MD5: b8d0ff525ff7e4f2b2c577519665c147
SHA1: aadac4ce2627b4d2d0b80c81b4acf33a8c4bdca0
SHA256: 9875f9087f10b00f5854f1bc9e0e681e8ffa585e5e7ad72e06143a2900730aa2
SSDeep: 24576:mPfB4jcK3yXahZe txE6ZrCcQFLPlVBzXh9BrqY:gyj2a3HEOOcQFLBbzd5
Size: 1237882 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

worldweather.exe:2452
worldWeatherUpdate.5002.exe:2896
365weatherIns_61.exe:408
greendou.exe:772
worldWeatherRealTime5002.exe:2408

The Trojan injects its code into the following process(es):

%original file name%.exe:204

File activity

The process worldweather.exe:2452 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\worldweather\Cfg5002.ini (288 bytes)
%Program Files%\worldweather\5.0.0.5002\Cfg5002.ini (216 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Program Files%\worldweather\5.0.0.5002\weatherData.tmp (354 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@uujzy[1].txt (139 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\go[1].htm (0 bytes)

The process worldWeatherUpdate.5002.exe:2896 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\369[1].ico (16369 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\PM10Context\PM10Context.db.!mv (835 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\PM10Context[1].xml (835 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\AQIContext\AQIContext.db.!mv (365 bytes)
%Program Files%\worldweather\5.0.0.5002\Cfg5002.ini (202 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\WeatherContext[1].xml (509 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\PM25Context[1].xml (624 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\Cfg5002.ini (1196 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (196 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\366.ico.!mv (16369 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\AQIContext[1].xml (365 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\PM25Context\PM25Context.db.!mv (624 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\WeatherContext\WeatherContext.db.!mv (509 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\369.ico.!mv (16369 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\366[1].ico (16369 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\worldweather\WeatherContext\WeatherContext.db (0 bytes)

The process 365weatherIns_61.exe:408 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\System.dll (11 bytes)
%Program Files%\worldweather\5.0.0.5002\PM10.5002.exe (7192 bytes)
%Program Files%\worldweather\5.0.0.5002\weather.db (6584 bytes)
%Program Files%\worldweather\5.0.0.5002\uninst.exe (2251 bytes)
%Program Files%\worldweather\5.0.0.5002\updateContext\un_update.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\ToggleImages.html (1 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\btn_move.jpg (1 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\bg_large.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\btn_next.bmp (2392 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\btn_max.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb4.tmp (80589 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\future\n99.png (6 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\future\tips.ico (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\loading1.bmp (696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\tongji_61[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\KillProcDLL.dll (4 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\err.png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\checkbox1.bmp (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\tongji.html (2 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\btn_min.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\inetc.dll (784 bytes)
%Program Files%\worldweather\5.0.0.5002\areacode.db (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\2.jpg (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\btn_close.bmp (1 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\Cfg5002.ini (325 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\min.png (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\bg.bmp (18424 bytes)
%Program Files%\worldweather\5.0.0.5002\updateContext\i.gif (170 bytes)
%Program Files%\worldweather\5.0.0.5002\updateContext\loading.gif (8 bytes)
%Program Files%\worldweather\5.0.0.5002\sqliteApi.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\3.jpg (1552 bytes)
%Program Files%\worldweather\5.0.0.5002\worldWeatherRealTime5002.exe (4992 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\bg_small.png (4 bytes)
%Program Files%\worldweather\5.0.0.5002\Cfg5002.ini (325 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\nsWindows.dll (10 bytes)
%Program Files%\worldweather\5.0.0.5002\updateContext\update.html (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\worldweather\´óÖÚÌìÆøÔ¤±¨Ð¶ÔØ.lnk (911 bytes)
%Program Files%\worldweather\5.0.0.5002\worldweather.exe (19096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\md5dll.dll (8 bytes)
%Program Files%\worldweather\5.0.0.5002\updateContext\updateRecord.db (1 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\loading.png (3 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\worldweather\´óÖÚÌìÆøÔ¤±¨.lnk (943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\checkbox2.bmp (2 bytes)
%Program Files%\worldweather\5.0.0.5002\AQI.5002.exe (7192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\loading2.bmp (696 bytes)
%Program Files%\worldweather\5.0.0.5002\WeatherContext\WeatherContext.db (352 bytes)
%Program Files%\worldweather\5.0.0.5002\worldWeatherUpdate.5002.exe (11344 bytes)
%Program Files%\worldweather\5.0.0.5002\sqlite3.dll (20416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\1.jpg (1552 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\large\n99.png (784 bytes)
%Program Files%\worldweather\5.0.0.5002\PM25.5002.exe (11344 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\btn_setting.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\SkinBtn.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\btn_complete.bmp (2392 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\kz.png (3 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\close.png (873 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\skin.xml (6 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\btn_close.jpg (3 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\topbar.png (3 bytes)
%Program Files%\worldweather\5.0.0.5002\mfc5002.dll (5520 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\updateContext\updateRecord.db (1 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\WeatherContext\WeatherContext.db (352 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp (0 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\updateContext\AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp (0 bytes)

The process greendou.exe:772 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\citydata[2].js (7666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\skin_[1].css (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\123.sogou[2] (10367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\guide_tip[1].png (1459 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VGX6.tmp (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\lk_jumei[1].png (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\titlebg[1].png (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\main[1].js (6192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\v33_sugg_ajaj_v40_3[2].js (1187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\foot_slider[1].jpg (322 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\ufo2[1].js (17536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140512170407_319[1].jpg (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\DD_belatedPNG_0.0.8a-min[2].js (1208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\20130820165531_481[1].gif (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\selogo_111207[1].png (1848 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\main[2].js (2605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\skin2_0[1].gif (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\20140508103513_537[1].gif (6813 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\20140512170546_833[1].jpg (232 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (1879 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (640 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\skin3[1].gif (1314 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (1398 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\fine_cloudy[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\citydata[1].js (7992 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (11568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\_ads_2[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\v53_2icos[1].gif (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\favicon[1].ico (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (774 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\123.sogou[1].htm (7472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\setskinbg[1].gif (397 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\fbg_about[1].png (805 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\cloudy[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\123.sogou[1] (14016 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\v53_arrow_h[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\v53_123n[2].js (4349 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\img-video-2[1].gif (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\DD_belatedPNG_0.0.8a-min[1].js (217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\get_tj[1].php (1199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140513112717_7[1].jpg (3852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\guide_tip[1].png (2319 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\hotdata[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\skin_tips_n1[1].gif (1 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (191 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\setting_icon[1].gif (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\rec[1].do (374 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\get_123_v53[1].php (16030 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\subnav_v41[1].png (682 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140512112800_851[1].jpg (2380 bytes)
%Program Files%\greeou\profile\Defaults\last.ini (2306 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\20130531144119_126[1].png (3810 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\v53_bicos[1].gif (826 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\v33_sugg_ajaj_v40_3[1].js (1352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\hotdata[2].js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\logo_1112293[1].gif (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\search_arrow[1].gif (447 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\i-ico-2b[1].png (173 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\icon4[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\_ads_2[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\ufo2[2].js (19464 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\20140507144656_823[1].jpg (783 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\fIXLig2wT89333[1].jpg (2500 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\selogo_111207[2].png (1606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\selogo_111207[1].png (2008 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\v53_123n[1].js (4851 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\img-news[1].gif (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\new-ico[1].png (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\1oq9Gg9Y3L8813[1].jpg (1492 bytes)
%Program Files%\greeou\profile\Defaults\config.ini (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140507144124_693[1].jpg (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\new-erweima2[1].png (2985 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\v33_sugg_ajaj_v40_3[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\DD_belatedPNG_0.0.8a-min[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\hotdata[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\_ads_2[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\citydata[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\main[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\ufo2[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\v53_123n[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\123.sogou[1] (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\guide_tip[1].png (0 bytes)

The process %original file name%.exe:204 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\processwork.dll (6140 bytes)
%Program Files%\greeou\skin\Default\control\tab_hover.png (346 bytes)
%Program Files%\greeou\skin\Default\control\tab_bg.png (314 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_new3.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\System.dll (11 bytes)
%Program Files%\greeou\skin\Default\misc\16_ad_hunter.png (716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\365weatherIns_61.exe (119257 bytes)
%Program Files%\greeou\profile\Template\start\style.css (3 bytes)
%Program Files%\greeou\skin\Default\control\tab_sidebar.png (321 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_favorites2.png (696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\Md5dll.dll (8 bytes)
%Program Files%\greeou\skin\Default\control\MenuItem_Hover.png (2 bytes)
%Program Files%\greeou\skin\Default\misc\24_go.png (650 bytes)
%Program Files%\greeou\skin\Default\misc\16_open_in_bg.png (507 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_favorites.png (700 bytes)
%Program Files%\greeou\profile\Defaults\CommandBars.ini (1 bytes)
%Program Files%\greeou\skin\Default\mskin.ini (10 bytes)
%Program Files%\greeou\GreenDou.exe (25123 bytes)
%Program Files%\greeou\skin\Default\control\status_bar_bg.png (445 bytes)
%Program Files%\greeou\skin\Default\control\combo_dropdown_hover.png (774 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_forward.png (947 bytes)
%Program Files%\greeou\skin\Default\control\win_minimize.png (202 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\NSISdl.dll (14 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_refresh.png (1 bytes)
%Program Files%\greeou\skin\Default\control\combo_dropdown.png (794 bytes)
%Program Files%\greeou\profile\Template\start\images\logo.gif (3 bytes)
%Program Files%\greeou\skin\Default\control\Button_Pressed.png (1 bytes)
%Program Files%\greeou\profile\Template\start\index.html (832 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_home.png (1 bytes)
%Program Files%\greeou\skin\Default\misc\16_website_info.png (1 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_new.png (879 bytes)
%Program Files%\greeou\skin\Default\control\title_bg.png (655 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_home2.png (1 bytes)
%Program Files%\greeou\profile\Template\start\images\header_logo.gif (2 bytes)
%Program Files%\greeou\skin\Default\shared\16_edit.png (646 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_back3.png (1 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_stop2.png (1 bytes)
%Program Files%\greeou\profile\SearchEngine\config.ini (226 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_new2.png (801 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_page_zoom2.png (724 bytes)
%Program Files%\greeou\profile\Template\start\images\dian.gif (376 bytes)
%Program Files%\greeou\skin\Default\control\win_close.png (362 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_refresh2.png (1 bytes)
%Program Files%\greeou\profile\Template\start\images\header_bg.gif (83 bytes)
%Program Files%\greeou\skin\Default\control\tab_active.png (1 bytes)
%Program Files%\greeou\skin\Default\control\mainframe.png (288 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_back2.png (1 bytes)
%Program Files%\greeou\skin\Default\control\tab_inactive.png (281 bytes)
%Program Files%\greeou\skin\Default\control\sidebar_tab_inactive.png (259 bytes)
%Program Files%\greeou\skin\Default\misc\16_folder_open.png (614 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_search.png (871 bytes)
%Program Files%\greeou\skin\Default\control\combosearch_dropdown.png (794 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\open.ini (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_a7158.exe (354562 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_search2.png (969 bytes)
%Program Files%\greeou\skin\Default\control\win_maximum.png (275 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_new.png (637 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_page_zoom.png (733 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\Inetc.dll (20 bytes)
%Program Files%\greeou\skin\Default\control\tab_sidebar_hover.png (322 bytes)
%Program Files%\greeou\skin\Default\control\sidebar_tab_active.png (957 bytes)
%Program Files%\greeou\skin\Default\control\progress.png (708 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_back.png (953 bytes)
%Program Files%\greeou\skin\Default\control\combo.png (260 bytes)
%Program Files%\greeou\profile\SearchEngine\google.ico (1 bytes)
%Program Files%\greeou\skin\Default\control\tab_new.png (350 bytes)
%Program Files%\greeou\skin\Default\control\combosearch_dropdown_hover.png (774 bytes)
%Program Files%\greeou\profile\Template\start\left.html (1 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_forward2.png (1 bytes)
%Program Files%\greeou\profile\Defaults\config.ini (902 bytes)
%Program Files%\greeou\skin\Default\control\skin_selector.png (283 bytes)
%Program Files%\greeou\skin\Default\control\win_restore.png (302 bytes)
%Program Files%\greeou\skin\Default\control\Button_Checked.png (976 bytes)
%Program Files%\greeou\skin\Default\misc\16_page.png (519 bytes)
%Program Files%\greeou\skin\Default\control\tab_close.png (259 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_history2.png (994 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_undo2.png (840 bytes)
%Program Files%\greeou\skin\Default\control\tab_new_hover.png (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\xID.dll (3 bytes)
%Program Files%\greeou\profile\SearchEngine\taobao.ico (1 bytes)
%Program Files%\greeou\skin\Default\control\Button_Hover.png (1 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_new2.png (1 bytes)
%Program Files%\greeou\skin\Default\misc\16_folder_closed.png (587 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_stop.png (1 bytes)
%Program Files%\greeou\skin\Default\shared\16_new.png (650 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Â̶¹ä¯ÀÀÆ÷\Â̶¹ä¯ÀÀÆ÷.lnk (678 bytes)
%Documents and Settings%\%current user%\Desktop\Â̶¹ä¯ÀÀÆ÷.lnk (666 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_history.png (847 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_undo.png (748 bytes)
%Program Files%\greeou\profile\SearchEngine\baidu.ico (2 bytes)
%Program Files%\greeou\skin\Default\misc\24_go2.png (648 bytes)
%Program Files%\greeou\profile\Defaults\last.ini (348 bytes)
%Program Files%\greeou\skin\Default\control\combo_hover.png (261 bytes)
%Program Files%\greeou\skin\Default\control\tab_close_hover.png (2 bytes)
%Program Files%\greeou\profile\Defaults\searchkeys.ini (14 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_forward3.png (1 bytes)
%Program Files%\greeou\ico\taobao.ico (2104 bytes)
%Program Files%\greeou\skin\Default\misc\16_open_in_new.png (548 bytes)
%Program Files%\greeou\profile\Template\start\images\logo2.gif (596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsRandom.dll (935 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\open.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp1.tmp (0 bytes)

Registry activity

The process worldweather.exe:2452 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\worldweather\5.0.0.5002]
"worldWeatherUpdate.5002.exe" = "天气预报升级核心"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 2A 97 12 A0 AE 25 AF 75 E8 94 21 60 E7 8F 4E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process worldWeatherUpdate.5002.exe:2896 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 21 C5 C1 17 8D 54 C2 04 DE FB 24 47 6F 13 AE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 365weatherIns_61.exe:408 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\worldweather]
"UninstallString" = "%Program Files%\worldweather\5.0.0.5002\uninst.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\worldweather.exe]
"index" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\365weatherIns_61.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\worldweather.exe]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\worldweather.exe]
"jieguo" = "mac=00-0C-29-8A-8B-37&soft_id=33&tuiguang_id=C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\365weatherIns_61.exe&yanzheng=318d97cc71dd4de571edddf8241ae5c0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\worldweather]
"DisplayIcon" = "%Program Files%\worldweather\5.0.0.5002\worldweather.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\worldweather.exe]
"mac" = "00-0C-29-8A-8B-37"

"(Default)" = "%Program Files%\worldweather\5.0.0.5002\worldweather.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\worldweather.exe]
"collection" = "%Documents and Settings%\%current user%\Favorites"
"menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\worldweather.exe]
"desk" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D B8 5F 28 37 98 B9 A7 C4 46 72 83 47 4B 1F F9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\worldweather]
"URLInfoAbout" = "http://weather.22pk.cn/"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\worldweather]
"Publisher" = "´óÖÚÌìÆø¹¤×÷ÊÒ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\worldweather]
"5.0.0.5002/worldWeatherRealTime5002.exe" = "worldWeatherRealTime5002.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\worldweather]
"DisplayVersion" = "5.0.0.5002"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\worldweather]
"DisplayName" = "´óÖÚÌìÆøÔ¤±¨ 5.0.0.5002"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"worldweather5002" = "%Program Files%\worldweather\5.0.0.5002\worldweather.exe /autorun"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process greendou.exe:772 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32]
"(Default)" = "%Program Files%\Internet Explorer\IEXPLORE.EXE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@shell32.dll,-12693" = "Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051320140514]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051320140514]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014051320140514\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051320140514]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "greendou.exe"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Disable Script Debugger" = "yes"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051320140514]
"CacheLimit" = "8192"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1244086619"

[HKCU\Software\Gie]
"update2" = "2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "24 BF 3D E6 6D 66 76 3F 2B C6 4D 0F 9F ED 49 E4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051320140514]
"CachePrefix" = ":2014051320140514:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"

[HKLM\System\CurrentControlSet\Services\Tcpip\Performance]
"Error Count"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

The process %original file name%.exe:204 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"Publisher" = "ico10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"DisplayName" = "Â̶¹ä¯ÀÀÆ÷ 1.0.0.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 45 6C 84 01 24 A1 EF 38 59 8B 06 81 67 27 90"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"DisplayVersion" = "1.0.0.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The process worldWeatherRealTime5002.exe:2408 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 E5 65 15 80 2A F8 F7 B1 7A 66 3F C5 CD 04 09"

[HKCR\AppID\worldWeatherRTP.EXE]
"AppID" = "{C75ABB58-E428-4F54-A75E-39E1905088A4}"

[HKCR\AppID\{C75ABB58-E428-4F54-A75E-39E1905088A4}]
"LocalService" = "worldWeatherRealTime5002"
"(Default)" = "worldWeatherRTP"

The Trojan deletes the following value(s) in system registry:

[HKCR\AppID\{C75ABB58-E428-4F54-A75E-39E1905088A4}]
"LocalService"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: MeinV
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: Corporation. All rights reserved.
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: Installer Application
Comments: http://hh8.xjtj.org
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://lm.beilequ.com/update/365/365weatherIns_61.rar	122.225.100.200
hxxp://lvdou.300duo.com/favicon.ico	223.255.145.200
hxxp://lvdou.300duo.com/	223.255.145.200
hxxp://proxy.sogou.com/?22014
hxxp://njsh.cdn.sogou.com/kan/static/css/DD_belatedPNG_0.0.8a-min.js?t=
hxxp://proxy.sogou.com/css/skin_.css?V=cr
hxxp://njsh.cdn.sogou.com/imgn/v32/icon4.gif
hxxp://njsh.cdn.sogou.com/imgn/v32/selogo_111207.png
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_2icos.gif
hxxp://proxy.sogou.com/v53/jsn/v53_123n.js?V=cr
hxxp://njsh.cdn.sogou.com/imgn/v32/skin3.gif
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/subnav_v41.png
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140508103513_537.gif
hxxp://njsh.cdn.sogou.com/imgn/v32/skin2_0.gif
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_bicos.gif
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_arrow_h.gif
hxxp://njsh.cdn.sogou.com/imgu/2013/05/20130531144119_126.png
hxxp://njsh.cdn.sogou.com/imgn/123ie/search_arrow.gif
hxxp://njsh.cdn.sogou.com/imgn/123ie/setting_icon.gif
hxxp://njsh.cdn.sogou.com/imgu/2013/08/20130820165531_481.gif
hxxp://njsh.cdn.sogou.com/v53/imgn/foot_slider.jpg
hxxp://proxy.sogou.com/dh/dhrc/rec.do?block=gamev2&jsonp=__yx2q&t=1&_stamp=1399956568915
hxxp://njsh.cdn.sogou.com/ads_hz/_ads_2.js?t=777753
hxxp://njsh.cdn.sogou.com/imgn/v32/titlebg.png
hxxp://proxy.sogou.com//v53/get_123_v53.php?block=wt&ver=v53&gfg=1&city=unknown&pid=Af22014&c=1399956570478&method=ajaf&cbf=fn
hxxp://proxy.sogou.com/jsn/hotdata.js?V=1399956570493
hxxp://njsh.cdn.sogou.com/imgn/v32/fbg_about.png
hxxp://njsh.cdn.sogou.com/imgn/tips/lk_jumei.png
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=ufo&ufoid=ads&ptype=ads&pcode=ads&rdk=1399956570071&img=extra.gif&yyid=&ssuv=&m=&loc=&module=show&tag=62
hxxp://njsh.cdn.sogou.com/u/js/ufo2.js
hxxp://njsh.cdn.sogou.com/jsn/v33_sugg_ajaj_v40_3.js
hxxp://njsh.cdn.sogou.com/jsn/citydata.js
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=ufo&ufoid=wan&ptype=jztf2&pcode=index&rdk=1399956570103&img=pv.gif&sourcelist=0011000100006_0011000100007_0011000100008_0011000100009_0011000100010_0011000100011&titlelist=风云无双_仙侠道_暗黑屠龙_Sogou傲剑2_万世_大闹天宫OL
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=daohang&rdk=1399956570493&img=pv.gif&pars=?rand=1399956570493&suid=null&sduv=1399956570462_5852_00001&ckid=6846_00001_00000_3030_00000_00000&m=null&apid=null&sgtp=null&refer=&page=&pageUrl=http%3A%2F%2F123.sogou.com%2F%3F22014&loc=null&hp=-1&pid=Af22014&ptype=index&pcode=index&yyid=null&skin=null&ver=v53_ie6_cr__4&sys=100&ser=null&sev=null&time=3531
hxxp://njsh.cdn.sogou.com/imgn/tips/skin_tips_n1.gif
hxxp://njsh.cdn.sogou.com/imgn/v32/setskinbg.gif
hxxp://proxy.sogou.com/images/weather/cloudy.gif
hxxp://proxy.sogou.com/images/weather/fine_cloudy.gif
hxxp://sj88.www.web.glb0.ldcache.net/hezi/jm/setup_a7158.rar
hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/5.0.0.5002/tongji/tongji_61.html	122.225.104.211
hxxp://njsh.cdn.sogou.com/imgn/v51/new-erweima2.png
hxxp://njsh.cdn.sogou.com/v53/jsn/main.js?V=16bb90f6b3db269d3b0dadfb85d67a51a
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=ufo&ufoid=ads&ptype=ads&pcode=ads&rdk=1399956570087&img=extra.gif&yyid=&ssuv=&m=&loc=&module=show&tag=172
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1399956575900&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53
hxxp://proxy.sogou.com/v53/get_tj.php?hz=4666521&ids=qiche
hxxp://njsh.cdn.sogou.com/v53/imgn/guide_tip.png
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140507144124_693.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140512170407_319.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140513112717_7.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140512112800_851.jpg
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/new-ico.png
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/img-news.gif
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140512170546_833.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140507144656_823.jpg
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/img-video-2.gif
hxxp://njsh.cdn.sogou.com/imgn/v51/i-ico-2b.png
hxxp://save2.xdwscache.glb0.lxdns.com/img/news_photo/2014/05/12/fIXLig2wT89333.jpg
hxxp://njsh.cdn.sogou.com/imgn/v32/logo_1112293.gif
hxxp://save2.xdwscache.glb0.lxdns.com/img/news_photo/2014/05/12/1oq9Gg9Y3L8813.jpg
hxxp://weather51la.cnzz.alivcd.com/post/	122.225.104.211
hxxp://proxy.sogou.com/favicon.ico
hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/weatherPng/cnzz.html	122.225.104.211
hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/5.0.0.5002/weatherdata/_61/cnzz.html	122.225.104.211
hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/5.0.0.5002/weatherdata/_61/WeatherContext.xml	122.225.104.211
hxxp://int.dpool.sina.com.cn/iplookup	123.125.29.252
hxxp://int.dpool.sina.com.cn/iplookup/	123.125.29.252
hxxp://p3.123.sogoucdn.com/imgn/sehome/tjv1/new-ico.png	58.215.147.36
hxxp://p0.123.sogoucdn.com/imgu/2014/05/20140512112800_851.jpg	222.211.87.167
hxxp://d.123.sogoucdn.com/v53/imgn/v53_bicos.gif	114.80.179.224
hxxp://p9.123.sogoucdn.com/imgu/2014/05/20140507144656_823.jpg	114.80.179.222
hxxp://pic1.xcarimg.com/img/news_photo/2014/05/12/1oq9Gg9Y3L8813.jpg	222.84.167.30
hxxp://d.123.sogoucdn.com/ads_hz/_ads_2.js?t=777753	114.80.179.224
hxxp://p3.123.sogoucdn.com/imgn/sehome/tjv1/img-news.gif	58.215.147.36
hxxp://p7.123.sogoucdn.com/imgu/2014/05/20140513112717_7.jpg	58.215.147.42
hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/5.0.0.5002/weatherdata/_61/cnzz.html	122.225.104.211
hxxp://p6.123.sogoucdn.com/imgu/2013/08/20130820165531_481.gif	58.215.147.38
hxxp://p0.123.sogoucdn.com/imgn/v32/skin3.gif	222.211.87.167
hxxp://d.123.sogoucdn.com/v53/imgn/v53_2icos.gif	114.80.179.224
hxxp://p3.123.sogoucdn.com/imgn/sehome/tjv1/img-video-2.gif	58.215.147.36
hxxp://123.sogou.com/favicon.ico	106.120.151.64
hxxp://www.sj88.com/hezi/jm/setup_a7158.rar	202.97.174.78
hxxp://p0.123.sogoucdn.com/imgn/v32/titlebg.png	222.211.87.167
hxxp://p6.123.sogoucdn.com/imgn/123ie/setting_icon.gif	58.215.147.38
hxxp://d.123.sogoucdn.com/v53/imgn/guide_tip.png	114.80.179.224
hxxp://p1.123.sogoucdn.com/imgn/v32/skin2_0.gif	222.211.87.171
hxxp://123.sogou.com/images/weather/cloudy.gif	106.120.151.64
hxxp://123.sogou.com//v53/get_123_v53.php?block=wt&ver=v53&gfg=1&city=unknown&pid=Af22014&c=1399956570478&method=ajaf&cbf=fn	106.120.151.64
hxxp://123.sogou.com/v53/jsn/v53_123n.js?V=cr	106.120.151.64
hxxp://img.users.51.la/15909623.asp	117.21.191.223
hxxp://p4.123.sogoucdn.com/imgn/v32/fbg_about.png	114.80.179.226
hxxp://pb.sogou.com/pv.gif?uigs_productid=ufo&ufoid=ads&ptype=ads&pcode=ads&rdk=1399956570087&img=extra.gif&yyid=&ssuv=&m=&loc=&module=show&tag=172	106.120.151.49
hxxp://123.sogou.com/?22014	106.120.151.64
hxxp://d.123.sogoucdn.com/v53/imgn/v53_arrow_h.gif	114.80.179.224
hxxp://d.123.sogoucdn.com/imgn/v32/icon4.gif	114.80.179.224
hxxp://123.sogou.com/jsn/hotdata.js?V=1399956570493	106.120.151.64
hxxp://p0.123.sogoucdn.com/u/js/ufo2.js	222.211.87.167
hxxp://p3.123.sogoucdn.com/imgn/v51/i-ico-2b.png	58.215.147.36
hxxp://p5.123.sogoucdn.com/imgn/v32/logo_1112293.gif	222.211.87.185
hxxp://pb.sogou.com/pv.gif?uigs_productid=ufo&ufoid=ads&ptype=ads&pcode=ads&rdk=1399956570071&img=extra.gif&yyid=&ssuv=&m=&loc=&module=show&tag=62	106.120.151.49
hxxp://d.123.sogou.com/jsn/v33_sugg_ajaj_v40_3.js	114.80.179.210
hxxp://p8.123.sogoucdn.com/imgn/tips/skin_tips_n1.gif	222.211.87.163
hxxp://p2.123.sogoucdn.com/imgu/2014/05/20140507144124_693.jpg	58.215.147.40
hxxp://123.sogou.com/images/weather/fine_cloudy.gif	106.120.151.64
hxxp://123.sogou.com/v53/get_tj.php?hz=4666521&ids=qiche	106.120.151.64
hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/weatherPng/cnzz.html	122.225.104.211
hxxp://123.sogou.com/css/skin_.css?V=cr	106.120.151.64
hxxp://p3.123.sogoucdn.com/imgn/v32/setskinbg.gif	58.215.147.36
hxxp://wan.sogou.com/dh/dhrc/rec.do?block=gamev2&jsonp=__yx2q&t=1&_stamp=1399956568915	106.120.151.65
hxxp://p9.123.sogoucdn.com/imgu/2014/05/20140512170546_833.jpg	114.80.179.222
hxxp://pb.sogou.com/pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1399956575900&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53	106.120.151.49
hxxp://p0.123.sogoucdn.com/imgn/sehome/tjv1/subnav_v41.png	222.211.87.167
hxxp://p4.123.sogoucdn.com/imgn/v32/selogo_111207.png	114.80.179.226
hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/5.0.0.5002/weatherdata/_61/WeatherContext.xml	122.225.104.211
hxxp://p8.123.sogoucdn.com/imgn/v32/selogo_111207.png	222.211.87.163
hxxp://pic4.xcarimg.com/img/news_photo/2014/05/12/fIXLig2wT89333.jpg	222.84.167.30
hxxp://p0.123.sogou.com/imgn/tips/lk_jumei.png	1.100.192.15
hxxp://p4.123.sogoucdn.com/imgu/2014/05/20140508103513_537.gif	114.80.179.226
hxxp://d.123.sogou.com/jsn/citydata.js	114.80.179.210
hxxp://p7.123.sogoucdn.com/imgn/123ie/search_arrow.gif	58.215.147.42
hxxp://p3.123.sogoucdn.com/imgn/v51/new-erweima2.png	58.215.147.36
hxxp://d.123.sogoucdn.com/v53/imgn/foot_slider.jpg	114.80.179.224
hxxp://p8.123.sogoucdn.com/imgu/2014/05/20140512170407_319.jpg	222.211.87.163
hxxp://p1.123.sogoucdn.com/imgn/v32/selogo_111207.png	222.211.87.171
hxxp://d.123.sogoucdn.com/v53/jsn/main.js?V=16bb90f6b3db269d3b0dadfb85d67a51a	114.80.179.224
hxxp://www.xzsky.com/post/	122.225.104.211
hxxp://pb.sogou.com/pv.gif?uigs_productid=ufo&ufoid=wan&ptype=jztf2&pcode=index&rdk=1399956570103&img=pv.gif&sourcelist=0011000100006_0011000100007_0011000100008_0011000100009_0011000100010_0011000100011&titlelist=风云无双_仙侠道_暗黑屠龙_Sogou傲剑2_万世_大闹天宫OL	106.120.151.49
hxxp://pb.sogou.com/pv.gif?uigs_productid=daohang&rdk=1399956570493&img=pv.gif&pars=?rand=1399956570493&suid=null&sduv=1399956570462_5852_00001&ckid=6846_00001_00000_3030_00000_00000&m=null&apid=null&sgtp=null&refer=&page=&pageUrl=http%3A%2F%2F123.sogou.com%2F%3F22014&loc=null&hp=-1&pid=Af22014&ptype=index&pcode=index&yyid=null&skin=null&ver=v53_ie6_cr__4&sys=100&ser=null&sev=null&time=3531	106.120.151.49
hxxp://p2.123.sogoucdn.com/imgu/2013/05/20130531144119_126.png	58.215.147.40
hxxp://d.123.sogoucdn.com/kan/static/css/DD_belatedPNG_0.0.8a-min.js?t=	114.80.179.224
vipimg.51.la	182.236.163.41
weather.uujzy.com	122.225.203.94
www.biso.cc	67.198.240.190

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET POLICY HTTP Request on Unusual Port Possibly Hostile
ET TROJAN Suspicious User-Agent (Session) - Possible Trojan-Clicker
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

GET /dh/dhrc/rec.do?block=gamev2&jsonp=__yx2q&t=1&_stamp=1399956568915 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wan.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:24 GMT

Content-Type: text/plain; charset=utf-8

Content-Length: 374

Connection: keep-alive

Set-Cookie: SSUID=E7F48AC1243DE19807397E1A09B09599; expires=Mon, 08-May-34 04:49:24 GMT; path=/

Set-Cookie: IPLOC=UA; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
__yx2q([{"gid":"212","title":"............","source":"0011000100006"},
{"gid":"181","title":".........","source":"0011000100007"},{"gid":"177
","title":"............","source":"0011000100008"},{"gid":"215","title
":"Sogou......2","source":"0011000100009"},{"gid":"178","title":".....
.","source":"0011000100010"},{"gid":"86","title":"............OL","sou
rce":"0011000100011"}]).HTTP/1.1 200 OK..Server: nginx..Date: Tue, 13 
May 2014 04:49:24 GMT..Content-Type: text/plain; charset=utf-8..Conten
t-Length: 374..Connection: keep-alive..Set-Cookie: SSUID=E7F48AC1243DE
19807397E1A09B09599; expires=Mon, 08-May-34 04:49:24 GMT; path=/..Set-
Cookie: IPLOC=UA; path=/..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UN
I PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..__yx2q([{"gid":"212","
title":"............","source":"0011000100006"},{"gid":"181","title":"
.........","source":"0011000100007"},{"gid":"177","title":"...........
.","source":"0011000100008"},{"gid":"215","title":"Sogou......2","sour
ce":"0011000100009"},{"gid":"178","title":"......","source":"001100010
0010"},{"gid":"86","title":"............OL","source":"0011000100011"}]
)...

GET /imgn/v32/logo_1112293.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p5.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:33 GMT

Content-Type: image/gif

Content-Length: 4512

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:33 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a..B...................................J}.v....._.,..;..-a.5m.J..
Z..R..x..`....................................`..]..]..[..Y..V..R..N..
M~.Iy.Eq.Bm.[..f.._..O..a..V..\..Kw.Is.d..T..Rx'g.V..i..Mz.k..w.......
....................w..s..q..o..l..l..i..f..b..]..Ly.Hs.~..u..s..d.._.
.P|.Z..y..u..i..^.....|..r..u..o..k..e..\..a..Ox.h.....X.....{..j.(..#
\~4y.K..:w.4j.E..S..W..p..|.....w.....................................
..............z..h..e.....o.....y...........y.&..(..(..!p.&y.5..=..=..
<..;..<..D..G..;..C..B..J..A..;..O..N..L..O..S..S..L..Y..Y..R..D
..<q.^..a..h..f..e..{..^...........................................
......................................................................
......................................................................
....................!.......,......B........H......*\......#J.H.....3j
...... C..I....(S.\.....".i.G..Mr..M...g.k.....n.......'/.7.P.>....
.o..q..u .s....&.......;[email protected]..}[7
.\[email protected]]9r...}..[..6X.^A...n...........|x....../.F.N..rG..
[.721.-d...B...1t..1....vOU&p........x...r.... ........Cv,....8....3..
......:.|....-....I..}%...9.X.C8Yq..8=....).0....p..'.!D8..C.6.%.C..e.
!|...Cf.T0.. .$.9.P..1[m......Bl H...g.p..hF...y...;{9t..C...r.%..{L..
.@Kf.!..T@d...#.9....7.h#.....B.b.p..g`!..i\q..W.Q..o...4.}(...L.0.p..
I..u.D...h....JpA.G.z(..Y3O:[email protected]..........@...>...c8!n.d....b=.a
..2...C...? .......A....lE..c.01(`A..b3-6..CGv .0..%`...N0.....1..w...
9......*.Y. `.Y.C.....}..{..g.p.R.....t...}.$A T`.D..S..:(....\c56
<<< skipped >>>

GET /imgn/v32/skin2_0.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p1.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/gif

Content-Length: 592

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a..........Ly.Ky.Aq.Et.Iw.S..W..Z..[..a..d..c..e..g..w...........
........................s.............................................
......................................................................
......................................................................
......................................................................
...............................................!.....s.,............s.
s...s ..................)q(....&X*....#qnmol!!p<Pad%..$igbf`ch\OYIQ
"...rlj_^]PMK/U:..s...pe[ZJG7'......kNLH6CF*....W.EB35-..s............
.B$...=~.HX...*8...... ..B...`..@.;HTTP/1.1 200 OK..Server: nginx/1.4.
1..Date: Tue, 13 May 2014 04:49:23 GMT..Content-Type: image/gif..Conte
nt-Length: 592..Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT..Connecti
on: keep-alive..Expires: Thu, 12 Jun 2014 04:49:23 GMT..Cache-Control:
 max-age=2592000..Accept-Ranges: bytes..GIF89a..........Ly.Ky.Aq.Et.Iw
.S..W..Z..[..a..d..c..e..g..w...................................s.....
......................................................................
......................................................................
......................................................................
......................................................................
.................!.....s.,............s.s...s ..................)q(...
.&X*....#qnmol!!p<Pad%..$igbf`ch\OYIQ"...rlj_^]PMK/U:..s...pe[ZJG7'
......kNLH6CF*....W.EB35-..s.............B$...=~.HX...*8...... ..B...`
..@.;..
<<< skipped >>>

GET /cnzz/weather/5.0.0.5002/tongji/tongji_61.html HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: weather51la.cnzz.alivcd.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:30 GMT

Content-Type: text/html

Content-Length: 2

Last-Modified: Fri, 21 Mar 2014 05:47:34 GMT

Connection: keep-alive

ETag: "532bd276-2"

Accept-Ranges: bytes
OKHTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:49:3
0 GMT..Content-Type: text/html..Content-Length: 2..Last-Modified: Fri,
 21 Mar 2014 05:47:34 GMT..Connection: keep-alive..ETag: "532bd276-2".
.Accept-Ranges: bytes..OK..

GET /imgn/v32/selogo_111207.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p8.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/png

Content-Length: 12155

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...a...?.....V.......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /?22014 HTTP/1.1

User-Agent: ...............

Connection: Keep-Alive

Host: 123.sogou.com

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:17 GMT

Content-Type: text/html; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

P3P: CP="NON DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa HISa TELa OTPa OUR UNRa IND UNI COM NAV INT DEM CNT PRELOC"

Content-Encoding: gzip
90c9................\.u/...gb!..=......`v..X........7.2....12N>6.A 
....@ @...$.yy...G.;..b...~.sj.Uw..I..21..[.T..sN..N......{....$..V3..
.{.~p_b"9=.......O.O|....y8.I..O..v.1ht.Nsz.......`.]..^[[K..R.^m..'..
....,?&......2.|?...]..|..1h..W>:}..g.N.<..........W~.......y..L
.;..O3.\...u..r.u..x...;p0.A7...6V.&..|zOr_..u..R..H.;....,M<x`.@k.
t....f'.................`...X.;..;X..V0.........w}......0.)=.)5...?...
............s.....N......n....v..............g.....3ZN.....}...M..t...
...8y..o..z.....x..H?{s.c...r...u....U..............{.....o.A.{.....#.
...^.y....^?v........}..K.~|...?<.W....[.....7....O....s?....?...g.
.._...7....4HB..?|.o...............;......n....c..$...J..6.&.X..D..V.&
..-......*....&...[.y<.....8}4.....hI...x..;......U.....K.....B.]K.
..........-|.Z\k. ...j!..^..Z..|....C.j.....?....u3....K..*)M8.J..~z.i
O.. ..t......Xr.. .?..b:.N.9.V..:...Z_..`N.....'Um..y_........8ht...}.
.CZ5R..f).Y5.-..1.!.V...V..V-....~5lo._:.. ...%.@.`........&.K....35lN
5.S..T.......zv....N...j...j....T.m...T..e....*..Je.mm..^..^Hw..v.J...
..-'...%........-g..ivz...*.-..' n...Bv.....Yn.No.......D...l..I...Y.6
;.`..V.[.l.e_&A3..}...{.Z}...zne.I...I..Q.W<..\.....B.....s..-J.. .
..[...P......0..Eh.,9..Z.._.&....59.v.Q...,......,....Uwq#..r....V!...
.......4HL|m...T...V.m.5*..B&.......G{k..*...2%..A.....M.;.F%1Y...bW..
)..p`.f.....z......j>.).?i..#..3.t 4h..3.....K... 6y2.E.E.?.......0
9([email protected].....;...~7..O ...j.;._i.s)..oW..I..........&g
t;...F..t..J.NyE""W0.M8..H?x..&A.O..e.4......1.,.h..a.........M...
<<< skipped >>>

GET /css/skin_.css?V=cr HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:22 GMT

Content-Type: text/css

Content-Length: 21

Connection: keep-alive

Last-Modified: Tue, 20 Sep 2011 09:23:40 GMT

ETag: "4e785b9c-15"

Expires: Wed, 14 May 2014 11:53:00 GMT

Cache-Control: max-age=259200

Accept-Ranges: bytes
/* skin default */...HTTP/1.1 200 OK..Server: nginx..Date: Tue, 13 May
 2014 04:49:22 GMT..Content-Type: text/css..Content-Length: 21..Connec
tion: keep-alive..Last-Modified: Tue, 20 Sep 2011 09:23:40 GMT..ETag: 
"4e785b9c-15"..Expires: Wed, 14 May 2014 11:53:00 GMT..Cache-Control: 
max-age=259200..Accept-Ranges: bytes../* skin default */.......


GET /v53/jsn/v53_123n.js?V=cr HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: application/x-javascript; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Thu, 08 May 2014 05:03:36 GMT

Expires: Wed, 14 May 2014 11:54:27 GMT

Cache-Control: max-age=259200

Content-Encoding: gzip
5206..............y...u/.U.).U......zC.....y..'R>......U...P...f.. 
....(.'..ls...;@...........).I.{.dK.d...nDdFVU....3sHtel7"nD..q....q..
...\.W.....vm4wW.9h.{^?...._g...].&..@........$t'C........v.;.*.......
(L;.?.p........._..w.?.d..g[.%Hg.G^8...Z.n........_8....z....~...|$...
.........?N..sv.`.......^..xsN.\t.....Y..........."%.....w.....o.=...u
`c...0.[=f6....G......~....`T....N...o%.x......`..{.vk.....*...A..E\I.
B.}...P#.....`g0j....$`p....C.Dg.>.j[.....dw...v.m...Y51..|.L....y.
.V...9.B4{..%....b..G......]....6.u..".9..D.{!......`';.z.......@.*z".
.6..X.o...C.#........;..xT..3...X..[i'..?v.}w=...w\.f.....r.wG1wG>.
.eL....qu...H ..j..*.a"....sYo.6k&.F!...i.....o.kh.*.:.Y..."....5s....
....f.15....."S6../.|...%..L..WJ0..'..V..1...,..>.z1..j. %. f..~...
.....s6znF.zS......X..?........p8t...VD.....n.4.'.F"j.a....c......K.N.
..'P......H..R...n.tb4.../._..Vr.....m.K..B.Xj,/........\X.7...r.. ...
s....&'......l.d...2-..~.o/J{.|.0...c;s\.i(...?\..G..>.u..x.....-R.
v...........3.-.2I.f.l.........k........4kP?...e.G..6..j.... .].tUO..h
.H.........I..enq.$&.}\ 3....5...Y8.8.?.la..Lv......75I.....0e..t"...Q
[email protected]....!a....F..w..]..x.,.^..46w...g.......,A.%..Rqy..[e|LpV.Z..z.
.7WZ.fc..(7....J...So&...z....2 ..Y.V.5..:s.....l^....#.../.gH.^{;;;.8
......X.=1. .3V..{$qg.ZbP..Bv..Z...... .s }.9....~..[..".E%.M.R.A....a
.)..{g....B...-.....6OS...v...1T..$...V-..l.T.v...p..z.t.3.c.)...{.YU 
.1.~.......a........q..8...W...y.W.%..p..h.........C.z..B=....B...:..T
..2...).9s..#..$..`...AoP...8..........hT.sN...`N...N....:....=g.$
<<< skipped >>>

GET /jsn/hotdata.js?V=1399956570493 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: application/x-javascript; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 13 May 2014 03:59:57 GMT

Set-Cookie: IPLOC=UA; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Expires: Fri, 16 May 2014 04:49:25 GMT

Cache-Control: max-age=259200

Content-Encoding: gzip
c63.............YkO..../D..."....^..lc.`I ..H...=..........{.z..{.....
,..f.^.NUWw..<..'?Z...skz.....[..t.K.2.i.{...i3.lf;.lP...{.H..H...O
k........i..7:..>.'.Q:>k.K....g.Sq"...Mgv..._...Q.~.t~.I.}.o.A..
.ju>~h|<.......Y.bx.M.Nn.&.....(.?......cO.u..2Qk}.......*...N..
9?..A.....?.T.z];8......................(.>z?..._.O....[...r...~...
..ZZ.w..x...t...L.N6c...eg.U.f.].Y....5..T^PY..-.....J...c!....X...g.i
..r.f...L....(..&.Z.C"..J.*.....b.|>..4..^sx.cC..P...F...61_{-.Z(..
..},.....:*.uB......dw8i......$-...]z....z...iR...s.....F.UE.(5LT..'..
.F..F.l.p..3..h/.B#.2.,...T!C..4...v.E.$...f..8Yh....z.UY.Z..m.kk#/#..
..Q-Y*...*.....Z{.....T..X..7Xy.....2?..4..u..s....|.. r..GU..<....
.L.xq..f..C..J .(.p. ..}(.E.y......V..YI.Q.y.. .....^.`j.;....4....'.f
...d 8N1..#]F.`6..V....................4...v{.G.9xO...~........f.^...[
.......1..McP.il..R;....u.k.tI.i...\[email protected].....\Q.r<. L..p..|%
f]....!.n..{w?.i'...F!.....[..........*..V`.U.>..^s0..;.8H[....2."V
e....2..a..W3&n{.4 ..Q.I'.D._ .{...u....a..m.....[!..fGh.....!l.*..\..
D.|.X...jJ.:.r).......|.Yw.#I....R ..9.......T{.N.9M ....JT;..::..a=..
..T..:........88>.......!#.g.r.t......<.@]F..>H..n.......o...
.G.P&.\.......!.|.%#&b{.....It.Gu.....Q.Aj..G...'TEQ.=..r.T.:...A...1~
.....z.U.ly.Q.... ZdK....g....x....4.5.P.EA.H.....x.RN%A. [email protected]....
:.._....~.........Ow..5W..d.t.(....Ut.....* -....Q.s.!.......*z......V
......L...^3.P=B...............9} .....dt([email protected]
.s.H..2....MHY....RC....:.T1....)..'y...Ce....]...#qQ....j...A#(.I
<<< skipped >>>

GET /images/weather/cloudy.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; IPLOC=UA; GOTO=Af22014; SUV=00461146C18AF4E75371A4556E6A4053

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:26 GMT

Content-Type: image/gif

Content-Length: 1663

Connection: keep-alive

Last-Modified: Sun, 09 Oct 2011 10:21:06 GMT

ETag: "4e917592-67f"

Expires: Sun, 18 May 2014 09:22:30 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a(.(.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..............................y.......................................
......................................................................
......................................................................
......................................................................
...........!.......,....(.(........H......*\......#J.H1..t..bCa..(Q..e
L(..7........H..x]..H..ff\[email protected]..
...ajT.Q..H.#F......Xa.....04. eS...z.*E....E.......?Ql...'.&*.k402...
6l.D...L#(v<.2....g..)Q....W#0..!.G//q.....N.0.....Q........... 2x.
..........y....Z...Yx...#Sh..$....~..8.a..KY...*[email protected]......
..q..r.".X.B.^..I.1...;.es...$....x"..q$QA.)\....X`..P.......J8.....aq
p...L..!..`.1..r.......".....h.N7.}..$...C.Q......P.(<....?....t...
..!.N45.B.*[email protected]...<!$.20P`..Pd.. Y....)..B..
......H............"..#..........D.Z,...E.RD 3... \,..;.T..2V`.H.. .D"
L......A.!R.!B.....C]$..0[...4R.2..D..A!j...0?DAG..84.&.T1..R....6H!..
eD.B..t.......-s81.......?.R./..1F...D..v....O..H#..-uB..3.=Xc....
<<< skipped >>>

GET /v53/get_tj.php?hz=4666521&ids=qiche HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://123.sogou.com/?22014

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; IPLOC=UA; _seCityCode2=CN110100; tjv2_cont=00_01_08_09; GOTO=Af22014; SUV=00DD04B9C18AF4E75371A458B1D10495

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:31 GMT

Content-Type: text/javascript; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.1.6
10b3..{"qiche":[{"tab":"\u6c7d\u8f66","taburl":"http:\/\/123.sogou.com
\/shwz\/qiche.html","list":[{"picurl":"http:\/\/pic4.xcarimg.com\/img\
/news_photo\/2014\/05\/12\/fIXLig2wT89333.jpg","url":"http:\/\/price.x
car.com.cn\/serise166\/city9999-1-1.htm?zoneclick=100517","title":"\u5
1ef\u7f8e\u745e\u21934.1\u4e07","price":""},{"picurl":"http:\/\/pic1.x
carimg.com\/img\/news_photo\/2014\/05\/12\/1oq9Gg9Y3L8813.jpg","url":"
http:\/\/price.xcar.com.cn\/serise601\/city9999-1-1.htm?zoneclick=1005
17","title":"\u5e15\u8428\u7279\u21933.6\u4e07","price":""},{"url":"ht
tp:\/\/price.xcar.com.cn\/serise1087\/city9999-1-1.htm?zoneclick=10051
7","title":"\u6bd4\u4e9a\u8feaS6  \u73b0\u91d1\u4f18\u60e01\u4e07\u514
3","color":false},{"url":"http:\/\/price.xcar.com.cn\/serise1608\/city
9999-1-1.htm?zoneclick=100517","title":"\u65b0\u4e00\u4ee3\u8f69\u9038
  \u4f18\u60e01.7\u4e07\u5143","color":false},{"url":"http:\/\/price.x
car.com.cn\/serise257\/city9999-1-1.htm?zoneclick=100517","title":"\u6
bd4\u4e9a\u8feaF3  \u73b0\u91d1\u4f18\u60e01\u4e07\u5143","color":fals
e},{"url":"http:\/\/price.xcar.com.cn\/serise1338\/city9999-1-1.htm?zo
neclick=100517","title":"\u5954\u9a70GLK\u7ea7 \u8d2d\u8f66\u4f18\u60e
05.5\u4e07","color":false}]},{"tab":"\u65b0\u8f66","taburl":"http:\/\/
123.sogou.com\/shwz\/qiche.html","list":[{"picurl":"http:\/\/pic5.xcar
img.com\/img\/news_photo\/2014\/05\/12\/O2xA3C6VhB1569.jpg","url":"htt
p:\/\/price.xcar.com.cn\/serise1261\/city9999-1-1.htm?zoneclick=100518
","title":"\u9038\u81f4","price":"\u964d2.6\u4e07"},{"picurl":"htt
<<< skipped >>>

GET /imgu/2014/05/20140512170546_833.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p9.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/jpeg

Content-Length: 4723

Last-Modified: Mon, 12 May 2014 09:05:46 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
......JFIF.............0Exif..II*.......1...............VVV.meitu.com.
...C..................................................................
..C...................................................................
....=._...............................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?.....0..4.....2..:v...".j.2Z
.=.NQ...?..{..r...FH.k..V..6t.1k].}*......Q.Gs..8?.j..".Z0...=..>'.
.m...}..2].........c. ..W.*>...9jBQ......H.t..n...E..7......1.9..K.
.G.'.3...K$..i..^......E.....MJ.S.YL.kef.7............~f....4..g.N.\ms
.[....>.~..?.k...>..'..GE.x......=>.{..Ve...x.e|J...@ ..$...S
.8..FV.6kB........{./...._.>(j..~#iia.h......t.A2r.2...`......tj.M{
........f5..\...Y..X...Mc....2.>.....{I...U.......ZS.i.....[X....} 
X.Ah.`I...t....}.*..d.f..2.....i.h...V....gf.r......}..:..Q((J.3...u..
^.d..t.N.Wq....JM.rH.f........K...0..x.kf.k..F.0..S.........f....g...n
O....Gj.p..V.wZt:'_....<...|..4v.II..s.'5........#*.....>1|2...i
i.m8B......G.......$.Dy.i....O......>.......a.....-.O.............l
.....N.5.P2....I.Y.85....k....<...S......<.w.s.....'.mlu......[.
K..\.)%..6.....w.Sx...c...E....k.h...{..{_~...o.........-t...F....
<<< skipped >>>

GET /img/news_photo/2014/05/12/fIXLig2wT89333.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pic4.xcarimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 12 May 2015 04:00:18 GMT

Date: Mon, 12 May 2014 04:00:18 GMT

Server: Apache

Last-Modified: Mon, 12 May 2014 02:55:05 GMT

Cache-Control: max-age=31536000

Content-Type: image/jpeg

Content-Length: 5534

Accept-Ranges: bytes

Xcar-Cache-Server: imgcache2-HIT

Age: 1

X-Via: 1.1 zjjx158:80 (Cdn Cache Server V2.0), 1.1 gl25:1 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:104A21BBC38311E382E2ECE6B616ED1C" xmpMM:DocumentI
D="xmp.did:104A21BCC38311E382E2ECE6B616ED1C"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:104A21B9C38311E382E2ECE6B616ED1C" stRef:doc
umentID="xmp.did:104A21BAC38311E382E2ECE6B616ED1C"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................U._.................................................
.............................................!..1.Q#..A".aq.2BR.3D&...
...................!1..AQaq..".........2R#3............?....N.8D...N.8
D...N.8D...N.8D...N.8D...N.8D...N.8D...N.8D...N.8D...N.8D..~..?.1.wK..
d...#...9..."....3L.E..pv.pPV(.....B...0..f.....Q.1?%W9C.~.c93....y..:
I......9;..m.:.S1..W'0.c......aI.3.T.....N..0^...U..I;&...S.v.{N.:/s..
N.......u..9T.T..S,...R..NJw...&<?uhUe...wY..f<.`MV..4.../..
<<< skipped >>>

GET /hezi/jm/setup_a7158.rar HTTP/1.0

Host: VVV.sj88.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:28 GMT

Content-Type: application/x-rar-compressed

Content-Length: 3732104

Connection: close

Last-Modified: Wed, 07 May 2014 07:50:55 GMT

X-Cache: EXPIRED

X-Cache: HIT

Accept-Ranges: bytes
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L....WZR............
......................... [email protected]=9...
[email protected].........
......................................................................
...............text...,........................... ..`.itext..D.......
.................... ..`.data........ [email protected]..
...V...0...........................idata..............................
@....tls.....................................rdata....................
..........@[email protected]................ ..............@..@................
....................@..@..............................................
......................................................................
[email protected]............
@...string([email protected]......@...............................@.....
.... 9@.([email protected]@[email protected]@[email protected]@..9@.,[email protected]@[email protected].%..A....%..A.
...%..A....%..A....%..A....%..A....%(.A....%..A....%$.A....%..A....%..
A....%..A....%..A....%..A....%|.A....%x.A....%t.A....%p.A....%l.A....%
h.A....% .A....%d.A....%`.A....%\.A....%..A....%..A....%..A....%X.A...
.%T.A....%..A....%..A....%..A....%P.A....%L.A....%H.A....%D.A....%@.A.
..S..........$D...T.J....D$,.t...\$0....D[..@..%<.A....%8.A....
<<< skipped >>>

GET /img/news_photo/2014/05/12/1oq9Gg9Y3L8813.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pic1.xcarimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 12 May 2015 04:00:18 GMT

Date: Mon, 12 May 2014 04:00:18 GMT

Server: Apache

Last-Modified: Mon, 12 May 2014 02:55:16 GMT

Cache-Control: max-age=31536000

Content-Type: image/jpeg

Content-Length: 5243

Accept-Ranges: bytes

Xcar-Cache-Server: imgcache1-HIT

Age: 1

X-Via: 1.1 tzwl37:8080 (Cdn Cache Server V2.0), 1.1 gl27:1 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:297A1A15C38311E387729AE07621B962" xmpMM:DocumentI
D="xmp.did:297A1A16C38311E387729AE07621B962"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:297A1A13C38311E387729AE07621B962" stRef:doc
umentID="xmp.did:297A1A14C38311E387729AE07621B962"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................U._.................................................
..............................................!1....AQa#.R$."2Br%.....
..................!1.AQa...q.."..BR...$............?..................
...........................................03.X..5,.......d[DUy (.e...
|{b....Q.P.PI..R.!.L....8C}....1.X.... .`1..i ..jR....t.p.7.......8T.a
....*...........2V..:..w..?....!.s... nl.@....)..vK(.S&t}..l....A.....
0.J...0...*....".....2....3(E=0  v92.>."D.;. *..Cn.....Q=..VS.D
<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: lvdou.300duo.com

Connection: Keep-Alive

HTTP/1.1 302 Object moved

Date: Tue, 13 May 2014 04:49:23 GMT

Server: Microsoft-IIS/6.0

Location: hXXp://123.sogou.com/?22014

Content-Length: 148

Content-Type: text/html

Set-Cookie: daohang=1; path=/

Set-Cookie: ASPSESSIONIDAAQBQDRT=LPBGIBHAHMIAKLCFMNMJAIJH; path=/

Cache-control: private
<head><title>Object moved</title></head>.<b
ody><h1>Object Moved</h1>This object may be found <a
 HREF="hXXp://123.sogou.com/?22014">here</a>.</body>.HT
TP/1.1 302 Object moved..Date: Tue, 13 May 2014 04:49:23 GMT..Server: 
Microsoft-IIS/6.0..Location: hXXp://123.sogou.com/?22014..Content-Leng
th: 148..Content-Type: text/html..Set-Cookie: daohang=1; path=/..Set-C
ookie: ASPSESSIONIDAAQBQDRT=LPBGIBHAHMIAKLCFMNMJAIJH; path=/..Cache-co
ntrol: private..<head><title>Object moved</title><
;/head>.<body><h1>Object Moved</h1>This object ma
y be found <a HREF="hXXp://123.sogou.com/?22014">here</a>.
</body>...

GET /?22014 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:17 GMT

Content-Type: text/html; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

P3P: CP="NON DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa HISa TELa OTPa OUR UNRa IND UNI COM NAV INT DEM CNT PRELOC"

Content-Encoding: gzip
90c9................\.u/...gb!..=......`v..X........7.2....12N>6.A 
....@ @...$.yy...G.;..b...~.sj.Uw..I..21..[.T..sN..N......{....$..V3..
.{.~p_b"9=.......O.O|....y8.I..O..v.1ht.Nsz.......`.]..^[[K..R.^m..'..
....,?&......2.|?...]..|..1h..W>:}..g.N.<..........W~.......y..L
.;..O3.\...u..r.u..x...;p0.A7...6V.&..|zOr_..u..R..H.;....,M<x`.@k.
t....f'.................`...X.;..;X..V0.........w}......0.)=.)5...?...
............s.....N......n....v..............g.....3ZN.....}...M..t...
...8y..o..z.....x..H?{s.c...r...u....U..............{.....o.A.{.....#.
...^.y....^?v........}..K.~|...?<.W....[.....7....O....s?....?...g.
.._...7....4HB..?|.o...............;......n....c..$...J..6.&.X..D..V.&
..-......*....&...[.y<.....8}4.....hI...x..;......U.....K.....B.]K.
..........-|.Z\k. ...j!..^..Z..|....C.j.....?....u3....K..*)M8.J..~z.i
O.. ..t......Xr.. .?..b:.N.9.V..:...Z_..`N.....'Um..y_........8ht...}.
.CZ5R..f).Y5.-..1.!.V...V..V-....~5lo._:.. ...%.@.`........&.K....35lN
5.S..T.......zv....N...j...j....T.m...T..e....*..Je.mm..^..^Hw..v.J...
..-'...%........-g..ivz...*.-..' n...Bv.....Yn.No.......D...l..I...Y.6
;.`..V.[.l.e_&A3..}...{.Z}...zne.I...I..Q.W<..\.....B.....s..-J.. .
..[...P......0..Eh.,9..Z.._.&....59.v.Q...,......,....Uwq#..r....V!...
.......4HL|m...T...V.m.5*..B&.......G{k..*...2%..A.....M.;.F%1Y...bW..
)..p`.f.....z......j>.).?i..#..3.t 4h..3.....K... 6y2.E.E.?.......0
9([email protected].....;...~7..O ...j.;._i.s)..oW..I..........&g
t;...F..t..J.NyE""W0.M8..H?x..&A.O..e.4......1.,.h..a.........M...
<<< skipped >>>

GET //v53/get_123_v53.php?block=wt&ver=v53&gfg=1&city=unknown&pid=Af22014&c=1399956570478&method=ajaf&cbf=fn HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: text/javascript; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: IPLOC=UA; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

X-Powered-By: PHP/5.1.6

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: max-age=0
e02..sg_wt_cb({"cn":["110100","北京"],"wt7":[["2014-05-13"
,2,"多云","cloudy.gif",17,30,"北风 3-4级
"],["2014-05-14",3,"晴转多云","fine_cloudy.gif
",10,24,"北风 3-4级"],["2014-05-15",4,"晴ů
16;多云","fine_cloudy.gif",16,29,"微风"],["201
4-05-16",5,"晴转多云","fine_cloudy.gif",18,29,
"微风"],["2014-05-17",6,"阴","cloudy.gif",15,25,"
4494;风"],["2014-05-18",0,"阴转多云","cl
oudy.gif",14,24,"微风"],["2014-05-19",1,"多云"
,"cloudy.gif",16,27,"微风"]],"city":"CN110100","ip":"193.1
38.244.231","md":"05-13","week":"2","nongli":"四月十
五","tuanmv":"","pm":138});tjv2_cb({"tj_utag":"00_01_08","data":
{"news":[{"tab":"\u5934\u6761","taburl":"http:\/\/123.sogou.com\/xinwe
n\/","list":[{"title":"\u7f51\u6c11\u5728\u5883\u5916\u7f51\u7ad9\u62b
9\u9ed1\u4e2d\u56fd\u88ab\u5211\u62d8","picurl":0,"url":"http:\/\/news
.sohu.com\/20140513\/n399470242.shtml?pvid=7d0a16e31613c9e0","color":f
alse},{"title":"\u8700\u516c\u4ea4\u7206\u71c3\u7cfb\u4eba\u4e3a\u7eb5
\u706b\u5acc\u72af\u88ab\u70e7\u6b7b","picurl":0,"url":"http:\/\/news.
sohu.com\/20140513\/n399470183.shtml?pvid=7d0a16e31613c9e0","color":fa
lse},{"title":"\u4e4c\u514b\u51702\u5dde\u5ba3\u5e03\u6210\u4e3a\u72ec
\u7acb\u4e3b\u6743\u56fd\u5bb6","picurl":0,"url":"http:\/\/news.qq.com
\/a\/20140513\/000421.htm","color":"red"},{"title":"\u4e60\u8fd1\u
<<< skipped >>>

GET /images/weather/fine_cloudy.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; IPLOC=UA; GOTO=Af22014; SUV=00461146C18AF4E75371A4556E6A4053

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:26 GMT

Content-Type: image/gif

Content-Length: 1751

Connection: keep-alive

Last-Modified: Sun, 09 Oct 2011 10:21:05 GMT

ETag: "4e917591-6d7"

Expires: Sun, 18 May 2014 09:22:34 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a(.(.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.....................................................0..[..m..........
....D....................$.............................'..=..O..]..k..
6..M..w..............C..Y....................h.................Q..u...
...........J..Y..q.............................q......................
...........!.......,....(.(........H......*\....D..E..(."......I.%..6}
..(.F..6e.$J..h.......&M&O....S.w....6...w.@......J..Q..J.UU.X.R....M.
.&.I...U.b.Z....U..........>."g.T,T.f..% .-_.\.".-.... A.....Y.R.*F
l..f...j....P.0>.T...X.s......e...;......0v.....Z.HE.....|........v
.H6L...8S.........}<..)....i..i.%..#H....E.X1k...N.PxQB._.@.>. c
.(.4......K,.0..3.....J....B(.....S.6...."p...,.(.M7..s..T, ..R|@B.4..
b-.@..#.............C..H.........T..#.(..'..3. ..#..$....At.E.(.`..9..
.<[email protected]....(HQ...p....8.."..../[email protected]@.K....
.6...;....$....:..0A..D`..R. ..)l..." a..5...?.(.J4..!..2\..... ...x..
..L...Y......y."...O.0(@..C.!E..t....4Q....pB.-.....`.-B...C...Q..]...
.S,...K....?....,...8...B.W(`..$..F.%|0..JLpB.A....O..2.....=5..@.
<<< skipped >>>

GET /favicon.ico HTTP/1.1

User-Agent: ...............

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; IPLOC=UA; _seCityCode2=CN110100; tjv2_cont=00_01_08_09; GOTO=Af22014; SUV=00DD04B9C18AF4E75371A458B1D10495

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:35 GMT

Content-Type: image/x-icon

Content-Length: 1150

Connection: keep-alive

Last-Modified: Wed, 21 Sep 2011 09:58:33 GMT

ETag: "4e79b549-47e"

Expires: Sun, 18 May 2014 09:22:29 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
............ .h.......(....... ..... .....@...........................
........ddd.aaa.___.]]].[[[.XXX.VVV.UUU.............................ii
if............................VVV.UUUl....................}}}.........
............................fff.UUU................o..........v..t...q
..........................bbb.UUUQ....xxx...........F..o..............
.y............A.........VVV.UUU....v.........b...{...........}....!...
............ .....~~~.VVVT.........r#..o...w...v...h....E.............
.....w..........XXX..........W...q...h...y(...........................
....U.....[[[..........X...g....E..........................y......../.
....]]]..........g...[........................v..p............G.....__
_...........P..l...................b...o...~.......y..........aaa.....
.........^...............X...s...x...|...|...n..........ddd-..........
...................T...l...o...m...b..........~~~.....................
.................{6..o ...Z.............kkk...........................
..............................qqq............................&........
................... ..................................................
..............................HTTP/1.1 200 OK..Server: nginx..Date: Tu
e, 13 May 2014 04:49:35 GMT..Content-Type: image/x-icon..Content-Lengt
h: 1150..Connection: keep-alive..Last-Modified: Wed, 21 Sep 2011 09:58
:33 GMT..ETag: "4e79b549-47e"..Expires: Sun, 18 May 2014 09:22:29 GMT.
.Cache-Control: max-age=2592000..Accept-Ranges: bytes.............. .h
.......(....... ..... [email protected]
<<< skipped >>>

GET /imgn/tips/lk_jumei.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p0.123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: image/png

Content-Length: 731

Last-Modified: Thu, 28 Feb 2013 09:01:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:25 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...6...).............tEXtSoftware.Adobe ImageReadyq.e&
lt;...}IDATx.b<.2....3`., .6........@.$#...&..@.@..................
..A.1.;..v.....w-.s`[email protected] ......?R4.m......$..v.....H...@
.......7Ab.@/.  4...D.&`..'Y.C.|..5.".n.A.....KX.g'......KF$.3R.(c.K..
&...6zZ.@[email protected]......!]|vGJ%.......F`........gtO .j..!|....L.{..J...B.
AN....,:...9r......,..Tx...z....N...Q.......0..........yr.>.......5
.r.a.....]..>./..W2@.)...=..F-.k..g.hb....6........... .z0@.:.*.@y.
/@.!7x`...E......P..._c.~|.K`?X....u..%.!.)pr.....A......&...Xa~.n...r
q.c..#.cQbr...c......hZ....h...S..]j....S...v%..i.Y.o...E..8......}.AG
...=..T..\...V...Rx.=.j.~..."9.".....F=62=......... [.011...O........ 
.......GpA1...$Pu.......7.W.%x.....IEND.B`.HTTP/1.1 200 OK..Server: ng
inx/1.4.1..Date: Tue, 13 May 2014 04:49:25 GMT..Content-Type: image/pn
g..Content-Length: 731..Last-Modified: Thu, 28 Feb 2013 09:01:24 GMT..
Connection: keep-alive..Expires: Thu, 12 Jun 2014 04:49:25 GMT..Cache-
Control: max-age=2592000..Accept-Ranges: bytes...PNG........IHDR...6..
.).............tEXtSoftware.Adobe ImageReadyq.e<...}IDATx.b<.2..
..3`., .6........@.$#...&..@[email protected].;..v.....w-.s`..
[email protected] [email protected].@/.  4...D.
&`..'Y.C.|..5.".n.A.....KX.g'......KF$.3R.(c.K..&...6zZ.@[email protected]......!
]|vGJ%.......F`........gtO .j..!|....L.{..J...B.AN....,:...9r......,..
Tx...z....N...Q.......0..........yr.>.......5.r.a.....]..>./..W2
@.)...=..F-.k..g.hb....6........... .z0@.:.*.@y./@.!7x`...E......P
<<< skipped >>>

GET /15909623.asp HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Referer: hXXp://tongji.uujzy.com/tongji.html?5.0.0.5002_id61_md1_os1

User-Agent: session

Host: img.users.51.la

HTTP/1.1 302 Object moved

Date: Tue, 13 May 2014 04:50:04 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Location: hXXp://vipimg.51.la:82/go.asp?svid=1&id=15909623&style=9&vpage=http://tongji.uujzy.com/tongji.html?5.0.0.5002_id61_md1_os1&46204.88.gif

Content-Length: 300

Content-Type: text/html

Cache-control: private
<head><title>Object moved</title></head>.<b
ody><h1>Object Moved</h1>This object may be found <a
 HREF="hXXp://vipimg.51.la:82/go.asp?svid=1&id=15909623&style=
9&vpage=http://tongji.uujzy.com/tongji.html?5.0%
2E0.5002_id61_md1_os1&46204.88.gif">here</a>.<
/body>.HTTP/1.1 302 Object moved..Date: Tue, 13 May 2014 04:50:04 G
MT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Location: http:/
/vipimg.51.la:82/go.asp?svid=1&id=15909623&style=9&vpage=http://
tongji.uujzy.com/tongji.html?5.0.0.5002_id61_md1%5
Fos1&46204.88.gif..Content-Length: 300..Content-Type: text/html..Cache
-control: private..<head><title>Object moved</title>
</head>.<body><h1>Object Moved</h1>This object
 may be found <a HREF="hXXp://vipimg.51.la:82/go.asp?svid=1&id=
15909623&style=9&vpage=http://tongji.uujzy.com/ton
gji.html?5.0.0.5002_id61_md1_os1&46204.88.gif">
here</a>.</body>...

GET /imgn/123ie/search_arrow.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p7.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: image/gif

Content-Length: 447

Last-Modified: Wed, 25 Jul 2012 09:14:49 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:25 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a................$..................O...........FC...............
QRR...{......{z.......m..li......fff......B...... %.<3.......l2.o.e
l......8.nWz{{58=.J....#r.T.....'....r|......Z.x4....&&'S.z...........
...3......YQ.............El..d,...4?......e...W...e.R}.....v....-.....
.... *.f...vQ...9.h..............b....s..r.....M.{dY.x.....F.IJw..j...
.l...)p]_..6.R...Xeqy2AvcY."y....i.....f..........!.....~.,...........
.~..............x.....x......;HTTP/1.1 200 OK..Server: nginx/1.4.1..Da
te: Tue, 13 May 2014 04:49:25 GMT..Content-Type: image/gif..Content-Le
ngth: 447..Last-Modified: Wed, 25 Jul 2012 09:14:49 GMT..Connection: k
eep-alive..Expires: Thu, 12 Jun 2014 04:49:25 GMT..Cache-Control: max-
age=2592000..Accept-Ranges: bytes..GIF89a................$............
......O...........FC...............QRR...{......{z.......m..li......ff
f......B...... %.<3.......l2.o.el......8.nWz{{58=.J....#r.T.....'..
..r|......Z.x4....&&'S.z..............3......YQ.............El..d,...4
?......e...W...e.R}.....v....-......... *.f...vQ...9.h..............b.
...s..r.....M.{dY.x.....F.IJw..j....l...)p]_..6.R...Xeqy2AvcY."y....i.
....f..........!.....~.,............~..............x.....x......;t>....


GET /imgu/2014/05/20140513112717_7.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p7.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/jpeg

Content-Length: 11976

Last-Modified: Tue, 13 May 2014 03:27:17 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:1D83D2A5C09EE3119
F67BC560D35722B" xmpMM:DocumentID="xmp.did:94D6195DD97C11E3BF6BA573D74
A4472" xmpMM:InstanceID="xmp.iid:94D6195CD97C11E3BF6BA573D74A4472" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:02B321837BD9E311B9DCEA1BD6C26215" stRef:docum
entID="xmp.did:1D83D2A5C09EE3119F67BC560D35722B"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................k._...................................................
.............................................!..1..AQ"..aq.2#...B$....
3..Rr.Cc.&.........................!..1A.Qaq"...2....B...r#...b.34.RCs
$5.6............?..S.........8z*.S./...].v.s/......5.t...6.......q[z5.
....SXF4.H...0S......c....7.E...;F.I)...E..<.T.~-...c.q>.m...3.-
.KL....d.H&R*...{..a.......W.n.....7.b...r6.d...i......7....xe.fp.
<<< skipped >>>

GET /cnzz/weather/weatherPng/cnzz.html HTTP/1.1

User-Agent: mfc5002

Host: weather51la.cnzz.uujzy.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:56 GMT

Content-Type: text/html

Content-Length: 2

Last-Modified: Wed, 18 Dec 2013 02:33:49 GMT

Connection: keep-alive

ETag: "52b1098d-2"

Accept-Ranges: bytes
OKHTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:49:5
6 GMT..Content-Type: text/html..Content-Length: 2..Last-Modified: Wed,
 18 Dec 2013 02:33:49 GMT..Connection: keep-alive..ETag: "52b1098d-2".
.Accept-Ranges: bytes..OK..

GET /favicon.ico HTTP/1.1

User-Agent: ...............

Host: lvdou.300duo.com

Connection: Keep-Alive

HTTP/1.1 302 Object moved

Date: Tue, 13 May 2014 04:49:23 GMT

Server: Microsoft-IIS/6.0

Location: hXXp://123.sogou.com/?22014

Content-Length: 148

Content-Type: text/html

Set-Cookie: daohang=0; path=/

Set-Cookie: ASPSESSIONIDAAQBQDRT=JPBGIBHAFGFCCDGADMHIOFKD; path=/

Cache-control: private
<head><title>Object moved</title></head>.<b
ody><h1>Object Moved</h1>This object may be found <a
 HREF="hXXp://123.sogou.com/?22014">here</a>.</body>.HT
TP/1.1 302 Object moved..Date: Tue, 13 May 2014 04:49:23 GMT..Server: 
Microsoft-IIS/6.0..Location: hXXp://123.sogou.com/?22014..Content-Leng
th: 148..Content-Type: text/html..Set-Cookie: daohang=0; path=/..Set-C
ookie: ASPSESSIONIDAAQBQDRT=JPBGIBHAFGFCCDGADMHIOFKD; path=/..Cache-co
ntrol: private..<head><title>Object moved</title><
;/head>.<body><h1>Object Moved</h1>This object ma
y be found <a HREF="hXXp://123.sogou.com/?22014">here</a>.
</body>...

GET /imgn/v32/selogo_111207.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p1.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/png

Content-Length: 12155

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...a...?.....V.......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /imgn/sehome/tjv1/subnav_v41.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/png

Content-Length: 3655

Last-Modified: Mon, 28 Jan 2013 13:46:09 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...............x.....sBIT.....O.....PLTE"5R..L4s...$.?
....fff............iV*.ji......t.........hC...)Bd.....k...........f...
...9..............Q`w..Y[ZZ.......YRGGG;`......k.4/..B..E...J..f......
....`.....}...-D.....zq...f......rP..T........N....eW...i|...r..`..LGt
...dR....<..................O....T..........MI.../Kr.J-...........t
..e.....}}.....333..I......wvw`..I}........iC......4U.....( ..........
.......3.....W.....:.."w....S........n..x.....B.....\..sAj...r..b.....
...d...........}b...........IYq...9X......Jr......m9.....Q.........]..
.....a..:.yR..G......Lz.k..........~..f........IEq...Qp........... Fj.
...............................m..Ko....^9].........z........jW.......
.T....S7Qs.....[..W..C..J....................................b..Cm.R}.
...........J..')Jk{.......:..cl..=d......k..;..H.....jLt.B..f....tRNS.
......................................................................
......................................................................
......................................................................
.............................................s.......pHYs...........~.
....tEXtSoftware.Adobe FireworksO..N....tEXtXML:com.adobe.xmp.<?xpa
cket begin="   " id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmln
s:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/
02/12-17:32:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1
999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:x
mp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com
<<< skipped >>>

GET /imgn/v32/titlebg.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:24 GMT

Content-Type: image/png

Content-Length: 2842

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:24 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.............b.......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /u/js/ufo2.js HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 06 Nov 2012 08:12:45 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Tue, 20 May 2014 04:49:25 GMT

Cache-Control: max-age=604800

Content-Encoding: gzip
600a...............v.G....<.....X.D.={...m.....MK.v7I{.R.A.......&l
t;.y..d.......!.g.Y..ZDU.=#.......]..M.|.....o.O..^..=\\.m..b9y4......
{...j.o...t1o..A.6>..G...}._....O.g....e..Y....e.x...W.....j...M.[.
...Yw..]..../{...b......n.;x..../F..w.%.G.Y.m....a.`.^.....l~S4.?:j...
...7..Y.U6[..n.=).......f]6..1..io1...../.I.u.^...u.mc..).....{..g =..
..f6k..o.`t.hPa.;.u.n....9j..............3.......u{w....4.J.....]X.Q..
.NK{<^,....|..f...Q.4.<.nOW_]]...0.(..f.dp.j.....t~S....f..h.e.h
.(..&.....y... {..g.....f.........f.?.6.([email protected]..[...
.*[email protected][email protected]>N.............l.wE?u%....l....Y...>u.W.
~.9.T0..G..........g.;(..js.Og..8a......V.W..`;.......?_.........a.q..
...*[email protected]..~5 ..u..<h...d}....4....u..J
p:.v...0...xhx..........9h.<>.........P5.!-...e..v..WM.K.Eg(....
0.n..W_.QN.v...}.e1f.....*&.aP.[.yw.._.. ..3...r].Mhr>...$|.6.....S
N.G..E.=.y..;.=).G...[0.Zm.G#.`X..........y...?.O.v..4o..M.... ..MGc..
>B...fV......<....~o_..IY/.........]....C.0....2..aN........w...
.w..n.n....u.|}5....b^..L....?x.>...h#.lY...&..V.c#...o. ..k?....vK
#.....l....^.`..0..t./..u.vS.H}.e....&v....m....02\.b?v.".......... .W
.0......=z..p9...0..k..~....Z...\.W...N.i....."?5.3..p.....m....t^....
e....V'5c...|..|6.nb..W?9....,[;.\....K......F..8`...~.p...cq"....N..=
.C.<j....x.S<.....C."^..g.C;w.}D,......Q..`....V|h..._.w..N....0
.%..?.S....|.R}..........1......t<~29...A.N.g.....Z......H.....Ec1.
....^s_..<....[.7{...!.....u2.... ...b8.A1.B8-...]._7.Z5.0.....
<<< skipped >>>

GET /update/365/365weatherIns_61.rar HTTP/1.0

Host: lm.beilequ.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Server: nginx/1.1.19

Date: Tue, 13 May 2014 04:39:38 GMT

Content-Type: application/x-rar-compressed

Content-Length: 1038034

Last-Modified: Fri, 21 Mar 2014 05:24:42 GMT

Connection: close

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1H..u)..u)..
u)...&..w)..u)...)...&..d)...6...).../..t)..Richu)..........PE..L.....
:J.................\...........2.......p....@.........................
.`...............................................s.......p............
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
..>[email protected].>[email protected]
...Pr@..}..e..9}[email protected]........ M............U....M....3..
.3..FQ......3..NU.....M..........VT..U.....FP..E...............E.P.M..
[email protected]@..u....E..9}[email protected].}.j
[email protected]@[email protected] ...Pj.h.6B.W..Xr@.
.u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.
;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F..
<<< skipped >>>

GET /cnzz/weather/5.0.0.5002/weatherdata/_61/cnzz.html HTTP/1.1

User-Agent: mfc5002

Host: weather51la.cnzz.uujzy.com

Cache-Control: no-cache

Cookie: city=101010100

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:50:02 GMT

Content-Type: text/html

Content-Length: 198

Last-Modified: Wed, 16 Apr 2014 09:44:13 GMT

Connection: keep-alive

ETag: "534e50ed-c6"

Accept-Ranges: bytes
a556f5dd20dcbdfb274d34f5c504a160$2d204d39f2faa25896874c01c0135d760$bca
7b8d364fc9c89c96702a19aa47a00$d8099717b5894a1c926de4f6fe36e650$bf60bba
bd09f5e0270f38adbc02d36b0$b982497d26da6f0218296012b54c5ab0HTTP/1.1 200
 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:50:02 GMT..Content
-Type: text/html..Content-Length: 198..Last-Modified: Wed, 16 Apr 2014
 09:44:13 GMT..Connection: keep-alive..ETag: "534e50ed-c6"..Accept-Ran
ges: bytes..a556f5dd20dcbdfb274d34f5c504a160$2d204d39f2faa25896874c01c
0135d760$bca7b8d364fc9c89c96702a19aa47a00$d8099717b5894a1c926de4f6fe36
e650$bf60bbabd09f5e0270f38adbc02d36b0$b982497d26da6f0218296012b54c5ab0
....


GET /cnzz/weather/5.0.0.5002/weatherdata/_61/WeatherContext.xml HTTP/1.1

User-Agent: mfc5002

Host: weather51la.cnzz.uujzy.com

Cache-Control: no-cache

Cookie: city=101010100

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:50:04 GMT

Content-Type: text/xml

Content-Length: 509

Last-Modified: Fri, 21 Mar 2014 04:22:34 GMT

Connection: keep-alive

ETag: "532bbe8a-1fd"

Accept-Ranges: bytes
<html>..<title>........</title> ..<body scroll=no
>..<skin>..<name>skin.xml</name>..<path>htt
p://conf.f.360.cn/status.html</path>..<hash>ffa9975d557f92
25ae0a0eb80212b98f</hash>..<size>0</size>..<type&
gt;0</type>..<cnzz>hXXp://int.dpool.sina.com.cn/iplookup$c
nzz_ID_0</cnzz>..<cfg>hXXp://weather51la.cnzz.uujzy.com/cn
zz/weather/5.0.0.5002/</cfg>..<cfg>hXXp://weather51la.cnzz
.alivcd.com/cnzz/weather/5.0.0.5002/</cfg>..<tqy>AQI.5002.
exe</tqy>..<chx>worldWeatherRealTime5002.exe</chx>..
</skin>..</body>..</html>HTTP/1.1 200 OK..Server: ng
inx/1.4.1..Date: Tue, 13 May 2014 04:50:04 GMT..Content-Type: text/xml
..Content-Length: 509..Last-Modified: Fri, 21 Mar 2014 04:22:34 GMT..C
onnection: keep-alive..ETag: "532bbe8a-1fd"..Accept-Ranges: bytes..<
;html>..<title>........</title> ..<body scroll=no>
;..<skin>..<name>skin.xml</name>..<path>http:/
/conf.f.360.cn/status.html</path>..<hash>ffa9975d557f9225a
e0a0eb80212b98f</hash>..<size>0</size>..<type>
0</type>..<cnzz>hXXp://int.dpool.sina.com.cn/iplookup$cnzz
_ID_0</cnzz>..<cfg>hXXp://weather51la.cnzz.uujzy.com/cnzz/
weather/5.0.0.5002/</cfg>..<cfg>hXXp://weather51la.cnzz.al
ivcd.com/cnzz/weather/5.0.0.5002/</cfg>..<tqy>AQI.5002.exe
</tqy>..<chx>worldWeatherRealTime5002.exe</chx>.
<<< skipped >>>

GET /imgu/2013/08/20130820165531_481.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p6.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:24 GMT

Content-Type: image/gif

Content-Length: 2049

Last-Modified: Tue, 20 Aug 2013 08:55:31 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:24 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a..y....1.....A.....c........t..S........9........I........Y..j..
.........<..L.....y.................X...........T..s.....J..J..a..c
....................................................................!.
....*.,[email protected],....r.l:...tJ.*.X.*......6.]...3Z.^.........^..
m........M\fDyH.[G.t.D.t.D........D..Y.X..D..........C..............c_
x.......K..J. C.J....*..H......I.Y...I....J....".....G..X..H.....@....
...".`O..e.28A....%..a..B... C...a...I.....$..EF\[email protected].. 2........h0
d...H."e9AH....X.....1.....5...U.....lY,[email protected]....$......
.'.....@ 8".Wc.]..U. ...."\[email protected]..;....8..A.;.....
..........@..%[email protected]..>.p..C,..H@..@......"
.]...u.B...0.....S...A.].."A......X(.............z\80Ak...@[email protected]..
..g..#)..v.p... [email protected].,[email protected]...\D..X.Q......9Ch..\B..@.
ExW...`..5.`..[CH..5Hx."...@X..,..nF .H0W0....F...*[email protected]...
&%.....0.wX.p....!......{XL"`..0P.v.bq....`A..0.......}h9....(@..]9...
...M\.T.... ...........W......:P.p.d?.DG.B..OA.<. .....U&..U.x.y...
[email protected]....(...@.....,...(
4...Ll....`.4.....5.p...D.pY.>.,F...q.......K..A.X.)....-.......B.P
c....x .0p.`.0...^....C|l.........V..........!.".*3.BT........oX B&.q.
..s.$`[email protected]]..m^@......!..A..k.6.b.yD..d.....o.Gc.$L.y.
.Bj^...S..O.S...............R?.E.Fz... [email protected]%...m]..
.......... ..@...........&$...`*..n.C....?....0..0 b.b..Dh..0....L.aH.
*R..(.........>F.M.p(.S...g<.....5.!Bi,...t.9.....c..p..de..
<<< skipped >>>

GET /jsn/v33_sugg_ajaj_v40_3.js HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: application/x-javascript

Last-Modified: Fri, 02 Aug 2013 03:01:34 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
12ba.............Z{w.........5{<."..;..Y.q...W<..;.\6.A.d.......
...VK.;...............5J.a..~-..Az...*..W.HM....j.....XJ0xt..R_. k.es.
..c.l..Y.Dz.;.......m...HUn..gJ}..k...,...z.:.3...J&n.-,6^.s..5...vS..
.`...Oc..Bw..z...T.Rz..4qm.~.N.T4...8.?`...........N.I......6....}...F
.......9....v....;q....h...A4c....V...F.....k&j..a...91#.n....x...s...
..N..`.h$M......}....?...?...=Yl..8K...................k.ZhA.o...ol.}.
..p....~n9I.. ..$.......L...w.......g....H...|f...4ADSy.(.......=^..v.
...v.'......u...gC..'*..*....#....Z......o..*.#'I#.v.....s.\>..6...
...5[c.|Vb.....l.l..k7N...._..D.....4.$l8.d...J..........m.....%.Z.F..
-...>.3...k....a.D....U... 3U...]...w........c2...(..a...VO.$I.....
....s}...M9N.q.=.....9.0..._...,.|.He....r...........>g^....u.%....
7.....DU..*..J....R'i.h%Q@.<.........%.7..%pVbO....V1'!!^..}...caj.
b\......Qv....(.i.S.."..|...a..1..........X.....l.,9n....x0..6Tg......
..S.8.36&K..hhA....U.T.J....-.'.J..i..)...l.5.v.ih..w..l...fS.y..5...7
o....i...P ..V......x.M..Z4.:[email protected]...<..|.{
X.o`!_..K.P.....a....>./...*/.|......m.X.W.!.....$...r(..4.....0|..
|.* LzF.3->..k..:.X...\.].........Q..{._....'........Q9M.........q.
..........K.....GH..I..c.U....e>.../.'=N...-......W..^Y.p.!..>].
.:.NU..GM..^o.9N.%.(GAD.v.&I...!.s.q2..F..q...."h....%...o.".M......H)
..,...(..,[email protected]|...{..*....`x.....:...A..S......r.?}....!.`.0..&..!..#
.#";.#....e3.0gG.J.=#..a.......Oz.|.q`..D.L... .z.....#..=6t.RTla)...[
Gz'B3..:...b.SZ.}#W9.W...Vi....U>.)W.g....dZ(.. ....S.j>...#
<<< skipped >>>

POST /post/ HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.xzsky.com

Content-Length: 137

Connection: Keep-Alive

Cache-Control: no-cache

mac=00-0C-29-8A-8B-37&soft_id=33&tuiguang_id=C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\365weatherIns_61.exe&yanzheng=318d97cc71dd4de571edddf8241ae5c0
HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:38 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.15
0..HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:49:
38 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connectio
n: keep-alive..Vary: Accept-Encoding..X-Powered-By: PHP/5.3.15..0..

GET /pv.gif?uigs_productid=ufo&ufoid=ads&ptype=ads&pcode=ads&rdk=1399956570087&img=extra.gif&yyid=&ssuv=&m=&loc=&module=show&tag=172 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pb.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:28 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive

Set-Cookie: SUV=00DD04B9C18AF4E75371A458B1D10495; expires=Fri, 10-May-24 04:49:28 GMT; domain=.sogou.com; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
HTTP/1.1 200 OK..Server: nginx..Date: Tue, 13 May 2014 04:49:28 GMT..C
ontent-Type: text/xml..Content-Length: 0..Connection: keep-alive..Set-
Cookie: SUV=00DD04B9C18AF4E75371A458B1D10495; expires=Fri, 10-May-24 0
4:49:28 GMT; domain=.sogou.com; path=/..P3P: CP="CURa ADMa DEVa PSAo P
SDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..

GET /imgn/v51/new-erweima2.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:28 GMT

Content-Type: image/png

Content-Length: 18683

Last-Modified: Mon, 08 Jul 2013 10:16:12 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:28 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...,...,........"..H.IDATx....x.U..'.R.D.Q....*...]A.;
".".... 5$.%....I.=....^............?.I\2w.,......'..\....;..s....D...
...H.!.D..H$..D".I$.AH"..$.. $..B.... ...tuu..lcc..=.....}.6v.....S.wb
aa..Dv..[$.|..!.=..9.....d....;......[?w..M..'.l....[.....d.....U.. $.
.B.. $..B.. $..B.. $..B.. $......AH..!|....t.....:.?......c........gi.
....:::.s.p........{^.j.....~X..B1!...g..|.r.9..;W........J......yx>
;>>.sdB.....T..I.bgm.......~.Mu......V.....j....P4.d.........4n.
MEK..1...5.tjjj............O^.h.....F.<..:...!AH....!AH....!AH....!
A.~......yE.H.....!Ax..v..d..............j....U....*.%x..{d:.:.B.._vv.
........."l..$.......OSS...g....y..'......l......rrr..z.@(..3..T<.]
.B......!CT.Ph.d.U. ...2....,.p.....@$::Z.........x.T<A<..!AH...
[email protected].........(.....,l.k.
...7z..N.P^....O.....2R.!.qGA(..$.;.Y.........w[...C........l.qI....,!
AH....!AH.>x..t.@(..!Te%aGA...".....!..QY..Z....5..d....%$..B.. $..
B....N..[o.....^b6.>|.(.._..K?..#[email protected]...={V..
......VVV2/..o.).AOO.y....#?.}l.;Y.V. ...=L._...bqL'..Q*.W..3......J%.
..(AH....!AH....!AH....!AH....!A.i.".....i....G.yDx.......f.....m.....
[email protected].......]]]...N.y...P.ekx.T|P........B.....LK...
......X.....~...b......!AH....!AH....!AH....!AH....!AH....6.C....s...*
....k......2...7O....Lu.?....,..9Sx..b.tv...P.C.F...c....7..y......6l.
6...e6f..|....c(...N~P.F'A.E..A.X..:.(....'T*[email protected]..]G.!AH....!AH.
...!AH....!AH........n..<W.c...c.....&..w1.....{V....;.= .)hjjz
<<< skipped >>>

GET /imgn/sehome/tjv1/img-news.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/gif

Content-Length: 225

Last-Modified: Fri, 11 Jan 2013 08:57:48 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a................................................................
.......................................!.......,..........^...dY"I"(..
.pl...$.0.|..6... .P..c..1....psF..TbZM......M${[email protected]
%.fD...)..#.!.;....


GET /imgn/sehome/tjv1/img-video-2.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/gif

Content-Length: 225

Last-Modified: Wed, 15 May 2013 13:45:48 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a................................................................
.......................................!.......,..........^...di....J.
.. .k..O.......cT..t.F.A(...@ ...TN.Tz| .*......R....>..e.<R..A6
.....D'..@..')'.#.!.;HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 
13 May 2014 04:49:32 GMT..Content-Type: image/gif..Content-Length: 225
..Last-Modified: Wed, 15 May 2013 13:45:48 GMT..Connection: keep-alive
..Expires: Thu, 12 Jun 2014 04:49:32 GMT..Cache-Control: max-age=25920
00..Accept-Ranges: bytes..GIF89a......................................
.................................................................!....
...,..........^...di....J... .k..O.......cT..t.F.A(...@ ...TN.Tz| .*..
....R....>..e.<R..A6.....D'..@..')'.#.!.;..

GET /imgu/2014/05/20140508103513_537.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p4.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/gif

Content-Length: 21959

Last-Modified: Thu, 08 May 2014 02:35:13 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89ai......SSS.ww........\.......c;/.W...i......C.hhh.R.............
.........................vE.....................-.......Z...bbb~~~.=..
...]8....t...."*........dd.......A....S............%..............D..=
....DDD.K.....kH.....h...................BB...)1.TZ........$$.SSJJJ.::
...qqqdj..........\c..........4<......4vvv.,,.22.ZZ.......j .......
............nn......ty.>>>....z\lll..........]#....KK........
.....qR.L$....f ............:B...x......................R,......yyyCJ.
...........{.....b%-............mh...n7.....r...JQ.....a'.K..~O.6.....
...}`.....c......lq....}............G.....R$.....p.E...b.....m~...V..^
 .G...z..s.......vW.}Z.G.....P......~.Z0.............9..............D.
@[email protected]'/..>>.K..F.. ....\s..............
XL.....w....,&..f.....h......!..XMP DataXMP<?xpacket begin="..." id
="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/
" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27     
   "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-synta
x-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.ado
be.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/Res
ourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocu
mentID="xmp.did:491CD10DA3D5E311A958EE854ABCD7D0" xmpMM:DocumentID="xm
p.did:4C40E5B5D5E411E3B4278899C73C6A8E" xmpMM:InstanceID="xmp.iid:4C40
E5B4D5E411E3B4278899C73C6A8E" xmp:CreatorTool="Adobe Photoshop CS6 (Wi
ndows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9908CF
<<< skipped >>>

GET /iplookup HTTP/1.1

User-Agent: mfc5002

Host: int.dpool.sina.com.cn

Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently

Date: Tue, 13 May 2014 04:50:09 GMT

Server: Apache

Location: hXXp://int.dpool.sina.com.cn/iplookup/

Cache-Control: max-age=120

Expires: Tue, 13 May 2014 04:52:09 GMT

Content-Length: 246

Connection: close

Content-Type: text/html; charset=iso-8859-1

SINA-LB:aGEuMzguZzEuYngubGIuc2luYW5vZGUuY29t

SINA-TS:OTdjMmRlY2UgMjQwNSAyNDA2IDAgNiAyNwo=
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>301 Moved Permanently</title>.</head
><body>.<h1>Moved Permanently</h1>.<p>The d
ocument has moved <a href="hXXp://int.dpool.sina.com.cn/iplookup/"&
gt;here</a>.</p>.</body></html>...

GET /imgn/tips/skin_tips_n1.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p8.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:26 GMT

Content-Type: image/gif

Content-Length: 1779

Last-Modified: Wed, 20 Jun 2012 04:23:22 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:26 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89af.!../......Z..R.....K...........P.....Y.....}..................
.......................^...........S...........l.....W..L........m....
.......f.........................................................!..XM
P DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &
lt;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060
 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="ht
tp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf
:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="h
ttp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.ad
obe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:018011740720681191
09DDF35EE18454" xmpMM:DocumentID="xmp.did:B01789E6890511E18530B51A3723
DDED" xmpMM:InstanceID="xmp.iid:B01789E5890511E18530B51A3723DDED" xmp:
CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom 
stRef:instanceID="xmp.iid:02801174072068119109DDF35EE18454" stRef:docu
mentID="xmp.did:01801174072068119109DDF35EE18454"/> </rdf:Descri
ption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
;.....................................................................
.............................................................~}|{zyxwv
utsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876
543210/.-, *)('&%$#"! .................................!...../.,....f.
!......pH,...$q.l:...4i.....vK<<...xL.1>..y.... ........k/2..
.(..........{.........B.$)..........{!......./....................
<<< skipped >>>

GET /imgu/2014/05/20140512170407_319.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p8.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/jpeg

Content-Length: 5937

Last-Modified: Mon, 12 May 2014 09:04:07 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
......JFIF.............0Exif..II*.......1...............VVV.meitu.com.
...C..................................................................
..C...................................................................
....=._...............................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?....|.-......d....Qg.u.Vz3..
....\..lD. .......hN........c.....s....mt....6...X73u.>.'8.v......i
>.4w...V.R9..a.G....B.:..Zd..Sf.r%.5(.O........C1..A.:`.}.Z.&.B.OS.
..i..w...._..........o......u..7RQ. z. *.*...._...m....G..^4...[X.....
.v.T...?&.i-...j.}^.....K.P.V..-...S.'.....,c.%...F...m...............
A....Y.G8...WM*..q..,.y.9..../kB.jx...?.xg.w.....l.,.hnmgM.....v.V.]8%
s.&.....j\)#..-....p.&9..z..J....e.....~8~..Z/.9...<..|V.K...(. .7x
....<.mm..*.G.c..c...)...c.A..k........o...y....^;.|."...42k.u.....
s....h.|..pk...I.rIBKV..#...a..u.W..|e...f...V.g...h.]Z...v.i...g'sq..
..q.y.I{._.}6.(....M.....E.5.-.B...4..........D^T}I. ..V.Yb%.....4....
.....3]K3.,...l.....C..c..g........w.?..<.....V x#[email protected].
.ua0...P..k.S...c......- I.<bMSP.C.......GB{._.c..n6.5...G..2......
..._..r...*.W.Wg....\.b.P....66...d...c.rJ......#.s.C.....O5....P.
<<< skipped >>>

GET /v53/imgn/guide_tip.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:30 GMT

Content-Type: image/png

Content-Length: 10442

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
.PNG........IHDR.......J.......D.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Macintosh" xmpMM:InstanceID="xmp.iid:CEC0416D02FB11E388CB8B
2E3040A42A" xmpMM:DocumentID="xmp.did:CEC0416E02FB11E388CB8B2E3040A42A
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CEC0416B02FB11E3
88CB8B2E3040A42A" stRef:documentID="xmp.did:CEC0416C02FB11E388CB8B2E30
40A42A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>.Z....%<IDATx..].....&.(..."...ky.....
.f...7..........W@%.`..@A.*(...P..;K......E|..;g.....?[....>.<..
...........i......h-....@_~.. _&.2%...<..........k......w.d./.....U
 8..r./=|..9.{.P .IT.r.J.b].|...3|....../7....]1..=?..M]Y.f.....n...7l
.:w......Vk?.gkk 8.z..........ps...^p........P-....Z..._.6l.....KWWW.j
jj...........Q..P.~.|..Y..O......... .}...GI...3k..#......KS.....n..r.
rm..../.....'JUUU..aIT....V......4...]P.......M.....Y..xju6...2...|.o3
......?...>X\..V[[......}(//........o.CEM...f.N..Z.....O. ..7hU.qC=
p&/........@.|'gA.1.>.$....{@t..P...um..A..8..].v.;..D.b.]..ss.
<<< skipped >>>

GET /kan/static/css/DD_belatedPNG_0.0.8a-min.js?t= HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:22 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 27 Aug 2013 08:33:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
b9b.............Y.o....=...}mH....yx....vZ.p..q...P,....*I...........#
@Lrvvvv.ofW...g......Hx-...... ........UQ.emk kq.CQiA^j'..k..n.2_e....
x.kg.o......:....W.:.K[;-..v.'.(A}..8.5.D.....D..<..oW....uaO...-./
.8..e*..Q.....H.)&...*.3[.Y3._.....Y%|...R.#..9.n..JJ..f...%..Y...O.Dh
....A.id.....*..O7|n,..T.e."......d%...9.fg.e..Z...m..m..L..4O_'..>
;<.>...X...*...33N....a.7...?....a....A....J...=M..T./.'.`.y5...
.8....{.20T.P......M....UKc.g....7.&[..]y.Hyu..^.WyP....].0c...z_?&.}$
D=T.v..|.:.Zj'..tV.<f,\......cwU.....93Y.~......4"....O.8....U....!
t.l9..e..~.....F..c.:.o...\...Zh....>..kWD..F...D...._%.w...06rs.&V
./.&.y..#m.Vy../FS...b..)..g.H.%....n.,..Bs..t[}.........h.....s....B.
......~....EFZ.E..z.;...G..'.Y.qV.?....;..%:o...........n.A.....^...y.
...[R.*.`.......I.3.. .U.x2W.....J..W....B..g..*....5.s.!.^4.. `{^z...
.....h.....e.(Fc=B(..E..p.]c....R.eD...k.A:y...nd..c.Ã..z..Mr..-..:.
.L....&...W....z:7..d....d.)Gw.x..~5;..qR#..U.7.....H......{...v..)...
I..v../....G6....yV....[..Ql....>.|}...a.dnn..f..|fL...'h......*J.'
.W.d..(M. W[[email protected]_....Z.........s....#!...(c..d...&l
t;.........$.....Y...:Z..... ..y..]....K)*.O.q.C=*.$..q.Gf.....*WY....
...Z<..c.3.._`LDj....`.jDj..\0....<...xy.xN}..LK.G..5..3....5...
|.3CS...,|.6...*.d...X).....Q6.BlQ.A...}....:.W..q......ad8bc.p.......
n..;e.<L0 d....w...OG..<D....'..m....3.Q.....K=6.kK..5.....M.3..
w.Z......[....#...N\.G$F.!.KS../y.:s......[.).c..h'uc....V`...(...@...
.../..j...."..C....pB.!.....f.Px.r..[p...R.......b..]u.I%.6|.NAXs.
<<< skipped >>>

GET /imgn/v32/icon4.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:22 GMT

Content-Type: image/gif

Content-Length: 1506

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Accept-Ranges: bytes
GIF89a".....................v.....Cs.`}...............................
...I{.b...........................................................U..m
..r..........................M..Z.....................................
......................................................................
......................................................................
.............................mmm^^^QQQ777......!.....~.,....".......~.
...................................................................dKG
8HINi.];K.D.kUMJ[.LG`....DIa.O9c.o|z.bKL.i8p.zy{x..G..OL....'@.>w.Y
.....ox..).n..:..(.....oz...........XB.......9.3@.'...........5..H...5
....m..HNk...4.... uYR...7.....Rj./J.H..d...p....d....5.(ybi..%<..f
....Lk.4Y..M....<I..G..T2.eB%.. I.X..dI..T.R...m.6J.H...M.<?....
CR..w~...T...<F?r....v...<.Rk....D.}<..1..<9........y..9t;
z..S...B.....mU..1Ga.T.L...B...];..p.t....$r(..Oz...Ou8..$[...[d...%[ 
1@M~.0.%T ..`N.....`....5aE}..)...,P..H&YD.%E...[,[email protected]....%.`C...`...
....%..B.!x....,9..%. '.jv.A.a......y....)..}.`'..P...t.z(..4..76t.C.Y
.P..If....h...=dP...0`*........*[email protected]......)...$.Lq...&.....`@..
.p.."..A.!..B.S....)D;.....m.1L1A....n$.L...$@...>L....x..$).a(..L.
........>B........H.....(..$...A..lp.....B..4...Pp..."D ..&k.r#....
.<C...SL1...F....P.4.L7....F-.....@. 4.B&#X...#p....dp...p`..S@1E.?
..@%g..A.2....P.....4.@.'.PC.1....P.p.......z.^..!.....H2A....w.&.@.. 
L.B......&......`...BrC.f@..."....&<.)$u....g.....,[email protected][email protected];..@ 
..3Lr.?.=.`...h....,`v.).....: ...B^...,0...0..R...\b..PA.R`..xbkT
<<< skipped >>>

GET /v53/imgn/v53_2icos.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/gif

Content-Length: 2051

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
GIF89a)....................8Y....................1..v...........=.....
.........z....................e........J........}.................8..j
..............u.................r.....Q..............C................
.k...........L........................................................
......................................................................
...............................................!.....N.,....).......NN
5....................N.?N...........I.>[email protected]......
-.......................<*........A..G.%:......#%% .C.......].....I
!JP.....I..a.8....A$.3..B.H.$N\.a %#.#......I4L)..k...&O........{.(7.f
N.:(P.pO.C.!..,.j.....D.'..6.G'A........u-z",..H....q...W.LI]d...J7..8
. .O.x.*..l....Tl...... ..m<a.$.J...d..a...J...s$.$H..e..$^..9...D.
........[k.`.Jbs.qk..nj..Yt........n...c.......uE'.c..n.Q_b.....)..x..
..d.....6e..V.)._c..'....W`...._{.}E.$.` ........,.....@..,.....)..W.M
 ..-....B.8#&..)...y..#..gb.#.|.. K6..*IJ.....R.3U:.%#..Rer_....P.8.9c
.X...8..#_..&.jN.'B>..g.$....G...P1..&0.........MTIb. ....M8!.h....
....*.y`yZ.|.xG.Q6.)k.6.:J_..y.X}....-\..o.05k..L..)...........v.)..HK
.H.....J.....4[.c.*Bn..9.^...[.xw.;...bGo......h.{o...[.%..Xo#...^..d 
S......~..r...*\[email protected]..&F...m...9.h..0..".*.(...:.....s..,.
.2.....!..l.#N.....4y..S32% cr..-bV.,...S.....6.....wn.9&.;LP7..a.wMlV
y...W:....0..<. ../.2x{...(%V.[B.PM..TGu.yV.....$z^9v.J".....@.:0EB
....:. ...]".PW....`.......PP..p..D.%..|...e..>)al....=.._.%...z..O
...n..J.B.........>.....B....62....C.h.k....<@.....B.A...5..
<<< skipped >>>

GET /v53/imgn/v53_arrow_h.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/gif

Content-Length: 1036

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
GIF89aQ.}..........1..b.......................C.....t.................
............G...........j........}..T.................................
.................................................................!....
.).,....Q.}........(....r.l:...0E.Z...v..z...xL.o...z}-..p.;N.W.......
&. .z.waZ........z|W.........#.v.W.X!...u.)..Z$.$.q....\...{.U....[...
j.....Z..........[....d...\....f...[. .i.).!X..e.....).......]Q0......
...%..@$"(.8....t.b..q#.......e...C..\..%..B..|.sK..NPz..E.......8s...
.T..R.q.SYO9:..u...U?^......k.j.J...Bb..%....H`...jv......i...Z...~.\O
.R..*x.B..R...(V..L..]4..<./.5."...q.d.....@ sT........k1..W.R[N...
ws....p9.../n....Y.3'C....b*D..8M.........w......PM...N..-.}......b.~.
...w.}..h....WE}...`...W`9`=.!.U1x.n....\.]h.TU.". ."2.Z..aXF.m<U.s
.)7..Z.H..Z...R..H..d...........6b]D...i....^U.x.`P.yW.m.uT..eya.t..#G
f...aj..Q......V..d.^....brE..|..e.y....".D.N>....C...N9E..M..1.I..
*....j...r.. ...E"[email protected].... -.l.....#........0..4.j
P.5.\.-...#N.....:..#)@<..k.=.......K.A.....V8..D..,....l... ...;font>....


GET /ads_hz/_ads_2.js?t=777753 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:24 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 13 May 2014 04:30:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
c11.............Y.s.H..W..=,- $0. ...v.W%.W.l.na.%.H(. z......G/ .....
h.=3.....-;y8..(...' .B.e.......d.3*.i&.;Ag.q......tme\V.......py..eKi
.....y..L.G....u.......s9P....la...._......_...b/.)H.j.....c.x. ..P...
k.......B...."I.E.f....~.$Ul.....`!L#.o6.H.{....\yIx.'.T..an|N..^....[
.MOfi.?1e.a..H.............:..y..U1.......Y.X.I..l..I..p.f..L.....v.@y
....M.....$5....E.......2.s..V.J_..eh..Q......=..]....W..v*.9&[dY<.
....Fn.C.A/~R].....S..q.-..`........Yv...`.{....r.<...~d.&5x.D.hY.(
...{...t$....S.{.<..NJ..);mv.{n..'....l3w.......8[..h.#.h%.#!..Z^..
|.%.i..^c.k?b........._.../h.v...i.......[.i%.....M...\.(.}/..{...[.N.
.....u84..........v.X.2...^....wGf....#...p...Z....U..i>K.D.: ...0.
z...L....l...U......`M.. y.T..m.v..Z.......D..M...&e]F`D..3.yre...V..l
..)..L..m...L1...Fy........Z....^]V.l.."@(/ U.\....d...p.R=.sc..;|..s%
.....d."......m.....6.d...N...H.~..Ck....jcW.qY..\'v.Uj...0.S.~.R..7.\
x.#..;..N.4..m..r..Z{ny...o..a.7)...f.......?..~..:.......c.....J}...z
'.%..I.pef...."....{.#......_.......W$%....V.....| |d....y.....Cv.....
......\..j.b..Z..s..b..u...".....A;%....cZk....8...L.o..V^...V......w0
f[...D....P*.s.w...H.W...w'.[...B..#.oe...C.F.*4...RP.....(..)0{.F.x..
P.i..)....../.....dLv.\........z....30.9.]f..g..,..~X.8..xf...$.C.9O|.
........B..y.....6._m....p..>..O)8 ...!.b...0fL... .o..J......'W5..
-.5...*n@.?R..4X..XQf V...Z...Q.PV.E1...E`.........J.}F.....W.ir.6....
.\.u........."..(t{...zV...../......x2O...:..|....'...(Q..'....E~..x#.
..z.(.d..........h...3.....M..I".3 .uZ...U7]._....:....d[.e.#.YX..
<<< skipped >>>

GET /imgn/v32/selogo_111207.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p4.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/png

Content-Length: 12155

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...a...?.....V.......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /imgn/v32/fbg_about.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p4.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: image/png

Content-Length: 3580

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:25 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.............&u2.....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /pv.gif?uigs_productid=ufo&ufoid=ads&ptype=ads&pcode=ads&rdk=1399956570071&img=extra.gif&yyid=&ssuv=&m=&loc=&module=show&tag=62 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pb.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive

Set-Cookie: SUV=0033227BC18AF4E75371A455E4AD7518; expires=Fri, 10-May-24 04:49:25 GMT; domain=.sogou.com; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
....


GET /pv.gif?uigs_productid=ufo&ufoid=wan&ptype=jztf2&pcode=index&rdk=1399956570103&img=pv.gif&sourcelist=0011000100006_0011000100007_0011000100008_0011000100009_0011000100010_0011000100011&titlelist=风云无双_仙侠道_暗黑屠龙_Sogou傲剑2_万世_大闹天宫OL HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pb.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive

Set-Cookie: SUV=00461146C18AF4E75371A4556E6A4053; expires=Fri, 10-May-24 04:49:25 GMT; domain=.sogou.com; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
....


GET /pv.gif?uigs_productid=daohang&rdk=1399956570493&img=pv.gif&pars=?rand=1399956570493&suid=null&sduv=1399956570462_5852_00001&ckid=6846_00001_00000_3030_00000_00000&m=null&apid=null&sgtp=null&refer=&page=&pageUrl=http%3A%2F%2F123.sogou.com%2F%3F22014&loc=null&hp=-1&pid=Af22014&ptype=index&pcode=index&yyid=null&skin=null&ver=v53_ie6_cr__4&sys=100&ser=null&sev=null&time=3531 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pb.sogou.com

Connection: Keep-Alive

Cookie: GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:26 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive

Set-Cookie: SUV=0066339EC18AF4E75371A4567C72F260; expires=Fri, 10-May-24 04:49:26 GMT; domain=.sogou.com; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
HTTP/1.1 200 OK..Server: nginx..Date: Tue, 13 May 2014 04:49:26 GMT..C
ontent-Type: text/xml..Content-Length: 0..Connection: keep-alive..Set-
Cookie: SUV=0066339EC18AF4E75371A4567C72F260; expires=Fri, 10-May-24 0
4:49:26 GMT; domain=.sogou.com; path=/..P3P: CP="CURa ADMa DEVa PSAo P
SDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"...
...


GET /pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1399956575900&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pb.sogou.com

Connection: Keep-Alive

Cookie: GOTO=Af22014; SUV=00DD04B9C18AF4E75371A458B1D10495

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:30 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive
HTTP/1.1 200 OK..Server: nginx..Date: Tue, 13 May 2014 04:49:30 GMT..C
ontent-Type: text/xml..Content-Length: 0..Connection: keep-alive..

GET /imgu/2014/05/20140507144656_823.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p9.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/jpeg

Content-Length: 5785

Last-Modified: Wed, 07 May 2014 06:46:56 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
......JFIF.............0Exif..II*.......1...............VVV.meitu.com.
...C..................................................................
..C...................................................................
....=._...............................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?.....n.aw..W.....8m...K..`.v
.w..!.....g..p...fu.I@.>-....l..T....N..8..X8...ji~%.......... U.`.
.......F...{_........~2.c....U...V7.:..6o....?.....*xy3..IU.B>g....
..?...o..l.LQ...<.".Lo"KS,..-...QT..d..W.R.1..T....U.r.E..........S
..K_...u~..?........m..KTP1sf....y..N.s....._QE..j.5....qU.h{......|#.
.}.... ....8...u..]F;..b.XQ...h..M9.........................j...M.4RL.
.{.Y.u.O<WR.i9sJ-G......~X......W.-..g..o...X...q.V..Gc._O.IJ......
qj.OMD.....%....F....T..... ;.xB......L.4g.b.r.K..... ..#...X..6. .W..
.*.GE.s.0.f..b.&..F.e.A........y..4.GZ.....R..<Q.O.H..?.4.R...2....
.U..rB.*.fb#Bs..p...8...........{Y.QS7..j......K..o^.......D...%......
.`[email protected].*X.V......'0.C.Y........n.C....%.........b.SN,t.
.]>..}.^..<...?.|....(....}'..P..&......_......^.V....'....4..J.
.6..q.B.{....<.&...}6a...^.............q|/..<m.?....[.......
<<< skipped >>>

GET /imgn/v32/skin3.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: image/gif

Content-Length: 4159

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:25 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a..h..........R..J..Bs.S................r.....qq}a...............
........n..~..|..m..l..l..x..k..v..t..i..s.xa..n..l..k.ua..i..h..i.~f.
r`....wd.xd....rb....pa.nb.rf.vm.xp.xp}OJ..........l`.mb.pe.od.oe.wl.x
n.qg.~t.sj.sj.tk..|..}....SM.vn............wMIuLH.|v.}wmJG.......~yeHE
..|..................................................................H
??....................................................................
......................................................................
......................................................................
.................|||{{{zzzyyyxxxtttsssrrrpppmmmlllkkkjjj<<<..
......................................................................
......................................................................
....................!.......,......h........H......*\.......H.H.....3j
.....I.BJ......(S.\.....0].IdI.$K...T...O.....JTh.dH.*EZ..O....%j....J
.@1.....{[email protected].=;..].VA.8p..ms....x.5m../..;8.......u.........#[...N!
F.......g....&L.`2....T.....;vd.L8L./..g.......)..s.....]..=P......F}W
.@..)....v\4=bs..}w...J|._.>.r...?..].t.......B..)T.].n....g....B.&
....'!d....2.=W.2.Q..2.Y`...x....\(..I.....1.....`...L...s|...@R......
.|p...].2.Bl L...#8...l<.[.e..C.o.W..6.&..2.....E....U....).ZS!....
".p....%F.;[email protected]...^..........H..D....C.....B
u.bj ......b..d.......l.k...0F......8|Z...R.k.........A.sf...u6...wN[m
.;9..TS.u.VJ5..O..k.i.......$...............p..G,....j...g....w... ..q
...l..(..r.$_.qM .4.'1..J.6..r.pb<J*..<.-.............I.<
<<< skipped >>>

GET /imgu/2014/05/20140512112800_851.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/jpeg

Content-Length: 18313

Last-Modified: Mon, 12 May 2014 03:28:00 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.....0Exif..MM.*.......1..............VVV.meitu.com....C..............
......................................................C...............
........................................................k._...........
....................................................}........!1A..Qa."
q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwx
yz....................................................................
..........................................................w.......!1..
AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghi
jstuvwxyz.............................................................
.......................?.......8.:.da....0N......<.3.F....J;.E~.;.u
...1.._?.....s.c%..d....4k.H...T2.Y.>TG..d....q..<.W. ..5h.h.h..
....o...i.[......v..k..>........:...]i...um.....G..R........P.k.iZ.
.....y.......\.n..sZ....Ws..F.X.q.p...w..]g;.....(...]..W...\-H.....c.
.........Z...*5..R. S.:......M........4K]?V.....].Y.x.V..x"....Vw..k..
.N.%.../6E..rd.i'._..e..........^..~..-.d.. .,!..b.]Y..u.G2...P.:8OiR8
.=J..*.W6..s.:q.Q.J._g.Rw.b.c....'.z.}.g..........~..g...G.....[....=.
v..6...$:..oq.xYt....M..........i.Z..-.m_.q...........F..R.[.S..Z.%e..
QB.o...*IE)9..x.......j..p..*4*EFMS..R..(.{:...q.p..(.1..C._.......<
;3.GJ..!.?.....K.l....^>'..4..L...R=i.....v.m..h....N..]..&.o.....N
N......Q...Q.8F..T..j8.J>..]')..R^..b.<d=.'..Z1...qT........j...
.....R.j. .'...[......!.6~..?.>.k?o.....>(.aZ.h...u=KA.Dy..ck.j.
....V:......Y.....K5.........4.H..%/f..7z5.%...$....a<\...l....
<<< skipped >>>

GET /imgn/v32/setskinbg.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:26 GMT

Content-Type: image/gif

Content-Length: 397

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:26 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a................................................................
.......................................!.......,............%.di.Y..l.
bp,.tl.x..x.....G)....q.l:...dJ.Z...v..z...xL.....z.n....|N.....~.....
.......................\..............................................
.............................................................H......:X
......#Jd......3j...".. C..I....(G.FX.....,C..;HTTP/1.1 200 OK..Server
: nginx/1.4.1..Date: Tue, 13 May 2014 04:49:26 GMT..Content-Type: imag
e/gif..Content-Length: 397..Last-Modified: Wed, 20 Jun 2012 04:23:24 G
MT..Connection: keep-alive..Expires: Thu, 12 Jun 2014 04:49:26 GMT..Ca
che-Control: max-age=2592000..Accept-Ranges: bytes..GIF89a............
......................................................................
.....................!.......,............%.di.Y..l.bp,.tl.x..x.....G)
....q.l:...dJ.Z...v..z...xL.....z.n....|N.....~.......................
.....\................................................................
...........................................H......:X......#Jd......3j.
..".. C..I....(G.FX.....,C..;....


GET /imgn/sehome/tjv1/new-ico.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/png

Content-Length: 211

Last-Modified: Mon, 28 Jan 2013 11:52:04 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.............&P......sBIT.....O.....PLTE...???.Mv.....
tRNS..[.".....pHYs.........B.4.....tEXtCreation Time.12/28/12...5....t
EXtSoftware.Adobe FireworksO..N....IDAT..c` .H..!...2.1_.......IEND.B`
.....


GET /imgn/v51/i-ico-2b.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/png

Content-Length: 2337

Last-Modified: Thu, 30 May 2013 07:28:54 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR..._...X......I M....sBIT....|.d.....pHYs.........B.4.
....tEXtSoftware.Adobe FireworksO..N....tEXtCreation Time.12/28/12...5
...}IDATx...{l[...?..y4MH.'$kIXJIE.H.^K.2...d06p.44.m.4..tb....m...ib.
.aM.....Tk......#{....P......m.&n..}}...ul...~..J.G..{..]..=?...>..
.HlA.......F..6"...K....^lG.#.#_6@..)...(.9.|...#g..E9...,Gr._._\,././
>.rm.6.$.F..6"...)..H.m..........,G2.5[...w...0.. .UX..pi.....O...;
%.sI.V..?~.}.e.#3.Q}..B..W.L..I}..}....4.4..{..k73....5"_.A.h(..PH..&l
t;J..O(.vv.a*.c.n..5.H.5.. ..U.m5.e8.....r....._.....A.5.._.s...eJHc.c
.%uv..@|..^!....0.XC.|:\Y2G."..............F..&.-._......T.qel.4...~r.
..o......$..gI. ..=.K*S/...v.\./......o...~..jv...n)|.d=.R......:.....
(.3=...C)|..g.lD.j..........y......-..p...,.C_....Y......P.....;...:p.
..@{.~..u...[3Up..M........&...V.Y:..N..`66.......,.....J.....'R......
6.........)....c..K.../..........)..s[.r.h...)N.U .......F9=.d..*>.
..l.q.}....A....0....../V......3.wy|..........q:.....s.w.'.r. .C..wh|.
..K...g...e...3.H...].<......].Iu.....x...f..{......7"......;......
.....k...`=..D.:.7.fu.....T......`r:...Yy.... .1....a^...o......A.cJL.
.....}.4c...oIT.9...!........k.....U....a&....H..][email protected]..
.$.....R'.}.#._N)....8.|..L..<pON9....F.....j*....`|j.....y].......
..h..p'..y...O.....$.X........~......S....:.yF~"o.7.$x"......2..Ss~.t.
...B.......l.&.[....s$..4.#....W.....ho^..........T.c.K ....&./"..)../
.}...h..!^ "u.r..j....G....E./Mg...$..LF; .>_.......9.~DZ1..<.&l
t;gb.......6...e..3..TA....-.F.>..==.....o.p......J.<..nG.%.
<<< skipped >>>

GET /imgu/2013/05/20130531144119_126.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p2.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/png

Content-Length: 13613

Last-Modified: Fri, 31 May 2013 06:41:19 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.......2.............pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /imgu/2014/05/20140507144124_693.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p2.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/jpeg

Content-Length: 5054

Last-Modified: Wed, 07 May 2014 06:41:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
......JFIF.....`.`.....0Exif..II*.......1...............VVV.meitu.com.
...C..................................................................
..C...................................................................
....=._...............................................................
}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
......................................................................
......w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFG
HIJSTUVWXYZcdefghijstuvwxyz...........................................
.........................................?...h..O>..y0...Dq...(....
z..QWl..9Y......g.Ry...Z..k...ib.......6....?......1/.2...#x.....~....
.......k ........u![.w.2.......`.....5.........q..|e...<....g.4....
R[m.W....V.Gp`..F.~lg.R.J.eI.'....%..H.M7..{t...D.......q%.[..u%\..I..
....e..a.....yP...]H...F..6.L..6......{...)[email protected].].>....%.....
.......OS..`.p..y.%.iO.Z.NJQrg.y.....O...2.\..V{{....B..?J.p....4..p..
.0..........x.\.....#.Wr....Uj.....@.[...8...W..B1.s....u.G._..?....].
..).k....6|M._..3.z...U.A.iZM.............1...k.....?...(o..?.....MP|.
.E..|..I-....>[.....c.$~.< 8...4.j.2..%.~....J....z..3..........
........W.....~..H#s...L...8A.*.....WC......\..Z...5..f..,.......U...N
.\e.Q-..3\$...y8?qB..n0y.1\=.J......kO....n:.T\...g.......0.?i/.E....!
.|C>..zF...m..L........z.28...b*V.UwZhz..P.U(..>.._...|F.....|1.
..e..{-J.f....#.../s...X.....#.&..i..x/...l..#K.......Y.kg.HUWr.T.
<<< skipped >>>

GET /jsn/citydata.js HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 19 Sep 2012 10:54:17 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
5c2b............m.Yo[I...W.t..o{......'7............-.[.Z6EJ.G..(R.G..
..gK...(w..~-.g..._:....U.j..U.V.........._....o....?.........?.s.....
......s.......wZ......4Y^..K....>..e.n.nv.[@..v..<.o.].S....>
.....]d...4..LU]...7S..9...d.z.2........*..U..T..x~.y.&.!.3...x......y
....y....%.Y.W........S.s.yv. ,.2.,.M..7..k9=..|....WT..........>g.
......7..M>'..F..~_......~_...Q.>.3.Lssk.....M.....b......q5....
..Bx.6.c0......{........z...T./...-...........2.,<..(..pExy>..U.
...x..)..In..0.Q8;.P...*.........q.Y.........X..=...Y_9..bl.w?m.16....
....~....xw.l\....~..L7.{...l.6C..v.`M....n..%..F......O.~......Y....f
l...R....O....f..P.........'........ly%...\.L...9..\..a..=.V.....u3...
........W.......f.Fm..B:....?.?T..q........m.].LFj....~..Lwq..C......M
.Y..6.K......T.....FT..l..P....m....n...}..fl.r.b....5...XQtGT..).h.bG
..\[email protected].#..xffA]...v......I)/\...v'....:..........
q....Z..)...Z.rK..8.zV.F.....n.....r&;..n.q.......6...H..i=.-.&.5.Msu.
.,.........b...r..KY9.......J...Q.8.....bl..P...s.<.|...n......5..G
.j.....9.k,..R.e.%k...0..L.%....5.E...g.].1.y..G........H........a/..-
U.,6k.< .b......U.#.k.....#...<...........z.*.w.........-.z.V...
..........v.m....%z...m..,......h..6..7...../.h..6....k..:JV.z.R.....0
[email protected]....#=hH6p..,..........CLo~r.Fl~F_..TT.....P...G..&.~...i
.z......M:a....;..r..~3b..... .......}.g.\c...AL..L.l..w..]...9...].=j
=........X.2|alV....W........[b..zyc.Z... .......K2...\..X-..........0
.D0~50^..*]........l..Y...f{..<$`K8.8Q..........l.....[.(O.}5..
<<< skipped >>>

GET /v53/imgn/v53_bicos.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/gif

Content-Length: 826

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
GIF89aD.......Bo...v..1..;o..........f...W.......;........e...W.d.....
.........@......`..P~%[email protected]{......Z...
...W.%h.t...d................@..&z..Hv......L...\.Q~..R....6..........
..h..Ky...y..Y..Cp..a...........R.....Z.....Cr.c..........:......o....
...$m..f....&}........................................................
...............................................!....._.,....D......._.
.............@'K3@?...0 0...''@...'....0......KK.3$.;=3........'*K??G.
.CCH8........?'/[email protected]&&LLN.T@@.. .. .mXR.....7(a. 
...4>.[[email protected].)...?.n..e...4P...H...R.H......P........4..dY...'.
[email protected]......?F)..!....BX...A......1.^.... u@..,!_9..{[email protected]
....tHr..]A.~..7`....N......!J...pb..AF.L....._O..;....!]..#2...AF.H..
 .4#.~D.b%.....,.... .h..p.DP.W.......o..><0.K..{.O.@Q .;t>....


GET /v53/imgn/foot_slider.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:24 GMT

Content-Type: image/jpeg

Content-Length: 322

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ....................................................
....................S.................................................
........?......>....('@......... . [email protected]/1.1 200 OK..Server: 
nginx/1.4.1..Date: Tue, 13 May 2014 04:49:24 GMT..Content-Type: image/
jpeg..Content-Length: 322..Last-Modified: Thu, 14 Nov 2013 11:00:56 GM
T..Connection: keep-alive..Accept-Ranges: bytes........JFIF.....H.H...
..C.......................................................          ..
.C................                                                 ...
.....................................................................S
.........................................................?......>..
..('@......... . ..@........


GET /v53/jsn/main.js?V=16bb90f6b3db269d3b0dadfb85d67a51a HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:28 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 12 Feb 2014 04:41:53 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
54c0..............{[.G...w.... Y-!q.....0...${..I^`xuiI.BR....:.......
H.;.......?.....Z.n.j....p}=..L.....8.u....h.O....;a7....x..X..D...]z.
@[email protected]...|^....8......X.........!_G......a....\.W....9..P.
O..$.'..^..~H7.....Gww.0~./...2.e..,.....*H>.. f_}... Z^..f.U.d....
b.....C?..............LJx.....~4 .!...x6.._?,.....<.LC..(......I..&
..$m4l...'......a[0.d2i~J.n...I.V..........a.\z....bx1....va...[7a.6..
..v..aj..!...j-..D<..V?...~T.#....e)tfw.....R.......>.eh [s....(
..g.w../g.N../g.{.v.g;.........W{........r......~...{a.#.....V8)....&a
[email protected].>......y>{.M..]..tkoN.K.n|....z...........]..v.......
...-z.z..-............`.kj.9;..H.N......~.L .o. [email protected]....{vN.
.N.........m._.....qv...`.A..p<h.....;........ ....6....9..v.u..A9A
-o..'...0./...J)&..as..~.....c0....e...y.o.|..?.u.K.\.%.r............^
.S.|W..,.....}W.*..].U/}bi..].....%....^......wCv.2f..e....\...8.....a
B.....5!l.....}.*...x.lI.. .n... ,....<..5..9^.5h...QZ...FP......Y.
[email protected]........./.....5...>D..5.[.2....j..g.J...|......mY.y......
...x..........`.7'..0.iI...t<....z\..,..]....J..h.....R..25......t.
.K'q#.....N...f...O..a3L.....A..:......b.. .j=....6.....Z'.,....\.\D..
...ah%.w....8e.n.....qhh..x.....!4.....(.c......8<5..1..CH......qq.
N........e...r~Y.,]V/./.u..Lr...LA.f.....!0.z..X..... ..fd....u&B.....
.qy..3p.".f&<.B|s.....v%^...]......p..........<.s.V.Kb....r<Q
|.x..w,.a.Xr....f.147a...J./7.........(5..p4....*o...F..yC.h*}.5.~H.q.
.`kd.?|<Z9u....z... >...z..y.C]O....<.N!...<M@.@B6.,d.
<<< skipped >>>

GET /v53/imgn/guide_tip.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:30 GMT

Content-Type: image/png

Content-Length: 10442

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes
.PNG........IHDR.......J.......D.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Macintosh" xmpMM:InstanceID="xmp.iid:CEC0416D02FB11E388CB8B
2E3040A42A" xmpMM:DocumentID="xmp.did:CEC0416E02FB11E388CB8B2E3040A42A
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CEC0416B02FB11E3
88CB8B2E3040A42A" stRef:documentID="xmp.did:CEC0416C02FB11E388CB8B2E30
40A42A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>.Z....%<IDATx..].....&.(..."...ky.....
.f...7..........W@%.`..@A.*(...P..;K......E|..;g.....?[....>.<..
...........i......h-....@_~.. _&.2%...<..........k......w.d./.....U
 8..r./=|..9.{.P .IT.r.J.b].|...3|....../7....]1..=?..M]Y.f.....n...7l
.:w......Vk?.gkk 8.z..........ps...^p........P-....Z..._.6l.....KWWW.j
jj...........Q..P.~.|..Y..O......... .}...GI...3k..#......KS.....n..r.
rm..../.....'JUUU..aIT....V......4...]P.......M.....Y..xju6...2...|.o3
......?...>X\..V[[......}(//........o.CEM...f.N..Z.....O. ..7hU.qC=
p&/........@.|'gA.1.>.$....{@t..P...um..A..8..].v.;..D.b.]..ss.
<<< skipped >>>

GET /imgn/123ie/setting_icon.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p6.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/gif

Content-Length: 76

Last-Modified: Wed, 25 Jul 2012 09:14:49 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a.............#.....!.......,.............".8....=h%v..n!.....y.h
.....;HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:
49:23 GMT..Content-Type: image/gif..Content-Length: 76..Last-Modified:
 Wed, 25 Jul 2012 09:14:49 GMT..Connection: keep-alive..Expires: Thu, 
12 Jun 2014 04:49:23 GMT..Cache-Control: max-age=2592000..Accept-Range
s: bytes..GIF89a.............#.....!.......,.............".8....=h%v..
n!.....y.h.....;..

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

http://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

\LOCALS~1\Temp\nsu2.tmp\NSISdl.dll

r.png

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu2.tmp\NSISdl.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu2.tmp

open.ini

tEXtXML:com.adobe.xmp

xmlns:xap="http://ns.adobe.com/xap/1.0/">

xmlns:dc="http://purl.org/dc/elements/1.1/">

Undo=toolbar\16_undo.png

Undo.Hover=toolbar\16_undo2.png

Undo.DrawBackground=1

Favorites=toolbar\16_favorites.png

Favorites.Hover=toolbar\16_favorites2.png

Favorites.DrawBackground=1

Feed.DrawBackground=1

History=toolbar\16_history.png

History.Hover=toolbar\16_history2.png

History.DrawBackground=1

Layout.DrawBackground=1

FontSize.DrawBackground=1

Encoding.DrawBackground=1

Zoom=toolbar\16_page_zoom.png

Zoom.Hover=toolbar\16_page_zoom2.png

Zoom.DrawBackground=1

Proxy.DrawBackground=1

Tools.DrawBackground=1

Plugins.DrawBackground=1

Security.DrawBackground=1

PageContent.DrawBackground=1

Edit=toolbar\16_edit.png

Edit.DrawBackground=1

Save.DrawBackground=1

Options.DrawBackground=1

FormFiller.DrawBackground=1

Screenshot.DrawBackground=1

Page=misc\16_page.png

AddressBar=misc\16_page.png

DefaultTabIcon=misc\16_page.png

Search=toolbar\16_search.png

SearchBar=toolbar\16_search.png

FolderOpen=misc\16_folder_open.png

FolderClose=misc\16_folder_closed.png

FolderClose.hover=misc\16_folder_open.png

WebsiteInfo=misc\16_website_info.png

Go=misc\24_go.png

Go.Hover=misc\24_go2.png

AdHunter=misc\16_ad_hunter.png

_Add=shared\16_new.png

_Edit=shared\16_edit.png

_Search=toolbar\16_search.png

Caption=control\caption.ico

OpenInNew=misc\16_open_in_new.png

ForceTabInBK=misc\16_open_in_bg.png

Caption.Text=#555555

Status.Address.Text=#555555

Toolbar.Normal.Text=#4F7639

Toolbar.Disable.Text=#999999

Toolbar.Gripper.Style=Dashed

Toolbar.Gripper.Width=2

Toolbar.Gripper.Gap=2

Toolbar.Gripper.Percent=90

Toolbar.Gripper.Color=#6281aa

Toolbar.Gripper.ShadowColor=#f8fafd

Toolbar.Separator.Style=Solid

Toolbar.Separator.Width=1

Toolbar.Separator.Percent=90

Toolbar.Separator.Color=#6281aa

Toolbar.Separator.ShadowColor=#f8fafd

Toolbar.Hover.Text=#000066

Toolbar.Hover.Border=#7CA5FA

Toolbar.Hover.Start=#FFFFFF

Toolbar.Hover.End=#C6D8FD

Toolbar.Checked.Text=#000066

Toolbar.Checked.Border=#7CA5FA

Toolbar.Checked.Start=#E7EEFE

Toolbar.Checked.End=#FFFFFF

Toolbar.Pressed.Text=#003399

Toolbar.Pressed.Border=#7CA5FA // Not Impletemented

Toolbar.Pressed.Start=#E7EEFE

Toolbar.Pressed.End=#FFFFFF

Menu.Normal.Text=#444444

Menu.Disable.Text=#999999

Menu.Border=#77a861

Menu.Separator.Style=Solid

Menu.Separator.Width=2

Menu.Separator.Percent=90

Menu.Separator.Color=#77A861

Menu.Separator.ShadowColor=#f8fafd

Menu.Hover.Text=#000066

Menu.Hover.Border=#7CA5FA

Menu.Hover.Start=#FFFFFF

Menu.Hover.End=#C6D8FD

Menu.Checked.Text=#000066

Menu.Checked.Border=#7CA5FA

Menu.Checked.Start=#E7EEFE

Menu.Checked.End=#FFFFFF

Menu.LabelBackground.Start=#ffffff

Menu.LabelBackground.End=#000000

Tab.Normal.Text=#4F7639

Tab.Hover.Text=#4F7639

Tab.Active.Text=#4F7639

ComboBox.Text=#387B2F

//MainPanel.Style=GFill

//MainPanel.Fill.ColorStart=#F6F9FD

//MainPanel.Fill.ColorEnd=#D5E3F7

//MainPanel.Fill.Angle=90

MainPanel.Style=3Image

MainPanel.Image=control\title_bg.png

MainPanel.Image.StartOffset=0

MainPanel.Image.EndOffset=0

MainPanel.Image.Stretch=0

MenuBar.Style=Transparent

Menu.Style=GFill

Menu.Fill.ColorStart=#f6f9fd

Menu.Fill.ColorEnd=#E0F0DC

Menu.Fill.Angle=90

MenuStrip.Style=Transparent

ToolBar.Style=Transparent

WebBar.Style=GFill

WebBar.Fill.ColorStart=#7b7153

WebBar.Fill.ColorEnd=#9b998f

WebBar.Fill.Angle=90

FloatBar.Style=GFill

FloatBar.Fill.ColorStart=#EAF2F9

FloatBar.Fill.ColorEnd=#D5E3F7

FloatBar.Fill.Angle=90

StatusBar.Style=GFill

StatusBar.Fill.ColorStart=#F7F6F5

StatusBar.Fill.ColorEnd=#D5E3F7

StatusBar.Fill.Angle=90

StatusBar.Style=Image

StatusBar.Image=control\status_bar_bg.png

StatusBar.Image.Stretch=1

FindInPageBar.Style=GFill

FindInPageBar.Fill.ColorStart=#F7F6F5

FindInPageBar.Fill.ColorEnd=#D5E3F7

FindInPageBar.Fill.Angle=90

StatusBar.Style=3Image

StatusBar.Image.StartOffset=15

StatusBar.Image.EndOffset=15

StatusBar.Image.Stretch=0

Button.Normal.Style=Transparent

Button.Hover.Style=3Image

Button.Hover.Image=control\Button_Hover.png

Button.Hover.Image.StartOffset=2

Button.Hover.Image.EndOffset=2

Button.Hover.Image.Stretch=1

Button.Pressed.Style=3Image

Button.Pressed.Image=control\Button_Pressed.png

Button.Pressed.Image.StartOffset=2

Button.Pressed.Image.EndOffset=2

Button.Pressed.Image.Stretch=1

Button.Disabled.Style=3Image

Button.Disabled.Image=control\Button_disabled.png

Button.Disabled.Image.StartOffset=2

Button.Disabled.Image.EndOffset=2

Button.Disabled.Image.Stretch=1

Button.Checked.Style=3Image

Button.Checked.Image=control\Button_Checked.png

Button.Checked.Image.StartOffset=2

Button.Checked.Image.EndOffset=2

Button.Checked.Image.Stretch=1

MenuItem.Hover.Style=3Image

MenuItem.Hover.Image=control\MenuItem_Hover.png

MenuItem.Hover.Image.StartOffset=15

MenuItem.Hover.Image.EndOffset=15

MenuItem.Hover.Image.Stretch=1

Tab.Normal.Image=control\tab_inactive.png

Tab.Normal.Image.StartOffset=8

Tab.Normal.Image.EndOffset=8

Tab.Normal.Image.Stretch=1

Tab.Normal.StartOut=2

Tab.Normal.EndOut=0

Tab.Normal.Padding=0 0 2 0

Tab.Hover.Image=control\tab_hover.png

Tab.Hover.Image.StartOffset=8

Tab.Hover.Image.EndOffset=8

Tab.Hover.Image.Stretch=0

Tab.Unread.Image.StartOffset=8

Tab.Unread.Image.EndOffset=8

Tab.Unread.Image.Stretch=1

Tab.Active.Image=control\tab_active.png

Tab.Active.Image.StartOffset=12

Tab.Active.Image.EndOffset=12

Tab.Active.Image.Stretch=0

Tab.Active.StartOut=4

Tab.Active.EndOut=3

Tab.Active.Padding=0 0 2 0

Background.Style=3Image

Background.Image=control\tab_bg.png

Background.Image.StartOffset=4

Background.Image.EndOffset=4

Background.Image.Stretch=1

InactiveBackground.Style=3Image

InactiveBackground.Image.StartOffset=4

InactiveBackground.Image.EndOffset=4

InactiveBackground.Image.Stretch=0

TabProgress.Style=Progress

TabProgress.HideIcon=1

TabProgress.Offset=0 0

TabProgress.Image.FrameWidth=16

TabClose=control\tab_close.png

TabClose.Hover=control\tab_close_hover.png

TabClose.Offset=-6 6

TabClose.ExtendSpace=20

Tab.Normal.Image=control\sidebar_tab_inactive.png

Tab.Normal.Image.StartOffset=10

Tab.Normal.Image.EndOffset=4

Tab.Normal.StartOut=0

Tab.Normal.Padding=0 0 0 4

Tab.Active.Image=control\sidebar_tab_active.png

Tab.Active.Image.StartOffset=14

Tab.Active.Image.EndOffset=4

Tab.Active.StartOut=2

Tab.Active.EndOut=0

Tab.Active.Padding=0 0 0 0

TitleBackground.Style=GFill

TitleBackground.Fill.ColorStart=#E4F2DD

TitleBackground.Fill.ColorEnd=#E0ECD9

TitleBackground.Fill.Angle=90

TabBackground.Style=GFill

TabBackground.Fill.ColorStart=#CCDEC3

TabBackground.Fill.ColorEnd=#D4E3CC

TabBackground.Fill.Angle=90

Background.Normal.Image=control\combo.png

Background.Normal.Image.StartOffset=8

Background.Normal.Image.EndOffset=8

Background.Normal.Image.Stretch=0

Background.Hover.Image=control\combo_hover.png

Background.Hover.Image.StartOffset=8

Background.Hover.Image.EndOffset=8

Background.Hover.Image.Stretch=0

Thumb.Normal.Image=control\combo_dropdown.png

Thumb.Hover.Image=control\combo_dropdown_hover.png

Foreground.Style=3Image

Foreground.Image=control\progress.png

Foreground.Image.StartOffset=2

Foreground.Image.EndOffset=9

Foreground.Image.Stretch=1

Background.Image.StartOffset=2

Background.Image.EndOffset=9

.tci4n

6-3}ij

.vN {

({,{<{*;

 Z.pZ

nsu2.tmp

0C-29-8A-8B-37&md5=8eff8335308629faaae7eeb9444da07a&ini=open.ini&v=1.0.0.0

1.0.0.0

//www.sj88.com/hezi/jm/setup_a7158.rar

ns_61.rar

360.ini

c:\%original file name%.exe

%Program Files%\greeou

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

setup_a7158.exe

http://www.sj88.com/hezi/jm/setup_a7158.rar

og.nk2

%dN@#

Fxx.tb

U0.Ylb

,.fd="

.pN7b

'SOE%s

N,.fh

.QfAk

ÞDTDDDDDDDUUEUTDEUUEEEL

,<<<<,3#33#3"<"

<3""2#2"<<

3<#33<#""""

2#<<<333#""""**

""*""""3"2344/

#""#""""

"""#2#"",

#"222"**

"""#""21

llfff.NB

!%UUUN334Q

)))S%S*

Nullsoft Install System v2.46

%Documents and Settings%\%current user%\Desktop\

http://hh8.xjtj.org

1.0.0.0

%original file name%.exe_204_rwx_10004000_00001000:

callback%d

greendou.exe_772:

.text

`.rdata

@.data

.rsrc

L$PSSSh,

FtPh>

SSSSh

FtPh

tcPS

F4SSh

t%9X t ;

HSVWh<%U

FTPj

.FG;}

pdh.dll

>1.2.10

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

1.2.3

inflate 1.2.3 Copyright 1995-2005 Mark Adler

GetUrlCacheEntryInfoW

FindCloseUrlCache

DeleteUrlCacheEntryW

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

WININET.dll

WS2_32.dll

MFC42u.DLL

MSVCRT.dll

_wcmdln

GetWindowsDirectoryW

KERNEL32.dll

GetKeyState

EnumChildWindows

UnregisterHotKey

RegisterHotKey

keybd_event

MapVirtualKeyW

USER32.dll

SetViewportOrgEx

GDI32.dll

RegCloseKey

RegOpenKeyW

RegCreateKeyW

RegDeleteKeyW

RegCreateKeyExW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

COMCTL32.dll

ole32.dll

OLEAUT32.dll

URLDownloadToFileW

urlmon.dll

MSVCP60.dll

VERSION.dll

imagehlp.dll

WINMM.dll

UnhookWindowsHookEx

SetWindowsHookExW

GetKeyNameTextW

MapVirtualKeyExW

GetKeyboardLayout

GetKeyboardState

GetKeyboardLayoutList

GetViewportOrgEx

iie.exe

%y%m%d%H%M%S

http://localhost

http://127.0.0.1

127.0.0.1

favicon.ico

http://

CWebBrowser2

\update.ini

application/x-www-form-urlencoded

HTTPS://

HTTP://

Ryeol HTTP Client Class

::WriteFile failed ("%s").

::GetFileSize failed ("%s").

OpenFile (::CreateFile) failed ("%s").

::HttpEndRequest failed.

::HttpSendRequestEx failed.

::HttpSendRequest failed.

::HttpAddRequestHeaders failed.

::HttpOpenRequest failed.

::HttpQueryInfo failed.

The file (%s) aleady exists.

The encoded URL is not valid.

The port number is not valid.

The requested URL is not a valid URL.

.?AVerrmsg_exceptionA@Ryeol@@

.?AVhttpclientexceptionA@Ryeol@@

CHttpEncoderA::_AnsiCharToUtf8Char: szUtf8Char and szAnsiChar can not be NULL.

CHttpEncoderA::UrlEncodeW: szBuff can not be NULL.

.PAVCFileException@@

.PAVCArchiveException@@

.PAVCOleException@@

.PAVCMemoryException@@

GDI32.DLL

RICHED32.DLL

RICHED20.DLL

shlwapi.dll

1.2.10

UXTHEME.DLL

.PAVCException@@

PSAPI.DLL

NULL row buffer for row %ld, pass %d

RICHED20.dll

libpng error: %s

libpng error: %s, offset=%d

Unknown zTXt compression type %d

Incomplete compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

gamma = (%d/100000)

gx=%f, gy=%f, bx=%f, by=%f

wx=%f, wy=%f, rx=%f, ry=%f

incorrect gamma=(%d/100000)

iTXt chunk not supported.

IE9.IE9NSHandle.1 = s 'IE9NSHandle Class'

CLSID = s '{00B39D47-3331-49a7-B54E-32AE6E993C67}'

IE9.IE9NSHandle = s 'IE9NSHandle Class'

ForceRemove {00B39D47-3331-49a7-B54E-32AE6E993C67} = s 'IE9NSHandle Class'

ProgID = s 'IE9.IE9NSHandle.1'

VersionIndependentProgID = s 'IE9.IE9NSHandle'

val AppID = s '{00B39D47-3331-49a7-B54E-32AE6E993C67}'

'TypeLib' = s '{14264AA3-BB53-4d3a-89DE-05AD67D6D6C6}'

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

Config.dll

Internet Explorer\iexplore.exe
SOFTWARE\Microsoft\Windows\CurrentVersion
durlmon.dll
%s
http://www.biso.cc/ld/stat.asp?install
%s\Common Files\stat.dat
http://www.biso.cc/ld/stat.php?uninstal
http://www.biso.cc/ld/stat.asp?open
Software\Microsoft\WindowsLive
CommandBars.ini
start/index.html
file:///%sprofile/Template/
\Unblocksite.dat
webprx
saveKeyword
oleaut32.dll
%d-%s
https
http:
navcancl.htm#
var i = parseInt(document.body.style.zoom);
if(isNaN(i))i=100; if(i<0)i=0; if(i==19)i=18; newZoom=i 10 '%'; document.body.style.zoom=newZoom; 
if(isNaN(i))i=100; if(i<18)i=18; newZoom=i-10 '%'; document.body.style.zoom=newZoom; 
\/:*?"<>|
MSWHEEL_ROLLMSG
RSRC32.dll
Software\Microsoft\Internet Explorer\TypedUrls
Software\Microsoft\Windows\CurrentVersion\Internet Settings
unbock_%d
block_%d
blockage.ini
url_unblock_count
url_block_count
key_0
key_%d
searchkeys.ini
shdocvw.dll
windows-874
windows-1258
windows-1257
windows-1256
windows-1255
windows-1254
windows-1253
windows-1251
windows-1250
www.g-leaf.cn
%s - %s
url_%d
title_%d
last.ini
.com.cn
HOTKEYSET
.ZIP;.RAR;.EXE
bosskey
http://%u.%u.
http://www.baidu.com/s?wd=%s&tt=
d:d:d
.jpeg
Software\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11cf-96B8-444553540000}
%download_info
%download_url
function cancelError() {return true;} onerror=cancelError;function newpropertychange(){var name = event.propertyName.toLowerCase();var elem = event.srcElement;if( name.indexOf('left')>-1||name.indexOf('top')>-1||name.indexOf('move')>-1){ try{ elem.onpropertychange = null; elem.style.visibility = 'hidden'; elem.srcElement.removeNode(true); }catch(e){} }}function killobj(doc,obj){var objs=doc.document.getElementsByTagName(obj);for (var i=0;i
Resource\KillFlyAd.htm
function cancelError() {return true;} onerror=cancelError;var i,len,src,img;len=document.images.length;for(i=0;i
function cancelError() {return true;} onerror=cancelError;function killTag(tagName){var url;var objs=document.getElementsByTagName(tagName);for(i=0;i
o%s\profile\SearchEngine\%s
mskin.ini
%s%s\%s
Language\*.dll
iiedata.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\
Proxy%d_
proxy.ini
%d_ico
%d_title
profile\SearchEngine\config.ini
www.daidu.com
MenuClose.Hover
MenuMaximum.Hover
MenuRestore.Hover
MenuMinimize.Hover
SkinSelect.Hover
TabSidebar.Hover
Search.Hover
Go.Hover
Home.Offset
Home.Hover
Undo.Offset
Undo.Disable
Undo.Hover
Stop.Offset
Stop.Hover
Refresh.Offset
Refresh.Hover
HistoryMenu.Offset
HistoryMenu.Hover
HistoryMenu.Disable
Forward.Offset
Forward.Hover
Forward.Disable
Back.Offset
Back.Hover
Back.Disable
SideClose.Hover
Thumb.Hover.Image
Thumb.Normal.Image
Background.Hover.Image
Background.Normal.Image
Foreground.Image
Progress.Image
StatusBar.Image
InactiveBackground.Image
Background.Image
Split.Hover
Split.Disable
TabNew.Hover
AutoHidePaneBackground.Fill.ColorEnd
AutoHidePaneBackground.Fill.ColorStart
BlockBarBackground.Fill.ColorEnd
BlockBarBackground.Fill.ColorStart
TreeCtrl.Fill.ColorEnd
TreeCtrl.Fill.ColorStart
Tab.InsertSign
Tab.Active.Text
Tab.Hover.Text
Tab.Normal.Text
ToolBar.Style
Menu.Border
Menu.Disable.Text
Menu.Normal.Text
Toolbar.Gripper.ShadowColor
Toolbar.Gripper.Color
Toolbar.Gripper.Width
Toolbar.Gripper.Style
ComboBox.Disable.text
ComboBox.Text
Toolbar.Disable.Text
Toolbar.Normal.Text
Menu.Separator.ShadowColor
Menu.Separator.Color
Menu.Separator.Offset
Menu.Separator.Width
MenuItem.Hover.Image
FavToolBar.Fill.ColorEnd
FavToolBar.Fill.ColorStart
FloatBar.Fill.ColorEnd
FloatBar.Fill.ColorStart
Menu.Fill.ColorEnd
Menu.Fill.ColorStart
Menu.Image
Menu.Style
TitleBackground.Fill.ColorEnd
TitleBackground.Fill.ColorStart
TitleBackground.Image
TitleBackground.Style
Tab.Hover.Image
Tab.Active.Image
Tab.Normal.Image
TabBackground.Fill.ColorEnd
TabBackground.Fill.ColorStart
TabBackground.Image
TabBackground.Style
Button.Checked.Image
Button.Pressed.Image
Button.Hover.Image
Caption.Text
MainPanel.Fill.ColorEnd
MainPanel.Fill.ColorStart
MainPanel.Image
MainPanel.Style
Edit.Height
CustomFrame.CornerRadius
CustomFrame.CornerSize
CustomFrame.Image
%s.Stretch
%s.EndOffset
%s.StartOffset
%s.ExtendSpace
%s.Offset
%s.DrawBackground
%s.Hover
\updatelog.txt
update.exe
Element '%s' at offset %d not ended
End tag '%s' at offset %d does not match start tag '%s' at offset %d
No start tag for end tag '%s' at offset %d
%s at offset %d unterminated
Incorrect %s at offset %d
.The file (%s) aleady exists.
COMCTL32.DLL
User32.dll
user32.dll
oleacc.dll
%s-%s
KeyboardCuesShow
KeyboardCuesUse
AlwaysShowFullMenus
msimg32.dll
winxp.royale.cjstyles
royale.msstyles
winxp.luna.cjstyles
luna.msstyles
WindowRectLeftPos
Right Windows
Left Windows
dUxTheme.dll
Ldwmapi.dll
CONTEXTTAB%s
CONTEXTTAB%sCLIENT
CONTEXTTAB%sGROUPBUTTON
ContextTab%sHeader
%Y-%d-%mT%H:%M:%S
%Y-%d-%m
%H:%M:%S
wID=X, cx=%d, fStyle=X
%i %s
1&0 %s
&%i %s
shell32.dll
OFFICE2007\SCROLLTHUMBHORIZONTAL.BMP
OFFICE2007\SCROLLTHUMBVERTICAL.BMP
OFFICE2007\SCROLLARROWSVERTICALDARK.BMP
OFFICE2007\SCROLLARROWSVERTICALLIGHT.BMP
OFFICE2007\SCROLLARROWSHORIZONTALDARK.BMP
OFFICE2007\SCROLLARROWSHORIZONTALLIGHT.BMP
OFFICE2007\SCROLLVERTICALDARK.BMP
OFFICE2007\SCROLLHORIZONTALDARK.BMP
OFFICE2007\SCROLLVERTICALLIGHT.BMP
OFFICE2007\SCROLLHORIZONTALLIGHT.BMP
OFFICE2007\SCROLLARROWGLYPHS.BMP
WindowsForms
SHLWAPI.DLL
USER32.DLL
KERNEL32.DLL
FRAMECAPTION%s%i
0000..\\updata.exe
(Windows)
:http://127.0.0.1:80
&Windows sockets initialization failed.
!.Icon Files (*.ico)|*.ico|All Files (*.*)|*.*||
|*.htm;*.html|
|*.txt|GIF
|*.gif|JPEG
|*.jpg;*.jpeg|AU
|*.au|AIFF
|*.aif;*.aiff|XBM
|*.xbm|
|*.*||!
(*.txt)|*.txt|
(*.*)|*.*||
(*.exe)|*.exe|
(*.*)|*.*||
IE.Document
IE Files (*.htm,*.html)
Input URL:
0, 1, 1, 982
GreenDou1.exe

worldweather.exe_2452:


.text
`.data
.rsrc
MSVBVM60.DLL
%Z%FG2F1
VB5!6&vb6chs.dll
CMsgTrans
GdiplusShutdown
gdi32.dll
user32.dll
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
wininet.dll
DeleteUrlCacheEntry
mfc5002.dll
kernel32.dll
shell32.dll
user32.dll
orldweather5.0.0
sqliteApi.dll
Sqlite_QueryCityID
VBA6.DLL
[fjbntbpvdqyZgocnvcnvcludmvdnudnucoucoubntcoucoufrx^jpiu{htz_kqdpveqw`lrcou]iofrxhtzdpv`lr`lreqw\hnfrxkw}amscoueqwfrxcoueqwcoudpvbntcoucoucoubntbntcoucoubntbnteqw_kqbntiu{`lrWcihtz
msgID
worldweather.exe
D:\everyday\36
>cmd=[
Cfg5002.ini
worldWeatherRealTime5002.exe
http://tongji.uujzy.com/tongji.html
WeatherContext\WeatherContext.db
http://
?5.0.0.5002_id
?5.0.0.5002_md
AQI.5002.exe
PM25.5002.exe
PM10.5002.exe
tongjizxDataby51la>TongjiUrl=
>port=
Timer_Timer(0)>10>AlreadyHasExecSplitData
Timer_Timer(0)>10>tmr45stoExecSplitData
worldWeatherUpdate.5002.exe
Timer_Timer(5)>readyto>doactiveExecSplitData
skins\default\bg_small.png
skins\default\bg_large.png
skins\common\loading.png
http://weather.uujzy.com:8123/tt.php?id=****
http://sj.tianqi.com/index.php?c=other&a=apppc&id=****
http://i.tianqi.com/index.php?c=other&a=apppc&id=****
http://pm25.uujzy.com:8123/data/****.js
http://www.pm25.in/****
http://weather51la.cnzz.uujzy.com/cnzz/weather/5.0.0.5002/
GetCityIDFromWeatherDBbyIPAndMC>gWeatherUrl,gWeatherUrlBf1=
GetCityIDFromWeatherDBbyIPAndMC>gWeatherUrlBf2=
GetCityIDFromWeatherDBbyIPAndMC>gWeatherUrlBf3=
weatherData.tmp
\n99.png
areacode.db
GetWeatherAQIData>sAQIUrl>
skins\common\kz.png
Adodb.Stream
Microsoft.XMLHTTP
Pm2.5MK.exe
needshowpm25data>readyRunExecFile>
needshowpm25data>notExistExecFile>
AQIContext\AQIContext.db
tryToConnectWeatherService>gWeatherPngUrl=
ConnectWeatherServiceBkInfo>queryifnetactive_Error>tmrtorequerybynexturl>iLoadWeatherFail=
worldWeatherUpdate.5002.exe.tmp
>ReadyTimertoTryNextUrl
cnzz.html
ConnectWeatherServiceBkInfo>loadweatherData_Fail>tmrtorequerybynexturl>iLoadWeatherFail=
tryToConnectWeatherService>beginQueryIfReceiveNetStateMsgIn1min
skins\common\err.png
updatedata/worldWeatherUpdate.5002.exe
QueryIfHaveHighVersion>FindNoUpdateUrl>cancel
debug_main.log
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
HookMsg>
UnhookMsg>
Microsoft Windows NT 4.0
weather.db
Sqlite_QueryCityID>
skins\default\btn_close.jpg
skins\default\btn_max.jpg
skins\default\btn_min.jpg
skins\default\btn_setting.jpg
skins\default\btn_move.jpg
.wServicePackMajor:
.wServicePackMinor:
.wSuiteMask:
.wProductType:
Microsoft Windows 95
Microsoft Windows 98
Microsoft Windows Me
Windows 2000 Data center
Windows 2000 Advanced
Windows 2000
Windows XP Professional
Windows XP Home
Windows XP
Windows Server 2003 Enterprise
Windows Server 2003 Data center
Windows Server 2003 Web Edition
Windows Server 2003 Standard
Windows Server 2003
Windows Vista
Windows Server 2008
Microsoft Windows 7
Windows Server 2008 R2
Microsoft Windows 8
GetwindowsVersion>
world.cn
5.00.5002
worldweather.exe