MD5: 75d4f04577417faeee85a9b1e706e66b
SHA1: 0611968e477bb04a8af318d03e0ee1b720e2342d
SHA256: 2ece80e3f6b7a01da9d86d5bccdcc2e2043038a94a23a55023e1dc699ecd567b
SSDeep: 24576:N48JRGmay4PA5NLqDYXyvDB2NeJfGaJYk1UsRNhwcHce:N42GfQNuN7seJ 2Yk/twcB
Size: 1117368 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: AirInstaller
Created at: 2009-06-07 00:41:59
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

shandian.exe:604
shandian.exe:564

The Trojan injects its code into the following process(es):

F30241_s_0523.exe:1700
%original file name%.exe:1180
sdad.exe:1736

File activity

The process F30241_s_0523.exe:1700 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\System.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\PluginInstallHelper.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf5.tmp (51442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp\NewPih.dll (4992 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa4.tmp (0 bytes)

The process %original file name%.exe:1180 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\shandian\ico\360.ico (32 bytes)
%Documents and Settings%\%current user%\Desktop\Internet Explorer.lnk (1 bytes)
%Program Files%\shandian\uninst.exe (2466 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp\config.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp\xID.dll (10 bytes)
%Program Files%\shandian\home.bat (691 bytes)
%Program Files%\shandian\bin\shandian.exe (28332 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp\config0.ini (3 bytes)
%Program Files%\shandian\ico\ie.ico (700 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Desktop\ÉÁµçä¯ÀÀÆ÷.lnk (505 bytes)
%Program Files%\shandian\config.ini (194 bytes)
%Program Files%\shandian\bin\shandian.ini (74 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\ÉÁµçä¯ÀÀÆ÷\жÔØÉÁµçä¯ÀÀÆ÷.lnk (682 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp\Md5dll.dll (8 bytes)
%Program Files%\shandian\ico\anquan.ico (3 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\ÉÁµçä¯ÀÀÆ÷\ÉÁµçä¯ÀÀÆ÷.lnk (694 bytes)
%Program Files%\shandian\ico\taobao.ico (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\F30241_s_0523[1].rar (91814 bytes)
%Program Files%\shandian\bin\sdad.exe (12955 bytes)
%Program Files%\shandian\shandian.exe (3121 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\ÉÁµçä¯ÀÀÆ÷.lnk (700 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp\bind.dll (1207 bytes)
%Documents and Settings%\%current user%\Desktop\360°²È«ä¯ÀÀÆ÷.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp\F30241_s_0523.exe (91814 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\F30241_s_0523[1].rar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\F30241_s_0523[1].rar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc1.tmp (0 bytes)

The process sdad.exe:1736 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b17[1].jpg (4544 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cpc_img[1].htm (442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-1.7.2.min[1].js (3045 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa7[1].jpg (3400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\close[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b16[1].jpg (9411 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tj[1].js (279 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\0[1].gif (18574 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\nvxing_509_366[2].htm (2273 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b19[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa9[1].jpg (3420 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].php (1163 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (21204 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa3[1].jpg (12610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b16[1].jpg (6651 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa9[1].jpg (4619 bytes)
%Program Files%\shandian\bin\update\PopWinParam.xml (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa1[1].jpg (9224 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (330 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@70e[1].txt (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa4[1].jpg (7028 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cpc_ztyw[1].css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b15[1].jpg (7171 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b18[1].jpg (4059 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@70e[2].txt (272 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Untitled-3[1].jpg (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\miniindex[1].htm (2174 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\aaa7[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa5[1].jpg (13944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cpc_swf[1].asp (1803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\aaa8[1].jpg (1675 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa8[1].jpg (2579 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lieqi_509_366[1].htm (1907 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa5[1].jpg (12097 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\aaa4[1].jpg (7788 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa3[1].jpg (17222 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa10[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cpv1[1].htm (1117 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jiankang_509_366[1].htm (2973 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\shehui_509_366[1].htm (2900 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b14[1].jpg (8832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b13[1].jpg (9569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b19[1].jpg (1152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa2[2].jpg (5416 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@565882[1].txt (137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico_new2[1].png (13581 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (410 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\meinv[1].htm (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-1.7.2.min[1].js (48201 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa10[1].jpg (3460 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (688 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa6[1].jpg (6912 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\core[1].php (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b14[1].jpg (10694 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b17[1].jpg (5464 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stylemini[1].css (5481 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xinwen[1].htm (810 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\shehui_509_366[1].htm (2736 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (330 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2012_swf[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa1[1].jpg (8107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa2[1].jpg (9631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\normal_bg[1].png (11551 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lieqi_509_366[1].htm (2736 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b18[1].jpg (4680 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b15[1].jpg (7771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Untitled-2[1].gif (3259 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\xinwen[1].htm (1799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\d[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jiankang_509_366[1].htm (3645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Close[1].gif (348 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\meinv[1].htm (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa6[1].jpg (6043 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@zhouliboguju[1].txt (148 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cpc_img[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b13[1].jpg (8731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\nvxing_509_366[1].htm (1449 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\Untitled-1[1].gif (3259 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (1008 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa1[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa6[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jiankang_509_366[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\shehui_509_366[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b14[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b13[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@70e[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa4[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa2[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b15[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@70e[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\meinv[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b16[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\xinwen[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cpc_swf[1].asp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\aaa8[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lieqi_509_366[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa5[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\core[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b19[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b17[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa9[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b18[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\nvxing_509_366[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\aaa7[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\aaa10[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\aaa3[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)

The process shandian.exe:604 makes changes in the file system.
The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DFB830.tmp (0 bytes)

The process shandian.exe:564 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\v53_123n[2].js (1527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\foot_slider[1].jpg (322 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\texture[1].gif (1485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hotdata[1].js (478 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (1826 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ufo2[1].js (10884 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\_ads_2[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\123.sogou[1] (9287 bytes)
%Program Files%\shandian\bin\twcache.ini (1388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rec[1].do (374 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140526163446_912[1].jpg (1264 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20130830161205_609[1].gif (940 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\DD_belatedPNG_0.0.8a-min[2].js (254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\selogo_111207[3].png (1858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\favicon[1].ico (681 bytes)
%Program Files%\shandian\bin\ImgCache\123.sogou.com_favicon.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\get_123_v53[1].php (15861 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (316 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\selogo_111207[1].png (1858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\v53_2icos[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ufo2[1].js (9978 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\mE8bXnNioe2802[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\skin_tips_n1[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cloudy[1].gif (1 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (1354 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\skin_[1].css (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\newioage[1].css (715 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\icon4[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\main[1].js (4537 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\guide_tip[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\123.sogou[1].htm (3733 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\new-ico[1].png (211 bytes)
%Program Files%\shandian\bin\shandian.ini.tmp (244 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (132 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\titlebg[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\20130531144119_126[1].png (3789 bytes)
%Program Files%\shandian\bin\theworld.ac (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VGX3.tmp (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\guide_top[1].jpg (605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\welcome_cn[1].htm (1469 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20140528121904_599[1].jpg (1467 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140526163242_997[1].jpg (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140526170756_638[1].jpg (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\img-news[1].gif (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\skin2_0[1].gif (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\20140508103513_537[1].gif (4179 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\v53_123n[1].js (2146 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\guide_tip[1].png (3767 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\setting_icon[1].gif (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\new-erweima2[1].png (5099 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (191 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\i8g7XZO1lz1162[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\v33_sugg_ajaj_v40_3[2].js (1187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\fine_cloudy[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo_1112293[1].gif (1266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\selogo_111207[2].png (1858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\skin3[1].gif (188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140527160745_754[1].jpg (556 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\DD_belatedPNG_0.0.8a-min[1].js (678 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fbg_about[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\setskinbg[1].gif (397 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\i-ico-2b[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\_ads_2[2].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\search_arrow[1].gif (447 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\img-video-2[1].gif (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20130820165531_481[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\start_button[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\citydata[1].js (2747 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\v53_arrow_h[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\get_tj[1].php (1199 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (8676 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hotdata[2].js (1018 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\main[2].js (2963 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\citydata[2].js (3487 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\v33_sugg_ajaj_v40_3[1].js (1352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\subnav_v41[1].png (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140526163043_207[1].jpg (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\v53_bicos[1].gif (826 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\_ads_2[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Program Files%\shandian\bin\shandian.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\v53_123n[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\guide_tip[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hotdata[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\main[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\citydata[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\DD_belatedPNG_0.0.8a-min[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\v33_sugg_ajaj_v40_3[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ufo2[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302 (0 bytes)

Registry activity

The process F30241_s_0523.exe:1700 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED 68 3C D4 8F FA B3 1B 8B 6B 94 73 B6 10 77 57"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process %original file name%.exe:1180 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsx2.tmp\config.ini\..]
"F30241_s_0523.exe" = "百度杀毒安装程序"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"DisplayName" = "ÉÁµçä¯ÀÀÆ÷"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 14 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"Publisher" = "ÉÁµç"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"URLInfoAbout" = "http://www.sd.com"
"DisplayIcon" = "%Program Files%\shandian\shandian.exe"

"UninstallString" = "%Program Files%\shandian\uninst.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"DisplayVersion" = "1.0.0.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8B 75 31 65 F3 78 B4 87 33 37 5A 62 4B 13 D0 2C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\shandian]
"home.bat" = "home"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"shandian" = "%Program Files%\shandian\shandian.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process sdad.exe:1736 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "sdad.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1384939658"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 7A 95 15 45 1B D0 D3 C6 75 26 4F E9 00 0D 0F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process shandian.exe:604 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 C0 3A 7F D0 07 06 A9 DD 6D 48 5E 6D 5A 2A 17"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process shandian.exe:564 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014053020140531]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014053020140531]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014053020140531\"

"CachePrefix" = ":2014053020140531:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT]
"shandian.exe" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "shandian.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014053020140531]
"CacheLimit" = "8192"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014053020140531]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE]
"shandian.exe" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1301653454"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 5E EC B1 61 B3 E8 5A D0 14 0C B5 00 AA BB 39"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013030120130302]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021120130218]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021820130225]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://stat.fjmjm.com/stat/?v=1&ac=setup&name=%original file name%.exe&mac=00-0C-29-86-17-36&md5=96c33967acbb608760244c8e0ec6d330	112.124.102.171
hxxp://stat.fjmjm.com/stat/?ac=stat&name=%original file name%.exe&mac=00-0C-29-86-17-36&md5=96c33967acbb608760244c8e0ec6d330	112.124.102.171
hxxp://stat.fjmjm.com/web/welcome_cn.htm?ver=2.4.1.9&guid=af4678061341bc0590d6e0ca25c130c163f1c4c5fb8e4c09b653a78c91814b0f1401434659&lastver=	112.124.102.171
hxxp://stat.fjmjm.com/	112.124.102.171
hxxp://proxy.sogou.com/?22014
hxxp://stat.fjmjm.com/web/PopWinParam.asp?d=2014419&mainver=1.0.0&popver=1.0.0&xmlver=20131020010000	112.124.102.171
hxxp://stat.fjmjm.com/web/images/texture.gif	112.124.102.171
hxxp://stat.fjmjm.com/web/newioage.css	112.124.102.171
hxxp://stat.fjmjm.com/web/images/start_button.jpg	112.124.102.171
hxxp://stat.fjmjm.com/web/images/guide_top.jpg	112.124.102.171
hxxp://njsh.cdn.sogou.com/kan/static/css/DD_belatedPNG_0.0.8a-min.js?t=
hxxp://stat.fjmjm.com/favicon.ico	112.124.102.171
hxxp://proxy.sogou.com/css/skin_.css?V=dr
hxxp://njsh.cdn.sogou.com/imgn/v32/icon4.gif
hxxp://proxy.sogou.com/v53/jsn/v53_123n.js?V=dr
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_bicos.gif
hxxp://njsh.cdn.sogou.com/imgn/v32/selogo_111207.png
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/subnav_v41.png
hxxp://proxy.sogou.com/dh/dhrc/rec.do?block=gamev2&jsonp=__yx2q&t=1&_stamp=1401434665786
hxxp://njsh.cdn.sogou.com/imgn/v32/skin2_0.gif
hxxp://njsh.cdn.sogou.com/u/js/ufo2.js
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140508103513_537.gif
hxxp://njsh.cdn.sogou.com/imgn/v32/setskinbg.gif
hxxp://njsh.cdn.sogou.com/imgn/123ie/setting_icon.gif
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_2icos.gif
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_arrow_h.gif
hxxp://njsh.cdn.sogou.com/imgn/v32/logo_1112293.gif
hxxp://njsh.cdn.sogou.com/v53/imgn/foot_slider.jpg
hxxp://njsh.cdn.sogou.com/imgn/123ie/search_arrow.gif
hxxp://njsh.cdn.sogou.com/imgu/2013/05/20130531144119_126.png
hxxp://njsh.cdn.sogou.com/ads_hz/_ads_2.js?t=778574
hxxp://proxy.sogou.com//v53/get_123_v53.php?block=wt&ver=v53&gfg=1&city=unknown&pid=Af22014&c=1401434667349&method=ajaf&cbf=fn
hxxp://njsh.cdn.sogou.com/imgn/v32/skin3.gif
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=daohang&rdk=1401434667364&img=pv.gif&pars=?rand=1401434667364&suid=null&sduv=1401434667239_7225_00001&ckid=8577_00001_00000_3805_00000_00000&m=null&apid=null&sgtp=null&refer=&page=&pageUrl=http%3A%2F%2F123.sogou.com%2F%3F22014&loc=null&hp=-1&pid=Af22014&ptype=index&pcode=index&yyid=null&skin=null&ver=v53_ie6_dr__4&sys=100&ser=null&sev=null&time=3672
hxxp://proxy.sogou.com/jsn/hotdata.js?V=1401434667411
hxxp://njsh.cdn.sogou.com/imgn/v51/new-erweima2.png
hxxp://njsh.cdn.sogou.com/imgn/v32/fbg_about.png
hxxp://njsh.cdn.sogou.com/jsn/citydata.js
hxxp://njsh.cdn.sogou.com/imgn/v32/titlebg.png
hxxp://njsh.cdn.sogou.com/jsn/v33_sugg_ajaj_v40_3.js
hxxp://njsh.cdn.sogou.com/imgn/tips/skin_tips_n1.gif
hxxp://njsh.cdn.sogou.com/v53/jsn/main.js?V=107ff6db9da3d62875c7cafb326229a51
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=ufo&ufoid=wan&ptype=jztf2&pcode=index&rdk=1401434669817&img=pv.gif&sourcelist=0011000100006_0011000100007_0011000100008_0011000100009_0011000100010_0011000100011&titlelist=热血沙城_风云无双_仙侠道_大闹天宫OL_万世_Sogou傲剑2
hxxp://njsh.cdn.sogou.com/imgu/2013/08/20130820165531_481.gif
hxxp://proxy.sogou.com/images/weather/fine_cloudy.gif
hxxp://proxy.sogou.com/images/weather/cloudy.gif
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1401434671333&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53
hxxp://njsh.cdn.sogou.com/v53/imgn/guide_tip.png
hxxp://proxy.sogou.com/v53/get_tj.php?hz=4671448&ids=qiche
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140526163043_207.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140526163242_997.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140526163446_912.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140526170756_638.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140527160745_754.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140528121904_599.jpg
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/new-ico.png
hxxp://njsh.cdn.sogou.com/imgu/2013/08/20130830161205_609.gif
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/img-news.gif
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/img-video-2.gif
hxxp://save2.xdwscache.glb0.lxdns.com/img/news_photo/2014/05/29/mE8bXnNioe2802.jpg
hxxp://njsh.cdn.sogou.com/imgn/v51/i-ico-2b.png
hxxp://save2.xdwscache.glb0.lxdns.com/img/news_photo/2014/05/28/i8g7XZO1lz1162.jpg
hxxp://proxy.sogou.com/favicon.ico
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/inc/jquery-1.7.2.min.js	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/inc/stylemini.css	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/xinwen.htm?time=undefined	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/nvxing_509_366.htm?time=undefined	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/lieqi_509_366.htm?time=undefined	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/shehui_509_366.htm?time=undefined	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/jiankang_509_366.htm?time=undefined	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/meinv.htm?time=undefined	117.34.91.39
hxxp://taurus.danuoyi.tbcache.com/material/d7/4/a9ac5ed3b828895d94097c8c6faba.jpg
hxxp://drmcmm.e.shifen.com/media/id=nHRLPjm3nWRY&gp=401&time=nHnLPjmzrHckPs.jpg
hxxp://taurus.danuoyi.tbcache.com/noname.gif
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/Untitled-1.gif	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/inc/normal_bg.png	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/Untitled-2.gif	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/Untitled-3.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/tj.js	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/inc/ico_new2.png	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/inc/min.png	117.34.91.39
hxxp://c.split.cnzz.com/stat.php?id=5645354
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/inc/close.png	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/b13.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/inc/style.css	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/b14.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/b15.jpg	117.34.91.39
hxxp://c.split.cnzz.com/core.php?web_id=5645354&t=z
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=915151347-1401452266-&showp=1024x768&st=0&sin=&t=undefinedundefinedundefinedundefinedundefined&rnd=116594153
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401452266&repeatip=1&rtime=0&cnzz_eid=915151347-1401452266-&showp=1024x768&st=-17581&sin=none&t=undefinedundefinedundefined&rnd=1200138110
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/b16.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/b17.jpg	117.34.91.39
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=472740344
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/b18.JPG	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/b19.JPG	117.34.91.39
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1209621387
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa4.jpg	117.34.91.39
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1124007407
hxxp://pcookie.split.cnzz.com/app.gif?&cna=7GQPDDm4py0CAbhrJibz/3gM
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa5.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa3.jpg	117.34.91.39
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401452266&repeatip=2&rtime=0&cnzz_eid=915151347-1401452266-&showp=1024x768&st=-17579&sin=none&t=undefinedundefinedundefined&rnd=1087256729
hxxp://pcookie.split.cnzz.com/app.gif?&cna=7GQPDP4AjggCAbhrJiZwk7QY
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa6.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa1.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa2.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa7.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa8.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa9.jpg	117.34.91.39
hxxp://www.mdtxw.org.he2.aqb.so/miniindex/images/aaa10.jpg	117.34.91.39
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1301804592
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401452266&repeatip=3&rtime=0&cnzz_eid=915151347-1401452266-&showp=1024x768&st=-17576&sin=none&t=undefinedundefinedundefined&rnd=499790247
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1113500954
hxxp://z12.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401452266&repeatip=4&rtime=0&cnzz_eid=915151347-1401452266-&showp=1024x768&st=-17574&sin=none&t=undefinedundefinedundefined&rnd=1582803127
hxxp://stat.fjmjm.com/a/cpv1.html?t=20140530201724	112.124.102.171
hxxp://stat.fjmjm.com/a/Close.gif	112.124.102.171
hxxp://e.70e.com/cpc_img.asp?u=34496&m=6&n=1719,1685,1706,1707,1718&s_px=1	125.78.241.119
hxxp://e.70e.com/js/cpc_img.js	125.78.241.119
hxxp://e.70e.com/code/cpc_swf.asp?s_noadid=1719,1685,1706,1707,1718&s_width=300&s_height=250&s_id=34496&s_attrib=0&ref=&l=1	125.78.241.119
hxxp://e.70e.com/s_style/cpc_ztyw.css	125.78.241.119
hxxp://lg1236.565882.com/pShow.php?PID=5534	115.238.244.83
hxxp://e.70e.com/js/jquery-1.7.2.min.js	125.78.241.119
hxxp://e.70e.com/code/2012_swf.js	125.78.241.119
hxxp://cache.adm.cnzz.net/material/d7/4/a9ac5ed3b828895d94097c8c6faba.jpg	195.27.31.250
hxxp://www.mdtxw.org/miniindex/inc/ico_new2.png	117.34.91.39
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1209621387	42.120.219.171
hxxp://www.mdtxw.org/miniindex/images/Untitled-2.gif	117.34.91.39
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401452266&repeatip=1&rtime=0&cnzz_eid=915151347-1401452266-&showp=1024x768&st=-17581&sin=none&t=undefinedundefinedundefined&rnd=1200138110	42.156.140.25
hxxp://www.mdtxw.org/miniindex/images/aaa1.jpg	117.34.91.39
hxxp://cache.adm.cnzz.net/noname.gif	195.27.31.250
hxxp://www.mdtxw.org/miniindex/nvxing_509_366.htm?time=undefined	117.34.91.39
hxxp://p3.123.sogoucdn.com/imgn/v51/i-ico-2b.png	58.215.147.38
hxxp://123.sogou.com/?22014	106.120.151.64
hxxp://c.cnzz.com/core.php?web_id=5645354&t=z	42.120.219.6
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401452266&repeatip=3&rtime=0&cnzz_eid=915151347-1401452266-&showp=1024x768&st=-17576&sin=none&t=undefinedundefinedundefined&rnd=499790247	42.156.140.25
hxxp://123.sogou.com/css/skin_.css?V=dr	106.120.151.64
hxxp://p4.123.sogoucdn.com/imgn/v32/fbg_about.png	222.211.87.185
hxxp://www.mdtxw.org/miniindex/xinwen.htm?time=undefined	117.34.91.39
hxxp://p4.123.sogoucdn.com/imgu/2014/05/20140508103513_537.gif	222.211.87.185
hxxp://d.123.sogoucdn.com/imgn/v32/icon4.gif	222.211.87.185
hxxp://pb.sogou.com/pv.gif?uigs_productid=ufo&ufoid=wan&ptype=jztf2&pcode=index&rdk=1401434669817&img=pv.gif&sourcelist=0011000100006_0011000100007_0011000100008_0011000100009_0011000100010_0011000100011&titlelist=热血沙城_风云无双_仙侠道_大闹天宫OL_万世_Sogou傲剑2	220.181.124.108
hxxp://pic4.xcarimg.com/img/news_photo/2014/05/29/mE8bXnNioe2802.jpg	222.84.167.30
hxxp://p8.123.sogoucdn.com/imgn/tips/skin_tips_n1.gif	114.80.179.206
hxxp://p5.123.sogoucdn.com/imgu/2014/05/20140528121904_599.jpg	222.211.87.171
hxxp://www.mdtxw.org/miniindex/tj.js	117.34.91.39
hxxp://www.mdtxw.org/miniindex/images/b16.jpg	117.34.91.39
hxxp://p3.123.sogoucdn.com/imgu/2014/05/20140527160745_754.jpg	58.215.147.38
hxxp://www.fjmjm.com/web/newioage.css	112.124.102.171
hxxp://www.mdtxw.org/miniindex/lieqi_509_366.htm?time=undefined	117.34.91.39
hxxp://p3.123.sogoucdn.com/imgn/sehome/tjv1/img-video-2.gif	58.215.147.38
hxxp://www.mdtxw.org/miniindex/inc/normal_bg.png	117.34.91.39
hxxp://p1.123.sogoucdn.com/imgn/v32/selogo_111207.png	114.80.179.206
hxxp://d.123.sogoucdn.com/v53/jsn/main.js?V=107ff6db9da3d62875c7cafb326229a51	222.211.87.185
hxxp://p2.123.sogoucdn.com/imgu/2013/05/20130531144119_126.png	58.215.147.40
hxxp://www.mdtxw.org/miniindex/images/Untitled-3.jpg	117.34.91.39
hxxp://p3.123.sogoucdn.com/imgn/sehome/tjv1/new-ico.png	58.215.147.38
hxxp://www.mdtxw.org/miniindex/images/b14.jpg	117.34.91.39
hxxp://d.123.sogoucdn.com/v53/imgn/v53_bicos.gif	222.211.87.185
hxxp://pcookie.cnzz.com/app.gif?&cna=7GQPDP4AjggCAbhrJiZwk7QY	42.120.219.171
hxxp://p5.123.sogoucdn.com/imgn/v32/logo_1112293.gif	222.211.87.171
hxxp://www.mdtxw.org/miniindex/images/b19.JPG	117.34.91.39
hxxp://p0.123.sogoucdn.com/imgn/v32/skin3.gif	222.211.87.167
hxxp://www.mdtxw.org/miniindex/inc/close.png	117.34.91.39
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1124007407	42.120.219.171
hxxp://123.sogou.com/favicon.ico	106.120.151.64
hxxp://www.mdtxw.org/miniindex/images/Untitled-1.gif	117.34.91.39
hxxp://p1.123.sogoucdn.com/imgu/2014/05/20140526163446_912.jpg	114.80.179.206
hxxp://d.123.sogoucdn.com/v53/imgn/guide_tip.png	222.211.87.185
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401452266&repeatip=4&rtime=0&cnzz_eid=915151347-1401452266-&showp=1024x768&st=-17574&sin=none&t=undefinedundefinedundefined&rnd=1582803127	42.156.140.25
hxxp://s9.cnzz.com/stat.php?id=5645354	1.99.192.15
hxxp://p5.123.sogoucdn.com/imgu/2013/08/20130830161205_609.gif	222.211.87.171
hxxp://www.mdtxw.org/miniindex/inc/min.png	117.34.91.39
hxxp://pcookie.cnzz.com/app.gif?&cna=7GQPDDm4py0CAbhrJibz/3gM	42.120.219.171
hxxp://p6.123.sogoucdn.com/imgn/123ie/setting_icon.gif	114.80.179.224
hxxp://www.mdtxw.org/miniindex/jiankang_509_366.htm?time=undefined	117.34.91.39
hxxp://www.mdtxw.org/miniindex/images/aaa8.jpg	117.34.91.39
hxxp://p0.123.sogoucdn.com/imgu/2014/05/20140526170756_638.jpg	222.211.87.167
hxxp://www.mdtxw.org/miniindex/inc/stylemini.css	117.34.91.39
hxxp://p7.123.sogoucdn.com/imgn/123ie/search_arrow.gif	114.80.179.210
hxxp://taoqibao.zhouliboguju.com/pShow.php?PID=5534	115.238.244.83
hxxp://d.123.sogoucdn.com/v53/imgn/foot_slider.jpg	222.211.87.185
hxxp://p3.123.sogoucdn.com/imgn/sehome/tjv1/img-news.gif	58.215.147.38
hxxp://www.mdtxw.org/miniindex/shehui_509_366.htm?time=undefined	117.34.91.39
hxxp://www.mdtxw.org/miniindex/inc/jquery-1.7.2.min.js	117.34.91.39
hxxp://p3.123.sogoucdn.com/imgn/v51/new-erweima2.png	58.215.147.38
hxxp://pb.sogou.com/pv.gif?uigs_productid=daohang&rdk=1401434667364&img=pv.gif&pars=?rand=1401434667364&suid=null&sduv=1401434667239_7225_00001&ckid=8577_00001_00000_3805_00000_00000&m=null&apid=null&sgtp=null&refer=&page=&pageUrl=http%3A%2F%2F123.sogou.com%2F%3F22014&loc=null&hp=-1&pid=Af22014&ptype=index&pcode=index&yyid=null&skin=null&ver=v53_ie6_dr__4&sys=100&ser=null&sev=null&time=3672	220.181.124.108
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1113500954	42.120.219.171
hxxp://www.mdtxw.org/miniindex/meinv.htm?time=undefined	117.34.91.39
hxxp://p0.123.sogoucdn.com/imgn/v32/titlebg.png	222.211.87.167
hxxp://p5.123.sogoucdn.com/imgu/2014/05/20140526163043_207.jpg	222.211.87.171
hxxp://www.jlbnh.com/	112.124.102.171
hxxp://pic2.xcarimg.com/img/news_photo/2014/05/28/i8g7XZO1lz1162.jpg	222.84.167.30
hxxp://p1.123.sogoucdn.com/imgn/v32/skin2_0.gif	114.80.179.206
hxxp://www.mdtxw.org/miniindex/images/aaa2.jpg	117.34.91.39
hxxp://www.fjmjm.com/web/images/start_button.jpg	112.124.102.171
hxxp://123.sogou.com//v53/get_123_v53.php?block=wt&ver=v53&gfg=1&city=unknown&pid=Af22014&c=1401434667349&method=ajaf&cbf=fn	106.120.151.64
hxxp://www.fjmjm.com/web/images/texture.gif	112.124.102.171
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=http://www.mdtxw.org/miniindex/&lg=en-us&ntime=1401452266&repeatip=2&rtime=0&cnzz_eid=915151347-1401452266-&showp=1024x768&st=-17579&sin=none&t=undefinedundefinedundefined&rnd=1087256729	42.156.140.25
hxxp://www.mdtxw.org/miniindex/images/aaa4.jpg	117.34.91.39
hxxp://d.123.sogou.com/jsn/v33_sugg_ajaj_v40_3.js	222.211.87.171
hxxp://p0.123.sogoucdn.com/imgu/2014/05/20140526163242_997.jpg	222.211.87.167
hxxp://123.sogou.com/images/weather/fine_cloudy.gif	106.120.151.64
hxxp://p4.123.sogoucdn.com/imgn/v32/selogo_111207.png	222.211.87.185
hxxp://www.mdtxw.org/miniindex/	117.34.91.39
hxxp://drmcmm.baidu.com/media/id=nHRLPjm3nWRY&gp=401&time=nHnLPjmzrHckPs.jpg	123.125.65.24
hxxp://p0.123.sogoucdn.com/imgn/sehome/tjv1/subnav_v41.png	222.211.87.167
hxxp://www.mdtxw.org/miniindex/images/b13.jpg	117.34.91.39
hxxp://p6.123.sogoucdn.com/imgu/2013/08/20130820165531_481.gif	114.80.179.224
hxxp://wan.sogou.com/dh/dhrc/rec.do?block=gamev2&jsonp=__yx2q&t=1&_stamp=1401434665786	106.120.151.63
hxxp://123.sogou.com/v53/get_tj.php?hz=4671448&ids=qiche	106.120.151.64
hxxp://123.sogou.com/jsn/hotdata.js?V=1401434667411	106.120.151.64
hxxp://d.123.sogou.com/jsn/citydata.js	222.211.87.171
hxxp://p8.123.sogoucdn.com/imgn/v32/selogo_111207.png	114.80.179.206
hxxp://d.123.sogoucdn.com/kan/static/css/DD_belatedPNG_0.0.8a-min.js?t=	222.211.87.185
hxxp://www.fjmjm.com/web/images/guide_top.jpg	112.124.102.171
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1301804592	42.120.219.171
hxxp://www.mdtxw.org/miniindex/images/aaa5.jpg	117.34.91.39
hxxp://d.123.sogoucdn.com/v53/imgn/v53_2icos.gif	222.211.87.185
hxxp://www.mdtxw.org/miniindex/inc/style.css	117.34.91.39
hxxp://www.mdtxw.org/miniindex/images/aaa7.jpg	117.34.91.39
hxxp://www.mdtxw.org/miniindex/images/aaa6.jpg	117.34.91.39
hxxp://123.sogou.com/images/weather/cloudy.gif	106.120.151.64
hxxp://d.123.sogoucdn.com/ads_hz/_ads_2.js?t=778574	222.211.87.185
hxxp://www.mdtxw.org/miniindex/images/aaa9.jpg	117.34.91.39
hxxp://d.123.sogoucdn.com/v53/imgn/v53_arrow_h.gif	222.211.87.185
hxxp://p0.123.sogoucdn.com/u/js/ufo2.js	222.211.87.167
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=472740344	42.120.219.171
hxxp://www.mdtxw.org/miniindex/images/b15.jpg	117.34.91.39
hxxp://www.mdtxw.org/miniindex/images/b17.jpg	117.34.91.39
hxxp://123.sogou.com/v53/jsn/v53_123n.js?V=dr	106.120.151.64
hxxp://p3.123.sogoucdn.com/imgn/v32/setskinbg.gif	58.215.147.38
hxxp://www.mdtxw.org/miniindex/images/b18.JPG	117.34.91.39
hxxp://www.fjmjm.com/web/welcome_cn.htm?ver=2.4.1.9&guid=af4678061341bc0590d6e0ca25c130c163f1c4c5fb8e4c09b653a78c91814b0f1401434659&lastver=	112.124.102.171
hxxp://www.mdtxw.org/miniindex/images/aaa10.jpg	117.34.91.39
hxxp://pb.sogou.com/pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1401434671333&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53	220.181.124.108
hxxp://www.mdtxw.org/miniindex/images/aaa3.jpg	117.34.91.39
hxxp://hzs10.cnzz.com/stat.htm?id=5645354&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=915151347-1401452266-&showp=1024x768&st=0&sin=&t=undefinedundefinedundefinedundefinedundefined&rnd=116594153	42.156.140.25
hxxp://www.fjmjm.com/favicon.ico	112.124.102.171
down.icudi.org	222.186.60.12

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request on Unusual Port Possibly Hostile

Traffic

GET /core.php?web_id=5645354&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Fri, 30 May 2014 12:17:47 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Fri, 30 May 2014 12:17:47 GMT

Expires: Fri, 30 May 2014 12:32:47 GMT
31e..!function(){var a,b,c,d=encodeURIComponent,e="5645354",f="",g="",
h="online_v3.php",i="z12.cnzz.com",j="1",k="text",l="z",m="站
8271;统计",n=window["_CNZZDbridge_" e].bobject,o="https:"=
=document.location.protocol?"https:":"http:",p="0",q=o "//online.cnzz.
com/online/" h,r=[];r.push("id=" e),r.push("h=" i),r.push("on=" d(g)),
r.push("s=" d(f)),q ="?" r.join("&"),"0"===p&&n.callRequest([o "//cnzz
.mmstat.com/9.gif?abc=1"]),j&&(""!==g?n.createScriptIcon(q,"utf-8"):(b
="z"==l?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" e:"hXXp://quanj
ing.cnzz.com","pic"===k?(c=o "//icon.cnzz.com/img/" f ".gif",a="<a 
href='" b "' target=_blank title='" m "'><img border=0 hspace=0 
vspace=0 src='" c "'></a>"):a="<a href='" b "' target=_bla
nk title='" m "'>" m "</a>",n.createIcon([a])))}();...0..

GET /miniindex/images/aaa3.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:49 GMT

Content-Type: image/jpeg

Content-Length: 67971

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

ETag: "0a4acfec357cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:49 GMT

Accept-Ranges: bytes
......JFIF.....`.`.....fExif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:01:17....................
.................................................................&.(..
...............................0.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................x...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..EU....G.S.........H)..3.....?{..$
..k..7}.?..t ...N&`|..~......d.&.............. y...q.........?...K..l.
....R......?...v..I.g.Dy6...w.n......m..R...?.j.....lI i...G.o.>...
}......E.nuB.5$3.......}...e.c.E8-6.[.v...k_f......k)o......]......6..
.1..s......_.. .....].....7..g....z...w.k...j.~..........]..[.P#k.}nic
.?....\....Z...9.]=.O.f......Pyy..L......u....v.z...G..........u.....n
....n......"[email protected]\OG*...s..*...e..kl;^.....W...W...Y..o.....7....s}.
Xw4.i......c..5...g....N'VcH...A.g....%..Dw.....fQw...9pV...w8.6....{.
....]...q=7)...e........z.#.^.e.;..~;...JYW...U...Z.:*W......U?s_.....
.....B...H*L.A... .N.(...3..Q.._.U..A..:....?.........~.._.>z.Y
<<< skipped >>>

GET /miniindex/images/aaa9.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:51 GMT

Content-Type: image/jpeg

Content-Length: 23028

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

ETag: "0a4acfec357cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:51 GMT

Accept-Ranges: bytes
......JFIF.....`.`.....DExif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:26:02....................
.........}...........~...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................~.}.."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?...m/.'....s.........5n....?.T<x
...S [email protected].]..~.UC [email protected].\.)k..$..?....uln...
.}........N...v..(.. .%Oc.Ki............1.KA\.B.wQ..9.m.m .!....#s.|..
...G..3..o.........8}..c}m. v?P......A.H......PDvY.S.......t...M$v.LA.
.O3..0...c..6K.......u.P....v...>......[....X...lct..5....U.4..!..z
....z.....o.p..u<....u`4i. y=q...c.TX.....qY...}.,p,..p..J~(HkWi...
u....y..N....)p....^..._Q.fM\Z. vt/%.....H8...l.......Wv>G.lt2..N..
....'e..5kO....O..6..2[..d\....o...k..G...... ..A~...^..X.)s.Hm.p-=.n.
............{L.q..........t..r5...........b......i.y*A..(.%..xR.ap....
[email protected](L..p;........a..........gHu}...>>.....ZX.$...
<<< skipped >>>

GET /miniindex/images/b13.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:51 GMT

Content-Type: image/jpeg

Content-Length: 42296

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 07:47:34 GMT

ETag: "0affbcbb557cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:51 GMT

Accept-Ranges: bytes
......JFIF.....H.H.....[Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 15:47:34....................
.................................................................&.(..
...............................%.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................f...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..8........~.........A...^ ..6.i...
.....gf.m#X......:.`........5..........*.[cg71.\]..'.sO.....:m.H....{.
r....Ob.H....e...,x.@.%.......[..-=.<=...2A...2}...=...Z.....kI.?.P
{.s..eOi<..IL)..Z...?...mi..i.((..E.....{QI..4.~W...9......l..\#...
e....m.y;t". ecn.....u..W...cfD.l..p%X....Yfb,..v5..<9..:Dr%B...{.i
[email protected]#S.......`...G?I....P...P).#!d0...F.:W...m.6......I.V.
...40...Z.. ...O.o...........%.......TI.*.v.....Y...%...5..}?Y....h,.o
;.....)n.5...t2u.5....-..k@-....$.F.v..J....'Yk.O..]*.-.X]..4.......a*
....E... .....S~g...,.D4=WF$..uL,.[n.......i"=.\._N.O.p....H.O.......u
..T-...*....$......*hv%./..;.^....A.??.. ._.#h.......>......U.}
<<< skipped >>>

GET /miniindex/images/b15.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:52 GMT

Content-Type: image/jpeg

Content-Length: 38304

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 07:58:46 GMT

ETag: "0bf865cb757cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:52 GMT

Accept-Ranges: bytes
......JFIF.....H.H.....>Exif..MM.*.............................b...
........j.(...........1.........r.2...........i.................H.....
..H....Adobe Photoshop CS Windows.2014:04:14 15:58:46.................
....................................................................&.
(.........................................H.......H..........JFIF.....
H.H......Adobe_CM......Adobe.d........................................
......................................................................
...................................f...."................?............
..............................................................3......!
.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'..
.............Vfv........7GWgw........................5.....!1..AQaq"..
2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F............
...Vfv........'7GWgw.................?....Ny)*..Jb..RS..T..IH.....%...
......=l..i<.......{..?z......w..2...{}...........'.S..-..e_b6XH!..
....WzV{..jt...............?Q.6N.rn........W..?X...t....)m7. .Iq.....7
.s.....h..S,"fk.]].#E...$...X.).r....1R*%%1L.S$.....d.UY.....6..A.i..m
{....z.:..Y....l,.`k.C...3.Qg.........oV...g...........MZ..{.a........
.Z....... y..fQc3k.%......67_.....clg. A.~...A.(b2<W.d..."=.bTJ)...
?r....?qR.<...K.........4.k...]7.:.v.......nf.=..]F{.02K.`T.dx4.n..
....".w..GVD...h.D...2..3..>;/...."@.........)~=N...{@.{...=..w.!.7
..Y.....vz.eU....V...s_.s....N{)....S0.W;.>..;~....v.&V...fc./g.k`.
f..q.z..'.*x.~.j1.YHt.....ng `....D.K^/SQ1R*%\s.*%H..T..).b....$..
<<< skipped >>>

GET /miniindex/images/b16.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:52 GMT

Content-Type: image/jpeg

Content-Length: 43598

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 08:01:35 GMT

ETag: "801942c1b757cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:52 GMT

Accept-Ranges: bytes
......JFIF.....H.H......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 16:01:34....................
.................................................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................f...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..{..h....iku..C.v..8D.. 1...5'r.5.
.}....)T.....sv...'E'....'D.T....?w..j.....8l....]...c...G........C.Ce
.DhH.0....L.N.......;..H........F..s..v...A...._...ICu.v.vC.F0>.;..
.......;.c6.....t~.^NCr^.|:X.k.....&.R..k=/O....'. .~...|..l..9..-.#A.
.O...5ut............c.` ...c.^..&(e=H.."46G...]g.=.8Y./...V..z.6~.. ..
1.G._N.z....U..U.`...O.f.o{e..[K..............]n}..u..^..m..-l.5..t?..
.k.. w....."..-.....:.....^........t...........Sv......5._c.!.....s. .
Kk.m..kO..v.{N.b...}......A.......I..1.h..!...&O.W..._........C..T....
.....gJ..X.."!:........{........?.]..;.V.'B..T9.X.{....".[..."..3}.]. 
Y.....g.*9..G<}....P.uE.7*.....q.....?h.......O'.[t<.....V..
<<< skipped >>>

GET /miniindex/images/b17.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:53 GMT

Content-Type: image/jpeg

Content-Length: 40997

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 08:05:38 GMT

ETag: "0f51852b857cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:53 GMT

Accept-Ranges: bytes
......JFIF.....H.H......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 16:05:37....................
.................................................................&.(..
...............................{.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................f...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..uM...[O |T.......=;h.<..O...F.
....x..R.x}...8.>.xG...'i...2;.1.R.3.>...ILt.I.?"....V.......a..
.. .US~..].kr)$../k\..J1.$.t...:mG%...K..z. z...e....=.....u*..,[.T...
.w[E..Z.....p_VG........X...m.... .....v..q..q....Tv...73w.u..@f...,xG
.yk......S1.k....7G.v............R.h5....;......C....)....&....}...j..
....k}`U0m..~.....o."..H_v.......<.L%.`.I;.Q...lo...Q.!...C.......q
.....g.F.)aE.r.../...t|.g.!1.D..?uF\u!.....h.....t......#.).O...G.Q2u.
........P$p....O..#.RB..@.....>T......xG."Q.}.2...l..u...8.....s...
.3z.h...q......\...o...UM.u.....O..3.}[ki...U./........?....H...xB...[
.........K....w.....(.C.|...c..8....-..U........v..Wn.g....s=oQ{.v
<<< skipped >>>

GET /miniindex/images/b19.JPG HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:53 GMT

Content-Type: image/jpeg

Content-Length: 20701

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 08:17:59 GMT

ETag: "8095c4bba57cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:53 GMT

Accept-Ranges: bytes
......JFIF.....H.H......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 16:17:58....................
.........l...........A...........................................&.(..
...............................\.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................A.l.."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?....mS...0..........z../i....F..Z.-
.....u.!.`......Hy...G...Cu.a.i.^........k..w.y/S..?).Y$.......f..E...
...z.P{..1.-..Ak.....e.o......2[......8..~...'S.-P.n...~....U. .o...5.
......]}.w..?n{.(#I..6.w..?K..gO.....qc-i.........;..........g. .4i.A.
......V.R.nf#..N..:;...r...L.....V..o...p.V.......} ...<:.K\.V.5.-.
]k...c[i..j......E.._P..F..f.v..P...ysH..;...g........d..E.l.a,s{.....
.......8..-..7E....8..?......I.-..S..#.2...{.er..5...n........._...c?k
...o.>........n\....V.`4.Y.y.{O^.....a.k.....;........^...#.b6..?i.
;....;.....BG.2e...=^w.e;[email protected]=.h[.z...(.L....{..z....o..4,...
.9,...e....N.........Ocoq>......T<VI..........df6..N8....q..
<<< skipped >>>

GET /miniindex/images/aaa4.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:53 GMT

Content-Type: image/jpeg

Content-Length: 61094

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

ETag: "0a4acfec357cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:53 GMT

Accept-Ranges: bytes
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:05:17....................
.................................................................&.(..
...............................R.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................x...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?.....[....i.r.H.e.4.T...-.96l6i[.%.
#..j.../Q.-~;Hc......O.}....o....u<lL.G.)m........s.9.......8tV.9..
..8..V........N.Y...L.V...&.M.y.Yz..C*....c.. ...j?..j.Y...M.{6-n..;..
.LF.b....*.C.kl}}..]>.U.h.-..............j...cq..0....e..Cmo..-w..[
N..Vi...pX.....-k....=-.]mk>...I2D..i......._......z....5.6....\v..
 \.?7.s...de.mU..p..'..\._X..1............ZX.......M.....$.cZ.........
.FW....k....S.1..f^.c......q......I...^.zN...b... ~~Q#Su..qT........=.
..".G.....h1.......;)4..[lk.....A.....ad.\..e.`'..-..9z^mmu..4'.......
.p.{...?M..5..h..'.j.[80.....FwF.K..8.p~I}....R.SI.S0]&...V.)}...=....
..$..C..x)......&...PTA" .W......K..B/...V,.........3*...kC...i#..
<<< skipped >>>

GET /miniindex/images/aaa5.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:54 GMT

Content-Type: image/jpeg

Content-Length: 71321

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

ETag: "0a4acfec357cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:54 GMT

Accept-Ranges: bytes
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:10:25....................
.................................................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................x...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'[email protected][email protected]..../..d.
v.;...q.h.#!.m.....;......Y..... Z~..7z?O....wu7.....S..Y.m.d{.=../...
m..........o..{......m.f....-yu.|.$..s......?.P...~.}_...znP}.....k..I
>..........k.....Ll..o.#..UuD:.Xv......~.}l.... ."..q......O.Y,h.,.
k............u.6..{@..#...l?..~.e..-~K=#.M...[.......H....^...?.......
f.[_H%. <....l....p..r..6m/{a.N. .5.8......9.u...@....'.;..Wg..]lT.
............9...o.uW.Q..a.... ........YV3.<..n.ZD~...Z.....)..iu.s.
..O...}..&...O%..:.6.q..WI.o...Uf...:X..'rfB"......Y..I..v.......k7.5.
.....:L..&>j.X.SN=T.U]O%..F.d.....MN....j......?9.*...y.1..b<..g
:.dd.............T`<.,.ku....r...Z0.,8....,{.u.2.\...OQq..[....
<<< skipped >>>

GET /miniindex/images/aaa6.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:55 GMT

Content-Type: image/jpeg

Content-Length: 40601

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

ETag: "0a4acfec357cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:55 GMT

Accept-Ranges: bytes
......JFIF.....`.`.....cExif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:17:06....................
.................................................................&.(..
...............................-.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................x...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?....`..r.Z..l.t...q-..deLOaN;..._.=
t.1.K.7...... ..m.1.;..gs....rf.....a.c.44....mZ.u.4...c..v9...utx?\l.
......@l$7i?E.5...?........d.........E"...k*......c..........s.^.]W..u
,'.\.>.#..E.:..N.f.../M{...2|.k.h.@>..-f..g}..[.u...a..9..4.....
.......-q.)%..'$..>.......... :.E......S...K.....qr,....`x'e. .?5..
.#....hz^..`.cN.. .|.#.....2>z%ji.J.s}..4.c.....a...C..u...\.mS....
.`....A3......l(4C..Uo.x.n.... .U@...{{......vRw........i..M{...8.u..:
.......!q...@t[.KG.{....1>........-k...*C....$.R;...Z...,< u;}6.
5'.......6.....x...)...l-s}..H.)......bh.h.k/....o5.u,WWy.y....w5.~...
^..wz~.}.W....o....t%@Z.'@....S=@.#..n...Sa.H.{J...V..Wcn{F&.....^
<<< skipped >>>

GET /miniindex/images/aaa1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:55 GMT

Content-Type: image/jpeg

Content-Length: 45855

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

ETag: "0a4acfec357cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:55 GMT

Accept-Ranges: bytes
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 16:43:10....................
.....................^...........................................&.(..
...............................w.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................A...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..~..e........l%.....Y{.m.9..V.[..^
...3..4N..X.........m.. .U.?....u.Q.y....!.9....NN.S\....*......Z?...d
`uW.9.....1{..Xo..G....V.~{.W....S. .09*P.~..}_V.......qlr......K.zKP.
}g.y....nE..5.8TN!{....K\.O.w...UuZ....[U....t.....6<u.....[..[_S..
..I...g........^.h.^?..*Et.["..\CZ.K.x...s.........y..QwM.>..w.....
.Z..EWdc.Z.,.........k}e...Z..3G7....I....y]?Xp......N8~]..m.4}..#!...
.W................w.K\..B4#.....{(cf.g...k.}o.....<....o...>.#1.
^.D....y__...u..7]g...[..>.]......Y.w..WW.Z..-q.B4\?B.......2.FV].s
l..z..W4[.{.s....A....I.\.j...UR].1..8.;..nw... .bH.<Z]o..tN.......
UU.7.c.eU....Z......tN...]E.....H....-...u.......*.72..MM..Y.r..v.
<<< skipped >>>

GET /miniindex/images/aaa2.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:55 GMT

Content-Type: image/jpeg

Content-Length: 40325

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

ETag: "0a4acfec357cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:55 GMT

Accept-Ranges: bytes
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 16:57:14....................
.....................k...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................J...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?...`..?..............0h....t....X..
[email protected]'[email protected]=.{..>.K.<.w........F
.}...S..$F..........#&.!_.{r.q.....;...&.~......T.3/9..M..H<WX..v..
.....J...}..v.. ..0.a...z..S_.....%.s.X88.?.8........R..o.V.RR].....m.
..K|..-.K?Us...............P......t..3............N.8......2~h.X55....
.....}.....]K..Z.....9.....w.E......SN........r.}...t ......Q .w......
......o`...#?..........}C...7zn.8...g...r........7.w...c...''b./6,.P.`
.... I...........;[.;........0.S..Q.Z...b....O<)..I.).(....@5.$.Z.I
..s...z.s.m..l.......&.......5`..l.........>..J...!..b.{.{..Z.Y.R..
7d...G..._R(...=Q...'.o.l....U.z.Q."..m88..X...qi;....S..E.. )...(
<<< skipped >>>

GET /miniindex/images/aaa7.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:55 GMT

Content-Type: image/jpeg

Content-Length: 24446

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

ETag: "0a4acfec357cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:55 GMT

Accept-Ranges: bytes
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:21:08....................
.........}...........~...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................~.}.."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?.......\.......'..r~....N.....F...:
.......e..P4.....z6.tuf...c,n.j.N....Q.=..;<.'...X.....:.'A....:W@.
.0]s..V....G.......P.O.`|...2.ve..Ya;...a#-5)[email protected].. .......O.h.n
....i;M..s... c].....gfSsG.]#.5..|.K.a.X..!.c.:.O.....&.....~v....}i..
..r.}.u.>f..7m../.......\.r..II$..RS9 .*.'.M.g.J..S...J.Gu.32.I)...
.u<..k-;[.]...]o...9C9.Yok1\.q&...Z.....&...d ...r~..A.V.....K...%y
g....}1.... .}......~.......V...\KY..<.T9"j...ZOceX..h...@#.<..O
..j.syQ.F&.$.......&.K] ....W=.>.tN./..b.#[i..|l.......h....:L...W.
f}Y..X..2$:?;.aK....9. w..........O........]..1^....u.{3.l..z.....{...
v..kY;~.......4Y.cZ..:...X...........x"..i>.,p..6.`.O.c........
<<< skipped >>>

GET /miniindex/images/aaa8.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:56 GMT

Content-Type: image/jpeg

Content-Length: 22801

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

ETag: "0a4acfec357cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:56 GMT

Accept-Ranges: bytes
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:23:40....................
.........}...........~...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................~.}.."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?....8.|.d[..[....."S...`..2H0EgQ...
]V.w.E.........,.!!.....K.W...]..._..m.#L...%..Sr...X^Y.io?.... .c....
.h.P...hx:....{>.=.3k...;.......6.m{=.{H.......l.J#QOU.....k..M_...
....V...t..`e...n....... .6...i.. ...V....'9'9........Cs.9.e.)w9Cv..r.
......&@......*..*.,.d..U.-qo..Lgb.sKO..}..x......r..W%. ..m....)..k~M
-...=....az=....d....c..K....3.$.7.A.?..;.f~....a.hm..n...^h.Ttnr.$.s.
.=......f...J....?..F."......q...p..8..q..{~..r?X.C.....~....(i._...w.
h...V.C.'h...?.w..c9...z......^sz.NNSi.t......).....B.n......>../..
Uuy.5....KgY....p. .5..?...s.[6"..I........C~.<....:..s.e:...#.c.%.
W..c.#.).P.|Rs.%=....M..'B.y....fz.eZm....S..r.J...~....O.l.~..S..
<<< skipped >>>

GET /miniindex/images/aaa10.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:56 GMT

Content-Type: image/jpeg

Content-Length: 23965

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 09:29:12 GMT

ETag: "0a4acfec357cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:56 GMT

Accept-Ranges: bytes
......JFIF.....`.`......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................`.......`
....Adobe Photoshop CS Windows.2014:04:14 17:28:23....................
.........}...........~...........................................&.(..
...............................Z.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................~.}.."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..Y. Cn..gE.Y.K.\i..6.[[..........4
.E/?.x.-|[email protected]..(...{....;}....}N.9....`. R5...-...eD{~%Qn#...zGU.&g
t;...l..5h.p...8.".. F......j.>...]`..vCvC..H........T.:1S3xp......
88...(...]..E).a .9B.......%:r.f.............;][email protected]
he..;g.T=J6.=_.z...`.=..N.,l..R.S..L.<O.n...../...p.F..QH.  r.1..]W
[email protected]>......
Vw....{.....9...;ts7.Ut....O.`S.qD~ .8I.Z.D.......?*.~.tS.]v63........
gf...ee.:..&7Y.W._.[]l...!.p..X.W..r#....W...f.... .....z^e..me...H...
b...,.7p.4.)..q..!.q%.9WEpF..c...M{m..........{.[p.5!.. [email protected]
..>....B7...P....1....q...<d.....|..i........89.....U..5ul.7
<<< skipped >>>

GET /jsn/hotdata.js?V=1401434667411 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1401434667239_7225_00001; CKOR=8577_00001_00000; CKOD=3805_00000_00000; GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 May 2014 12:17:30 GMT

Content-Type: application/x-javascript; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Fri, 30 May 2014 10:57:43 GMT

Set-Cookie: IPLOC=CA; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Expires: Mon, 02 Jun 2014 12:17:30 GMT

Cache-Control: max-age=259200

Content-Encoding: gzip
c3d.............YkO.K../D.v...kz./."? ...ro.$...............T..=C..~.(
.=...:Uu...t.H'........3.....o;..l.[.2.k.....Y3..L.Z..2;...#.P..S.....
./......y.|.8.......E.k..]............O?.....:N..../?.....kD.X.V......
_.p....._.N......tq..o.J.?...i........SQk}.......*>i.....8..a.....?
.T.zSk\.....Mr...zZm.F....Y.r.........?.....;...r...}.....ZZ..w.|.De6o
...i7.3"?.......c..V..'..6...*.xO..Bj..8.~_y.q.i....y...N{...........E
.. ./.}..i......b...6G.~s..g...&...02..j....k..B...h;....~.....p..:!.]
...?_.L;..#EW(...q.}P=O._w..;.....D.j.Ut."'#o..$.5"/..8..QM.'...dw|...
.V..#...96U..XA3....6.b.]%..F..H..q....j..#m..c.LT.......?.....*(i....
.._.....'..r.`.....M.*..5.....*....k.. .1.V..........g....$1.t.m)....C
gRy.U.......z.. ..V..H.......J).P...X..?.O......I5.,.7.%.|.8..Y.!.\...
w...rl.=P...WY..5.z.,..[....`h...mO.4h...Hsk.#...a.XWB.v...5.x.t..:...
QTmD.......1....p).....0..W$...'(.C...3....t..Q{e....(...Z..o.g....E#.
.r.?.].9..G..$H{"b.}e......R.Y..u9...w.v'-F..!'.H......$......I...&...
..J$.ZkN-....@f!l|9...jM.dvj,...4¹.......B....V.J..G..E,.*..r.Q^D...
P......SiWT.W.Z.5jQ.F..0m.....d......&......K.o.bIB.4......b.O.V..mBb.
....._..n.F5B.R....[....E..g.P.q...2.........j ].]..n...".Q...j...{"..
.M.p..E5...`.=.8.../I..i.1...,...3.".wZ..z...=....G..._..T.P..\.Q..W..
.7..X.#PC.....k4Z..B..*6....JHA..7....QU0...C..mB.....(g$7|Np;..u.j(/.
aiL......9........|.&.*<....u......Zbm...WIDW..../....e..>.G..@.
[email protected]{.>.Wh.Y......>....h.)...}..e.A...z.v......U.,:.
.(.U.X..0l......e...;~.1....c2.(V...u,.<.Ds..:f..Z.... .k......
<<< skipped >>>

GET /images/weather/fine_cloudy.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1401434667239_7225_00001; CKOR=8577_00001_00000; CKOD=3805_00000_00000; IPLOC=CA; GOTO=Af22014; SUV=00591E10B86B2626538876DABB432297

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 May 2014 12:17:33 GMT

Content-Type: image/gif

Content-Length: 1751

Connection: keep-alive

Last-Modified: Sun, 09 Oct 2011 10:21:07 GMT

ETag: "4e917593-6d7"

Expires: Tue, 17 Jun 2014 09:22:35 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a(.(.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.....................................................0..[..m..........
....D....................$.............................'..=..O..]..k..
6..M..w..............C..Y....................h.................Q..u...
...........J..Y..q.............................q......................
...........!.......,....(.(........H......*\....D..E..(."......I.%..6}
..(.F..6e.$J..h.......&M&O....S.w....6...w.@......J..Q..J.UU.X.R....M.
.&.I...U.b.Z....U..........>."g.T,T.f..% .-_.\.".-.... A.....Y.R.*F
l..f...j....P.0>.T...X.s......e...;......0v.....Z.HE.....|........v
.H6L...8S.........}<..)....i..i.%..#H....E.X1k...N.PxQB._.@.>. c
.(.4......K,.0..3.....J....B(.....S.6...."p...,.(.M7..s..T, ..R|@B.4..
b-.@..#.............C..H.........T..#.(..'..3. ..#..$....At.E.(.`..9..
.<[email protected]....(HQ...p....8.."..../[email protected]@.K....
.6...;....$....:..0A..D`..R. ..)l..." a..5...?.(.J4..!..2\..... ...x..
..L...Y......y."...O.0(@..C.!E..t....4Q....pB.-.....`.-B...C...Q..]...
.S,...K....?....,...8...B.W(`..$..F.%|0..JLpB.A....O..2.....=5..@.
<<< skipped >>>

GET /v53/get_tj.php?hz=4671448&ids=qiche HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://123.sogou.com/?22014

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1401434667239_7225_00001; CKOR=8577_00001_00000; CKOD=3805_00000_00000; IPLOC=CA; _seCityCode2=CN110100; tjv2_cont=00_01_08_09; GOTO=Af22014; SUV=00591E10B86B2626538876DABB432297

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 May 2014 12:17:34 GMT

Content-Type: text/javascript; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.1.6
10cb..{"qiche":[{"tab":"\u6c7d\u8f66","taburl":"http:\/\/123.sogou.com
\/shwz\/qiche.html","list":[{"picurl":"http:\/\/pic2.xcarimg.com\/img\
/news_photo\/2014\/05\/28\/i8g7XZO1lz1162.jpg","url":"http:\/\/topic.x
car.com.cn\/201404\/ford562\/?zoneclick=101487","title":"\u798f\u7279\
u7ffc\u864e","price":""},{"picurl":"http:\/\/pic4.xcarimg.com\/img\/ne
ws_photo\/2014\/05\/29\/mE8bXnNioe2802.jpg","url":"http:\/\/price.xcar
.com.cn\/serise1168\/city9999-1-1.htm?zoneclick=100517","title":"\u54c
8\u5f17H6\u21938\u5343","price":""},{"url":"http:\/\/price.xcar.com.cn
\/serise630\/city9999-1-1.htm?zoneclick=100517","title":"\u79d1\u9c81\
u5179\u4e09\u53a2 \u73b0\u91d1\u4f18\u60e03\u4e07\u5143","color":false
},{"url":"http:\/\/price.xcar.com.cn\/serise1933\/city9999-1-1.htm?zon
eclick=100517","title":"\u79d1\u9c81\u5179\u6380\u80cc \u73b0\u4f18\u6
0e01.3\u4e07\u5143","color":false},{"url":"http:\/\/price.xcar.com.cn\
/serise109\/city9999-1-1.htm?zoneclick=100517","title":"\u5609\u5e74\u
534e\u4e24\u53a2 \u73b0\u91d1\u4f18\u60e02\u4e07\u5143","color":false}
,{"url":"http:\/\/price.xcar.com.cn\/serise937\/city9999-1-1.htm?zonec
lick=100517","title":"\u96ea\u94c1\u9f99C5 \u73b0\u91d1\u4f18\u60e04.5
\u4e07\u5143","color":false}]},{"tab":"\u65b0\u8f66","taburl":"http:\/
\/123.sogou.com\/shwz\/qiche.html","list":[{"picurl":"http:\/\/pic1.xc
arimg.com\/img\/news_photo\/2014\/05\/29\/KCHDs5Hhfp1883.jpg","url":"h
ttp:\/\/price.xcar.com.cn\/serise561\/city9999-1-1.htm?zoneclick=10051
8","title":"\u950b\u8303","price":"\u964d2.6\u4e07"},{"picurl":"ht
<<< skipped >>>

GET /jsn/citydata.js HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1401434667239_7225_00001; CKOR=8577_00001_00000; CKOD=3805_00000_00000; GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:30 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 19 Sep 2012 10:54:17 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
5c2b............m.Yo[I...W.t..o{......'7............-.[.Z6EJ.G..(R.G..
..gK...(w..~-.g..._:....U.j..U.V.........._....o....?.........?.s.....
......s.......wZ......4Y^..K....>..e.n.nv.[@..v..<.o.].S....>
.....]d...4..LU]...7S..9...d.z.2........*..U..T..x~.y.&.!.3...x......y
....y....%.Y.W........S.s.yv. ,.2.,.M..7..k9=..|....WT..........>g.
......7..M>'..F..~_......~_...Q.>.3.Lssk.....M.....b......q5....
..Bx.6.c0......{........z...T./...-...........2.,<..(..pExy>..U.
...x..)..In..0.Q8;.P...*.........q.Y.........X..=...Y_9..bl.w?m.16....
....~....xw.l\....~..L7.{...l.6C..v.`M....n..%..F......O.~......Y....f
l...R....O....f..P.........'........ly%...\.L...9..\..a..=.V.....u3...
........W.......f.Fm..B:....?.?T..q........m.].LFj....~..Lwq..C......M
.Y..6.K......T.....FT..l..P....m....n...}..fl.r.b....5...XQtGT..).h.bG
..\[email protected].#..xffA]...v......I)/\...v'....:..........
q....Z..)...Z.rK..8.zV.F.....n.....r&;..n.q.......6...H..i=.-.&.5.Msu.
.,.........b...r..KY9.......J...Q.8.....bl..P...s.<.|...n......5..G
.j.....9.k,..R.e.%k...0..L.%....5.E...g.].1.y..G........H........a/..-
U.,6k.< .b......U.#.k.....#...<...........z.*.w.........-.z.V...
..........v.m....%z...m..,......h..6..7...../.h..6....k..:JV.z.R.....0
[email protected]....#=hH6p..,..........CLo~r.Fl~F_..TT.....P...G..&.~...i
.z......M:a....;..r..~3b..... .......}.g.\c...AL..L.l..w..]...9...].=j
=........X.2|alV....W........[b..zyc.Z... .......K2...\..X-..........0
.D0~50^..*]........l..Y...f{..<$`K8.8Q..........l.....[.(O.}5..
<<< skipped >>>

GET /stat.htm?id=5645354&r=http://VVV.mdtxw.org/miniindex/&lg=en-us&ntime=1401452266&repeatip=1&rtime=0&cnzz_eid=915151347-1401452266-&showp=1024x768&st=-17581&sin=none&t=undefinedundefinedundefined&rnd=1200138110 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hzs10.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.1

Date: Fri, 30 May 2014 12:17:47 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Tue, 28 May 2013 02:57:17 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /dh/dhrc/rec.do?block=gamev2&jsonp=__yx2q&t=1&_stamp=1401434665786 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: wan.sogou.com

Connection: Keep-Alive

GET /dh/dhrc/rec.do?block=gamev2&jsonp=__yx2q&t=1&_stamp=1401434665786 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: wan.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 May 2014 12:17:32 GMT

Content-Type: text/plain; charset=utf-8

Content-Length: 374

Connection: keep-alive

Set-Cookie: SSUID=26266BB816EE9BA4B835381DDCE99374; expires=Thu, 25-May-34 12:17:32 GMT; path=/

Set-Cookie: IPLOC=CA; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
__yx2q([{"gid":"123","title":"............","source":"0011000100006"},
{"gid":"212","title":"............","source":"0011000100007"},{"gid":"
181","title":".........","source":"0011000100008"},{"gid":"86","title"
:"............OL","source":"0011000100009"},{"gid":"178","title":"....
..","source":"0011000100010"},{"gid":"215","title":"Sogou......2","sou
rce":"0011000100011"}])...

GET /miniindex/ HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:38 GMT

Content-Type: text/html

Content-Length: 10093

Connection: keep-alive

Content-Location: hXXp://VVV.mdtxw.org/miniindex/index.html

Last-Modified: Thu, 22 May 2014 11:22:12 GMT

Accept-Ranges: bytes

ETag: "684ac813b075cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: MISS from chn-xa-th-sb1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml">...<head>....<meta http
-equiv="Content-Type" content="text/html; charset=gb2312">....<m
eta http-equiv="Cache-Control" content="no-cache">....<meta name
="robots" content="noindex, nofollow,nosnippet,noarchive,noodp">...
.<title>..........</title>....<link href="inc/stylemini
.css" rel="stylesheet" type="text/css">....<script src="inc/jque
ry-1.7.2.min.js" type="text/javascript"></script>....<base
 target="_blank">..<script type="text/javascript"> ..<!-- 
..//..........//document.oncontextmenu=function(e){return false;}..//.
...........var cusi=0;..var tiaozuan=1;..var timer;..//..............v
ar bq_array = new Array();..//........,....id,........url,............
(1....,..............class) ......url ......bq_array.push(["....","0",
"","0","","0"]);..bq_array.push(["....","105","hXXp://VVV.jgtj.com.cn/
ll","0","xinwen.htm","0"]);..bq_array.push(["....","101","hXXp://VVV.j
gtj.com.cn/ll","0","nvxing_509_366.htm","0"]);..bq_array.push(["....",
"102","hXXp://VVV.jgtj.com.cn/ll","0","lieqi_509_366.htm","0"]);..bq_a
rray.push(["....","100","hXXp://VVV.jgtj.com.cn/ll","0","shehui_509_36
6.htm","0"]);..bq_array.push(["....","120","hXXp://VVV.jgtj.com.cn/ll"
,"0","jiankang_509_366.htm","0"]);..bq_array.push(["....","130","http:
//VVV.jgtj.com.cn/ll","0","meinv.htm","0"]);..bq_array.push(["....
<<< skipped >>>

GET /miniindex/inc/jquery-1.7.2.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:39 GMT

Content-Type: application/x-javascript

Content-Length: 91342

Connection: keep-alive

Last-Modified: Thu, 10 Apr 2014 16:44:10 GMT

ETag: "069a418dc54cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:39 GMT

Accept-Ranges: bytes
/*!. * jQuery JavaScript Library v1.6.1. * hXXp://jquery.com/. *. * Co
pyright 2011, John Resig. * Dual licensed under the MIT or GPL Version
 2 licenses.. * hXXp://jquery.org/license. *. * Includes Sizzle.js. * 
hXXp://sizzlejs.com/. * Copyright 2011, The Dojo Foundation. * Release
d under the MIT, BSD, and GPL Licenses.. *. * Date: Thu May 12 15:04:3
6 2011 -0400. */.(function(a,b){function cy(a){return f.isWindow(a)?a:
a.nodeType===9?a.defaultView||a.parentWindow:!1}function cv(a){if(!cj[
a]){var b=f("<" a ">").appendTo("body"),d=b.css("display");b.rem
ove();if(d==="none"||d===""){ck||(ck=c.createElement("iframe"),ck.fram
eBorder=ck.width=ck.height=0),c.body.appendChild(ck);if(!cl||!ck.creat
eElement)cl=(ck.contentWindow||ck.contentDocument).document,cl.write("
<!doctype><html><body></body></html>");b
=cl.createElement(a),cl.body.appendChild(b),d=f.css(b,"display"),c.bod
y.removeChild(ck)}cj[a]=d}return cj[a]}function cu(a,b){var c={};f.eac
h(cp.concat.apply([],cp.slice(0,b)),function(){c[this]=a});return c}fu
nction ct(){cq=b}function cs(){setTimeout(ct,0);return cq=f.now()}func
tion ci(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b)
{}}function ch(){try{return new a.XMLHttpRequest}catch(b){}}function c
b(a,c){a.dataFilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTypes,
e={},g,h,i=d.length,j,k=d[0],l,m,n,o,p;for(g=1;g<i;g  ){if(g===1)fo
r(h in a.converters)typeof h=="string"&&(e[h.toLowerCase()]=a.converte
rs[h]);l=k,k=d[g];if(k==="*")k=l;else if(l!=="*"&&l!==k){m=l " " k
<<< skipped >>>

GET /miniindex/nvxing_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:41 GMT

Content-Type: text/html

Content-Length: 12745

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 11:01:01 GMT

Accept-Ranges: bytes

ETag: "80544bd2d057cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: MISS from chn-xa-th-sb1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/lieqi_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:41 GMT

Content-Type: text/html

Content-Length: 13149

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 11:01:34 GMT

Accept-Ranges: bytes

ETag: "0bbf6e5d057cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: MISS from chn-xa-th-sb1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/jiankang_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:41 GMT

Content-Type: text/html

Content-Length: 13037

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 11:01:30 GMT

Accept-Ranges: bytes

ETag: "06194e3d057cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: MISS from chn-xa-th-sb1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/meinv.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:42 GMT

Content-Type: text/html

Content-Length: 6471

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 11:01:42 GMT

Accept-Ranges: bytes

ETag: "06fbbead057cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: MISS from chn-xa-th-sb1
<!DOCTYPE html PUBliC "-//W3C//DTD Xhtml 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta content
="IE=10.000" http-equiv="X-Ua-Compatible"> ..<meta http-equiv="C
ontent-Type" content="text/html; charset=gb2312">.. ..<meta name
="robots" content="noindex, nofollow,nosnippet,noarchive,noodp">..&
lt;title>......</title>..<base target=_blank>..<link
 href="inc/style.css" rel="stylesheet" type="text/css">..<style 
type="text/css">...bj {background-color: #FFFFFF;float: left;height
: 336px;width: 509px;}...bj .top {float: left;height: 207px;margin-bot
tom: 3px;width: 509px;}...bj .top .top_left {float: left;height: 206px
;margin-right: 4px;width: 274px;}...txt1{ background: #000;line-height
: 30px;height: 30px;overflow: hidden;text-align: center;display: block
;color: #fff;margin: -29px 0 0 0;width: 231px;position: relative;opaci
ty: 0.7;filter: alpha(opacity=60);cursor: pointer;float: left;font-siz
e: 14px;}...bj .top .top_right {float: right;height: 207px;width: 231p
x;}...bj .top .top_right .right_01 {height: 95px;margin-bottom: 4px;}.
..txt2{ background: #000;line-height: 22px;height: 22px;overflow: hidd
en;text-align: center;display: block;color: #fff;margin: -21px 0 0 0;w
idth: 231px;position: relative;opacity: 0.7;filter: alpha(opacity=60);
cursor: pointer;float: left;font-size: 12px;}...bj .up {float: left;he
ight: 126px;width: 509px;}..ul {margin: 0;padding: 0;}...bj .up li
<<< skipped >>>

GET /miniindex/nvxing_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:43 GMT

Content-Type: text/html

Content-Length: 12745

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 11:01:01 GMT

Accept-Ranges: bytes

ETag: "80544bd2d057cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: MISS from chn-xa-th-sb1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/shehui_509_366.htm?time=undefined HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:44 GMT

Content-Type: text/html

Content-Length: 12927

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 11:01:16 GMT

Accept-Ranges: bytes

ETag: "0263cdbd057cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: MISS from chn-xa-th-sb1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv=
"Content-Type" content="text/html; charset=GBK">..<title>mini
_509_366</title>..<base href="." target="_blank" />..    .
.<style type="text/css">../*....*/..html,..body{ overflow:hidden
; }..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,form,input,textarea,
p,th,td,button { padding:0; margin:0;}..input,label,select,option,text
area,button { font:12px/18px Simsun, Helvetica, Arial, sans-serif; }..
table { border-collapse:collapse; border-spacing:0; }..ul { list-style
:none; }..img { border:none; }..button { cursor:pointer; }..input,text
area { font-size:12px; }..body { font:12px/18px Simsun, Helvetica, Ari
al, sans-serif; text-align:center;}..a { text-decoration:none; color:#
333333; }..a:hover { text-decoration:underline; color:#BD0A01; }..::se
lection {background-color:#669800;color:#FFFFFF;}..::-moz-selection {b
ackground-color:#669800;color:#FFFFFF;}...list_pic li.noMargin{margin:
0}../*global*/...more,...home,...at_me { display:inline-block; }...wb_
ico { background-position:right 3px; padding-right:10px; }...more_box{
 margin-left:4px; position:relative;}...more { width:6px; height:5px; 
position:absolute; left:0;_left:4px; top:3px; background-position:-14p
x -40px; }...vico { background-position:0 -114px; padding-left:23px; }
...vico_right{ padding-right:20px; background-position:right -496p
<<< skipped >>>

GET /miniindex/images/Untitled-1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:45 GMT

Content-Type: image/gif

Content-Length: 19666

Connection: keep-alive

Last-Modified: Sun, 13 Apr 2014 01:54:58 GMT

ETag: "0859c5fbb56cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:45 GMT

Accept-Ranges: bytes
GIF89a..s...........gE..u......e:".........vvwY7$............fefsF)...
....=Fc4.iB).\F.SP.eTyR7..x.cHWVW...GEEtK1...Z1.V ....saW.uS.uVxWD....
...........J&....E..7......wc'#$......jG2..........ru...755.......b?..
.......7!..jS.......S3...F .U@9.....................".........Z:.\<
....{z......y{..th......hio......d[U...TGC..........nK.........l.....Z
[`...............,..V$....rkf..........)).{r.......Z;#......j].R......
.nrv.........lRH.T;.T3VQO.....hbI@d_`......|^O........._ah......5'$...
6......I(.........I:9...q> OSW........................uqp.tZ...1...
.....nmq...zO-..].[3.L2.Y1KJL...SLP.U9..........T[40/.......oa...oO8uP
@......BAA<:>...#.........13......0-0N.....knj.cd..z.qr....67>
;>9!  .08PPJ..!.DF...*) .........--(_`^$...........................
........._A..........64......!..NETSCAPE2.0.....!.......,......s......
......z... (o..y...34o.=...a../.<z..y.I2...X..3......?...ea......7.
.&{.j..G...w.FY|Y0%..J.EM...</.4...5.!,.^...........Dp../..\......f
.. `...3fV.q..O`[email protected]... &i.\c.... ...i....sE.4..k..X..#!T.
Z..%..J..>3..GF|..../ .P.C.|.P.P.l..H..c_.=R...Q4..P.<...PD.0...
wIl.V.....6..h.c...O<.. {....w  [email protected](..&...d.......bJ.HXA
...4...,..H#...#(4............J0G`.E7.d.....P..I.`..0..C.S....1.2..\v.
e._....Z.........1L..<[email protected]..`.a..j....b...`[email protected]...
..vZ.E....H."@........Qj......V......... ..0.....L....M.}...27.... X`.
..4;..#8....*.e.u`.m..r;..1L.....#.........s..Zh...P$.........4..%.Xb.
1.4....E....UH....`....0C..h.. .q0j.................d....PrD.GPr..
<<< skipped >>>

GET /miniindex/images/Untitled-2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:45 GMT

Content-Type: image/gif

Content-Length: 18896

Connection: keep-alive

Last-Modified: Sun, 13 Apr 2014 02:21:34 GMT

ETag: "0cbe616bf56cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:45 GMT

Accept-Ranges: bytes
GIF89a..s....SE3...mWG....vU.eF........ivcO....tGW6$TOH..V.ZD.f8.W8.ye
I ...\H3$....gE.......fD..Y..j.fH)...T9.......Z8.....z........de;)..f.
..dG6..swI5.tK....zS.....a....qF%"..wV.{fxT;5%...v..m....vI.......L4..
.fddfB).iV.hS&&!82%......wC .b>........d. ............r..Y4* ......
..i....pY.....j..c....(!wvu.|[..b.H ..t..u...E) .kR.kG.]@eR;..r.......
.o.......|O......H:0...U;..zR........d.....l..k..b..q%4#643.....j.|\..
..L1;A/.V-..{.....c.....z.....J.....|..l....rP...zsd.....O..p.......lM
..a....~S.oL{_;g4.sj`.R0.s[@...pPzT-S.!..~.L,..}........k;....[s>..
.>....._.....}.....i..]fO-.........b\]..n..X.t\........."......{aH@
@.._BDA...4..&7-4-,`gb.........qprllm.................................
.............J .oN...w{|........._^Z..p........{......... ,(..........
..34>..pmui.........!..NETSCAPE2.0.....!.......,......s......L.!...
...........Y...C......B..A..\N.$.J.IQkD.H....(... .'[email protected]
f.v..]......N....-[....d.&. ..`....5...^......B1X..u.%"..g,.......]N.(
D.....R.L..e..3...e.....2k......<A.,..A.k*....-.<...m.F..9......
.......:q.KC.rO........Xt...:.7....S.d.Q..4...SO.<2w.z........Y....
.b.qm-..1.^.........e.4.$b0B.q!a!!.]p!.sk...Fl`........4t`b..]BJ...a.y
........^..4..'.hs.X....<.pe................\.qa%HXp.\.ehqJ.....u.i
Y..4..&.D$pI...H.f4.I#[email protected]&..Y.t.d.'0(...I.!..u...;H
G]ue.F.w$iq...4PC...........hv..YQQ..S;#..[.W)@...*..5L.....H(Fq.b...W
2W.....iF.p.*G..!.,Z.*@.Q.G.O..%..s...h...E$.. ....q....k,X.....'H...r
Q...qU.......F.^...rQ..,.hq.1..d'f2v&T....2Q=E.....ZC=........U..`
<<< skipped >>>

GET /miniindex/images/Untitled-3.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:46 GMT

Content-Type: image/jpeg

Content-Length: 31591

Connection: keep-alive

Last-Modified: Sun, 13 Apr 2014 02:27:26 GMT

ETag: "0bbb5e8bf56cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:46 GMT

Accept-Ranges: bytes
......JFIF.....H.H.....ZExif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:13 10:27:24....................
.....................s...........................................&.(..
...............................$.......H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................p...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'[email protected]@..... [b..*.X$d.9......U.f.
@.o...%.*e9.QX.U.....K.....B>..-... .|T....|.b.h.........Bh.#.....-
..rp.RZ..eZ..i..5>.....M...5Y.O#..h.b.............R...).G-.W.P6.Ic^
..cG%.....*..g..v3X.ki9...].....H.a=......Os.l3'e.i.m...........(.....
}.;?...O........]^.......`q5.l.5m6..w.?5v~..[.........{...>........
....X....Sus.`..o..E.....El.F......#>...4..t .....:@..._^[email protected].
v....B...)..,.5a%n.s.......B.....:.{.........[...O>yR.....p.J..f...
....?h...uF..../...j....W:?jPO..'.eG.x..{.N.....].h.....U....gw...*...
.C.B...)....z.......`.l..t....C..fu..0.OM..X.... g.K...R.;>.....U&.
;]c.....,.s......qjy........O.....P3.....i..u.....{...............
<<< skipped >>>

GET /miniindex/inc/min.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:46 GMT

Content-Type: image/png

Content-Length: 1080

Connection: keep-alive

Last-Modified: Thu, 10 Apr 2014 17:05:46 GMT

ETag: "0511e1ddf54cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:46 GMT

Accept-Ranges: bytes
.PNG........IHDR...l.........u.......tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx....k.Q...kfwf...F.B........ ..6.Z(.[..../..F.,l,E.". "./P
.....M.....}x...........i...9.|.~w.../..C.>FBIdq.....O?L.;...P.*..p
...WS.6._..^d..}.._..............D.. .*H.>.r)V.*k...k.kc.S........_
D.-..BJ.$...G...Y.\......lX.1D.......Z0H.\..*L..59B...... ...:CV0$a>
;...e....V3Q.g.`].$5.P........(.`....I...JlX:..7.U.#.X.....>K'..!..
Rj.!.&.k. ../#p.VY....-.tHLT..3#Q..D.GD...IL2;.q%-W$uK...D.> ....G.
...q....nY..QNK^j...Y.......b.f..0*.|.n.<.t|zP.c.g.0.K.. .R........
.=>... .../....8.t...H.).4.I. L.$.90s.3....S_:... ..<Hak5$yqz0.5
K.M....q4.g..........).d7..w......q.. h.M...*N...f...b..Gn=..<.}...
..&..~...B..~...y.D8.U2]/8.`%.E.F..l....~. .G..(l...L.JU.5.,=N.%..".2.
<[email protected].....=....C.h..~.z..qfU..*....#......o..8..a..<.....
*.b.0'Ga.........G..].jB.3}p1_i...6..J..)a......9Zf.k.b.|..6.J...a....
..^.G......j.u>........Q.5.u.....6....0%....Y..V..Q..K.RGj....a..&g
t;.../.....m.<..E..b.....d.{...s.L. -...$..6`?......<.[pKN.Rj..X
X4.... ;.N.'7..a.$6X3{..(.`z............[.?g.ab..z..U.....'d...B.;....
IEND.B`.....


GET /miniindex/inc/close.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:46 GMT

Content-Type: image/png

Content-Length: 2526

Connection: keep-alive

Last-Modified: Thu, 10 Apr 2014 17:05:46 GMT

ETag: "0511e1ddf54cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:46 GMT

Accept-Ranges: bytes
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..Z{..U......dw.v....H*...H.....L..i.."j...5.bL..b..Y.5.(.
.FC.DH..X(...#.XK....[[email protected]..}.<....f.....|...3....|.........
[email protected]._'.K?...(..J.3.6..Mw.......S.i.EC!|.q..Q,.N.....U.(....
.....a.w......o^2..w..t]....d......t....(.m.F...fwN.W.........N..#.a..
.|.i 5..4..H.'.C..BJ.......)(.8.......,RJ....T.].X.......V,GRz........
.0D./..).....e.P,.._A.'][email protected]......$.W.b.1M....g.....
t....T.*.#.'%Y?....P.b..y..,..z..4...r..-}..%D..M.h../Z..S.......5\.,.
wq..3.....U....D.2..-....' .e[mm..,U.(.2.8..r., .P.).......C@ ..qBtob=
..|oU......5._..6.J&.hD..R........_.6...-.Z..$....s..)..v..Yh.........
....p..[..c.>...Tp.w.9...?p...}.......}..`..!..=.b...m...3$.}......
.`M....I(e......,[email protected]\........-_.~$Z..?....~8Q6..MW.....f*.0D
@ ......p.U..Zh..Dd{e..a(...._...j?....D&.....I-:.M.k......r%.....D..m
..7Os.........H........*.AH....1.k..8n..m.....I.........wg......S.Jk.r
.........Z...A.m......q...F...wq.H..u......}.}4.F..#.P.e..@..!....h.Q.
.}r.&V].}h.r8.....~...G$ b..P......z{..'.......{..Z. 62.W.6.w...r-...,
.t.j3..#`....X.'..L.....33..`...q..p....\K>....1..,*......!|.7.Q-`.
T.........|..#..U.p.>.D.C..ZFmQ...\.fTJ.N....q.../.AS.......}..y.R.
.......y...`c..#....Y.$...A....y..L....].x.;..X4.x$I.IX..._...q.w..0O.
.N...MB.y/.!Z.,......U._...e.........TO..._.w{../...= Q%......v.._....
TO...W..S.O.Hv..G..Z..x.~t...Be.....K....'.........N.......l..;.T..O..
.....w.n...a....j>....%......u..L.......M...}.#..._.G....b8....
<<< skipped >>>

GET /miniindex/inc/style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:47 GMT

Content-Type: text/css

Content-Length: 2899

Connection: keep-alive

Last-Modified: Thu, 10 Apr 2014 16:40:38 GMT

ETag: "0c7479adb54cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:47 GMT

Accept-Ranges: bytes
*{margin:0;padding:0}html,body{overflow:hidden}body{font:12px/18px Sim
sun,Helvetica,Arial,sans-serif;text-align:center;font-size-adjust:none
;font-stretch:normal}ul,li{list-style:none}a{color:#333;text-decoratio
n:none}a:hover{color:#bd0a01;text-decoration:underline}a,img{border:0}
.focus_filter{left:0;width:100%;text-align:center;bottom:0;display:blo
ck;position:absolute;z-index:3;cursor:pointer}.focus_filter{background
:#000;height:21px;z-index:1;opacity:.6;-moz-opacity:.6}.main{backgroun
d:#fff;padding:14px 0 0 14px;width:509px;height:352px;text-align:left;
float:left;position:relative;-ms-zoom:1}.main_left{background:#fff;wid
th:222px;overflow:hidden;padding-right:20px;float:left}.product_yl .li
st_news_yl1{padding:4px 0;margin-bottom:3px;border-bottom-color:#8b8c8
c;border-bottom-width:1px;border-bottom-style:dotted}.mod_left{margin-
top:10px}.list_pic{width:222px;overflow:hidden;-ms-zoom:1}.list_pic ul
{width:232px}.list_pic li{margin-right:10px;float:left}.list_pic li a{
padding:2px;border:1px solid #dddfde;width:100px;float:left}.list_pic 
li a img{width:100px;height:65px}.list_pic li a span{height:19px;text-
align:center;padding-top:6px;display:block;cursor:pointer}.list_pic li
 a:hover{text-decoration:none}.list_pic li a:hover img{text-decoration
:none}.list_pic li a:hover span{text-decoration:none}.list_news::after
{clear:both;display:block;content:""}.list_news li{font-family:simsun}
.list_news li a{height:22px;line-height:22px;display:inline-block}.pro
duct_yl .list_news_yl1{padding:4px 0;margin-bottom:3px;border-bott
<<< skipped >>>

GET /miniindex/images/b14.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:47 GMT

Content-Type: image/jpeg

Content-Length: 40898

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 07:49:40 GMT

ETag: "0c21517b657cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:47 GMT

Accept-Ranges: bytes
......JFIF.....H.H..... Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 15:49:39....................
.................................................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................f...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?.....N%.....Dj...V}../t.}..../...*.
KH.\7W.7t..9..>...............u............v..e. 8.......u~.....?..
... .Y[...m5...5..^.c..7{.......q>...[...'.....7.Y.....L.........L.
..K..8...).K.....:.........&..'....\.j.E.....G.-g2.t-...h....SE8....g.
.N.0..t...tQe.)....tm...k. .......ur>.....Lhm..[.#MWB.2K W>>.
?r.......v.=..D...`....S...}^..V..b.u.c.V..2.j&......=..\}.....Vh..G.k
mc...H./N..T.....m~...l;..i..r,kE..\.......3].....?..?1.c.8......e....
.j.DJ.....=......B.....z.G...62.X...4.......*wu....mk...~j..'.. .q.w.&
gt;. .4..9.>....W.F.o..'.i.y&.../c.P.K..gN..~T..2...D.LsOhU.gtB....
@.x.UNY*&.P..US...pn..W4...u[...b.<[email protected]
<<< skipped >>>

GET /miniindex/images/b16.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:47 GMT

Content-Type: image/jpeg

Content-Length: 43598

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 08:01:35 GMT

ETag: "801942c1b757cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:47 GMT

Accept-Ranges: bytes
......JFIF.....H.H......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 16:01:34....................
.................................................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................f...."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..{..h....iku..C.v..8D.. 1...5'r.5.
.}....)T.....sv...'E'....'D.T....?w..j.....8l....]...c...G........C.Ce
.DhH.0....L.N.......;..H........F..s..v...A...._...ICu.v.vC.F0>.;..
.......;.c6.....t~.^NCr^.|:X.k.....&.R..k=/O....'. .~...|..l..9..-.#A.
.O...5ut............c.` ...c.^..&(e=H.."46G...]g.=.8Y./...V..z.6~.. ..
1.G._N.z....U..U.`...O.f.o{e..[K..............]n}..u..^..m..-l.5..t?..
.k.. w....."..-.....:.....^........t...........Sv......5._c.!.....s. .
Kk.m..kO..v.{N.b...}......A.......I..1.h..!...&O.W..._........C..T....
.....gJ..X.."!:........{........?.]..;.V.'B..T9.X.{....".[..."..3}.]. 
Y.....g.*9..G<}....P.uE.7*.....q.....?h.......O'.[t<.....V..
<<< skipped >>>

GET /miniindex/images/b18.JPG HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:48 GMT

Content-Type: image/jpeg

Content-Length: 23977

Connection: keep-alive

Last-Modified: Mon, 14 Apr 2014 08:14:46 GMT

ETag: "01fbb98b957cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:48 GMT

Accept-Ranges: bytes
......JFIF.....H.H......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i.................H.......H
....Adobe Photoshop CS Windows.2014:04:14 16:14:46....................
.........l...........A...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
................................A.l.."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..w=.Ku vX...~U..p.iM.....ec...'r..
...g.:...N.e.].^...v=O?E.7}t..%..i.8.C...D.t.a...%...........?$.-.k...
.F...K{~sTs....4........].d/L3...N..R<...T.2F2......;..nt..Y..4....
W.....C|..;.}z......H.. o.a...K}.z.I........X...CuN..w}N..5..o..`...k.
......7...?GN....-.;[email protected].'.|.8...#,....8&v.a.Ay......
?=....W.W......KA.}.WG..W[.:.u.....^K....4h...........5..->.\d.....
.R..L..w.... G....q.....)......W.,..2..l........52..g}..L..?[..O..Sg.?
......}......G.X....C..f.N...b6}/..#..xA..`....u.>O...,..4...y..v5.
Y]...RK...t..R....].y..M...>.. .c?7.2...n{..Y.CI..O....f.g..l..."h.
.....5/[email protected]..^...u.;...1..........kk.[.j.......3
<<< skipped >>>

GET /miniindex/inc/style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ASERVER/1.2.9-3

Date: Fri, 30 May 2014 12:17:48 GMT

Content-Type: text/css

Content-Length: 2899

Connection: keep-alive

Last-Modified: Thu, 10 Apr 2014 16:40:38 GMT

ETag: "0c7479adb54cf1:416"

Who: ShanIE

X-Powered-By-Anquanbao: HIT from chn-xa-th-sb1

Cache-Control: public, max-age=86400

Expires: Sat, 31 May 2014 12:17:48 GMT

Accept-Ranges: bytes
*{margin:0;padding:0}html,body{overflow:hidden}body{font:12px/18px Sim
sun,Helvetica,Arial,sans-serif;text-align:center;font-size-adjust:none
;font-stretch:normal}ul,li{list-style:none}a{color:#333;text-decoratio
n:none}a:hover{color:#bd0a01;text-decoration:underline}a,img{border:0}
.focus_filter{left:0;width:100%;text-align:center;bottom:0;display:blo
ck;position:absolute;z-index:3;cursor:pointer}.focus_filter{background
:#000;height:21px;z-index:1;opacity:.6;-moz-opacity:.6}.main{backgroun
d:#fff;padding:14px 0 0 14px;width:509px;height:352px;text-align:left;
float:left;position:relative;-ms-zoom:1}.main_left{background:#fff;wid
th:222px;overflow:hidden;padding-right:20px;float:left}.product_yl .li
st_news_yl1{padding:4px 0;margin-bottom:3px;border-bottom-color:#8b8c8
c;border-bottom-width:1px;border-bottom-style:dotted}.mod_left{margin-
top:10px}.list_pic{width:222px;overflow:hidden;-ms-zoom:1}.list_pic ul
{width:232px}.list_pic li{margin-right:10px;float:left}.list_pic li a{
padding:2px;border:1px solid #dddfde;width:100px;float:left}.list_pic 
li a img{width:100px;height:65px}.list_pic li a span{height:19px;text-
align:center;padding-top:6px;display:block;cursor:pointer}.list_pic li
 a:hover{text-decoration:none}.list_pic li a:hover img{text-decoration
:none}.list_pic li a:hover span{text-decoration:none}.list_news::after
{clear:both;display:block;content:""}.list_news li{font-family:simsun}
.list_news li a{height:22px;line-height:22px;display:inline-block}.pro
duct_yl .list_news_yl1{padding:4px 0;margin-bottom:3px;border-bott
<<< skipped >>>

GET /v53/imgn/v53_arrow_h.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:29 GMT

Content-Type: image/gif

Content-Length: 1036

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
GIF89aQ.}..........1..b.......................C.....t.................
............G...........j........}..T.................................
.................................................................!....
.).,....Q.}........(....r.l:...0E.Z...v..z...xL.o...z}-..p.;N.W.......
&. .z.waZ........z|W.........#.v.W.X!...u.)..Z$.$.q....\...{.U....[...
j.....Z..........[....d...\....f...[. .i.).!X..e.....).......]Q0......
...%..@$"(.8....t.b..q#.......e...C..\..%..B..|.sK..NPz..E.......8s...
.T..R.q.SYO9:..u...U?^......k.j.J...Bb..%....H`...jv......i...Z...~.\O
.R..*x.B..R...(V..L..]4..<./.5."...q.d.....@ sT........k1..W.R[N...
ws....p9.../n....Y.3'C....b*D..8M.........w......PM...N..-.}......b.~.
...w.}..h....WE}...`...W`9`=.!.U1x.n....\.]h.TU.". ."2.Z..aXF.m<U.s
.)7..Z.H..Z...R..H..d...........6b]D...i....^U.x.`P.yW.m.uT..eya.t..#G
f...aj..Q......V..d.^....brE..|..e.y....".D.N>....C...N9E..M..1.I..
*....j...r.. ...E"[email protected].... -.l.....#........0..4.j
P.5.\.-...#N.....:..#)@<..k.=.......K.A.....V8..D..,....l... ...;font>....


GET /v53/jsn/main.js?V=107ff6db9da3d62875c7cafb326229a51 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:32 GMT

Content-Type: application/x-javascript

Last-Modified: Thu, 22 May 2014 03:42:23 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
5507..............{[.G...w.... Y-!q.....0...${..I^`xuiI.BR....:.......
H.;.......?......U.V.V}hN........:.?..Q..~..&.4.....v.a........A.-....
....d....=e..s?..........l.....Xzp..i.....Q...:............E|..^L.....
|.7'q8.Lz...!.L...o....a.._ ..2.e..,......$.|....>]...-/...s.$.4u.@
l....b.....}.\\..`..X.I.....p....:.qR...}....`..>...i.r..sT..|>.
..dX.....65......z7l...L&.O.....?... ......pr0,.K...z\./...~..,..s.&l.
..@....>L->8...^......v...W...J~D.s..,...n|6.._.8.b.9..G...dkN.B
.......n.........l.....l.|_.w.^.|.j...rv~^{C.W;.....5.r/..d..uv..'E...
.$l..h.[..A-..'...7.:.go.).. ..n..i}.../...X......T..U...........c....
E._.....;5` Py0]....vM.;gg....).|U......$.-y.I.f....(..=S..V..v.......
......}.....[.^9......6hb....vX..a...R..c.ze....&=..6g......7('.....dt
_......Q)... l.......Xz........86/.........s_&.C.v9\..:._.....w/.)_. .
^.x.n....K.i.....>........K....uK/.J.Y.......Y.CY.q0)..%?.4}3.a.P..
..qM..!dkui_...d ^"[.. ..[ie5.K<..*..wMCB..j..j.k..........4%B...U!
......n./.......?........>D..5.[.2... ....v.:...L...CG..0.......78.
..{.9..>.....oNz3ax...!3.x..e1....Yd)....J..... ..z...ej.]43l.....N
.F.#.-..L.O.._5I..a3L.....A..:......b.. .j=....6.....Z'.,....\.\D.....
ah%.w....8e.n.....qhh..x.....!4.....(.c......8<5..1..CH......qq.N..
......e...r~Y.,]V/./.u..Lr...LA.f.....!0.z..X..... ..fd....u&B>...!
.....g.8E\.Lx..Hs.....v%^...]......p..........<.s.V.....R...D.I....
.$..b..>........m^n(9.....K.....QjH..h.z..T...).6.....T..k8MH.q...5
2..>.........co}..x.o...<...'..t..L..r.a.&.. !.i..........4.
<<< skipped >>>

GET /v53/imgn/guide_tip.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:34 GMT

Content-Type: image/png

Content-Length: 10442

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
.PNG........IHDR.......J.......D.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Macintosh" xmpMM:InstanceID="xmp.iid:CEC0416D02FB11E388CB8B
2E3040A42A" xmpMM:DocumentID="xmp.did:CEC0416E02FB11E388CB8B2E3040A42A
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CEC0416B02FB11E3
88CB8B2E3040A42A" stRef:documentID="xmp.did:CEC0416C02FB11E388CB8B2E30
40A42A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>.Z....%<IDATx..].....&.(..."...ky.....
.f...7..........W@%.`..@A.*(...P..;K......E|..;g.....?[....>.<..
...........i......h-....@_~.. _&.2%...<..........k......w.d./.....U
 8..r./=|..9.{.P .IT.r.J.b].|...3|....../7....]1..=?..M]Y.f.....n...7l
.:w......Vk?.gkk 8.z..........ps...^p........P-....Z..._.6l.....KWWW.j
jj...........Q..P.~.|..Y..O......... .}...GI...3k..#......KS.....n..r.
rm..../.....'JUUU..aIT....V......4...]P.......M.....Y..xju6...2...|.o3
......?...>X\..V[[......}(//........o.CEM...f.N..Z.....O. ..7hU.qC=
p&/........@.|'gA.1.>.$....{@t..P...um..A..8..].v.;..D.b.]..ss.
<<< skipped >>>

GET /imgn/v32/selogo_111207.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p8.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:29 GMT

Content-Type: image/png

Content-Length: 12155

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Sun, 29 Jun 2014 12:17:29 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...a...?.....V.......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /imgn/tips/skin_tips_n1.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p8.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:31 GMT

Content-Type: image/gif

Content-Length: 1779

Last-Modified: Wed, 20 Jun 2012 04:23:22 GMT

Connection: keep-alive

Expires: Sun, 29 Jun 2014 12:17:31 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89af.!../......Z..R.....K...........P.....Y.....}..................
.......................^...........S...........l.....W..L........m....
.......f.........................................................!..XM
P DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &
lt;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060
 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="ht
tp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf
:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="h
ttp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.ad
obe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:018011740720681191
09DDF35EE18454" xmpMM:DocumentID="xmp.did:B01789E6890511E18530B51A3723
DDED" xmpMM:InstanceID="xmp.iid:B01789E5890511E18530B51A3723DDED" xmp:
CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom 
stRef:instanceID="xmp.iid:02801174072068119109DDF35EE18454" stRef:docu
mentID="xmp.did:01801174072068119109DDF35EE18454"/> </rdf:Descri
ption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
;.....................................................................
.............................................................~}|{zyxwv
utsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876
543210/.-, *)('&%$#"! .................................!...../.,....f.
!......pH,...$q.l:...4i.....vK<<...xL.1>..y.... ........k/2..
.(..........{.........B.$)..........{!......./....................
<<< skipped >>>

GET /core.php?web_id=5645354&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/xinwen.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Fri, 30 May 2014 12:17:47 GMT

Content-Type: application/javascript

Content-Length: 798

Connection: keep-alive

Last-Modified: Fri, 30 May 2014 12:17:47 GMT

Expires: Fri, 30 May 2014 12:32:47 GMT
!function(){var a,b,c,d=encodeURIComponent,e="5645354",f="",g="",h="on
line_v3.php",i="z12.cnzz.com",j="1",k="text",l="z",m="站长
统计",n=window["_CNZZDbridge_" e].bobject,o="https:"==docu
ment.location.protocol?"https:":"http:",p="0",q=o "//online.cnzz.com/o
nline/" h,r=[];r.push("id=" e),r.push("h=" i),r.push("on=" d(g)),r.pus
h("s=" d(f)),q ="?" r.join("&"),"0"===p&&n.callRequest([o "//cnzz.mmst
at.com/9.gif?abc=1"]),j&&(""!==g?n.createScriptIcon(q,"utf-8"):(b="z"=
=l?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" e:"hXXp://quanjing.c
nzz.com","pic"===k?(c=o "//icon.cnzz.com/img/" f ".gif",a="<a href=
'" b "' target=_blank title='" m "'><img border=0 hspace=0 vspac
e=0 src='" c "'></a>"):a="<a href='" b "' target=_blank ti
tle='" m "'>" m "</a>",n.createIcon([a])))}();.....

GET /stat/?ac=stat&name=%original file name%.exe&mac=00-0C-29-86-17-36&md5=96c33967acbb608760244c8e0ec6d330 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.fjmjm.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 30 May 2014 12:17:15 GMT

Server: Microsoft-IIS/6.0

Who: ShanIE

Content-Length: 0

Content-Type: text/html

Set-Cookie: ASPSESSIONIDACSSDCBR=PHJIEGAAEEIILMDFLCDNPNGA; path=/

Cache-control: private

GET /v53/imgn/v53_2icos.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:29 GMT

Content-Type: image/gif

Content-Length: 2051

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
GIF89a)....................8Y....................1..v...........=.....
.........z....................e........J........}.................8..j
..............u.................r.....Q..............C................
.k...........L........................................................
......................................................................
...............................................!.....N.,....).......NN
5....................N.?N...........I.>[email protected]......
-.......................<*........A..G.%:......#%% .C.......].....I
!JP.....I..a.8....A$.3..B.H.$N\.a %#.#......I4L)..k...&O........{.(7.f
N.:(P.pO.C.!..,.j.....D.'..6.G'A........u-z",..H....q...W.LI]d...J7..8
. .O.x.*..l....Tl...... ..m<a.$.J...d..a...J...s$.$H..e..$^..9...D.
........[k.`.Jbs.qk..nj..Yt........n...c.......uE'.c..n.Q_b.....)..x..
..d.....6e..V.)._c..'....W`...._{.}E.$.` ........,.....@..,.....)..W.M
 ..-....B.8#&..)...y..#..gb.#.|.. K6..*IJ.....R.3U:.%#..Rer_....P.8.9c
.X...8..#_..&.jN.'B>..g.$....G...P1..&0.........MTIb. ....M8!.h....
....*.y`yZ.|.xG.Q6.)k.6.:J_..y.X}....-\..o.05k..L..)...........v.)..HK
.H.....J.....4[.c.*Bn..9.^...[.xw.;...bGo......h.{o...[.%..Xo#...^..d 
S......~..r...*\[email protected]..&F...m...9.h..0..".*.(...:.....s..,.
.2.....!..l.#N.....4y..S32% cr..-bV.,...S.....6.....wn.9&.;LP7..a.wMlV
y...W:....0..<. ../.2x{...(%V.[B.PM..TGu.yV.....$z^9v.J".....@.:0EB
....:. ...]".PW....`.......PP..p..D.%..|...e..>)al....=.._.%...z..O
...n..J.B.........>.....B....62....C.h.k....<@.....B.A...5..
<<< skipped >>>

GET /ads_hz/_ads_2.js?t=778574 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:29 GMT

Content-Type: application/x-javascript

Last-Modified: Fri, 30 May 2014 12:00:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
ce3.............Y.o.8.. *w.H.-K.#.....m.v.n....I...d5zU..N..~.I=l7..p@
k.....|.f8.."..~......J.......a?.E4bV2.L^w..........te.TV.......Ry.z..
.^).....F.:....Z.6.H.fs;.r..........-..6...e...]%~J3...<~....<.#
Of. ..Z.e.o.....A,..6.....|B....-.Ub-....P!...n6....m..T..sJ."..Zml.:.
l......|....$..G.l6.t.X...o..v..a....7...........-.U/(...v>_....P.z
..D......`@y...{....W.;5..P.M....S.N.DE.l..J.........4..9.{......._...
.L.Zd.....Kfj.{q.#...Q.|w..6\..D.6WZ.B1.....Sb;Y2....8vnB.c...8.b....M
.8.o.,Ns..........Y.!......V...%.m.....>Ic...p...[..7(.J.uB..<v.
[.<0..I..=....fVh...D...`.....!.1..%.......{O[w.Fg.l..N.]J..IX...'.
.,..\.......t.Tfv]ZZ..R...|a.O..l.....M.w*pOW..2....]yu.?....J...7....
Y....Y.T..S.....{...e...Ge.(_....T.z..I50..l....}.{.........rU...a`...
.$4..3.f..&_.t.$.S.n...(3....U..t.Ayn..V..aK...U...b.P.W*w....;......J
........`B.KnH5..4..xgg....m%v...(.eL.....#M{m.`5.7.......,.x.3u.Uf-M.
b-...v........G.]76...eio..~...j......_.....bd.k..J#.o.p.Y........0.N.
5VZ-_~...0{\.._J.OJ.....^[email protected]{..v....g..=.....
y.Y.............l.d-.|5D1oZ.....^1......b..vI........p.......k^.......
.3t....<..u...9.z.9V^.0.Fe...........|.b.vk#...`..| .=...0.HX...1R.
....8L0)0{`FN<......0.C$.r...J...F2.. W..%q..h.;..r.......9...m.$3.
............E.3.i W.h..F.'.........6.Om....p.....'...b^..]..u)..0g..%.
oe.j_}........Fm..,".%" ..3.K...#F....._3{.@[email protected].....
.|...j.f..M6.b...l.0|......[...G^...#...........-.7...a.\gCv.l6...{v..
j....c....z..%C...B.'#$..?..`.....t.K......GD..O...T...U7[....G.u.
<<< skipped >>>

GET /v53/imgn/guide_tip.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:34 GMT

Content-Type: image/png

Content-Length: 10442

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
.PNG........IHDR.......J.......D.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Macintosh" xmpMM:InstanceID="xmp.iid:CEC0416D02FB11E388CB8B
2E3040A42A" xmpMM:DocumentID="xmp.did:CEC0416E02FB11E388CB8B2E3040A42A
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CEC0416B02FB11E3
88CB8B2E3040A42A" stRef:documentID="xmp.did:CEC0416C02FB11E388CB8B2E30
40A42A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>.Z....%<IDATx..].....&.(..."...ky.....
.f...7..........W@%.`..@A.*(...P..;K......E|..;g.....?[....>.<..
...........i......h-....@_~.. _&.2%...<..........k......w.d./.....U
 8..r./=|..9.{.P .IT.r.J.b].|...3|....../7....]1..=?..M]Y.f.....n...7l
.:w......Vk?.gkk 8.z..........ps...^p........P-....Z..._.6l.....KWWW.j
jj...........Q..P.~.|..Y..O......... .}...GI...3k..#......KS.....n..r.
rm..../.....'JUUU..aIT....V......4...]P.......M.....Y..xju6...2...|.o3
......?...>X\..V[[......}(//........o.CEM...f.N..Z.....O. ..7hU.qC=
p&/........@.|'gA.1.>.$....{@t..P...um..A..8..].v.;..D.b.]..ss.
<<< skipped >>>

GET /favicon.ico HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Pragma: no-cache

Cache-Control: no-cache

Connection: Close

Host: VVV.fjmjm.com

HTTP/1.1 404 Not Found

Content-Length: 83

Content-Type: text/html

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Fri, 30 May 2014 12:17:27 GMT

Connection: close
<html><head><title>Error</title></head>&
lt;body>........................</body></html>..

GET /kan/static/css/DD_belatedPNG_0.0.8a-min.js?t= HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:26 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 27 Aug 2013 08:33:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
b9b.............Y.o....=...}mH....yx....vZ.p..q...P,....*I...........#
@Lrvvvv.ofW...g......Hx-...... ........UQ.emk kq.CQiA^j'..k..n.2_e....
x.kg.o......:....W.:.K[;-..v.'.(A}..8.5.D.....D..<..oW....uaO...-./
.8..e*..Q.....H.)&...*.3[.Y3._.....Y%|...R.#..9.n..JJ..f...%..Y...O.Dh
....A.id.....*..O7|n,..T.e."......d%...9.fg.e..Z...m..m..L..4O_'..>
;<.>...X...*...33N....a.7...?....a....A....J...=M..T./.'.`.y5...
.8....{.20T.P......M....UKc.g....7.&[..]y.Hyu..^.WyP....].0c...z_?&.}$
D=T.v..|.:.Zj'..tV.<f,\......cwU.....93Y.~......4"....O.8....U....!
t.l9..e..~.....F..c.:.o...\...Zh....>..kWD..F...D...._%.w...06rs.&V
./.&.y..#m.Vy../FS...b..)..g.H.%....n.,..Bs..t[}.........h.....s....B.
......~....EFZ.E..z.;...G..'.Y.qV.?....;..%:o...........n.A.....^...y.
...[R.*.`.......I.3.. .U.x2W.....J..W....B..g..*....5.s.!.^4.. `{^z...
.....h.....e.(Fc=B(..E..p.]c....R.eD...k.A:y...nd..c.Ã..z..Mr..-..:.
.L....&...W....z:7..d....d.)Gw.x..~5;..qR#..U.7.....H......{...v..)...
I..v../....G6....yV....[..Ql....>.|}...a.dnn..f..|fL...'h......*J.'
.W.d..(M. W[[email protected]_....Z.........s....#!...(c..d...&l
t;.........$.....Y...:Z..... ..y..]....K)*.O.q.C=*.$..q.Gf.....*WY....
...Z<..c.3.._`LDj....`.jDj..\0....<...xy.xN}..LK.G..5..3....5...
|.3CS...,|.6...*.d...X).....Q6.BlQ.A...}....:.W..q......ad8bc.p.......
n..;e.<L0 d....w...OG..<D....'..m....3.Q.....K=6.kK..5.....M.3..
w.Z......[....#...N\.G$F.!.KS../y.:s......[.).c..h'uc....V`...(...@...
.../..j...."..C....pB.!.....f.Px.r..[p...R.......b..]u.I%.6|.NAXs.
<<< skipped >>>

GET /imgn/v32/icon4.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:28 GMT

Content-Type: image/gif

Content-Length: 1506

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Accept-Ranges: bytes
GIF89a".....................v.....Cs.`}...............................
...I{.b...........................................................U..m
..r..........................M..Z.....................................
......................................................................
......................................................................
.............................mmm^^^QQQ777......!.....~.,....".......~.
...................................................................dKG
8HINi.];K.D.kUMJ[.LG`....DIa.O9c.o|z.bKL.i8p.zy{x..G..OL....'@.>w.Y
.....ox..).n..:..(.....oz...........XB.......9.3@.'...........5..H...5
....m..HNk...4.... uYR...7.....Rj./J.H..d...p....d....5.(ybi..%<..f
....Lk.4Y..M....<I..G..T2.eB%.. I.X..dI..T.R...m.6J.H...M.<?....
CR..w~...T...<F?r....v...<.Rk....D.}<..1..<9........y..9t;
z..S...B.....mU..1Ga.T.L...B...];..p.t....$r(..Oz...Ou8..$[...[d...%[ 
1@M~.0.%T ..`N.....`....5aE}..)...,P..H&YD.%E...[,[email protected]....%.`C...`...
....%..B.!x....,9..%. '.jv.A.a......y....)..}.`'..P...t.z(..4..76t.C.Y
.P..If....h...=dP...0`*........*[email protected]......)...$.Lq...&.....`@..
.p.."..A.!..B.S....)D;.....m.1L1A....n$.L...$@...>L....x..$).a(..L.
........>B........H.....(..$...A..lp.....B..4...Pp..."D ..&k.r#....
.<C...SL1...F....P.4.L7....F-.....@. 4.B&#X...#p....dp...p`..S@1E.?
..@%g..A.2....P.....4.@.'.PC.1....P.p.......z.^..!.....H2A....w.&.@.. 
L.B......&......`...BrC.f@..."....&<.)$u....g.....,[email protected][email protected];..@ 
..3Lr.?.=.`...h....,`v.).....: ...B^...,0...0..R...\b..PA.R`..xbkT
<<< skipped >>>

GET /v53/imgn/v53_bicos.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:29 GMT

Content-Type: image/gif

Content-Length: 826

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
GIF89aD.......Bo...v..1..;o..........f...W.......;........e...W.d.....
.........@......`..P~%[email protected]{......Z...
...W.%h.t...d................@..&z..Hv......L...\.Q~..R....6..........
..h..Ky...y..Y..Cp..a...........R.....Z.....Cr.c..........:......o....
...$m..f....&}........................................................
...............................................!....._.,....D......._.
.............@'K3@?...0 0...''@...'....0......KK.3$.;=3........'*K??G.
.CCH8........?'/[email protected]&&LLN.T@@.. .. .mXR.....7(a. 
...4>.[[email protected].)...?.n..e...4P...H...R.H......P........4..dY...'.
[email protected]......?F)..!....BX...A......1.^.... u@..,!_9..{[email protected]
....tHr..]A.~..7`....N......!J...pb..AF.L....._O..;....!]..#2...AF.H..
 .4#.~D.b%.....,.... .h..p.DP.W.......o..><0.K..{.O.@Q .;t>....


GET /v53/imgn/foot_slider.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:29 GMT

Content-Type: image/jpeg

Content-Length: 322

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ....................................................
....................S.................................................
........?......>....('@......... . ..@........


GET /v53/imgn/guide_tip.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:34 GMT

Content-Type: image/png

Content-Length: 10442

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
.PNG........IHDR.......J.......D.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Macintosh" xmpMM:InstanceID="xmp.iid:CEC0416D02FB11E388CB8B
2E3040A42A" xmpMM:DocumentID="xmp.did:CEC0416E02FB11E388CB8B2E3040A42A
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CEC0416B02FB11E3
88CB8B2E3040A42A" stRef:documentID="xmp.did:CEC0416C02FB11E388CB8B2E30
40A42A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>.Z....%<IDATx..].....&.(..."...ky.....
.f...7..........W@%.`..@A.*(...P..;K......E|..;g.....?[....>.<..
...........i......h-....@_~.. _&.2%...<..........k......w.d./.....U
 8..r./=|..9.{.P .IT.r.J.b].|...3|....../7....]1..=?..M]Y.f.....n...7l
.:w......Vk?.gkk 8.z..........ps...^p........P-....Z..._.6l.....KWWW.j
jj...........Q..P.~.|..Y..O......... .}...GI...3k..#......KS.....n..r.
rm..../.....'JUUU..aIT....V......4...]P.......M.....Y..xju6...2...|.o3
......?...>X\..V[[......}(//........o.CEM...f.N..Z.....O. ..7hU.qC=
p&/........@.|'gA.1.>.$....{@t..P...um..A..8..].v.;..D.b.]..ss.
<<< skipped >>>

GET /a/cpv1.html?t=20140530201724 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.fjmjm.com

Connection: Keep-Alive

Cookie: ASPSESSIONIDACSSDCBR=JIJIEGAADADNCOEGLLGEHFGL

HTTP/1.1 200 OK

Content-Length: 1117

Content-Type: text/html

Last-Modified: Sun, 11 May 2014 18:17:40 GMT

Accept-Ranges: bytes

ETag: "0ba444b456dcf1:416"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Fri, 30 May 2014 12:18:15 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> ..<html&g
t;..<head>..<meta http-equiv="Content-Type" content="text/htm
l; charset=gb2312">..<meta http-equiv="cache-control" content="n
o-cache">..<title>..</title>..<style>..*{margin:0
;padding:0;position:relative;top:0;left:0;}..body{font-size:13px;}..a{
color:black;text-decoration:none;border:0px}..#popwin{margin:0 auto;wi
dth:300px;height:265px;border:0px;}..#title{width:auto;height:12px;}..
#title a.btn-close{position:relative;left:230px;width:39px;height:12px
;display:block;}...adright{float:right;width:300px;height:15px;border:
0px} ..</style>..</head>..<body>..<div id="popwin
">..<div class="adright"><p align="right"><a onclick
="window.external.CloseWindow();"><img src="Close.gif"></a
></p></div>..<div id="gList">..<script src="ht
tp://e.70e.com/cpc_img.asp?u=34496&m=6&n=1719,1685,1706,1707,1718&s_px
=1" charset="gb2312"></script>..</div>..</div>..&
lt;script type="text/javascript" src="hXXp://lg1236.565882.com/pShow.p
hp?PID=5534"></script>..<div style="display:none"></
div>..</body>..</html>....
<<< skipped >>>

GET /a/Close.gif HTTP/1.1

Accept: */*

Referer: hXXp://stat.fjmjm.com/a/cpv1.html?t=20140530201724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.fjmjm.com

Connection: Keep-Alive

Cookie: ASPSESSIONIDACSSDCBR=JIJIEGAADADNCOEGLLGEHFGL

HTTP/1.1 200 OK

Content-Length: 348

Content-Type: image/gif

Last-Modified: Sun, 11 May 2014 18:17:52 GMT

Accept-Ranges: bytes

ETag: "0c86b52456dcf1:416"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Fri, 30 May 2014 12:18:16 GMT
GIF89a........................`..p.....M..5...........................
....{...'.....*.....7........?.....3..,..................../..........
.................................................................!....
...,..........y..jH,..).h"....fj.r.T%...ULW).jl...*[email protected]...$*..%...
A....h....~ &...y*...&C&.$h.h$.......c..#(!*!('..(#C#...'...BF. .A.;..

GET /stat.php?id=5645354 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s9.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Fri, 30 May 2014 12:17:46 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Fri, 30 May 2014 12:17:46 GMT

Expires: Fri, 30 May 2014 13:47:46 GMT
1f7a..(function(){function l(){this.c="5645354";this.R="z";this.N="";t
his.K="";this.M="";this.o="1401452266";this.P="hzs10.cnzz.com";this.L=
"";this.s="CNZZDATA" this.c;this.r="_CNZZDbridge_" this.c;this.G="_cnz
z_CV" this.c;this.u="0";this.B={};this.a={};this.la()}function g(a,b){
try{var c=[];c.push("siteid=5645354");.c.push("name=" d(a.name));c.pus
h("msg=" d(a.message));c.push("r=" d(h.referrer));c.push("page=" d(f.l
ocation.href));c.push("agent=" d(f.navigator.userAgent));c.push("ex=" 
d(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).
src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(e){}}var h=docu
ment,f=window,d=encodeURIComponent,k=decodeURIComponent,p=unescape,r=e
scape,m="https:"===f.location.protocol?"https:":"http:",s=m "//c.cnzz.
com/core.php";l.prototype={la:function(){try{this.U(),.this.J(),this.i
a(),this.H(),this.m(),this.ga(),this.fa(),this.ja(),this.j(),this.ea()
,this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),f[this.r]
=f[this.r]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:funct
ion(){try{var a=this;f._czc={push:function(){return a.C.apply(a,argume
nts)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=f._czc;if("
[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b  ){v
ar c=a[b];switch(c[0]){case "_setAccount":f._cz_account="[object Strin
g]"===.{}.toString.call(c[1])?c[1]:String(c[1]);break;case "_setAutoPa
geview":"boolean"===typeof c[1]&&(f._cz_autoPageview=c[1])}}}catch(e){
g(e,"cS failed")}},qa:function(){try{if("undefined"===typeof f._cz
<<< skipped >>>

GET /imgu/2014/05/20140508103513_537.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p4.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:29 GMT

Content-Type: image/gif

Content-Length: 21959

Last-Modified: Thu, 08 May 2014 02:35:13 GMT

Connection: keep-alive

Expires: Sun, 29 Jun 2014 12:17:29 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89ai......SSS.ww........\.......c;/.W...i......C.hhh.R.............
.........................vE.....................-.......Z...bbb~~~.=..
...]8....t...."*........dd.......A....S............%..............D..=
....DDD.K.....kH.....h...................BB...)1.TZ........$$.SSJJJ.::
...qqqdj..........\c..........4<......4vvv.,,.22.ZZ.......j .......
............nn......ty.>>>....z\lll..........]#....KK........
.....qR.L$....f ............:B...x......................R,......yyyCJ.
...........{.....b%-............mh...n7.....r...JQ.....a'.K..~O.6.....
...}`.....c......lq....}............G.....R$.....p.E...b.....m~...V..^
 .G...z..s.......vW.}Z.G.....P......~.Z0.............9..............D.
@[email protected]'/..>>.K..F.. ....\s..............
XL.....w....,&..f.....h......!..XMP DataXMP<?xpacket begin="..." id
="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/
" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27     
   "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-synta
x-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.ado
be.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/Res
ourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocu
mentID="xmp.did:491CD10DA3D5E311A958EE854ABCD7D0" xmpMM:DocumentID="xm
p.did:4C40E5B5D5E411E3B4278899C73C6A8E" xmpMM:InstanceID="xmp.iid:4C40
E5B4D5E411E3B4278899C73C6A8E" xmp:CreatorTool="Adobe Photoshop CS6 (Wi
ndows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9908CF
<<< skipped >>>

GET /imgu/2014/05/20140528121904_599.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p5.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:35 GMT

Content-Type: image/jpeg

Content-Length: 9642

Last-Modified: Wed, 28 May 2014 04:19:04 GMT

Connection: keep-alive

Expires: Sun, 29 Jun 2014 12:17:35 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
......JFIF.....d.d.....0Exif..MM.*.......1..............VVV.meitu.com.
...C..................................................................
..C...................................................................
....k._...............................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?............................
9G..`....=..g.?.S....(....{.f...A.|H...w..>......_.}......jq.Oo....
.......W.'..2.[..O...];;._.....^ ......=....s.Mu.x?.......1[.....iv.s^
............<....{,/......?..{^...d9.[.....L:.....1.........../...K
..f.hI!....Pm...ss$..o....i....q..ZW.fX........2...;......v}......0..Z
.1.m..K.......}b.A.n.6TvV..Hw....<.;...w.......w.?.......t..?..~...
......mo..=.. ..\...=.a...i.H|I.\.k...<...l6w....wg..>w..Q..U...
....................I.Q....p...?.....?.3...?}.........<c...7^.K..g.
.s.....:......{.^.k.'*.a.\%.~...........m...FC....~...g][email protected].. 
.$..........^ .......\a.v.......</...F .b1...<...#{ /..Wo.......
:.q.....>...)......{./.....l.....=......T........>./...O.?f..7..
.G....T......>w..?..x.....E.o...W.....O .._.........`..j....>..e
.{*_............'...A....~......}..'.7.?...../?...{s.S..s]>....
<<< skipped >>>

GET /stat.htm?id=5645354&r=http://VVV.mdtxw.org/miniindex/&lg=en-us&ntime=1401452266&repeatip=4&rtime=0&cnzz_eid=915151347-1401452266-&showp=1024x768&st=-17574&sin=none&t=undefinedundefinedundefined&rnd=1582803127 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hzs10.cnzz.com

Connection: Keep-Alive

Cookie: cna=7GQPDP4AjggCAbhrJiZwk7QY

HTTP/1.1 200 OK

Server: Tengine/1.4.1

Date: Fri, 30 May 2014 12:17:54 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Tue, 28 May 2013 02:57:17 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /app.gif?&cna=7GQPDDm4py0CAbhrJibz/3gM HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pcookie.cnzz.com

HTTP/1.1 200 OK

Server: Tengine

Date: Fri, 30 May 2014 12:17:49 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=7GQPDDm4py0CAbhrJibz/3gM; expires=Mon, 27-May-24 12:17:49 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;....


GET /app.gif?&cna=7GQPDP4AjggCAbhrJiZwk7QY HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/meinv.htm?time=undefined

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pcookie.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Fri, 30 May 2014 12:17:49 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=7GQPDP4AjggCAbhrJiZwk7QY; expires=Mon, 27-May-24 12:17:49 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;....

GET /imgu/2013/05/20130531144119_126.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p2.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:29 GMT

Content-Type: image/png

Content-Length: 13613

Last-Modified: Fri, 31 May 2013 06:41:19 GMT

Connection: keep-alive

Expires: Sun, 29 Jun 2014 12:17:29 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.......2.............pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /imgn/sehome/tjv1/subnav_v41.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:29 GMT

Content-Type: image/png

Content-Length: 3655

Last-Modified: Mon, 28 Jan 2013 13:46:09 GMT

Connection: keep-alive

Expires: Sun, 29 Jun 2014 12:17:29 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...............x.....sBIT.....O.....PLTE"5R..L4s...$.?
....fff............iV*.ji......t.........hC...)Bd.....k...........f...
...9..............Q`w..Y[ZZ.......YRGGG;`......k.4/..B..E...J..f......
....`.....}...-D.....zq...f......rP..T........N....eW...i|...r..`..LGt
...dR....<..................O....T..........MI.../Kr.J-...........t
..e.....}}.....333..I......wvw`..I}........iC......4U.....( ..........
.......3.....W.....:.."w....S........n..x.....B.....\..sAj...r..b.....
...d...........}b...........IYq...9X......Jr......m9.....Q.........]..
.....a..:.yR..G......Lz.k..........~..f........IEq...Qp........... Fj.
...............................m..Ko....^9].........z........jW.......
.T....S7Qs.....[..W..C..J....................................b..Cm.R}.
...........J..')Jk{.......:..cl..=d......k..;..H.....jLt.B..f....tRNS.
......................................................................
......................................................................
......................................................................
.............................................s.......pHYs...........~.
....tEXtSoftware.Adobe FireworksO..N....tEXtXML:com.adobe.xmp.<?xpa
cket begin="   " id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmln
s:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/
02/12-17:32:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1
999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:x
mp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com
<<< skipped >>>

GET /imgn/v32/skin3.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:30 GMT

Content-Type: image/gif

Content-Length: 4159

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Sun, 29 Jun 2014 12:17:30 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a..h..........R..J..Bs.S................r.....qq}a...............
........n..~..|..m..l..l..x..k..v..t..i..s.xa..n..l..k.ua..i..h..i.~f.
r`....wd.xd....rb....pa.nb.rf.vm.xp.xp}OJ..........l`.mb.pe.od.oe.wl.x
n.qg.~t.sj.sj.tk..|..}....SM.vn............wMIuLH.|v.}wmJG.......~yeHE
..|..................................................................H
??....................................................................
......................................................................
......................................................................
.................|||{{{zzzyyyxxxtttsssrrrpppmmmlllkkkjjj<<<..
......................................................................
......................................................................
....................!.......,......h........H......*\.......H.H.....3j
.....I.BJ......(S.\.....0].IdI.$K...T...O.....JTh.dH.*EZ..O....%j....J
.@1.....{[email protected].=;..].VA.8p..ms....x.5m../..;8.......u.........#[...N!
F.......g....&L.`2....T.....;vd.L8L./..g.......)..s.....]..=P......F}W
.@..)....v\4=bs..}w...J|._.>.r...?..].t.......B..)T.].n....g....B.&
....'!d....2.=W.2.Q..2.Y`...x....\(..I.....1.....`...L...s|...@R......
.|p...].2.Bl L...#8...l<.[.e..C.o.W..6.&..2.....E....U....).ZS!....
".p....%F.;[email protected]...^..........H..D....C.....B
u.bj ......b..d.......l.k...0F......8|Z...R.k.........A.sf...u6...wN[m
.;9..TS.u.VJ5..O..k.i.......$...............p..G,....j...g....w... ..q
...l..(..r.$_.qM .4.'1..J.6..r.pb<J*..<.-.............I.<
<<< skipped >>>

GET /imgn/v32/titlebg.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; TheWorld)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 30 May 2014 12:17:30 GMT

Content-Type: image/png

Content-Length: 2842

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Sun, 29 Jun 2014 12:17:30 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.............b.......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /imgu/2014/05/20140526163242_997.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate