Trojan.Win32.FlyStudio_aebb3eb403

by malwarelabrobot on May 5th, 2014 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.GenericKD.1656582 (B) (Emsisoft), Trojan.GenericKD.1656582 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan-PSW, Trojan


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: aebb3eb403015059ae8e54d50e9db966
SHA1: b72ca0e60edf4e485f1efac43906e38570aa20eb
SHA256: 0f730f83907ef81703ce4eff001a524deb493c387265adbd2ae72141a4e2d569
SSDeep: 98304:fG8cLz//gGYAfZhCA13s767eUsM6FQuhaV/ZTbFz2PX:O6oZ53syeUsVRaV/ZTbN2PX
Size: 4677632 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PolyEnE001byLennartHedlund, UPolyXv05_v6
Company: no certificate found
Created at: 2014-03-19 10:37:07
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

wuauclt.exe:1880

The Trojan injects its code into the following process(es):

%original file name%.exe:1412

File activity

The process wuauclt.exe:1880 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2448 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)

The Trojan deletes the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)

The process %original file name%.exe:1412 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\soso[1].htm (383 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\wy[1].jpg (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\ico_src[1].png (1534 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (189 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso[2].txt (330 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\xz2[1].png (5063 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\init.v.24[1].js (638 bytes)
%System%\Configuration file.ini (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\cft[1].jpg (4565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\jsanalyzexml.min.v.12[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\salelogo[1].png (8464 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\xz1[1].png (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\sale_bg[1].jpg (671 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\q[1].se&unc=&query=¾¢ÎèЦЦ (7770 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\init.v.24[2].js (1 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (158 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\soso[1].png (618 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\dk[1].jpg (3015 bytes)
%System%\drivers\etc\hosts (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\logo130826[1].png (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\jsanalyzexml.min.v.12[2].js (4 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\soso[1] (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\jquery.form[1].js (5477 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\logo_index[1].png (1797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\ico_icp[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\year[2].jsp (22 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso[1].txt (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\sale_style[1].css (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (3361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\sale_search[1].gif (2 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\jquery.pngFix[1].js (73 bytes)
C:\¾¢ÎèЦЦ-Ψһ¹ÙÍø.url (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\z_stat[1].php (5067 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\button_10[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\jquery.1.3.2.pack[1].js (39083 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\q[1].htm (7142 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\admin_pub[1].js (2749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3.tmp (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\xiazai[1].htm (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\core[1].php (803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\sale_le[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\sale_btn1[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\fav[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (4545 bytes)
C:\ʹÓñؿ´.txt (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (10312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\year[1].jsp (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\icon_index[1].png (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\zfb[1].jpg (8286 bytes)
C:\VIPЦЦ-¹ºÂòÁ´½Ó.url (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\hookbug[1].htm (10776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\xz2[1].png (8820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\btn_del[1].gif (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\jsanalyzexml.min.v.12[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\xz2[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\year[1].jsp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\soso[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\init.v.24[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1412 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "%System%\oleacc.dll"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1395218227"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 5A 99 1C C6 11 7B 13 A2 9E DB 20 AA 42 96 7A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 1110 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1 www.t6t8.com
127.0.0.1 t6t8.com
127.0.0.1 www.jingwuwg.com
127.0.0.1 jingwuwg.com
127.0.0.1 www.52jwyy.com
127.0.0.1 52jwyy.com
127.0.0.1 www.au2014.com
127.0.0.1 au2014.com
127.0.0.1 www.92ausf.com
127.0.0.1 92ausf.com
127.0.0.1 92jwyy.taobao.com
127.0.0.1 www.jwyywg.d131.tqxq.com
127.0.0.1 jwyywg.d131.tqxq.com


Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: WWW.52JWXX.COM
Product Name: ?????????
Product Version: 8.1.0.0
Legal Copyright: WWW.52JWXX.COM ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 8.1.0.0
File Description: ?????????
Comments: 
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 989227 991232 5.10395 80d4d003e036043f6942eddd1201b82e
.rdata 995328 3499198 3502080 5.15624 40a8e8ba3b524f5806f1697e3fecbaae
.data 4497408 276266 73728 4.25974 801aa385f20f54de67ea0019344a207f
.rsrc 4775936 106124 106496 2.40461 de76147f68bae29242797b81d69fba4e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://b.proxy.sogou.com/
hxxp://blogx.sina.com.cn/s/blog_b61e00f001016mtd.html
hxxp://www.hixxg.com/xiazai.html 183.60.204.213
hxxp://b.proxy.sogou.com/soso/images/logo_index.png
hxxp://ctc.a.proxy.sogou.com/websearch/features/year.jsp
hxxp://b.proxy.sogou.com/soso/images/icon_index.png
hxxp://b.proxy.sogou.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢ÎèЦЦ
hxxp://b.proxy.sogou.com/js/kmap/jsanalyzexml.min.v.12.js
hxxp://b.proxy.sogou.com/images/btn_del.gif
hxxp://ctc.a.proxy.sogou.com/images/logo/old/soso.png
hxxp://b.proxy.sogou.com/images/ico_src.png
hxxp://b.proxy.sogou.com/images/ico_icp.gif
hxxp://ctc.a.proxy.sogou.com/img/fav.ico?99eab349-f602-4979-b97d-8aed9e7bfc0c
hxxp://b.proxy.sogou.com/js/kmap/init.v.24.js
hxxp://06811.xdwscache.glb0.lxdns.com/30d/img/web/logo130826.png
hxxp://c.split.cnzz.com/z_stat.php?id=1000293249&show=pic1
hxxp://webproxy-sz.qplus.com/pa?p=2:1848168177:41 &r=0.6772223338484764
hxxp://z5.cnzz.com/stat.htm?id=1000293249&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=14837493-1399157467-&showp=1916x902&st=0&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=1949207463 42.156.140.18
hxxp://c.split.cnzz.com/core.php?web_id=1000293249&show=pic1&t=z
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1542735406
hxxp://icon.cnzz.com/img/pic1.gif 42.156.162.7
hxxp://ssd.tcdn.qq.com/qconn/wpa/button/button_10.gif
hxxp://pcookie.split.cnzz.com/app.gif?&cna=3GDsC2YZlx0CAcGK9Od5msQz
hxxp://www.soso.com/js/kmap/init.v.24.js 220.181.124.154
hxxp://blog.sina.com.cn/s/blog_b61e00f001016mtd.html 218.30.115.254
hxxp://www.soso.com/ 220.181.124.154
hxxp://pcookie.cnzz.com/app.gif?&cna=3GDsC2YZlx0CAcGK9Od5msQz 42.120.219.171
hxxp://www.soso.com/soso/images/icon_index.png 220.181.124.154
hxxp://www.sogou.com/websearch/features/year.jsp 218.30.103.177
hxxp://www.soso.com/images/ico_src.png 220.181.124.154
hxxp://www.soso.com/js/kmap/jsanalyzexml.min.v.12.js 220.181.124.154
hxxp://wpa.qq.com/pa?p=2:1848168177:41 &r=0.6772223338484764 103.7.28.63
hxxp://pub.idqqimg.com/qconn/wpa/button/button_10.gif 103.7.30.59
hxxp://www.soso.com/images/btn_del.gif 220.181.124.154
hxxp://c.cnzz.com/core.php?web_id=1000293249&show=pic1&t=z 42.120.219.6
hxxp://www.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢ÎèЦЦ 220.181.124.154
hxxp://soso.qstatic.com/30d/img/web/logo130826.png 220.162.97.165
hxxp://s23.cnzz.com/z_stat.php?id=1000293249&show=pic1 1.99.192.16
hxxp://www.soso.com/soso/images/logo_index.png 220.181.124.154
hxxp://www.sogou.com/img/fav.ico?99eab349-f602-4979-b97d-8aed9e7bfc0c 218.30.103.177
hxxp://www.sogou.com/images/logo/old/soso.png 218.30.103.177
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1542735406 42.120.219.171
hxxp://www.soso.com/images/ico_icp.gif 220.181.124.154
www.hookbug.com 183.60.204.213


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET DNS DNS Query for Suspicious .com.cn Domain
ET POLICY HTTP Request on Unusual Port Possibly Hostile
ET POLICY Unsupported/Fake Windows NT Version 5.0

Traffic

GET /30d/img/web/logo130826.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢ÎèЦЦ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: soso.qstatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 27 May 2014 03:00:51 GMT
Date: Sun, 27 Apr 2014 03:00:51 GMT
Content-Type: image/png
ETag: "52594142"
Accept-Ranges: bytes
Last-Modified: Mon, 26 Aug 2013 08:32:00 GMT
Cache-Control: max-age=2592000
Content-Length: 2443
Server: WS CDN Server
Age: 1
X-Via: 1.1 zjjx159:8105 (Cdn Cache Server V2.0), 1.1 qz163:5 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.............K-......PLTE...DDEffg...IIJ...QQRMMNFFG..
....[[\.....<.................Nxxy.jZ......e...............TC......
.....@.........^^_iij............KKL............B.....................
O=........a............................F3...wwx.......^M...........a..
u........]......E....Jy....Z......aaa......mmn..9~~...o...XXY.YH......
.....q..h.cS....L9[...............G4qqr..>K..........Ddde}}~......z
z{.....G.........ttt.................T...........s.....q...WWX.....i..
..se................\K...t..........W...........y..............U......
.....................T.......e.....................__`..............R.
...........ccd.....|..k...................J8............eef...||}..z..
..................'..........................}.oa......oop...uuv}.....
.....u..gVVW..........`[email protected][email protected]
x^..c.,M..3..:.m...m..m..m....mk2..o.97b76.>?z:...DuVV..v....V...'.
D.|....p...w~y)3<6.L....9I.K.......I..[....b.m.&.^[email protected]
Z.9`..J...{[email protected].\.1.....^.! ..$....8.$n|..|............S2'
.X..".D`.~..bn...I.4-..4M.z.4rEfkZ..(F..#]....Jj9....8Q.....=By.-E.. ^
..D.}u...vG.Q1.....X..VJ\>......e.pmXYYX...)...-.6|..!...q*4(......
.s..Y(.$........X.. .Ll..V2..)Y..0...]...yt...R....a Y....PT.._.....N.
..v.w8(.......Q......z..~...M..l4.$?XB.w..g.... .....?.A..f...EJv.....
o.,M.d....ns....w...U.5.K..i6...(.d.....K..L6...A.H.v...` .:2.-.......
#.V.....a4..B..N.1...H>`......Ih.g"YLI..9VkO<f.[.D......l..Z....
8......%eT[......z..~.F[`{.R.6 Uir...^..........u'(..$...w(z.`.1..
<<< skipped >>>


GET /qconn/wpa/button/button_10.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: pub.idqqimg.com


HTTP/1.1 200 OK
Server: NWS_UGC_HY
Connection: keep-alive
Date: Sat, 03 May 2014 22:51:07 GMT
Cache-Control: max-age=2592000
Expires: Mon, 02 Jun 2014 22:51:07 GMT
Last-Modified: Mon, 08 Apr 2013 03:15:19 GMT
Content-Type: image/gif
Content-Length: 2997
X-Cache-Lookup: Hit From DiskCache
GIF89aM..........me.{l...............`u.jmt......n..sv|.i].c\.....n...
?Xf......nqy~...rf..qSiv.......................t...............y|....@
Yg.~t.....kv..efm.....................Nes......cdn)FVz.....s.......WQT
V._\.i`......'EUdx.`bl*GW^t.dejcdj^`h......<Ve...............;Ud...
......=We|..................2E........................................
....................>Wf.........w..(EV...............r.............
..................................[r........................V.mh......
w{..~m.._......iei..~..s.qh.pn..U.....^...............udh.............
....................gini....x..~...........X......ebk..q.......ub.zh..
.....WX.......fa.ib.ed..p..w..q..e...sv....ty...[.....U.sj..j..v.mkhjs
............sqv........^..k........a.k]...kn{.........................
.................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehi
HzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="A
dobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <
;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> &
lt;rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1
.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" x
mlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.
did:E41382F2429BE211A018AF641D24CE9C" xmpMM:DocumentID="xmp.did:8AF3F4
679FFA11E2AFECC3046E5C8B96" xmpMM:InstanceID="xmp.iid:8AF3F4669FFA11E2
AFECC3046E5C8B96" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:25F0FBA9669BE211A0
<<< skipped >>>


GET /9.gif?abc=1&rnd=1542735406 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Server: Tengine
Date: Sat, 03 May 2014 22:51:08 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=3GDsC2YZlx0CAcGK9Od5msQz; expires=Tue, 30-Apr-24 22:51:08 GMT; path=/; domain=.mmstat.com
Set-Cookie: sca=94af1fe3; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=626822c4dad17846cb82ce90_1399157468; expires=Tue, 30-Apr-24 22:51:08 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=3GDsC2YZlx0CAcGK9Od5msQz
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Sat, 03 May 2014 22:51:08 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=3GDsC2YZlx
0CAcGK9Od5msQz; expires=Tue, 30-Apr-24 22:51:08 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=94af1fe3; path=/; domain=.cnzz.mmstat.com..
Set-Cookie: atpsida=626822c4dad17846cb82ce90_1399157468; expires=Tue, 
30-Apr-24 22:51:08 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt
p://pcookie.cnzz.com/app.gif?&cna=3GDsC2YZlx0CAcGK9Od5msQz..Expires: T
hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach
e..GIF89a.............!.......,...........L..;..



GET /z_stat.php?id=1000293249&show=pic1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s23.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Date: Sat, 03 May 2014 22:51:07 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Sat, 03 May 2014 22:51:07 GMT
Expires: Sun, 04 May 2014 00:21:07 GMT
ef2..(function(){function l(){this.c="1000293249";this.R="z";this.N="p
ic1";this.K="";this.M="";this.o="1399157467";this.P="z5.cnzz.com";this
.L="";this.s="CNZZDATA" this.c;this.r="_CNZZDbridge_" this.c;this.G="_
cnzz_CV" this.c;this.u="0";this.B={};this.a={};this.la()}function g(a,
b){try{var c=[];c.push("siteid=1000293249");.c.push("name=" d(a.name))
;c.push("msg=" d(a.message));c.push("r=" d(h.referrer));c.push("page="
 d(f.location.href));c.push("agent=" d(f.navigator.userAgent));c.push(
"ex=" d(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new I
mage).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(e){}}var 
h=document,f=window,d=encodeURIComponent,k=decodeURIComponent,p=unesca
pe,r=escape,m="https:"===f.location.protocol?"https:":"http:",s=m "//c
.cnzz.com/core.php";l.prototype={la:function(){try{this.U(),.this.J(),
this.ia(),this.H(),this.m(),this.ga(),this.fa(),this.ja(),this.j(),thi
s.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),f[t
his.r]=f[this.r]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa
:function(){try{var a=this;f._czc={push:function(){return a.C.apply(a,
arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=f._cz
c;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;
b  ){var c=a[b];switch(c[0]){case "_setAccount":f._cz_account="[object
 String]"===.{}.toString.call(c[1])?c[1]:String(c[1]);break;case "_set
AutoPageview":"boolean"===typeof c[1]&&(f._cz_autoPageview=c[1])}}}cat
ch(e){g(e,"cS failed")}},qa:function(){try{if("undefined"===typeof
<<< skipped >>>


GET /s/blog_b61e00f001016mtd.html HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: blog.sina.com.cn
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.2.8
Date: Sat, 03 May 2014 22:50:51 GMT
Content-Type: text/html
Content-Length: 25757
Connection: keep-alive
Vary: Accept-Encoding
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Cache-Control: no-cache
Expires: Sat, 03 May 2014 22:50:50 GMT
Last-Modified: Sun, 04 May 2014 01:11:31 GMT 8
DPOOL_HEADER: 10.55.27.52
SINA-LB: aGwuOTAuc2c1LmphLmxiLnNpbmFub2RlLmNvbQ==
SINA-TS: YzVmOWU0Y2UgMCAwIDAgOCAxMDAK
Age: 20369
X-Cache: HIT from blog-front005.blog.ja.sinanode.com
X-debug: 218.30.115.254
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xml
ns="hXXp://VVV.w3.org/1999/xhtml">.<head>.<meta http-equiv
="Content-Type" content="text/html; charset=utf-8" />.<title>
.................._........._............</title>.<meta name=
"keywords" content=".................._........._............,........
.,it" />.<meta name="description" content=".................._..
......._............,.........," />.<meta http-equiv="X-UA-Compa
tible" content="IE=EmulateIE7" />.<!...[if lte IE 6]>.<scr
ipt type="text/javascript">.try{.document.execCommand("BackgroundIm
ageCache", false, true);.}catch(e){}.</script>.<![endif]...&g
t;.<script type="text/javascript">.window.staticTime=new Date().
getTime();.</script>.<link rel="pingback" href="hXXp://upload
.move.blog.sina.com.cn/blog_rebuild/blog/xmlrpc.php" />.<link re
l="EditURI" type="application/rsd xml" title="RSD" href="hXXp://upload
.move.blog.sina.com.cn/blog_rebuild/blog/xmlrpc.php?rsd" />.<lin
k href="hXXp://blog.sina.com.cn/blog_rebuild/blog/wlwmanifest.xml" typ
e="application/wlwmanifest xml" rel="wlwmanifest" />.<link rel="
alternate" type="application/rss xml" href="hXXp://blog.sina.com.cn/rs
s/3055419632.xml" title="RSS" />.<link href="hXXp://simg.sinajs.
cn/blog7style/css/conf/blog/article.css" type="text/css" rel="styleshe
et" /><link href="hXXp://simg.sinajs.cn/blog7style/css/commo
<<< skipped >>>


GET /app.gif?&cna=3GDsC2YZlx0CAcGK9Od5msQz HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: pcookie.cnzz.com


HTTP/1.1 200 OK
Server: Tengine
Date: Sat, 03 May 2014 22:51:09 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=3GDsC2YZlx0CAcGK9Od5msQz; expires=Tue, 30-Apr-24 22:51:09 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Sat, 03 May 2014 22:51:09 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=3GDsC2YZlx0CA
cGK9Od5msQz; expires=Tue, 30-Apr-24 22:51:09 GMT; path=/; domain=.cnzz
.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache.
.Pragma: no-cache..GIF89a.............!.......,...........L..;..



GET /soso/images/icon_index.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:50:58 GMT
Content-Type: image/png
Content-Length: 3310
Connection: keep-alive
Last-Modified: Fri, 28 Mar 2014 08:08:00 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:50:58 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53352de0-cee"
Expires: Mon, 02 Jun 2014 22:50:58 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR...d...x.....3(......PLTE.......~.......E..v.....'....
.......S...............~..s..v.......L..f.......................M.....
h.....&.....M..;...~..........m......x........|.P........N...z....A...
...}.^..U...........F...{................X......y...........}.....}...
....]..G...y..........................|..........5..............0.....
.|....5.........v...........z.........................................
.....................|.>...........P................. .............
.............-....................... ....................,........P..
....t...........z..|...........{........}..~..~..}..~.............[...
......}.....~....$......|..~.,..v...}.P..:.........~.".........|.e..'.
[email protected]......}.........................H...........
...J......................................1.!.....tRNS.@..f....IDATx^.
.5.$I.E..........353.- z..,...U...%....4.l.6.c...P..m...pF.M.w..aK.z(.
h.J.BH.!...B<..:.CC...C,....0.-3..e.......hA.P..ai..=P...?....:b[.j
.y!a.........?>...T.3..E...nvpe.....k.........z......=.a(..-U..W...
......z....}..P;..l.}..l^fY.G!..&C.Rp....W...9...QH s...].?....jU_)u.P
.B.sBh.W/o......mUY..(.X......-.w.n....{."h..{.RhWJ.z..U....(....Y..!^
..V..i'....&nhMN.K.|(.....a.G!..,..\j..{..{.}..C=..\...p.XN6/.....q)..
.x.....W.W...a..../..P.B,x .....I...._~.t.......mA..7..<..<..(D.
. ....S..MF.....j4.Bh...`h..`...1.`G..M,[email protected]<
.4.v.%.Yl4.5......9Vi ..0<e.B...DR...l..N..aK...X.........6...X.. .
.<@......Uz....a...4?G..>L.F..%R\...*fMU5U.Hw.x.(.Ak.H.....7
<<< skipped >>>

GET /js/kmap/jsanalyzexml.min.v.12.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢ÎèЦЦ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1; SUV=1399157474856700; SNUID=4B5F216DACAF542D10F61563AC479AF4


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:51:00 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 30 Apr 2014 02:16:32 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:51:00 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Expires: Mon, 02 Jun 2014 22:51:00 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
830.............X.v.6.~....!"...&MC.>......u{....HPbL...Zv%...../..
....d9...G..`....7y.........../...G.............^=...Y...-. rln....%~8
S......t......u....LP..HE1.-....H.,.AJ.@...#..{..t.s.8.)....D].#as?..(
Q....-......V....K:z..S).r..)...{.r.O#O.4....A...^.kq.........VR.#.&.~
.....b;I)`AJ..C.( .....". ..PV"..O...\z..D..7CE.>.6...i...7.......6
.~..@9..$J#.i...F..f...C.g.R$$Ad.|...'.eI...n.d.......................
........?$........}.h.LP..N...k."Z.Q.N...XZx5.@.(.M..-......D~.*S..-U.
...!..Z.;.=.tw.=,..A..)#.OP....!uQ.%.Rp0.0..f.F.L..W.../..../...$e5..!
^...6.%.....=....%O:..j;.....B..z%l...}.t....:...".zx.W&A..8....|..b.`
]..O3Fa..n...Y.4....E....&.>...zmHX..~....a......AF....o..S.6<[K
.]c..v.. .......d>.5|A..[..25.T.L..&.F.t.........b.!g......N.......
7.v....J...^.""o..%d..1...R...c.U...b}..Bu..n.p.WFkc.n....Z'.j...Q.n_.
Cq-..^....... ..............~....p[..5....._.M....>.4..R.r....=.T.2
.....p.....@.".......%....%f?..r.......2ht..RD.....X.....I..H..i`...$.
..L..(..bm.".........Zh....[..ln.n@k.}..^y\.....=.i._.m.....Z.?.?w....
.?up.iq8Cz_...$j\.x.....P.E..~.O}x..c.=..R..b?..GP'~.V@.....\.....)...
l ........nA.|3.\.......CmN....>......oJ#$7....\%..q........vD.6.k^
...Q..a.....0.......g...i.v&u...o...Y.....V ...7[a....E ......Za.J .$x
..5..!..yg.vt..$....Fc.of....2..s%:d...R.ov........G-..S}....km..../..
J&...u./Uz.(...5.....yU"...@*..... [email protected].^...#.....7..Q..o
.c...6..'...J#.7...7.1X..^s....7....^...u.K..69.....>.q_2.Q..."D.f.
..;.............$0.l.!.y...[..f.T...z........%....#I.N7.........m.
<<< skipped >>>

GET /images/ico_src.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢ÎèЦЦ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1; SUV=1399157474856700; SNUID=4B5F216DACAF542D10F61563AC479AF4


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:51:01 GMT
Content-Type: image/png
Content-Length: 8524
Connection: keep-alive
Last-Modified: Fri, 28 Mar 2014 08:08:15 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:51:01 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53352def-214c"
Expires: Mon, 02 Jun 2014 22:51:01 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR...Y...t......9.G....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>


GET /websearch/features/year.jsp HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.sogou.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:50:58 GMT
Content-Type: application/x-javascript; charset=gbk
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: ABTEST=5|1399157458|v17; expires=Mon, 02-Jun-14 22:50:58 GMT; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:50:58 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: SUID=E7F48AC11424900A00000000536572D2; expires=Fri, 28-Apr-34 22:50:58 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Expires: Sat, 03 May 2014 22:50:58 GMT
Cache-Control: max-age=0
Content-Encoding: gzip
30............J.O..M. . /.,I.P7204Q.........i.........0..HTTP/1.1 200 
OK..Server: nginx..Date: Sat, 03 May 2014 22:50:58 GMT..Content-Type: 
application/x-javascript; charset=gbk..Transfer-Encoding: chunked..Con
nection: keep-alive..Set-Cookie: ABTEST=5|1399157458|v17; expires=Mon,
 02-Jun-14 22:50:58 GMT; path=/..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR
 BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Set-Cookie: IPL
OC=UA; expires=Sun, 03-May-15 22:50:58 GMT; domain=.sogou.com; path=/.
.P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM
 NAV OTC NOI DSP COR"..Set-Cookie: SUID=E7F48AC11424900A00000000536572
D2; expires=Fri, 28-Apr-34 22:50:58 GMT; domain=.sogou.com; path=/..P3
P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NA
V OTC NOI DSP COR"..Expires: Sat, 03 May 2014 22:50:58 GMT..Cache-Cont
rol: max-age=0..Content-Encoding: gzip..30............J.O..M. . /.,I.P
7204Q.........i.........0......
<<< skipped >>>

GET /images/logo/old/soso.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢ÎèЦЦ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.sogou.com
Connection: Keep-Alive
Cookie: ABTEST=5|1399157458|v17; IPLOC=UA; SUID=E7F48AC11424900A00000000536572D2


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:51:01 GMT
Content-Type: image/png
Content-Length: 2990
Connection: keep-alive
Last-Modified: Tue, 29 Apr 2014 05:49:24 GMT
ETag: "535f3d64-bae"
Expires: Mon, 02 Jun 2014 22:51:01 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR...P.........)$>^....tEXtSoftware.Adobe ImageReadyq
.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xa
p/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="htt
p://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Ph
otoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:2512D67CC6E611E3860CCB2
0D69AB655" xmpMM:DocumentID="xmp.did:2512D67DC6E611E3860CCB20D69AB655"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2512D67AC6E611E38
60CCB20D69AB655" stRef:documentID="xmp.did:2512D67BC6E611E3860CCB20D69
AB655"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>f.B....$IDATx..X.TSW...a_D...EA..D.cY-.E."
..i..8 BG..:g.r,..2u....0...h.CEi V... (.l.&.vH...dy..$......qN..=...{
.{......{.. ..d.g..S.......5..G....Lh`...&..=.H...I.Y.?.l.j....PU.....
.b...QK..A.f...n.O'..=.=-..2.......Y...W......(.G.D.E.N%.a.....Y&..Dc.
............2%...O..z.s.....4k...Po(/V....X..hi....-P_.e?...R.. .o....
...,.....`C8.L.C.y.f.....y.p...).`B.i.|..[..Q6k.m..!..]."..j....dZ...n
9..q$........j}..i.....\.M......m..db.....s.....#.....@...^.o..Pr}.]..
.{....z.3...O..m.|./.w..F>.L....K............[5..a........Rq.t)*.z.
.R.f.Y........V......s.ls.!.Q..`.v.....[".N...RPU#.~=..1"..[. ....
<<< skipped >>>


GET /img/fav.ico?99eab349-f602-4979-b97d-8aed9e7bfc0c HTTP/1.1
Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢ÎèЦЦ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.sogou.com
Connection: Keep-Alive
Cookie: ABTEST=5|1399157458|v17; IPLOC=UA; SUID=E7F48AC11424900A00000000536572D2


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:51:01 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: ng
inx..Date: Sat, 03 May 2014 22:51:01 GMT..Content-Type: image/gif..Con
tent-Length: 43..Connection: keep-alive..Last-Modified: Mon, 28 Sep 19
70 06:00:00 GMT..GIF89a.............!.......,...........L..;..



GET /xiazai.html HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hixxg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 266
Content-Type: text/html
Last-Modified: Wed, 19 Mar 2014 08:51:53 GMT
Accept-Ranges: bytes
ETag: "80da62795043cf1:469"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 03 May 2014 22:48:38 GMT
<html>..<head>..<meta http-equiv="Content-Language" con
tent="zh-CN">..<meta HTTP-EQUIV="Content-Type" CONTENT="text/htm
l; charset=gb2312">..<meta http-equiv="refresh" content="0.1;url
=hXXp://VVV.hookbug.com:5151/">..<title></title>..</
head>..<body>..</body>..</html>HTTP/1.1 200 OK..C
ontent-Length: 266..Content-Type: text/html..Last-Modified: Wed, 19 Ma
r 2014 08:51:53 GMT..Accept-Ranges: bytes..ETag: "80da62795043cf1:469"
..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Sat, 03 May 
2014 22:48:38 GMT..<html>..<head>..<meta http-equiv="Co
ntent-Language" content="zh-CN">..<meta HTTP-EQUIV="Content-Type
" CONTENT="text/html; charset=gb2312">..<meta http-equiv="refres
h" content="0.1;url=hXXp://VVV.hookbug.com:5151/">..<title>&l
t;/title>..</head>..<body>..</body>..</html>
;..



GET /pa?p=2:1848168177:41 &r=0.6772223338484764 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wpa.qq.com
Connection: Keep-Alive


HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Location: hXXp://pub.idqqimg.com/qconn/wpa/button/button_10.gif
Pragma: no-cache
Connection: close
Cache-Control: no-cache; must-revalidate
Date: Sat, 03 May 2014 22:51:07 GMT
Content-Length: 0



GET /core.php?web_id=1000293249&show=pic1&t=z HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Date: Sat, 03 May 2014 22:51:08 GMT
Content-Type: application/javascript
Content-Length: 803
Connection: keep-alive
Last-Modified: Sat, 03 May 2014 22:51:08 GMT
Expires: Sat, 03 May 2014 23:06:08 GMT
!function(){var a,b,c,d=encodeURIComponent,e="1000293249",f="pic1",g="
",h="online_v3.php",i="z5.cnzz.com",j="1",k="pic",l="z",m="站
8271;统计",n=window["_CNZZDbridge_" e].bobject,o="https:"=
=document.location.protocol?"https:":"http:",p="0",q=o "//online.cnzz.
com/online/" h,r=[];r.push("id=" e),r.push("h=" i),r.push("on=" d(g)),
r.push("s=" d(f)),q ="?" r.join("&"),"0"===p&&n.callRequest([o "//cnzz
.mmstat.com/9.gif?abc=1"]),j&&(""!==g?n.createScriptIcon(q,"utf-8"):(b
="z"==l?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" e:"hXXp://quanj
ing.cnzz.com","pic"===k?(c=o "//icon.cnzz.com/img/" f ".gif",a="<a 
href='" b "' target=_blank title='" m "'><img border=0 hspace=0 
vspace=0 src='" c "'></a>"):a="<a href='" b "' target=_bla
nk title='" m "'>" m "</a>",n.createIcon([a])))}();...HTTP/1.
1 200 OK..Server: Tengine..Date: Sat, 03 May 2014 22:51:08 GMT..Conten
t-Type: application/javascript..Content-Length: 803..Connection: keep-
alive..Last-Modified: Sat, 03 May 2014 22:51:08 GMT..Expires: Sat, 03 
May 2014 23:06:08 GMT..!function(){var a,b,c,d=encodeURIComponent,e="1
000293249",f="pic1",g="",h="online_v3.php",i="z5.cnzz.com",j="1",k="pi
c",l="z",m="站长统计",n=window["_CNZZDbridge_"
 e].bobject,o="https:"==document.location.protocol?"https:":"http:",p=
"0",q=o "//online.cnzz.com/online/" h,r=[];r.push("id=" e),r.push("h="
 i),r.push("on=" d(g)),r.push("s=" d(f)),q ="?" r.join("&"),"0"===p&&n
.callRequest([o "//cnzz.mmstat.com/9.gif?abc=1"]),j&&(""!==g?n.cre
<<< skipped >>>


GET / HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:50:57 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Fri, 28 Mar 2014 08:08:00 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:50:57 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: SUID=E7F48AC11424900A00000000536572D1; expires=Fri, 28-Apr-34 22:50:57 GMT; domain=.soso.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Expires: Sat, 03 May 2014 22:50:57 GMT
Cache-Control: max-age=0
Content-Encoding: gzip
b2a.............Y[o$G.~v....r.g....{.......F..dw.(.......=]..j...<.
..H!..D....)..M$. .$.&.....s..6..m.U}..;.N.......g/o_.......>....O.
Gj..o.<..s..H.....8..m.*.*..Q.)q.j@.?TMd..w....A....%M........n.../
n......s.i.....u..k[.#...T5.\.\...S|...L|...N...Y.&..Ds......AF\.#.%.V
.{=".x<...:...*I.H. .8h..AR`...D..e<n..F..9..<..]...1.}...S..
\...K.[.....4... c.B.a(C.......g(...q Bn,"7"..})...8.~..{~,..t.......k
..!Ql$..AX,.8..0.......N.J$.o.A..llvg...!.m|.....j._..{e,.[......../..
.\.QZ.P..FV..J.........Qm-.LS......... .....(s.#<.S.Y.I:.h..$...R..
C.Ad.'O$Q..!"..XN ..J.3.,*.............9R)9..... ..F....~9....d..,.k..
.D.m......'..N..F...V)(......!.nUrQ.....a...$%".....,.(>.v..Nv.....
...^n....d)........D..#.....v.K.Cm..3O..0.|..s.ge.Yhbz.T 2U....%......
.......Yy& r|..e.V2b..\...A.z..u....Y.sTx.pAIV.e.]..i....LdS..........
aG._.o..G.)S..1.k..1RV......B...2r.8A.#).. ....6Z%.Z.Z[......._le.`...
d4.G..VR.K... Fw,.(.A.....}....g.ny.>.|g...C..&k*[email protected]
.9:..x..... ..V........d....j.&..2Mxv&.x......z.Awr. \t1..!.N..5..#...
...p.,g.......C....j.....dj_......J.....D..9;....M[..Qp.....V......>
;....3M[..f...5.a..6*/..|:...?S.y=.....e..S....}..Z......*...F...N.p..
.."...8..7..:.G/[..3.7.0.SY3.".$#C.g.`..........N"Z]...$.u..P..m..o.%=
......$..3]..L.]..<...F.f.8..;...~.1..=}.Kcq.jK.R...~....k..;_.....
...f..Wn .=....H....r.t.|8.8.v..F...]9.../..w..,.nf....n.|......7..J?.
........5.P..O~}./.?..q....e...............W:wV'.3.&<....ej.mn..\Cn
.~p.^.......0.. b..0.....-%.......o.|.8A..$)c......,.........>.
<<< skipped >>>

GET /soso/images/logo_index.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.soso.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:50:58 GMT
Content-Type: image/png
Content-Length: 5020
Connection: keep-alive
Last-Modified: Fri, 28 Mar 2014 08:08:00 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:50:58 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53352de0-139c"
Expires: Mon, 02 Jun 2014 22:50:58 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR.......1.....6.F.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:BA474413854011E2AD099132
6E52ED8A" xmpMM:DocumentID="xmp.did:BA474414854011E2AD0991326E52ED8A"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BA474411854011E2AD
0991326E52ED8A" stRef:documentID="xmp.did:BA474412854011E2AD0991326E52
ED8A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>c..{....PLTE...{{|....... ,......QQSFFI....
.d.....n..2....tt...ggh:..K......OOZZ\...........w......B..E....0.....
...L.....4.22...........Z........3........2........R..W.........^....N
..............g...........]........PTTV]]_LLM..a........3.............
[email protected]......^`
b..........@?prsVVY.....i.........q..~.K..j..............ROOP.33.aa..=
......G....IDATx....C.....>(..h-.. ..y*..y.ik......A*..R.9.....>
.Iv..|........:3;.D....._Gy.I.\.......\..=.@ .....x@&..?..........._.5
....7/.....//N..J.ooo..G.#...6d.W...h..\..\T......o..M=..*T^.v;m..
<<< skipped >>>

GET /q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢ÎèЦЦ HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.soso.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:50:59 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: SNUID=4B5F216DACAF542D10F61563AC479AF4; expires=Tue, 13-May-14 22:50:59 GMT; path=/
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:50:59 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
set-cookie: ld=0aEjokllll2FBgaFlllllV2OtHGlllllZYr1iZllll9llllllZlll5@@@@@@@@@@; path=/; expires=Mon, 02 Jun 2014 22:50:59 GMT; domain=.sogou.com
Cache-Control: max-age=0
Expires: Sat, 03 May 2014 22:50:59 GMT
Content-Encoding: gzip
266.............S.k.@....?L.R..d...t..v..J..)..L..d.$.g^6]...A..7/....
.O.K..g8I`).!^.<..........1~>.........tzvpr<B.!.....q0n..n...
.....9...>......!UU... UB..$.L..!.fn.1.zu.XF...1...9.]..>~...;#.
..x(.F.......C.!..c...`V........E)U.._..y...k....RL.X.RAT....Q........
,.Hf.g4a.l.H"EL&tZs\c0......\:M.!...`...?......o?..[^]_-[.....8.s.....
.....#-.......T!.....z..Y....e.n. ..q.=...8.2..e*[email protected]....$...L...ja.(
B....I`<..yT....q.=1.'.......E......V.5#.#3....u;.,..{...ba`....*m.
.xD..itaE=.....f...f.......4...<g.....v7-\(....9... ..].3a...B..ov.
F.r.C.8.N....H.x.i.N).I....U.......F.. ...wg.6i.0.........e.o.lW.V....
..i.........5af...Xm..F.. ..rv....g NU%..Jm.FQ U.i..^..Y.....3..f..S.X
..0...<.<../D.A<k?.....j......t......%n..u,]sx.K.\..t...K....
t.~....#,]..X.*...q.-..f.....3..A.?$%.;.....8y......9....D.......&|._=
.....{O..........Q3.......u.t.vOog.......*\..O...w.w...n..CZ%N........
?....C........G.......o./.....~../.~...r........7E..x...hB..`2.{.%...N
.....e....M.o..\.0.......{Gd.\.....D..j.a;.J....*X.....E*..[9....z.?..
........sX.....(......a.<:G..4v..p..%[email protected]!...2.'.Kx@...*
`..en..i..[>..$J.3..p.../W.T..cna..zD...uLx. ...p..,.Z...:q.O$.(...
H...F..1J~...P....C... .......".b(.r......,.s..Xj.........9.......q*@.
7...}I.......{ge....<5.7....B.RN......e:T,........V~Rf.~... .......
.3.k2[..~..a.mk].Y..c4%...].d.va.......I..\.Y._.a].....7.7F.?....I.2..
..`)..iJI.=.?.`......v..R.....=.8L.v...i`.0.....:.... A^B ..A......."P
.X/....I..k$....,.....{..`....*iy.b.M/@.....vvM...d...J...p"..Bsae
<<< skipped >>>

GET /images/btn_del.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢ÎèЦЦ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1; SUV=1399157474856700; SNUID=4B5F216DACAF542D10F61563AC479AF4


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:51:01 GMT
Content-Type: image/gif
Content-Length: 1286
Connection: keep-alive
Last-Modified: Fri, 28 Mar 2014 08:08:14 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:51:01 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53352dee-506"
Expires: Mon, 02 Jun 2014 22:51:01 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
GIF89a................................................................
.......................................!..XMP DataXMP<?xpacket begi
n="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adob
e:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:
56:27        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22
-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http:
//ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/"
 xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:Crea
torTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:0DC8
9FA742CA11E3911B860E70DCA297" xmpMM:DocumentID="xmp.did:0DC89FA842CA11
E3911B860E70DCA297"> <xmpMM:DerivedFrom stRef:instanceID="xmp.ii
d:0DC89FA542CA11E3911B860E70DCA297" stRef:documentID="xmp.did:0DC89FA6
42CA11E3911B860E70DCA297"/> </rdf:Description> </rdf:RDF&g
t; </x:xmpmeta> <?xpacket end="r"?>.......................
......................................................................
.....................................~}|{zyxwvutsrqponmlkjihgfedcba`_^
]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! ..
...............................!.......,..........g.$JL.L..0c..0......
0..=30C`.Z.......,.....k8.LG.v.Y#.mlp.........Q..L.n|.S [email protected].<=
2#6.94.>4"%'.q,#!.;....
<<< skipped >>>

GET /images/ico_icp.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢ÎèЦЦ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1; SUV=1399157474856700; SNUID=4B5F216DACAF542D10F61563AC479AF4


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:51:01 GMT
Content-Type: image/gif
Content-Length: 1139
Connection: keep-alive
Last-Modified: Fri, 28 Mar 2014 08:08:14 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:51:01 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
ETag: "53352dee-473"
Expires: Mon, 02 Jun 2014 22:51:01 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
GIF89a...................!..XMP DataXMP<?xpacket begin="..." id="W5
M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:
xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "
> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns
#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com
/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe
 Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:29A259B042D711E3AB
C99BBCDC02AA8E" xmpMM:DocumentID="xmp.did:29A259B142D711E3ABC99BBCDC02
AA8E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:29A259AE42D7
11E3ABC99BBCDC02AA8E" stRef:documentID="xmp.did:29A259AF42D711E3ABC99B
BCDC02AA8E"/> </rdf:Description> </rdf:RDF> </x:xmpm
eta> <?xpacket end="r"?>.....................................
......................................................................
.......................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQP
ONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! ................
.................!.......,..........(.."p..N.j..q.|e....L!......s...E.
.8vn.y..;....
<<< skipped >>>

GET /js/kmap/init.v.24.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.soso.com/q?utf-8=ie&pid=s.idx&cid=s.idx.se&unc=&query=¾¢ÎèЦЦ
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.soso.com
Connection: Keep-Alive
Cookie: SUID=E7F48AC11424900A00000000536572D1; SUV=1399157474856700; SNUID=4B5F216DACAF542D10F61563AC479AF4


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2014 22:51:01 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 01 May 2014 05:17:47 GMT
Set-Cookie: IPLOC=UA; expires=Sun, 03-May-15 22:51:01 GMT; domain=.sogou.com; path=/
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Expires: Mon, 02 Jun 2014 22:51:01 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
27e...............o.0.....?..9...3..ss.].r.%.,.p.h...Ug.....0.........
.o...&~.8..~.....w.....`E... mF(...mnM.1W....(...V.[.oU..p....oK.w....
......]r..W.......W. ..w%..$........5.x..*\....vJ.x[....KW..n.U.[.=...
CdFX.N-)..T.lK6.E(n..t.\.EqDjAG..\..!...%..../,D...&....h.4..._....f.d
.....w8.';..2?..n<.A...|0._....PC....9&i...y.....l([email protected]..
p...\il...QF................"$...e.#br...zr........q..7.s......?...2..
...pt.j...lM..._./.`c.7 ..z.Q\*.;KhI..t...2......./.....3.0.!K.....>
;h...../..>..p.i.7......'.=5..8H....._T..,).y..M.....3.(....a......
.3?..t..K,.....q....d;E..C.\e.|......l.0.....!.Wkv.....gy^sqr...W..*..
q.....D.<.......V.Z.....0..HTTP/1.1 200 OK..Server: nginx..Date: Sa
t, 03 May 2014 22:51:01 GMT..Content-Type: application/x-javascript..T
ransfer-Encoding: chunked..Connection: keep-alive..Last-Modified: Thu,
 01 May 2014 05:17:47 GMT..Set-Cookie: IPLOC=UA; expires=Sun, 03-May-1
5 22:51:01 GMT; domain=.sogou.com; path=/..P3P: CP="CURa ADMa DEVa PSA
o PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Expir
es: Mon, 02 Jun 2014 22:51:01 GMT..Cache-Control: max-age=2592000..Con
tent-Encoding: gzip..27e...............o.0.....?..9...3..ss.].r.%.,.p.
h...Ug.....0..........o...&~.8..~.....w.....`E... mF(...mnM.1W....(...
V.[.oU..p....oK.w..........]r..W.......W. ..w%..$........5.x..*\....vJ
.x[....KW..n.U.[.=...CdFX.N-)..T.lK6.E(n..t.\.EqDjAG..\..!...%..../,D.
..&....h.4..._....f.d.....w8.';..2?..n<.A...|0._....PC....9&i...y..
...l([email protected]...\il...QF................"$...e.#br...zr..
<<< skipped >>>


GET /img/pic1.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: icon.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine/1.3.0
Date: Sat, 03 May 2014 22:51:08 GMT
Content-Type: image/gif
Content-Length: 428
Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Expires: Sun, 04 May 2014 22:51:08 GMT
Cache-Control: max-age=86400
Accept-Ranges: bytes
GIF89a.......f..3...33.......................................!..NETSCA
PE2.0.....!..Powered by AFEI.!.......,.............I........08bX....d.
n...CS.3......_..`..H..H\8....)...S.b.UX.....(...r.L....tb]&"......#..
.o.V.a..D..o.V.a..........D..o.V.a..........D...........!.......,.....
........I........08bX....d.n...CS.3......_..`..H..H\8....).:[email protected]...
x ..........D.| .#.u.a....n~D..[....n..........D..[...n..........D....
.......;HTTP/1.1 200 OK..Server: Tengine/1.3.0..Date: Sat, 03 May 2014
 22:51:08 GMT..Content-Type: image/gif..Content-Length: 428..Last-Modi
fied: Fri, 16 Jan 2009 08:10:47 GMT..Connection: keep-alive..Keep-Aliv
e: timeout=5..Expires: Sun, 04 May 2014 22:51:08 GMT..Cache-Control: m
ax-age=86400..Accept-Ranges: bytes..GIF89a.......f..3...33............
...........................!..NETSCAPE2.0.....!..Powered by AFEI.!....
...,.............I........08bX....d.n...CS.3......_..`..H..H\8....)...
S.b.UX.....(...r.L....tb]&"......#...o.V.a..D..o.V.a..........D..o.V.a
..........D...........!.......,.............I........08bX....d.n...CS.
3......_..`..H..H\8....).:[email protected] ..........D.| .#.u.a....n~D..[..
..n..........D..[...n..........D...........;..



GET /stat.htm?id=1000293249&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=14837493-1399157467-&showp=1916x902&st=0&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=1949207463 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hookbug.com:5151/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z5.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine/1.4.1
Date: Sat, 03 May 2014 22:51:07 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Tue, 28 May 2013 02:57:17 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..










%original file name%.exe_1412:




.text
.rdata
@.data
.rsrc
t$(SSh
~%UVW
u$SShe
kernel32.dll
Kernel32.dll
ntdll.dll
user32.dll
Shlwapi.dll
shlwapi.dll
NTDLL.DLL
psapi.dll
Ole32.dll
GdiPlus.dll
gdiplus.dll
ole32.dll
OLEACC.DLL
gdi32.dll
advapi32.dll
MsgWaitForMultipleObjects
SetWindowsHookExA
EnumWindows
ShellExecuteA
GdiplusShutdown
RegCreateKeyA
RegOpenKeyA
RegEnumKeyA
RegCloseKey
RegFlushKey
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
127.0.0.1 www.t6t8.com
127.0.0.1 t6t8.com
127.0.0.1 www.jingwuwg.com
127.0.0.1 jingwuwg.com
127.0.0.1 www.52jwyy.com
127.0.0.1 52jwyy.com
127.0.0.1 www.au2014.com
127.0.0.1 au2014.com
127.0.0.1 www.92ausf.com
127.0.0.1 92ausf.com
127.0.0.1 92jwyy.taobao.com
127.0.0.1 www.jwyywg.d131.tqxq.com
127.0.0.1 jwyywg.d131.tqxq.com
127.0.0.1 audition0538.i.sohu.com
www.hixxg.com
http://www.hookbug.com:5151/vip
http://www.hixxg.com
www.hixxg.com
Result=MsgBox ("
(*^__^*)
%System%\XXTS.vbs
\UpData.exe
\unrar.dll
BASEURL
Hotkey
%System%\Configuration file.ini
cg(.CU
xÒB
M.pib
.oIZV
c).zI
]-5}v
T:Q%u
%x7El
5/h%c
4.yHE
1z|;%u/
-TI}*
.xc3$C
.FzlJ
"-TD}
JCXm5Ftp5Q
%Xqvh*O2%
.FoZ?
SL.Dce
Q]%UZ
G.tQ`
I.rvH
(F..hU
JmL%D#
7I.ha
) (%S
$A%*.xk
.rnu,[
&1:kcwb%c\41H
.aSab
%s 7S
:|?%f
A.riM}_
v.eLg
R.YGT
3`E3.gV
O/.BAF@
Jjg%x\
T%1UT
lm.Su
LEvo%f
õfe9
msGv8
-URv}
http://http://www.hookbug.com:5151/vip
\QQShow.dll
P@http://www.hookbug.com:5151/
197774811
[email protected]
5B3838F5-0C81-46D9-A4C0-6EA28CA3E942_
709847386
2286585953
1149544
*.bak
*.rar
Vg0.yy?
k.Lk&
aRUU%UVVZc
pT$%%U%&&
=.NJ7j
& ..In
;888 000
diTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?>        =
" id="W5M0MpCehiHzreSzNTczkc9d"?>        
" id="W5M0MpCehiHzreSzNTczkc9d"?>        
" id="W5M0MpCehiHzreSzNTczkc9d"?>        
" id="W5M0MpCehiHzreSzNTczkc9d"?>        
" id="W5M0MpCehiHzreSzNTczkc9d"?>        8i
" id="W5M0MpCehiHzreSzNTczkc9d"?>        
" id="W5M0MpCehiHzreSzNTczkc9d"?>        .
" id="W5M0MpCehiHzreSzNTczkc9d"?>        
" id="W5M0MpCehiHzreSzNTczkc9d"?>        
" id="W5M0MpCehiHzreSzNTczkc9d"?>        _
http://blog.sina.com.cn/s/blog_b61e00f001016mtd.html
9.7.0.1
ÝIt
o.pMM
.AQ@9.
Zf.YB
.nsp0
.nsp1
.nsp2
=f%7s
KERNEL32.DLL
WINMM.DLL
WS2_32.DLL
USER32.DLL
GDI32.DLL
WINSPOOL.DRV
ADVAPI32.DLL
SHELL32.DLL
OLE32.DLL
OLEAUT32.DLL
COMCTL32.DLL
COMDLG32.DLL
.tOwe
.ZGW)
*;M%x
fv#}ET%D?
K.NV'
\a.RN
Tni%F
Q&.Hyt`
U.rR*
m=C3%s
2.Cz=
.Ly$_
.UW^}
Nkl.KgpT
7.BN8
&l3%U
,E.XL&~
%d" {
|.Rb&
.yR#b
km6.Xh
b_.HKOa
FTP>u
rF%x7
f.pzw}\
.data
]W%sE
6mU%c\]
]W%sE6
64n%c
5!" 4eU%s
]ÁY
W%sEj
6dW%S
\XÏ
\XÏ2U
\X%SF
GetAsyncKeyState
{B6F7542F-B8FE-46a8-9605-98856A687097}
-Www.52jwxx.Com
0000000000000000
0000000
d-WWW.HIXXG.COM
http://www.hookbug.com:5151/vip/
http://www.hookbug.com:5151/jiezhi/
À-#R4d
/'*w4l%X89
%s)l)*%
%d%V&
%U3e)
http://www.hookbug.com:5151
*.dll
,50,100,150
00 00 17 01
W WWW.52JWXX.COM
ws2_32.dll
AKernel32.dll
http://www.hookbug.com:5151/vip.rar
http://www.hixxg.com/xiazai.html
http://bbs.52jwxx.com/
197774811
WWW.HIXXG.COM
W www.hixxg.com
%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
CCmdTarget
windows
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
iphlpapi.dll
SHLWAPI.dll
MPR.dll
WINMM.dll
WS2_32.dll
VERSION.dll
RASAPI32.dll
GetProcessHeap
WinExec
GetWindowsDirectoryA
KERNEL32.dll
GetKeyState
UnhookWindowsHookEx
EnumChildWindows
USER32.dll
GetViewportOrgEx
GDI32.dll
MSIMG32.dll
ADVAPI32.dll
SHELL32.dll
OLEAUT32.dll
COMCTL32.dll
oledlg.dll
WSOCK32.dll
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCanonicalizeUrlA
WININET.dll
GetCPInfo
CreateDialogIndirectParamA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
comdlg32.dll
Fuck_Au.dll
.mkBT
.qc]b
.pK>NG`
P>f%S9e
.qn{\
_.Ry=
\.Wzvv
1%%%u
q@http://www.hixxg.com/
http://
javascript:document.onsdragstart=document.onselectstart=document.oncontextmenu=function(){return true}
javascript:document.onselectstart = document.oncontextmenu = document.onmousedown = document.onkeydown = function(){return true;};
var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');
text|password|file
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
WarnOnHTTPSToHTTPRedirect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
www.soso.com{
http://www.hixxg.com/xiazai.htmlr
.PAVCException@@
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
.PAVCFileException@@
: %d]
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
.PAVCNotSupportedException@@
out.prn
(*.prn)|*.prn|
%d.%d
%d/%d
%d / %d
Bogus message code %d
(%d-%d):
%ld%c
www.dywt.com.cn
(*.htm;*.html)|*.htm;*.html
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
1.1.3
;3 #>6.&
'2, / 0&7!4-)1#
.PAVCOleException@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
zcÁ
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
1.0.0.0
{"{$|%~%
DBUNg[yg
00>BLTWebuk
%'%5%D%P%['d,l4r
 y%r$i$^%U N.G4B7<;9<5<0;)5"0
g~\tPiD^9T.K%D
@"<)7,20 2$2
9$5)0, .$.
9"5'0 )."0
2$,%'' '
0",%')" 
\e5.0\e.exe
(*.*)
8.1.0.0
WWW.52JWXX.COM
WWW.52JWXX.COM

%original file name%.exe_1412_rwx_00401000_000F2000:




t$(SSh
~%UVW
u$SShe






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    wuauclt.exe:1880
    

    2. 

  2. Delete the original Trojan file.
    3. 

  3. Delete or disinfect the following files created/modified by the Trojan:
    

    %WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
    %WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2448 bytes)
    %WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\soso[1].htm (383 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\wy[1].jpg (1928 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\pic1[1].gif (428 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\ico_src[1].png (1534 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (189 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@soso[2].txt (330 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\xz2[1].png (5063 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\init.v.24[1].js (638 bytes)
    %System%\Configuration file.ini (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\cft[1].jpg (4565 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\jsanalyzexml.min.v.12[1].js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\salelogo[1].png (8464 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (304 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\xz1[1].png (1928 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\sale_bg[1].jpg (671 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\q[1].se&unc=&query=¾¢ÎèЦЦ (7770 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\init.v.24[2].js (1 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (158 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\soso[1].png (618 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\dk[1].jpg (3015 bytes)
    %System%\drivers\etc\hosts (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\logo130826[1].png (2 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (122 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\jsanalyzexml.min.v.12[2].js (4 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (210 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\jquery.form[1].js (5477 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\logo_index[1].png (1797 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\ico_icp[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\year[2].jsp (22 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@soso[1].txt (180 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\sale_style[1].css (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (3361 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\sale_search[1].gif (2 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (203 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\jquery.pngFix[1].js (73 bytes)
    C:\¾¢ÎèЦЦ-Ψһ¹ÙÍø.url (112 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\z_stat[1].php (5067 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\button_10[1].gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\jquery.1.3.2.pack[1].js (39083 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\q[1].htm (7142 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\admin_pub[1].js (2749 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\3.tmp (1425 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\stat[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\xiazai[1].htm (266 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\core[1].php (803 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\sale_le[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0L6XEJ0D\sale_btn1[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\fav[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (4545 bytes)
    C:\ʹÓñؿ´.txt (4 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (10312 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\year[1].jsp (48 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\icon_index[1].png (440 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WV0S24X6\zfb[1].jpg (8286 bytes)
    C:\VIPЦЦ-¹ºÂòÁ´½Ó.url (166 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\hookbug[1].htm (10776 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SU8P4J4M\xz2[1].png (8820 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SB0J2TW9\btn_del[1].gif (1 bytes)
    

    4. 

  4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
    
    127.0.0.1       localhost
    5. 

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    6. 

  6. Reboot the computer.
    7. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now