MD5: 2e8cd40312802ca5117dca7994143f01
SHA1: 82d5bcff45b0ae3a2a6e26318a747568b8d95036
SHA256: 40be4c4d59d74bbc0c8423af759a55b28adb61c361495ba28dd65b1c150aacdb
SSDeep: 24576:/vTRGmay4PA5NLqDYXyvDB2NeJfGaJYk1UsRNhwcRcg:/FGfQNuN7seJ 2Yk/tw T
Size: 1119244 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-06-07 00:41:59
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

shandian.exe:764
shandian.exe:1772

The Trojan injects its code into the following process(es):

%original file name%.exe:1628
emaaif_70690.exe:2124
sdad.exe:1944
F30241_s_0523.exe:752
services.exe:760
svchost.exe:1080

File activity

The process %original file name%.exe:1628 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\shandian\ico\360.ico (32 bytes)
%Documents and Settings%\%current user%\Desktop\Internet Explorer.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\F30241_s_0523[1].rar (91814 bytes)
%Program Files%\shandian\uninst.exe (1368 bytes)
%Program Files%\shandian\home.bat (691 bytes)
%Program Files%\shandian\bin\shandian.exe (28332 bytes)
%Program Files%\shandian\ico\ie.ico (700 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Desktop\ÉÁµçä¯ÀÀÆ÷.lnk (505 bytes)
%Program Files%\shandian\config.ini (194 bytes)
%Program Files%\shandian\bin\shandian.ini (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\config.ini (3 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\ÉÁµçä¯ÀÀÆ÷.lnk (700 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\emaaif_70690.exe (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\config0.ini (3 bytes)
%Program Files%\shandian\ico\anquan.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\F30241_s_0523.exe (91814 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\bind.dll (1207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\Md5dll.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\xID.dll (10 bytes)
%Program Files%\shandian\ico\taobao.ico (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\System.dll (11 bytes)
%Program Files%\shandian\bin\sdad.exe (12955 bytes)
%Program Files%\shandian\shandian.exe (3121 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\emaaif_70690[1].rar (12288 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\ÉÁµçä¯ÀÀÆ÷\жÔØÉÁµçä¯ÀÀÆ÷.lnk (682 bytes)
%Documents and Settings%\%current user%\Desktop\360°²È«ä¯ÀÀÆ÷.lnk (1 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\ÉÁµçä¯ÀÀÆ÷\ÉÁµçä¯ÀÀÆ÷.lnk (694 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\F30241_s_0523[1].rar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\emaaif_70690[1].rar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\emaaif_70690[1].rar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\F30241_s_0523[1].rar (0 bytes)

The process emaaif_70690.exe:2124 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa9.tmp\res\onlineWnd.zip (14184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa9.tmp\BDMDownload.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa9.tmp\BDMNetGetInfo.dll (9608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa9.tmp\dl.dll (65930 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa9.tmp\hu.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa9.tmp\tmppm4bkx.dll (24832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa9.tmp\BDLogicUtils.dll (31856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa9.tmp\System.dll (784 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Common\Global.db (100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa9.tmp\BDMSkin.dll (36698 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk8.tmp (128685 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu7.tmp (0 bytes)

The process sdad.exe:1944 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Untitled-1[1].gif (2240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\miniindex[1].htm (4605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa9[1].jpg (2077 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Untitled-2[1].gif (2240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b19[1].jpg (2237 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b17[1].jpg (7365 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\d[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b19[1].jpg (1414 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\normal_bg[1].png (5246 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b18[1].jpg (2077 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\meinv[1].htm (882 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\close[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\nvxing_509_366[2].htm (2047 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (23708 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\0[1].gif (8389 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b16[1].jpg (8236 bytes)
%Program Files%\shandian\bin\update\PopWinParam.xml (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\aaa5[1].jpg (11932 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa1[1].jpg (6388 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (491 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@70e[1].txt (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xinwen[1].htm (881 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (340 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[3].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b15[1].jpg (6803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b16[1].jpg (8548 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b18[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@70e[2].txt (272 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa10[1].jpg (1732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa5[1].jpg (10868 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\aaa6[1].jpg (4786 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa8[1].jpg (2157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lieqi_509_366[1].htm (2049 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa4[1].jpg (11693 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\aaa4[1].jpg (11974 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tj[1].js (279 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cpc_img[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\shehui_509_366[2].htm (2049 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cpc_img[1].htm (442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jiankang_509_366[1].htm (2033 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\shehui_509_366[1].htm (2049 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cpc_swf[1].asp (1805 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa2[1].jpg (4351 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\Untitled-3[1].jpg (3491 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\aaa9[1].jpg (1958 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@565882[1].txt (139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].php (1163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (798 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (410 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\meinv[1].htm (882 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ico_new2[1].png (10044 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (611 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa10[1].jpg (1634 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\Close[1].gif (348 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\core[1].php (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b14[1].jpg (13617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b17[1].jpg (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\aaa7[1].jpg (2555 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stylemini[1].css (5664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa8[1].jpg (975 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa1[1].jpg (4121 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b13[1].jpg (7583 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa2[1].jpg (7222 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\aaa3[1].jpg (17741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lieqi_509_366[1].htm (2033 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa7[1].jpg (2955 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-1.7.2.min[1].js (5157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cpc_ztyw[1].css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2012_swf[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b15[1].jpg (6803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa3[1].jpg (16842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\xinwen[1].htm (881 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-1.7.2.min[1].js (55290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jiankang_509_366[1].htm (1593 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa6[1].jpg (6982 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@zhouliboguju[1].txt (150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b13[1].jpg (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\nvxing_509_366[1].htm (2570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cpv1[1].htm (1117 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b14[1].jpg (2696 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (1010 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b16[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa1[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b18[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa9[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa8[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\style[2].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\aaa5[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\shehui_509_366[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa2[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cpc_swf[1].asp (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\aaa3[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@70e[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b14[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa7[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b19[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b15[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].php (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@70e[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa10[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\xinwen[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jiankang_509_366[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lieqi_509_366[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa6[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\core[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b17[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\meinv[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b13[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\nvxing_509_366[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\aaa4[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)

The process F30241_s_0523.exe:752 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM (100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\bdmp.dat (784 bytes)
%WinDir%\Temp\Perflib_Perfdata_7a0.dat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDKitUtils.dll (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\wverify.dat (66168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\systemfile.dat (3 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\bdkvtrayplugins\BDKVTrayTipsPlugin.dll (673 bytes)
%System%\Macromed\Flash (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\KVInstallHelper.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\RtpContainerConfig.xml (818 bytes)
%WinDir%\Fonts (1248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDDownLoadProtectPlugin.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (4 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmsysrepair\BSRLib.dat (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\TrustAndIso.dll (8184 bytes)
%WinDir%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\bdkvrtpplugins\fm.dat (597 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\blacksign.dat (852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\BDMSkin.dll (37025 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\virus_type.dat (485 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\Repair_PluginConfig.xml (411 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\NewPih.dll (4992 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\kav_verify.dat (677 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN (288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\Repair_PluginConfig.xml (411 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDMPerfMon.dll (5064 bytes)
%Program Files%\Common Files\Adobe\Acrobat\ActiveX (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDKVTrayTipsPlugin.dll (6584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (2132 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\scan_mgr_config.dat (5 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\CompatibilityChecker.dll (601 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\systemfile.dat (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\res\InstallWnd.zip (12536 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\BAV\bdvs.dat (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\CompatibilityChecker.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\HIPS.dll (30968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN (100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\GetSupplyId.dll (3616 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\bdkvtrayplugins\UserDetectionPlugin.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\Cooly_PluginConfig.xml (720 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J (196 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\virus_type.dat (485 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\BDMAVCached.dll (1425 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\bduf.dll (1425 bytes)
%System%\config (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDMSREng.dll (9608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\PrivacyProtect.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\KavUpdate.dll (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\KVMainframe_PluginConfig.xml (1 bytes)
%WinDir%\Prefetch (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\CoolyContainerConfig.xml (329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\bdvs.dat (5 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\bdkvtrayplugins\BDDownLoadProtectPlugin.dll (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\RepairPluginContainerConfig.xml (228 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\KVMainframe_PluginConfig.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014060120140602\index.dat (388 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\KVTray_PluginConfig.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\102[1].jpg (288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\KVRtp_PluginConfig.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\FileMon.dll (18424 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\PluginInstallHelper.dll (3616 bytes)
%Program Files%\Internet Explorer (4 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\bdkvrtpplugins\RtpContainerConfig.xml (818 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\repairplugins\baidusdRepair.dll (601 bytes)
%WinDir%\WinSxS\Manifests (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\cache_config.dat (469 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\BDKitUtils.dll (54 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\bdkv\KVMainframePluginContainerConfig.xml (384 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5 (4 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\KVRtp_PluginConfig.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\bduf.dll (11048 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\BDUDiskGuard.dll (1281 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\BDMPerfMon.dll (673 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\BDMAVEng.dll (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDMRepBase.dll (27704 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\bdkvtrayplugins\TrayPluginContainerConfig.xml (945 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\UserDetectionPlugin.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (484 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BSRLib.dat (5064 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\BDMRepMgr.dll (1425 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\Cooly_PluginConfig.xml (720 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDKVVirusPlugins.dll (12024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDMAVCached.dll (11048 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\BAV\BDAVCScan.dll (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDMSRCore.dll (10136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\baidusdRepair.dll (4992 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\monitor_config.dat (559 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\wverify.dat (15019 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\System.dll (784 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\bdkvtrayplugins\BDKVRmvDevPlugin.dll (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDKVRmvDevPlugin.dll (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDUDiskGuard.dll (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\emaaif_70690[1].rar (2701 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\cache_config.dat (469 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\scan_mgr_config.dat (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\fm.dat (597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VGX3.tmp (12 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmsysrepair\BDMSREng.dll (1425 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\BAV\bdmp.dat (25 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\coolyplugins\CoolyContainerConfig.xml (329 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\bdkvrtpplugins\HIPS.dll (7345 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\bdkvrtpplugins\FileMon.dll (3361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\monitor_config.dat (559 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\repairplugins\RepairPluginContainerConfig.xml (228 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\bdkv\BDKVVirusPlugins.dll (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\kav_verify.dat (677 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\blacksign.dat (852 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\plugins\bdkvrtpplugins\PrivacyProtect.dll (673 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\BDMRepBase.dll (5873 bytes)
%Program Files%\Messenger (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\KVTray_PluginConfig.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDMRepMgr.dll (10136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\TrayPluginContainerConfig.xml (945 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDMAVEng.dll (22192 bytes)
%Program Files%\Baidu\BaiduSd\1.8.0.1255\bdmsysrepair\BDMSRCore.dll (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp (306512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\KVMainframePluginContainerConfig.xml (384 bytes)
%Documents and Settings%\%current user%\Cookies (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDAVCScan.dll (4992 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\bdmp.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDKVRmvDevPlugin.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\KVRtp_PluginConfig.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\FileMon.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\wverify.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\baidusdRepair.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDKVTrayTipsPlugin.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\fm.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\scan_mgr_config.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\cache_config.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\monitor_config.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\HIPS.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\RtpContainerConfig.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDAVCScan.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDDownLoadProtectPlugin.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\kav_verify.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\Cooly_PluginConfig.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\blacksign.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\virus_type.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\CoolyContainerConfig.xml (0 bytes)
%Program Files%\sng (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDMSREng.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\PrivacyProtect.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\KVTray_PluginConfig.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDMSRCore.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\systemfile.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\UserDetectionPlugin.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\TrayPluginContainerConfig.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BSRLib.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\RepairPluginContainerConfig.xml (0 bytes)
C:\sng (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\BDKVVirusPlugins.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\Repair_PluginConfig.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\bdvs.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\KVMainframe_PluginConfig.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\file\KVMainframePluginContainerConfig.xml (0 bytes)

The process shandian.exe:764 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DF2D5A.tmp (0 bytes)

The process shandian.exe:1772 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\v53_123n[2].js (2713 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (1879 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\v53_2icos[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\123.sogou[1] (9215 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\citydata[2].js (5163 bytes)
%Program Files%\shandian\bin\twcache.ini (696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\get_tj[1].php (1199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\start_button[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\main[1].js (3902 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140528121906_70[1].jpg (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\get_123_v53[1].php (15871 bytes)
%Program Files%\shandian\bin\ImgCache\123.sogou.com_favicon.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\subnav_v41[1].png (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VGX3.tmp (10 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\selogo_111207[1].png (2331 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ufo2[1].js (9654 bytes)
%Program Files%\shandian\bin\shandian.ini.tmp (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cloudy[2].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\mE8bXnNioe2802[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\skin_tips_n1[1].gif (1 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (1398 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140526163043_207[1].jpg (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\DD_belatedPNG_0.0.8a-min[2].js (254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hotdata[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\guide_tip[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\123.sogou[1].htm (7616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\foot_slider[1].jpg (322 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\_ads_2[2].js (706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140526170756_638[1].jpg (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\favicon[2].ico (681 bytes)
%Program Files%\shandian\bin\theworld.ac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140526163446_912[1].jpg (1264 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\main[2].js (3624 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\welcome_cn[1].htm (1469 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\guide_tip[1].png (3767 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\v33_sugg_ajaj_v40_3[1].js (1352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\new-erweima2[1].png (3086 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\skin2_0[1].gif (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140526163242_997[1].jpg (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\20130820165531_481[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\v53_123n[1].js (2786 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ufo2[2].js (7798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\new-ico[1].png (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\texture[1].gif (1544 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\i8g7XZO1lz1162[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logo_1112293[1].gif (1266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\citydata[1].js (4189 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\icon4[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\selogo_111207[2].png (1858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\skin3[1].gif (188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\newioage[1].css (715 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140527160745_754[1].jpg (197 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\img-news[1].gif (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fbg_about[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\rec[1].do (374 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\guide_top[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\i-ico-2b[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\skin_[1].css (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20140508103513_537[1].gif (3628 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\20130531144119_126[1].png (2409 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\search_arrow[1].gif (447 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cloudy[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\setskinbg[1].gif (397 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\titlebg[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\setting_icon[1].gif (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\v53_bicos[1].gif (826 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\v33_sugg_ajaj_v40_3[2].js (1187 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (9640 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\20130830161205_609[1].gif (1858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hotdata[2].js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\_ads_2[1].js (678 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\selogo_111207[1].png (2409 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\v53_arrow_h[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\DD_belatedPNG_0.0.8a-min[1].js (678 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\v33_sugg_ajaj_v40_3[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\v53_123n[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cloudy[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hotdata[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\guide_tip[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041720130418\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\main[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041720130418 (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\DD_belatedPNG_0.0.8a-min[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\citydata[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ufo2[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\_ads_2[1].js (0 bytes)
%Program Files%\shandian\bin\shandian.ini (0 bytes)

Registry activity

The process %original file name%.exe:1628 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"DisplayName" = "ÉÁµçä¯ÀÀÆ÷"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\config.ini\..]
"emaaif_70690.exe" = "emaaif_70690"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\config.ini\..]
"F30241_s_0523.exe" = "百度杀毒安装程序"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"Publisher" = "ÉÁµç"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"URLInfoAbout" = "http://www.sd.com"
"DisplayIcon" = "%Program Files%\shandian\shandian.exe"

"UninstallString" = "%Program Files%\shandian\uninst.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"DisplayVersion" = "1.0.0.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 2A 4D 24 D8 87 2E D9 FE B1 DA 64 1C BC 03 EA"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\shandian]
"home.bat" = "home"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"shandian" = "%Program Files%\shandian\shandian.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process emaaif_70690.exe:2124 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "38 7F 75 F5 18 E0 7A B5 9B 12 7D 96 01 3E B2 1B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The Trojan adds process executable file it works in to the list of trusted Windows Firewall applications:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp]
"emaaif_70690.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\emaaif_70690.exe:*:Enabled:百度卫士在线安装程序"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp]
"emaaif_70690.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\emaaif_70690.exe:*:Enabled:百度卫士在线安装程序"

The process sdad.exe:1944 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "sdad.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 19 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1384939658"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A1 E0 95 38 C9 3F F3 5D FF C3 A6 20 D5 FA 68 3C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process F30241_s_0523.exe:752 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE D7 B9 4A 0F CA 9D 3B 5D 80 95 00 EA 07 68 C8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\CrashControl]
"CrashDumpEnabled" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Baidu\BaiduSd]
"RtpFlag" = "273"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The Trojan adds process executable file it works in to the list of trusted Windows Firewall applications:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp]
"F30241_s_0523.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\F30241_s_0523.exe:*:Enabled:百度杀毒安装程序"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp]
"F30241_s_0523.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\F30241_s_0523.exe:*:Enabled:百度杀毒安装程序"

The process shandian.exe:764 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 89 FD 96 0B 0D 2C 99 38 0D EA 34 44 8A CB 2A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process shandian.exe:1772 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014060120140602]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 18 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014060120140602]
"CachePrefix" = ":2014060120140602:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT]
"shandian.exe" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014060120140602]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014060120140602\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "shandian.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE]
"shandian.exe" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1301653454"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 47 39 E3 E2 AB 08 A7 B5 3B 76 99 BC AB CA 69"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014060120140602]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014060120140602]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013041720130418]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 6
09c0ff178e2a86dc19a7dcb1def06e38
7ebde9dce28c4e3b5820e4802e351f5d
67944e24d67fc320cdd5cbf1416e969c
016980277f652175566881a946fee88b
a36d0342f8dc2d0dae7408eefee4b478
391973927c955458f767c3164aabca95

URLs

URL	IP
hxxp://112.124.102.171/stat/?ac=stat&name=%original file name%.exe&mac=00-0C-29-7C-CD-1F&md5=cc87e224f8d7fa1f264f3aa969a8538f
hxxp://www.fjmjm.com/	112.124.102.171
hxxp://www.fjmjm.com/web/welcome_cn.htm?ver=2.4.1.9&guid=aa477d021f4abe049ed2e0cd23c43dc76af7c9c0f5824003b258ad80938b4a0c1401572567&lastver=	112.124.102.171
hxxp://www.fjmjm.com/web/images/texture.gif	112.124.102.171
hxxp://proxy.sogou.com/?22014
hxxp://www.fjmjm.com/web/newioage.css	112.124.102.171
hxxp://www.fjmjm.com/web/images/start_button.jpg	112.124.102.171
hxxp://www.fjmjm.com/web/images/guide_top.jpg	112.124.102.171
hxxp://njsh.cdn.sogou.com/kan/static/css/DD_belatedPNG_0.0.8a-min.js?t=
hxxp://www.fjmjm.com/favicon.ico	112.124.102.171
hxxp://proxy.sogou.com/css/skin_.css?V=dr
hxxp://njsh.cdn.sogou.com/imgn/v32/icon4.gif
hxxp://proxy.sogou.com/v53/jsn/v53_123n.js?V=11
hxxp://njsh.cdn.sogou.com/imgn/v32/selogo_111207.png
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_2icos.gif
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/subnav_v41.png
hxxp://proxy.sogou.com/dh/dhrc/rec.do?block=gamev2&jsonp=__yx2q&t=1&_stamp=1401572570907
hxxp://njsh.cdn.sogou.com/imgn/123ie/setting_icon.gif
hxxp://njsh.cdn.sogou.com/imgn/v32/skin2_0.gif
hxxp://njsh.cdn.sogou.com/u/js/ufo2.js
hxxp://njsh.cdn.sogou.com/imgn/v32/logo_1112293.gif
hxxp://njsh.cdn.sogou.com/imgn/v32/setskinbg.gif
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140508103513_537.gif
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_bicos.gif
hxxp://njsh.cdn.sogou.com/imgu/2013/05/20130531144119_126.png
hxxp://njsh.cdn.sogou.com/imgn/123ie/search_arrow.gif
hxxp://njsh.cdn.sogou.com/imgu/2013/08/20130820165531_481.gif
hxxp://njsh.cdn.sogou.com/v53/imgn/foot_slider.jpg
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_arrow_h.gif
hxxp://njsh.cdn.sogou.com/ads_hz/_ads_2.js?t=778651
hxxp://proxy.sogou.com//v53/get_123_v53.php?block=wt&ver=v53&gfg=1&city=unknown&pid=Af22014&c=1401572571766&method=ajaf&cbf=fn
hxxp://njsh.cdn.sogou.com/imgn/v32/skin3.gif
hxxp://proxy.sogou.com/jsn/hotdata.js?V=1401572571813
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=daohang&rdk=1401572571797&img=pv.gif&pars=?rand=1401572571797&suid=null&sduv=1401572571703_4807_00001&ckid=7892_00001_00000_5205_00000_00000&m=null&apid=null&sgtp=null&refer=&page=&pageUrl=http%3A%2F%2F123.sogou.com%2F%3F22014&loc=null&hp=-1&pid=Af22014&ptype=index&pcode=index&yyid=null&skin=null&ver=v53_ie6_dr__4&sys=100&ser=null&sev=null&time=2562
hxxp://njsh.cdn.sogou.com/imgn/v32/fbg_about.png
hxxp://njsh.cdn.sogou.com/jsn/v33_sugg_ajaj_v40_3.js
hxxp://njsh.cdn.sogou.com/jsn/citydata.js
hxxp://njsh.cdn.sogou.com/imgn/v51/new-erweima2.png
hxxp://njsh.cdn.sogou.com/imgn/v32/titlebg.png
hxxp://njsh.cdn.sogou.com/imgn/tips/skin_tips_n1.gif
hxxp://proxy.sogou.com/images/weather/cloudy.gif
hxxp://njsh.cdn.sogou.com/v53/jsn/main.js?V=107ff6db9da3d62875c7cafb326229a51
hxxp://proxy.sogou.com/favicon.ico
hxxp://www.fjmjm.com/web/PopWinParam.asp?d=2014419&mainver=1.0.0&popver=1.0.0&xmlver=20131020010000	112.124.102.171
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=ufo&ufoid=wan&ptype=jztf2&pcode=index&rdk=1401572571657&img=pv.gif&sourcelist=0011000100006_0011000100007_0011000100008_0011000100009_0011000100010_0011000100011&titlelist=热血沙城_风云无双_仙侠道_大闹天宫OL_万世_Sogou傲剑2
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1401572574922&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53
hxxp://proxy.sogou.com/v53/get_tj.php?hz=4671908&ids=qiche
hxxp://njsh.cdn.sogou.com/v53/imgn/guide_tip.png
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140526163242_997.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140526163043_207.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140526163446_912.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140526170756_638.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140527160745_754.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140528121906_70.jpg
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/new-ico.png
hxxp://njsh.cdn.sogou.com/imgu/2013/08/20130830161205_609.gif
hxxp://save2.xdwscache.glb0.lxdns.com/img/news_photo/2014/05/28/i8g7XZO1lz1162.jpg
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/img-news.gif
hxxp://njsh.cdn.sogou.com/imgn/v51/i-ico-2b.png
hxxp://save2.xdwscache.glb0.lxdns.com/img/news_photo/2014/05/29/mE8bXnNioe2802.jpg
hxxp://www.fjmjm.com/miniindex/	112.124.102.171
hxxp://www.fjmjm.com/miniindex/inc/stylemini.css	112.124.102.171
hxxp://www.fjmjm.com/miniindex/inc/jquery-1.7.2.min.js	112.124.102.171
hxxp://www.fjmjm.com/miniindex/nvxing_509_366.htm?time=undefined	112.124.102.171
hxxp://www.fjmjm.com/miniindex/xinwen.htm?time=undefined	112.124.102.171
hxxp://www.fjmjm.com/miniindex/shehui_509_366.htm?time=undefined	112.124.102.171
hxxp://www.fjmjm.com/miniindex/lieqi_509_366.htm?time=undefined	112.124.102.171
hxxp://www.fjmjm.com/miniindex/jiankang_509_366.htm?time=undefined	112.124.102.171
hxxp://www.fjmjm.com/miniindex/meinv.htm?time=undefined	112.124.102.171
hxxp://taurus.danuoyi.tbcache.com/material/d7/4/a9ac5ed3b828895d94097c8c6faba.jpg
hxxp://drmcmm.e.shifen.com/media/id=nHRLPjm3nWRY&gp=401&time=nHnLPjmzrHckPs.jpg
hxxp://taurus.danuoyi.tbcache.com/noname.gif
hxxp://www.fjmjm.com/miniindex/images/Untitled-1.gif	112.124.102.171
hxxp://www.fjmjm.com/miniindex/images/Untitled-2.gif	112.124.102.171
hxxp://www.fjmjm.com/miniindex/images/Untitled-3.jpg	112.124.102.171
hxxp://www.fjmjm.com/miniindex/inc/normal_bg.png	112.124.102.171
hxxp://www.fjmjm.com/miniindex/tj.js	112.124.102.171
hxxp://www.fjmjm.com/miniindex/inc/ico_new2.png	112.124.102.171
hxxp://www.fjmjm.com/miniindex/inc/min.png	112.124.102.171
hxxp://www.fjmjm.com/miniindex/inc/close.png	112.124.102.171
hxxp://www.fjmjm.com/miniindex/inc/style.css	112.124.102.171
hxxp://c.split.cnzz.com/stat.php?id=5645354
hxxp://www.fjmjm.com/miniindex/images/b13.jpg	112.124.102.171
hxxp://www.fjmjm.com/miniindex/images/b14.jpg	112.124.102.171
hxxp://www.fjmjm.com/miniindex/images/b15.jpg	112.124.102.171
hxxp://www.fjmjm.com/miniindex/images/b16.jpg	112.124.102.171
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=380591987-1401590181-&showp=1024x768&st=0&sin=&t=undefinedundefinedundefinedundefinedundefined&rnd=393595797
hxxp://www.fjmjm.com/miniindex/images/b17.jpg	112.124.102.171
hxxp://www.fjmjm.com/miniindex/images/b18.JPG	112.124.102.171
hxxp://c.split.cnzz.com/core.php?web_id=5645354&t=z
hxxp://www.fjmjm.com/miniindex/images/b19.JPG	112.124.102.171
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401590181&repeatip=1&rtime=0&cnzz_eid=380591987-1401590181-&showp=1024x768&st=-17588&sin=none&t=undefinedundefinedundefined&rnd=711879827
hxxp://www.fjmjm.com/miniindex/images/aaa4.jpg	112.124.102.171
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=962045481
hxxp://www.fjmjm.com/miniindex/images/aaa3.jpg	112.124.102.171
hxxp://www.fjmjm.com/miniindex/images/aaa5.jpg	112.124.102.171
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1478584794
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401590182&repeatip=2&rtime=0&cnzz_eid=380591987-1401590181-&showp=1024x768&st=-17588&sin=none&t=undefinedundefinedundefined&rnd=1206591093
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=544013861
hxxp://www.fjmjm.com/miniindex/images/aaa6.jpg	112.124.102.171
hxxp://pcookie.split.cnzz.com/app.gif?&cna=p38RDMFQvHUCAbhrJiYykGZt
hxxp://pcookie.split.cnzz.com/app.gif?&cna=p38RDLY5j1UCAbhrJiYNAN2/
hxxp://www.fjmjm.com/miniindex/images/aaa1.jpg	112.124.102.171
hxxp://pcookie.split.cnzz.com/app.gif?&cna=p38RDIUAhDcCAbhrJibsQQBm
hxxp://www.fjmjm.com/miniindex/images/aaa2.jpg	112.124.102.171
hxxp://www.fjmjm.com/miniindex/images/aaa7.jpg	112.124.102.171
hxxp://www.fjmjm.com/miniindex/images/aaa8.jpg	112.124.102.171
hxxp://www.fjmjm.com/miniindex/images/aaa9.jpg	112.124.102.171
hxxp://www.fjmjm.com/miniindex/images/aaa10.jpg	112.124.102.171
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1780999421
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401590182&repeatip=3&rtime=0&cnzz_eid=380591987-1401590181-&showp=1024x768&st=-17586&sin=none&t=undefinedundefinedundefined&rnd=1389648265
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=183382857
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401590182&repeatip=4&rtime=0&cnzz_eid=380591987-1401590181-&showp=1024x768&st=-17584&sin=none&t=undefinedundefinedundefined&rnd=1972289161
hxxp://www.mdtxw.org/miniindex/inc/ico_new2.png	112.124.102.171
hxxp://pcookie.cnzz.com/app.gif?&cna=p38RDMFQvHUCAbhrJiYykGZt	42.120.219.171
hxxp://www.mdtxw.org/miniindex/images/Untitled-2.gif	112.124.102.171
hxxp://www.mdtxw.org/miniindex/images/aaa1.jpg	112.124.102.171
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401590182&repeatip=3&rtime=0&cnzz_eid=380591987-1401590181-&showp=1024x768&st=-17586&sin=none&t=undefinedundefinedundefined&rnd=1389648265	42.156.140.25
hxxp://www.mdtxw.org/miniindex/nvxing_509_366.htm?time=undefined	112.124.102.171
hxxp://p3.123.sogoucdn.com/imgn/v51/i-ico-2b.png	114.80.179.206
hxxp://d.123.sogoucdn.com/kan/static/css/DD_belatedPNG_0.0.8a-min.js?t=	114.80.179.210
hxxp://p6.123.sogoucdn.com/imgn/123ie/setting_icon.gif	114.80.179.206
hxxp://c.cnzz.com/core.php?web_id=5645354&t=z	42.120.219.6
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=183382857	42.120.219.171
hxxp://123.sogou.com/css/skin_.css?V=dr	106.120.151.64
hxxp://p4.123.sogoucdn.com/imgn/v32/fbg_about.png	114.80.179.206
hxxp://www.mdtxw.org/miniindex/xinwen.htm?time=undefined	112.124.102.171
hxxp://p4.123.sogoucdn.com/imgu/2014/05/20140508103513_537.gif	114.80.179.206
hxxp://d.123.sogoucdn.com/imgn/v32/icon4.gif	114.80.179.210
hxxp://d.123.sogoucdn.com/ads_hz/_ads_2.js?t=778651	114.80.179.210
hxxp://pic4.xcarimg.com/img/news_photo/2014/05/29/mE8bXnNioe2802.jpg	8.37.231.20
hxxp://p8.123.sogoucdn.com/imgn/tips/skin_tips_n1.gif	114.80.179.224
hxxp://www.mdtxw.org/miniindex/tj.js	112.124.102.171
hxxp://www.mdtxw.org/miniindex/images/b16.jpg	112.124.102.171
hxxp://p3.123.sogoucdn.com/imgu/2014/05/20140527160745_754.jpg	114.80.179.206
hxxp://www.mdtxw.org/miniindex/lieqi_509_366.htm?time=undefined	112.124.102.171
hxxp://www.mdtxw.org/miniindex/inc/jquery-1.7.2.min.js	112.124.102.171
hxxp://d.123.sogoucdn.com/v53/imgn/v53_arrow_h.gif	114.80.179.210
hxxp://www.mdtxw.org/miniindex/inc/normal_bg.png	112.124.102.171
hxxp://123.sogou.com//v53/get_123_v53.php?block=wt&ver=v53&gfg=1&city=unknown&pid=Af22014&c=1401572571766&method=ajaf&cbf=fn	106.120.151.64
hxxp://p1.123.sogoucdn.com/imgn/v32/selogo_111207.png	114.80.179.206
hxxp://d.123.sogoucdn.com/v53/jsn/main.js?V=107ff6db9da3d62875c7cafb326229a51	114.80.179.210
hxxp://p2.123.sogoucdn.com/imgu/2013/05/20130531144119_126.png	58.215.147.40
hxxp://www.mdtxw.org/miniindex/inc/stylemini.css	112.124.102.171
hxxp://p3.123.sogoucdn.com/imgn/sehome/tjv1/new-ico.png	114.80.179.206
hxxp://www.mdtxw.org/miniindex/images/b14.jpg	112.124.102.171
hxxp://d.123.sogoucdn.com/v53/imgn/v53_bicos.gif	114.80.179.210
hxxp://p5.123.sogoucdn.com/imgn/v32/logo_1112293.gif	58.215.147.38
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=962045481	42.120.219.171
hxxp://p0.123.sogoucdn.com/imgn/v32/skin3.gif	58.215.147.40
hxxp://www.mdtxw.org/miniindex/inc/close.png	112.124.102.171
hxxp://123.sogou.com/favicon.ico	106.120.151.64
hxxp://wan.sogou.com/dh/dhrc/rec.do?block=gamev2&jsonp=__yx2q&t=1&_stamp=1401572570907	180.149.156.70
hxxp://p1.123.sogoucdn.com/imgu/2014/05/20140526163446_912.jpg	114.80.179.206
hxxp://d.123.sogoucdn.com/v53/imgn/guide_tip.png	114.80.179.210
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=544013861	42.120.219.171
hxxp://s9.cnzz.com/stat.php?id=5645354	1.99.192.15
hxxp://stat.fjmjm.com/web/PopWinParam.asp?d=2014419&mainver=1.0.0&popver=1.0.0&xmlver=20131020010000
hxxp://pcookie.cnzz.com/app.gif?&cna=p38RDLY5j1UCAbhrJiYNAN2/	42.120.219.171
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401590182&repeatip=4&rtime=0&cnzz_eid=380591987-1401590181-&showp=1024x768&st=-17584&sin=none&t=undefinedundefinedundefined&rnd=1972289161	42.156.140.25
hxxp://www.mdtxw.org/miniindex/inc/style.css	112.124.102.171
hxxp://p5.123.sogoucdn.com/imgu/2013/08/20130830161205_609.gif	58.215.147.38
hxxp://www.mdtxw.org/miniindex/inc/min.png	112.124.102.171
hxxp://pb.sogou.com/pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1401572574922&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53	106.120.151.52
hxxp://p4.123.sogoucdn.com/imgn/v32/selogo_111207.png	114.80.179.206
hxxp://cache.adm.cnzz.net/material/d7/4/a9ac5ed3b828895d94097c8c6faba.jpg	195.27.31.240
hxxp://www.mdtxw.org/miniindex/jiankang_509_366.htm?time=undefined	112.124.102.171
hxxp://www.mdtxw.org/miniindex/images/aaa8.jpg	112.124.102.171
hxxp://p0.123.sogoucdn.com/imgu/2014/05/20140526170756_638.jpg	58.215.147.40
hxxp://p7.123.sogoucdn.com/imgn/123ie/search_arrow.gif	222.211.87.163
hxxp://d.123.sogoucdn.com/v53/imgn/foot_slider.jpg	114.80.179.210
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=380591987-1401590181-&showp=1024x768&st=0&sin=&t=undefinedundefinedundefinedundefinedundefined&rnd=393595797	42.156.140.25
hxxp://www.mdtxw.org/miniindex/images/Untitled-3.jpg	112.124.102.171
hxxp://p3.123.sogoucdn.com/imgn/sehome/tjv1/img-news.gif	114.80.179.206
hxxp://123.sogou.com/jsn/hotdata.js?V=1401572571813	106.120.151.64
hxxp://www.mdtxw.org/miniindex/shehui_509_366.htm?time=undefined	112.124.102.171
hxxp://stat.fjmjm.com/stat/?ac=stat&name=%original file name%.exe&mac=00-0C-29-7C-CD-1F&md5=cc87e224f8d7fa1f264f3aa969a8538f
hxxp://pb.sogou.com/pv.gif?uigs_productid=ufo&ufoid=wan&ptype=jztf2&pcode=index&rdk=1401572571657&img=pv.gif&sourcelist=0011000100006_0011000100007_0011000100008_0011000100009_0011000100010_0011000100011&titlelist=热血沙城_风云无双_仙侠道_大闹天宫OL_万世_Sogou傲剑2	106.120.151.52
hxxp://p3.123.sogoucdn.com/imgn/v51/new-erweima2.png	114.80.179.206
hxxp://www.mdtxw.org/miniindex/images/b19.JPG	112.124.102.171
hxxp://www.mdtxw.org/miniindex/images/b15.jpg	112.124.102.171
hxxp://www.mdtxw.org/miniindex/meinv.htm?time=undefined	112.124.102.171
hxxp://p0.123.sogoucdn.com/imgn/v32/titlebg.png	58.215.147.40
hxxp://123.sogou.com/v53/get_tj.php?hz=4671908&ids=qiche	106.120.151.64
hxxp://p5.123.sogoucdn.com/imgu/2014/05/20140526163043_207.jpg	58.215.147.38
hxxp://www.jlbnh.com/	112.124.102.171
hxxp://pic2.xcarimg.com/img/news_photo/2014/05/28/i8g7XZO1lz1162.jpg	8.37.231.22
hxxp://p1.123.sogoucdn.com/imgn/v32/skin2_0.gif	114.80.179.206
hxxp://www.mdtxw.org/miniindex/images/aaa2.jpg	112.124.102.171
hxxp://p1.123.sogoucdn.com/imgu/2014/05/20140528121906_70.jpg	114.80.179.206
hxxp://www.mdtxw.org/miniindex/images/aaa4.jpg	112.124.102.171
hxxp://pcookie.cnzz.com/app.gif?&cna=p38RDIUAhDcCAbhrJibsQQBm	42.120.219.171
hxxp://d.123.sogou.com/jsn/v33_sugg_ajaj_v40_3.js	58.215.147.36
hxxp://p0.123.sogoucdn.com/imgu/2014/05/20140526163242_997.jpg	58.215.147.40
hxxp://drmcmm.baidu.com/media/id=nHRLPjm3nWRY&gp=401&time=nHnLPjmzrHckPs.jpg	202.108.23.74
hxxp://p0.123.sogoucdn.com/imgn/sehome/tjv1/subnav_v41.png	58.215.147.40
hxxp://www.mdtxw.org/miniindex/images/b13.jpg	112.124.102.171
hxxp://d.123.sogou.com/jsn/citydata.js	58.215.147.36
hxxp://p8.123.sogoucdn.com/imgn/v32/selogo_111207.png	114.80.179.224
hxxp://www.mdtxw.org/miniindex/	112.124.102.171
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1478584794	42.120.219.171
hxxp://www.mdtxw.org/miniindex/images/aaa5.jpg	112.124.102.171
hxxp://d.123.sogoucdn.com/v53/imgn/v53_2icos.gif	114.80.179.210
hxxp://www.mdtxw.org/miniindex/images/aaa7.jpg	112.124.102.171
hxxp://www.mdtxw.org/miniindex/images/aaa6.jpg	112.124.102.171
hxxp://123.sogou.com/images/weather/cloudy.gif	106.120.151.64
hxxp://123.sogou.com/?22014	106.120.151.64
hxxp://cache.adm.cnzz.net/noname.gif	195.27.31.240
hxxp://www.mdtxw.org/miniindex/images/aaa9.jpg	112.124.102.171
hxxp://p6.123.sogoucdn.com/imgu/2013/08/20130820165531_481.gif	114.80.179.206
hxxp://p0.123.sogoucdn.com/u/js/ufo2.js	58.215.147.40
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1780999421	42.120.219.171
hxxp://www.mdtxw.org/miniindex/images/Untitled-1.gif	112.124.102.171
hxxp://www.mdtxw.org/miniindex/images/b17.jpg	112.124.102.171
hxxp://123.sogou.com/v53/jsn/v53_123n.js?V=11	106.120.151.64
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401590182&repeatip=2&rtime=0&cnzz_eid=380591987-1401590181-&showp=1024x768&st=-17588&sin=none&t=undefinedundefinedundefined&rnd=1206591093	42.156.140.25
hxxp://pb.sogou.com/pv.gif?uigs_productid=daohang&rdk=1401572571797&img=pv.gif&pars=?rand=1401572571797&suid=null&sduv=1401572571703_4807_00001&ckid=7892_00001_00000_5205_00000_00000&m=null&apid=null&sgtp=null&refer=&page=&pageUrl=http%3A%2F%2F123.sogou.com%2F%3F22014&loc=null&hp=-1&pid=Af22014&ptype=index&pcode=index&yyid=null&skin=null&ver=v53_ie6_dr__4&sys=100&ser=null&sev=null&time=2562	106.120.151.52
hxxp://p3.123.sogoucdn.com/imgn/v32/setskinbg.gif	114.80.179.206
hxxp://www.mdtxw.org/miniindex/images/b18.JPG	112.124.102.171
hxxp://www.mdtxw.org/miniindex/images/aaa10.jpg	112.124.102.171
hxxp://www.mdtxw.org/miniindex/images/aaa3.jpg	112.124.102.171
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401590181&repeatip=1&rtime=0&cnzz_eid=380591987-1401590181-&showp=1024x768&st=-17588&sin=none&t=undefinedundefinedundefined&rnd=711879827	42.156.140.25
down.icudi.org	222.186.60.12

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request on Unusual Port Possibly Hostile

Traffic

GET /web/welcome_cn.htm?ver=2.4.1.9&guid=aa477d021f4abe049ed2e0cd23c43dc76af7c9c0f5824003b258ad80938b4a0c1401572567&lastver= HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: VVV.fjmjm.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 1469

Content-Type: text/html

Last-Modified: Thu, 17 Apr 2014 15:55:27 GMT

Accept-Ranges: bytes

ETag: "80414a73555acf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:35:57 GMT
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">.
.<html>..<head>..<meta http-equiv="Content-Type" conten
t="text/html; charset=gb2312">..<title>................</t
itle>..<link href="newioage.css" rel="stylesheet" type="text/css
">..</head>..<body>..<p> </p>..<tab
le width="712" height="49" border="0" align="center" cellpadding="0" c
ellspacing="0">..  <tr>..    <td background="images/guide_
top.jpg"><table width="550" align="center">..        <tr&g
t;..          <td class="t14"><font color="#C8E2FF"><st
rong>................</strong></font></td>..     
   </tr>..      </table></td>..  </tr>..</t
able>..<table width="712" height="350" align="center" background
="images/texture.gif" bgcolor="#FFFFFF">..  <tr>..    <td 
valign="top">..<table width="500" align="center">..        &l
t;tr>..          <td><p class="t14"> </p>.. 
           <p class="t14"><font color="#D38C45" size="4">&
lt;strong>..............................</strong></font>
;</p>..            <p class="t14">........................
..................................................................<
/p>..            <p class="t14"> </p>..           
 </td>..        </tr>..      </table>..      <tab
le width="500" align="center">..        <tr> ..          
<<< skipped >>>

GET /web/images/texture.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.fjmjm.com/web/welcome_cn.htm?ver=2.4.1.9&guid=aa477d021f4abe049ed2e0cd23c43dc76af7c9c0f5824003b258ad80938b4a0c1401572567&lastver=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: VVV.fjmjm.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 11841

Content-Type: image/gif

Last-Modified: Thu, 17 Apr 2014 15:36:33 GMT

Accept-Ranges: bytes

ETag: "80965fcf525acf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:35:57 GMT
GIF89a..^.............................................................
......................................................................
.................................................................!....
...,......^......pH,....r.l:...tJ.Z...v..z...xL.....z.n....|N.....~...
......................................................................
...............................................................H......
*\......#J.H.....3j...... C..I....(S.\[email protected]...
.H.*].....P.J.J....X.j......`...K....h..].....p...K....x............L.
..... ^......#K.L.....3k.......C..M.....S.^......c..M.....s...........
N...... _.......K..`.\..p@......!....}{..E..h......q.(..=..! h........
G.}5...~.$.C}X`7.........H.J....v.*X..........7!y>...y.^.R..v(...a.
.{. ..~...@.>....-.h...q.d.4....B6......$.V^9...e....e.#..]..xE2.d.
Y.....p..._v..|...$.V.G^.V....nf).BH*...E.Gc..Nq#yqn.^...0A...z(A."hg.
#"....Jq..`....@...@H..$.L..d.K.H^.c.H....jO...)&.I.......B.!......h..
.M..x.>.evi.`......m;.....TD ..K....^....8L0............g..D.8R....
l*.;.......'.{[email protected]<........Z._.K.{/.-.h.....n...l..V...{...o...`
[email protected]./|. ....581.Iv....D.A.,.._.P
..A......M.... .x>....vj-...|.t..6K(....1.k.....tN.1z.........Y....
..n.:..T...z.>L..~....".....O....A..Z.}..=T_........3.... /...\. |.
.?.../......p......-.P.....}2..S....F}.}........d`=.K..%x.".M~.._.&...
....[..|A&.T.|.L.......O.([email protected]"...<..
.F=....H.*....3...h=....!.A...5'[email protected]....
<<< skipped >>>

GET /web/images/guide_top.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.fjmjm.com/web/welcome_cn.htm?ver=2.4.1.9&guid=aa477d021f4abe049ed2e0cd23c43dc76af7c9c0f5824003b258ad80938b4a0c1401572567&lastver=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: VVV.fjmjm.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 5936

Content-Type: image/jpeg

Last-Modified: Thu, 17 Apr 2014 15:48:06 GMT

Accept-Ranges: bytes

ETag: "0ff6e6c545acf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:35:58 GMT
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
.......................................................1..............
......................................................................
.......!1A.Qa.q.......2..."Rb3.B#C.rS....cD.........................!1
AQ..aq......."2.b..............?..k._..W..Sn.G..........s..."..Q3&....
...~.W...u.c...}...~.m...u.{.c.....!$}{..E=A......v.^C....].y....J\.d{
.>o............u..lg....O..?[...I..6o........~..I....m....G#.....{%
c.._......`i..~..:t.....}'.....\...M~.f....g.....z...:..)...{...v...m.
.<.$x..>7.....q5..v.;......Mv.\y...L[......m5..o...#.W.x.\qK'...
...].n.o.v>X`....w.V...._;G&.~...~.......G.Q.zQ.....,.JA.<\IY...
.og..<.5.h.[.W5.LN......s'....$..XP. &....S...........q........`.A.
..aC...H5...6A.%.......'...VL...&8...6Li..R.G.Z.O...T..(....w.l..a....
.-...P...2.O.....e...C.\{..l.xc....L.~..m.3...Y.....X.7L{.........l...
...#.Y ....p.#Sv..O.G0..n.../f...&....o.....k...!{u....N7.........."..
|B..kn.t.......~M..o...v...6,q..\..G.../ge.hk.b....>..7.G.......z.R
....n....|......\..\@.....SVg.sW.5fu....j..M.....Y];...9...v8. .......
.Y.;.......>l.#>*......b.;.v8... ] ..R.....X..HJ. .!......<.[
%.....(.!=...^N.......%...K./".-../$.jZX.};........t.NG5.......2rB.R(^
P.....n..|a....4..".$...x..v\ ..<..s.?Pz..........6..I..h.y..kI.sF.
..A ...........vL.....N.mn .......p..C0..5..&..5..@:..:.....&..a..-b.,
...L.}..6.'....I.........]V..v.........N..........^../.......CwF;}
<<< skipped >>>

GET /imgn/v32/skin2_0.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p1.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Sun, 01 Jun 2014 02:36:01 GMT

Content-Type: image/gif

Content-Length: 592

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Tue, 01 Jul 2014 02:36:01 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a..........Ly.Ky.Aq.Et.Iw.S..W..Z..[..a..d..c..e..g..w...........
........................s.............................................
......................................................................
......................................................................
......................................................................
...............................................!.....s.,............s.
s...s ..................)q(....&X*....#qnmol!!p<Pad%..$igbf`ch\OYIQ
"...rlj_^]PMK/U:..s...pe[ZJG7'......kNLH6CF*....W.EB35-..s............
.B$...=~.HX...*8...... ..B...`..@.;....


GET /imgu/2014/05/20140526163446_912.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p1.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Sun, 01 Jun 2014 02:36:05 GMT

Content-Type: image/jpeg

Content-Length: 5654

Last-Modified: Mon, 26 May 2014 08:34:46 GMT

Connection: keep-alive

Expires: Tue, 01 Jul 2014 02:36:05 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
......JFIF.............0Exif..II*.......1...............VVV.meitu.com.
...C..................................................................
..C...................................................................
....=._...............................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?..........|f...Yl..;av...zW.
...KC.....}..W.?.........'.....GN.".....VF..Xdn.\.L......|......=.7~/~
.../...Z..w...m....,..]...\|....?..Z.......z..T...<....Q_.s.o......
N.<7u..nSEW......o>....`14....WU-m...T o........_....M.mm.>.|
.S~.....bl<g?.Q].]Y........kH..J...M0.../7f.....k.x..k..o.........5
.g.l.K.e~|....q.*.Silz.xmr.....>7...&.&7.q..Y.....<.q....r...I.W
......N...;.a.W.........T...X...5..C..mc#/>..X...Mr....7........^..
.|......:...'.}.M.h.....:Ao.....aq...-f....!Qsy3.yF>.?i*o.u..~=..._
...M........Vo.0.h...P.*..P..v4..Pv.O..$...P....v......~L*[email protected]
.ot...C.:....2n...dsz..t...:.n.^x.i.6.70HQ.....G .V..*.i..]:..U..(..M9
qo.n<D.`{.Z7s..........-...-..!.P.g$....k....p4...;[email protected]
..>.....mkK. 2..tRF......_.[.....$....<<).*.H..h..''.........
. ..v..-n.ll<s...d.V..mB......I...Y.S..../....?.__4y..SW..>h
<<< skipped >>>

GET /miniindex/inc/stylemini.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 11323

Content-Type: text/css

Last-Modified: Thu, 10 Apr 2014 18:35:54 GMT

Accept-Ranges: bytes

ETag: "0a189b4eb54cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:16 GMT
img{border:0}..#mini_wrap .bor_n {...border: 0px currentColor;..}..#mi
ni_wrap .none {...display: none;..}..#mini_wrap {.....}..#closehBtn {.
..background: url("close.png") no-repeat 0px 0px; padding: 0px; top: 0
px; width: 40px; height: 19px; color: rgb(11, 59, 140); font-size: 14p
x; vertical-align: 0px; position: relative;..}..#closehBtn:hover {...b
ackground: url("close.png") no-repeat -40px 0px;..}..#minBtn {...backg
round: url("min.png") no-repeat 0px 0px; padding: 0px; top: 0px; width
: 27px; height: 19px; color: rgb(11, 59, 140); font-size: 14px; vertic
al-align: 0px; position: relative;..}..#minBtn:hover {...background: u
rl("min.png") no-repeat -27px 0px;..}...wrapper {...margin: 0px auto; 
width: 698px; height: 399px; text-align: left;..}...normal_bg {...back
ground: url("normal_bg.png") no-repeat 0px 0px rgb(255, 255, 255);..}.
..body_bg {...position: relative;..}...header {...width: 698px; height
: 33px;..}...nav_box .refresh_box a {...background-image: url("ico_new
2.png"); background-repeat: no-repeat;..}...nav_box .on_bg {...backgro
und-image: url("ico_new2.png"); background-repeat: no-repeat;..}...nav
_box {...padding: 4px 0px 0px 10px; width: 688px;..}...nav_box span {.
..color: rgb(188, 202, 224); float: left;..}...nav_box a {...width: 45
px; height: 26px; text-align: center; color: rgb(11, 59, 140); padding
-top: 3px; font-size: 14px; text-decoration: none; display: inline-blo
ck; position: relative; _vertical-align: middle;..}...nav_box .on_bg {
...background-position: 0px -460px; left: 18px; width: 9px; height
<<< skipped >>>

GET /miniindex/nvxing_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 12745

Content-Type: text/html

Last-Modified: Mon, 14 Apr 2014 11:01:01 GMT

Accept-Ranges: bytes

ETag: "80544bd2d057cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:18 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/lieqi_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 13149

Content-Type: text/html

Last-Modified: Mon, 14 Apr 2014 11:01:34 GMT

Accept-Ranges: bytes

ETag: "0bbf6e5d057cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:18 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/meinv.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 6471

Content-Type: text/html

Last-Modified: Mon, 14 Apr 2014 11:01:42 GMT

Accept-Ranges: bytes

ETag: "06fbbead057cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:18 GMT
<!DOCTYPE html PUBliC "-//W3C//DTD Xhtml 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta content
="IE=10.000" http-equiv="X-Ua-Compatible"> ..<meta http-equiv="C
ontent-Type" content="text/html; charset=gb2312">.. ..<meta name
="robots" content="noindex, nofollow,nosnippet,noarchive,noodp">..&
lt;title>......</title>..<base target=_blank>..<link
 href="inc/style.css" rel="stylesheet" type="text/css">..<style 
type="text/css">...bj {background-color: #FFFFFF;float: left;height
: 336px;width: 509px;}...bj .top {float: left;height: 207px;margin-bot
tom: 3px;width: 509px;}...bj .top .top_left {float: left;height: 206px
;margin-right: 4px;width: 274px;}...txt1{ background: #000;line-height
: 30px;height: 30px;overflow: hidden;text-align: center;display: block
;color: #fff;margin: -29px 0 0 0;width: 231px;position: relative;opaci
ty: 0.7;filter: alpha(opacity=60);cursor: pointer;float: left;font-siz
e: 14px;}...bj .top .top_right {float: right;height: 207px;width: 231p
x;}...bj .top .top_right .right_01 {height: 95px;margin-bottom: 4px;}.
..txt2{ background: #000;line-height: 22px;height: 22px;overflow: hidd
en;text-align: center;display: block;color: #fff;margin: -21px 0 0 0;w
idth: 231px;position: relative;opacity: 0.7;filter: alpha(opacity=60);
cursor: pointer;float: left;font-size: 12px;}...bj .up {float: left;he
ight: 126px;width: 509px;}..ul {margin: 0;padding: 0;}...bj .up li
<<< skipped >>>

GET /miniindex/nvxing_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 12745

Content-Type: text/html

Last-Modified: Mon, 14 Apr 2014 11:01:01 GMT

Accept-Ranges: bytes

ETag: "80544bd2d057cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:19 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/shehui_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 12927

Content-Type: text/html

Last-Modified: Mon, 14 Apr 2014 11:01:16 GMT

Accept-Ranges: bytes

ETag: "0263cdbd057cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:19 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/meinv.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 6471

Content-Type: text/html

Last-Modified: Mon, 14 Apr 2014 11:01:42 GMT

Accept-Ranges: bytes

ETag: "06fbbead057cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:19 GMT
<!DOCTYPE html PUBliC "-//W3C//DTD Xhtml 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta content
="IE=10.000" http-equiv="X-Ua-Compatible"> ..<meta http-equiv="C
ontent-Type" content="text/html; charset=gb2312">.. ..<meta name
="robots" content="noindex, nofollow,nosnippet,noarchive,noodp">..&
lt;title>......</title>..<base target=_blank>..<link
 href="inc/style.css" rel="stylesheet" type="text/css">..<style 
type="text/css">...bj {background-color: #FFFFFF;float: left;height
: 336px;width: 509px;}...bj .top {float: left;height: 207px;margin-bot
tom: 3px;width: 509px;}...bj .top .top_left {float: left;height: 206px
;margin-right: 4px;width: 274px;}...txt1{ background: #000;line-height
: 30px;height: 30px;overflow: hidden;text-align: center;display: block
;color: #fff;margin: -29px 0 0 0;width: 231px;position: relative;opaci
ty: 0.7;filter: alpha(opacity=60);cursor: pointer;float: left;font-siz
e: 14px;}...bj .top .top_right {float: right;height: 207px;width: 231p
x;}...bj .top .top_right .right_01 {height: 95px;margin-bottom: 4px;}.
..txt2{ background: #000;line-height: 22px;height: 22px;overflow: hidd
en;text-align: center;display: block;color: #fff;margin: -21px 0 0 0;w
idth: 231px;position: relative;opacity: 0.7;filter: alpha(opacity=60);
cursor: pointer;float: left;font-size: 12px;}...bj .up {float: left;he
ight: 126px;width: 509px;}..ul {margin: 0;padding: 0;}...bj .up li
<<< skipped >>>

GET /miniindex/images/Untitled-2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 18896

Content-Type: image/gif

Last-Modified: Sun, 13 Apr 2014 02:21:34 GMT

Accept-Ranges: bytes

ETag: "0cbe616bf56cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:19 GMT
GIF89a..s....SE3...mWG....vU.eF........ivcO....tGW6$TOH..V.ZD.f8.W8.ye
I ...\H3$....gE.......fD..Y..j.fH)...T9.......Z8.....z........de;)..f.
..dG6..swI5.tK....zS.....a....qF%"..wV.{fxT;5%...v..m....vI.......L4..
.fddfB).iV.hS&&!82%......wC .b>........d. ............r..Y4* ......
..i....pY.....j..c....(!wvu.|[..b.H ..t..u...E) .kR.kG.]@eR;..r.......
.o.......|O......H:0...U;..zR........d.....l..k..b..q%4#643.....j.|\..
..L1;A/.V-..{.....c.....z.....J.....|..l....rP...zsd.....O..p.......lM
..a....~S.oL{_;g4.sj`.R0.s[@...pPzT-S.!..~.L,..}........k;....[s>..
.>....._.....}.....i..]fO-.........b\]..n..X.t\........."......{aH@
@.._BDA...4..&7-4-,`gb.........qprllm.................................
.............J .oN...w{|........._^Z..p........{......... ,(..........
..34>..pmui.........!..NETSCAPE2.0.....!.......,......s......L.!...
...........Y...C......B..A..\N.$.J.IQkD.H....(... .'[email protected]
f.v..]......N....-[....d.&. ..`....5...^......B1X..u.%"..g,.......]N.(
D.....R.L..e..3...e.....2k......<A.,..A.k*....-.<...m.F..9......
.......:q.KC.rO........Xt...:.7....S.d.Q..4...SO.<2w.z........Y....
.b.qm-..1.^.........e.4.$b0B.q!a!!.]p!.sk...Fl`........4t`b..]BJ...a.y
........^..4..'.hs.X....<.pe................\.qa%HXp.\.ehqJ.....u.i
Y..4..&.D$pI...H.f4.I#[email protected]&..Y.t.d.'0(...I.!..u...;H
G]ue.F.w$iq...4PC...........hv..YQQ..S;#..[.W)@...*..5L.....H(Fq.b...W
2W.....iF.p.*G..!.,Z.*@.Q.G.O..%..s...h...E$.. ....q....k,X.....'H...r
Q...qU.......F.^...rQ..,.hq.1..d'f2v&T....2Q=E.....ZC=........U..`
<<< skipped >>>

GET /miniindex/inc/normal_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 41703

Content-Type: image/png

Last-Modified: Thu, 10 Apr 2014 17:05:46 GMT

Accept-Ranges: bytes

ETag: "0511e1ddf54cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:20 GMT
.PNG........IHDR.......!.......c.....sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS5q..6....tEXtCreation Time.07/11/13
........prVWx......0...."k..a#...8.v..0...b!xkb8......I...I_..;\.uH.4.
.......1.]........,S..v.._.r...us...."MU.v.....j..j...Z..S...r..}.....
.|K...........w{\..p..........&b.....HmkBF............................
............................................).3...:.mkTSx..}Kl.Wvv.lY"
EQ..8..a......z. ....l.v.lu7%J1.TWwI.Q.L..(...#.......3..e.U&....>@
. H..Yg.eV3...s....u.Iv.I.h.............O........r.t......6|M.....2...
...{..3V.G.y..t..Z....;c.p.k=g\..now.....C8.......z.|4V....Me......X.k
e_....-.|.,.I.o..G.PYQ.d.Ke.v.;.8..6.{....U.zss.l..-...i.R..5....k..6.
W.M.O.il.....w.........f...u...[...}z.~..d...6....m...6w4.NsG..4w.lZd.
N..6.4n.l....*...Y6TF....iW.....Q.......1....6...B...a":Y.......Y%.~D0
......3..M....8t..>x.&...'jO......1. B.3.1.".S.L..I.2.^.1.j.G....`.
^F.....`x.a.'c..D.N...Qh.2E..R.1(....J.J...S.S.......E :.a.'.......S..
...i.9..(.ieH1.0Hm).z...t[>v...k.s.].*C.L..R4..<.dQ..mH..A..Y.}.
.2.y.S.g@~.;u... |.i....pL..2.....Z.D......D.J.4.8c..sZ.g.....F...7.E.
.H.<..)x.J..1.J..zj....sJ...S....2..A...AqD.."..I5.rn.....9..j.Y.. 
@.4...w.@[email protected]...}.,..6.
...c.;r..Fuj.......Y;@.^..G.v...".-/a.'..>l.@.,1V....0.T...g..f$...
..'.B.'....LQ.<....m..C...z..!.....A..1f .c..^....-.\...Z.8z..k..I.
...3d....>h...h...q....S....-..H....$7l...$.az$....j.>...P...XR.
....P..]4.z......,~....'........<}.M....R.8<f...........0..2
<<< skipped >>>

GET /miniindex/inc/ico_new2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 55317

Content-Type: image/png

Last-Modified: Thu, 10 Apr 2014 17:05:46 GMT

Accept-Ranges: bytes

ETag: "0511e1ddf54cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:20 GMT
.PNG........IHDR...(... .....QE .....sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS5q..6....prVWx....Q.A...vAX.]....@M
F....X..!..s!..1._Q..5...{.>LU...|....*..)b....}e=...%...,.fQ.."2.=
..y.w/..............M...u.4l!._....!.W.?.....'m>..........O.v....r-
...5M......f.x... ..l....^<.=....j.........S...1..6_..............e
{u......2....b...HmkBF................................................
........................).3...D.mkTSx..}K.$.Y.ywggzfv.k. qi../........
........z.g........g..CS6X.....6.........w..B !q....}.......Y.UY...qN.
vV>"3..}.......a.......8.}..>8.G.......98v4[w./..o.....>.|..I
.-m..9L.=M......k.....8.^.[..o...::n.......qk......V............6..e8.
..................}.._.o.a.....x........z....L.Q....ooC.R.P...5.h..s..
....`.C......ui.?...m.....vp.;8..Q{...Cv...=d...m6WB(....F.]..........
...A.6........z.f...vBd..B..Gf.u...Y.!.{.J&bc1l...h..DQ..m..D...4f...b
.......1x<..7..>......o{..........w9...g........;.W.`...M...fP..
..MB..i..j.A.8%..zmvf..*..8.mb..V........)..r...^..x*..b....2....h....
......8~H...g..U....f.F;.ln.asB.9e..x.n........f....[..w.......;......
[email protected]....<....y.8...I.....~.(.*E.....].].......B...h..A...
.RzFz.g..L6.)`0...r.|..%..30n/..i...G...Mc.h...A.1h4.....&.f.....{...D
..1.........-.A2K;...DI.9NF8)...o....E2.T...bPY.*.E~...C?l..-p`.0.q0..
9v..F...c.m.5......:.B....-..*`...S..t..B.....>.ZOsH.1...x..?%...i.
.F.....b...=....*..e3..0.aY.$..0.&.Z..A.TQ........(R7....S.....g._...=
.... [email protected]...`O_.......uL...
<<< skipped >>>

GET /miniindex/inc/close.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 2526

Content-Type: image/png

Last-Modified: Thu, 10 Apr 2014 17:05:46 GMT

Accept-Ranges: bytes

ETag: "0511e1ddf54cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:20 GMT
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..Z{..U......dw.v....H*...H.....L..i.."j...5.bL..b..Y.5.(.
.FC.DH..X(...#.XK....[[email protected]..}.<....f.....|...3....|.........
[email protected]._'.K?...(..J.3.6..Mw.......S.i.EC!|.q..Q,.N.....U.(....
.....a.w......o^2..w..t]....d......t....(.m.F...fwN.W.........N..#.a..
.|.i 5..4..H.'.C..BJ.......)(.8.......,RJ....T.].X.......V,GRz........
.0D./..).....e.P,.._A.'][email protected]......$.W.b.1M....g.....
t....T.*.#.'%Y?....P.b..y..,..z..4...r..-}..%D..M.h../Z..S.......5\.,.
wq..3.....U....D.2..-....' .e[mm..,U.(.2.8..r., .P.).......C@ ..qBtob=
..|oU......5._..6.J&.hD..R........_.6...-.Z..$....s..)..v..Yh.........
....p..[..c.>...Tp.w.9...?p...}.......}..`..!..=.b...m...3$.}......
.`M....I(e......,[email protected]\........-_.~$Z..?....~8Q6..MW.....f*.0D
@ ......p.U..Zh..Dd{e..a(...._...j?....D&.....I-:.M.k......r%.....D..m
..7Os.........H........*.AH....1.k..8n..m.....I.........wg......S.Jk.r
.........Z...A.m......q...F...wq.H..u......}.}4.F..#.P.e..@..!....h.Q.
.}r.&V].}h.r8.....~...G$ b..P......z{..'.......{..Z. 62.W.6.w...r-...,
.t.j3..#`....X.'..L.....33..`...q..p....\K>....1..,*......!|.7.Q-`.
T.........|..#..U.p.>.D.C..ZFmQ...\.fTJ.N....q.../.AS.......}..y.R.
.......y...`c..#....Y.$...A....y..L....].x.;..X4.x$I.IX..._...q.w..0O.
.N...MB.y/.!Z.,......U._...e.........TO..._.w{../...= Q%......v.._....
TO...W..S.O.Hv..G..Z..x.~t...Be.....K....'.........N.......l..;.T..O..
.....w.n...a....j>....%......u..L.......M...}.#..._.G....b8....
<<< skipped >>>

GET /miniindex/images/b13.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 42296

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 07:47:34 GMT

Accept-Ranges: bytes

ETag: "0affbcbb557cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:20 GMT
......JFIF.....H.H.....[Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 15:47:34....................
.................................................................&.(..
...............................%.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................f...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..8........~.........A...^ ..6.i...
.....gf.m#X......:.`........5..........*.[cg71.\]..'.sO.....:m.H....{.
r....Ob.H....e...,x.@.%.......[..-=.<=...2A...2}...=...Z.....kI.?.P
{.s..eOi<..IL)..Z...?...mi..i.((..E.....{QI..4.~W...9......l..\#...
e....m.y;t". ecn.....u..W...cfD.l..p%X....Yfb,..v5..<9..:Dr%B...{.i
[email protected]#S.......`...G?I....P...P).#!d0...F.:W...m.6......I.V.
...40...Z.. ...O.o...........%.......TI.*.v.....Y...%...5..}?Y....h,.o
;.....)n.5...t2u.5....-..k@-....$.F.v..J....'Yk.O..]*.-.X]..4.......a*
....E... .....S~g...,.D4=WF$..uL,.[n.......i"=.\._N.O.p....H.O.......u
..T-...*....$......*hv%./..;.^....A.??.. ._.#h.......>......U.}
<<< skipped >>>

GET /miniindex/images/b15.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 38304

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 07:58:46 GMT

Accept-Ranges: bytes

ETag: "0bf865cb757cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:21 GMT
......JFIF.....H.H.....>Exif..MM.*.............................b...
........j.(...........1.........r.2...........i.................H.....
..H....Adobe Photoshop CS Windows.2014:04:14 15:58:46.................
....................................................................&.
(.........................................H.......H..........JFIF.....
H.H......Adobe_CM......Adobe.d........................................
......................................................................
...................................f...."................?............
..............................................................3......!
.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'..
.............Vfv........7GWgw........................5.....!1..AQaq"..
2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F............
...Vfv........'7GWgw.................?....Ny)*..Jb..RS..T..IH.....%...
......=l..i<.......{..?z......w..2...{}...........'.S..-..e_b6XH!..
....WzV{..jt...............?Q.6N.rn........W..?X...t....)m7. .Iq.....7
.s.....h..S,"fk.]].#E...$...X.).r....1R*%%1L.S$.....d.UY.....6..A.i..m
{....z.:..Y....l,.`k.C...3.Qg.........oV...g...........MZ..{.a........
.Z....... y..fQc3k.%......67_.....clg. A.~...A.(b2<W.d..."=.bTJ)...
?r....?qR.<...K.........4.k...]7.:.v.......nf.=..]F{.02K.`T.dx4.n..
....".w..GVD...h.D...2..3..>;/...."@.........)~=N...{@.{...=..w.!.7
..Y.....vz.eU....V...s_.s....N{)....S0.W;.>..;~....v.&V...fc./g.k`.
f..q.z..'.*x.~.j1.YHt.....ng `....D.K^/SQ1R*%\s.*%H..T..).b....$..
<<< skipped >>>

GET /miniindex/images/b17.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 40997

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 08:05:38 GMT

Accept-Ranges: bytes

ETag: "0f51852b857cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:21 GMT
......JFIF.....H.H......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 16:05:37....................
.................................................................&.(..
...............................{.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................f...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..uM...[O |T.......=;h.<..O...F.
....x..R.x}...8.>.xG...'i...2;.1.R.3.>...ILt.I.?"....V.......a..
.. .US~..].kr)$../k\..J1.$.t...:mG%...K..z. z...e....=.....u*..,[.T...
.w[E..Z.....p_VG........X...m.... .....v..q..q....Tv...73w.u..@f...,xG
.yk......S1.k....7G.v............R.h5....;......C....)....&....}...j..
....k}`U0m..~.....o."..H_v.......<.L%.`.I;.Q...lo...Q.!...C.......q
.....g.F.)aE.r.../...t|.g.!1.D..?uF\u!.....h.....t......#.).O...G.Q2u.
........P$p....O..#.RB..@.....>T......xG."Q.}.2...l..u...8.....s...
.3z.h...q......\...o...UM.u.....O..3.}[ki...U./........?....H...xB...[
.........K....w.....(.C.|...c..8....-..U........v..Wn.g....s=oQ{.v
<<< skipped >>>

GET /miniindex/images/b19.JPG HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 20701

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 08:17:59 GMT

Accept-Ranges: bytes

ETag: "8095c4bba57cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:21 GMT
......JFIF.....H.H......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 16:17:58....................
.........l...........A...........................................&.(..
...............................\.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................A.l.."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?....mS...0..........z../i....F..Z.-
.....u.!.`......Hy...G...Cu.a.i.^........k..w.y/S..?).Y$.......f..E...
...z.P{..1.-..Ak.....e.o......2[......8..~...'S.-P.n...~....U. .o...5.
......]}.w..?n{.(#I..6.w..?K..gO.....qc-i.........;..........g. .4i.A.
......V.R.nf#..N..:;...r...L.....V..o...p.V.......} ...<:.K\.V.5.-.
]k...c[i..j......E.._P..F..f.v..P...ysH..;...g........d..E.l.a,s{.....
.......8..-..7E....8..?......I.-..S..#.2...{.er..5...n........._...c?k
...o.>........n\....V.`4.Y.y.{O^.....a.k.....;........^...#.b6..?i.
;....;.....BG.2e...=^w.e;[email protected]=.h[.z...(.L....{..z....o..4,...
.9,...e....N.........Ocoq>......T<VI..........df6..N8....q..
<<< skipped >>>

GET /miniindex/images/aaa4.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 61094

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:22 GMT
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:05:17....................
.................................................................&.(..
...............................R.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................x...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?.....[....i.r.H.e.4.T...-.96l6i[.%.
#..j.../Q.-~;Hc......O.}....o....u<lL.G.)m........s.9.......8tV.9..
..8..V........N.Y...L.V...&.M.y.Yz..C*....c.. ...j?..j.Y...M.{6-n..;..
.LF.b....*.C.kl}}..]>.U.h.-..............j...cq..0....e..Cmo..-w..[
N..Vi...pX.....-k....=-.]mk>...I2D..i......._......z....5.6....\v..
 \.?7.s...de.mU..p..'..\._X..1............ZX.......M.....$.cZ.........
.FW....k....S.1..f^.c......q......I...^.zN...b... ~~Q#Su..qT........=.
..".G.....h1.......;)4..[lk.....A.....ad.\..e.`'..-..9z^mmu..4'.......
.p.{...?M..5..h..'.j.[80.....FwF.K..8.p~I}....R.SI.S0]&...V.)}...=....
..$..C..x)......&...PTA" .W......K..B/...V,.........3*...kC...i#..
<<< skipped >>>

GET /miniindex/images/aaa5.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 71321

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:22 GMT
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:10:25....................
.................................................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................x...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'[email protected][email protected]..../..d.
v.;...q.h.#!.m.....;......Y..... Z~..7z?O....wu7.....S..Y.m.d{.=../...
m..........o..{......m.f....-yu.|.$..s......?.P...~.}_...znP}.....k..I
>..........k.....Ll..o.#..UuD:.Xv......~.}l.... ."..q......O.Y,h.,.
k............u.6..{@..#...l?..~.e..-~K=#.M...[.......H....^...?.......
f.[_H%. <....l....p..r..6m/{a.N. .5.8......9.u...@....'.;..Wg..]lT.
............9...o.uW.Q..a.... ........YV3.<..n.ZD~...Z.....)..iu.s.
..O...}..&...O%..:.6.q..WI.o...Uf...:X..'rfB"......Y..I..v.......k7.5.
.....:L..&>j.X.SN=T.U]O%..F.d.....MN....j......?9.*...y.1..b<..g
:.dd.............T`<.,.ku....r...Z0.,8....,{.u.2.\...OQq..[....
<<< skipped >>>

GET /miniindex/images/aaa6.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 40601

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:22 GMT
......JFIF.....`.`.....cExif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:17:06....................
.................................................................&.(..
...............................-.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................x...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?....`..r.Z..l.t...q-..deLOaN;..._.=
t.1.K.7...... ..m.1.;..gs....rf.....a.c.44....mZ.u.4...c..v9...utx?\l.
......@l$7i?E.5...?........d.........E"...k*......c..........s.^.]W..u
,'.\.>.#..E.:..N.f.../M{...2|.k.h.@>..-f..g}..[.u...a..9..4.....
.......-q.)%..'$..>.......... :.E......S...K.....qr,....`x'e. .?5..
.#....hz^..`.cN.. .|.#.....2>z%ji.J.s}..4.c.....a...C..u...\.mS....
.`....A3......l(4C..Uo.x.n.... .U@...{{......vRw........i..M{...8.u..:
.......!q...@t[.KG.{....1>........-k...*C....$.R;...Z...,< u;}6.
5'.......6.....x...)...l-s}..H.)......bh.h.k/....o5.u,WWy.y....w5.~...
^..wz~.}.W....o....t%@Z.'@....S=@.#..n...Sa.H.{J...V..Wcn{F&.....^
<<< skipped >>>

GET /miniindex/images/aaa1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 45855

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:24 GMT
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 16:43:10....................
.....................^...........................................&.(..
...............................w.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................A...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..~..e........l%.....Y{.m.9..V.[..^
...3..4N..X.........m.. .U.?....u.Q.y....!.9....NN.S\....*......Z?...d
`uW.9.....1{..Xo..G....V.~{.W....S. .09*P.~..}_V.......qlr......K.zKP.
}g.y....nE..5.8TN!{....K\.O.w...UuZ....[U....t.....6<u.....[..[_S..
..I...g........^.h.^?..*Et.["..\CZ.K.x...s.........y..QwM.>..w.....
.Z..EWdc.Z.,.........k}e...Z..3G7....I....y]?Xp......N8~]..m.4}..#!...
.W................w.K\..B4#.....{(cf.g...k.}o.....<....o...>.#1.
^.D....y__...u..7]g...[..>.]......Y.w..WW.Z..-q.B4\?B.......2.FV].s
l..z..W4[.{.s....A....I.\.j...UR].1..8.;..nw... .bH.<Z]o..tN.......
UU.7.c.eU....Z......tN...]E.....H....-...u.......*.72..MM..Y.r..v.
<<< skipped >>>

GET /miniindex/images/aaa2.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 40325

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:24 GMT
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 16:57:14....................
.....................k...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................J...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?...`..?..............0h....t....X..
[email protected]'[email protected]=.{..>.K.<.w........F
.}...S..$F..........#&.!_.{r.q.....;...&.~......T.3/9..M..H<WX..v..
.....J...}..v.. ..0.a...z..S_.....%.s.X88.?.8........R..o.V.RR].....m.
..K|..-.K?Us...............P......t..3............N.8......2~h.X55....
.....}.....]K..Z.....9.....w.E......SN........r.}...t ......Q .w......
......o`...#?..........}C...7zn.8...g...r........7.w...c...''b./6,.P.`
.... I...........;[.;........0.S..Q.Z...b....O<)..I.).(....@5.$.Z.I
..s...z.s.m..l.......&.......5`..l.........>..J...!..b.{.{..Z.Y.R..
7d...G..._R(...=Q...'.o.l....U.z.Q."..m88..X...qi;....S..E.. )...(
<<< skipped >>>

GET /miniindex/images/aaa7.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 24446

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:24 GMT
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:21:08....................
.........}...........~...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................~.}.."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?.......\.......'..r~....N.....F...:
.......e..P4.....z6.tuf...c,n.j.N....Q.=..;<.'...X.....:.'A....:W@.
.0]s..V....G.......P.O.`|...2.ve..Ya;...a#-5)[email protected].. .......O.h.n
....i;M..s... c].....gfSsG.]#.5..|.K.a.X..!.c.:.O.....&.....~v....}i..
..r.}.u.>f..7m../.......\.r..II$..RS9 .*.'.M.g.J..S...J.Gu.32.I)...
.u<..k-;[.]...]o...9C9.Yok1\.q&...Z.....&...d ...r~..A.V.....K...%y
g....}1.... .}......~.......V...\KY..<.T9"j...ZOceX..h...@#.<..O
..j.syQ.F&.$.......&.K] ....W=.>.tN./..b.#[i..|l.......h....:L...W.
f}Y..X..2$:?;.aK....9. w..........O........]..1^....u.{3.l..z.....{...
v..kY;~.......4Y.cZ..:...X...........x"..i>.,p..6.`.O.c........
<<< skipped >>>

GET /miniindex/images/aaa8.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 22801

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:24 GMT
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:23:40....................
.........}...........~...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................~.}.."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?....8.|.d[..[....."S...`..2H0EgQ...
]V.w.E.........,.!!.....K.W...]..._..m.#L...%..Sr...X^Y.io?.... .c....
.h.P...hx:....{>.=.3k...;.......6.m{=.{H.......l.J#QOU.....k..M_...
....V...t..`e...n....... .6...i.. ...V....'9'9........Cs.9.e.)w9Cv..r.
......&@......*..*.,.d..U.-qo..Lgb.sKO..}..x......r..W%. ..m....)..k~M
-...=....az=....d....c..K....3.$.7.A.?..;.f~....a.hm..n...^h.Ttnr.$.s.
.=......f...J....?..F."......q...p..8..q..{~..r?X.C.....~....(i._...w.
h...V.C.'h...?.w..c9...z......^sz.NNSi.t......).....B.n......>../..
Uuy.5....KgY....p. .5..?...s.[6"..I........C~.<....:..s.e:...#.c.%.
W..c.#.).P.|Rs.%=....M..'B.y....fz.eZm....S..r.J...~....O.l.~..S..
<<< skipped >>>

GET /miniindex/images/aaa9.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 23028

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:25 GMT
......JFIF.....`.`.....DExif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:26:02....................
.........}...........~...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................~.}.."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?...m/.'....s.........5n....?.T<x
...S [email protected].]..~.UC [email protected].\.)k..$..?....uln...
.}........N...v..(.. .%Oc.Ki............1.KA\.B.wQ..9.m.m .!....#s.|..
...G..3..o.........8}..c}m. v?P......A.H......PDvY.S.......t...M$v.LA.
.O3..0...c..6K.......u.P....v...>......[....X...lct..5....U.4..!..z
....z.....o.p..u<....u`4i. y=q...c.TX.....qY...}.,p,..p..J~(HkWi...
u....y..N....)p....^..._Q.fM\Z. vt/%.....H8...l.......Wv>G.lt2..N..
....'e..5kO....O..6..2[..d\....o...k..G...... ..A~...^..X.)s.Hm.p-=.n.
............{L.q..........t..r5...........b......i.y*A..(.%..xR.ap....
[email protected](L..p;........a..........gHu}...>>.....ZX.$...
<<< skipped >>>

GET /miniindex/inc/style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 3717

Content-Type: text/css

Last-Modified: Thu, 10 Apr 2014 16:40:38 GMT

Accept-Ranges: bytes

ETag: "0c7479adb54cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:25 GMT
*{margin:0px;padding:0px;}..html,body {overflow: hidden;}..body {font:
 12px/18px Simsun, Helvetica, Arial, sans-serif; text-align: center; f
ont-size-adjust: none; font-stretch: normal;}..ul ,li{list-style: none
;}..a {color: rgb(51, 51, 51); text-decoration: none;}..a:hover {color
: rgb(189, 10, 1); text-decoration: underline;}..a,img{border:0px;}...
focus_filter {left: 0px; width: 100%; text-align: center; bottom: 0px;
 display: block; position: absolute; z-index: 3; cursor: pointer;}...f
ocus_filter {background: rgb(0, 0, 0); height: 21px; z-index: 1; opaci
ty: 0.6; -moz-opacity: 0.6;}...main {background: rgb(255, 255, 255); p
adding: 14px 0px 0px 14px; width: 509px; height: 352px; text-align: le
ft; float: left; position: relative; -ms-zoom: 1;}...main_left {backgr
ound: rgb(255, 255, 255); width: 222px; overflow: hidden; padding-righ
t: 20px; float: left;}...product_yl .list_news_yl1 {padding: 4px 0px; 
margin-bottom: 3px; border-bottom-color: rgb(139, 140, 140); border-bo
ttom-width: 1px; border-bottom-style: dotted;}...mod_left {margin-top:
 10px;}...list_pic {width: 222px; overflow: hidden; -ms-zoom: 1;}...li
st_pic ul {width: 232px;}...list_pic li {margin-right: 10px; float: le
ft;}...list_pic li a {padding: 2px; border: 1px solid rgb(221, 223, 22
2); width: 100px; float: left;}...list_pic li a img {width: 100px; hei
ght: 65px;}...list_pic li a span {height: 19px; text-align: center; pa
dding-top: 6px; display: block; cursor: pointer;}...list_pic li a:hove
r {text-decoration: none;}...list_pic li a:hover img {text-decorat
<<< skipped >>>

GET /pv.gif?uigs_productid=ufo&ufoid=wan&ptype=jztf2&pcode=index&rdk=1401572571657&img=pv.gif&sourcelist=0011000100006_0011000100007_0011000100008_0011000100009_0011000100010_0011000100011&titlelist=热血沙城_风云无双_仙侠道_大闹天宫OL_万世_Sogou傲剑2 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: pb.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 01 Jun 2014 02:36:04 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive

Set-Cookie: SUV=00A446D5B86B2626538A91947C7CE830; expires=Wed, 29-May-24 02:36:04 GMT; domain=.sogou.com; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

GET /pv.gif?uigs_productid=daohang&rdk=1401572571797&img=pv.gif&pars=?rand=1401572571797&suid=null&sduv=1401572571703_4807_00001&ckid=7892_00001_00000_5205_00000_00000&m=null&apid=null&sgtp=null&refer=&page=&pageUrl=http%3A%2F%2F123.sogou.com%2F%3F22014&loc=null&hp=-1&pid=Af22014&ptype=index&pcode=index&yyid=null&skin=null&ver=v53_ie6_dr__4&sys=100&ser=null&sev=null&time=2562 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: pb.sogou.com

Connection: Keep-Alive

Cookie: GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 01 Jun 2014 02:36:02 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive

Set-Cookie: SUV=008911CEB86B2626538A91924D2DD928; expires=Wed, 29-May-24 02:36:02 GMT; domain=.sogou.com; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
....


GET /pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1401572574922&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: pb.sogou.com

Connection: Keep-Alive

Cookie: GOTO=Af22014; SUV=008911CEB86B2626538A91924D2DD928

GET /pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1401572574922&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: pb.sogou.com

Connection: Keep-Alive

Cookie: GOTO=Af22014; SUV=008911CEB86B2626538A91924D2DD928

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 01 Jun 2014 02:36:07 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive

GET /core.php?web_id=5645354&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 01 Jun 2014 02:36:23 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sun, 01 Jun 2014 02:36:23 GMT

Expires: Sun, 01 Jun 2014 02:51:23 GMT
31e..!function(){var a,b,c,d=encodeURIComponent,e="5645354",f="",g="",
h="online_v3.php",i="z12.cnzz.com",j="1",k="text",l="z",m="站
8271;统计",n=window["_CNZZDbridge_" e].bobject,o="https:"=
=document.location.protocol?"https:":"http:",p="0",q=o "//online.cnzz.
com/online/" h,r=[];r.push("id=" e),r.push("h=" i),r.push("on=" d(g)),
r.push("s=" d(f)),q ="?" r.join("&"),"0"===p&&n.callRequest([o "//cnzz
.mmstat.com/9.gif?abc=1"]),j&&(""!==g?n.createScriptIcon(q,"utf-8"):(b
="z"==l?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" e:"hXXp://quanj
ing.cnzz.com","pic"===k?(c=o "//icon.cnzz.com/img/" f ".gif",a="<a 
href='" b "' target=_blank title='" m "'><img border=0 hspace=0 
vspace=0 src='" c "'></a>"):a="<a href='" b "' target=_bla
nk title='" m "'>" m "</a>",n.createIcon([a])))}();...0..

GET /core.php?web_id=5645354&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 01 Jun 2014 02:36:22 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sun, 01 Jun 2014 02:36:22 GMT

Expires: Sun, 01 Jun 2014 02:51:22 GMT
31e..!function(){var a,b,c,d=encodeURIComponent,e="5645354",f="",g="",
h="online_v3.php",i="z12.cnzz.com",j="1",k="text",l="z",m="站
8271;统计",n=window["_CNZZDbridge_" e].bobject,o="https:"=
=document.location.protocol?"https:":"http:",p="0",q=o "//online.cnzz.
com/online/" h,r=[];r.push("id=" e),r.push("h=" i),r.push("on=" d(g)),
r.push("s=" d(f)),q ="?" r.join("&"),"0"===p&&n.callRequest([o "//cnzz
.mmstat.com/9.gif?abc=1"]),j&&(""!==g?n.createScriptIcon(q,"utf-8"):(b
="z"==l?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" e:"hXXp://quanj
ing.cnzz.com","pic"===k?(c=o "//icon.cnzz.com/img/" f ".gif",a="<a 
href='" b "' target=_blank title='" m "'><img border=0 hspace=0 
vspace=0 src='" c "'></a>"):a="<a href='" b "' target=_bla
nk title='" m "'>" m "</a>",n.createIcon([a])))}();...0..

GET /stat.php?id=5645354 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s9.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 01 Jun 2014 02:36:21 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sun, 01 Jun 2014 02:36:21 GMT

Expires: Sun, 01 Jun 2014 04:06:21 GMT
1f7a..(function(){function l(){this.c="5645354";this.R="z";this.N="";t
his.K="";this.M="";this.o="1401590181";this.P="hzs10.cnzz.com";this.L=
"";this.s="CNZZDATA" this.c;this.r="_CNZZDbridge_" this.c;this.G="_cnz
z_CV" this.c;this.u="0";this.B={};this.a={};this.la()}function g(a,b){
try{var c=[];c.push("siteid=5645354");.c.push("name=" d(a.name));c.pus
h("msg=" d(a.message));c.push("r=" d(h.referrer));c.push("page=" d(f.l
ocation.href));c.push("agent=" d(f.navigator.userAgent));c.push("ex=" 
d(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).
src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(e){}}var h=docu
ment,f=window,d=encodeURIComponent,k=decodeURIComponent,p=unescape,r=e
scape,m="https:"===f.location.protocol?"https:":"http:",s=m "//c.cnzz.
com/core.php";l.prototype={la:function(){try{this.U(),.this.J(),this.i
a(),this.H(),this.m(),this.ga(),this.fa(),this.ja(),this.j(),this.ea()
,this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),f[this.r]
=f[this.r]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:funct
ion(){try{var a=this;f._czc={push:function(){return a.C.apply(a,argume
nts)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=f._czc;if("
[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b  ){v
ar c=a[b];switch(c[0]){case "_setAccount":f._cz_account="[object Strin
g]"===.{}.toString.call(c[1])?c[1]:String(c[1]);break;case "_setAutoPa
geview":"boolean"===typeof c[1]&&(f._cz_autoPageview=c[1])}}}catch(e){
g(e,"cS failed")}},qa:function(){try{if("undefined"===typeof f._cz
<<< skipped >>>

GET /jsn/v33_sugg_ajaj_v40_3.js HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1401572571703_4807_00001; CKOR=7892_00001_00000; CKOD=5205_00000_00000; GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Sun, 01 Jun 2014 02:36:02 GMT

Content-Type: application/x-javascript

Last-Modified: Fri, 02 Aug 2013 03:01:34 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
12ba.............Z{w.........5{<."..;..Y.q...W<..;.\6.A.d.......
...VK.;...............5J.a..~-..Az...*..W.HM....j.....XJ0xt..R_. k.es.
..c.l..Y.Dz.;.......m...HUn..gJ}..k...,...z.:.3...J&n.-,6^.s..5...vS..
.`...Oc..Bw..z...T.Rz..4qm.~.N.T4...8.?`...........N.I......6....}...F
.......9....v....;q....h...A4c....V...F.....k&j..a...91#.n....x...s...
..N..`.h$M......}....?...?...=Yl..8K...................k.ZhA.o...ol.}.
..p....~n9I.. ..$.......L...w.......g....H...|f...4ADSy.(.......=^..v.
...v.'......u...gC..'*..*....#....Z......o..*.#'I#.v.....s.\>..6...
...5[c.|Vb.....l.l..k7N...._..D.....4.$l8.d...J..........m.....%.Z.F..
-...>.3...k....a.D....U... 3U...]...w........c2...(..a...VO.$I.....
....s}...M9N.q.=.....9.0..._...,.|.He....r...........>g^....u.%....
7.....DU..*..J....R'i.h%Q@.<.........%.7..%pVbO....V1'!!^..}...caj.
b\......Qv....(.i.S.."..|...a..1..........X.....l.,9n....x0..6Tg......
..S.8.36&K..hhA....U.T.J....-.'.J..i..)...l.5.v.ih..w..l...fS.y..5...7
o....i...P ..V......x.M..Z4.:[email protected]...<..|.{
X.o`!_..K.P.....a....>./...*/.|......m.X.W.!.....$...r(..4.....0|..
|.* LzF.3->..k..:.X...\.].........Q..{._....'........Q9M.........q.
..........K.....GH..I..c.U....e>.../.'=N...-......W..^Y.p.!..>].
.:.NU..GM..^o.9N.%.(GAD.v.&I...!.s.q2..F..q...."h....%...o.".M......H)
..,...(..,[email protected]|...{..*....`x.....:...A..S......r.?}....!.`.0..&..!..#
.#";.#....e3.0gG.J.=#..a.......Oz.|.q`..D.L... .z.....#..=6t.RTla)...[
Gz'B3..:...b.SZ.}#W9.W...Vi....U>.)W.g....dZ(.. ....S.j>...#
<<< skipped >>>

GET /kan/static/css/DD_belatedPNG_0.0.8a-min.js?t= HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Sun, 01 Jun 2014 02:35:59 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 27 Aug 2013 08:33:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
b9b.............Y.o....=...}mH....yx....vZ.p..q...P,....*I...........#
@Lrvvvv.ofW...g......Hx-...... ........UQ.emk kq.CQiA^j'..k..n.2_e....
x.kg.o......:....W.:.K[;-..v.'.(A}..8.5.D.....D..<..oW....uaO...-./
.8..e*..Q.....H.)&...*.3[.Y3._.....Y%|...R.#..9.n..JJ..f...%..Y...O.Dh
....A.id.....*..O7|n,..T.e."......d%...9.fg.e..Z...m..m..L..4O_'..>
;<.>...X...*...33N....a.7...?....a....A....J...=M..T./.'.`.y5...
.8....{.20T.P......M....UKc.g....7.&[..]y.Hyu..^.WyP....].0c...z_?&.}$
D=T.v..|.:.Zj'..tV.<f,\......cwU.....93Y.~......4"....O.8....U....!
t.l9..e..~.....F..c.:.o...\...Zh....>..kWD..F...D...._%.w...06rs.&V
./.&.y..#m.Vy../FS...b..)..g.H.%....n.,..Bs..t[}.........h.....s....B.
......~....EFZ.E..z.;...G..'.Y.qV.?....;..%:o...........n.A.....^...y.
...[R.*.`.......I.3.. .U.x2W.....J..W....B..g..*....5.s.!.^4.. `{^z...
.....h.....e.(Fc=B(..E..p.]c....R.eD...k.A:y...nd..c.Ã..z..Mr..-..:.
.L....&...W....z:7..d....d.)Gw.x..~5;..qR#..U.7.....H......{...v..)...
I..v../....G6....yV....[..Ql....>.|}...a.dnn..f..|fL...'h......*J.'
.W.d..(M. W[[email protected]_....Z.........s....#!...(c..d...&l
t;.........$.....Y...:Z..... ..y..]....K)*.O.q.C=*.$..q.Gf.....*WY....
...Z<..c.3.._`LDj....`.jDj..\0....<...xy.xN}..LK.G..5..3....5...
|.3CS...,|.6...*.d...X).....Q6.BlQ.A...}....:.W..q......ad8bc.p.......
n..;e.<L0 d....w...OG..<D....'..m....3.Q.....K=6.kK..5.....M.3..
w.Z......[....#...N\.G$F.!.KS../y.:s......[.).c..h'uc....V`...(...@...
.../..j...."..C....pB.!.....f.Px.r..[p...R.......b..]u.I%.6|.NAXs.
<<< skipped >>>

GET /imgn/v32/icon4.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Sun, 01 Jun 2014 02:36:00 GMT

Content-Type: image/gif

Content-Length: 1506

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Accept-Ranges: bytes
GIF89a".....................v.....Cs.`}...............................
...I{.b...........................................................U..m
..r..........................M..Z.....................................
......................................................................
......................................................................
.............................mmm^^^QQQ777......!.....~.,....".......~.
...................................................................dKG
8HINi.];K.D.kUMJ[.LG`....DIa.O9c.o|z.bKL.i8p.zy{x..G..OL....'@.>w.Y
.....ox..).n..:..(.....oz...........XB.......9.3@.'...........5..H...5
....m..HNk...4.... uYR...7.....Rj./J.H..d...p....d....5.(ybi..%<..f
....Lk.4Y..M....<I..G..T2.eB%.. I.X..dI..T.R...m.6J.H...M.<?....
CR..w~...T...<F?r....v...<.Rk....D.}<..1..<9........y..9t;
z..S...B.....mU..1Ga.T.L...B...];..p.t....$r(..Oz...Ou8..$[...[d...%[ 
1@M~.0.%T ..`N.....`....5aE}..)...,P..H&YD.%E...[,[email protected]....%.`C...`...
....%..B.!x....,9..%. '.jv.A.a......y....)..}.`'..P...t.z(..4..76t.C.Y
.P..If....h...=dP...0`*........*[email protected]......)...$.Lq...&.....`@..
.p.."..A.!..B.S....)D;.....m.1L1A....n$.L...$@...>L....x..$).a(..L.
........>B........H.....(..$...A..lp.....B..4...Pp..."D ..&k.r#....
.<C...SL1...F....P.4.L7....F-.....@. 4.B&#X...#p....dp...p`..S@1E.?
..@%g..A.2....P.....4.@.'.PC.1....P.p.......z.^..!.....H2A....w.&.@.. 
L.B......&......`...BrC.f@..."....&<.)$u....g.....,[email protected][email protected];..@ 
..3Lr.?.=.`...h....,`v.).....: ...B^...,0...0..R...\b..PA.R`..xbkT
<<< skipped >>>

GET /v53/imgn/v53_2icos.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Sun, 01 Jun 2014 02:36:01 GMT

Content-Type: image/gif

Content-Length: 2051

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
GIF89a)....................8Y....................1..v...........=.....
.........z....................e........J........}.................8..j
..............u.................r.....Q..............C................
.k...........L........................................................
......................................................................
...............................................!.....N.,....).......NN
5....................N.?N...........I.>[email protected]......
-.......................<*........A..G.%:......#%% .C.......].....I
!JP.....I..a.8....A$.3..B.H.$N\.a %#.#......I4L)..k...&O........{.(7.f
N.:(P.pO.C.!..,.j.....D.'..6.G'A........u-z",..H....q...W.LI]d...J7..8
. .O.x.*..l....Tl...... ..m<a.$.J...d..a...J...s$.$H..e..$^..9...D.
........[k.`.Jbs.qk..nj..Yt........n...c.......uE'.c..n.Q_b.....)..x..
..d.....6e..V.)._c..'....W`...._{.}E.$.` ........,.....@..,.....)..W.M
 ..-....B.8#&..)...y..#..gb.#.|.. K6..*IJ.....R.3U:.%#..Rer_....P.8.9c
.X...8..#_..&.jN.'B>..g.$....G...P1..&0.........MTIb. ....M8!.h....
....*.y`yZ.|.xG.Q6.)k.6.:J_..y.X}....-\..o.05k..L..)...........v.)..HK
.H.....J.....4[.c.*Bn..9.^...[.xw.;...bGo......h.{o...[.%..Xo#...^..d 
S......~..r...*\[email protected]..&F...m...9.h..0..".*.(...:.....s..,.
.2.....!..l.#N.....4y..S32% cr..-bV.,...S.....6.....wn.9&.;LP7..a.wMlV
y...W:....0..<. ../.2x{...(%V.[B.PM..TGu.yV.....$z^9v.J".....@.:0EB
....:. ...]".PW....`.......PP..p..D.%..|...e..>)al....=.._.%...z..O
...n..J.B.........>.....B....62....C.h.k....<@.....B.A...5..
<<< skipped >>>

GET /v53/imgn/foot_slider.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Sun, 01 Jun 2014 02:36:01 GMT

Content-Type: image/jpeg

Content-Length: 322

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ....................................................
....................S.................................................
........?......>....('@......... . ..@........


GET /v53/imgn/guide_tip.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Sun, 01 Jun 2014 02:36:05 GMT

Content-Type: image/png

Content-Length: 10442

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
.PNG........IHDR.......J.......D.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Macintosh" xmpMM:InstanceID="xmp.iid:CEC0416D02FB11E388CB8B
2E3040A42A" xmpMM:DocumentID="xmp.did:CEC0416E02FB11E388CB8B2E3040A42A
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CEC0416B02FB11E3
88CB8B2E3040A42A" stRef:documentID="xmp.did:CEC0416C02FB11E388CB8B2E30
40A42A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>.Z....%<IDATx..].....&.(..."...ky.....
.f...7..........W@%.`..@A.*(...P..;K......E|..;g.....?[....>.<..
...........i......h-....@_~.. _&.2%...<..........k......w.d./.....U
 8..r./=|..9.{.P .IT.r.J.b].|...3|....../7....]1..=?..M]Y.f.....n...7l
.:w......Vk?.gkk 8.z..........ps...^p........P-....Z..._.6l.....KWWW.j
jj...........Q..P.~.|..Y..O......... .}...GI...3k..#......KS.....n..r.
rm..../.....'JUUU..aIT....V......4...]P.......M.....Y..xju6...2...|.o3
......?...>X\..V[[......}(//........o.CEM...f.N..Z.....O. ..7hU.qC=
p&/........@.|'gA.1.>.$....{@t..P...um..A..8..].v.;..D.b.]..ss.
<<< skipped >>>

GET /miniindex/images/b14.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 40898

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 07:49:40 GMT

Accept-Ranges: bytes

ETag: "0c21517b657cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:25 GMT
......JFIF.....H.H..... Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 15:49:39....................
.................................................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................f...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?.....N%.....Dj...V}../t.}..../...*.
KH.\7W.7t..9..>...............u............v..e. 8.......u~.....?..
... .Y[...m5...5..^.c..7{.......q>...[...'.....7.Y.....L.........L.
..K..8...).K.....:.........&..'....\.j.E.....G.-g2.t-...h....SE8....g.
.N.0..t...tQe.)....tm...k. .......ur>.....Lhm..[.#MWB.2K W>>.
?r.......v.=..D...`....S...}^..V..b.u.c.V..2.j&......=..\}.....Vh..G.k
mc...H./N..T.....m~...l;..i..r,kE..\.......3].....?..?1.c.8......e....
.j.DJ.....=......B.....z.G...62.X...4.......*wu....mk...~j..'.. .q.w.&
gt;. .4..9.>....W.F.o..'.i.y&.../c.P.K..gN..~T..2...D.LsOhU.gtB....
@.x.UNY*&.P..US...pn..W4...u[...b.<[email protected]
<<< skipped >>>

GET /miniindex/images/aaa4.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 61094

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:27 GMT
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:05:17....................
.................................................................&.(..
...............................R.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................x...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?.....[....i.r.H.e.4.T...-.96l6i[.%.
#..j.../Q.-~;Hc......O.}....o....u<lL.G.)m........s.9.......8tV.9..
..8..V........N.Y...L.V...&.M.y.Yz..C*....c.. ...j?..j.Y...M.{6-n..;..
.LF.b....*.C.kl}}..]>.U.h.-..............j...cq..0....e..Cmo..-w..[
N..Vi...pX.....-k....=-.]mk>...I2D..i......._......z....5.6....\v..
 \.?7.s...de.mU..p..'..\._X..1............ZX.......M.....$.cZ.........
.FW....k....S.1..f^.c......q......I...^.zN...b... ~~Q#Su..qT........=.
..".G.....h1.......;)4..[lk.....A.....ad.\..e.`'..-..9z^mmu..4'.......
.p.{...?M..5..h..'.j.[80.....FwF.K..8.p~I}....R.SI.S0]&...V.)}...=....
..$..C..x)......&...PTA" .W......K..B/...V,.........3*...kC...i#..
<<< skipped >>>

GET /miniindex/images/aaa5.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 71321

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:27 GMT
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:10:25....................
.................................................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................x...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'[email protected][email protected]..../..d.
v.;...q.h.#!.m.....;......Y..... Z~..7z?O....wu7.....S..Y.m.d{.=../...
m..........o..{......m.f....-yu.|.$..s......?.P...~.}_...znP}.....k..I
>..........k.....Ll..o.#..UuD:.Xv......~.}l.... ."..q......O.Y,h.,.
k............u.6..{@..#...l?..~.e..-~K=#.M...[.......H....^...?.......
f.[_H%. <....l....p..r..6m/{a.N. .5.8......9.u...@....'.;..Wg..]lT.
............9...o.uW.Q..a.... ........YV3.<..n.ZD~...Z.....)..iu.s.
..O...}..&...O%..:.6.q..WI.o...Uf...:X..'rfB"......Y..I..v.......k7.5.
.....:L..&>j.X.SN=T.U]O%..F.d.....MN....j......?9.*...y.1..b<..g
:.dd.............T`<.,.ku....r...Z0.,8....,{.u.2.\...OQq..[....
<<< skipped >>>

GET /miniindex/images/aaa6.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 40601

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:28 GMT
......JFIF.....`.`.....cExif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:17:06....................
.................................................................&.(..
...............................-.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................x...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?....`..r.Z..l.t...q-..deLOaN;..._.=
t.1.K.7...... ..m.1.;..gs....rf.....a.c.44....mZ.u.4...c..v9...utx?\l.
......@l$7i?E.5...?........d.........E"...k*......c..........s.^.]W..u
,'.\.>.#..E.:..N.f.../M{...2|.k.h.@>..-f..g}..[.u...a..9..4.....
.......-q.)%..'$..>.......... :.E......S...K.....qr,....`x'e. .?5..
.#....hz^..`.cN.. .|.#.....2>z%ji.J.s}..4.c.....a...C..u...\.mS....
.`....A3......l(4C..Uo.x.n.... .U@...{{......vRw........i..M{...8.u..:
.......!q...@t[.KG.{....1>........-k...*C....$.R;...Z...,< u;}6.
5'.......6.....x...)...l-s}..H.)......bh.h.k/....o5.u,WWy.y....w5.~...
^..wz~.}.W....o....t%@Z.'@....S=@.#..n...Sa.H.{J...V..Wcn{F&.....^
<<< skipped >>>

GET /miniindex/images/aaa1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 45855

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:28 GMT
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 16:43:10....................
.....................^...........................................&.(..
...............................w.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................A...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..~..e........l%.....Y{.m.9..V.[..^
...3..4N..X.........m.. .U.?....u.Q.y....!.9....NN.S\....*......Z?...d
`uW.9.....1{..Xo..G....V.~{.W....S. .09*P.~..}_V.......qlr......K.zKP.
}g.y....nE..5.8TN!{....K\.O.w...UuZ....[U....t.....6<u.....[..[_S..
..I...g........^.h.^?..*Et.["..\CZ.K.x...s.........y..QwM.>..w.....
.Z..EWdc.Z.,.........k}e...Z..3G7....I....y]?Xp......N8~]..m.4}..#!...
.W................w.K\..B4#.....{(cf.g...k.}o.....<....o...>.#1.
^.D....y__...u..7]g...[..>.]......Y.w..WW.Z..-q.B4\?B.......2.FV].s
l..z..W4[.{.s....A....I.\.j...UR].1..8.;..nw... .bH.<Z]o..tN.......
UU.7.c.eU....Z......tN...]E.....H....-...u.......*.72..MM..Y.r..v.
<<< skipped >>>

GET /miniindex/images/aaa2.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 40325

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:28 GMT
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 16:57:14....................
.....................k...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................J...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?...`..?..............0h....t....X..
[email protected]'[email protected]=.{..>.K.<.w........F
.}...S..$F..........#&.!_.{r.q.....;...&.~......T.3/9..M..H<WX..v..
.....J...}..v.. ..0.a...z..S_.....%.s.X88.?.8........R..o.V.RR].....m.
..K|..-.K?Us...............P......t..3............N.8......2~h.X55....
.....}.....]K..Z.....9.....w.E......SN........r.}...t ......Q .w......
......o`...#?..........}C...7zn.8...g...r........7.w...c...''b./6,.P.`
.... I...........;[.;........0.S..Q.Z...b....O<)..I.).(....@5.$.Z.I
..s...z.s.m..l.......&.......5`..l.........>..J...!..b.{.{..Z.Y.R..
7d...G..._R(...=Q...'.o.l....U.z.Q."..m88..X...qi;....S..E.. )...(
<<< skipped >>>

GET /miniindex/images/aaa7.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 24446

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:29 GMT
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:21:08....................
.........}...........~...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................~.}.."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?.......\.......'..r~....N.....F...:
.......e..P4.....z6.tuf...c,n.j.N....Q.=..;<.'...X.....:.'A....:W@.
.0]s..V....G.......P.O.`|...2.ve..Ya;...a#-5)[email protected].. .......O.h.n
....i;M..s... c].....gfSsG.]#.5..|.K.a.X..!.c.:.O.....&.....~v....}i..
..r.}.u.>f..7m../.......\.r..II$..RS9 .*.'.M.g.J..S...J.Gu.32.I)...
.u<..k-;[.]...]o...9C9.Yok1\.q&...Z.....&...d ...r~..A.V.....K...%y
g....}1.... .}......~.......V...\KY..<.T9"j...ZOceX..h...@#.<..O
..j.syQ.F&.$.......&.K] ....W=.>.tN./..b.#[i..|l.......h....:L...W.
f}Y..X..2$:?;.aK....9. w..........O........]..1^....u.{3.l..z.....{...
v..kY;~.......4Y.cZ..:...X...........x"..i>.,p..6.`.O.c........
<<< skipped >>>

GET /miniindex/images/aaa9.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 23028

Content-Type: image/jpeg

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

Accept-Ranges: bytes

ETag: "0a4acfec357cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:29 GMT
......JFIF.....`.`.....DExif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:26:02....................
.........}...........~...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................~.}.."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?...m/.'....s.........5n....?.T<x
...S [email protected].]..~.UC [email protected].\.)k..$..?....uln...
.}........N...v..(.. .%Oc.Ki............1.KA\.B.wQ..9.m.m .!....#s.|..
...G..3..o.........8}..c}m. v?P......A.H......PDvY.S.......t...M$v.LA.
.O3..0...c..6K.......u.P....v...>......[....X...lct..5....U.4..!..z
....z.....o.p..u<....u`4i. y=q...c.TX.....qY...}.,p,..p..J~(HkWi...
u....y..N....)p....^..._Q.fM\Z. vt/%.....H8...l.......Wv>G.lt2..N..
....'e..5kO....O..6..2[..d\....o...k..G...... ..A~...^..X.)s.Hm.p-=.n.
............{L.q..........t..r5...........b......i.y*A..(.%..xR.ap....
[email protected](L..p;........a..........gHu}...>>.....ZX.$...
<<< skipped >>>

GET /imgu/2013/05/20130531144119_126.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p2.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Sun, 01 Jun 2014 02:36:01 GMT

Content-Type: image/png

Content-Length: 13613

Last-Modified: Fri, 31 May 2013 06:41:19 GMT

Connection: keep-alive

Expires: Tue, 01 Jul 2014 02:36:01 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.......2.............pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /stat.htm?id=5645354&r=http://VVV.mdtxw.org/miniindex/&lg=en-us&ntime=1401590182&repeatip=2&rtime=0&cnzz_eid=380591987-1401590181-&showp=1024x768&st=-17588&sin=none&t=undefinedundefinedundefined&rnd=1206591093 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hzs10.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.1

Date: Sun, 01 Jun 2014 02:36:23 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Tue, 28 May 2013 02:57:17 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /img/news_photo/2014/05/29/mE8bXnNioe2802.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: pic4.xcarimg.com

Connection: Keep-Alive

.q.%!..RR.Y*...(=;#)..K..;!...F...m..v....;..T.c...JE.fr.......{.)....
.{...s....%)kl.m...5..m..U....z.v[y.%..f.S..i.a...:G.jeG....0.,.1.22.'
T..nsj.u.c.&..64.....8].*....L..,.CR.!iB...d.A..A.....e....W./.....m..
-....}*)..v.z28......"[email protected]....;.....D..%..E(J..h%...HY.......
..RR"F......!...<..$! . ().[...s..".......p...JN....B.m...ze.....{.
..S.""^E.h...@7 ..>"..Op7S........%..z............>$.h1....yL.%.
!...z..O.O.x......[..d..^o...."Ci'.S.-#..Z.O.....L}...q..H.....wg..bC.
z..>/p.9.4.l..o.rJQ.. ...T.S;}.....>-..h!&m..AJ.....A.'...I._..j
....0;........B.4.6.......g{..%.!>..Z..Aq.4...).Z....K....d.y.4.^..
; ..L`..._.A...c......$r..PeP(..... .H?h..T(j..l..I......q...Z.....S..
...i?....(;[email protected]([email protected](?..HTTP/1.1 200 OK..Expires: Sun, 3
1 May 2015 16:34:13 GMT..Date: Sat, 31 May 2014 16:34:13 GMT..Server: 
Apache..Last-Modified: Thu, 29 May 2014 03:31:22 GMT..Cache-Control: m
ax-age=31536000..Content-Type: image/jpeg..Content-Length: 3226..Accep
t-Ranges: bytes..Xcar-Cache-Server: imgcache1-HIT..Age: 1..X-Via: 1.1 
zjjhdx36:8080 (Cdn Cache Server V2.0), 1.1 dls21:0 (Cdn Cache Server V
2.0)..Connection: keep-alive..........Exif..II*.................Ducky.
......<.....)hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." 
id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:met
a/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00   
     "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syn
tax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns
<<< skipped >>>

GET /u/js/ufo2.js HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Sun, 01 Jun 2014 02:36:01 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 06 Nov 2012 08:12:45 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Sun, 08 Jun 2014 02:36:01 GMT

Cache-Control: max-age=604800

Content-Encoding: gzip
600a...............v.G....<.....X.D.={...m.....MK.v7I{.R.A.......&l
t;.y..d.......!.g.Y..ZDU.=#.......]..M.|.....o.O..^..=\\.m..b9y4......
{...j.o...t1o..A.6>..G...}._....O.g....e..Y....e.x...W.....j...M.[.
...Yw..]..../{...b......n.;x..../F..w.%.G.Y.m....a.`.^.....l~S4.?:j...
...7..Y.U6[..n.=).......f]6..1..io1...../.I.u.^...u.mc..).....{..g =..
..f6k..o.`t.hPa.;.u.n....9j..............3.......u{w....4.J.....]X.Q..
.NK{<^,....|..f...Q.4.<.nOW_]]...0.(..f.dp.j.....t~S....f..h.e.h
.(..&.....y... {..g.....f.........f.?.6.([email protected]..[...
.*[email protected][email protected]>N.............l.wE?u%....l....Y...>u.W.
~.9.T0..G..........g.;(..js.Og..8a......V.W..`;.......?_.........a.q..
...*[email protected]..~5 ..u..<h...d}....4....u..J
p:.v...0...xhx..........9h.<>.........P5.!-...e..v..WM.K.Eg(....
0.n..W_.QN.v...}.e1f.....*&.aP.[.yw.._.. ..3...r].Mhr>...$|.6.....S
N.G..E.=.y..;.=).G...[0.Zm.G#.`X..........y...?.O.v..4o..M.... ..MGc..
>B...fV......<....~o_..IY/.........]....C.0....2..aN........w...
.w..n.n....u.|}5....b^..L....?x.>...h#.lY...&..V.c#...o. ..k?....vK
#.....l....^.`..0..t./..u.vS.H}.e....&v....m....02\.b?v.".......... .W
.0......=z..p9...0..k..~....Z...\.W...N.i....."?5.3..p.....m....t^....
e....V'5c...|..|6.nb..W?9....,[;.\....K......F..8`...~.p...cq"....N..=
.C.<j....x.S<.....C."^..g.C;w.}D,......Q..`....V|h..._.w..N....0
.%..?.S....|.R}..........1......t<~29...A.N.g.....Z......H.....Ec1.
....^s_..<....[.7{...!.....u2.... ...b8.A1.B8-...]._7.Z5.0.....
<<< skipped >>>

GET /imgu/2014/05/20140526170756_638.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Sun, 01 Jun 2014 02:36:05 GMT

Content-Type: image/jpeg

Content-Length: 5409

Last-Modified: Mon, 26 May 2014 09:07:56 GMT

Connection: keep-alive

Expires: Tue, 01 Jul 2014 02:36:05 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
......JFIF.............0Exif..II*.......1...............VVV.meitu.com.
...C..................................................................
..C...................................................................
....=._...............................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?....x@..........'_.H. .#S...
/....;6......O...1...c...;q3..k..j~g*2N{..z.....).|..f.Tpi...I..^ho..-
.....5..eo.i:.6v...^I,e.cnw6.[.p..5...<5.'.f...u.]TI7..v.......k.L^
"....u... .d..|.......G8$.^..<......QQ..G.G._..C.......<.~..K..K
......JD.W3I.......g'......Th..CyN.......8!...).........x.V..H...l...(
9.k.....8\.-.....2j..J....19.>.I..2qw9(>[email protected].=74U.tK....v
...hs...o|s.KgC}.7..'..R.$......I6R>..{[email protected]...
.</...[...$.1.$\0?.Z..H.].t.^....ec.r............! ...O.|%.>0D..
..."l..z`T...(a.);..VwG..x/........,...4.c,...H......X.n*/.EI]..I....7
k.;._J.m>..h>....mR.<qjl...............Z.....\.x..>.p.G/.J
./..}O;.</..S...]...Z._.........N.lQ.#..D....M{.qY. ..e....e/.Z.Nin
..G.......4...>p....t.Y.4..o..<6.8...O...._.ay.I:.7.....|.Y..q..
.2.kg.H.G...).. ..#.N...~...& .J..PF\D..FQ....'c........M<..i..
<<< skipped >>>

GET /stat.php?id=5645354 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s9.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 01 Jun 2014 02:36:22 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sun, 01 Jun 2014 02:36:22 GMT

Expires: Sun, 01 Jun 2014 04:06:22 GMT
2595..(function(){function l(){this.c="5645354";this.R="z";this.N="";t
his.K="";this.M="";this.o="1401590182";this.P="hzs10.cnzz.com";this.L=
"";this.s="CNZZDATA" this.c;this.r="_CNZZDbridge_" this.c;this.G="_cnz
z_CV" this.c;this.u="0";this.B={};this.a={};this.la()}function g(a,b){
try{var c=[];c.push("siteid=5645354");.c.push("name=" d(a.name));c.pus
h("msg=" d(a.message));c.push("r=" d(h.referrer));c.push("page=" d(f.l
ocation.href));c.push("agent=" d(f.navigator.userAgent));c.push("ex=" 
d(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).
src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(e){}}var h=docu
ment,f=window,d=encodeURIComponent,k=decodeURIComponent,p=unescape,r=e
scape,m="https:"===f.location.protocol?"https:":"http:",s=m "//c.cnzz.
com/core.php";l.prototype={la:function(){try{this.U(),.this.J(),this.i
a(),this.H(),this.m(),this.ga(),this.fa(),this.ja(),this.j(),this.ea()
,this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),f[this.r]
=f[this.r]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:funct
ion(){try{var a=this;f._czc={push:function(){return a.C.apply(a,argume
nts)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=f._czc;if("
[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b  ){v
ar c=a[b];switch(c[0]){case "_setAccount":f._cz_account="[object Strin
g]"===.{}.toString.call(c[1])?c[1]:String(c[1]);break;case "_setAutoPa
geview":"boolean"===typeof c[1]&&(f._cz_autoPageview=c[1])}}}catch(e){
g(e,"cS failed")}},qa:function(){try{if("undefined"===typeof f._cz
<<< skipped >>>

GET /imgn/123ie/setting_icon.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p6.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Sun, 01 Jun 2014 02:36:01 GMT

Content-Type: image/gif

Content-Length: 76

Last-Modified: Wed, 25 Jul 2012 09:14:49 GMT

Connection: keep-alive

Expires: Tue, 01 Jul 2014 02:36:01 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a.............#.....!.......,.............".8....=h%v..n!.....y.h
.....;..

GET /web/PopWinParam.asp?d=2014419&mainver=1.0.0&popver=1.0.0&xmlver=20131020010000 HTTP/1.1

User-Agent: hello crazyk

Host: stat.fjmjm.com

HTTP/1.1 200 OK

Date: Sun, 01 Jun 2014 02:36:04 GMT

Server: Microsoft-IIS/6.0

Who: ShanIE

Content-Length: 4659

Content-Type: text/html

Set-Cookie: ASPSESSIONIDCASRABDR=DPHJDCNAMBOFAFEOGMECNLMB; path=/

Cache-control: private
..<?xml version="1.0" encoding="gb2312"?>..<SoftwareConfig>
;..  <Version>20140601103604</Version>..  <Popwin>..
.    <Item id="1">..      <Subject>........</Subject>
;..      <WinWidth>708</WinWidth>..      <WinHeight>
404</WinHeight>..      <StartUpPosition>0</StartUpPosit
ion>..      <URL>hXXp://VVV.mdtxw.org/miniindex/</URL> 
..      <StartUpTime>10</StartUpTime>..      <ShowIntev
al>7200</ShowInteval>..      <AutoClose>600</AutoClo
se>..      <isShow>1</isShow>..    </Item>..    &
lt;Item id="2">..      <Subject>........</Subject>..   
  <WinWidth>300</WinWidth>..      <WinHeight>265<
/WinHeight>..      <StartUpPosition>1</StartUpPosition>
..      <URL>hXXp://stat.fjmjm.com/a/cpv1.html?t=20140601103604&
lt;/URL> ..      <StartUpTime>50</StartUpTime>..      &
lt;ShowInteval>0</ShowInteval>..      <AutoClose>50<
/AutoClose>..      <isShow>1</isShow>..    </Item>
;..    <Item id="3">..      <Subject>....LB</Subject>
;..      <WinWidth>300</WinWidth>..      <WinHeight>
265</WinHeight>..      <StartUpPosition>1</StartUpPosit
ion>..      <URL>hXXp://stat.fjmjm.com/a/cpv1.html?t=20140601
103604</URL>..      <StartUpTime>200</StartUpTime>..
      <ShowInteval>7200</ShowInteval>..      <AutoC
<<< skipped >>>

GET /imgu/2014/05/20140508103513_537.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p4.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Sun, 01 Jun 2014 02:36:01 GMT

Content-Type: image/gif

Content-Length: 21959

Last-Modified: Thu, 08 May 2014 02:35:13 GMT

Connection: keep-alive

Expires: Tue, 01 Jul 2014 02:36:01 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89ai......SSS.ww........\.......c;/.W...i......C.hhh.R.............
.........................vE.....................-.......Z...bbb~~~.=..
...]8....t...."*........dd.......A....S............%..............D..=
....DDD.K.....kH.....h...................BB...)1.TZ........$$.SSJJJ.::
...qqqdj..........\c..........4<......4vvv.,,.22.ZZ.......j .......
............nn......ty.>>>....z\lll..........]#....KK........
.....qR.L$....f ............:B...x......................R,......yyyCJ.
...........{.....b%-............mh...n7.....r...JQ.....a'.K..~O.6.....
...}`.....c......lq....}............G.....R$.....p.E...b.....m~...V..^
 .G...z..s.......vW.}Z.G.....P......~.Z0.............9..............D.
@[email protected]'/..>>.K..F.. ....\s..............
XL.....w....,&..f.....h......!..XMP DataXMP<?xpacket begin="..." id
="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/
" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27     
   "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-synta
x-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.ado
be.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/Res
ourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocu
mentID="xmp.did:491CD10DA3D5E311A958EE854ABCD7D0" xmpMM:DocumentID="xm
p.did:4C40E5B5D5E411E3B4278899C73C6A8E" xmpMM:InstanceID="xmp.iid:4C40
E5B4D5E411E3B4278899C73C6A8E" xmp:CreatorTool="Adobe Photoshop CS6 (Wi
ndows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9908CF
<<< skipped >>>

GET /stat.htm?id=5645354&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=380591987-1401590181-&showp=1024x768&st=0&sin=&t=undefinedundefinedundefinedundefinedundefined&rnd=393595797 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hzs10.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.1

Date: Sun, 01 Jun 2014 02:36:22 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Tue, 28 May 2013 02:57:17 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /miniindex/ HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 10093

Content-Type: text/html

Content-Location: hXXp://VVV.mdtxw.org/miniindex/index.html

Last-Modified: Thu, 22 May 2014 11:22:12 GMT

Accept-Ranges: bytes

ETag: "684ac813b075cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:16 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml">...<head>....<meta http
-equiv="Content-Type" content="text/html; charset=gb2312">....<m
eta http-equiv="Cache-Control" content="no-cache">....<meta name
="robots" content="noindex, nofollow,nosnippet,noarchive,noodp">...
.<title>..........</title>....<link href="inc/stylemini
.css" rel="stylesheet" type="text/css">....<script src="inc/jque
ry-1.7.2.min.js" type="text/javascript"></script>....<base
 target="_blank">..<script type="text/javascript"> ..<!-- 
..//..........//document.oncontextmenu=function(e){return false;}..//.
...........var cusi=0;..var tiaozuan=1;..var timer;..//..............v
ar bq_array = new Array();..//........,....id,........url,............
(1....,..............class) ......url ......bq_array.push(["....","0",
"","0","","0"]);..bq_array.push(["....","105","hXXp://VVV.jgtj.com.cn/
ll","0","xinwen.htm","0"]);..bq_array.push(["....","101","hXXp://VVV.j
gtj.com.cn/ll","0","nvxing_509_366.htm","0"]);..bq_array.push(["....",
"102","hXXp://VVV.jgtj.com.cn/ll","0","lieqi_509_366.htm","0"]);..bq_a
rray.push(["....","100","hXXp://VVV.jgtj.com.cn/ll","0","shehui_509_36
6.htm","0"]);..bq_array.push(["....","120","hXXp://VVV.jgtj.com.cn/ll"
,"0","jiankang_509_366.htm","0"]);..bq_array.push(["....","130","http:
//VVV.jgtj.com.cn/ll","0","meinv.htm","0"]);..bq_array.push(["....
<<< skipped >>>

GET /miniindex/inc/jquery-1.7.2.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 91342

Content-Type: application/x-javascript

Last-Modified: Thu, 10 Apr 2014 16:44:10 GMT

Accept-Ranges: bytes

ETag: "069a418dc54cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:16 GMT
/*!. * jQuery JavaScript Library v1.6.1. * hXXp://jquery.com/. *. * Co
pyright 2011, John Resig. * Dual licensed under the MIT or GPL Version
 2 licenses.. * hXXp://jquery.org/license. *. * Includes Sizzle.js. * 
hXXp://sizzlejs.com/. * Copyright 2011, The Dojo Foundation. * Release
d under the MIT, BSD, and GPL Licenses.. *. * Date: Thu May 12 15:04:3
6 2011 -0400. */.(function(a,b){function cy(a){return f.isWindow(a)?a:
a.nodeType===9?a.defaultView||a.parentWindow:!1}function cv(a){if(!cj[
a]){var b=f("<" a ">").appendTo("body"),d=b.css("display");b.rem
ove();if(d==="none"||d===""){ck||(ck=c.createElement("iframe"),ck.fram
eBorder=ck.width=ck.height=0),c.body.appendChild(ck);if(!cl||!ck.creat
eElement)cl=(ck.contentWindow||ck.contentDocument).document,cl.write("
<!doctype><html><body></body></html>");b
=cl.createElement(a),cl.body.appendChild(b),d=f.css(b,"display"),c.bod
y.removeChild(ck)}cj[a]=d}return cj[a]}function cu(a,b){var c={};f.eac
h(cp.concat.apply([],cp.slice(0,b)),function(){c[this]=a});return c}fu
nction ct(){cq=b}function cs(){setTimeout(ct,0);return cq=f.now()}func
tion ci(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b)
{}}function ch(){try{return new a.XMLHttpRequest}catch(b){}}function c
b(a,c){a.dataFilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTypes,
e={},g,h,i=d.length,j,k=d[0],l,m,n,o,p;for(g=1;g<i;g  ){if(g===1)fo
r(h in a.converters)typeof h=="string"&&(e[h.toLowerCase()]=a.converte
rs[h]);l=k,k=d[g];if(k==="*")k=l;else if(l!=="*"&&l!==k){m=l " " k
<<< skipped >>>

GET /miniindex/xinwen.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 7368

Content-Type: text/html

Last-Modified: Wed, 16 Apr 2014 14:44:27 GMT

Accept-Ranges: bytes

ETag: "5947395e8259cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:18 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<HTML xm
lns="hXXp://VVV.w3.org/1999/xhtml"><HEAD><META content="IE
=10.000" http-equiv="X-UA-Compatible">. ..<meta http-equiv="Cont
ent-Type" content="text/html; charset=gb2312">.. ..<meta name="r
obots" content="noindex, nofollow,nosnippet,noarchive,noodp">..<
title>......</title>..<link href="inc/style.css" rel="styl
esheet" type="text/css">.. ..<style type="text/css">..       
     * { padding:0px;..                margin:0px;..            }..   
         .roll-news {..                width:220px;..                h
eight:150px;..                border:solid 1px #c1c1c1;..             
   overflow:hidden;..            }..            .roll-news-index-hover
 {..                background-color:white !important;..            }.
.            .roll-news-image a img {..                width:220px;.. 
               height:150px;..            }..            .roll-news-in
dex {..                position:relative;..                top:-22px;.
.                float:right;..                width: 60px;..         
   }..            .roll-news-index li {..                list-style:no
ne;..                float:left;..                font-size:12px;..   
             font-weight:600;..                width:8px;..           
     height:16px;..                line-height:16px;..                
cursor:pointer;..                margin:0 3px 0 0;..              
<<< skipped >>>

GET /miniindex/shehui_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 12927

Content-Type: text/html

Last-Modified: Mon, 14 Apr 2014 11:01:16 GMT

Accept-Ranges: bytes

ETag: "0263cdbd057cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:18 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/jiankang_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 13037

Content-Type: text/html

Last-Modified: Mon, 14 Apr 2014 11:01:30 GMT

Accept-Ranges: bytes

ETag: "06194e3d057cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:18 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/xinwen.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 7368

Content-Type: text/html

Last-Modified: Wed, 16 Apr 2014 14:44:27 GMT

Accept-Ranges: bytes

ETag: "5947395e8259cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:18 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<HTML xm
lns="hXXp://VVV.w3.org/1999/xhtml"><HEAD><META content="IE
=10.000" http-equiv="X-UA-Compatible">. ..<meta http-equiv="Cont
ent-Type" content="text/html; charset=gb2312">.. ..<meta name="r
obots" content="noindex, nofollow,nosnippet,noarchive,noodp">..<
title>......</title>..<link href="inc/style.css" rel="styl
esheet" type="text/css">.. ..<style type="text/css">..       
     * { padding:0px;..                margin:0px;..            }..   
         .roll-news {..                width:220px;..                h
eight:150px;..                border:solid 1px #c1c1c1;..             
   overflow:hidden;..            }..            .roll-news-index-hover
 {..                background-color:white !important;..            }.
.            .roll-news-image a img {..                width:220px;.. 
               height:150px;..            }..            .roll-news-in
dex {..                position:relative;..                top:-22px;.
.                float:right;..                width: 60px;..         
   }..            .roll-news-index li {..                list-style:no
ne;..                float:left;..                font-size:12px;..   
             font-weight:600;..                width:8px;..           
     height:16px;..                line-height:16px;..                
cursor:pointer;..                margin:0 3px 0 0;..              
<<< skipped >>>

GET /miniindex/lieqi_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 13149

Content-Type: text/html

Last-Modified: Mon, 14 Apr 2014 11:01:34 GMT

Accept-Ranges: bytes

ETag: "0bbf6e5d057cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:19 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/jiankang_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 13037

Content-Type: text/html

Last-Modified: Mon, 14 Apr 2014 11:01:30 GMT

Accept-Ranges: bytes

ETag: "06194e3d057cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:19 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/images/Untitled-1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 19666

Content-Type: image/gif

Last-Modified: Sun, 13 Apr 2014 01:54:58 GMT

Accept-Ranges: bytes

ETag: "0859c5fbb56cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:19 GMT
GIF89a..s...........gE..u......e:".........vvwY7$............fefsF)...
....=Fc4.iB).\F.SP.eTyR7..x.cHWVW...GEEtK1...Z1.V ....saW.uS.uVxWD....
...........J&....E..7......wc'#$......jG2..........ru...755.......b?..
.......7!..jS.......S3...F .U@9.....................".........Z:.\<
....{z......y{..th......hio......d[U...TGC..........nK.........l.....Z
[`...............,..V$....rkf..........)).{r.......Z;#......j].R......
.nrv.........lRH.T;.T3VQO.....hbI@d_`......|^O........._ah......5'$...
6......I(.........I:9...q> OSW........................uqp.tZ...1...
.....nmq...zO-..].[3.L2.Y1KJL...SLP.U9..........T[40/.......oa...oO8uP
@......BAA<:>...#.........13......0-0N.....knj.cd..z.qr....67>
;>9!  .08PPJ..!.DF...*) .........--(_`^$...........................
........._A..........64......!..NETSCAPE2.0.....!.......,......s......
......z... (o..y...34o.=...a../.<z..y.I2...X..3......?...ea......7.
.&{.j..G...w.FY|Y0%..J.EM...</.4...5.!,.^...........Dp../..\......f
.. `...3fV.q..O`[email protected]... &i.\c.... ...i....sE.4..k..X..#!T.
Z..%..J..>3..GF|..../ .P.C.|.P.P.l..H..c_.=R...Q4..P.<...PD.0...
wIl.V.....6..h.c...O<.. {....w  [email protected](..&...d.......bJ.HXA
...4...,..H#...#(4............J0G`.E7.d.....P..I.`..0..C.S....1.2..\v.
e._....Z.........1L..<[email protected]..`.a..j....b...`[email protected]...
..vZ.E....H."@........Qj......V......... ..0.....L....M.}...27.... X`.
..4;..#8....*.e.u`.m..r;..1L.....#.........s..Zh...P$.........4..%.Xb.
1.4....E....UH....`....0C..h.. .q0j.................d....PrD.GPr..
<<< skipped >>>

GET /miniindex/images/Untitled-3.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 31591

Content-Type: image/jpeg

Last-Modified: Sun, 13 Apr 2014 02:27:26 GMT

Accept-Ranges: bytes

ETag: "0bbb5e8bf56cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:19 GMT
......JFIF.....H.H.....ZExif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:13 10:27:24....................
.....................s...........................................&.(..
...............................$.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................p...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'[email protected]@..... [b..*.X$d.9......U.f.
@.o...%.*e9.QX.U.....K.....B>..-... .|T....|.b.h.........Bh.#.....-
..rp.RZ..eZ..i..5>.....M...5Y.O#..h.b.............R...).G-.W.P6.Ic^
..cG%.....*..g..v3X.ki9...].....H.a=......Os.l3'e.i.m...........(.....
}.;?...O........]^.......`q5.l.5m6..w.?5v~..[.........{...>........
....X....Sus.`..o..E.....El.F......#>...4..t .....:@..._^[email protected].
v....B...)..,.5a%n.s.......B.....:.{.........[...O>yR.....p.J..f...
....?h...uF..../...j....W:?jPO..'.eG.x..{.N.....].h.....U....gw...*...
.C.B...)....z.......`.l..t....C..fu..0.OM..X.... g.K...R.;>.....U&.
;]c.....,.s......qjy........O.....P3.....i..u.....{...............
<<< skipped >>>

GET /miniindex/tj.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 279

Content-Type: application/x-javascript

Last-Modified: Thu, 10 Apr 2014 18:44:12 GMT

Accept-Ranges: bytes

ETag: "0665eddec54cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:20 GMT
var cnzz_protocol = (("https:" == document.location.protocol) ? " http
s://" : " hXXp://");document.write(unescape(""));<
/font>....


GET /miniindex/inc/min.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 1080

Content-Type: image/png

Last-Modified: Thu, 10 Apr 2014 17:05:46 GMT

Accept-Ranges: bytes

ETag: "0511e1ddf54cf1:420"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sun, 01 Jun 2014 02:36:20 GMT
.PNG........IHDR...l.........u.......tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx....k.Q...kfwf...F.B........ ..6.Z(.[..../..F.,l,E.". "./P
.....M.....}x...........i...9.|.~w.../..C.>FBIdq.....O?L.;...P.*..p
...WS.6._..^d..}.._..............D.. .*H.>.r)V.*k...k.kc.S........_
D.-..BJ.$...G...Y.\......lX.1D.......Z0H.\..*L..59B...... ...:CV0$a>
;...e....V3Q.g.`].$5.P........(.`....I...JlX:..7.U.#.X.....>K'..!..
Rj.!.&.k. ../#p.VY....-.tHLT..3#Q..D.GD...IL2;.q%-W$uK...D.> ....G.
...q....nY..QNK^j...Y.......b.f..0*.|.n.<.t|zP.c.g.0.K.. .R........
.=>... .../....8.t...H.).4.I. L.$.90s.3....S_:... ..<Hak5$yqz0.5
K.M....q4.g..........).d7..w......q.. h.M...*N...f...b..Gn=..<.}...
..&..~...B..~...y.D8.U2]/8.`%.E.F..l....~. .G..(l...L.JU.5.,=N.%..".2.
<[email protected].....=....C.h..~.z..qfU..*....#......o..8..a..<.....
*.b.0'Ga.........G..].jB.3}p1_i...6..J..)a......9Zf.k.b.|..6.J...a....
..^.G......j.u>........Q.5.u.....6....0%....Y..V..Q..K.RGj....a..&g
t;.../.....m.<..E..b.....d.{...s.L. -...$..6`?......<.[pKN.Rj..X
X4.... ;.N.'7..a.$6X3{..(.`z............[.?g.ab..z..U.....'d...B.;....
IEND.B`.....


GET /miniindex/inc/style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate