_v0.2.406.zip?ich_args=a6e23c7ef9e8009565d7b74153176f8a_1_0_0_2_5d1e65fcfb7400741be5b2dbf911b54b50a4a6ddab3276edd4f5cf3230bf617a_20eec99348d222f8a2f0db7ba7fc6395_1_0
hxxp://cmc.imgstore.cdn.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/5632829225944923461.png&r=null	36.110.170.46
hxxp://cmc.imgstore.cdn.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-7654919934142823378.png&r=null	36.110.170.46
hxxp://58.254.134.249:80/
hxxp://xz.sogou.com/softRanking	36.110.170.46
hxxp://yze.t.sogou.com/cooperation/popuprecommend/cooperation/install_finish_qqbrowser.html	87.245.198.84
hxxp://img01.sogoucdn.com/app/a/10190001/381427456234840	220.195.17.25
hxxp://cmc.imgstore.cdn.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-1433550905860313072.png&r=null	36.110.170.46
hxxp://cmc.imgstore.cdn.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/2040683535505104749.png&r=null	36.110.170.46
hxxp://xz.sogou.com/softassis/img/loading.gif	36.110.170.46
hxxp://cmc.imgstore.cdn.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/1882834511144817344.png&r=null	36.110.170.46
hxxp://cmc.imgstore.cdn.sogou.com/net/a/66/link?appid=66&url=http://dl.app.sogou.com/pc_logo/zhuanti_58_640x260.jpg&r=	36.110.170.46
hxxp://xz.sogou.com/handleUserIdDb?userid=439c2bffa13f3a494b969e2ef76d660b&unc=sogousoftware_game&mode=recommend	36.110.170.46
hxxp://yx.sogou.com/redirectdownload.jsp?u=http://300hero.download.jumpwgame.com/client/300_v0.2.406.zip&pcid=12110057764174543756&downloadtype=game&filename=300_v0.2.406.zip	36.110.170.46
hxxp://cmc.imgstore.cdn.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/6940656908449948330.png&r=null	36.110.170.46
hxxp://ping.t.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=100&tasktype=2&pcid=9223372036854775807&downloadtype=game&softname=300英雄&extension=zip&rand=1463913667	36.110.170.40
hxxp://cmc.imgstore.cdn.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/8623308865128809051.png&r=null	36.110.170.46
hxxp://xz.sogou.com/softRanking/loadMore?pageSize=10&pageNo=1	36.110.170.46
hxxp://cmc.imgstore.cdn.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-6542522661282298716.png&r=null	36.110.170.46
hxxp://xz.sogou.com/js/scroll.js?vs=03	36.110.170.46
hxxp://zs.xiazai.sogou.com/pc_assist/silent_install.php	36.110.170.46
hxxp://img04.sogoucdn.com/app/a/10190001/741430117543639	220.195.19.42
hxxp://zs.xiazai.sogou.com/pc_assist/local_info.php	36.110.170.46
hxxp://cmc.imgstore.cdn.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-3230604409881581210.png&r=null	36.110.170.46
hxxp://cmc.imgstore.cdn.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-3726774318030095000.png&r=null	36.110.170.46
hxxp://123.129.242.154:80/
hxxp://xz.sogou.com/ie-css3.htc	36.110.170.46
hxxp://img03.sogoucdn.com/app/a/10190001/CC1430117533187	27.36.118.29
hxxp://123.129.242.139:80/
hxxp://xz.sogou.com/img/recommend-btn.png	36.110.170.46
hxxp://xz.sogou.com/js/jquery-1.11.1.min.js	36.110.170.46
hxxp://cmc.imgstore.cdn.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/4871856506745242874.png&r=null	36.110.170.46
hxxp://xz.sogou.com/softassis/css/recommend.css?vs=1.0	36.110.170.46
hxxp://dl.app.sogou.com/pc_logo/7638937123950702413.png	87.245.198.84
hxxp://t.sogou.com/update_platform/update.php?appname=sogoudownload_bindsecontrol&v=1.0.0.0	36.110.170.46
hxxp://yze.t.sogou.com/externalapp/SogouSoftwareExternalApp.exe	87.245.198.84
hxxp://xz.sogou.com/softassis/img/ranking-ico.png	36.110.170.46
hxxp://58.254.134.139:80/
hxxp://xz.sogou.com/ajax/loadItem	36.110.170.46
hxxp://123.129.242.140:80/
hxxp://zs.xiazai.sogou.com/pc_assist/newversion_info.php	36.110.170.46
hxxp://ping.t.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=230&bindtype=installfinishbind&bindname=QQBrowser&weight=0&scheme=a&rand=1463913667	36.110.170.40
hxxp://163.177.79.152:80/
hxxp://ping.t.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=310&num=1&rand=1463913664	36.110.170.40
hxxp://dl.app.sogou.com/128128.png	87.245.198.84
hxxp://300hero.download.jumpwgame.com/client/300_v0.2.406.zip	125.39.5.36
hxxp://zs.xiazai.sogou.com/pc_assist/install_check.php	36.110.170.46
hxxp://ping.t.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=5&servicestate=4&rand=1463913664	36.110.170.40
hxxp://ping.t.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=800&sogousoftware=1&updateservice=1&rand=1463913664	36.110.170.40
hxxp://xz.sogou.com/softassis/js/jquery-1.7.2.min.js	36.110.170.46
hxxp://yze.t.sogou.com/cooperation/popuprecommend/installfinishbind-qqbrowser.xml	87.245.198.84
hxxp://cmc.imgstore.cdn.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-6699374927030488929.png&r=null	36.110.170.46
hxxp://ping.t.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=11&sogousoftware=1&updateservice=1&rand=1463913664	36.110.170.40
hxxp://xz.sogou.com/softassis/css/ranking.css	36.110.170.46
hxxp://58.254.134.140:80/
hxxp://xz.sogou.com/handleUserIdDb256?userid=439c2bffa13f3a494b969e2ef76d660b&downloadtype=game&unc=sogousoftware_game&pcid=9223372036854775807&mode=recommend	36.110.170.46
hxxp://ping.t.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=4&activatetype=download&rand=1463913663	36.110.170.40
hxxp://t.sogou.com/update_platform/done.php?v=1.0.0.0&appname=sogoudownload_bindsecontrol&state=1	36.110.170.46
hxxp://zs.xiazai.sogou.com/pc_assist/soft_info.php?fields=logo_url	36.110.170.46
hxxp://cmc.imgstore.cdn.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-3080605666447722537.png&r=null	36.110.170.46
hxxp://cmc.imgstore.cdn.sogou.com/net/a/66/link?appid=66&url=http://dl.app.sogou.com/pc_logo/yijianchongzhuang_745x240.png&r=	36.110.170.46
hxxp://ping.t.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2N0000o30f--&unc=sogousoftware_game&t=10&rand=1463913643	36.110.170.40
hxxp://ping.t.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=1&rand=1463913659	36.110.170.40
hxxp://xz.sogou.com/softRecommend	36.110.170.46
hxxp://yz.app.sogou.com/appinfo?num=16777252	36.110.170.46
hxxp://ping.t.sogou.com/pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2P4djMo30000&unc=sogousoftware_game&t=801&rand=1463913661	36.110.170.40
hxxp://cmc.imgstore.cdn.sogou.com/net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/4669602030091557924.png&r=null	36.110.170.46
hxxp://122.143.5.59:80/
hub5idx.shub.hz.sandai.net	123.129.242.139
hub5pr.hz.sandai.net	58.254.134.139
pmap.hz.sandai.net	122.143.5.59
hub5c.hz.sandai.net	123.129.242.139
hub5pn.hz.sandai.net	119.189.1.10
hub5u.hz.sandai.net	58.254.134.201
relay.phub.hz.sandai.net	58.254.134.245
hub5p.hz.sandai.net	58.254.134.140
time.windows.com	40.69.40.157
hubstat.hz.sandai.net	123.129.242.154
hub5sr.shub.hz.sandai.net	123.129.242.140
hub5pnc.hz.sandai.net	119.188.108.56
score.phub.hz.sandai.net	163.177.79.152
imhub5pr.hz.sandai.net	58.254.134.249

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN Suspicious User-Agent (HttpDownload)

Traffic

GET /cache/300hero.download.jumpwgame.com/client/300_v0.2.406.zip?ich_args=a6e23c7ef9e8009565d7b74153176f8a_1_0_0_2_5d1e65fcfb7400741be5b2dbf911b54b50a4a6ddab3276edd4f5cf3230bf617a_20eec99348d222f8a2f0db7ba7fc6395_1_0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 111.7.131.67

Pragma: no-cache

Range: bytes=426097816-495379023

Referer: hXXp://300.jumpw.com/index.html?cid=0

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 403 Forbidden

Server: httpserver

Date: Sun, 22 May 2016 10:43:04 GMT

Content-Type: text/html

Content-Length: 569

Connection: keep-alive
<html>..<head><title>403 Forbidden</title><
/head>..<body bgcolor="white">..<center><h1>403 F
orbidden</h1></center>..<hr><center>httpserver
</center>..</body>..</html>..<!-- a padding to di
sable MSIE and Chrome friendly error page -->..<!-- a padding to
 disable MSIE and Chrome friendly error page -->..<!-- a padding
 to disable MSIE and Chrome friendly error page -->..<!-- a padd
ing to disable MSIE and Chrome friendly error page -->..<!-- a p
adding to disable MSIE and Chrome friendly error page -->..<!-- 
a padding to disable MSIE and Chrome friendly error page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=287535400-356816607

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:43:19 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 61.130.28.166, UGenerate MISS from 27.209.182.28, Configured MISS from 27.209.182.25
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

HEAD /redirectdownload.jsp?u=http://300hero.download.jumpwgame.com/client/300_v0.2.406.zip&pcid=12110057764174543756&downloadtype=game&filename=300_v0.2.406.zip HTTP/1.1

User-Agent: HttpRequest

Host: yx.sogou.com

Content-Length: 0

Cache-Control: no-cache

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.1 302 Found

Server: nginx

Date: Sun, 22 May 2016 10:40:56 GMT

Content-Type: text/html; charset=UTF-8

Connection: keep-alive

Set-Cookie: galaxy_group=8; expires=Sat, 20-Aug-16 10:40:56 GMT; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://300hero.download.jumpwgame.com/client/300_v0.2.406.zip
HTTP/1.1 302 Found..Server: nginx..Date: Sun, 22 May 2016 10:40:56 GMT
..Content-Type: text/html; charset=UTF-8..Connection: keep-alive..Set-
Cookie: galaxy_group=8; expires=Sat, 20-Aug-16 10:40:56 GMT; path=/..P
3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM N
AV OTC NOI DSP COR"..Location: hXXp://300hero.download.jumpwgame.com/c
lient/300_v0.2.406.zip..

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=555272200-634596799

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:41:01 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 61.130.28.167, Configured MISS from 61.130.28.168, UGenerate MISS from 27.209.182.28, Configured MISS from 27.209.182.25
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=79324600-158649199

Referer: hXXp://125.39.5.8/client

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:41:36 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 222.88.91.15, Configured MISS from 222.88.91.17, UGenerate MISS from 125.39.5.8
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=356816608-633941439

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:52 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 61.130.28.167, Configured MISS from 61.130.28.168, UGenerate MISS from 123.147.166.37
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=218109882-356895163

Referer: hXXp://123.147.166.37/client

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:30 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 222.88.91.15, Configured MISS from 222.88.91.17, UGenerate MISS from 123.147.166.37
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=396623000-475947599

Referer: hXXp://125.39.5.36/client

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:41:44 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 222.88.91.15, Configured MISS from 222.88.91.17, UGenerate MISS from 125.39.5.36
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:02 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: Combine MISS from 222.88.91.15, Configured MISS from 222.88.91.18, Combine MISS from 125.39.5.33
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=39236316-78472631

Referer: hXXp://300hero.download.jumpwgame.com/client

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:53 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 218.58.225.38, Configured MISS from 218.58.225.35, UGenerate MISS from 123.147.166.37
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=426287805-495680445

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:30 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 221.204.226.49, UGenerate MISS from 27.209.182.28, Configured MISS from 27.209.182.25
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=317298400-396622999

Referer: hXXp://123.147.166.14/client

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:41:37 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 221.204.226.49, UGenerate MISS from 123.147.166.13, Configured MISS from 123.147.166.14
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:40:58 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: Combine MISS from 218.58.225.38, Configured MISS from 218.58.225.37, Combine MISS from 123.147.166.36
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=79324600-396622999

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:41:46 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 110.80.134.199, Configured MISS from 110.80.134.202, UGenerate MISS from 125.39.5.8
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=0-76873727

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:43:17 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 110.80.134.199, UGenerate MISS from 123.147.166.13
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /update_platform/update.php?appname=sogoudownload_bindsecontrol&v=1.0.0.0 HTTP/1.1

User-Agent: HttpRequest

Host: t.sogou.com

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:58 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

Ruleid: 54d3460c179ca2b2069ae8f3
2b6....[.A.p.p.l.i.c.a.t.i.o.n.D.o.w.n.l.o.a.d.].....P.c.i.d.L.i.s.t.=
.1.2.9.7.9.4.2.4.2.5.3.3.7.0.8.2.7.4.,.-.8.5.0.8.4.0.3.4.1.8.9.0.2.1.1
.8.0.7.8.,.5.7.7.6.6.5.4.4.1.8.0.3.2.3.7.2.9.3.7.,.2.0.4.0.6.8.3.5.3.5
.5.0.5.1.0.4.7.4.9.,.-.1.5.3.5.1.7.7.8.6.7.9.6.8.9.6.2.7.5.5.,.2.1.9.9
.4.3.5.4.9.5.5.3.7.6.6.3.8.5.4.,.8.6.2.3.3.0.8.8.6.5.1.2.8.8.0.9.0.5.1
.....N.a.m.e.L.i.s.t.=.3.6.0..[hQkS.X,[email protected],.3.6.0..g..Om..hV,.3
.6.0..[hQOm..hV,.3.6.0.Kb:g.RKb5u..Hr,.~v.^kS.X,..d.rOm..hV....[.A.p.p
.l.i.c.a.t.i.o.n.R.u.n.].....P.r.o.c.e.s.s.L.i.s.t.=.3.6.0.T.r.a.y...e
.x.e.,.3.6.0.s.d...e.x.e.,.3.6.0.c.h.r.o.m.e...e.x.e.,.3.6.0.s.e...e.x
.e.,.3.6.0.M.o.b.i.l.e.M.g.r...e.x.e.,.B.a.i.d.u.A.n.T.r.a.y...e.x.e..
.0......


GET /update_platform/done.php?v=1.0.0.0&appname=sogoudownload_bindsecontrol&state=1 HTTP/1.1

User-Agent: HttpDownload

Host: t.sogou.com

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:58 GMT

Content-Type: text/html

Content-Length: 0

Connection: keep-alive

X-Powered-By: PHP/5.3.3
54d3460c179ca2b2069ae8f3<br/>HTTP/1.1 200 OK..Server: nginx..Dat
e: Sun, 22 May 2016 10:40:58 GMT..Content-Type: text/html..Content-Len
gth: 0..Connection: keep-alive..X-Powered-By: PHP/5.3.3..54d3460c179ca
2b2069ae8f3<br/>..

GET /net/a/66/link?appid=66&url=http://dl.app.sogou.com/pc_logo/yijianchongzhuang_745x240.png&r= HTTP/1.1

Accept: */*

Referer: hXXp://xz.sogou.com/softRecommend

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cmc.imgstore.cdn.sogou.com

Connection: Keep-Alive

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:56 GMT

Content-Type: image/png

Content-Length: 36851

Connection: keep-alive

Last-Modified: Sun, 22 May 2016 07:40:49 GMT

Expires: Mon, 23 May 2016 07:40:49 GMT

Cache-Control: max-age=86400

ETag: c9153defbd9c1c927650b5b5446b225a

X-YunTu-Cache: HIT

X-Yuntu-Trace: bjzw_8_120

X-Yuntu-Trace-Proxy: sjs_86_87
[email protected]......,......gAMA......a.... cHRM..z&.........
.....u0...`..:....p..Q<....bKGD..............tIME...... ;..k....IDA
Tx...w.fUy/.}.Z....2s..P..:..XPD.XP.DMLL,.kbL..c.i7..{..cCP.....Nez=..
u.....c....f.|~....9......=.E..... <.F.j.g'.....I...z....!Q.1.i....
..= D...3.@`..L.2..[..RX.=C.07.YJX.....X.....$..R..Yn0..PE.z.~.....c..
.....=.B3 A....5.b......M3. x!.J43gI..`p...<..,.li.....^.I....i...&
gt;.`0C.T(.:.$...k..O..^e.z....F...B..Q.hn......(,R P.. @.1\..k..,%.a.
G4c.Sv...E(..\.fCe...>.V.d....b.j...4@.@.?E..c..b.%P......0.._....,
.....K0..Y.u. ...Q.X.Y'.CO..M3...P...l..........F..B.......Y.0....!1;a
../>...yT..B..k..D.Mn....GEe.M.^...wH...`..-.^R....)a..C.-.3.D....T
.).S&...OU.."b.^.T.hL$B..fk.<......]d...B..pl@ By.X..g....B_ H.f.B.
.lmq...:.%$H0.\.....3JE..d."[email protected].#..yM.P.'H
...'H.N..@...|....([email protected]$.p{.......k.|..9..a..2Y.e.1
.aa...).......X3..[d..b.W........W..0%..7ewK......l9.-..D ....E.`nM...
b.eX..s~.2..d...........n<......Orw.z..-....;.l.6.(@...g.7..9s.....
.l{S..{........&..X..Z.4........Ct..........>.._Z...P.%&T*........5
..........%AP.=..8..`. &_.y....Z.'.1.!..H.H ....Kq..A.R.h...I.M....$b.
@.. .48.,L........0.Y..aRf7G....;v...e....$l..1 ....u...l"....Sp.4.Ckb
.)...D.6y..Ov.#.f..$lS...#... <R...1...QP .....;...C"./.,...m.....@
C...I...P:.#.&l.........*..(...X..lSk5.hl1... .[6...V3.....|.|.O. ...k
.3r.Z.(s....c....\..N.B.......2e.u....M..b...X.[z"....(.d..*.j..O|.`..
"....K.jU..T*[email protected]..`j4./...l.Q.6.y9.:...^. ...I...Bz...
<<< skipped >>>

GET /net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-3726774318030095000.png&r=null HTTP/1.1

Accept: */*

Referer: hXXp://xz.sogou.com/softRecommend

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cmc.imgstore.cdn.sogou.com

Connection: Keep-Alive

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:59 GMT

Content-Type: image/png

Content-Length: 12563

Connection: keep-alive

Last-Modified: Sat, 21 May 2016 11:43:14 GMT

Expires: Sun, 22 May 2016 11:43:14 GMT

Cache-Control: max-age=86400

ETag: aad931a542f9dbd361458639bfb4ea70

X-YunTu-Ipt: 0.016000032424927

X-Yuntu-Trace: yf_26_53

X-Yuntu-Trace-Proxy: yf_27_101
.PNG........IHDR..............>a.....gAMA......a.... cHRM..z&......
........u0...`..:....p..Q<....bKGD.......C......pHYs...#...#.x.?v..
..tIME..... ...T...0.IDATx..}y.%Uu...{.^.....W...a.d1...5*A.%.h..DMb4.
&q..".\.~.qGE../..,.......L..===..............u.{..._...t.....=.]..DK.
DK.DK.DK.DK.DK.DK.DK.DK.DK.D......X4.....ry...C....y......z.k.(.......
.....n.^...)HJ.h....P...p........q..}.z..5...BF..E.....a....m...0.....
........t....J.;b....A....k1..1 }-0.^`...?PX.iAY.R...6..g.....o... u..
y.Z..c..}@4..#-.. ....z...q....e..?,.|2P.$.Xk..BY......c...|?.{..yJ..m
....E......c..-#%[..-........5........2|..>6....3..?.G.......$.}b.v
.%..9$}..|c......y...fx....=.z/y....!..D........O..:.../?n ..g..I*b.h.
j.3"......0Q..&k....s...G...]..(...........h.N..#;..;56.....<...)..
F.F.< a... ^.Z....O..........cS..?.}...'.'...N..y...^a......R.$... 
..... 3..u.).!....L.c.. ....x..]...zO.%.../..~.....[.l.f.....-..O...@:
....(.^x..t.......tu....-i......B*.6 .y......ERJH).`......U1.....,..}.
..Dd........p..{E..^....foB[.....ia..?...%.ll.......^X...^..`..@([.%..
....#.P2..H....FR......Y.a...@<.3..7{]....F.r]..Bi...........q .%..
.........../[email protected]*.ON.y..sle)..Y3.!&....B2}v.....
b0...(..n)W.....AKb.P.P...|....O......?.>..i)."../.@:....rjI.....U,
..X.b60.,8P...:>...>.....]...B..).....@.."...`i)................
...$....R......'.z...].O.......v.l.'.}.f.B2..gU.O....'...!/...........
c}.......J...W.y^........F#..EW..#)..:....KD.....CW....G... .....o... 
..Q..(?...g.....pl. .........?......Y.A.(L.3....I...lI.-Ki.M...Ht.
<<< skipped >>>

GET /net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/5632829225944923461.png&r=null HTTP/1.1

Accept: */*

Referer: hXXp://xz.sogou.com/softRecommend

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cmc.imgstore.cdn.sogou.com

Connection: Keep-Alive

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:59 GMT

Content-Type: image/png

Content-Length: 8510

Connection: keep-alive

Last-Modified: Sat, 21 May 2016 13:27:41 GMT

Expires: Sun, 22 May 2016 13:27:41 GMT

Cache-Control: max-age=86400

ETag: 39120ed0c7c4e8992ac1565c69540fa8

X-YunTu-Ipt: 0.013999938964844

X-Yuntu-Trace: bjzw_97_68

X-Yuntu-Trace-Proxy: bjzw_40_33
.PNG........IHDR..............>a.....gAMA......a.... cHRM..z&......
........u0...`..:....p..Q<....bKGD.......C......pHYs...#...#.x.?v..
..tIME......)...... -IDATx...w.U....k.}....D.J......P.F.`...Q.`G.I&...
...L.Q...c...*:vl..(RTD@)"\............^N...s..>....}.^.o.....I.of.
.K....<............].....5@%..X.....>..W...._.4.x...$.&.W.C..p"p
1p8...{a....x.. 0..!$....3........|<..`.2....&".....0..;.......<
J.A.4&A(.&.w...;[email protected]$P.R.c...>._t...w! ....k.3
...5....4...B............]h...v....i2.8...V.Xd...<.%....H.......3.%
.5.z....#..5.w|....x.q.}...H..?...5.w6..LG..&....y..~H..wJ.,...V....C`
$Z..._..4-.z[C.J..<\....([email protected]\G...u..k.r.7.:..$...........S..o.z
......h-......JA..EncaZ.B.@......!.....}7$..n...`.....~.p6.7K........l
E$.....t~.by..A...A=a.^.~..w.E.r.]....]K.......H.(h..!n.m..z....5..*.R
m.T._o.u.....v.BM...K.J..`.9,..)!.,p>..F.S....]...Sy\....dtw-.^]`D_
.....vS.....*v...V..-.`T..2C...._l...1..hX...r.a[.T...J.............`.
[email protected]..]K`PO.8T1i.........Z.Q.a...q.2..B"....5.?.m...G.P...]E
..\....>.J..j../[email protected]!j..8.C.~.....q........K..a..F ...
..!..%;...9.....djn[...1,!..7.....L...:FL.-...j......b..kCM...."i..m.s
...........Ug.;..>T....3Pq.8......].$...V..............61.._ex.c.sK
..m4..J..l.{.f.W.~3c..../.....o.i.w9L..p.d.Qc........w:.L..w..\....5..
o...fK...%E...J..~3c.H%OAaG|m....}[email protected].${.........!.....F
...h.[.Y.IH...u.......ra~.....bA.....P.|....;.:N....t..V.y....BHfc..&g
t;...j......{..,Yo(..pl........'\G,...0./.8...C...E...hO....T..;F.
<<< skipped >>>

GET /net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-1433550905860313072.png&r=null HTTP/1.1

Accept: */*

Referer: hXXp://xz.sogou.com/softRecommend

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cmc.imgstore.cdn.sogou.com

Connection: Keep-Alive

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:59 GMT

Content-Type: image/png

Content-Length: 8018

Connection: keep-alive

Last-Modified: Sat, 21 May 2016 11:44:46 GMT

Expires: Sun, 22 May 2016 11:44:46 GMT

Cache-Control: max-age=86400

ETag: fed97390953dc45e825714f9c617b3c2

X-YunTu-Ipt: 0.014999866485596

X-Yuntu-Trace: bjzw_128_9

X-Yuntu-Trace-Proxy: tc_196_98
.PNG........IHDR..............>a.....gAMA......a.... cHRM..z&......
........u0...`..:....p..Q<....bKGD.......C......pHYs...#...#.x.?v..
..tIME.....,..0.....AIDATx...y.]W}.?.....wk.l..%.."..........2,a.....*
.$T..p..PIH.....UI..jB.....$a1........2..d.......w.=......m.%.....I.o.
..=.w.9.w......}C..{1o\;...I..L...S ,5Tz.`....13.....{.....e....v.....
./.p.;7....-E..].?... .Gg......5...W....?..S...5}Q-._deI..P.....9<.
LMM..z..NU/.).Q.^.....!....MWu\....E.~._Aw@D0..*... .0...p.B....... .?
.!..... [...I/._..WpA C....B.o.........Xzgd.........ZXX.\...Q.jp..n...
.$..5.......r..;....s. K......c.....a`..?...^.....CJs..I...._8.o.*..^.
[.z...}>....X4..Rg....CaP..7....>L.............j..y.`k.>..@..
...&0g..A......J..O........N...~.. ..7..d..._2....w:.e*.%dO...T...6.(6
.(J>.)Q..3....LF..........o.&".i;!...\F.......>..?.[...O.....G.#
.3.l..=.a.........3.....#..i;y......4.._.cp".V..'...T..R..A....%......
.s0..O..2./k....8*[email protected]/..n.../".$[S..&kpY.~.r.kV)...;..k.:.[..
...j..5...R|............7..0,.....0. 6.%..K...\S.....u.].....o.Dq...o.
.v...~..s..z .9%.....D.4|...._.)...j.R..v..]........M..DH\J...J.y.E...
`OA%..sp... .T....\F'K..z........!..W`.|,.4.[@*.us.-.au...u...,.;..[..
(......}....X.!.t.`BJseS..PP....J.d.>....[....N.L.^5...jM"`L......g
$.R.71 mS.N.[..X_...g.&.kWi>.2.l..ja...I...Z.L.....-C.#...].#.....j
vO..< ...;A7!Ko....Qn...k....w...E....Y3pvP....[...~.e.]...g......,
...oH...Bl..P....K`Z.>.%B%2T"Cl....T.o.h...{C....1"...{......fc....
K.............9~p..sc1.f.3.A..P...q...k...y(.&.......V.i......cR..
<<< skipped >>>

GET /net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/4669602030091557924.png&r=null HTTP/1.1

Accept: */*

Referer: hXXp://xz.sogou.com/softRecommend

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cmc.imgstore.cdn.sogou.com

Connection: Keep-Alive

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:41:00 GMT

Content-Type: image/png

Content-Length: 11255

Connection: keep-alive

Last-Modified: Sat, 21 May 2016 12:47:34 GMT

Expires: Sun, 22 May 2016 12:47:34 GMT

Cache-Control: max-age=86400

ETag: 1889e0afb5279bb55a640e7b27b43c0a

X-YunTu-Ipt: 0.012999773025513

X-Yuntu-Trace: bjzw_16_98

X-Yuntu-Trace-Proxy: sjs_86_87
.PNG........IHDR..............>a.....gAMA......a.... cHRM..z&......
........u0...`..:....p..Q<....bKGD.......C......pHYs...#...#.x.?v..
..tIME...../"......*.IDATx..]w.U.....{_.o... m..  ....j..%j~j.Xb...5&v
M...F.]cDc.h0...h......,......9.?.{."E..R....-o..33...3g...t....D':..N
t....D':..Nt....D'.sPG7.../.=r....X.... ..Y..1@.&.....L...`bf....#... 
.8.5...R.L......^........~.....1.j..t..............;y..|.........#XH..
.o......D`R&.>s..=.p|.f#~..7.1.{.......N.S...^R._...J..E.S.K.......
.?..........Y%...8Z...2T..G.8..A....@.`.3S....ll...}..P...c,z..~.2...:
.r.\n..v. ...i...AB.*.Z|MG.c.c...s.nCvQ.....j6C..6-...(...$c)f.G.~.z..
.#.#49..m.bR.........Y....t...|.. @$  ....r.`.B.s.ds.../.e......|."...
........O..'.\...~.........y.G.[.`....*.....O.....Lz.8O.. ..Q......Y..
....u..=.A..b[*[email protected]!..L6.. a~f......;~.....A<
..C..8!,/!n..x-...........KD...sKoA...@*.....JJ....d6C0.va..Q3.F.T....
[..)(NAC.`..."r......&..`v......ia..$.m.;...5..y)....K.e/.H.......D.QW
"Q........nA...s.oA.....pR.daRji....M.......m...6.......d.6q..........
0.4.@R...>..Kx..i....c...C....,...!.A...`...]k...n..|.ch...V.G..J..
..j.0L..u....b~. 'Z..*.........Z.....>......3X...I.<.A.<.....
{C...$.Vu.\.#...^*8....ux.....;f......i..^p=..}...;e....*{.n@%..>..
.h..B.H.cp.f..A........I2.K.."[email protected].
..7#....6.j).L.W..H...f....g$9.....D$.a...~.H0C.:-.!.!....\.....U.3..)
y....A..Z...w...........B..p...nZ.......?06....$5......IM..Ovt.[...f.&
lt;.Oa........xUV.&R.9..RJ.....Q\6...np........B........8.(..Q.{J-
<<< skipped >>>

GET /net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-3080605666447722537.png&r=null HTTP/1.1

Accept: */*

Referer: hXXp://xz.sogou.com/softRanking

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cmc.imgstore.cdn.sogou.com

Connection: Keep-Alive

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:41:00 GMT

Content-Type: image/png

Content-Length: 22286

Connection: keep-alive

Last-Modified: Sat, 21 May 2016 13:28:12 GMT

Expires: Sun, 22 May 2016 13:28:12 GMT

Cache-Control: max-age=86400

ETag: 33a044a3c64d4a5d817d9055d7620a91

X-YunTu-Ipt: 0.016999959945679

X-Yuntu-Trace: bjzw_44_61

X-Yuntu-Trace-Proxy: sjs_86_87
.PNG........IHDR..............>a.....gAMA......a.... cHRM..z&......
........u0...`..:....p..Q<....bKGD.......C......pHYs...#...#.x.?v..
..tIME.............U.IDATx...y.eWY..{.....\[email protected]
.Q[[.U...vh.EP.Vh@@..B...1.2.5Ow.g.{..~..}.=.R.T........{....{..].<
..?...l.z...`....7G..8...n.....f.D.7Z...;t.......d?........8w..1......
l....4....;T.6E'......?......r..,Y.OIq..},92........!.....".y..&`lt<
;\^]z...y..4.rEw)[email protected]..'d..5......#!..(...e.k.
..P)Uj...H.$h.[Wy....{..n1b.X.....#.k..1...AU...(.{....7.;q.P<:..d 
_.>,.?x..."JA}.$D8.d/.#......~.3..o.Uc.t........^f.%.bJq.(..0.A...x
.q....U.9...5......j.......Y...... [email protected]^D..G...oED....M..o....
..q\........L`\.I...^.K.e8..:.k...E..B.E>.....L...{.Sud..k.p......'
.)..E.2.7 .|."...^D...S.UU.3.e?....T.:5...k...i.[..M:..i..........y..s
[email protected]}....K ....0D...e.oJ...e'....#"X.z..u..?t..[.Wuvv....`.{Y
YY...B...g..>...X..z...!...|>...0b..e..3....Y.....K..k..7...M..9
....A..w5U.=...7.....~...b.5 ..,//..v......>.;..l.......g..m..c0.. 
N3.H.x.........DY...9..>..0<N.~`.u.....#.K^V.O../x..3.l/I...yV..
.s}............~.9.....3F0b......1..@. .T..../T.....x........_D..c..~.
s.....M..d........H.......v..W....9w.vvz6............{..|F... 7....`.:
.<...<.K<..e.N.)..~.T.'.K.g......n..O.2....<.V......K..C..
%..;...k.<.=.U...#.....!..k.O....?......O..?...e...#.:U..,K.8..z.e/
......F......a.-T3.D{..NNz?t..>.z%...pT.$-B.{.k. .A`s$..|....X..[..
..R.`..].v4.".c.9.....w.e.7c.3fii...........'ix..rZl..8`3./.!.....
<<< skipped >>>

GET /net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/4871856506745242874.png&r=null HTTP/1.1

Accept: */*

Referer: hXXp://xz.sogou.com/softRanking

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cmc.imgstore.cdn.sogou.com

Connection: Keep-Alive

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:41:00 GMT

Content-Type: image/png

Content-Length: 24324

Connection: keep-alive

Last-Modified: Sat, 21 May 2016 13:29:29 GMT

Expires: Sun, 22 May 2016 13:29:29 GMT

Cache-Control: max-age=86400

ETag: bd275ac3f83cb51426145c3a1b9f6ac8

X-YunTu-Cache: HIT

X-Yuntu-Trace: tc_52_37

X-Yuntu-Trace-Proxy: zw_64_27
.PNG........IHDR..............>a.....gAMA......a.... cHRM..z&......
........u0...`..:....p..Q<....bKGD.......C......pHYs...#...#.x.?v..
..tIME.......<..R..].IDATx...w.%U./.]{W.I7.......M7..Ii.......Q.4.8
>...(..3>ELO16..).#9..4 ...............C.m...8.W~...sn.:..w}..k.
...I....j....~..}..0{.,..1.0?.....7..J).(.j.....wW*...N;m..e.f...N-..U
!D....v.'6F ...fs|..m............cc#.... `..l.....m..,C..rbb.._q.Y.v-.
..Wy..)...C.e..G.W...o...r..j....A..}......4g.l.!.Q.....}..G...[...C..
.....v..i..........EQEJ)...RB....a...Z.h.....j..CCC;.......oZ.v.c..^..
C.=.UF./m.............|......_........s?..y...G......k.........(J....N
;..K/....q...<.a...h..l.1.\.1.Z..?..~..hcx.......u.?..-....o~...X.|
...:..1.X.....oy.......,\..~......_..W..G.q..........t.{.........G..]3
844.J.g.Y...3_...&............J...9..a.F..........[V.^...N<..8e....
.....W.z..T*..S.L.s?...#....QG.M....k.y.[{.... ~.......G~;4<.R:7P..
3.U..V..e...N.9.0..h......]s.=7|.......{.......{.o}.....!.`...=.......
.(..t..5..............o.y..m..Zi.,Ni.R.u........pf.....4..J.<|..-~.
.......].j.......7.tS../...@I.`..9.nQ.y.........*.f../...|..o........j
j...1:UZ.Z.Lk..i.....R.[..ff.N....V.Y.@_<..3m8..[Js3S.:Js......*...
.|.5o..k...n....}...j...t.e.G.z....jkk......".....]...w........n.Q....
...;..k..442.. ..*.Z.2..B}...Zq3S.*..v..l..4M..l.D.......s...z...V..,e
.....2.S..N..........Xl......^w....v...J..v....>...5K..Z..'...4....
...!.......^.ZCDt..^v.?...>|..G....3f.k....l......... H ......c....
..k,.....&2.O..K...Z..i ..HH...K..$T$..$0.*1...........UA..C......
<<< skipped >>>

GET /net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/-6699374927030488929.png&r=null HTTP/1.1

Accept: */*

Referer: hXXp://xz.sogou.com/softRanking

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cmc.imgstore.cdn.sogou.com

Connection: Keep-Alive

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:41:01 GMT

Content-Type: image/png

Content-Length: 10697

Connection: keep-alive

Last-Modified: Sat, 21 May 2016 13:47:36 GMT

Expires: Sun, 22 May 2016 13:47:36 GMT

Cache-Control: max-age=86400

ETag: d863a2272c2088e7948acacfb5609d22

X-YunTu-Cache: HIT

X-Yuntu-Trace: bjzw_56_116

X-Yuntu-Trace-Proxy: bjzw_16_121
.PNG........IHDR..............>a.....gAMA......a.... cHRM..z&......
........u0...`..:....p..Q<....bKGD..............tIME.....$.......(.
IDATx...y.]U}.......|3. ...9..@F."2.kQ.C...j......Sm...k.....G.-..O.A.
..2#...!..In.|..~....9..{........}>;.....Yk..............#..F.(....
[email protected].;[ s.d.7..p......t..X.EHd!...*`1..F...{H.3....g(....%
.I`.....5..,.."...N.N.N...=..D.... .f..sG.{.....9.....U!.8...*@l@...}.
p2p......_."j8P.../..0.......fm................pA..B.(..=..$..........
A'-......Q|[email protected].."..8..".p.\.c4.k..n..D..9....v....
...{..(}.7..VT.&.-..P.....#r.p...8...d..<....{* .......2.......q...
...#x.w.=A..rY%9.....5.e..rx...l....v.0.%!..7..........5~$......D.H...
.`..9I.NT*'[email protected].."....V..(..R.7.T@%.j.a."....7....m.D.....N.x......A
.6"<b....>....n.......V.. .~...@.(...........4y|#...ZTp.........
d......y#.J......s.G.M ....Uz.r.p<..q.s.p4...,*.8{Wqx ...y...e..3..
v...>..pm.."...&!J.....o^.z,.k..q.........bo..4:..5......dQJ.z]..*.
.5....X..3.GXaP..v...ht.$.....<(.,.../.........8..V. ..WhV.^s.7..i/
..........(...\....I.O...Sy.8....~..3.#....'. ..*...%....K....!2...nr.
..t..3&m*....Ys.........w0.j`J.P..k..R.`S...2......l......(.6......Y..
..ew..;.^.......`f680..l....n?...`...t=....([email protected]...
.v......*}.To...!*&h. ....X$....|...*[email protected]..^..."w.Y.|:..p......v.U
....Sk..D..s[I0..QsyH....V.c..q.....&..kB....w.....4.....l..j.<....
......'NI.f@. [email protected] 
...a..o......S.W"....@?...e..Qj.......Wy.c..C.Sy`.G.u.G...l.."&.(.
<<< skipped >>>

GET /net/a/16/link?appid=16&url=http://dl.app.sogou.com/pc_logo/2040683535505104749.png&r=null HTTP/1.1

Accept: */*

Referer: hXXp://xz.sogou.com/softRanking

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cmc.imgstore.cdn.sogou.com

Connection: Keep-Alive

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:41:01 GMT

Content-Type: image/png

Content-Length: 73015

Connection: keep-alive

Last-Modified: Sun, 22 May 2016 02:00:25 GMT

Expires: Mon, 23 May 2016 02:00:25 GMT

Cache-Control: max-age=86400

ETag: 4bb8331597dd543b9706f3581d79c62e

X-YunTu-Cache: HIT

X-Yuntu-Trace: yf_25_38

X-Yuntu-Trace-Proxy: yf_22_56
.PNG........IHDR.....................gAMA......a.... cHRM..z&.........
.....u0...`..:....p..Q<....bKGD.......X......pHYs...H...H.F.k>..
..tIME.....*...c.....IDATx...u.Ue...Z.>.Lw... .."...t.....*..b!.J.t
H..JJww....t.s.... ~.......[....3...s....W/....R9........../=(.....f..
...I5*x.x_... .$.SSn8...... ............~{D_.}o..9.....S..!s...?.0....
...=x.\9`shm...^...7...}.61.s.5..~ .N..v.r.s...i~.2...y.K6.....c.f..|.
J.r.L.&5y.D)&.e..=.T..I....e.,...m.K8.n...n..?.J....%.}r a.......]....
.3,{...Q...dT.....<x`.A x....~.W. .V....x..... .....O{%[email protected].....
...#...r^....[..]..sv...?"=G..gr.#.q....[.G.... ...,Lk).O..s..C....}.e
[.4.<.gs..?.[.]Rg'......_.....w.....#.H...s9.s..C.D>.q.m..].Ox..
..Ib.......lI..O..{......H\.{..|l|.M.....7........8...d..:Tk....n..%7$
.[>.$...~...>.. .7.0Vp.CG..C....,.......0....k.[...E...(.;..z{..
6X.Q.k...........2Q...R.:i...H.r]..-..v.........^.k0..-z.....{........
..... ..%.@.\.~.c.1.....o..r..4(.......6oS.g.*...G.7.w...E...`34d.....
.z@3G}GcG}.Z...l~vl..ZK..G.........5.&........7.u.n...y..w.;".......Lj
...no.N..9...9.`.'.s..yx.}.}..r.x....2'_:..r....?.....^.F........N3.}~
.|g.....6"..E....4~1.s..t ..v.^..h.W.3{e...,.S[.o....{...C;..b.!i..D..
..........KH...?fU..M..#........a.J._l,..CGW.M^..\,..K[R.@.].O...[&Q..
a........9E.c....o...!.n$..p.y...x3.s...%..(A4.._7.I.N..iRYZ......k;..
..k... .........5.....B|c\..i7L.(...;j...p.}..9...r...............'.b.
........$>x.I[..).......#........%..............U..]....E.......js.
....kA..]0,..".....>.z.........gS..>.|..4)Y.w.....%F.....wV.
<<< skipped >>>

GET /ie-css3.htc HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xz.sogou.com

Connection: Keep-Alive

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3; JSESSIONID=aaaKeb7N9G-M38UzAdytv

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:58 GMT

Content-Length: 11952

Connection: keep-alive

ETag: "AVYcdCtTP6x"

Last-Modified: Thu, 19 May 2016 10:17:29 GMT

Accept-Ranges: bytes
...Do not remove this if you are using.....Original Author: Remiz Rahn
as..Original Author URL: hXXp://VVV.htmlremix.com..Published date: 200
8/09/24..Changes by Nick Fetchak:..- IE8 standards mode compatibility.
.- VML elements now positioned behind original box rather than inside 
of it ... should be less prone to breakage..- Added partial support fo
r ...box-shadow... style..- Checks for VML support before doing anythi
ng..- Updates VML element size and position via timer and also via win
dow resize event..- lots of other small things..Published date : 2010/
03/14..hXXp://fetchak.com/ie-css3..Thanks to TheBrightLines.com (http:
//VVV.thebrightlines.com/2009/12/03/using-ies-filter-in-a-cross-browse
r-way) for enlightening me about the DropShadow filter..timer_length =
 200; // Milliseconds..border_opacity = false; // Use opacity on borde
rs of rounded-corner elements? Note: This causes antialiasing issues..
// supportsVml() borrowed from hXXp://stackoverflow.com/questions/6541
12/how-do-you-detect-support-for-vml-or-svg-in-a-browser..function sup
portsVml() {..if (typeof supportsVml.supported == ...undefined...) {..
var a = document.body.a(document_createElement_x_x_x_x_x(...div...));.
.a.innerHTML = ...;..var b = a.firstChild;..b.style.behavior = ...url(
#default#VML)...;..supportsVml.supported = b ? typeof b.adj == ...obje
ct...: true;..a.parentNode.removeChild(a);..}..return supportsVml.supp
orted..}..// findPos() borrowed from hXXp://VVV.quirksmode.org/js/find
pos.html..function findPos(obj) {..var curleft = curtop = 0;..if (
<<< skipped >>>

GET /softRanking/loadMore?pageSize=10&pageNo=1 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://xz.sogou.com/softRanking

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xz.sogou.com

Connection: Keep-Alive

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3; JSESSIONID=aaaKeb7N9G-M38UzAdytv

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:58 GMT

Content-Type: application/json; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Cache-Control: no-cache

Expires: Thu, 01 Jan 1970 00:00:00 GMT
f36..{"data":[{"docid":"-3080605666447722537","time":"2016-05-12","det
ails":".............................................","name":"QQ","dow
nloadnum":"0","pid":"34","cid":"1","logo_url":"http:\/\/cmc.imgstore.c
dn.sogou.com\/net\/a\/16\/link?appid=16&url=http://dl.app.so
gou.com/pc_logo/-3080605666447722537.png&r=null","fullname":"Q
Q","size":"54.25MB","hd_data":"{\"docid\":\"-3080605666447722537\",\"i
con\":\"http:\\\/\\\/dl.app.sogou.com\\\/pc_logo\\\/-30806056664477225
37.png\",\"name\":\"QQ\",\"pid\":\"34\",\"cid\":\"1\",\"size\":\"54.25
MB\",\"sogouHighdownUrl\":\"http:\\\/\\\/xiazai.sogou.com\\\/comm\\\/r
edir?softdown=1&u=YRyEVuHeM45mBjjEUSPVUEJm8GF_McJfVdEjKPrgnocp6RPTnPFS
Kls2-N19zn1Vkn7odhWiVY2XtB1GttVabv1-ADEcrdTQ-iKClemVEPIO-inS8VQTtv5V2h
DxQGVyuN87GS8Q0oehm6RfSK3qEdVQPXpgHp2iMhxDAjN02n4mFjdOpBN0epdYeddfMeUW
&pcid=-3080605666447722537&filename=QQ8.3.exe\"}"},{"docid":"563282922
5944923461","time":"2016-04-13","details":"...........................
..................","name":"............","downloadnum":"0","pid":"34"
,"cid":"12","logo_url":"http:\/\/cmc.imgstore.cdn.sogou.com\/net\/a\/1
6\/link?appid=16&url=http://dl.app.sogou.com/pc_logo/563
2829225944923461.png&r=null","fullname":"............","size":"49.
15MB","hd_data":"{\"docid\":\"5632829225944923461\",\"icon\":\"http:\\
\/\\\/dl.app.sogou.com\\\/pc_logo\\\/5632829225944923461.png\",\"name\
":\"............\",\"pid\":\"34\",\"cid\":\"12\",\"size\":\"49.15MB\",
\"sogouHighdownUrl\":\"http:\\\/\\\/xiazai.sogou.com\\\/comm\\\/re
<<< skipped >>>

GET /softassis/img/ranking-ico.png HTTP/1.1

Accept: */*

Referer: hXXp://xz.sogou.com/softRanking

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xz.sogou.com

Connection: Keep-Alive

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3; JSESSIONID=aaaKeb7N9G-M38UzAdytv

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:59 GMT

Content-Type: image/png

Content-Length: 1103

Connection: keep-alive

Last-Modified: Thu, 19 May 2016 08:23:34 GMT

ETag: "573d7806-44f"

Expires: Wed, 25 May 2016 10:40:59 GMT

Cache-Control: max-age=259200

Accept-Ranges: bytes
[email protected] ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:07A25883293D11E5BA4C
CD9836B368CC" xmpMM:DocumentID="xmp.did:07A25884293D11E5BA4CCD9836B368
CC"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:07A25881293D11
E5BA4CCD9836B368CC" stRef:documentID="xmp.did:07A25882293D11E5BA4CCD98
36B368CC"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>Y..n....IDATx.b.......0..%.....8..h.3..
...D.C@@...J`..Q.F.....@|....`.....@[email protected]...{Py..d...K ^[email protected]
[email protected]....`3.8|.%HP.....db.^O..F..Q.F..5hp.k..T...[.=...)...^.b;Z
...4j..A..^.bK.z. ...umH..D.....IEND.B`.HTTP/1.1 200 OK..Server: nginx
..Date: Sun, 22 May 2016 10:40:59 GMT..Content-Type: image/png..Conten
t-Length: 1103..Connection: keep-alive..Last-Modified: Thu, 19 May 201
6 08:23:34 GMT..ETag: "573d7806-44f"..Expires: Wed, 25 May 2016 10:40:
59 GMT..Cache-Control: max-age=259200..Accept-Ranges: bytes...PNG.....
[email protected] ImageReadyq.e<..
<<< skipped >>>

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=158649200-237973799

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:41:01 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 222.88.91.15, Configured MISS from 222.88.91.18, UGenerate MISS from 123.147.166.37
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=564660232-633941439

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:43:16 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 222.88.91.19, UGenerate MISS from 125.39.5.33
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=356895164-634465727

Referer: hXXp://123.147.166.36/client

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:29 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 221.204.226.49, UGenerate MISS from 123.147.166.36
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=317298400-634596799

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:41:01 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 218.58.225.38, Configured MISS from 218.58.225.50, UGenerate MISS from 123.147.166.13, Configured MISS from 123.147.166.14
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /cache/300hero.download.jumpwgame.com/client/300_v0.2.406.zip?ich_args=a6e23c7ef9e8009565d7b74153176f8a_1_0_0_2_5d1e65fcfb7400741be5b2dbf911b54b50a4a6ddab3276edd4f5cf3230bf617a_20eec99348d222f8a2f0db7ba7fc6395_1_0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 111.7.131.67

Pragma: no-cache

Range: bytes=39662300-79324599

Referer: hXXp://300.jumpw.com/index.html?cid=0

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 403 Forbidden

Server: httpserver

Date: Sun, 22 May 2016 10:41:11 GMT

Content-Type: text/html

Content-Length: 569

Connection: keep-alive
<html>..<head><title>403 Forbidden</title><
/head>..<body bgcolor="white">..<center><h1>403 F
orbidden</h1></center>..<hr><center>httpserver
</center>..</body>..</html>..<!-- a padding to di
sable MSIE and Chrome friendly error page -->..<!-- a padding to
 disable MSIE and Chrome friendly error page -->..<!-- a padding
 to disable MSIE and Chrome friendly error page -->..<!-- a padd
ing to disable MSIE and Chrome friendly error page -->..<!-- a p
adding to disable MSIE and Chrome friendly error page -->..<!-- 
a padding to disable MSIE and Chrome friendly error page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=475947600-555272199

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:41:02 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 110.80.134.201, UGenerate MISS from 123.147.166.36
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=426287805-495680445

Referer: hXXp://27.209.182.8/client

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:40 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 221.204.226.49, Configured MISS from 221.204.226.47, UGenerate MISS from 27.209.182.28, Configured MISS from 27.209.182.25
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=426287805-495680445

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:11 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 218.58.225.38, Configured MISS from 218.58.225.50, UGenerate MISS from 27.209.182.28, Configured MISS from 27.209.182.25
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /app/a/10190001/CC1430117533187 HTTP/1.1

Accept: */*

Referer: hXXp://xz.sogou.com/softRecommend

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img03.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_VCLOUD_ACCESS

Connection: keep-alive

Date: Sun, 22 May 2016 10:40:54 GMT

Cache-Control: max-age=86400

Expires: Mon, 23 May 2016 10:40:54 GMT

Last-Modified: Sat, 21 May 2016 21:01:06 GMT

Content-Type: image/png

Content-Length: 104812

X-Cache-Lookup: Hit From MemCache

ETag: 14bc09e4cd90b4aa7520414ded59b107

X-Daa-Tunnel: hop_count=1

X-Cache-Lookup: Hit From Inner Cluster 
.PNG........IHDR.............2.m&....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=0-78472631

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:39 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 222.88.91.19, UGenerate MISS from 125.39.5.33
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=148972984-218254191

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:43:18 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 221.204.226.49, UGenerate MISS from 123.147.166.13, Configured MISS from 123.147.166.14
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=287502523-356895163

Referer: hXXp://125.39.5.36/client

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:38 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 222.88.91.15, Configured MISS from 222.88.91.18, UGenerate MISS from 125.39.5.36
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=565073087-634465727

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:10 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 110.80.134.199, Configured MISS from 110.80.134.202, UGenerate MISS from 123.147.166.13
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

HEAD /pc_logo/7638937123950702413.png HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, application/msword, application/vnd.ms-excel, application/vnd.ms-powerpoint, */*

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; {D9D54F49-E51C-445e-92F2-1EE3C2313240})

Host: dl.app.sogou.com

Content-Length: 0

Cache-Control: no-cache

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.0 503 Service Unavailable

Server: Cdn Cache Server V2.0

Date: Sun, 22 May 2016 10:40:54 GMT

Content-Type: text/html

Content-Length: 1604

Expires: Sun, 22 May 2016 10:40:54 GMT

X-Cache-Error: ERR_CANNOT_FORWARD 11

Via: 1.0 db79:82 (Cdn Cache Server V2.0)

Connection: close

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=287535400-356816607

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:43:04 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 221.204.226.49, Configured MISS from 221.204.226.47, UGenerate MISS from 27.209.182.28, Configured MISS from 27.209.182.25
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=287502523-356895163

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:27 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 222.88.91.15, Configured MISS from 222.88.91.18, UGenerate MISS from 125.39.5.36
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=0-79324599

Referer: hXXp://123.147.166.13/client

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:41:46 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 110.80.134.201, UGenerate MISS from 123.147.166.13
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=148972984-218254191

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:43:03 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 110.80.134.201, UGenerate MISS from 123.147.166.13, Configured MISS from 123.147.166.14
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

HEAD /128128.png HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, application/msword, application/vnd.ms-excel, application/vnd.ms-powerpoint, */*

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; {D9D54F49-E51C-445e-92F2-1EE3C2313240})

Host: dl.app.sogou.com

Content-Length: 0

Cache-Control: no-cache

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.0 503 Service Unavailable

Server: Cdn Cache Server V2.0

Date: Sun, 22 May 2016 10:40:55 GMT

Content-Type: text/html

Content-Length: 1564

Expires: Sun, 22 May 2016 10:40:55 GMT

X-Cache-Error: ERR_CANNOT_FORWARD 11

Via: 1.0 db80:7002 (Cdn Cache Server V2.0)

Connection: close

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=218254192-356816607

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:53 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 222.88.91.15, Configured MISS from 222.88.91.17, UGenerate MISS from 125.39.5.8
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=565073087-634465727

Referer: hXXp://123.147.166.13/client

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:38 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 110.80.134.201, UGenerate MISS from 123.147.166.13
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=79691776-633941439

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:53 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 222.88.91.15, Configured MISS from 222.88.91.17, UGenerate MISS from 123.147.166.36
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=0-

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:41:00 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 61.130.28.167, UGenerate MISS from 123.147.166.36
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=148717241-218109881

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:03 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 110.80.134.201, UGenerate MISS from 123.147.166.13, Configured MISS from 123.147.166.14
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=356895164-634465727

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:00 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 218.58.225.38, Configured MISS from 218.58.225.37, UGenerate MISS from 123.147.166.36
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=495680446-634465727

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:13 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 221.204.226.49, UGenerate MISS from 125.39.5.8
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

POST / HTTP/1.1

Host: 163.177.79.152:80

Content-type: application/octet-stream

Content-Length: 92

Connection: Keep-Alive

<.......P...|...(...TLQ.j....W.......{..`t.\.V.{>X.G........5.....C..Z.....y.#.I...-51.X..p
HTTP/1.1 200 OK

Content-Length: 60

Content-Type: application/octet-stream

Connection: Close
HTTP/1.1 200 OK..Content-Length: 60..Content-Type: application/octet-s
tream..Connection: Close..<.......0.......F...!..../70..$.U.)7.....
....... .(.U..f..ed..

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=565073087-634465727

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:27 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 110.80.134.199, UGenerate MISS from 123.147.166.13
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

POST / HTTP/1.1

Host: 123.129.242.154:80

Content-type: application/octet-stream

Content-Length: 204

Connection: Keep-Alive

<[email protected].&.!.J.qK......gE,M.3..*..........Y.(........Q
..........K.]Bu.. ......]]..R.y........E.D....:..).=.. ...%.q..U...,5.=.bI.....#............e1..... ......u....'G...P4T.....<.
HTTP/1.1 200 OK

Content-Length: 28

Content-Type: application/octet-stream

Connection: Close
HTTP/1.1 200 OK..Content-Length: 28..Content-Type: application/octet-s
tream..Connection: Close..<.............W'.D..;....M....

GET /externalapp/SogouSoftwareExternalApp.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: yze.t.sogou.com

Connection: Keep-Alive

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1

HTTP/1.0 200 OK

Date: Wed, 18 May 2016 11:51:24 GMT

Content-Type: application/octet-stream

ETag: "-394504404"

Accept-Ranges: bytes

Last-Modified: Wed, 18 May 2016 11:42:04 GMT

Content-Length: 5844568

Server: WS CDN Server

Age: 341354

Via: 1.0 db80:8032 (Cdn Cache Server V2.0)

Connection: close
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z...........0.......p....@.........
.................P......|.Y......................................s....
[email protected].................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
[email protected][email protected].
...n.......p...t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
..>[email protected].>[email protected]
...Pr@..}[email protected]... M.......M....3.....FQ.....NU..
M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...
[email protected]}[email protected].}.j.W.E......E.......Pp@.
[email protected]@.W...E..E.h [email protected]...\r
@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.
......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[...U.
<<< skipped >>>

POST / HTTP/1.1

Host: 122.143.5.59:80

Content-type: application/octet-stream

Content-Length: 92

Connection: Keep-Alive

@.......P...........V.......mK9[4[....*J..hr.........<.../...C$H..Y..~...YT ..b...m..%..S...
HTTP/1.1 200 OK

Content-Length: 8604

Content-Type: application/octet-stream

Connection: Close
@........!.......g;.9..S..1.l.r.>../.....i....U..F.Ur........\}..[.
.]2.4...~.[..J^..c`...`........C]..]..'Q.....m.[z\).#...w.Pq.....:.W..
X.L[.Y.lv....~5p.|...6..v-i.....Qz. ...k..Nk...^.. N"S...r0S.L~..<r
qLN ."wXO...@.".#7.}l.A..H..s&l'.87k;.K.... ..7..bXuv.F.c......!..IHs.
6....<..........%p.~.B.S x7w..`E..)..%..Fw....O.& |a..i..a!..3;Jn..
..[B.=..G/..B.0KlR.D..|..j.OT._..BZ...#..^.....D...3..}.2.h<D./..!}
[email protected]{S....K....-..
.v....>o.z..E.WE.W.=H.....^*...Z8.rM.O.. I.R....,&<....~n.......
[email protected]?{z.......-9<.k
*..2Y...(7.d..0H.4...K....>[email protected]..].t`[email protected].
l..} H..O....}.d......C.42....@8dRY....%..}V0|P.......K.$.._....V.....
....z\......w....(....L....F2.....05.w..hp.y....8P.)..G66...y.....q...
......l...T;5.b...?.}U..5u.Q..@.@Z..(?M.%[email protected]..}E....U...[!.E
N..O..V;.dL.....o2)|.,.4.!....G..?...o?c.5..e.g..Qb.(...r.5.. .o......
.9........kD9...pW.0`.}.D;....m=.;..F.......k......".......H.>...2.
..$sU..V...B.h.W../..V....|.|....t.........)g6.y..A...)....,.Vz.IGL/{d
t0PvgdD.rws..\[email protected]<..'.....-R#.@e.,..8*..9...
.m.yF.P..Zs..\..JXN......{.cq....-.U(.....1.sZ..V.-./.....,[email protected].&g
t;...n1A..r}.........}.C.7.Z3.....E9...h...P......Q.Y..Y...3......>
..TS..Y.~.}....|. .Jm...e....k{=D....3..'[......z.zu..Y......|.{......
.1.uI>7..Lj'\...:A..wN....O.>(..n........r:.G...K9..H.....l.u...
......._...B....}..F. .i.....6._...W.f@.`..0C`.....3..7.B}..^._b..
<<< skipped >>>

GET /cache/300hero.download.jumpwgame.com/client/300_v0.2.406.zip?ich_args=a6e23c7ef9e8009565d7b74153176f8a_1_0_0_2_5d1e65fcfb7400741be5b2dbf911b54b50a4a6ddab3276edd4f5cf3230bf617a_20eec99348d222f8a2f0db7ba7fc6395_1_0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 111.7.131.67

Pragma: no-cache

Range: bytes=79691776-148717240

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 403 Forbidden

Server: httpserver

Date: Sun, 22 May 2016 10:42:28 GMT

Content-Type: text/html

Content-Length: 569

Connection: keep-alive
<html>..<head><title>403 Forbidden</title><
/head>..<body bgcolor="white">..<center><h1>403 F
orbidden</h1></center>..<hr><center>httpserver
</center>..</body>..</html>..<!-- a padding to di
sable MSIE and Chrome friendly error page -->..<!-- a padding to
 disable MSIE and Chrome friendly error page -->..<!-- a padding
 to disable MSIE and Chrome friendly error page -->..<!-- a padd
ing to disable MSIE and Chrome friendly error page -->..<!-- a p
adding to disable MSIE and Chrome friendly error page -->..<!-- 
a padding to disable MSIE and Chrome friendly error page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=495680446-634465727

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:02 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 221.204.226.49, UGenerate MISS from 125.39.5.8
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /cache/300hero.download.jumpwgame.com/client/300_v0.2.406.zip?ich_args=a6e23c7ef9e8009565d7b74153176f8a_1_0_0_2_5d1e65fcfb7400741be5b2dbf911b54b50a4a6ddab3276edd4f5cf3230bf617a_20eec99348d222f8a2f0db7ba7fc6395_1_0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 111.7.131.67

Pragma: no-cache

Range: bytes=79691776-148717240

Referer: hXXp://111.7.131.67/cache/300hero.download.jumpwgame.com/client

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 403 Forbidden

Server: httpserver

Date: Sun, 22 May 2016 10:42:39 GMT

Content-Type: text/html

Content-Length: 569

Connection: keep-alive
<html>..<head><title>403 Forbidden</title><
/head>..<body bgcolor="white">..<center><h1>403 F
orbidden</h1></center>..<hr><center>httpserver
</center>..</body>..</html>..<!-- a padding to di
sable MSIE and Chrome friendly error page -->..<!-- a padding to
 disable MSIE and Chrome friendly error page -->..<!-- a padding
 to disable MSIE and Chrome friendly error page -->..<!-- a padd
ing to disable MSIE and Chrome friendly error page -->..<!-- a p
adding to disable MSIE and Chrome friendly error page -->..<!-- 
a padding to disable MSIE and Chrome friendly error page -->....

POST / HTTP/1.1

Host: 58.254.134.139:80

Content-type: application/octet-stream

Content-Length: 44

Connection: Keep-Alive

A....... .....[F/./.......q....6...A.P|/6...
HTTP/1.1 200 OK

Content-Length: 28

Content-Type: application/octet-stream

Connection: Close
HTTP/1.1 200 OK..Content-Length: 28..Content-Type: application/octet-s
tream..Connection: Close..A...........~P..O........h....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=0-79324599

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:41:34 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 110.80.134.201, UGenerate MISS from 123.147.166.13
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=396623000-475947599

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:41:33 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 222.88.91.15, Configured MISS from 222.88.91.18, UGenerate MISS from 125.39.5.36
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=39236316-78472631

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:39 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 221.204.226.49, Configured MISS from 221.204.226.50, UGenerate MISS from 125.39.5.8
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /pingd?srctype=sogousoftware&gid=gVMH-W4-eABbBFUKZSRC2N0000o30f--&unc=sogousoftware_game&t=10&rand=1463913643 HTTP/1.1

User-Agent: HttpRequest

Host: ping.t.sogou.com

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:34 GMT

Content-Type: application/octet-stream

Content-Length: 0

Connection: keep-alive

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=218109882-356895163

Referer: hXXp://xiazai.sogou.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:01 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 110.80.134.200, UGenerate MISS from 123.147.166.37
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

POST / HTTP/1.1

Host: 58.254.134.140:80

Content-type: application/octet-stream

Content-Length: 140

Connection: Keep-Alive

A...........$..}-jKs".y 1...y...OH.aI..i.4...h.A.....M.d.?j..6..~h&0.. .x...A......
.....4..z.[H.......o%M.........<....[.8.S.......Q.....N
HTTP/1.1 200 OK

Content-Length: 44

Content-Type: application/octet-stream

Connection: Close
HTTP/1.1 200 OK..Content-Length: 44..Content-Type: application/octet-s
tream..Connection: Close..A....... ....X..d/W6 .L.q.......v.Zh.....4..
..

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=148717241-218109881

Referer: hXXp://123.147.166.14/client

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:37 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 110.80.134.199, Configured MISS from 110.80.134.202, UGenerate MISS from 123.147.166.13, Configured MISS from 123.147.166.14
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /app/a/10190001/741430117543639 HTTP/1.1

Accept: */*

Referer: hXXp://xz.sogou.com/softRecommend

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img04.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_VCLOUD_ACCESS

Connection: keep-alive

Date: Sun, 22 May 2016 10:40:53 GMT

Cache-Control: max-age=86400

Expires: Mon, 23 May 2016 10:40:53 GMT

Last-Modified: Sat, 21 May 2016 23:18:48 GMT

Content-Type: image/png

Content-Length: 151522

X-Cache-Lookup: Hit From Disktank

ETag: 39932f127e952c35a683cdf6fe90d0a7

X-Daa-Tunnel: hop_count=1

X-Cache-Lookup: Hit From Inner Cluster 
.PNG........IHDR.............2.m&....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /client/300_v0.2.406.zip HTTP/1.1

Accept: */*

Accept-Language: en-us

Cache-Control: no-cache

Connection: Keep-Alive

Host: 300hero.download.jumpwgame.com

Pragma: no-cache

Range: bytes=79324600-396622999

Referer: hXXp://300hero.download.jumpwgame.com/client

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1

HTTP/1.1 404 Not Found

Date: Sun, 22 May 2016 10:42:03 GMT

Content-Length: 591

Content-Type: text/html

Connection: Keep-Alive

Server: fastmirror 2014-09-09_2014-09-24

Fw-Via: UGenerate MISS from 222.88.91.19, UGenerate MISS from 125.39.5.33
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>fastmirror
 2014-09-09_2014-09-24</center>..</body>..</html>..&
lt;!-- a padding to disable MSIE and Chrome friendly error page -->
..<!-- a padding to disable MSIE and Chrome friendly error page --&
gt;..<!-- a padding to disable MSIE and Chrome friendly error page 
-->..<!-- a padding to disable MSIE and Chrome friendly error pa
ge -->..<!-- a padding to disable MSIE and Chrome friendly error
 page -->..<!-- a padding to disable MSIE and Chrome friendly er
ror page -->....

GET /pc_logo/7638937123950702413.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dl.app.sogou.com

Connection: Keep-Alive

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

HTTP/1.0 503 Service Unavailable

Server: Cdn Cache Server V2.0

Date: Sun, 22 May 2016 10:40:54 GMT

Content-Type: text/html

Content-Length: 1604

Expires: Sun, 22 May 2016 10:40:54 GMT

X-Cache-Error: ERR_CANNOT_FORWARD 11

Via: 1.0 db79:82 (Cdn Cache Server V2.0)

Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "htt
p://VVV.w3.org/TR/html4/loose.dtd">.<HTML><HEAD>.<ME
TA HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=gb2312"> .
<TITLE>......................URL..........</TITLE>.<STY
LE type="text/css"><!--BODY{background-color:#ffffff;font-family
:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>.&l
t;/HEAD><BODY>.<H1>....</H1>.<H2>..........
......URL..........</H2>.<HR noshade size="1px">.<P>
.......................URL.......<A HREF="hXXp://dl.app.sogou.com/p
c_logo/7638937123950702413.png">hXXp://dl.app.sogou.com/pc_logo/763
8937123950702413.png</A>.<P>....................<UL>
.<LI>.<STRONG>.Unable to forward this request at this time
..<BR>................................</STRONG>.</UL>
;..<P>.This request could not be forwarded to the origin server 
or to any.parent caches.  The most likely cause for this error is that
:.<UL>.<LI>The cache administrator does not allow this cac
he to make .    direct connections to origin servers, and.<LI>Al
l configured parent caches are currently unreachable..</UL>.<
/P>.<P>......................................................
..................................<UL>.<LI>...............
............................................<LI>................
.................................</UL>.</P>.<P>.
<<< skipped >>>

POST /pc_assist/install_check.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

Content-Length: 1957

User-Agent: HttpRequest

Host: zs.xiazai.sogou.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1

<?xml version="1.0" encoding="utf-8" ?>

<SoftwareInstallFeaturesRequset>

    <Item>

        <Reg>

            <![CDATA[$(RegUninstall)\\Adobe Flash Player ActiveX]]>

        </Reg>

    </Item>

    <Item>

        <Reg>

            <![CDATA[$(RegUninstall)\\Microsoft .NET Framework 3.5]]>

        </Reg>

    </Item>

    <Item>

        <Reg>

            <![CDATA[$(RegUninstall)\\Microsoft .NET Framework 4 Client Profile]]>

        </Reg>

    </Item>

    <Item>

        <Reg>

            <![CDATA[$(RegUninstall)\\SogouSoftware]]>

        </Reg>

    </Item>

    <Item>

        <Reg>

            <![CDATA[$(RegUninstall)\\Totalcmd]]>

        </Reg>

    </Item>

    <Item>

        <Reg>

            <![CDATA[$(RegUninstall)\\WinPcapInst]]>

        </Reg>

    </Item>

    <Item>

        <Reg>

            <![CDATA[$(RegUninstall)\\Wireshark]]>

        </Reg>

    </Item>

    <Item>

        <Reg>

            <![CDATA[$(RegUninstall)\\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}]]>

        </Reg>

    </Item&g
HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:52 GMT

Content-Type: text/html; charset=gb2312

Content-Length: 341

Connection: keep-alive

X-Powered-By: PHP/5.3.3
<?xml version="1.0" encoding="utf-8"?>.<SoftwareInstallFeatur
esResponse><Item><Reg><![CDATA[$(RegUninstall)\\Adob
e Flash Player ActiveX]]></Reg><PCID><![CDATA[763893
7123950702413]]></PCID></Item><Item><Reg>&l
t;![CDATA[$(RegUninstall)\\SogouSoftware]]></Reg><PCID>
<![CDATA[-4581287645299687438]]></PCID></Item></S
oftwareInstallFeaturesResponse>.....


POST /pc_assist/local_info.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

Content-Length: 294

User-Agent: HttpRequest

Host: zs.xiazai.sogou.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

<?xml version="1.0" encoding="utf-8" ?>

<SoftwareLocalInfosRequest>

    <Item>

        <PCID>

            <![CDATA[7638937123950702413]]>

        </PCID>

    </Item>

    <Item>

        <PCID>

            <![CDATA[-4581287645299687438]]>

        </PCID>

    </Item>

</SoftwareLocalInfosRequest>

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:52 GMT

Content-Type: text/html; charset=gb2312

Content-Length: 2272

Connection: keep-alive

X-Powered-By: PHP/5.3.3
<?xml version="1.0" encoding="utf-8"?>.<SoftwareLocalInfosRes
ponse>.<Item DisplayName="Adobe Flash Player for IE">...<P
CID>....<![CDATA[7638937123950702413]]>...</PCID>...<
;InstallPath>....<FindByPathDirect>.....<![CDATA[C:\Window
s\SysWOW64\Macromed\Flash]]>....</FindByPathDirect>....<Fi
ndByPathDirect>.....<![CDATA[%System%\Macromed\Flash]
]>....</FindByPathDirect>...</InstallPath>...<ExeFil
e>...    <FindByPath>.....<![CDATA[$(InstallPath)\Flash32_
18_0_0_232.ocx]]>....</FindByPath>...</ExeFile>...<V
ersion>....<FindByReg>.....<![CDATA[$(RegUninstall)\Adobe 
Flash Player ActiveX\DisplayVersion]]>....</FindByReg>...<
/Version>...<Icon>....<FindByReg>.....<![CDATA[$(Reg
Uninstall)\Adobe Flash Player ActiveX\DisplayIcon]]>....</FindBy
Reg>...</Icon>...<UninstallString>....<FindByReg>
.....<![CDATA[$(RegUninstall)\Adobe Flash Player ActiveX\UninstallS
tring]]>....</FindByReg>...</UninstallString>..</Ite
m>.<Item DisplayName="............">...<PCID>....<![
CDATA[-4581287645299687438]]>...</PCID>...<InstallPath>
...    <FindByLink>.....<![CDATA[$(StartMenu)\Programs\......
......\.............lnk]]>....</FindByLink>....<FindByLink
>.....<![CDATA[$(Desktop)\.............lnk]]>....</FindByL
ink>....<FindByReg> .....<![CDATA[HKEY_LOCAL_MACHINE\S
<<< skipped >>>

POST /pc_assist/local_info.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

Content-Length: 294

User-Agent: HttpRequest

Host: zs.xiazai.sogou.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

<?xml version="1.0" encoding="utf-8" ?>

<SoftwareLocalInfosRequest>

    <Item>

        <PCID>

            <![CDATA[7638937123950702413]]>

        </PCID>

    </Item>

    <Item>

        <PCID>

            <![CDATA[-4581287645299687438]]>

        </PCID>

    </Item>

</SoftwareLocalInfosRequest>

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:52 GMT

Content-Type: text/html; charset=gb2312

Content-Length: 2272

Connection: keep-alive

X-Powered-By: PHP/5.3.3
<?xml version="1.0" encoding="utf-8"?>.<SoftwareLocalInfosRes
ponse>.<Item DisplayName="Adobe Flash Player for IE">...<P
CID>....<![CDATA[7638937123950702413]]>...</PCID>...<
;InstallPath>....<FindByPathDirect>.....<![CDATA[C:\Window
s\SysWOW64\Macromed\Flash]]>....</FindByPathDirect>....<Fi
ndByPathDirect>.....<![CDATA[%System%\Macromed\Flash]
]>....</FindByPathDirect>...</InstallPath>...<ExeFil
e>...    <FindByPath>.....<![CDATA[$(InstallPath)\Flash32_
18_0_0_232.ocx]]>....</FindByPath>...</ExeFile>...<V
ersion>....<FindByReg>.....<![CDATA[$(RegUninstall)\Adobe 
Flash Player ActiveX\DisplayVersion]]>....</FindByReg>...<
/Version>...<Icon>....<FindByReg>.....<![CDATA[$(Reg
Uninstall)\Adobe Flash Player ActiveX\DisplayIcon]]>....</FindBy
Reg>...</Icon>...<UninstallString>....<FindByReg>
.....<![CDATA[$(RegUninstall)\Adobe Flash Player ActiveX\UninstallS
tring]]>....</FindByReg>...</UninstallString>..</Ite
m>.<Item DisplayName="............">...<PCID>....<![
CDATA[-4581287645299687438]]>...</PCID>...<InstallPath>
...    <FindByLink>.....<![CDATA[$(StartMenu)\Programs\......
......\.............lnk]]>....</FindByLink>....<FindByLink
>.....<![CDATA[$(Desktop)\.............lnk]]>....</FindByL
ink>....<FindByReg> .....<![CDATA[HKEY_LOCAL_MACHINE\S
<<< skipped >>>

POST /pc_assist/newversion_info.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

Content-Length: 429

User-Agent: HttpRequest

Host: zs.xiazai.sogou.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

<SoftwareNewVersionInfosRequest>

    <Item>

        <PCID>

            <![CDATA[7638937123950702413]]>

        </PCID>

        <LocalVersion>

            <![CDATA[11.6.602.168]]>

        </LocalVersion>

    </Item>

    <Item>

        <PCID>

            <![CDATA[-4581287645299687438]]>

        </PCID>

        <LocalVersion>

            <![CDATA[3.1.13.79]]>

        </LocalVersion>

    </Item>

</SoftwareNewVersionInfosRequest>

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:53 GMT

Content-Type: text/html; charset=gb2312

Content-Length: 1380

Connection: keep-alive

X-Powered-By: PHP/5.3.3
<?xml version="1.0" encoding="utf-8"?>.<SoftwareNewVersionInf
os>.<Item>...<soft_id><![CDATA[7638937123950702413]]
></soft_id>....<name><![CDATA[Adobe Flash Player for
 IE]]></name>....<logo_url><![CDATA[hXXp://pc3.gtimg
.com/softmgr/logo/48/504_48_1433919181.png]]></logo_url>....&
lt;installfile_size><![CDATA[19419627]]></installfile_size
>....<download_url1><![CDATA[hXXp://c.softmgr.qq.com/fcgi-
bin/partnerdown?soft_id=504&partner=108&dl=http://dl.softmgr.qq.
com/original/Video/install_flash_player_21_active_x_ie_21.0.0.24
2.exe]]></download_url1>....<app_updatetime><![CDATA
[2016-05-12]]></app_updatetime>....<details><![CDATA
[.....................................................................
......................................................................
.....]]></details>....<version><![CDATA[21.0.0.242]]
></version>....<is_stable><![CDATA[1]]></is_st
able>....<whatsnew><![CDATA[1.............................
.........................................Flash Player ActiveX...NPAPI.
..PPAPI............................2..................................
.........Chrome.................................MAC...................
.........3..........Stage3D......VideoTexture.........MAC...PC........
...........4.........................]]></whatsnew>....<up
grade_rate><![CDATA[86]]></upgrade_rate>....<sco
<<< skipped >>>

POST /pc_assist/silent_install.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

Content-Length: 254

User-Agent: HttpRequest

Host: zs.xiazai.sogou.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: IPLOC=UA; SUID=DA60F2C28460900A0000000057418CA1; usid=DA60F2C24F0A900A0000000057418CB3

<SoftwareSilentParaRequest>

    <Item>

        <PCID>

            <![CDATA[7638937123950702413]]>

        </PCID>

    </Item>

    <Item>

        <PCID>

            <![CDATA[-4581287645299687438]]>

        </PCID>

    </Item>

</SoftwareSilentParaRequest>

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 22 May 2016 10:40:53 GMT

Content-Type: text/html; charset=gb2312

Content-Length: 97

Connection: keep-alive

X-Powered-By: PHP/5.3.3
<?xml version="1.0" encoding="utf-8"?>.<SoftwareSilentParaReq
uest>..</SoftwareSilentParaRequest>.....


POST /pc_assist/soft_info.php?fields=logo_url HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

Content-Length: 254

User-Agent: HttpRequest

Host: zs.xiazai.sogou.com

Connection: Keep-Alive