Gen.Variant.Application.Graftor.182456_7948e11453 – Adaware

Gen:Variant.Application.Graftor.182456 (AdAware), Trojan.Win32.IEDummy.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 7948e11453d4f40db7faebc31dc8e8f0

SHA1: 48d21cc16d9daee4fe20b03dd91622fd12f4f37a

SHA256: f76091a6a358052d3e4a3e57fb3c839b6e7ff47f45d6a1d7f0caf55c59346608

SSDeep: 12288:ShdoH1uo7I9YTWw9GkqT/fA40i0sHyyPY6w0f5L54pq:kuHN1ZcNrfA7i1HyVnY5F3

Size: 551456 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: PECompactV2X, PECompactv20, UPolyXv05_v6

Company: no certificate found

Created at: 2015-05-15 18:55:09

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

jfilemanagersetup.exe:584

The Trojan injects its code into the following process(es):

JFileManager.exe:1304
WebBrowser.exe:1612
%original file name%.exe:928

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process jfilemanagersetup.exe:584 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\JFileManager\Languages\Italian.gif (934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\nsProcess.dll (4 bytes)
%Program Files%\JFileManager\Languages\Hindi.ini (2 bytes)
%Program Files%\JFileManager\Languages\Italian.ini (1 bytes)
%Program Files%\JFileManager\icono.ico (12088 bytes)
%Program Files%\JFileManager\Languages\Hindi.gif (920 bytes)
%Program Files%\JFileManager\Newtonsoft.Json.dll (12536 bytes)
%Program Files%\JFileManager\Languages\Spanish.gif (569 bytes)
%Program Files%\JFileManager\JFileManager.exe (37368 bytes)
%Program Files%\JFileManager\Languages\English.ini (1 bytes)
%Program Files%\JFileManager\Languages\French.gif (928 bytes)
%Program Files%\JFileManager\Languages\Spanish.ini (1 bytes)
%Program Files%\JFileManager\Languages\Portuguese.ini (1 bytes)
%Program Files%\JFileManager\dotNetFx40_Full_setup.exe (30344 bytes)
%Program Files%\JFileManager\Languages\Hebrew.gif (929 bytes)
%Program Files%\JFileManager\update.xml (206 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\JFileManager\JFileManager.lnk (836 bytes)
%Program Files%\JFileManager\Languages\English.gif (977 bytes)
%Program Files%\JFileManager\uninstall.exe (3096 bytes)
%Program Files%\JFileManager\Languages\Portuguese.gif (883 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\JFileManager\Uninstall JFileManager.lnk (637 bytes)
%Program Files%\JFileManager\Languages\Chinese (Simplified).ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Config.ini (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp (126424 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Downloads\Torrents\fastresume.data (2 bytes)
%Program Files%\JFileManager\ComponentFactory.Krypton.Toolkit.dll (77843 bytes)
%Program Files%\JFileManager\ClipboardURLCatcher.jar (2 bytes)
%Program Files%\JFileManager\jfilemanager.affcode (3 bytes)
%Program Files%\JFileManager\Languages\French.ini (1 bytes)
%Program Files%\JFileManager\jfilemanager.uidnum (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\System.dll (11 bytes)
%Program Files%\JFileManager\Languages\Hebrew.ini (1 bytes)
%Program Files%\JFileManager\Languages\Chinese (Simplified).gif (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Downloads\Torrents\DhtNodes (2 bytes)
%Program Files%\JFileManager\Languages\German.gif (916 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\WebBrowserJFile.lnk (1 bytes)
%Program Files%\JFileManager\WebBrowser.exe (5064 bytes)
%Documents and Settings%\All Users\Desktop\JFileManager.lnk (824 bytes)
%Program Files%\JFileManager\Languages\German.ini (1 bytes)
%Program Files%\JFileManager\LTV.exe (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\System.dll (0 bytes)

The process %original file name%.exe:928 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (6616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\JFileManagerSetup[1].exe (1014662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\progress-level[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\loading-install[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\i-download[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\msjava[1].dll (465777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\progress-bar[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\d1c89e2c-dd98-48c4-9372-55f6da10336c\jfilemanagersetup.exe (1014662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bullet-short[1].gif (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (225 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\0b6626ec5e4bd43463c10b130d5e34b10864302c058b6d184bb46749500be84c4bde88c5d88e32622c4040c760d4f2447fb9c56605186310[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\JFileManagerSetup[1].exe (0 bytes)

Registry activity

The process JFileManager.exe:1304 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EA 50 34 3A B2 9E AE 56 EA 32 58 61 C7 3F 76 77"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process WebBrowser.exe:1612 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 0E FE 3F 66 84 CB EB D4 C2 01 9A 2B 8D 1B 06"

The process jfilemanagersetup.exe:584 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"Publisher" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"DisplayVersion" = "v1.0.0.2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"UninstallString" = "%Program Files%\JFileManager\uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\JFileManager\JFileManager]
"InstallDir" = "%Program Files%\JFileManager"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"DisplayName" = "JFileManager"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 53 A7 5D 3E B8 65 3E F9 A3 DB 06 47 20 38 55"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"EstimatedSize" = "6015"
"DisplayIcon" = "%Program Files%\JFileManager\JFileManager.exe"

[HKLM\SOFTWARE\JFileManager\JFileManager]
"(Default)" = "%Program Files%\JFileManager\JFileManager.exe"

The process %original file name%.exe:928 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\d1c89e2c-dd98-48c4-9372-55f6da10336c]
"jfilemanagersetup.exe" = "jfilemanagersetup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1431705309"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 C7 45 D2 A3 E1 43 2D 06 24 79 75 B3 DB 95 EB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
ca04007495aae5057da274a53a338ddc	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\d1c89e2c-dd98-48c4-9372-55f6da10336c\jfilemanagersetup.exe
67986ec074b86590e110a76480f7da99	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\msjava[1].dll
ca04007495aae5057da274a53a338ddc	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\JFileManagerSetup[1].exe
ac56f3a4d75499f5501dd8ee0faba055	c:\Program Files\JFileManager\ComponentFactory.Krypton.Toolkit.dll
c6d1dc750e7c72e70fe919441bfd7efe	c:\Program Files\JFileManager\JFileManager.exe
f4f2e95f1bd669f0ff2fda93df846fc6	c:\Program Files\JFileManager\LTV.exe
9de67831de7205e5f7a8d95325b4c366	c:\Program Files\JFileManager\Newtonsoft.Json.dll
617ae3416669fb73ab8fd76b1c96bce4	c:\Program Files\JFileManager\WebBrowser.exe
53406e9988306cbd4537677c5336aba4	c:\Program Files\JFileManager\dotNetFx40_Full_setup.exe
096d18f71e04b204860a7d4f89d16728	c:\Program Files\JFileManager\uninstall.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
jfilemanagersetup.exe:584
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Program Files%\JFileManager\Languages\Italian.gif (934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\nsProcess.dll (4 bytes)
%Program Files%\JFileManager\Languages\Hindi.ini (2 bytes)
%Program Files%\JFileManager\Languages\Italian.ini (1 bytes)
%Program Files%\JFileManager\icono.ico (12088 bytes)
%Program Files%\JFileManager\Languages\Hindi.gif (920 bytes)
%Program Files%\JFileManager\Newtonsoft.Json.dll (12536 bytes)
%Program Files%\JFileManager\Languages\Spanish.gif (569 bytes)
%Program Files%\JFileManager\JFileManager.exe (37368 bytes)
%Program Files%\JFileManager\Languages\English.ini (1 bytes)
%Program Files%\JFileManager\Languages\French.gif (928 bytes)
%Program Files%\JFileManager\Languages\Spanish.ini (1 bytes)
%Program Files%\JFileManager\Languages\Portuguese.ini (1 bytes)
%Program Files%\JFileManager\dotNetFx40_Full_setup.exe (30344 bytes)
%Program Files%\JFileManager\Languages\Hebrew.gif (929 bytes)
%Program Files%\JFileManager\update.xml (206 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\JFileManager\JFileManager.lnk (836 bytes)
%Program Files%\JFileManager\Languages\English.gif (977 bytes)
%Program Files%\JFileManager\uninstall.exe (3096 bytes)
%Program Files%\JFileManager\Languages\Portuguese.gif (883 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\JFileManager\Uninstall JFileManager.lnk (637 bytes)
%Program Files%\JFileManager\Languages\Chinese (Simplified).ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Config.ini (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp (126424 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Downloads\Torrents\fastresume.data (2 bytes)
%Program Files%\JFileManager\ComponentFactory.Krypton.Toolkit.dll (77843 bytes)
%Program Files%\JFileManager\ClipboardURLCatcher.jar (2 bytes)
%Program Files%\JFileManager\jfilemanager.affcode (3 bytes)
%Program Files%\JFileManager\Languages\French.ini (1 bytes)
%Program Files%\JFileManager\jfilemanager.uidnum (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\System.dll (11 bytes)
%Program Files%\JFileManager\Languages\Hebrew.ini (1 bytes)
%Program Files%\JFileManager\Languages\Chinese (Simplified).gif (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Downloads\Torrents\DhtNodes (2 bytes)
%Program Files%\JFileManager\Languages\German.gif (916 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\WebBrowserJFile.lnk (1 bytes)
%Program Files%\JFileManager\WebBrowser.exe (5064 bytes)
%Documents and Settings%\All Users\Desktop\JFileManager.lnk (824 bytes)
%Program Files%\JFileManager\Languages\German.ini (1 bytes)
%Program Files%\JFileManager\LTV.exe (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (6616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\JFileManagerSetup[1].exe (1014662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\progress-level[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\loading-install[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\i-download[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\msjava[1].dll (465777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\progress-bar[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\d1c89e2c-dd98-48c4-9372-55f6da10336c\jfilemanagersetup.exe (1014662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bullet-short[1].gif (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (225 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1638400	503296	5.5449	f4e0d9f6e06b7b00604246830226221f
.rsrc	1642496	40960	40960	3.86803	3068a94d6adf127c149e809532f69dfb

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 32
b961127ce2ebed0b1d793fc1457c062b
586a7d0c906a5a725405d7041f755366
29517c8981aeed04f8c4da7b1ff5382b
862b28a00ab3dec3e0e71bb608cfe62c
d0fbd988a684011254a7396a2f80d9f3
21e07880b0ebe2241d35fea00a17eda7
66a863350764d479e42897f125f64ca9
797642aec7e9a15be35dc56028194470
9870e739dd72af3c09ac0240c6689868
e8e0c8631b613bbdf0ed6716b41823e0
0545481fbd2161083c5144dceae0890f
c3489f84410649c5715e0a46663fa65c
5db8a3e1287bce870134f34333f5de30
c8cc06158732f7bd26a70d24d556715b
c15197f96a6d91ed5489090f86aadc16
70a3ea306318570c5d99baf2e0132ad6
2f839c7b998efc06799fce7754d86702
d2f0d537f79000fd520bb33201c511a8
e76822b889c8dc38923309d2812e14e6
4a7c6c2670efd2cbc4e42a341c68fd89
ac25c051bbdc5783515026e0952f726a
eef7251cc09ae712e94efa1a78a85245
685d846920f78a8aac14ba33111bb64b
91689b79cd15ba0989c3f016ea920580
be94147b408a6c546a093ffe4a89b8dc
5bbab558c65fd6d04bc98b96d714d64b

Network Activity

URLs

URL	IP
hxxp://api.magnodownload.com/	54.191.3.243
hxxp://api.magnodownload.com/d5/msjava.dll	54.191.3.243
hxxp://api.magnodownload.com/?ctrak3.2.587=c_Start_Application	54.191.3.243
hxxp://api.magnodownload.com/fd862eba9a8eff3775636859f9766f82c6a7232124f727e93497715d0390105b0b8886781535ed62a8d0fcf75290092ff752ed904486fe229632d57ce23620a8e80d093e255c14cd84528e8074a4b2ebaa2f43f9c68ccac4f0a9932d7b8bc982ab6a23ab2c704e36	54.191.3.243
hxxp://api.magnodownload.com/0b6626ec5e4bd43463c10b130d5e34b10864302c058b6d184bb46749500be84c4bde88c5d88e32622c4040c760d4f2447fb9c56605186310	54.191.3.243
hxxp://api.magnodownload.com/__maxpower__/render_template/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab?language_code=en	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/style.css	54.191.3.243
hxxp://api.magnodownload.com/__maxpower__/render_screen/2014/11/d1187d84-6a69-11e4-b052-06a3579b0dab/screen_variation=I_link	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/i-download.png	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-bar.png	54.191.3.243
hxxp://146.185.26.220/8c/JFileManagerSetup.exe
hxxp://api.magnodownload.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/loading-install.gif	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-level.png	54.191.3.243
hxxp://www.magnodownload.com/BesH3gE9/pop-up/	54.213.71.128
hxxp://www.magnodownload.com/lpresources/js/linkv2.js	54.213.71.128
hxxp://www.magnodownload.com/lpresources/js/ainj.js	54.213.71.128
hxxp://www.magnodownload.com/lpresources/js/dlStoragev1.js	54.213.71.128
hxxp://www.magnodownload.com/mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js	54.213.71.128
hxxp://api.magnodownload.com/__maxpower__/render_screen/2014/10/e8150ca4-4ae4-11e4-be98-06a3579b0dab/screen_variation=f_link	54.191.3.243
hxxp://api.magnodownload.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/bullet-short.gif	54.191.3.243
hxxp://n149adserv.com/js/show_ads.js	204.155.152.38
hxxp://n149adserv.com/ads-sync.js?v=1&key=8807bef3df789cfc967df2f12545a152&ch=&click=&tz=3&t=1434155616452&requestUrl=http://www.magnodownload.com/BesH3gE9/pop-up/&requestRef=&flashVer=11.6 r602&scrWidth=1276&scrHeight=846&cIds=	204.155.152.38
hxxp://n149adserv.com/impression.gif?b=778&p=27&ch=&ap=&cps=&c=76&l=UA&h=acf77f38e46b2eec6d48af61483c53a7&t=1434155616827&s=1ca12eb2e60e376e81cb62ca2676068e	204.155.152.38
hxxp://onclickads.net/afu.php?zoneid=313275	78.140.191.109
hxxp://onclickads.net/?r=/mb/han&zoneid=313275&pbk2=aed4aed7aec61aea2427c1373066bf8d6159651431394916656&saved_referer=&adparams=bm9qcz0w&a=1256&b=693	78.140.191.109
hxxp://click.alibaba.com/rd/vutlr5u3?pid=313275&tp1=65352150151&cv=147001&cn=UA	198.11.132.6
hxxp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf	205.204.96.35
hxxp://a1049.w55.akamai.net/js/6v/atom/??atom-sc.js?t=6453147c_104cacc3f2
hxxp://a1049.w55.akamai.net/css/6v/??run/arcadia/landing-page/lp-layout-premium-market.css,run/list/common/default.css,run/arcadia/landing-page/lp-category-list.css,run/arcadia/category/categories-home.css,apollo/mod/header/header-v4-sc.css,run/common/top-reached/top-reached.css,apollo/mod/footer/footer-v4-sc.css?t=1839ef62e_22db2c054f
hxxp://a1049.w55.akamai.net/js/6v/lib/gallery/??jquery/jquery.js,es5-safe/es5-safe.js,json/json.js?t=db4c592b_0
hxxp://a1082.w55.akamai.net/wimg/monitor/start-render.png
hxxp://a1049.w55.akamai.net/js/beacon_en.js
hxxp://a1049.w55.akamai.net/simg/sprites/env/aisn/ghome/ghome.png?t=4e09143a_0
hxxp://a1049.w55.akamai.net/simg/sprites/app/new-header-v4-2@1x.png?t=21312772_0
hxxp://e11102.b.akamaiedge.net/tps/i2/TB1QtIrFVXXXXbHXFXXIVqAQXXX-1400-160.png
hxxp://e11102.b.akamaiedge.net/tps/i3/TB1knn4HpXXXXc.XVXXoNAWQpXX-300-251.jpg
hxxp://stat.alibaba.com/event/common.html?id=17769&st_page_id=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ver=40&time=1434155618687	205.204.96.98
hxxp://gj.gds.mmstat.com/7.gif?logtype=1&title=&pre=http://onclickads.net/afu.php?zoneid=313275&cache=67bd1e4&scr=1276x846&isbeta=5&spm-cnt=0.0.0.0.Mj3nGs&aplus&pageid=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ali_apache_id=193.138.244.231.1434155608293.716224.2&dmtrack_c={trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76\|aep_usuc_f=-}&p=1&o=winXP&b=ie6&s=1276x846&w=trident
hxxp://dmtracking2.alibaba.com/b.jpg?cD17MX0mdT17L29mZmVyLmFsaWJhYmEuY29tL2V4Y2x1c2l2ZS5odG1sP2FscHNtPXRydWUmc21zPXN1Z2ludGVyJnNtY29uPXAmdHY9MyZpbXA9NWIxYW9yMTlubDVicTc2bTNoaiZ4cD1MdmdNdXo3U3hWQlNPOG04cExOT0g3YTMxYmVEcVlXZW0wNUFwbFhvbGd2akQwOTdUSW9OWk9vZU5LS2J0S0Fhc3R5bjR0ZG9FX21HLU83ZnBxYTJpQ3d4dDVxY2NBaXJCeE1RQkZQbnRMNCZwaWQ9MzEzMjc1JnRkPVByb3BlbGxlcmFkcyZjdj0xNDcwMDEmYWZmX2lkPTE4MjQ2MzYxOCZjdD0xJnNpemU9MDAwXzAwMCZjbj1VQSZhbj0xMDAwMDAwMDQ2MDAxJmJtPWNwYSZ0cDE9NjUzNTIxNTAxNTEmc3JjPXNhZn0mbT17R0VUfSZzPXsyMDB9JnI9e2h0dHA6Ly9vbmNsaWNrYWRzLm5ldC9hZnUucGhwP3pvbmVpZD0zMTMyNzV9JmE9ey19JmI9ey19JmM9e3RyZmNfaT1zYWZednV0bHI1dTNebTFqcWhxMzleMTlubDVicTc2fGFlcF91c3VjX2Y9LX0=&pageid=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&sys=ie6.0\|windowsXP\|1276*846\|en-us&ver=40&time=1434155618687	205.204.96.111
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://e11102.b.akamaiedge.net/tps/i3/TB1_jCQHpXXXXXDXXXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i4/TB13n.FHXXXXXX7aXXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i3/TB1ciU8HXXXXXahaXXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i4/TB16MsBGXXXXXc1XFXXw4O3GXXX-33-20.png
hxxp://e11102.b.akamaiedge.net/tps/i1/TB1YUr7HpXXXXXTaXXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i3/TB19_fqGXXXXXXrXFXXSutbFXXX.jpg
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j37&a=2129827782&t=pageview&_s=1&dl=http://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf&dr=http://onclickads.net/afu.php?zoneid=313275&ul=en-us&de=utf-8&dt=Alibaba Premium Marketplace&sd=32-bit&sr=1276x846&vp=1260x681&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=1757803183&cid=1214118344.1434155619&tid=UA-53529524-1&_r=1&z=1776085867
hxxp://a1049.w55.akamai.net/js/6v/biz/common/lazyload-images/lazyload-images.js?t=ba5caa31_6b5144d34
hxxp://a1049.w55.akamai.net/js/6v/??biz/list/common/top.js,biz/list/common/bottom.js,biz/aisn/ghome/categories/categories.js,biz/common/header/header-v4-sc.js,biz/common/top-reached/top-reached.js,biz/common/url/url.js,biz/common/cookie-info/cookie-info.js,biz/common/affiliate-remarketing/affiliate-remarketing.js,biz/common/umid/umid.js,biz/arcadia/premium-ppv/premium-ppv.js,lib/gallery/store/store.js?t=3e3f0742a_1013aa46edc
hxxp://e11102.b.akamaiedge.net/tps/i4/TB1WJb8HpXXXXcCXFXXoNAWQpXX-300-251.jpg
hxxp://e11102.b.akamaiedge.net/tps/i1/TB1QrZ5HXXXXXbmapXXoNAWQpXX-300-251.jpg
hxxp://a1049.w55.akamai.net/js/6v/??lib/arale/class/class.js,lib/arale/events/events.js,lib/arale/base/base.js,lib/arale/widget/widget.js,lib/arale/position/position.js,lib/arale/iframe-shim/iframe-shim.js,lib/arale/overlay/overlay.js,lib/arale/overlay/mask.js,lib/arale/popup/popup.js,lib/arale/templatable/templatable.js,lib/arale/dialog/dialog.js,lib/arale/cookie/cookie.js,lib/arale/placeholder/placeholder.js,lib/arale/autocomplete/autocomplete.js,lib/icbu/scroll-trigger/scroll-trigger.js,lib/icbu/dialog/dialog.js,lib/icbu/balloon/balloon.js,lib/icbu/messenger/messenger.js,lib/icbu/ghost-panel/ghost-panel.js,lib/gallery/underscore/underscore.js,lib/gallery/handlebars/handlebars.js,lib/gallery/qrcode/qrcode.js,biz/list/common/dot/dot.js,biz/list/common/title/title.js,biz/list/common/history/history.js,biz/list/common/history/log.js,biz/list/common/load/load.js,biz/list/common/gotop/gotop.js,biz/list/common/survey/survey.js,biz/list/common/qrcode/qrcode.js,biz/list/common/webatm/webatm.js,biz/common/mcms/mcms.js,biz/common/switch-language/switch-language.js,biz/common/nav/nav.js,biz/common/header/header-module-base.js,biz/common/beacon/beacon-v4-sc.js,biz/common/store-proxy/store-proxy2.js,biz/common/searchbar/searchbar-v4-sc.js?t=11df03f0f4_1971b41c7df
hxxp://pcookie.alibaba.com/app.gif?&cna=WWgCDjWxzjYCAcGK9OdXbmWQ	205.204.96.213
hxxp://offer.alibaba.com/favicon.ico	205.204.96.35
hxxp://a1049.w55.akamai.net/simg/single/icon/loading_16x16.gif?t=30d69a7b_0
hxxp://e11102.b.akamaiedge.net/js/6v/biz/common/store-proxy/store-proxy2.html?iframe_delete=true
hxxp://us-scproxy.alibaba.com/ajaxMemberLevelTag.do?event=getMemberLevel&callback=jQuery183069035179626267_1434155618577&_=1434155620218
hxxp://us-scproxy.alibaba.com/notification.do?callback=jQuery183069035179626267_1434155618578&_=1434155620249
hxxp://a1049.w55.akamai.net/js/6v/biz/common/security-umscript/??um.js?t=9d044bd6_0
hxxp://e11102.b.akamaiedge.net/favicon.ico
hxxp://stat.alibaba.com/event/common.html?id=17770&ext=cnatime=2078&st_page_id=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ali_beacon_id=193.138.244.231.143415561055.341443.0&inc=0&ver=40&time=1434155620749	205.204.96.98
hxxp://stat.alibaba.com/sc/fpc.html?cna=WWgCDjWxzjYCAcGK9OdXbmWQ&pageid=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ali_beacon_id=193.138.244.231.143415561055.341443.0	205.204.96.98
hxxp://cmap.alibaba.com/ml.html?callback=landing8978252&cna=WWgCDjWxzjYCAcGK9OdXbmWQ	205.204.96.142
hxxp://e11102.b.akamaiedge.net/js/sufei.js?v=2015-05-26
hxxp://cmap.alibaba.com/landing.gif	205.204.96.142
hxxp://pagead.l.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm&loop=1
hxxp://pagead.l.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm=&loop=1&google_tc=
hxxp://cmap.alibaba.com/landing.gif?google_gid=CAESEDFEM-6j34BXp9sspL63B48&google_cver=1&loop=1	205.204.96.142
hxxp://ynuf.alibaba.com/service/um.json?xv=2.0.3&xt=d5b9591c-cb60-4f96-be26-2bff6b23ff8a&xa=scp4p&xh=&x0=0^^1^^1^^1^^1^^1^^1^^1^^5^^1^^color^^-^^1276^^846&x1=1^^1^^1^^1^^0^^0^^1^^0^^0^^en^^-^^0^^Windows XP^^Win32&x2=Mozilla^^;SP3;^^Microsoft Internet Explorer^^3516ab67d54092e6bf44e729b77d6580^^en-us^^x86^^57f2da82064a7b7501289385afb25340^^Adobe Windows^^ActiveX^^en-us^^1def8189f7c620d61827869f51fcf447^^en-us^^WIN 11,6,602,168&x3=818^^1276^^3896^^1400^^846^^-^^http%3A%2F%2Foffer.alibaba.com%2Fexclusive.html%3Falpsm%3Dtrue%26sms%3Dsuginter%26smcon%3Dp%26tv%3D3%26imp%3D5b1aor19nl5bq76m3hj%26xp%3DLvgMuz7SxVBSO8m8pLNOH7a3^^-^^101^^-^^1434155621374^^120^^1276&xs=null&_callback=_1867_1434155621390	198.11.132.254
hxxp://staticrr.tgusrv.com/sdb/e0/WebBrowser.xml?71b7ff3e-9e2c-4df1-9a9e-999ab41d6549
hxxp://a1082.w55.akamai.net/simg/sprites/env/aisn/goto-top.png
hxxp://a1049.w55.akamai.net/js/6v/biz/common/webatm-new/webatm.js?t=fbcc9a5f_88ad028d78
hxxp://a1082.w55.akamai.net/simg/sprites/env/aisn/survey-grey.png
hxxp://a1049.w55.akamai.net/js/6v/??lib/icbu/menu-tree/menu-tree.js,lib/icbu/uploader/uploader.js,lib/icbu/dragdrop/draggable.js,biz/common/drag-paste-widget/drag-paste-widget.js?t=2e3641163_1d539836ca
hxxp://a1049.w55.akamai.net/css/6v/run/common/webatm-new/webatm.css?t=0_102dc101ea
hxxp://a1049.w55.akamai.net/css/6v/run/common/drag-paste/drag-paste.css?t=db4d3b36_0
hxxp://a1049.w55.akamai.net/simg/sprites/env/webatm-new/contacts-icons.png?t=762e3bac_0
hxxp://a1049.w55.akamai.net/simg/sprites/env/webatm/common.png?t=ad99287c_0
hxxp://img.alicdn.com/tps/i4/TB1WJb8HpXXXXcCXFXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://style.aliunicorn.com/css/6v/run/common/drag-paste/drag-paste.css?t=db4d3b36_0	212.30.134.221
hxxp://style.aliunicorn.com/css/6v/??run/arcadia/landing-page/lp-layout-premium-market.css,run/list/common/default.css,run/arcadia/landing-page/lp-category-list.css,run/arcadia/category/categories-home.css,apollo/mod/header/header-v4-sc.css,run/common/top-reached/top-reached.css,apollo/mod/footer/footer-v4-sc.css?t=1839ef62e_22db2c054f	212.30.134.221
hxxp://notification.alibaba.com/notification.do?callback=jQuery183069035179626267_1434155618578&_=1434155620249	198.11.132.198
hxxp://www.google-analytics.com/r/collect?v=1&_v=j37&a=2129827782&t=pageview&_s=1&dl=http://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf&dr=http://onclickads.net/afu.php?zoneid=313275&ul=en-us&de=utf-8&dt=Alibaba Premium Marketplace&sd=32-bit&sr=1276x846&vp=1260x681&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=1757803183&cid=1214118344.1434155619&tid=UA-53529524-1&_r=1&z=1776085867	216.58.209.206
hxxp://is.alicdn.com/favicon.ico	23.64.226.88
hxxp://style.aliunicorn.com/js/6v/biz/common/webatm-new/webatm.js?t=fbcc9a5f_88ad028d78	212.30.134.221
hxxp://style.aliunicorn.com/js/6v/biz/common/lazyload-images/lazyload-images.js?t=ba5caa31_6b5144d34	212.30.134.221
hxxp://style.aliunicorn.com/css/6v/run/common/webatm-new/webatm.css?t=0_102dc101ea	212.30.134.221
hxxp://img.alicdn.com/tps/i2/TB1QtIrFVXXXXbHXFXXIVqAQXXX-1400-160.png	23.64.226.88
hxxp://i02.i.aliimg.com/simg/sprites/env/aisn/survey-grey.png	212.30.134.220
hxxp://style.aliunicorn.com/simg/sprites/env/webatm/common.png?t=ad99287c_0	212.30.134.221
hxxp://img.alibaba.com/js/beacon_en.js	212.30.134.190
hxxp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm&loop=1	216.58.209.162
hxxp://i02.i.aliimg.com/wimg/monitor/start-render.png	212.30.134.220
hxxp://img.alicdn.com/tps/i1/TB1QrZ5HXXXXXbmapXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://style.aliunicorn.com/js/6v/biz/common/security-umscript/??um.js?t=9d044bd6_0	212.30.134.221
hxxp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm=&loop=1&google_tc=	216.58.209.162
hxxp://img.alicdn.com/tps/i4/TB16MsBGXXXXXc1XFXXw4O3GXXX-33-20.png	23.64.226.88
hxxp://gj.mmstat.com/7.gif?logtype=1&title=&pre=http://onclickads.net/afu.php?zoneid=313275&cache=67bd1e4&scr=1276x846&isbeta=5&spm-cnt=0.0.0.0.Mj3nGs&aplus&pageid=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ali_apache_id=193.138.244.231.1434155608293.716224.2&dmtrack_c={trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76\|aep_usuc_f=-}&p=1&o=winXP&b=ie6&s=1276x846&w=trident	205.204.96.45
hxxp://style.aliunicorn.com/js/6v/??biz/list/common/top.js,biz/list/common/bottom.js,biz/aisn/ghome/categories/categories.js,biz/common/header/header-v4-sc.js,biz/common/top-reached/top-reached.js,biz/common/url/url.js,biz/common/cookie-info/cookie-info.js,biz/common/affiliate-remarketing/affiliate-remarketing.js,biz/common/umid/umid.js,biz/arcadia/premium-ppv/premium-ppv.js,lib/gallery/store/store.js?t=3e3f0742a_1013aa46edc	212.30.134.221
hxxp://img.alicdn.com/tps/i3/TB1ciU8HXXXXXahaXXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://u.alicdn.com/js/sufei.js?v=2015-05-26	23.64.226.88
hxxp://img.alicdn.com/tps/i3/TB1_jCQHpXXXXXDXXXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://style.aliunicorn.com/js/6v/lib/gallery/??jquery/jquery.js,es5-safe/es5-safe.js,json/json.js?t=db4c592b_0	212.30.134.221
hxxp://www.google-analytics.com/analytics.js	216.58.209.206
hxxp://style.aliunicorn.com/simg/sprites/env/aisn/ghome/ghome.png?t=4e09143a_0	212.30.134.221
hxxp://img.alicdn.com/tps/i1/TB1YUr7HpXXXXXTaXXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://img.alicdn.com/tps/i3/TB1knn4HpXXXXc.XVXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://style.aliunicorn.com/js/6v/??lib/icbu/menu-tree/menu-tree.js,lib/icbu/uploader/uploader.js,lib/icbu/dragdrop/draggable.js,biz/common/drag-paste-widget/drag-paste-widget.js?t=2e3641163_1d539836ca	212.30.134.221
hxxp://img.alicdn.com/tps/i3/TB19_fqGXXXXXXrXFXXSutbFXXX.jpg	23.64.226.88
hxxp://static.api.magnodownload.com/d5/msjava.dll	54.191.3.243
hxxp://style.aliunicorn.com/js/6v/atom/??atom-sc.js?t=6453147c_104cacc3f2	212.30.134.221
hxxp://style.aliunicorn.com/simg/sprites/app/new-header-v4-2@1x.png?t=21312772_0	212.30.134.221
hxxp://profile.alibaba.com/ajaxMemberLevelTag.do?event=getMemberLevel&callback=jQuery183069035179626267_1434155618577&_=1434155620218	198.11.132.198
hxxp://i02.i.aliimg.com/simg/sprites/env/aisn/goto-top.png	212.30.134.220
hxxp://style.aliunicorn.com/simg/sprites/env/webatm-new/contacts-icons.png?t=762e3bac_0	212.30.134.221
hxxp://style.aliunicorn.com/simg/single/icon/loading_16x16.gif?t=30d69a7b_0	212.30.134.221
hxxp://img.alicdn.com/tps/i4/TB13n.FHXXXXXX7aXXXoNAWQpXX-300-251.jpg	23.64.226.88
hxxp://is.alicdn.com/js/6v/biz/common/store-proxy/store-proxy2.html?iframe_delete=true	23.64.226.88
hxxp://staticrr.fastplayerpro.com/sdb/e0/WebBrowser.xml?71b7ff3e-9e2c-4df1-9a9e-999ab41d6549	185.2.179.74
s.tbcdn.cn	195.27.31.232
stats.g.doubleclick.net	64.233.161.154
ssl.google-analytics.com	216.58.209.200

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /js/show_ads.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: n149adserv.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Accept-Ranges: bytes

ETag: W/"7614-1432285206000"

Last-Modified: Fri, 22 May 2015 09:00:06 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Content-Encoding: gzip

Vary: Accept-Encoding

Date: Sat, 13 Jun 2015 00:33:25 GMT

a..............200...Ymo.8.. 6.....8=...U.4.^.H[\.......h..,jE.......I..,{.......G....g...;,....l..A4.i... b.u*..UF@c.u..}...=..R*.......=.X..p..ln.).....c..Q).i....w..|...',_.<l.6....).i._.EF.,....2......'>u.2....,&a.......s.G...6.!..D....O.2I.0e...6{.=s....s......G............!.`.......r..hl.{...o..=..u.r..y.w.....;\.y.......t.gT.._J._.X.|%..#./.d..s......)..T|'n..".~..b....j!....Us?.i,.`P...y:s......^..y..b.-...G4.._f.....^......y...M...........U....~.;..l..{.....X..9Ob.....A........B<p&..bq-".L.AtV;.....T..O;../...!..ah.....200..V9.*....U ...4|.;V...;O..N>.GOA.... #8.Ft...e~..sG.HH..V..~..!.....|LH@z.l.....Cwk/.w..fA Z.....l^...qg.>b....G...P..F.. G..j.0?..#.....$..G..P<.A......{..,....Y......K.*.H.N$..@...ICnO.r6J...(=91..C~....c.a.'...t..!.S.'...v..^..?.d.....1.....`...Ng..Dd^w>.....G.9..[..>/..|O.f.hd..L.V1[...1..E.T,...qS.......2G7i.GC.gBr....E......U..xZ1|t.g...V.....XH.R...R..."..D.>.0U...z..[GU1.(.y.L......|.)...@.U].-..c..`....C.|.G o..|..hb..2iL......T#p.bV.)b.z).....AZ.k.v..o.......n /"..|.".........3...]^...u.1....1..\.P..200..H.b-......z......r\p....L..H].Q._Y.W..v..DA.R..:..I=.C..Jg{W.....#.e.......O.#.....................\.0Q..7s......i..S@V..........C..X..,AK!...H#...."...$..:p...S.R.k..Y:..<...U....m6\..@.<.`...3.f......p.r.9....U.*]..f.b..k.i_..U..z..n1....&C|.6.X.1*X...k......P]...^k....U.=~..mrc......Jc.aASj,.|...B.f.l.........*.1..^[d....Fe.m7J.PW.v..C/d...E..l.....f5..v.D...B...'.&T....&E.D....h.O.......M.R.4..h......sb{.YQ..Nm=%..d.....zO.{....9.*s.H..d

<<< skipped >>>

GET /ads-sync.js?v=1&key=8807bef3df789cfc967df2f12545a152&ch=&click=&tz=3&t=1434155616452&requestUrl=http://VVV.magnodownload.com/BesH3gE9/pop-up/&requestRef=&flashVer=11.6 r602&scrWidth=1276&scrHeight=846&cIds= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: n149adserv.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Cache-Control: no-cache

Pragma: no-cache

Expires: Thu, 01 Jan 1970 00:00:00 GMT

P3P: CP="CAO PSA OUR"

Set-Cookie: csc=76-1434242006566-19-1--; Domain=.n149adserv.com; Expires=Sun, 12-Jun-2016 00:33:26 GMT; Path=/

Set-Cookie: epomUUID=ce532c61-1163-11e5-87f2-f8bc125381b8; Domain=.n149adserv.com; Expires=Fri, 08-Jun-2035 00:33:26 GMT; Path=/

Content-Type: text/javascript;charset=UTF-8

Content-Length: 422

Date: Sat, 13 Jun 2015 00:33:25 GMT

document.write("<meta http-equiv=\"refresh\" content=\"0; url=http:\/\/onclickads.net\/afu.php?zoneid=313275\" \/><script type=\"text\/javascript\">new Image().src = \"http:\/\/n149adserv.com\" \"\/im\" \"pressi\" \"on.gif?b=778\" \"&p=27&ch=&ap=&cps=&c\" \"=76&l=UA\" \"&h=acf77f38e46b2eec6d48af61483c53a7&t=\" new Date().getTime() \"&s=1ca12eb2e60e376e81cb62ca2676068e\";<\/script>");.CustomWLAdServer.addCampaignId(76);....

GET /simg/sprites/env/aisn/goto-top.png HTTP/1.1

Accept: */*

Referer: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i02.i.aliimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 13 Jun 2015 22:13:24 GMT

Last-Modified: Wed, 05 Dec 2012 08:39:07 GMT

Cache-Control: max-age=172800

Timing-Allow-Origin: *

SERVED-FROM: 212.30.134.184

Server: Tengine

Accept-Ranges: bytes

Content-Length: 370

Content-Type: image/png

X-Pad: avoid browser bug

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

.PNG........IHDR...0...0.....`.......tEXtSoftware.Adobe ImageReadyq.e<...KPLTE.............................................................................XY....tRNS..........................4......IDATx......0....&"..8....W..L..z..6.G.....i&..8p`..\M..... .A6..5U...d...@.g....(}...>4...........\.T...{}b.q.[v.D ....Unb.u.m.~w.#..........p...`}......8..........IEND.B`.HTTP/1.1 200 OK..Expires: Sat, 13 Jun 2015 22:13:24 GMT..Last-Modified: Wed, 05 Dec 2012 08:39:07 GMT..Cache-Control: max-age=172800..Timing-Allow-Origin: *..SERVED-FROM: 212.30.134.184..Server: Tengine..Accept-Ranges: bytes..Content-Length: 370..Content-Type: image/png..X-Pad: avoid browser bug..Date: Sat, 13 Jun 2015 00:33:34 GMT..Connection: keep-alive..Timing-Allow-Origin: *..Network_Info: UA_KHARKIV_34323...PNG........IHDR...0...0.....`.......tEXtSoftware.Adobe ImageReadyq.e<...KPLTE.............................................................................XY....tRNS..........................4......IDATx......0....&"..8....W..L..z..6.G.....i&..8p`..\M..... .A6..5U...d...@.g....(}...>4...........\.T...{}b.q.[v.D ....Unb.u.m.~w.#..........p...`}......8..........IEND.B`...

<<< skipped >>>

GET /pixel?google_nid=alibaba_dmp&google_cm&loop=1 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm=&loop=1&google_tc=

Date: Sat, 13 Jun 2015 00:33:32 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 294

X-XSS-Protection: 1; mode=block

Set-Cookie: test_cookie=CheckForPermission; expires=Sat, 13-Jun-2015 00:48:32 GMT; path=/; domain=.doubleclick.net

Alternate-Protocol: 80:quic,p=1

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm=&loop=1&google_tc=">here</A>...</BODY></HTML>......

GET /pixel?google_nid=alibaba_dmp&google_cm=&loop=1&google_tc= HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive

Cookie: test_cookie=CheckForPermission

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://cmap.alibaba.com/landing.gif?google_gid=CAESEDFEM-6j34BXp9sspL63B48&google_cver=1&loop=1

Date: Sat, 13 Jun 2015 00:33:32 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 300

X-XSS-Protection: 1; mode=block

Set-Cookie: id=22ba38080f020075||t=1434155612|et=730|cs=002213fd48905a2bce2cc59624; expires=Mon, 12-Jun-2017 00:33:32 GMT; path=/; domain=.doubleclick.net

Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT

Alternate-Protocol: 80:quic,p=1

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://cmap.alibaba.com/landing.gif?google_gid=CAESEDFEM-6j34BXp9sspL63B48&google_cver=1&loop=1">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Location: hXXp://cmap.alibaba.com/landing.gif?google_gid=CAESEDFEM-6j34BXp9sspL63B48&google_cver=1&loop=1..Date: Sat, 13 Jun 2015 00:33:32 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Content-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Content-Length: 300..X-XSS-Protection: 1; mode=block..Set-Cookie: id=22ba38080f020075||t=1434155612|et=730|cs=002213fd48905a2bce2cc59624; expires=Mon, 12-Jun-2017 00:33:32 GMT; path=/; domain=.doubleclick.net..Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT..Alternate-Protocol: 80:quic,p=1..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://cmap.alibaba.com/landing.gif?google_gid=CAESEDFEM-6j34BXp9sspL63B48&go

<<< skipped >>>

GET /sdb/e0/WebBrowser.xml?71b7ff3e-9e2c-4df1-9a9e-999ab41d6549 HTTP/1.1

Host: staticrr.fastplayerpro.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 13 Jun 2015 00:33:33 GMT

Content-Type: text/xml

Content-Length: 4250

Last-Modified: Mon, 18 May 2015 14:02:05 GMT

Connection: keep-alive

ETag: "5559f0dd-109a"

Accept-Ranges: bytes

<Popup>..<Version>1.0.0.10</Version>. <Enabled>true</Enabled>..<Size height="768" width="1000"/>. <FrecuencyPerHour>3</FrecuencyPerHour>. <MaxWindows>4</MaxWindows>. <LaunchDate>07/01/2015</LaunchDate>. <Url container="popup">hXXp://VVV.wbredirect.com</Url>..<UrlNotAllowedCountries countries="AE,IR,IL,EG,CN,BA,RS,TH,IN,CZ,ID,VN,PH,PK" container="popup">hXXp://network.adsmarket.com/click/jGJunWecqZmOZnCXYcp6w4iQa5xgn36bi2SYm2Gif5mJkGqXXpt-lbdia5hhn3qX</UrlNotAllowedCountries>. <UrlByRegister>...<Url container="browser" key="HKLM\SOFTWARE" priority="5"><![CDATA[http://n149adserv.com/ads?key=8a35d9a5b93c671dcef88419ab81871b&width=0&height=0]]></Url>...<Url container="browser" key="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TeamSpeak 3 Client" priority="5"><![CDATA[hXXp://n149adserv.com/ads?key=0d8448124f556ffceee148f60ea374f6&width=0&height=0]]></Url>...<Url container="browser" key="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RaidCall" priority="5"><![CDATA[hXXp://n149adserv.com/ads?key=0d8448124f556ffceee148f60ea374f6&width=0&height=0]]></Url>...<Url container="browser" key="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}" priority="5"><![CDATA[hXXp://n149adserv.com/ads?key=0d8448124f556ffceee148f60ea374f6&width=0&height=0]]></Url>...<Url container

<<< skipped >>>

GET /ml.html?callback=landing8978252&cna=WWgCDjWxzjYCAcGK9OdXbmWQ HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cmap.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==; uns_unc_f=trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76; _ga=GA1.2.1214118344.1434155619; _gat=1; ali_beacon_id=193.138.244.231.143415561055.341443.0; cna=WWgCDjWxzjYCAcGK9OdXbmWQ; ali_apache_track=""; ali_apache_tracktmp=""

HTTP/1.1 200 OK

Cache-Control: max-age=3600

Content-Type: application/javascript

Expires: Sat, 13 Jun 2015 01:33:31 UTC

Date: Sat, 13 Jun 2015 00:33:31 GMT

Content-Length: 55

landing8978252(['hXXp://cmap.alibaba.com/landing.gif'])....

GET /landing.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cmap.alibaba.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: max-age=3600

Expires: Sat, 13 Jun 2015 01:33:32 UTC

Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm&loop=1

Date: Sat, 13 Jun 2015 00:33:32 GMT

Content-Length: 104

Content-Type: text/html; charset=utf-8

<a href="hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm&loop=1">Found</a>...HTTP/1.1 302 Found..Cache-Control: max-age=3600..Expires: Sat, 13 Jun 2015 01:33:32 UTC..Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm&loop=1..Date: Sat, 13 Jun 2015 00:33:32 GMT..Content-Length: 104..Content-Type: text/html; charset=utf-8..<a href="hXXp://cm.g.doubleclick.net/pixel?google_nid=alibaba_dmp&google_cm&loop=1">Found</a>.......

GET /landing.gif?google_gid=CAESEDFEM-6j34BXp9sspL63B48&google_cver=1&loop=1 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: cmap.alibaba.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=3600

Content-Length: 49

Content-Type: image/gif

Expires: Sat, 13 Jun 2015 01:33:32 UTC

Last-Modified: Fri, 06 Mar 2015 09:11:41 GMT

Date: Sat, 13 Jun 2015 00:33:32 GMT

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=3600..Content-Length: 49..Content-Type: image/gif..Expires: Sat, 13 Jun 2015 01:33:32 UTC..Last-Modified: Fri, 06 Mar 2015 09:11:41 GMT..Date: Sat, 13 Jun 2015 00:33:32 GMT..GIF89a...................!.......,...........T..;..

GET /tps/i2/TB1QtIrFVXXXXbHXFXXIVqAQXXX-1400-160.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 43988

Last-Modified: Fri, 15 Aug 2014 07:58:54 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 81.52.170.69

Timing-Allow-Origin: *

Cache-Control: max-age=296475865

Expires: Sun, 03 Nov 2024 10:57:54 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

.PNG........IHDR...x.........9<......tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:6AF5F36560E1E3119071C82A8D479882" xmpMM:DocumentID="xmp.did:F3AD4A80245111E49140D07A52E4B5BE" xmpMM:InstanceID="xmp.iid:F3AD4A7F245111E49140D07A52E4B5BE" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:948E8F5A5024E411BC839BB25A649170" stRef:documentID="xmp.did:6AF5F36560E1E3119071C82A8D479882"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..-.....IDATx....|..}.{.`....N..DJ..X.%;.#/..'...I..nZ....n.......7....}7q....ub.y.s.Z..(M,.q.E..k!%..N..@..l.....@.X......X....Y..........................4............ ................ 4............b................B............ ................Jh.......[.m-...L..a..V#u9R.b..<b.(<%......?/z.">.m....d..o4B .......B.7a....^."...Vt..f..3....V....2.B.......-s.g.........,..8.#q.{.uA.....i~n@h........hkq..p.. vB.#..?....(@.....r@h........7|......). ~f.uR..4..@#...............6..^.S...U.................[......lXp..WWe h..

<<< skipped >>>

GET /tps/i3/TB1_jCQHpXXXXXDXXXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 10992

Last-Modified: Thu, 19 Mar 2015 09:19:49 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 92.123.78.44

Timing-Allow-Origin: *

Cache-Control: max-age=308044267

Expires: Mon, 17 Mar 2025 08:24:36 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

......JFIF.....H.H.....C.....................................!........'.."#%%%..),($ !$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$........,..".........................................D..........................!.1A."Qaq..2B..#R....3b.$r..C.4D...ST..................................)........................!1A."2Q..a..#3C............?...D@...DD....D@joi.x..&. c.K...#|.M.....p.C..._..........)...Z..&.7..r..l..y.....}.bg.~].{.7.F....)=.s<.....z{.o.Ql.....U.g.....N........_..$...U.........<..t.......V.....;.x....V.4..uL......i.k.B7....G..H{C.#.^.. b-....^.qSK...`*...a...D@...DD....D@...DD....D@...DD.......\.....i.9.=u.s\.......T..=>.G.....q.9=.............;]o...d..../..OO. ...0j..eD..e...j..$S5......=..Ga...G.T.&....D._............\.e..T.O.o..:G..../-.... .&.Oy..........X..|....js(.....o......X.....'.[...ch.,u...V.^|.:&..p.D@...DD....D@...DD....D@...DX?.8....eF6..z.8AK..$......@d9.5..J....'MAN..W.O....Z'7.d...MO....B@.mD.... s?..4...<x......N.Ov.....o...?. g..!.p.....1l>z......Qs@....].G.G...1......D..j.];..Vc\.s`....EU....[).f.~.Y...Un.WA.m34......T.........lo..x...J..(.}%[...K.J[.d?..X..J...'.J...;.....;.... .....c.UFK.......r..T.]..b...K...j..}|..8j..]8Sq..T.;...U....?/....*..5d.j`...F..M.V...H....5&\..qW..9.....).x..6X.6..j.;.7.oU.]..nd>?.<.P.Y]6=....n.M=t?.?..]s..n..2.&=.Jd..m.;9...GB..p.X.X.n.m...UV.M..a..2..].......".......|....h.r.....Q.I#8DEA...." ...""...." ...""....._.......*z.....x....D.9.h...6&...kF.....x.......v.,2....6=..%u./Ri.$sM...}J...h...f...8y{...

<<< skipped >>>

GET /tps/i3/TB1ciU8HXXXXXahaXXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 13988

Last-Modified: Thu, 19 Mar 2015 09:19:49 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 80.239.222.164

Timing-Allow-Origin: *

Cache-Control: max-age=308044290

Expires: Mon, 17 Mar 2025 08:24:59 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

......JFIF.....H.H.....C.....................................!........'.."#%%%..),($ !$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$........,..".........................................G........................!..1A."Qa2q..#B...3R.....$br.4C....Sc]s....................................1........................!1A..Q"aq.2.....#B..R..............?...*.J..ZZ.( .^..Z..KGB...>#.....s..0..B......tKb....F...'Q.H.........?/R 5vA..a.....F...l.t6...b......*s.OA..("..~.....Y..rs.a..z.U.!<....2=....x.C....b}..Q.f......jH.^...@........=3...(;..?..h..B...A.It...=~~.._!.........OJ...w.5..|.@._.....oRP....&....G.F.|.yv.........?_...g...G@H..ToQ....L...{..}G.....sx..3.c..CR!H..^n... ....p...M.JQ.u.1.F.....O.Y....n.../jl.....`..?Q..R..0...KD-U......RyE:b4.LRd{...r..PjZ.....AIjU&.K .....l.I.).4..P...J!..........7....U.&....P*Y..1A<...:R.^...B...om!..H.Lc..G.t.....l._5".]!..R..;.U.).`.?......syE8......i..*..c.s..@...7....~.....A..?.sN...f.=3.......\....b....o.S.....C.......J..@T..8....7NW..........w..eU...ZIt:...B..UNd.9..LR.^].C..Q.S...N...$..S$gq.). .t.Mf.O.J..D.../..v.. m.v....Z..X|X..............%....$... .T..}Y.|.xr..{z.j.....6.N...=N;{..W>X...c.[.'.-2........=5.~<.EmR.0..eu.......xg...T.._)...=...jr.G...".DF.=E#..N.(....~J......*vd.8..S.........j*q..B..)......M'...X(h.*....e.&.Zn...4.~.._m..#...q.1.(...a&..1.,.om.....,>....k....p2.p....5".^Y.fw...X..Q....,..4k@.Z.. ....I(Wq.,.R.i..u&..A...D...E.oJyW...n...'...M..0h..s.G..Jt/..f....u..4.1eNd..d.R....<$.A..cz_.v.l......)..={n.z17

<<< skipped >>>

GET /tps/i1/TB1YUr7HpXXXXXTaXXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 31751

Last-Modified: Tue, 31 Mar 2015 02:32:49 GMT

Access-Control-Allow-Origin: *

Cache-Control: max-age=308974022

Expires: Fri, 28 Mar 2025 02:40:31 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

SERVED-FROM: 80.239.222.166

......JFIF.....,.,.....C....................................................................C.........................................................................,.............................................C...........................!.1."AQa.q..2.#B....R...$3..%4...Sbr..................................7........................".!12.AB.#QRaq..3....$b.4.r..............?..m..kJ..s`.1r=!....E..;.s..&}>..6....q8.~"...<...b....H...O..|..@...tFE..!.z\........HF.9..M:...00...M..IC...O...P....G..pi.p.W.h.;.-......"..e.@.[...).........o!(.O7......5[.9.-Jq...ap.#.&...FR...{....^.....M......z@..Gt....p1.#..IZZ...........k.........b..b.]..>.YZ.gi.`2......k...f-......(7".[....8..<..6W{.=1..Z.$.c...[#.$xc...c..l..;...\..Lq..Z...n=p3...|.e...e-.v....YT.r..s...{.j.V.......(!.Y4N.. ....IA..s.R.7..ne.@.Um'.I.......~...&.P8.%O.3..............I..Si=.].......bI..../.1.o.....q.8... .'.~qM.*...kmD...l.U..".....r.....]C.lGA...<.R........eHm.#.I....o.....:*Pn.F.<v'..!.I...).Y..1.h] ..............,.&..H...a.}..N..:H..~........sZ.b.:..V....E.....HeU.~.Z.Pb..Jp{....AuU.8...I.R\5)D.p.{.~N.#b.B.....IyD6lB}1.d..&..zJ).[.r0.q.v..........,H.W")V.I..S.$.KR..<..1-.;O7.Rq;I].......RR.o.. (.....]9...n.R....Q.i..MB...I.._..~...w..B.gJ5.$....F;.a.r.R:].m...!?$... .c..U..f....C@.q~}}1\X.X..z'...>$5).........[5 ....$2..w..qR.H-T....b8"...@Bc3..q._lI..>l.M...yl.'..l~....gN........Kl.V.z}.;... &..^..V..e'w.......N9...C.2.<....3...J0W......ZIW _.....'.~...NS...v?.8..}%.b.?..>..c.9....8...6..[#...}.. ...JT[.x....{..

<<< skipped >>>

GET /tps/i1/TB1QrZ5HXXXXXbmapXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 18841

Last-Modified: Thu, 19 Mar 2015 09:19:50 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 92.123.78.48

Cache-Control: max-age=308044308

Expires: Mon, 17 Mar 2025 08:25:18 GMT

Date: Sat, 13 Jun 2015 00:33:30 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

......JFIF.....H.H.....C.....................................!........'.."#%%%..),($ !$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$........,..".........................................I...........................!1."AQa..2q.#Bb...R...$...................................1.......................!1..A"Qa.2.q..3B.....#..............?..4.(.)J.JR.R....(.)J.JR.R....(.)J.B.......t9lf.....!....J.q.Ww...X....T....@.N..-.N.-.8............*..CLr.... ..(....N.oJ..C)...?-..SHt.......t.3..........P..>.3...DV..[N.N..E...j.".V>!\...| .N.v..i~;...}.....yTc6."\.'<.7.VVS......C....=|.....^..N........Y.rY{...}.O...Ze@G..Lm.LT..q..2X.Jq. s....h.c.W[.}.....w. r.I......N..%.Q..q_zc..DPTK.\.iI......1VS........2....T.,.DK.F].........q#.^...I]C... ..l..J.i.<..B....|..]..3.R......)@)JP.R......)@)JP.R......)@)JP.R....©'..M......x..t.T..rc...T..|......n..9....G.....o..!#.....~...F..........l.-.f.).m[Q\ZH.....^C..........V.:{vKh[...q.........du'.m.......6..\i71...>.p~.......=k...k.-w^.A.C.m`s....>....]............l...r].R.wg.Q.ni.HI.Dh...N|.@..<..:.6......s..c.....:...l.~.j.... ....B.........#.....V..Gm...q...7d...W/./....J....#....6{y1.m.3...g.....j...d"....t...%( .......g.0kz..iZ.<.1...n.....}..;...8.OJ.8Ei...@[..l..OZ.sR.A(..D.h....:w..mT....-V.5...oy..c......7.B.?.zk.NB..cTR....(.)J.JR.R....(.)J.JR.R....(.)J._)Z...........I..Dh...........v>.,...0Y.6z...].N ......(R..|.9...o....1....?q.....u'......{..%.Qfn....'>........Xv.|.Nm.G.k..T./6....mqhO.L..7.0.$....u....9

<<< skipped >>>

GET /css/6v/run/common/drag-paste/drag-paste.css?t=db4d3b36_0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 506

Last-Modified: Mon, 02 Feb 2015 10:28:49 GMT

Content-Encoding: gzip

Cache-Control: max-age=20253401

Expires: Tue, 02 Feb 2016 10:30:15 GMT

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

...........TQ..0.. ..I7iA..n....Ln...m.%....}n....c...=@.8.>.....S. g.|@V._7f.. ...JJ..5^.e4...r.090.%.|.J....=g;L.*...z.....9...-.?&.C...b.t.G....n..H.\Gy}.h..B....Bs}.`,....@......8~J.Ty...^.Z.I.b.;...O.... T...V"...X.R.k........[s..yN.d..0.7..<...x...M....(j.-`./..P..*..E.J..G....(........rq.U.WA.?..(..)....h. .:.6A.l2.....|.f..]....8`M]O:PIQ.t........O........?N*p..dX.R...>...3.<. 2...E..5.|-).~.f...c.........[.,.U.]\F...&Ds.!x.=...#...O...}"k.g.*.Q....?5.....j.J..l$..-.......h..<..<......6;M.....HTTP/1.1 200 OK..Server: Tengine..Content-Type: text/css..Content-Length: 506..Last-Modified: Mon, 02 Feb 2015 10:28:49 GMT..Content-Encoding: gzip..Cache-Control: max-age=20253401..Expires: Tue, 02 Feb 2016 10:30:15 GMT..Date: Sat, 13 Jun 2015 00:33:34 GMT..Connection: keep-alive..Vary: Accept-Encoding..Timing-Allow-Origin: *.............TQ..0.. ..I7iA..n....Ln...m.%....}n....c...=@.8.>.....S. g.|@V._7f.. ...JJ..5^.e4...r.090.%.|.J....=g;L.*...z.....9...-.?&.C...b.t.G....n..H.\Gy}.h..B....Bs}.`,....@......8~J.Ty...^.Z.I.b.;...O.... T...V"...X.R.k........[s..yN.d..0.7..<...x...M....(j.-`./..P..*..E.J..G....(........rq.U.WA.?..(..)....h. .:.6A.l2.....|.f..]....8`M]O:PIQ.t........O........?N*p..dX.R...>...3.<. 2...E..5.|-).~.f...c.........[.,.U.]\F...&Ds.!x.=...#...O...}"k.g.*.Q....?5.....j.J..l$..-.......h..<..<......6;M.........

<<< skipped >>>

GET /simg/sprites/env/webatm-new/contacts-icons.png?t=762e3bac_0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 5943

Last-Modified: Thu, 30 Apr 2015 11:11:54 GMT

ETag: 762e3bac_0

Timing-Allow-Origin: *

Cache-Control: max-age=28063698

Expires: Mon, 02 May 2016 20:01:52 GMT

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Timing-Allow-Origin: *

.PNG........IHDR..............t.`....tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A31709C8CAA2E4118E68A101057BAC00" xmpMM:DocumentID="xmp.did:0C00D1F0BC0B11E4A9C39E44F3EF610C" xmpMM:InstanceID="xmp.iid:0C00D1EFBC0B11E4A9C39E44F3EF610C" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F77F117407206811822AF53B6DA261FD" stRef:documentID="xmp.did:A31709C8CAA2E4118E68A101057BAC00"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>. Q....gIDATx......u].......A.....A!P8..DKA..o..WD.E$..[...,x!0...`H..[..%.=..@..."B........>?.....s......u...s..=......y.c..pu........d...]..f../..a.||...n...b. .....'.^O.<?sx........!.e...P.ke.~ ....=...9:sG......e>.H~n).4...Gb......G.g{.a ... .....~7?....2;e^..6.8.$.t,i.q...y.....I.G.o{...#3..l.9 .|...e......$..X.V.Xm{...|..[m{.q........3.d.5.8.9.M..7sU..o...u-k Vm...Q..V.....h!..ev.."...>I9...=_..9.....X.=.....(.V....@...'...=.>.[..@.".....c..........=......2W..d......2.Z.Y{p{$...G...h!..d....do.Ufy.1.G..y.

<<< skipped >>>

GET /8c/JFileManagerSetup.exe HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: 146.185.26.220

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 13 Jun 2015 00:33:24 GMT

Content-Type: application/octet-stream

Content-Length: 2229214

Last-Modified: Thu, 15 Jan 2015 17:44:21 GMT

Connection: keep-alive

ETag: "54b7fc75-2203de"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......................................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata.......@...........................rsrc................v..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..

<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/html

Date: Sat, 13 Jun 2015 00:33:13 GMT

ETag: "5452135d-38"

Last-Modified: Thu, 30 Oct 2014 10:30:53 GMT

Server: nginx

Content-Length: 56

Connection: keep-alive

<html><head><title>ok</title></head><body></body></html>HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: text/html..Date: Sat, 13 Jun 2015 00:33:13 GMT..ETag: "5452135d-38"..Last-Modified: Thu, 30 Oct 2014 10:30:53 GMT..Server: nginx..Content-Length: 56..Connection: keep-alive..<html><head><title>ok</title></head><body></body></html>....

GET /?ctrak3.2.587=c_Start_Application HTTP/1.1

User-Agent: session

Host: api.magnodownload.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/html

Date: Sat, 13 Jun 2015 00:33:18 GMT

ETag: "54521359-38"

Last-Modified: Thu, 30 Oct 2014 10:30:49 GMT

Server: nginx

Content-Length: 56

Connection: keep-alive

<html><head><title>ok</title></head><body></body></html>HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: text/html..Date: Sat, 13 Jun 2015 00:33:18 GMT..ETag: "54521359-38"..Last-Modified: Thu, 30 Oct 2014 10:30:49 GMT..Server: nginx..Content-Length: 56..Connection: keep-alive..<html><head><title>ok</title></head><body></body></html>....

GET /fd862eba9a8eff3775636859f9766f82c6a7232124f727e93497715d0390105b0b8886781535ed62a8d0fcf75290092ff752ed904486fe229632d57ce23620a8e80d093e255c14cd84528e8074a4b2ebaa2f43f9c68ccac4f0a9932d7b8bc982ab6a23ab2c704e36 HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Date: Sat, 13 Jun 2015 00:33:19 GMT

Server: nginx

transfer-encoding: chunked

Connection: keep-alive

224c..897d36dc986b9a50cbd1eee39dd9aa0fd1e25e56da9e7a6f0c0feea7a57e63b1220027765be511a128ef7ac863aea520fc89a4174fd0ed9897cb3d5e52571b809ef9e0a97649be6ebb591700985d395608da6f2c5c4d122390aa80f5b8da8d2710895f1e34e0543db722a0ea4ee71d2d1a1de0394225cef0012b3e6a225fdef6c19aff3ac5895b5ec381b2d6d9ddcd023f549451513bec2fddb7e36043acd985e62db0f54736a74366d377a457204e404f6fb23de991b40fbc464a97a0ca3c7a0ec8e61a217157e47126454bdf6303264d7c59a7aa091dc2fcb555b18a1c2ea8bf995bc85fd9647da934b2f131291143f4a318bf79215746b142da221600f691c539840e097dd13cd8302ae105228c3ab38bd04297184ad19fb4f3375d08e8e192780fd5fd0baa9d183a42f4b977f9c4aff86ccc2f45d9a3d642bba18050d081bad5f4eafc9b251986cd2897abd09ce0c560eea3475e77e701c2ba367ee2f4ec330b4e97e14b5c77bc5233ce0985241929661bad9196733bc3fde73b1ea04ea46f2d9b190b90a1f757c53f0bf35983faab92919f40caa2b375e09edd356611fdb72163282f83b82ff320f3f79ffff99ede3f8d992eaa7c53909931e041098624f5298e36895794418c7535cef69df4e0f75350d5fd7b92535fb6859ef7b7424aabf30d28563633ec391df7c96b36a5bb9d1731f03d806f3dd75f013c6a1024eceef80ef61e6bdd9c81f948ed2fa9df05750f88a192abae5a034f8e97c1781550c747682918e36603f697a3057b011bc71c63d6e1982c65bdc74b17a3b0f75d6f3e388b7ea6b6f1ef588ba42b65ae0126466fdff8b1f9c74885312003eeb8c128d72c0689f557d9beeec84fe0669fb87bbba54a30fa4e963ae99c0273cf7fc3010d950151dce027bbe634276a5eaf4625a7e8ba148dd2c5cc5d99d02919f85aaa55c524210ff3823ea66a04c2f95ed770741f6d8a3ef1b193890b28dfe363e174b320882838bc710a7f1cd6c8c6d7bd9629f5d4bfcc54a9e38b409ccf56f07bedca6dc5fbcf1c299301abc76d34a5269078693dcdbc362084c5801b3998

<<< skipped >>>

POST /0b6626ec5e4bd43463c10b130d5e34b10864302c058b6d184bb46749500be84c4bde88c5d88e32622c4040c760d4f2447fb9c56605186310 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 2 R:1

Host: api.magnodownload.com

Content-Length: 2726

Cache-Control: no-cache

cdata=86394263D6DED7AD3ED013DFEF7E64F6C29F5997166EF97A418F915F82A9AD7FC77F5FC74ED02F99799278738B97993DFA484DED0643C147AF1F76E6047AAC12B04F4D1B9014C49B2B9206253F7B816F613C3C2381141BF9CF3270815E833E217C84153888AF84AD3B25072B7234318ADB6B796AA64B779F2A2FFAABF95EFDC11241AEEFDE629155B76CCA2A4F117755C06DE1498E9C37CD98B521F0FD403F13CB01AF0E4FBF71138F6A88730187FF335D1D49628715144B0C70D3E9EFE7F238A0BD4DC3850AA17491D1411F679F649D153C8BB58D807D75C71D684597E3C53158883877E2B2DF5F9835210215BF8B4E424D54C9DC1B0382804C82DF6DE430D6286F4EC32EFA9C0879E0B5195F873EC93EFD9028384F794BA8001AAD0EFD2F57163951F48C0543140FA71C2CC25B1E684F083496E91153CD0189459D14D516740D975556EED463D549149C64F7817B04107DF3BD3AADB9D05FF4CA61C16FFA52B0B03FC804758BA2BBFE11F6894C15F67736AE213BCEFDF4413BB9970F70654B7C300116460FAB905A38A5DA3C219D77E5831422B475F8B98F771450C586E4A98C88422A4D2D55FEBEE8C1F50ED3ADDFD386B54BF360ED09327D06513E427FC52942CDABED860F111BDC58F37DAE1E5804B1D324B29777FFAC9632ED0D917F4E2946F6770B48CACED65284414A0C6474B822F9F408D2C90856DBF16EC64796FF36885F3B72C81CDD380DE08636AF2F3CB02F987C595702481E0F760E2BBE161B8F139E030546165681464EC41212D0E3C01FB7AB00263FAE363E85221EF85FF79BD6CC295620E6ECB200436E44A91018A97C28E93F

HTTP/1.1 200 OK

Content-Type: text/plain

Date: Sat, 13 Jun 2015 00:33:22 GMT

Server: nginx

Content-Length: 7

Connection: keep-alive

MAXTHX.....

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/style.css HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Sat, 13 Jun 2015 00:33:22 GMT

ETag: "5506ab53-5454"

Last-Modified: Mon, 16 Mar 2015 10:07:15 GMT

Server: nginx

Content-Length: 21588

Connection: keep-alive

/* Template Win_Link */...article,aside,details,figcaption,figure,.footer,header,hgroup,menu,nav,section {..display:block;.}.p, h5, h4, h3, h2, h1, span, ul, li, form, input, textarea {..margin:0;..padding:0;.}.body {..margin:0 auto;..background-color:#f6f6f6;..width: 566px;..height: 458px;..color:#444;..font-family:Arial, Helvetica, sans-serif;..}.a {..color:#0066cc;.}..clear {..clear:both;..height:0px;..overflow:inherit;..display: none;.}..li {..list-style: none;.}./*********************//*********************//*********************//*********************//********./* estilo para poner los botones del box.html todos en display none */.._Bnext, .._Bexit, .._Bdecline, .._Bomit {../*display:none;*/.}./**************************************************/..container {..float: left;..width: 566px;..height: 459px;..border: 1px solid #ccc;..margin: 0 auto;.}.../*****************Template Win_Link*****************/......minimize {..float: right;..width: 45px;..position: relative;..margin-right: -45px;..right: 45px;..margin-top: 12px;..z-index: 9999;.}....minimize ul li {..display: inline;..float: left;.}...minimize .button-min {..color: #8b8b8b;..text-decoration: none;..border: none;..font-size: 17px;..float: left;..line-height: 12px;..font-weight: lighter;..cursor: pointer;..width: 12px;..}.../**************************************************/./* content */./**************************************************/.b {..font-weight: normal;.}..content {..width:90%;..height:353px;..position: relative;..margin: 0 auto;..borde

<<< skipped >>>

GET /event/common.html?id=17770&ext=cnatime=2078&st_page_id=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ali_beacon_id=193.138.244.231.143415561055.341443.0&inc=0&ver=40&time=1434155620749 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.alibaba.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 13 Jun 2015 00:33:31 GMT

Server: Apache

Last-Modified: Thu, 25 Dec 2014 09:24:05 GMT

ETag: "50b06f82d9740"

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

X-XSS-protection: 1;mode=block

Content-Length: 20

Connection: close

Content-Type: text/html

......................

GET /js/6v/biz/common/store-proxy/store-proxy2.html?iframe_delete=true HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: is.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/html

Content-Length: 3168

Last-Modified: Mon, 12 Jan 2015 11:48:30 GMT

Accept-Ranges: bytes

Content-Encoding: gzip

Timing-Allow-Origin: *

SERVED-FROM: 2.16.217.230

Timing-Allow-Origin: *

Cache-Control: max-age=84159313

Expires: Sun, 11 Feb 2018 02:08:44 GMT

Date: Sat, 13 Jun 2015 00:33:31 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

...........Y...G..^K...:.v.;7.g..v..q.[.%q.....6..=.c..lzz...A.....D...(/...^....`.?.........!.0..]U]]....;.y...G..{.Y....K...o.p....z.y$...........y...."RI&\.~..I(.| .*..........."&E..\.$R$.....tm....pL.d.G..)>(2..Ty...y..4...b....kf.......?....4...ZoT....b.\..>....W<.a..TW....... ........e(.f.~G.C.....t.nQ..i.;...%...#....C.`.{.h <.%^.e.(\y..2.....V..T..O9X...M.........j..G=K.V.@.s~....<.....i...[...(.ye..5..FH..(..9..b..OD.... !..U...0......,;,T.5.....%...RCc%...,.....l2....&.W2S...v...V.9.e`......2<.....\).Gj...t....0.....b"f..%.<....:* ,#..........T..jX.O.D....t@p......i...9.hX.%%..|S;.....5F.].s.........Lz.>..3y..n...|...J:p.!F..8...JK.B..N.I....S/....xWf ........v...]e.ui......R..2o....6z#T../.4;.,.....d;..2...0-....t.........!~...tA.=2......PKX8.d...Q..hk.;Y!s.2.....p....<.......0.K............&...m.&)i........@8.g.....pO......xZ..:......7..hO.....-.rC.....[.....q.S.........N.dz.[.....Wc.|;...@p.......tN...!F.J........z..P..$..)p.>LN.$....w`C.=...O.........)O..$.b.!V].!.Z..`..>....#.E .........7ZL..Y...}....Q.M....wf.k..1.........&.Z.....N..O.{R...k..Q..m..e./..^hl......$'\.u].O...Vyg|.t.Jj....k GxM...&.*..z |...c..6N._....9Z.. ..[..V_#......|..q...8.^t....U.Wz............._.y.h.........i>...~.....t..G....y,..m..p...^|g..l}...}.5B..2y..b*g..F..o...u.p...O...9....t.....d0.......Y[..<..6.E...tB.HC(.".)....q.....JZ...H;......OK.3z.....B.g.P.q.a\. ..W..i.K....k...U&.v._.n..J..U.#R...I2 ......;.e...;|y....s".4..@./.\..._*.........`";.$.."..c......>.c.G.x9#Gi6o.d.<

<<< skipped >>>

GET /favicon.ico HTTP/1.1

Accept: */*

Referer: hXXp://is.alicdn.com/js/6v/biz/common/store-proxy/store-proxy2.html?iframe_delete=true

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: is.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 06 Nov 2012 09:39:36 GMT

Server: Tengine

Content-Type: image/x-icon

Content-Length: 443

Accept-Ranges: bytes

Content-Encoding: gzip

Timing-Allow-Origin: *

SERVED-FROM: 80.239.222.164

Cache-Control: max-age=12056

Expires: Sat, 13 Jun 2015 03:54:27 GMT

Date: Sat, 13 Jun 2015 00:33:31 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

.............S.@.........Ia.s).u.5s..T......i..YQ..8.@ ....$..$.Q.@T"*......./I..4....d.o.~...5......u`...$.....kx.jmY.._..c....:..E.<.!U...|r..w....fO....u.}v.q5.z.@.s......b.....ZC...=1..7.....$.w......0.......>.?.:.........C........A..."C#c.}KJ`4..:.....8.P!}...C../...}t<do!.. =.`...MoQ..9.N.M....>.Q.\..;.~$.Rz..n6....!q..h6..@;....$....Q..~....hc.............)@T....=.8..X...._. .V.~.Vq."h..m~ c!...dOz.i..N.$;?.z..S.D..0%I.f.../..C.~...HTTP/1.1 200 OK..Last-Modified: Tue, 06 Nov 2012 09:39:36 GMT..Server: Tengine..Content-Type: image/x-icon..Content-Length: 443..Accept-Ranges: bytes..Content-Encoding: gzip..Timing-Allow-Origin: *..SERVED-FROM: 80.239.222.164..Cache-Control: max-age=12056..Expires: Sat, 13 Jun 2015 03:54:27 GMT..Date: Sat, 13 Jun 2015 00:33:31 GMT..Connection: keep-alive..Vary: Accept-Encoding..Timing-Allow-Origin: *..Network_Info: UA_KHARKIV_34323...............S.@.........Ia.s).u.5s..T......i..YQ..8.@ ....$..$.Q.@T"*......./I..4....d.o.~...5......u`...$.....kx.jmY.._..c....:..E.<.!U...|r..w....fO....u.}v.q5.z.@.s......b.....ZC...=1..7.....$.w......0.......>.?.:.........C........A..."C#c.}KJ`4..:.....8.P!}...C../...}t<do!.. =.`...MoQ..9.N.M....>.Q.\..;.~$.Rz..n6....!q..h6..@;....$....Q..~....hc.............)@T....=.8..X...._. .V.~.Vq."h..m~ c!...dOz.i..N.$;?.z..S.D..0%I.f.../..C.~.....

<<< skipped >>>

GET /analytics.js HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 12 Jun 2015 23:36:36 GMT

Expires: Sat, 13 Jun 2015 01:36:36 GMT

Last-Modified: Wed, 27 May 2015 21:02:55 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11093

Age: 3413

Cache-Control: public, max-age=7200

Alternate-Protocol: 80:quic,p=0

...........}iW....w~E\'.U..e...6.^.L$.I.l.,.$......!....~...28.......jk...,ux2..i.4.......21C5........x44..8I..C=...d_NO[...7*."..33.e.{2>..I..W..[......2....ZNe ...\N.i ~.$...i fI.2#.....S....$....t.......T.g......M..A..>I..HI.&...9......l46.....l4..%*.$.....F.g..H...bJ.h..8........x<.f.Tx6.Z...%....Lh..ht..43..ht...4..i..!........`.Q.f.{..vDW4.3.M...<..~b.B.....Wc*8.\5..z>.5....NeFH.......c..zi..S.zN....!r...H...~ONGY ^&..Q.....F{.K.....ZX..*........I|....Nw...:..1...2..M*u_.n....NFY..-.tE..[...x.m..j.....j(;..d0.*i.a.Mn}.klm..~....mK.f$....Ov.>{......{...o..;z....._..T...N.?......g6.....]..7.76.<|.....A.Ne.=....M=j...y... ...'.3..t24.......Z.40E.9J....p|.T.f.TS....F..$'^h...h............-&.d.P...S..#..5jKZ. BN.Q...nn.U]7..5.F.[...}z.[..xXQ.L...&.j....1r....<(H.......gK.vF.......L^u..!.c_MGG..;;..B.......{....W.$ruu...........sP.E.Li-m...{k.\ .....L..di?.-;oU7.}..O...z.z....z..j..\L.......h..s.C ./q....N.0sr..Dz4.s1...5.......R...T.P...]f....k......N.-L_(..lgW.2.Z?. ....L..d...0. JT*:jR.t*.)....|....*5...8Bh.k...h>.....1..P,.&*....N.6....i......2..j....41.R"(*&.B....d..........w@t.h.S..t<.....a....Y..:e&.bh..ty...=.N..&m....n.Yw.~-,...AP..s..`......8.hC=.......Z.ibb\&.L."4..q...q..V.w....a.o...A.V..b6E......$Q77..o..I......F"......m.K? ...}O.>...K...P.WD.....B.:..{...O.......$N%......}j.Z.6D..3D...n."u...6M.`E=:#..?......Y:=PI.....$....`b..f3\BR.-..!.....c.vf.&D([.q.a`Bs.........Yq.K.t..L.m.u..U..i..j..-.n.j7T..f.5..F.4..<.......st.........KK..`%*ji...H1..........t.}.\.8..d

<<< skipped >>>

GET /r/collect?v=1&_v=j37&a=2129827782&t=pageview&_s=1&dl=http://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf&dr=http://onclickads.net/afu.php?zoneid=313275&ul=en-us&de=utf-8&dt=Alibaba Premium Marketplace&sd=32-bit&sr=1276x846&vp=1260x681&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=1757803183&cid=1214118344.1434155619&tid=UA-53529524-1&_r=1&z=1776085867 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Location: hXXps://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-53529524-1&cid=1214118344.1434155619&jid=1757803183&_v=j37&z=1776085867

Access-Control-Allow-Origin: *

Date: Sat, 13 Jun 2015 00:33:29 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

Content-Type: text/html; charset=UTF-8

Server: Golfe2

Content-Length: 369

Alternate-Protocol: 80:quic,p=0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXps://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-53529524-1&cid=1214118344.1434155619&jid=1757803183&_v=j37&z=1776085867">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Location: hXXps://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-53529524-1&cid=1214118344.1434155619&jid=1757803183&_v=j37&z=1776085867..Access-Control-Allow-Origin: *..Date: Sat, 13 Jun 2015 00:33:29 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..Content-Type: text/html; charset=UTF-8..Server: Golfe2..Content-Length: 369..Alternate-Protocol: 80:quic,p=0..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXps://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-53529524-1&cid=1214118344.1434155619&jid=1757803183&_v=j37&z=1776085867">here</A>...</BODY></HTML>....

<<< skipped >>>

GET /js/sufei.js?v=2015-05-26 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: u.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Mon, 25 May 2015 05:24:09 GMT

ETag: 86da1ecf_0

Server: Tengine

Content-Type: application/javascript

Content-Length: 2817

Content-Encoding: gzip

Cache-Control: max-age=29979551

Expires: Wed, 25 May 2016 00:12:42 GMT

Date: Sat, 13 Jun 2015 00:33:31 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

SERVED-FROM: 80.239.222.164

...........X.s.6.. 6....D=.;..X..M.nr.....d(...S ..R\...o.>%?....M...b..~.X..`.'. ~.Z^2.f..H.t..)}.37..,..n....'a.y".T&:....B\....s.&..x...U...E&B....|..n..'.........W:..`-kMb..z>..-.....O.en..RG.S...s..[.UQ..Ng....t[=..O.w.LE.t.(./.....g.....N.w.NwGN.....d:...._....p^. ..W...}Vi.....l{......;c.,.hvrJ.........0..Y..qp./_.~....?...o.\.....?]^...?.....Y8g.e..^. ...J......_..........;=.Gp..E....s.)0...W.)U.s...9..0w.......:..al.^?x....9...Y.........j....j.........p..`.1_F0.u.F.....:f..!......L...rMV.G....{<...q.4........U1...q.....^...s..b..0r...a].............'.....a7MR.W.#.......y...*..]B..l..z........l\.'U...Z2}.W...4sE..n[.\X.q........fVy..Ra.....d..%.l....I.......;...........?%.~......:. 9QO...&....'..!.....7.O..L....$.=....T.S..;..~.1....l...x.l.......=..@*.b...}pl.d..........$.V..7....6f ..9_#<F...f..L.;...5>Bo>\\...P&q.<.......HL..R([%k......$..Z..Y:......P4>.............^..5.... ...`......G.]FIx....]....}E..?2.{ y0......)X..A.4. .........|....a.-.P~...P7...B.Scz..h.8,.d.....*.....;h....(..n..\.C......]."...i..R...O\5.*X.W..JZB..i.kP.Y....Z....c...T~.......\...}r.F...\J.R.Q.....a ..M.5G.5X.o....i...Y.T3.%...{.%m......ycD...N.....8.......-.wg....=F.d........i..dI}A$.D....'#... 1.ID.i..^q.......x..<.J.M.A12.....=V6.d...$.....y...:."(I...a.>,.k..u..JKW@uVF.*.)-.(f.R..RQ2.'i.n.S......^....W...H.H...........x....3Fu.'...... ........h..8pc=...\2......C.N./J..q.n$..F....(#......8.|........../.......`n..N...!.\.......c.........#...Yp..a.5..B]......l.......k{>@....w.p.}(..........j.

<<< skipped >>>

GET /tps/i3/TB1knn4HpXXXXc.XVXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 33305

Last-Modified: Mon, 30 Mar 2015 10:02:44 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 92.123.78.44

Timing-Allow-Origin: *

Cache-Control: max-age=308973962

Expires: Fri, 28 Mar 2025 02:39:31 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

......JFIF.....,.,.....C....................................................................C.........................................................................,.............................................M............................!.1A."Qa..2q..#BRr.....$b...........4E....................................H..........................!1A.."Qa..2q.....B....#3Rr..$4Cb..S...Dcs...............?....>....|...8.."<q.4Dx..h..........#...DG.>....|...8.."<q.4Dx..h..........#...DG.>....|...8.."<q.4Dx..h..........#...DG.>....|...8.."<q.4Dx..h..........#...DG.>....|...8.."<q.4Dx..h......."(..".."(..|E.....#q..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ...4E..."(.."....."9."9.".3..#.4Dx.....DUJ.Q.h..".."(..".."(..".."(..".."(..".."(..".."..]..c).O!..v.^....?u.'...rTB....%l...M.yN.AR..%#... .....$.?.Q......W......,..H.m........Q..eP......a..j"......B.x)?.R.......|1....M...w.N}....>......4..q......Ew.W...8......E.*.(..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ.DE..DQ..r.....PCm$.d..74D..9#.m.O.T.RHe.F....SDX...4Eq1J......k..2v...U.Z...Am...ZcKM.m?5ml..@mC...$.0.W.O...z.0EM9.s...J..\q.P.dZ...Y........y...l..T..>eCj...U..$C...{.......\..`y.%..XG.^(#.l\I._=...s%...=...{w.!..%#<....l~ ..n*......Q...R.......R.m>.>..s[..!.*..E..^........8......O.B.. <..|D$W.....k.....J.OV.5.q......^AW..?..*.......>.........`....J.o....w.._4. .[h...bA......w7..MS..K8,v..n...A..H......!8.)P).yl.Ap{..N.R .R..I.k...$..(..IR{mDL.u.D\s%r..D...{.....*..o.G....}(.......9Dt..|5.D....:..)@....

<<< skipped >>>

GET /tps/i4/TB13n.FHXXXXXX7aXXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 13735

Last-Modified: Thu, 19 Mar 2015 09:19:46 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 81.52.170.75

Timing-Allow-Origin: *

Cache-Control: max-age=308044269

Expires: Mon, 17 Mar 2025 08:24:38 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

......JFIF.....H.H.....C.....................................!........'.."#%%%..),($ !$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$........,..".........................................Q.........................!.1A.."Q.2aq.....#.3BRb...$CSr....%&46Tcdes...5DUu....................................1........................!1A2Q..."3aq..#B..4r...............?...(..(.....(..(..(..(.....(..(..(..(.5..4V(.3E.P..Q@.QE.QE.. .A ......}Y-P4..)8(eD|.2t..89.Ay.....s..;....^l......$%..I...s5$.r.u..^..b1.<@...-jn.t.X....:.<.e6........ese..V...>..o.RH..Dv.f..Z Mm...[c..x.x..}3.k...Ir....E.....Q@.QE.QE..E.P..Q@.QE.QE..E.P.b.E..Q.Ep.1nl..%c.OOy.[v..uB....!......9....ky`.2k....$...$.r.pI,..9..G..f..j....... 5 .QE.QE..E.P.E.KYoC.........yTS....u...."...?......8....s..!....B...B..~......R.l.6..V./.k.o]Ho..QU..".s.-.*..5.\...?...T*....;..KO'..F=Z..Wl.hQE..E.P..Q@.QE.QE..E.P..Q@.QE.V....$s. mDu..kN...J..P...y...VL..m......#..S.x./KY.nC....]'...!....SZ.S..(6....I.Zx.Yt.)..}..z#P3f.........%..8...............\.....,....i..\^.p..O..r..}..B0.R.|.~PZ&3.O#......?w5`...\....=.<.PP...f..tX.9.K.e..)P...~4.dlj}./.Z5(.......z..O...O..[d.:.:..E.E.WH...Q@.QE.QE..Q^.............Vj{E........C q........H..,h.(g...i.......I..hX.Z.f. ..m.w..qV..2.F..H#c...k...sb..C5./....p.i9.W..L...#......._..H5h.........C..[..V..mO..i.Z..P.T0w.>t..7....wkt9......./Gm,...e<';.j..O,rR.G.....jp.Xem..E!..Y.[.......HX....WT..E.P..Q@.QE.QE..E.P..Q@.QE.QExq....rH.....-.%.G..l1...... :..8W..B....!.....z3].g}.k..J..Z....T.o.\%....

<<< skipped >>>

GET /tps/i4/TB16MsBGXXXXXc1XFXXw4O3GXXX-33-20.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 558

Last-Modified: Wed, 24 Sep 2014 12:27:08 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 80.239.222.164

Timing-Allow-Origin: *

Cache-Control: max-age=296530592

Expires: Mon, 04 Nov 2024 02:10:01 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

.PNG........IHDR...!..........STq....bKGD..............pHYs...H...H.F.k>....vpAg...!............2IDATH...[O.0...........Q/.~....F3'..e....7.D.......?i...Ah.5..21.t.3|.....!e.f.%.O.C.a.!.....jU..u...>.Y:f.?.G../Z4.u.J.$i5..A..8.[)...j..m3.#..|...y.@.~N..Fk.[...B<........u).. h._...eyj..n...'-......0..l...#.n...,..v..G.$.......`.t$i..p..}z.....b>_.^o.-..A..f.Q.v..4.Cj5.<b.M.Z.j........1....@@...~.....w.Lx.R......%tEXtdate:create.2014-09-24T20:27:08 08:00U......%tEXtdate:modify.2014-09-24T20:27:08 08:00$N5s....tEXtSoftware.Adobe ImageReadyq.e<....IEND.B`.....

GET /tps/i3/TB19_fqGXXXXXXrXFXXSutbFXXX.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 14848

Last-Modified: Mon, 15 Sep 2014 11:15:52 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 92.123.78.48

Timing-Allow-Origin: *

Cache-Control: max-age=294541662

Expires: Sat, 12 Oct 2024 01:41:11 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

......JFIF.....,.,.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........,...........................................>.........................!1A.."Qa2q.B..#R...3....b..$45CrSs...............................$......................!1.A.Q."2a.q............?.......8.... .@#(...8......e.fh..>&..).{$....;5.|QA.....3q..[8..a...[<..#~.2rr95.?.uc.Y...G.].R9..z_........(.(...T..PI.8.8i.g..!.l.E.fF.>j}*).....DN......=02...9....o.4....c2.2.2.2.2.2.2.2......b............>............T/F.....g31....vA..C. 3,.$...4.h....@.P.T.!....A).3T.......~.@.[..?..x.r...x.....Y..OG,..H...F....>.z3a.M..)\F..M...........e... ....$4..Av.A..V5.V..d.Nq.hI..1...|...w..].I....T..&S$R....b?z.....k?4.........,..O....fy.H......e.e.%.LR.h...m$.m.T|.L...A%..o..k..G...'..H.5*VSD...V#R...0d..i.....2(.*.@wLfP..P0W...S]3$&....hP.T......yG...lg..,.........l......}=....=.?.S.F.p3AL.iT.<.T64.nw.$..T;...ApX.$.4....r....i.0.w.......I......&B......0..{..%....n...K..^?z.$.Xg...U..f..E.#......O.l..}..!6Nz..Ah.-.A........)..n........8....Mx.zb_..9......&B..-.c...&5..i6.mf.......|Rb.Q.L....\....u.u.H...D.2..Z.g^j..i..:...Z..c...@i..9f......P..s@.~.....4.yG.........\y?.;1...t..~~ ..8.t.O..t;l..%W...y1.*[)l....g..d.u..../AF.EL.b...ng%.*_F.l.......6&..). t..V.$....{.}..f..%............w.....7.....y.O...(Q..eo .)z....y...dVNP......-.VX.[ .({..?Pj.k...\he..c...>.....[G......%.Q.T.|. E.2\Z:.#.K.{..i....`...'h....".{....x...Q.MC...B.......$....8.`..?

<<< skipped >>>

GET /tps/i4/TB1WJb8HpXXXXcCXFXXoNAWQpXX-300-251.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 24247

Last-Modified: Mon, 30 Mar 2015 10:01:51 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 92.123.78.48

Timing-Allow-Origin: *

Cache-Control: max-age=308974064

Expires: Fri, 28 Mar 2025 02:41:14 GMT

Date: Sat, 13 Jun 2015 00:33:30 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

......JFIF.....,.,.....C....................................................................C.........................................................................,.............................................I............................!.1A.."Qa..2Bq.#R...$br..C.3Sc...4....%&.....................................5.........................!1..AQaq.."B...2R....r.#..............?.....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h....h..#z:...t...}].........C x.F.O'.. ..?....c......'...C}..m7..._.rT...:.:..S.....{S -D..B.CEX.~.0...V.......MCS6......\..P.x&1........ick...b.g\4.c..I....,.QiDg....1.M.....L.)..r@....O^I.HS.6..D..,.YmO...q.2.B......"..A.{...@.4..@.4..@.4..@.4..@.4..@.4..@.4..P=JY]/X.\W.v....CA.rzZ..........g...Q.x}....."...%.Hx(59KD......P.C9.. R...5....V.....f.R.X......I..9...TA.Y....%...&L....%*2P.m(.......Rs.t.Sv.Z...g(v.9.) ...N.8.B..,...)=..8.d5 n=b..&.j.....b-...0;.. .R{.A.H.X.Mr.lLT5&.......W..6......R.....!C..<.A.MB..!."=D......34...P. ...l.,...@....3......_...........@...M.G....!.%.......qJT..yz.6..G..n..T:.....W..&J.?u.t .IZ..QW.....0.h/./"KIq.%m..%I9... .0t...@.4..@.4..@.4..@.4..@.4..@.4..AW=.^..;..c-..5j...N...x'.{.x.A.....,.O.......]....M....8...4......#...GR..@......NHF...S<.U...4i.'....~d..<.d.....m...q .u.j..j.$.......y..A..........{t^y.0...@.`.@4..}.w83...$.....".[..?.O`.y.9 .k.....!...~#<.?....z(u...R\..>n.%.?...h=.T"L......[..c..[_.N..t.s..UZ|...$9PPQ..m....<J.@.].

<<< skipped >>>

GET /exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf HTTP/1.1

Referer: hXXp://onclickads.net/afu.php?zoneid=313275

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: offer.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; ali_apache_track=""; ali_apache_tracktmp=""; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==

HTTP/1.1 200 OK

Server: Tengine

Date: Sat, 13 Jun 2015 00:33:28 GMT

Content-Type: text/html;charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

P3P: CP="CAO PSA OUR"

Set-Cookie: JSESSIONID=OP9666A1-2K0141E8U1AST28V2GAP2-XYX7BUAI-0G9B; Path=/; HttpOnly

Set-Cookie: ali_apache_track=; Domain=.alibaba.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: ali_apache_tracktmp=; Domain=.alibaba.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: _mle_tmp0=eNrz4A12DQ729PeL9/V3cfUxiKrOTLFS8g+wNDMzczTUNfI2MDQxdLUINXQMDjGyCDNydwww0o2IjDB3CnX01DVwt3RS0kkusTI0MTYxNDU1M7AwNzPUSUxGE8itsDKojQIAALQbiQ==; Path=/; HttpOnly

Content-Language: en-US

Content-Encoding: gzip

5be9..............]s... .lG.......N."..S...d...e..l...[Q..$,...!...D.......l....FGO.<.<m..n.....s......@.......i..k.@VUVfUVVVf...?z.w......z........f....8....Q.......Q.H.my.......JXlK...q...{.b..uz."......=.^<..iA*=.{.3<.>.1..i....=..IG...^.$.._. wy.........lGw.#..%(e.m.y.C..~....i...W}...;o6V.N].1..a[....K.^..4.......y.u.H.JD.I...~mhvoC:.}G3.....RGZ...j..c..5..Fu........v.tf;.>......._..t./5..O.....C...d.f..zC.n@.|..l...%.uK......i..1-=|../.Z....x........UUJ...5...2.K.W.<`j0... ..n...1..._......".h..&...m. ^a.J...K...u|.q.....'{..spp..p.t.|.d...}i[ZqI...}.t...W=....G..Wr.2.........R.2N/.5.r.}@.zZ...Z*..C.d...G..`.4.g(n.....7z..E.D...Jv.........NY.qQ..b.7.....z.........9.*.G#0uJ&H....>..../.dh..6.B..cB...:.2..&....VI.m...w.j..G;.3,b....m...n.k.(..DE..K.2P'.(^V@hDu..yv..P.u...>^S..At....@....I.5.. ..R.r...,.~w.8..{....$.iAr..zN}............Q.U..\.k.r...MS..J.H........ .(.`.{.s....c.ww.\.G:.y..~zxt..1..........Mi.po............ .....mJ2|..R.N....#...d/u.{P..h..........-.&:.j........hJ...G....F.z.F/hg&j.@~.......q.W....(...N......7.V..9.......I..l}.j4.,......PH..1.....#..........uu>@..=.!........eeK.?D.....&7H.B.D. D.S..V.j.Vn@...<......5n.....r....J. .....C.Q.....I.f.]...Y..%gO.?.........iO{.....7.....w..@7...;[.,......PF{..;~.j...6.>...z{...7.9....=...._.>........... kz......nK=.zqVu..=.z...w.t?",}..<}..:}...\~^ys....S.{.d....y.\..tt..|.......w.........re..........yyj..[...'e.......>/..JY........j(.?W.....!y.\.O^...../...K......._?..O..........'h..&.>=~.|.....q[...

<<< skipped >>>

GET /favicon.ico HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: offer.alibaba.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Sat, 13 Jun 2015 00:33:30 GMT

Content-Type: image/x-icon

Content-Length: 1406

Last-Modified: Tue, 09 Jun 2015 06:57:32 GMT

Connection: keep-alive

ETag: "55768e5c-57e"

Accept-Ranges: bytes

..............h.......(....... ...........@............................p...LL......t.......(H.0P......,Hx. XX.....4h.. 0@.0`...|...,,.........8x......0@X..00.. 0..............\\......|.......<D.<\..D`..8HX.,l..4<P.@p.......................XX..<@.<t..................................(8P.@h...08.....,t......0@h..08.(((......................48.0.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ADDDD*C.((0) ..>GGGGG<<C.(...... GGGGG<<C.(... ;;..GGGGG<C....);;.8'GGGGG<C..();;;..GGGGGG<CC.0;;;.1.. 91.<<CC.;;;;;EGGGGG ..<.(;;;;;EGGGGG.G<C.(;;;;.GGGGGGGG<..(;;;?.GGGGGGGD...(.;;;!..GGGGD....(.;;;;;!...D4....(..;;;;;....4....((..;;;;;;..4.....(.CC);;;..................................................................

<<< skipped >>>

GET /wimg/monitor/start-render.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i02.i.aliimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 14 Jun 2015 07:16:44 GMT

Last-Modified: Tue, 17 Jul 2012 05:55:27 GMT

Cache-Control: max-age=172800

Server: Tengine

Accept-Ranges: bytes

SERVED-FROM: 24.143.194.30

Content-Length: 949

Content-Type: image/png

X-Pad: avoid browser bug

Timing-Allow-Origin: *

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

.PNG........IHDR.............(.4.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:2CDA8B17CFBC11E19980DC0C34BFCD49" xmpMM:DocumentID="xmp.did:2CDA8B18CFBC11E19980DC0C34BFCD49"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2CDA8B15CFBC11E19980DC0C34BFCD49" stRef:documentID="xmp.did:2CDA8B16CFBC11E19980DC0C34BFCD49"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>].......PLTE......U..~....tRNS.@..f....IDATx.b`..0.....OmY.....IEND.B`.HTTP/1.1 200 OK..Expires: Sun, 14 Jun 2015 07:16:44 GMT..Last-Modified: Tue, 17 Jul 2012 05:55:27 GMT..Cache-Control: max-age=172800..Server: Tengine..Accept-Ranges: bytes..SERVED-FROM: 24.143.194.30..Content-Length: 949..Content-Type: image/png..X-Pad: avoid browser bug..Timing-Allow-Origin: *..Date: Sat, 13 Jun 2015 00:33:29 GMT..Connection: keep-alive..Timing-Allow-Origin: *..Network_Info: UA_KHARKIV_34323...PNG........IHDR.............(.4.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket

<<< skipped >>>

GET /simg/sprites/env/aisn/goto-top.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i02.i.aliimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 13 Jun 2015 22:13:24 GMT

Last-Modified: Wed, 05 Dec 2012 08:39:07 GMT

Cache-Control: max-age=172800

Timing-Allow-Origin: *

SERVED-FROM: 212.30.134.184

Server: Tengine

Accept-Ranges: bytes

Content-Length: 370

Content-Type: image/png

X-Pad: avoid browser bug

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

GET /service/um.json?xv=2.0.3&xt=d5b9591c-cb60-4f96-be26-2bff6b23ff8a&xa=scp4p&xh=&x0=0^^1^^1^^1^^1^^1^^1^^1^^5^^1^^color^^-^^1276^^846&x1=1^^1^^1^^1^^0^^0^^1^^0^^0^^en^^-^^0^^Windows XP^^Win32&x2=Mozilla^^;SP3;^^Microsoft Internet Explorer^^3516ab67d54092e6bf44e729b77d6580^^en-us^^x86^^57f2da82064a7b7501289385afb25340^^Adobe Windows^^ActiveX^^en-us^^1def8189f7c620d61827869f51fcf447^^en-us^^WIN 11,6,602,168&x3=818^^1276^^3896^^1400^^846^^-^^http%3A%2F%2Foffer.alibaba.com%2Fexclusive.html%3Falpsm%3Dtrue%26sms%3Dsuginter%26smcon%3Dp%26tv%3D3%26imp%3D5b1aor19nl5bq76m3hj%26xp%3DLvgMuz7SxVBSO8m8pLNOH7a3^^-^^101^^-^^1434155621374^^120^^1276&xs=null&_callback=_1867_1434155621390 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ynuf.alibaba.com

Connectio

HTTP/1.1 200 OK

Server: Tengine

Date: Sat, 13 Jun 2015 00:33:32 GMT

Content-Type: text/javascript;charset=utf-8

Content-Length: 174

Connection: keep-alive

Set-Cookie: umdata_=F18566FE3F6A1058A752130C834CBCD94FC38B3B6DD7EE76DCAA924E35643421A20691AAD79DCAC47DF1B5BC320AE4583433554724957A96960158C50EBC5BCE2264F1A04C3CF884; Domain=.ynuf.alibaba.com; Expires=Sun, 12-Jun-2016 00:33:32 GMT; Path=/; Secure; HttpOnly

P3P: CP=IVAa PSAa

Content-Language: zh-CN

_1867_1434155621390({"id":"F18566FE3F6A1058A752130C834CBCD94FC38B3B6DD7EE76DCAA924E35643421A20691AAD79DCAC47DF1B5BC320AE4583433554724957A96960158C50EBC5BCE2264F1A04C3CF884"})HTTP/1.1 200 OK..Server: Tengine..Date: Sat, 13 Jun 2015 00:33:32 GMT..Content-Type: text/javascript;charset=utf-8..Content-Length: 174..Connection: keep-alive..Set-Cookie: umdata_=F18566FE3F6A1058A752130C834CBCD94FC38B3B6DD7EE76DCAA924E35643421A20691AAD79DCAC47DF1B5BC320AE4583433554724957A96960158C50EBC5BCE2264F1A04C3CF884; Domain=.ynuf.alibaba.com; Expires=Sun, 12-Jun-2016 00:33:32 GMT; Path=/; Secure; HttpOnly..P3P: CP=IVAa PSAa..Content-Language: zh-CN.._1867_1434155621390({"id":"F18566FE3F6A1058A752130C834CBCD94FC38B3B6DD7EE76DCAA924E35643421A20691AAD79DCAC47DF1B5BC320AE4583433554724957A96960158C50EBC5BCE2264F1A04C3CF884"})..

GET /7.gif?logtype=1&title=&pre=http://onclickads.net/afu.php?zoneid=313275&cache=67bd1e4&scr=1276x846&isbeta=5&spm-cnt=0.0.0.0.Mj3nGs&aplus&pageid=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ali_apache_id=193.138.244.231.1434155608293.716224.2&dmtrack_c={trfc_i=saf^vutlr5u3^m1jqhq39^19nl5bq76|aep_usuc_f=-}&p=1&o=winXP&b=ie6&s=1276x846&w=trident HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gj.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Sat, 13 Jun 2015 00:33:29 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=WWgCDjWxzjYCAcGK9OdXbmWQ; expires=Tue, 10-Jun-25 00:33:29 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=b51e11e5; path=/; domain=.mmstat.com

Set-Cookie: atpsida=a6ca10f6dde226707a558e02_1434155609; expires=Tue, 10-Jun-25 00:33:29 GMT; path=/; domain=.mmstat.com

Location: hXXp://pcookie.alibaba.com/app.gif?&cna=WWgCDjWxzjYCAcGK9OdXbmWQ

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache

GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server: Tengine..Date: Sat, 13 Jun 2015 00:33:29 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=WWgCDjWxzjYCAcGK9OdXbmWQ; expires=Tue, 10-Jun-25 00:33:29 GMT; path=/; domain=.mmstat.com..Set-Cookie: sca=b51e11e5; path=/; domain=.mmstat.com..Set-Cookie: atpsida=a6ca10f6dde226707a558e02_1434155609; expires=Tue, 10-Jun-25 00:33:29 GMT; path=/; domain=.mmstat.com..Location: hXXp://pcookie.alibaba.com/app.gif?&cna=WWgCDjWxzjYCAcGK9OdXbmWQ..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /app.gif?&cna=WWgCDjWxzjYCAcGK9OdXbmWQ HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pcookie.alibaba.com

HTTP/1.1 200 OK

Server: Tengine

Date: Sat, 13 Jun 2015 00:33:30 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=WWgCDjWxzjYCAcGK9OdXbmWQ; expires=Tue, 10-Jun-25 00:33:30 GMT; path=/; domain=.alibaba.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Tengine..Date: Sat, 13 Jun 2015 00:33:30 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=WWgCDjWxzjYCAcGK9OdXbmWQ; expires=Tue, 10-Jun-25 00:33:30 GMT; path=/; domain=.alibaba.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /ajaxMemberLevelTag.do?event=getMemberLevel&callback=jQuery183069035179626267_1434155618577&_=1434155620218 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: profile.alibaba.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Sat, 13 Jun 2015 00:33:31 GMT

Content-Type: application/javascript;charset=utf-8

Content-Length: 80

Connection: keep-alive

P3P: CP="CAO PSA OUR"

Cache-Control: no-cache

Content-Language: en-US

jQuery183069035179626267_1434155618577({"resultCode":1,"tagType":"memberLevel"})HTTP/1.1 200 OK..Server: Tengine..Date: Sat, 13 Jun 2015 00:33:31 GMT..Content-Type: application/javascript;charset=utf-8..Content-Length: 80..Connection: keep-alive..P3P: CP="CAO PSA OUR"..Cache-Control: no-cache..Content-Language: en-US..jQuery183069035179626267_1434155618577({"resultCode":1,"tagType":"memberLevel"})..

HEAD /8c/JFileManagerSetup.exe HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: 146.185.26.220

Content-Length: 0

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 13 Jun 2015 00:33:24 GMT

Content-Type: application/octet-stream

Content-Length: 2229214

Last-Modified: Thu, 15 Jan 2015 17:44:21 GMT

Connection: keep-alive

ETag: "54b7fc75-2203de"

Accept-Ranges: bytes

GET /js/6v/atom/??atom-sc.js?t=6453147c_104cacc3f2 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Last-Modified: Thu, 11 Jun 2015 01:46:48 GMT

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Content-Length: 17825

Timing-Allow-Origin: *

Cache-Control: max-age=31367725

Expires: Fri, 10 Jun 2016 01:48:54 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

...........}i{.F.._.0Z.0[.(;..(..CI.8q.c2Y..BdS.M.4.........h...dg...$..F.]]WWU_....".....W.ez-.......v..v!;."../..$Y:.E2..(.;.4..I......N..6..AU.*.......".`....fn~....`.L.....$.a.....\g...a.x. .?M.\~..."..Y......a82p...T..i.M....h.?.4J..."..a...rx.y.-0)....8...^........"..$.%T;...~...X..%.........K...Z.$E.*.....Tf.B&i.. ..P.5t,q:.j.......<......y.f.-....{{fD.....z....;..Q..d.>.........?[S.E....A.Jo...H...%7I//.C.y.q.:y.:O...3......0L(....mg.l....[V.n..K.U.Y..d.......r.Y$.J*W.p"..p..;<;.....y.9......k..)...'bx....q.#..b......d.eF.uO`.|;!?>..w.g.f#;.@...3..8...L..>....3S.]......e/..^..e.Lw*o..7...7...5..v.U..3.[.\.$O...q5..7....0./.xx:..U.'.Z...b.w..=.QU.2....b...4. ..x.....-.....w......Qp". ..$:..Q.....H4..A.&. ..`...G...H`..e.. ..%l..[..eO>...jc.. rBe...2.=.y.A.....F....].n>XB...3..zm.Usu................m.O..nK.c...f.-..}~.}Ft =..8}. D.....O....O..x.%..qcOX.~_...0{.C...\..H'0...M..@.#.ze..`....`.|...f.q....g......&i...^,=]!<...<?.g.q.-L&. .....4.z"...T...(O6.2wD...r.....0..'....Bw!Q|.".~...:.i.D..I....?......O..L.....bQ..7{|Q.C..n6.....$.:.L.G...5t..P. .6...-.V..Ble.K.. .4I..fk.....F._........ez..h..aM8(q..?L.d\.W....j.\K.:A...]..p.....u.........Ha..-.{yz.....*`yt......Q...........W.^..x......O..z..wLrL...M..G_O......d....$.....Z.W..a....i.e......3...a^.m...Mx.3..-.Vc,....G.I....*...._.r..W...X"....;..~...K.....a...V.hz.......QV....&..E..O(..7..'.........?..4..`.#..(2@..vq.F9..,XoU..U..........#.....`..d.....N..s."....oXY.D.....O..1g.oE.8M..N...f........[5^x.AW'.Z.....1.....1.....l\.

<<< skipped >>>

GET /js/6v/lib/gallery/??jquery/jquery.js,es5-safe/es5-safe.js,json/json.js?t=db4c592b_0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 35636

Last-Modified: Tue, 23 Dec 2014 06:30:42 GMT

Content-Encoding: gzip

Timing-Allow-Origin: *

Cache-Control: max-age=16697321

Expires: Wed, 23 Dec 2015 06:42:10 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

...........}.{.F..."b...lQ......s...d&...I2..."A.1.0.(Y....._Uw.qP.{....q4.....n...z._../..o..6)"...6..iY...Q.J...x4...x...*......|...H...w|...TRU.&..V....2.....<...).:..W...?...m.3....t...l...".m...JT.<.I.-.#......_.$x..aV...d.=.....Q..o.dTnVi....."...i6..g.@U{[..x...!]....:>NFY.H..o..?....[.U|...Q.lV.<..S...s/.U.W.]R......E.....EU....J.4.S..../.....7..G=*.....zU.M...,..e.*q{...v..&........b2,.W.*) ..&..M\....|..............#.\.s.P...j.'....3;..e^..Q..%<1.:.Z.(nGi.z......5.W~2.fA0..*....t......H3.s..M.m/.|....>...N.m.....n7H0.$..........95...."?J".{|w...?q.|.57 .../.c......0R...... ..xM0B... .....hN...Tb[J...^ ....*4...:...U....".....1iRSZ.|.#[..*!.....`\E..`.A..i.^.E|...<:...s...M>..~.v^.2.\."...U>..i.?/.k....L.}.J.0...F.$..n..kz..7~`W!......;?...g.g.o..o.5..L.f..x.I..KjnA.(.......f....n....A....M\...k.`.9.}.RU...";;P...T..mT..[..s.%.OVI...Tc.X%*...=..3..m..":Si.%\.'m\\..b8.n..Q.XP3.B.i1..9c.:/......h6....G....C...;.7#.i[%qa.hy|.y..*....:i.k=..e.4.Uk"lzE[%gl.M.......QNU._... .={...Q..l....T.../Wy.x$.2)r|L H]XS..a.U...)..!.$.6....k....@......vU..I.....h...sE.q.....D..A.2OLC....Mh..x. .G7.F?q....ME.K3..C]._.z.V.,.E..h0...w... \.{,d....z.|....5w..k..8....k."o..=..&......B[..&2..x.Z..h......{.p.Z GcM.Kg....?.\ g...l{^o........q4..i.W).$...........G\zr...o.4..e.5........8....yI;Jy...r|..L...{..@..iV.. .uu.?.8..,"j.$...........|\..y .?-g.. .1......".Ly.ja;...?@..c..H.....i..p.t.SQ... .H.*..B.l..'$...B.._.S.......`O.......zHkuh..o..............K....EBa|_..M.t.....|.W7.u..?S..|v.gD=.../..P.

<<< skipped >>>

GET /simg/sprites/app/new-header-v4-2@1x.png?t=21312772_0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 12328

Last-Modified: Wed, 29 Apr 2015 02:46:24 GMT

ETag: 21312772_0

Timing-Allow-Origin: *

Cache-Control: max-age=27872996

Expires: Sat, 30 Apr 2016 15:03:25 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

.PNG........IHDR...X.........E.......sBIT.....O.....PLTE....................6...<.q.u....3m..f.UUU333*#.$ .."..#.............u.....f.UUU333$ ..#...................u....3m..f.UUUIII333$ ..........u.fff.f.UUU333$ ....u.....f.UUUMMM333---$ .......u.....f.UUU333$ ..&..'.u..f.UUU333.. .u.3m..f.UUU333..'.......u.3m..f.UUU333$ ..%.u..f.UUU333$ ....u....YYY.f.UUUMMM333$ ....u..q.......iiiYYY.f.UUUQQQ999333$ .....6.u.....n....3m.fffaaa.f.UUU333$ ................u....mmmiiifff]]]YYY.f.UUUQQQAAAT5.333$ ................................................................................u..r..i..e.....`..\..X.....U..P..M.....I..C.....;..8.....6..0........-<.q.......{$.}..y .~..w.....y..{..x..u..v..q..t..s.....p.yyyuuu.d.qqqmmm.`.iiifff3m..X..X.aaa]]].O.YYY.f.UUUQQQ.G.MMMIIIrB.EEEi=.AAAb<.===999677O1.333H/.---(((%$$.."K.;~....tRNS..................."""""""""""33333333333333DDDDDDDDDUUUUUUUUUffffffffffwwVVV...........................................................................................................................................................................................pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6...... .IDATx.........co_i.-.zSy.eZ....F..(.....8.G@.q.FJ]/.h.,[k...V....Z.RE.....v.m.J....X.V....F.{.I&3...f&g....I.9If....?gv;... k.....WX...X....S...;....?...r.t1..x...utl.2.t_A.a.P4...G?..^.pQ.]..._|..)\'@.m.TW......>`..7^.;RKO.%T...E...c..Y..cO.W......_|..._.C.,*UgG..6..x...8m....f.*..."..9.=......wj^-Q.C...N.Z.h.;o..3..8...*.M%....O..j.w51..BR...u...[gL.I.O..I...

<<< skipped >>>

GET /js/6v/??biz/list/common/top.js,biz/list/common/bottom.js,biz/aisn/ghome/categories/categories.js,biz/common/header/header-v4-sc.js,biz/common/top-reached/top-reached.js,biz/common/url/url.js,biz/common/cookie-info/cookie-info.js,biz/common/affiliate-remarketing/affiliate-remarketing.js,biz/common/umid/umid.js,biz/arcadia/premium-ppv/premium-ppv.js,lib/gallery/store/store.js?t=3e3f0742a_1013aa46edc HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Fri, 12 Jun 2015 11:55:46 GMT

ETag: 3f9aa75fe_103a5ff58aa

Timing-Allow-Origin: *

Server: Tengine

Content-Type: application/javascript

Content-Length: 21655

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Cache-Control: max-age=18

Expires: Sat, 13 Jun 2015 00:33:48 GMT

Date: Sat, 13 Jun 2015 00:33:30 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

...........}k{...._...LV ..$...W.d[...%..e-_....@..E.n...6m..f{...l....m...u....}........6.m....3.....(.v...Z..3g..9...3gf..[..VU1....bo..,6\.U..q.]...C.*U%.ZMq..T..-3..-.R-.\f...84.....(...v.KNh...$!n:#..#U}o...w.>6-s..Z.MG....Pt.....wG6...?.k.-..9....*.(q%.[1..j(.....G.B5[..T..e<.fb..mb.....).bM#.L% .Y%.-...*.....j..q......h1O..H.].z#.j[..rm.^'v. ...j...x.R..$..r.n0@5........1-..j..U......wt.N\../..2...Z..)Y.........*.....L............e.s.~...f..........|%3.'.Lq..).s. .. f.....he\%5M...c......6|..8Fr.\S .T>.Q...z.V.$.4.&......L.0Z.*....k..........~..1...i.Z..d.X..ZWw....SJ.T.dM.TIF..E ..R.3UlX.&.{.M$"...m.n..'%...%%.'.../).. ...I.9.. .KN.i................vqf~.lea~e..21OB....(.d.?m{f..H$..RbU.u.f..;..p.............R.*.Z.8.....H*@N ...t.f..>..g...V)TsE..H.....:{.......Y.,.W....P........Zm|.2VT.jd,n..[E...7.RLb..."....3.1......'...h.. 86....@..J=..a.o...h&[..P.2^..l.D.gY..c`...1...B&.W....y.[^..e.j..(tO..j.d.......Z........c...{'.pq..Sr.P)....L......*n..a..D...L.2.........e.Pq=..ch..#..).....$?)YGA.D...w.... ))G.....R.(@.2TR2.!K1>"e3]........... .. .[.....?..#/.7....q.6q.b..~.1.....n5ZS......Bn.P.z....^K..!r.f0...wvtWm$..U...-....b.._'.6Q.&...T.V..'..fW...5;...V....-7...*......|.T*....6.......:.h.........|...<.\.V.6*....F...^..D?l....]Y....h..N...\.....3....<..q....h.c.B..d...H..c..0...2 .&&.M.#x.}..3W.&s.i..R.?.h.HA...D.a.Z..\.. %.R.........Y.$.y..Y.xqni....!'.. H{...(..-....@^`.l....J...`...!|.>....p..z..]'... ....r.......A.T....e......<./9(.4M..c.=.c....`..w....d,.#b$...H.....e3....

<<< skipped >>>

GET /js/6v/??lib/arale/class/class.js,lib/arale/events/events.js,lib/arale/base/base.js,lib/arale/widget/widget.js,lib/arale/position/position.js,lib/arale/iframe-shim/iframe-shim.js,lib/arale/overlay/overlay.js,lib/arale/overlay/mask.js,lib/arale/popup/popup.js,lib/arale/templatable/templatable.js,lib/arale/dialog/dialog.js,lib/arale/cookie/cookie.js,lib/arale/placeholder/placeholder.js,lib/arale/autocomplete/autocomplete.js,lib/icbu/scroll-trigger/scroll-trigger.js,lib/icbu/dialog/dialog.js,lib/icbu/balloon/balloon.js,lib/icbu/messenger/messenger.js,lib/icbu/ghost-panel/ghost-panel.js,lib/gallery/underscore/underscore.js,lib/gallery/handlebars/handlebars.js,lib/gallery/qrcode/qrcode.js,biz/list/common/dot/dot.js,biz/list/common/title/title.js,biz/list/common/history/history.js,biz/list/common/history/log.js,biz/list/common/load/load.js,biz/list/common/gotop/gotop.js,biz/list/common/survey/survey.js,biz/list/common/qrcode/qrcode.js,biz/list/common/webatm/webatm.js,biz/common/mcms/mcms.js,biz/common/switch-language/switch-language.js,biz/common/nav/nav.js,biz/common/header/header-module-base.js,biz/common/beacon/beacon-v4-sc.js,biz/common/store-proxy/store-proxy2.js,biz/common/searchbar/searchbar-v4-sc.js?t=11df03f0f4_1971b41c7df HTTP/1.1

Accept: */*

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Last-Modified: Fri, 12 Jun 2015 02:29:55 GMT

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Timing-Allow-Origin: *

Content-Length: 104692

Timing-Allow-Origin: *

Cache-Control: max-age=31456518

Expires: Sat, 11 Jun 2016 02:28:48 GMT

Date: Sat, 13 Jun 2015 00:33:30 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

............Iw... ....p...%D.....q.\..W%Wl...b.!..P..^...Kr..lr.U:.l:''..tg.s...?.{.|.......kx].v.."..<...}...g.U4{y{.&...y....<8>...Y..f.Ut.u.....e..L..3..2.g.0..E.....-..T2....y.I<M..u~(...?.O.Q.....,*...I.........p......1.....,.<.c....m uco.L....I.V..e...l.J....|...\.i ..kU/.z.a9J?.O..-.n ..0..#?.|.(.2...MT...~.g.8/......P.3.f3.......j.wsl).u.8...M..?.q:.S...;..|...i..~......O....Oa.`.8...^z..eu..Gk.........w...YZ&.".....j....0..%....%.l..e.....<..8T.a....6{>...RD...gRx>-..Y..b....(...m.&e.G..q.Esck.z....[.p..t1.A7..\{~.......u-V....'....%Y........2....I....(=?.=-`.~.B...$c.z'.;.XuB......8P.R.....(.....0sc......0..ZO....[F/.....N.....)O.=.)/k.....o.R..M2....,n.i.z.........}..V...OX.5.....~..e...j_^....T..x...v..8.0..*.~$.V.:e..........<..$..].......xi.aFm....Y.....X.KQ.k.E.zHI:.?....{.`...@..8]=q...............y?m.....t..)%.K.....^...{@`...........>....{.]..2..=.Q..?...r.l..l.....}\"~L`....~...;....7.sT.OF..CR.o..r!o9.....p...i.O...a.D.......2..9..... ....T..OM?k.{._]..X......Z..)Z.....`..JU{-....3..l..;.......}....Yj.)@|..~.g....N 8.'.../.x!.1...#.....M=.....fa2,`.....#..:.E...:....}{.c....J.2..a.:..... 6k..}.85.........e)x.ia..^..^(,...Pm..L.Y\.-..!.>..@.Z..T,]f,.r...lD./4mB.txx...=P).}.G0...:..........<B..0........Ix.W...g....................V.........t.%@.n[;.....a.`..<....Q...|:\..F..p1..........2{.%a.)hn..'c:..3.v..n.Oiw.8...".....@..SO}..3.W&.M.<./...M>...%..~........0.. \..l..EJ..Y..xL;$......y.....]...;....../m..,\.|7.../../7.;..'..Itr.p.........9........

<<< skipped >>>

GET /simg/single/icon/loading_16x16.gif?t=30d69a7b_0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 1553

Last-Modified: Tue, 04 Nov 2014 09:34:41 GMT

ETag: 30d69a7b_0

Timing-Allow-Origin: *

Cache-Control: max-age=12500623

Expires: Wed, 04 Nov 2015 16:57:13 GMT

Date: Sat, 13 Jun 2015 00:33:30 GMT

Connection: keep-alive

Timing-Allow-Origin: *

GIF89a............................wwwfffUUUDDD333""".........................................................!..NETSCAPE2.0.....!.......,..........w $B..$..B.#..#..(<L.....3.....D....H$^..@....Pd..."U...P#..a..\;....1.....o.::0.v.@..$|,3......._#.....d..5..3.".s5..e!.!.......,..........c $.....9*"#......8.3.b.4..k..B.....J....`4...<..q8...B...._..sDP@U......d..Z.....f*.i.".(.)..VY..#!.!.......,..........` $.Pa.......K*:...u.....#.@tX....!&0<..U#'.....h..m.'.@Y..^h.a-k..(.........N......|$.C..f)@.f|!.!.......,..........b $.bA...@."&..-..".*6C.......*... `j..4..2`. 5...X......p......h/H..`......h....R"..]SW.B].~....(!.!.......,..........I $..q.........B.,.n[.h......*.G...U.....H.)8..G.tJ.^S.@....-*Dm.....T.....!.......,..........q $..0.(...q.....k.......7A.G..d....(1....0.....d...X...`U..eR!.P...T..h .(....v!_"PQ.V.e..Y..i)..Z.`x#..'3y.|)..!.!.......,..........` $.. ..8.E...I....F0C......T@..F.`.B4........A....b.Z.bq........ ............)/a.zSS...&.V...p$!.!.......,..........^ $B.8."1.......0.....B...R.0..v..".B....lp....Xb....F...a....AA&*X....(@.3....,...(.}..Q >..R!.!.......,..........c $.P...xB. . *.-[.d..... .i@...)`..L..?'I`.JG....b.P....h......X....B.)0.....X..Q#..}...N.o."tI ZI!.!.......,..........\ $.P`.....8.....*.....1.....h..0.r.x8..B......Qa......V. ....!.M.D.l!..4.%..B...Be..PDY0..0!.!.......,..........] $.$.........I>.Q........].. .d".2..8..G.qH9...A.2.......B..."., D..H('...4...C.\0..`.UL".r(!.!.......,..........d $.dI..`....k....B...B ...m.....A.72,....(P..X..........8@R%.a..K..*..

<<< skipped >>>

GET /js/6v/biz/common/security-umscript/??um.js?t=9d044bd6_0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 4274

Last-Modified: Tue, 28 Apr 2015 10:31:13 GMT

Content-Encoding: gzip

Cache-Control: max-age=27742566

Expires: Fri, 29 Apr 2016 02:49:37 GMT

Date: Sat, 13 Jun 2015 00:33:31 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

...........Z.s.F.. ....!.....@.U."o.%?*.f.G3..............}=...I...T]..1====.=...^.......E.[..y..E.'n....!w.PL....qd....r.K'I.<...1...F.m.....H..Cr.....'.&.sk..7...4..5N..sf.\z....I......'.;%>......E...3...^..F.......ag`F...i...r. "..,....."..2.....z.z...E........%../.D.?.\.._D....."^.s.H!|.A."..~*...|*...ydy*....3......2'...t|...U.HE..^./.Y.d...r.N.;f?...... .G..>...[... {.<'..".2.C....s/.S.g}{.....9..y.."...G=....^....u.f....!'.o....QD?y.gX {l.-......~.3...........ZK...K._...0....A/.Y.....K.4..dn......$.|n.>;..m`.A.zz.X....0..........E..p..e}vc_.c...,.En....,...bfJ'.r./^...5.S.......j.[..E.c.NRd......3..Q.x.R...:%Y.t|g.....br......Hew0,..k..`S>.7.m...4?......:0{.x.....S~.........N.k9.....M.....q.$.:Pe..D{S...=.{..q...rk#i.Va>....n....V|z/.-.R...0.0........s...t....Z......m....E..`.(.|...zq.So.Y...................s!.v{.8...E.sw. Yc0.'.c.......:......m.5......3.W..&.....?.....!.7.d3..K;..l..........'c.....v.=....[.k.....d......_yK.\...........".t..._.T..M.E.5...E..l..x0.F6.-8...h......dp.9U.Iy.[.]{K.L.m.h.q.Q(".....`x........O.....\..w..&5...@m..,.:....Y5..U...^:...T$...H.5H..|.p9n;....Vy9.9..;ST[b:.[...=R..C.......d.KN'.7....u.{R......T*.....r.e...t...t"%...H.....?...c.2o....^...C....!.....zc..Q.a0{h....j......X...k.W;o........2.\...4.J..#ckiKnQV..... ..(z...d...J..^....I......G......wc{~..l.....v....f.... ..t2uT.W....;...v.a"$...r0.d..A(.(.{.."...........W..N..p.........2..#......c.. ...9.. ..l<...P.....w.1r<...r;..=........yzY.:>...d.ktr.E.5y.!...N..fm.;`d.1.M.<..}.l.4?4.~.!.

<<< skipped >>>

GET /js/6v/biz/common/webatm-new/webatm.js?t=fbcc9a5f_88ad028d78 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Last-Modified: Fri, 05 Jun 2015 10:27:11 GMT

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Content-Length: 49656

Timing-Allow-Origin: *

Cache-Control: max-age=30880468

Expires: Sat, 04 Jun 2016 10:28:02 GMT

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

............{.#.q .U..,.j....].".&....."..j.9....Y.@........H....,.V.W.|......Z..,y$...=.=.._.".UY@....I..dk..|FFFFFDFF..a............h...q.......K.n.;v..b ...n.rc/...0..V.u.^<...Y3........dsV.M;.OM..hn.l..{...{.?wN...W...\.M.....Y~.;).......7.vj[.vg...$....`..`<...w{...x..9Z..6....F....:uRIv.(...4.di.(/.J'tdZ..`.y.vP...:?.<D.....8V7...e#O.....o...........#.._h.F....k{k.-{xB.F........zQQ.Q..YF^e@....xY.Y.XY.....).Xf/.DsI.....K.....g.............u-F..f...7N.L...T...`J.!mQ..f4 rv`.........c.._.TD.v..!.....k..zj#0....]..b.s.j...7.3....g.[..J.\..W*.I.p].uu<.....$x....!..(k.......gt#.c..ON(f.x.8N[O...O .....e"...n..I.......EY.....".0........-.{.Lv..[w.7......{.]F.........,.3.;.vau..n.rEd...................y...&9e..4"z..L/.H....P.*#"..3T...Y7.D..ka.$..WQ.Y....`...o.E{~.vl{.D...m.6..?.9clB....ER...`K>..NR......<=..>. ...=......]...-....tcj..!kb4........DR...i..v......F.-..=.R.........z}.P..c....Z....z...X0C..D.H$.>H.P}..../.................;..yxP.WK.l..A...f...........e..T ..RL.........C.. ..._~.....G?.;.=.Y........O......?...<../A...X.....B..?..g..oX.....X."K..0.N..v.b/?..g_......_.......................eH_a..y.w.E..........~.@.j2V.`.........O.s.J.KPl.?..s,............f".:.S...e......2..<.`.O.X......~.W/...._...............[...#...3..m .Ax.....'...............m.K..c.....k.................;......=,..A....b...Q..6s..F9.4G/..b..p.....2...._4`......~;.w..<....`..~LC...XS=7n...A..Y..D....XYh.(...8....r4..p.. ..Q.W....j..?...Q..R?.......h......:.2....w..<?.....Yp.U..A........s(..h.._....

<<< skipped >>>

GET /js/6v/??lib/icbu/menu-tree/menu-tree.js,lib/icbu/uploader/uploader.js,lib/icbu/dragdrop/draggable.js,biz/common/drag-paste-widget/drag-paste-widget.js?t=2e3641163_1d539836ca HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 18684

Last-Modified: Thu, 30 Apr 2015 13:37:25 GMT

Content-Encoding: gzip

Timing-Allow-Origin: *

Cache-Control: max-age=28046073

Expires: Mon, 02 May 2016 15:08:07 GMT

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

...........}.v.F...H.y2...)[....ql..3v.....(j...%. ..@.j....RU..BQJ....tN[`....... ....q..._...U...eQ,.......^.G.`..&.....$(.4.-..H'i..\<...=........M.9g8.gQ........}...&...<L.."....ix..g.2..kn..Z.. ...f...-.?PjT.O..........j5.,...I..9. J?.....O..........Rx.&E..p.`..l.......Appp.Pm....Wy:}~...88..,|........u4......M...........A....7......i...,.>.....cX... R..E......c............>~......-.......[FY..n..^.P%.H...U..5U...8n...}.........5.....8...O.....M29).b.g.\.e..T.7.....;- .d.......K...he...i0......P...*.,.k.p..`..P[}Zn...?......{....,).....z.."L...[X.p....FgnP.Y...xo.e....e..9L5....,K3...L.<..8.7Q\."..Y...i^X.2.=...5..n&.Q<....!..u.K.^.. UL.....B.S5.9,{...]\..0.'....#h ......n.......[.[..t..3o.ey..%..1......QW....:*&.........Z....#.......s<Z./....K%.......4...a....%..l...Q.K.\.....-.]....$.......Gk7....S....z.r.f.m).7.d`..Q...o.<J`...O.pn.d.;?..wf.m..qn......!~.....1...F.......S'..e...%gj.."^.}..!W..{..X....d[..X..Z...N7.r..B.....@E....k%D.....`..(...M..X......\.49....1 Vk.%..(9m.V6T..^I8......Y..DHv.dg....._t...Y.....~.8L.R...#...../.,....{..D..y.`9{.b.;.9..r...."P..0.(...Q>.:.....-.]:.0.C.#.&...Vk...iOb..........D.(......ZW..mi..loow).(..O..8&Jv............E.*0<U.........._.......5..%...."....1QW?54......ko/...mg{.J9...ZQTQ..X.I.qU..8...Hh..I......8...._...v.............-...D...v.......v..zx......q.K.0..yT..qT....&..%n...T.25>.E...#c.Z...4R...1tp.. j..'..X.]L?./...t.....K..[.[.c[....OLY"....F....KN.g..4?..S.>[;.v.F.e.CM...J/.=.......0....MQ...]me......PA.X..'.E.z..8-S.<

<<< skipped >>>

GET /css/6v/run/common/webatm-new/webatm.css?t=0_102dc101ea HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Last-Modified: Thu, 30 Apr 2015 11:11:19 GMT

Content-Encoding: gzip

Content-Length: 6999

Timing-Allow-Origin: *

Cache-Control: max-age=27961177

Expires: Sun, 01 May 2016 15:33:11 GMT

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

...........=....r...`13.V.,.... ..a_.......Eu.#K.$Ow.1_p......7...W.."%...L6....$...b.X7..........*.5.P.....<m...0.~w.......>.: ...}....rK..5......e..C..*.-.[5..*..w.(......w5.(.......K.3...e.U.ss..m..x....,%.p.>.....S....=./i.....-.....GM.o|.}Q.>i=.P./{t.tWW.2..w{......h.~gSG........#.....y..O.^.lv......p....5*........7.Ze^....:.uP.4?7.%.Lva...X.._."'...y....A .T.W.Q}...p6.(......,L....=.G.....-:... Y..{.^.Ia_....f... ..c...)......3.:.d....}.[..)~......;.fP.....y....).H..N(M......!,.>.....M8.....,..A.-.......7)..Nw.Y.A..y......cu./......n~F.....m....!<.4.......O......O.._.. ..7L.$h....P...l.0.fE.-l.y?&9LGC./..!....t.(0..d ........R....u.....b..=..-..2.......@R|.j.f.S."...6.1m...CC......(.S.7.2N*.......\......(...!...>h#t.#...9...s.!.........."K7uc.?!....q-q.....\7.P.3t.Z{y2.|B5......^.'RF:.....o5L.0!.WX@/..N.......I.o./...A.N.08....{.h4.. '..)...q(........tT." .e.w...K.4.E.....'....O.N&.6>. .&.m.['.......A.`|..m.i9.......?Y...s.:&....{7P...}:.-A.0.......?.}>........tj..`n....."..k.....v(...GC.eM.P.^.Y.r..8x@.I...u..C...>4.........D.%~. :o..hnO.....WI........Q.j|.....6.......4.K..M.].i.d.M.T.d..R)..H......?-.^.a..c.sY.\8...3.....!.:<..\......._=....(*"..M....=@u]=...}OS.......w.A[......u......{!..X.^.E.......<.....pP..o.,S...As..tzzd...jf..u.x/.........l&......v...i..'...8.b">.0..H>96A..DPn.;..].n.........Tq...x.c~.......Q[...~..?....<LV..|.,...f..<....W.zd?..G...........*....[3.C...n'P..1U.Y..m].....e...../.~..E..u.q...Y....q.....[.ks...".[..t..U....p h..&.[./.s.

<<< skipped >>>

GET /simg/sprites/env/webatm/common.png?t=ad99287c_0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 3565

Last-Modified: Tue, 28 Apr 2015 07:34:58 GMT

ETag: ad99287c_0

Timing-Allow-Origin: *

Cache-Control: max-age=27600010

Expires: Wed, 27 Apr 2016 11:13:44 GMT

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Timing-Allow-Origin: *

.PNG........IHDR.......q.....f..N....tEXtSoftware.Adobe ImageReadyq.e<....PLTE........"......Z......./.ND...........{...Q..|...gN...Iw....2}.y........9...............|........).......g......J5..................C....I..s.m.t........8j."Y...2...}}}K...........R..............h..........hg................I.....is.....2.....{.......x... }....=......X.=..6....................................H3...............L...........F...7%4...>=.......93W..*`...8....,'...p..............V.............................=....g........Y...............[........*f.....{e...A...........HH.......@.....U..JF....7........Y.........../...!!VVV......Ma................uuu...........W.........kkk...q..............U..^............................................2...........=r....O...~.............8.....<..h.....a..'o.*y.7{.E..E.. s.C}..a....................................f.....tRNS................................................................................................................................................................................................................................................................S..%...wIDATx...yT.....Q. .*R.2Jt.Y.EF....QA.as)E....c.i4.. j...S......Q....#.f\cLB....i...i.&-4I..~...k<... .{..{.......w.C%...2.(..N.. ...qx.3.h..h-..h..=.L-L.......d..e.....J%i.H2.....I...3...g*sc`.3).)gj,..s.)....i..v.v....K3..t.kPF.e._6}..]...d..>.....N..R...d..I.;@t.... ...{.d...R.].....&...6..m...*g.RKc`.3..)g..d..hH..\....Y............)..].2.(..2.(..2.(..}Y.gu.q.QF.e.QFYO.5}RA...e.QF.e.QF.e=F.f..

<<< skipped >>>

GET /b.jpg?cD17MX0mdT17L29mZmVyLmFsaWJhYmEuY29tL2V4Y2x1c2l2ZS5odG1sP2FscHNtPXRydWUmc21zPXN1Z2ludGVyJnNtY29uPXAmdHY9MyZpbXA9NWIxYW9yMTlubDVicTc2bTNoaiZ4cD1MdmdNdXo3U3hWQlNPOG04cExOT0g3YTMxYmVEcVlXZW0wNUFwbFhvbGd2akQwOTdUSW9OWk9vZU5LS2J0S0Fhc3R5bjR0ZG9FX21HLU83ZnBxYTJpQ3d4dDVxY2NBaXJCeE1RQkZQbnRMNCZwaWQ9MzEzMjc1JnRkPVByb3BlbGxlcmFkcyZjdj0xNDcwMDEmYWZmX2lkPTE4MjQ2MzYxOCZjdD0xJnNpemU9MDAwXzAwMCZjbj1VQSZhbj0xMDAwMDAwMDQ2MDAxJmJtPWNwYSZ0cDE9NjUzNTIxNTAxNTEmc3JjPXNhZn0mbT17R0VUfSZzPXsyMDB9JnI9e2h0dHA6Ly9vbmNsaWNrYWRzLm5ldC9hZnUucGhwP3pvbmVpZD0zMTMyNzV9JmE9ey19JmI9ey19JmM9e3RyZmNfaT1zYWZednV0bHI1dTNebTFqcWhxMzleMTlubDVicTc2fGFlcF91c3VjX2Y9LX0=&pageid=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&sys=ie6.0|windowsXP|1276*846|en-us&ver=40&time=1434155618687 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dmtracking2.alibaba.com

Connection: Keep-Alive

Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; xman_us_f=x_l=0; xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; acs_

HTTP/1.1 200 OK

Date: Sat, 13 Jun 2015 00:33:29 GMT

Server: Apache/2.2.22 (Unix) aliTracking(for apache2.x)/2.1 mod_ssl/2.2.22 OpenSSL/0.9.8x

Set-Cookie: ali_beacon_id=193.138.244.231.143415561055.341443.0; path=/; domain=.alibaba.com; expires=Fri, 20-Mar-2026 12:00:00 GMT

Last-Modified: Wed, 12 Mar 2014 08:22:58 GMT

ETag: "d000d9-0-4f4648b4f9c80"

Accept-Ranges: bytes

Content-Length: 0

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Connection: close

Content-Type: image/jpeg

GET /notification.do?callback=jQuery183069035179626267_1434155618578&_=1434155620249 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: notification.alibaba.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Sat, 13 Jun 2015 00:33:31 GMT

Content-Type: text/html;charset=UTF-8

Content-Length: 0

Connection: keep-alive

Set-Cookie: JSESSIONID=BV1AilYA4YXbPY1StnUUAM1n; Path=/

P3P: CP="CAO PSA OUR"

Set-Cookie: ali_apache_track=""; Domain=.alibaba.com; Expires=Thu, 01-Jul-2083 03:47:38 GMT; Path=/

Set-Cookie: ali_apache_tracktmp=""; Domain=.alibaba.com; Path=/

Content-Language: en-US

HTTP/1.1 200 OK..Server: Tengine..Date: Sat, 13 Jun 2015 00:33:31 GMT..Content-Type: text/html;charset=UTF-8..Content-Length: 0..Connection: keep-alive..Set-Cookie: JSESSIONID=BV1AilYA4YXbPY1StnUUAM1n; Path=/..P3P: CP="CAO PSA OUR"..Set-Cookie: ali_apache_track=""; Domain=.alibaba.com; Expires=Thu, 01-Jul-2083 03:47:38 GMT; Path=/..Set-Cookie: ali_apache_tracktmp=""; Domain=.alibaba.com; Path=/..Content-Language: en-US..

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/i-download.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Sat, 13 Jun 2015 00:33:24 GMT

ETag: "54fdc5af-cfd"

Last-Modified: Mon, 09 Mar 2015 16:09:19 GMT

Server: nginx

Content-Length: 3325

Connection: keep-alive

.PNG........IHDR...*...*........[....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:11EB63A0AE0011E4A9FEBA77EDE0B7A3" xmpMM:DocumentID="xmp.did:11EB63A1AE0011E4A9FEBA77EDE0B7A3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:11EB639EAE0011E4A9FEBA77EDE0B7A3" stRef:documentID="xmp.did:11EB639FAE0011E4A9FEBA77EDE0B7A3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......oIDATx..Y{l.G......l..qvb...WS......UTH..*.._.....BH...U.V!JKyH-.(.....M.".....)i.. .vI.4q...............q^........nvg.......L.......#r].z./.r/o.......8...C.z0.,.Z...6.>....}......V...k.......#{..3.p*..Rq...q.T...L..H....lh..D"..3X...s.X(...^4.3]...l...sW....x}.&xU{..)......l@.....;<. .........(.......L..].`..Y........~sxK..u...I8..Fd.......z3.l5...$?[....9]....6.......J..R..K..k4...7.....s...#..IrLQ.....|.(/....\.X..\U..uG...=........)P.k=...V/...d............fP.b!...'l. ......L.c...._y.h.....oJ.#....|..y..s~.lf.....m..$TZ.Jza...-|..,..H....1..9..[....{..F.93..B..n..U.....:..

<<< skipped >>>

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-bar.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Sat, 13 Jun 2015 00:33:24 GMT

ETag: "54fdc5b3-cc6"

Last-Modified: Mon, 09 Mar 2015 16:09:23 GMT

Server: nginx

Content-Length: 3270

Connection: keep-alive

.PNG........IHDR...|.........L.......pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

GET /__maxpower__/render_screen/2014/10/e8150ca4-4ae4-11e4-be98-06a3579b0dab/screen_variation=f_link HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Sat, 13 Jun 2015 00:33:26 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 600

Connection: keep-alive

.....<div class="finish">..<h1>........%mapp% Setup Wizard.......</h1>..<p style="margin-top: 15px; font-size: 13px;">You have succesfully installed the software below and they are ready to be used:</p>....<div class="items">...<ul>....<li class="check">%mapp%</li>......</ul>..</div>....<div class="clear"></div>....<p>Recommended offers:</p>......<div class="list-toolbars" id="alloffers">....<ul class="_FinishOffers">....</ul>...</div>...........<input id="_Bexit" class="_Bexit close absol" tabindex="2" type="submit" name="nombre" onclick='onExit()' value="Close">....</div>......

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/bullet-short.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/gif

Date: Sat, 13 Jun 2015 00:33:26 GMT

ETag: "54fdc5ab-36"

Last-Modified: Mon, 09 Mar 2015 16:09:15 GMT

Server: nginx

Content-Length: 54

Connection: keep-alive

GIF89a.............!.......,...................P..U..;HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: image/gif..Date: Sat, 13 Jun 2015 00:33:26 GMT..ETag: "54fdc5ab-36"..Last-Modified: Mon, 09 Mar 2015 16:09:15 GMT..Server: nginx..Content-Length: 54..Connection: keep-alive..GIF89a.............!.......,...................P..U..;..

GET /afu.php?zoneid=313275 HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: onclickads.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 13 Jun 2015 00:33:27 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Pragma: no-cache

Cache-Control: private, max-age=0, no-cache

Expires: Mon, 26 Jul 1997 05:00:00 GMT

P3P: CP="CUR ADM OUR NOR STA NID"

Set-Cookie: OAGEO57b51=2|UA|63|KHARKIV|61000|?|BROADBAND|IP-COM LTD||15610|25314|?; expires=Sun, 14-Jun-2015 00:33:27 GMT; path=/

Set-Cookie: OAID=4e669e2bd6717936b5e499a170ec68e5; expires=Sun, 12-Jun-2016 00:33:27 GMT; path=/

Content-Encoding: gzip

392.............U[..6.~....0.&.!.2)a*.......S.!I c...n.N2....1.&..ZMQb.\.s......gL.r .L...Ru$.... ...(......HJXD.......i..u&)d.......\.....{,..) .5......$.4....l....,.....bY.....d....`...J..2....8.Z.dY*!...=./b.....$.#....R.0.g2....`7.).).....P...x...|...A..]g.pg..1...q...]..sZ....d..}{|Ue...-...H........az.y....0 .B..Y.E......o.Rk.[..D........D..^..u....q.HJ.....h..Q...Z...]Z..].{......Q...*..._.L....=..{...=<. .Uj.k....(.....l....z9."..j.Q.......H)O1.aY..?.c$$(.5g.DX..M.o..."..F.......j;z%/YN|"..k./...(....*...c.........a6....kz....75V.`U........wC.r..~.g..../R.,.}..H...5kO....[..1e`.....l.g,M.....3_]....w ....e..W}F.3..l..w5..I_...z.1....d8'..<.~..,.#........@.@g......n..H]wY.....zs.x.cF\..._...n.....` jN..........I/w...5cD..j.h"c.o1..q...5P;V.2E.b>.Z1h.....B..._.}.7q?..C##1..Cp.U{.v(R...e.VG${v....D.B........T.......6..^.]..._y... ]...B....k.. .*..9.WX....6...?p...eE.mj...6.....<,.....A..y'.....^c.......0......

GET /?r=/mb/han&zoneid=313275&pbk2=aed4aed7aec61aea2427c1373066bf8d6159651431394916656&saved_referer=&adparams=bm9qcz0w&a=1256&b=693 HTTP/1.1

Referer: hXXp://onclickads.net/afu.php?zoneid=313275

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: onclickads.net

Connection: Keep-Alive

Cookie: OAGEO57b51=2|UA|63|KHARKIV|61000|?|BROADBAND|IP-COM LTD||15610|25314|?; OAID=4e669e2bd6717936b5e499a170ec68e5

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Sat, 13 Jun 2015 00:33:27 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Pragma: no-cache

Cache-Control: private, max-age=0, no-cache

Expires: Mon, 26 Jul 1997 05:00:00 GMT

P3P: CP="CUR ADM OUR NOR STA NID"

Set-Cookie: OAGEO57b51=2|UA|63|KHARKIV|61000|?|BROADBAND|IP-COM LTD||15610|25314|?; expires=Sun, 14-Jun-2015 00:33:27 GMT; path=/

Set-Cookie: ppucnt=1; expires=Sun, 14-Jun-2015 00:33:27 GMT; path=/

Set-Cookie: OAID=4e669e2bd6717936b5e499a170ec68e5; expires=Sun, 12-Jun-2016 00:33:27 GMT; path=/

Set-Cookie: _OACCAP[45384]=1; expires=Sun, 12-Jun-2016 00:33:27 GMT; path=/

Set-Cookie: _OACBLOCK[45384]=1434155607; expires=Mon, 13-Jul-2015 00:33:27 GMT; path=/

Location: hXXp://click.alibaba.com/rd/vutlr5u3?pid=313275&tp1=65352150151&cv=147001&cn=UA

0..HTTP/1.1 302 Moved Temporarily..Server: nginx..Date: Sat, 13 Jun 2015 00:33:27 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Pragma: no-cache..Cache-Control: private, max-age=0, no-cache..Expires: Mon, 26 Jul 1997 05:00:00 GMT..P3P: CP="CUR ADM OUR NOR STA NID"..Set-Cookie: OAGEO57b51=2|UA|63|KHARKIV|61000|?|BROADBAND|IP-COM LTD||15610|25314|?; expires=Sun, 14-Jun-2015 00:33:27 GMT; path=/..Set-Cookie: ppucnt=1; expires=Sun, 14-Jun-2015 00:33:27 GMT; path=/..Set-Cookie: OAID=4e669e2bd6717936b5e499a170ec68e5; expires=Sun, 12-Jun-2016 00:33:27 GMT; path=/..Set-Cookie: _OACCAP[45384]=1; expires=Sun, 12-Jun-2016 00:33:27 GMT; path=/..Set-Cookie: _OACBLOCK[45384]=1434155607; expires=Mon, 13-Jul-2015 00:33:27 GMT; path=/..Location: hXXp://click.alibaba.com/rd/vutlr5u3?pid=313275&tp1=65352150151&cv=147001&cn=UA..0..

<<< skipped >>>

GET /__maxpower__/render_template/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab?language_code=en HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Sat, 13 Jun 2015 00:33:22 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 2152

Connection: keep-alive

...<div class="link-v2">.<div class="container">.. <div class="minimize">. <ul>. <li><span id="_Bminimize" onclick="minimizeWindow();" class="button-min">-</span></li>. <li><span id="_Bexit" onclick="onExit()" class="button-min">x</span></li>. </ul>.</div>..<div class="icon-image">.</div>..<div id="_frameContainer" class="content">.. ..</div>....<div class="buttons">.. . . <input id="_Bnext" class="_Bnext green right" buttonText="Next" tabindex="0" type="submit" value="Next" onclick='onAccept();'>. .. .. . <input id="_Bomit" class="_Bomit normal-close leftnowidth" tabindex="3" type="submit" name="nombre" value="Skip All" onclick='onOmit();'>. . . <input id="_Bdecline" class="_Bdecline normal-close leftnowidth" tabindex="1" type="submit" name="nombre" value="Decline" onclick='onDecline();'>. .. <div class="clear"></div>.</div>.. ..<div class="contact">. <div class="contact-in" style="height: 20px;">.. <ul>. <li><a target='_blank' class="first _TitPrivacy">Privacy Policy</a></li>. <li><a target='_blank' class="_TitSetup">Setup info</a></li>. <li><a target='_blank' class="_TitFree">Why is this free?</a></li>. <li>&l

<<< skipped >>>

GET /__maxpower__/render_screen/2014/11/d1187d84-6a69-11e4-b052-06a3579b0dab/screen_variation=I_link HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Sat, 13 Jun 2015 00:33:22 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 953

Connection: keep-alive

....<div class="install">.. <h1>Installation Progress</h1>. . <p>This Download Manager will minimize to your system tray shortly to allow you to work on other items while your selections install. To restore this window, simply click on the icon in your system tray.</p>. . <div class="install-loading">. </div>. <div class="progress-bar">. <div class="_TotalProgressLevel progress-level" ></div> . </div>....<div class="clear" style="height:10px; display:block;"></div>. <div class="_ProgressInstallingText" style="display:none; text-align: center; margin-left: 45px; width: 422px;"><p>Installing ...</p></div>. . <div class="_ProgressText" style="display:none; margin-left: 33px;">. <p>Process: <span class="_ProgressTextDownloaded"></span> of <span class="_ProgressTextTotal"></span> (<span class="_ProgressTextPercentage"></span> %)</p>. </div>.. . .</div>.HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Language: en..Content-Type: text/html; charset=utf-8..Date: Sat, 13 Jun 2015 00:33:22 GMT..Server: nginx..Vary: Accept-Language..Content-Length: 953..Connection: keep-alive......<div class="install">.. <h1>Installation Progress</h1>. . <p>This Download Manager will minimize to your system tray shortly to

<<< skipped >>>

GET /css/6v/??run/arcadia/landing-page/lp-layout-premium-market.css,run/list/common/default.css,run/arcadia/landing-page/lp-category-list.css,run/arcadia/category/categories-home.css,apollo/mod/header/header-v4-sc.css,run/common/top-reached/top-reached.css,apollo/mod/footer/footer-v4-sc.css?t=1839ef62e_22db2c054f HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Last-Modified: Fri, 12 Jun 2015 02:59:04 GMT

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Content-Length: 51117

Timing-Allow-Origin: *

Cache-Control: max-age=31458240

Expires: Sat, 11 Jun 2016 02:57:29 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

............g....%...j4..1.....h.....tj.(...pj2. .......ff...../.u......W..k...@.=..9,.t.q ....~....m.}..{8.e....p......e.5...m...k..s.~._C?...~].. ...!...k..i........q.|m/.~V......FEZ...=..wNK.c....}.f....C..m...U....R......oZ}......b_.g..M...".&.../{.?.|.._...?.................9...G..e?..m.....v..............Q......a-.2*.r>./.$I..Y.....I.~._~.0.F.......s.B.,..../...?..._.............m~....0I.....~L..z...Q]._.k...<..aR-..-A..._.|......%)./....>..x.Rfc.._..K..)./.............K?._.1..~..h...c....K.1../q.._....d....R......z..$.....4_..KV.M2....../M.][.4O..K8..../.T~....L..a....<........R$....,.0....~...i.|...r..>.OK{Y........4.7.}.~_vE:...k..U.|..2....)m.p.i..K._T.?.:...e....<^._.....'........{?.KR....5....q......._.....8...~F....w.._..G..}3....*..........l....|4...5...$..6l~...K^.SS.! ?J..@........7k....3..;|w...O...........g...cK....._.cH........w.o.>.._F..G.a..^......[.}.@........O...g.|..........z....V.C?.a7.4............XN~..x.Dl?..O..........G..a.O... ................7D.>J/.H..1?.../3.?......~y.t...........\u._~7..u.u....Q...-...J...kU.c...G.u...).n.aM?~..n..O..WG.'.Na;|...m....}._.._SW"g?......._.2....._.....Hp.....V\...s.....?..V... v...hL.....OW)..}.2]9....d.............O.G.}?.M8.k....G...._...C.......%.....C....~_ ~.#...X..n.?....?~V....1...S......?]...o.....,2^A.;.....t....&.....:..7.....G...x.>?..}............./......;..._.\....o....l...qe..._....e......?.y....f..*.....N?...@....9Z..t_.nX. ...z.a..@....5.V....?../m...Y./...2.........).:..e.^.oF.$...B...?.................~...

<<< skipped >>>

GET /simg/sprites/env/aisn/ghome/ghome.png?t=4e09143a_0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 40369

Last-Modified: Mon, 05 Jan 2015 05:45:07 GMT

ETag: 4e09143a_0

Timing-Allow-Origin: *

Cache-Control: max-age=20395264

Expires: Thu, 04 Feb 2016 01:54:33 GMT

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Timing-Allow-Origin: *

.PNG........IHDR..............8......tEXtSoftware.Adobe ImageReadyq.e<...niTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:52EA6E036007E411B5E6D95C327E2CAD" xmpMM:DocumentID="xmp.did:1BF2668E869711E4A36CF4A1632FB7B3" xmpMM:InstanceID="xmp.iid:1BF2668D869711E4A36CF4A1632FB7B3" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:847a23ac-2119-0044-b527-1ce00237277e" stRef:documentID="xmp.did:52EA6E036007E411B5E6D95C327E2CAD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>{.......IDATx....|ee}?..&....d....A."BY.......?.....!Zq_.....Rm]&.].j.....B..APA.qAd..(...f.f.....=....$..!..~.....{....sc:.<yN..8=?..........%.........%5...*_....H}.Y..............Q..M.`..;.......{..W<>.........:m.}QZ.....LKJ.....#..Vy../T..?......R...........2{F.. .........H.....m.[ScJ.....M!.;..;..x..S...Hm....F~.ys..1.3\....N.O..o........u.....i%.p?'5......XOiNk..iI...k.....P.]...Sm...q.N/...}.zlU....\..3g.H.{.<..%.....t.WR.......x....id.C.@I.9.i..w.4.G..6..."=.Y_7..j......w\=.b...f..y..T.84<j}.....

<<< skipped >>>

GET /js/6v/biz/common/lazyload-images/lazyload-images.js?t=ba5caa31_6b5144d34 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: style.aliunicorn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Fri, 12 Jun 2015 10:52:19 GMT

ETag: fefb22b5_620209b94

Server: Tengine

Content-Type: application/javascript

Content-Length: 613

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Timing-Allow-Origin: *

Cache-Control: max-age=21

Expires: Sat, 13 Jun 2015 00:33:51 GMT

Date: Sat, 13 Jun 2015 00:33:30 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

...........T.n.0.....CD.............@.2R.P.BRB...^ZRj;..i{.......,....Z*J.}S..=.....]...n$.D.J(..j.Z*F.Pm.ie.S.(&s....;..8W.#._..5.J...g.........jCI^7R.~%.R..K.Ch4{..<..?.|.:....7..K....g[\..g1M...G.....Ib....K....K.ed......h....F......$b.I.....3-.e.W.*..2....5D7'..h.....WV.....8.I)...*..$..di....o..`...^h...x;.....y.....9....}q...qb..:...Z.m]ov....V........%.......N..B.8...A...X.2.#....._\..m/......5. .?s..&0}.zj..I@.Nn<.$.Ot...7x.O;.#j.-..z.X........[D@..o.(....A....9....zs"....@....~@...="...^,.Q.....'p..N!.q..s4.#...n\......44j...t......S....^[W.Nik....L.?...(@.-..c3........dvJX.U.s(....s.D......?.w...HTTP/1.1 200 OK..Last-Modified: Fri, 12 Jun 2015 10:52:19 GMT..ETag: fefb22b5_620209b94..Server: Tengine..Content-Type: application/javascript..Content-Length: 613..Access-Control-Allow-Origin: *..Content-Encoding: gzip..Timing-Allow-Origin: *..Cache-Control: max-age=21..Expires: Sat, 13 Jun 2015 00:33:51 GMT..Date: Sat, 13 Jun 2015 00:33:30 GMT..Connection: keep-alive..Vary: Accept-Encoding..Timing-Allow-Origin: *.............T.n.0.....CD.............@.2R.P.BRB...^ZRj;..i{.......,....Z*J.}S..=.....]...n$.D.J(..j.Z*F.Pm.ie.S.(&s....;..8W.#._..5.J...g.........jCI^7R.~%.R..K.Ch4{..<..?.|.:....7..K....g[\..g1M...G.....Ib....K....K.ed......h....F......$b.I.....3-.e.W.*..2....5D7'..h.....WV.....8.I)...*..$..di....o..`...^h...x;.....y.....9....}q...qb..:...Z.m]ov....V........%.......N..B.8...A...X.2.#....._\..m/......5. .?s..&0}.zj..I@.Nn<.$.Ot...7x.O;.#j.-..z.X........[D@..o.(....A....9....zs"....@....~

<<< skipped >>>

GET /event/common.html?id=17769&st_page_id=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ver=40&time=1434155618687 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.alibaba.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 13 Jun 2015 00:33:29 GMT

Server: Apache

Last-Modified: Thu, 25 Dec 2014 09:24:05 GMT

ETag: "50b06f82d9740"

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

X-XSS-protection: 1;mode=block

Content-Length: 20

Connection: close

Content-Type: text/html

......................

GET /simg/sprites/env/aisn/survey-grey.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i02.i.aliimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 14 Jun 2015 03:21:30 GMT

Last-Modified: Tue, 08 Jan 2013 02:58:18 GMT

Cache-Control: max-age=172800

Timing-Allow-Origin: *

SERVED-FROM: 212.30.134.195

Server: Tengine

Content-Type: image/png

Content-Length: 1733

Accept-Ranges: bytes

Date: Sat, 13 Jun 2015 00:33:34 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

.PNG........IHDR...0...b.....!..I....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:C90BDB4257B011E284E08882507217AF" xmpMM:DocumentID="xmp.did:C90BDB4357B011E284E08882507217AF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C90BDB4057B011E284E08882507217AF" stRef:documentID="xmp.did:C90BDB4157B011E284E08882507217AF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..W-....PLTE...................................................................................................................................................................................................................................................7.K....QtRNS.................................................................................h.......IDATx...is.0..w.ZT..h...........}.._...^(...:........aC...b.Jf%,.pc...|9G.3..g..........S....*...I.&.....^..%B.....#7R$...F\..&S....%%..!.M.......q. ...s.."A..vb.w...W...!c..p.....v;.rDA........P.T..g,..G{..3V....o9...@...iB..#~s..1...*...._....

<<< skipped >>>

GET /js/beacon_en.js HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alibaba.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 13 Jun 2015 00:36:42 GMT

Last-Modified: Wed, 20 May 2015 06:42:43 GMT

Cache-Control: max-age=1800

Timing-Allow-Origin: *

Server: Tengine

Content-Type: application/javascript

Content-Length: 15309

Accept-Ranges: bytes

Content-Encoding: gzip

Date: Sat, 13 Jun 2015 00:33:29 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *

...........}kw............F.2.g...t8~.Gl.N.$...W#...D@.l...U.....v..97k.H.Ruuu..Qvg:.. ..=...._t.5.N.!..c....q...,......'.[...n.bv..j3.X..X.....d7..5_..*6.r;...j..76f........G'G........^.yl1.k....vX.0......65......<vX.Qnb._..Idw.l.S...>.|.w[...O|L.[9 .Z.9A..#.v..0.#z...|r.[...U.L..Q..r."......X.@m...?..c..o......C..A..x......z..Y.t..#H.o..y..c......?....M]......z....C....o.......[.\...2s.w.x..:.c?...Kl.....3..q..~.q...@=.zc..N..B/.DC>..>.....]..c....|4.">...~../L'.x......E.......(/....v^.....A..[K*.A.......@....4.n.,.......l .k..nG0..i.....=p.8.b.............}....Q....f..^8....t.............J(>.L..F...=.Y..Rg.Kn.2B......"..x...S..G<......e..,...XX...n..v..=`...m.:...G .........c..af,....V.......t...qkK..'.Q`..z.......G.k5..W.b.5:,....c%.f.,..G~.P.`.N.'B@..."s..0.V...49...I.Q...WE.q..4_:E..".6.<B.&{o..r.X..,.........0....Q..q...B~....b|g.*W.E...........Y;d.........x}o..BkI@...)|.........64...R..0..4!..H}).....EW8pt...r....-....=.x...tC..m.3f=>J..\Z....vcs..t^@..;......wo...F....Nss...~eg..Y....=.D..vp."..k4.....9A..=...m.U...r<..........ld&x.q8......q`$t.5w.........m&.#....A...f.....=..7A..a..n&f..K0...k/.& ....De>l...........h.?..V(M2e..D....}5..d...w..........^..0........~a..l...../... 9..@..g...%..F........[..^"oZ..K..f...@.V........n.}m|..>M....I...b..d..8W.y{4.._..q.....[@.....Z.7(..n....T.j....'...@...g..K....hE..s...^\..XiG....._..)..U.(.(@b.....y{...........).,......\ ...PW.e.b0.@....P[. .. w..`..I.....-..c..z.I8...|..\..w..._l.)T.....-.....O....e-..#...VW.(.i,g...P...

<<< skipped >>>

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/loading-install.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/gif

Date: Sat, 13 Jun 2015 00:33:24 GMT

ETag: "54fdc5b0-1644"

Last-Modified: Mon, 09 Mar 2015 16:09:20 GMT

Server: nginx

Content-Length: 5700

Connection: keep-alive

GIF89a..........|~|...DFD......$"$dbd............424trt......\Z\..................LNLljl...<><.........LJL......,.,dfd............464|z|.....................................................................!..NETSCAPE2.0.....!.......,...........@.pHTA...rB..#....B*...@..$...u8.5....&.0.cX6..~-.ka..J0. ..*.'. B."*B... ,0..NB...0.".)%S.....q%.)!.&D.$..q....W..c.}D.....q$...../...q0......**.*..0...I..W&h..$.K.#.0.-.$..IL....L$*h.Z\.a.....T. q......-.....z.$<..D...L..H.g... ....1.Bn)....M..~*.M.......-....!.......,............|~|...DFD......,.,...dfd..................TVT......464...trt............|z|.........LNL......424...............\Z\......<:<...tvt..............................................................@.pH.QB... ..E....A*...CX.>;..P. -\P)....]YiW.._?..0..DJ..*..z.% .B%.-,g..#C#''.. . .S!.-.o.) .'.C..-.b...(b(.W.*I.*...o,....."".".o.........b....,I..J.nI#.".b....D.*...W........%g.NB#.\.x..@.=%..X`l....P..p....[....$...!D.x.g.$..F.S(fc.!(..$.a....&."I.C...W...!.......,............|~|...DBD......\^\..................TRTljl.........,.,...............LJL...trt............dfd$"$...............\Z\lnl.........424............LNL.................................................pH..&.........0#b)..J....>.....,b..B.A...G.*....TD.".T!.....{1./[1.""(g..$C$.-1./0.)S,.".Vb)..."N..Uo.0.*b..b$.I.,...oO......"."..1. ...........rD.o..J$..J....C....I# . ....g..1...1..J..!$.....x@.!....8|@q...-..8.`.Y.Q.2......7.s1..f...."LX/..'...@.... .!.......,............|~|...DFD......dbd$&$.........trt...424...

<<< skipped >>>

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-level.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Sat, 13 Jun 2015 00:33:24 GMT

ETag: "54fdc5b5-10c6"

Last-Modified: Mon, 09 Mar 2015 16:09:25 GMT

Server: nginx

Content-Length: 4294

Connection: keep-alive

<<< skipped >>>

GET /d5/msjava.dll HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: static.api.magnodownload.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/octet-stream

Date: Sat, 13 Jun 2015 00:33:14 GMT

ETag: "54ef0d1b-e5910"

Last-Modified: Thu, 26 Feb 2015 12:10:03 GMT

Server: nginx

Content-Length: 940304

Connection: keep-alive

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....C8...........#...............................k................................m...............................`#..te...........................................................................................................................text............................... ..`.data...d"......."..................@....rsrc...............................@..@.reloc..............................@..B4.D8@...0[.8M..... 8W...4.D8a...4.D8l...6.D8y...5.D8............KERNEL32.dll.NTDLL.DLL.GDI32.dll.USER32.dll.ADVAPI32.dll.OLEAUT32.dll.ole32.dll......................................................................................................................................................................................................................................................................................................................................................... ...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /sc/fpc.html?cna=WWgCDjWxzjYCAcGK9OdXbmWQ&pageid=c18af4e7ac14ac7e557b7a5814dea56116f24cff8f&ali_beacon_id=193.138.244.231.143415561055.341443.0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.alibaba.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 13 Jun 2015 00:33:31 GMT

Server: Apache

Last-Modified: Thu, 25 Dec 2014 09:24:05 GMT

ETag: "50b06f82d9740"

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

X-XSS-protection: 1;mode=block

Content-Length: 20

Connection: close

Content-Type: text/html

......................

GET /rd/vutlr5u3?pid=313275&tp1=65352150151&cv=147001&cn=UA HTTP/1.1

Referer: hXXp://onclickads.net/afu.php?zoneid=313275

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: click.alibaba.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Date: Sat, 13 Jun 2015 00:33:28 GMT

Content-Type: text/html;charset=UTF-8

Content-Length: 0

Connection: keep-alive

Set-Cookie: ali_apache_id=193.138.244.231.1434155608293.716224.2; path=/; domain=.alibaba.com; expires=Wed, 30-Nov-2084 01:01:01 GMT

Server: Apache-Coyote/1.1

Set-Cookie: JSESSIONID=8ldqHRwDVc9nJIMjERGGru7D; Path=/

P3P: CP="CAO PSA OUR"

Set-Cookie: ali_apache_track=""; Domain=.alibaba.com; Expires=Thu, 01-Jul-2083 03:47:35 GMT; Path=/

Set-Cookie: ali_apache_tracktmp=""; Domain=.alibaba.com; Path=/

Set-Cookie: xman_us_f=x_l=0; Domain=.alibaba.com; Expires=Thu, 01-Jul-2083 03:47:35 GMT; Path=/

Set-Cookie: xman_t=EmHlsOvc3ylN F4r JkXlE0VjW8eWN8PtDPEpnpDmEtSFMbCkJTb6v7oNe9Bv1LV; Domain=.alibaba.com; Path=/; HttpOnly

Set-Cookie: acs_usuc_t=acs_rt=065e622978cb4604801167fab6004ed7; Domain=.alibaba.com; Path=/

Set-Cookie: acs_t=PrO2qDo0fkn5bovjQNA5fDwb/rJYAdMFQxa5xJTatrLwlZr5Awv2gsWiv0a0l1tg; Domain=.alibaba.com; Path=/; HttpOnly

Set-Cookie: xman_f=b4hTZFNrgKoy5zRK56QTW65Z7NqkNbkYp4 c4o81HsFIr sNRq5vqACP7gT4tAa7Lzb9gq1vqkWVz2UB WbU01M3tU5bZUXls59Ibyc4uu0nd99LbrkZpw==; Domain=.alibaba.com; Expires=Thu, 01-Jul-2083 03:47:35 GMT; Path=/; HttpOnly

Location: hXXp://offer.alibaba.com/exclusive.html?alpsm=true&sms=suginter&smcon=p&tv=3&imp=5b1aor19nl5bq76m3hj&xp=LvgMuz7SxVBSO8m8pLNOH7a31beDqYWem05AplXolgvjD097TIoNZOoeNKKbtKAastyn4tdoE_mG-O7fpqa2iCwxt5qccAirBxMQBFPntL4&pid=313275&td=Propellerads&cv=147001&aff_id=182463618&ct=1&size=000_000&cn=UA&an=1000000046001&bm=cpa&tp1=65352150151&src=saf

Content-Language: zh-CN

<<< skipped >>>

GET /BesH3gE9/pop-up/ HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Language: en

Content-Type: text/html

Date: Sat, 13 Jun 2015 00:33:24 GMT

Server: nginx

Set-Cookie: lpsl_BesH3gE9=85428d98eda3bc5299dc163e7c082a0d 1434242004; Path=/; Expires=Sun, 14-Jun-15 00:33:24 GMT;Domain=VVV.magnodownload.com

Vary: Accept-Language

Content-Length: 1074

Connection: keep-alive

...........Vmo.6..._...$'.h.q.&9.....l..b....%*.#.*I.q....%..[...a.......y.2........}.f*M...?....a..?.....o.._..o..4.X.L.*..M.y..Fx.T> d.\:.......A.4.......".P.xdx....$.......W../...0../B..D. .V9..bO....VV...|L.\0...0I..$q..h9s.G..<G..F.l.?A..;..}`.......R..L.h.O)}.x..Y.i..<%..t....a............H.....v...hR.|..l..#..v.>.z}..|;:d.-.E0RT<0...dI...=.T...m.~.._.P.......*.X.....I....^......f..x..k.).){...(...T....`F..L....{e..wb..Ie......=..#.....x'w.7W..;cA.J.....Jx@...\p...........^."."^0...z....-..I.....Z7$d.....s...........h....H.....%...\..C.Z.SP....q.....E..un.>L....:0....946.K. .,.{...F..m-.i.3.Ex....g..8..?.4..T.(..#.f..L}...s.u...u...Lx..u.%.{..".9.0..G.......Q.J.8...e................f.H2.,..X..d@sf-c8...........&....ou..gb..0v.....:.Yo..[....i:..14M.j.w....#......G............o....{.....Y...#[..q...NY......Q....Q r[...u;-<4Jw`H..D.lL<dP.H..f...\e..yu..&3..mB2.._M.=8.>A...;..T._N.M%l|y..{.... ..[...V..pC>(..o...%.R/.f......pI../'P...>.H..P..r..6.n8...VVTd...V..\;zBWSc.s.. ..w..o_..{..P..e....f ......" ...4.B{Rr...C.._"<....S.../,.......^.o/D.P#. (...|.......

GET /lpresources/js/linkv2.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=85428d98eda3bc5299dc163e7c082a0d 1434242004

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Type: application/javascript

Date: Sat, 13 Jun 2015 00:33:24 GMT

ETag: "280056-d84-4feef24b01140"

Last-Modified: Thu, 24 Jul 2014 11:56:13 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 1358

Connection: keep-alive

...........WYo.8.~..`.ELV.|...q. M.........AIT,D...r....;$E.Ns 0,..|srf.Ty$."G.4..L...[&.T........B;.Q^......}..a...?.c.&h6.N..P...\.... 5.S..9......5.)..R..xQ.1Vb.......V.A........>:J..@yY.w)..:.[....w4.....Q.e..".\..!)..h.^......;..M......n....P.>....^ zBQ...Y.kq^e...L0.."...c...R..7Y..Jd..1pc....BO82.......l.r&"Z.....B!y..Z......i...?....9..5..gED.. .|T.=Qf.....\.V..O..C../x....M..l..z.."W.B.a..rh..,...'.?...?.L...c.N......5.A.."...u*..........?\..2W..q.......h..mb`Y.1...k..i.w.8K.;.3.,e.e......2T..FtS..K......7"..,*e.&.e.W.%v......=.L.....\.'.{......D9.U...s.-... ..JD..U.0pHqwV..;8Y5A....G.........T/.?~.w..A.aI...\i.}P.@k%<.G.7......%u2..0.....3.(.H%.......P?1x:n...=.:...m...v2..w.....Go..tj.(-7.K. =Y.4.>.........7.(.w.q ... i..Lt/.....W.....T...)..W.."Y...`..%..,...........tW..8.C.A2.,8(...j..../.B...x.S..u..X....f..=..U8......vLc. f...h@..A' E..A3.....t......-.yhZ)..6.`....o%.........'.Y...u...c..&....... .Q.9.....Vm.mW...h..W...C.w............'...r.(.t).j......L...9.j.Uc...QBa9 ..3gPJ.WJ.]xj..!M.<....U......_.....K!0...Ea..F...J=..`.6R.a..V..,cj . ..W..h.i........T....T_.l[.....i.u..VL.u.AE..CR..n...l......y..}...1..5.................O...`'.MW8c...|.. x...{.t..........}_...^..&...?[..9Y|...g.-..._.....h.G~.....i1...b.....&.:.j..9.g.]B]..}..K>......{.7.aNqtMWD.6.0g.......0..z...PghuR7..}..f.y./.p-.%T.n.......xN.j.[.Q......h}e.........

<<< skipped >>>

GET /lpresources/js/ainj.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=85428d98eda3bc5299dc163e7c082a0d 1434242004

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Type: application/javascript

Date: Sat, 13 Jun 2015 00:33:25 GMT

ETag: "28004c-0-4f9c38966d780"

Last-Modified: Mon, 19 May 2014 16:48:46 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 20

Connection: keep-alive

........................

GET /lpresources/js/dlStoragev1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=85428d98eda3bc5299dc163e7c082a0d 1434242004

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Encoding: gzip

Content-Type: application/javascript

Date: Sat, 13 Jun 2015 00:33:25 GMT

ETag: "180b8a-1a57-50572ea11d0c0"

Last-Modified: Wed, 15 Oct 2014 09:39:55 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 2010

Connection: keep-alive

...........X[o...~v~...H:q..X,...]d..]t/i.A..b.P.(.F.]..c....!.....p.......\...K.Y..P.......b..c.........\3 J..2o-e.*!.....Ur....S>..(..^....Z ...i..Z...Z.^.(b.}&.....O.$.:.:.....c{D........K.,.....WH.{C..}....2 n..Q..~[$p.1..C/<8.....EZ:_..'..@/.#...ud,K.T....J....i|....3=.....N.!.nY@g....~...~j..i..jj..m.D;l.94.h.$A..9..n.Vp?.X.O..&....".......mch....'L..[m...m...XfR......G9(.....BVq....\....G..1....V[.............%....H<...m..O.~.&...-...f...V..@.iV@....[.. .fZ8Ie...Z..%Zdy...s..@.T..B.2.~-..X?[O.Y.i{.K: L.....D......-......... .k.......r.6..... v.5X..l.O..F...9..-.O.....5^.L.i..<Ip..O.....~...,...>.2/...H.R .v..2....R*}:....X.......p2i..b..^.......tW.y...).'....H.......E.).Bx].......p.....9.c]...V....w..(. $D..uc..\.&OFv.2.>%.yf..!B.V4.)...~k..db...Z.......}.....&..^...{cGzV.V...yv:..^....vQ..`.@....f...ix........h*!-.l9L...1...@L...6{h./.HpF.).T......i.......3u.'...fK..j.OY.;!3 .N.'Fw1.....7..W..}"..n.ax[,y.%.. .......X%wf. .O...s...'...g7..9'y.V..y.\O..3...,.-....H.q..........AM..;..L.8B`.3.......X.J.0..m....)1..b-.w...j.!..oi...f..R'......-U]8.y. 0.*....0J..M...@.&.}..............IR<...G.J.)I...G.......l.....I.sU....I..}{8...."HQ.....- #..........Q.TL.%"^.h=..cX.r.7.{,......o#,.Ho...*.i...A..*...........2..mh{Ws.3.3.:..N.-...C#WV.[..I.c.J..`...{8....Dw.....x.................../.E_Cl7?....C<....a..Qg.V.p.....\.=.......w?.9.qno..%o....'..z..s(..)......p.v...}kw..*a.T.1...5.S.K]*......58....B..O$M.C.`.............a.h.q...0... jV.....C. IS.].......8_.l..h.....mP.6j....b.1...~.e...DV..

<<< skipped >>>

GET /mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.magnodownload.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.magnodownload.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=85428d98eda3bc5299dc163e7c082a0d 1434242004

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/javascript

Date: Sat, 13 Jun 2015 00:33:25 GMT

ETag: "53a84f60-1762a"

Last-Modified: Mon, 23 Jun 2014 16:01:36 GMT

Server: nginx

Content-Length: 95786

Connection: keep-alive

/*! jQuery v1.11.1 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.1",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0] |[\s\uFEFF\xA0] $/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushStack(d.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.length,c= a (0>a?b:0);return this.pushStack(c>=0&&b>c?[this[c]]:[])},end:function(){return this.prevObject||this.constructor(null)},push:f,sort:c.sort,splice:c.splice},m.extend=m.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]||{},h=1,i=arguments.length,j=!1;for("boolean"==typeof g&&(j=g,g=arguments[h]||{},h ),"object"==typeof g||m.

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_928:

.text

`.rsrc

@t-9}

NSSh:

FV<.tn>

j.hXES

J!"#$J%J&'()*J ,JJJJJJJJ-J.JJ/0J1JJJJJJJJJJJJJJJJJJ23JJ4567JJ8JJJJJ9:;JJJJJ?JJJJJJJJ@JJJJJJAJJJJJBJJCJJJJJJJJJJJDEJJJJJJJFJGJJJJJJJJJJJJHJI

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlexcept.h

HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0

kernel32.dll

%System%\drivers\vmmouse.sys

%System%\drivers\vmhgfs.sys

%System%\drivers\VBoxMouse.sys

sbiedll.dll

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xdebug

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\streambuf

SELECT * FROM Win32_BIOS WHERE Manufacturer LIKE '%XEN%')

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\cstringt.h

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocale

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xiosbase

Software\Microsoft\Windows\CurrentVersion\Uninstall

Software\Classes\ProcMon.Logfile.1\shell\open\command

IsWindowsServer

hXXps://ssl.google-analytics.com/collect?

IOTTTTTT[dosx#,,45;BEHQRZ]gnp}'68BHMV]]lo{,44BMS^dghn}(78BCHQY\]`ilqqu".09?AKXZ]aadqy ".19@@OOOT^jy{|!7CLMVZelnu$(6;FUbprry| :BMQVWdefgrw'5CMN[_jy"05@AGTT``gs!%(37

HQXXXXXX^jkquwz$&3@MSU^^myCJXgoq /099

O]`iiiiimx$*/2>CRTXYchjt""'-5CEFTapqty|!

BBFPPPPPWbdddsu"&DFOV\hnq}$$.5BKY[anpw

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocnum

BHKXXXXXbqxxx%-4ACDKOZZipz}.5DO\\gr ((.7EJYY``ijpy !"016;?MR]gprr!$02;DDEIIJLXYapx}!08

GSSYYYYYffllz(128GRTapstz)))5AOT]^`ekv{$.=AMTcpw'6

JQTTTTTT_hp #'5DJQ]afu} ! -2=?KKSSW_kmtz}%/6=>LR]eep{{"%'*066ERV`fnx!$'/18CPS_ekot!,-68;FGMRVcrt%(69ET

CRUXXXXX`jsv#13ACDHVdoy#-9GGVVValu}}#9DEPU[iqtx /7CCKPS\gv!'.=CQ[fjpp

GGLUUUUU[glyz),;CCRVddoy" 2?@EP_cdfu{ ,/:>JNZco{*2>APTW

LU[``````mp}#&0?GO[`m{$1?AMSUbns{ 66@IW^ksu%,2?GUcjpt}#&(7CRTckt{##&(6?HMTVVW\es#23::IV_jy| 4ADLZalz"& 8

IVV^^^^^^bbefqzz$&) 08>FSV_ht%68DJJVerx)2@DJVbn}%* 5MO^^j

N[_aaaaaaaetzz{&*-9FN\_jxz} 78FKSSbkz(66EHLUZ\\iu|$'1@MNS^kqs!"/2AETY[]^ejox$''39CJSW[hp}.9BLLWckqq!-;CRTcghhv%0=HSW^hvzz|%%-3;BCJJUUYbq F8;;BMV_lv{#&,4CJJU[]gs#-26=@

ABDJJJJJMRZ]^emop} -6;DHIR`nov%)23;>FPQ\gu|*19BIUU^fjjt &)-0:?DDNR```dklz(7BERVVbim{)7BJX^cggu6CLNQZes},.14@JSU`fhks#&127CQZhp .5BKZ[aahjlvy)7;;??JLT[blv{$ 01@IUdit|

KMT_____mx!01227ABIKV^kstLIUV`nqx#(3?M

FFGGGGGGIKKNPT\hny%*2AALS[fsss!$*33>KZ\fprs ,,99;HLUdpp{!*1=KS_`jxx{{ /;

KUZbbbbbp}(4AFMYY]^_ais"& 467@AJUbgixFGM[[iqz!)039HTY`gqz$(-4BJJLUXbd

DMMZZZZZdeeep} #%(-6CGMQRXakopu}&,8EHVee

M\`ggggggorx',;>@CGKMRZ^boy%*67EITacow$$%4

NRU[[[[[]_mr#/5DS]fmp|*3AGKUV^bhrs|LJP

PQVaaaaakpy|!0=>@DLUVWcrt| 0

MNUWWWWWZ]^aiilz!0=LZdghm{! .=?NP^mr|#8GOU^fntwy|#$22=AEHT`htv}'2AFR_msy#8FISZ`nz$)2INU^immy#%.;@D

LZ]`````ju&-5CNNUUakv}**7CLUdgt"$/38=JKK

()$^.* ?[]|\-{},:=!

JWX\\\\\ajy}$ ,:GIWamz')0=GMZhs (DJPU`mor|,.2@CHRXagru{&33::?JMR`knppt#(7BHUdht$-3==DGQ_m{"'/7EJJYekt

APRRRRRRVY[^fuv '-7FRVXYfnz E6CIPSU^lww%1?DSW`nos#/4@@JV`nrzHBO^hqq

MNN\\\\\jmqu!!/008CMTZhv#-7AOO

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\locale

GGLUUUUUdmosu$/4@LP[is!,5=JLQZ_fsz$167FP_jpst$FN]kw})5BFGTYcr}*8;EFRa

FGGLLLLLNTcoy7DPQV[]giu (.55?MR]coyz'()/5@ABP]]cemnny|$$-7AHS\bhw'5=>C

invalid _N_type: %d

OQQ]]]]]]els#'))-.1@LV]^elt"LHSSY]joxy)8?EFMMUUW_nv%--HRSTW[jqrrrw!(

IIPYYYYYYht|(FRWcrss|}(7ANWdfmp||-8BGL

LLO\\\\\do{ 9EMZaeq!*49BNSS]crt%2>MTadouu%(2:>MQWZgt "'3BGTZ_ds" 28DPY_lrw& 7@EMPWelnxzF?DHT]joq}!$%3LN[`jy%4:?IP\jprt *.8ER[`giryy%( :GJU\dffopv"%*27?MO^isv%'**4?L[aox&'4?GLUVY]hou|!.5@CHM[flqu%'5ALLVdlv#'.9

PQVaaaaanvz(3

OY_mmmmmvxz$,58:BBLP^_coqxx (3445;?GLNTX]_ffflmu"-06>>MQTcpt#(3>LT_ku}'/

KNOUUUUU^mmw$..59BN]lmx'11;@BHHUdpqqz}',05=

MNQTTTTT`crt -9FFR\ajuvz#,;?ELLXetv&4CR\ap!-0019>HOWdhrr||(669@JPSZejms

JPR^^^^^fkpr $%7BHKOUYgghksw{%*001@ANRR\^ly)8;AN\`kp!-5=>APXbiv" ,6@MYZdditw{"))2:@KZcp|',14?IQS\dfrr!-7EFU^koww 8CNSU`lsx#( :CGUdp!-.8FMQRYhnz'(,2=KN[gnvw&08?MY[gt}"&44@NXapstz#/3?@CFHILWX[bp!*.33>KSbqy" 1@FR_nr *02=LV]bmv"".MUbmrs}$)4>MMPTWX[iu}''0?GHNRT[hhly} .;?@BGQZZ_hkt$)8=FJYet%,346=IV\]gv&'.7DGIOVaoy"(*3@DO[cnou" 00?DGUU`koz',-4BIKV]`jknru#$3:>BHLRWds! /3@GVVaiky"%( -59?KUYds|# ,;IJW`hny},,;CFQ\dllr|-/69=ABIXaiiw$(.67:;FLO[fuuw%0=>KKZhjx#)03?NNSTZ\jmu$17=DHKVZgiss|*.7EPP\chqx%-7;DOZ]kpz!/233?CFMVboqs!$ 39

AOQSSSSSY[fmorw$ 6CMUdips|!"(266:@GKW[bopq!/>IINS^ant!$ 69BDS\aemuvz'/16?@LOUXcq"0:GTXbiqu{ #2ADR[]jloz)456EGGUW\cq|'05?HJWZ[[ikn{{CJJR[bgv#**--6>JM[jjtvxy 4CCQZ_jyz .0?NZ^mz#*1:FSSZ[beippv!!(/:DIIIIPZ

FFGGGGGGPZbo{ 4BCHMPP_cowy)4?JM[ivyz!)2:DHOUdppy!"1?GHMTahw$,39HLLS_cr{&

ENOXXXXXdqruIDFM[et|}'5CQ__nw(,:FQSXafjwwz*9@BIJRR_inoz*/6:HLQSWccq}}$'*8DQVbhmpt"*,8DRRUVXabds#D5CM

NetBase.cpp

APRRRRRRafqx!!'6BQ\ioprs$/8LVdrx|(4?DNRS[jp|" 258?MTceht)DHHIKKSW`fkopw} .CEHIS`ioq

LTZ`````oowx{*,9HQ[`jmz|LDFP^elz))8?@KS_gls|}&4BJLN]cmsstu#1?NZZZcq!*5

URL EMPTY

"url":"

ParseUrl

/Setup.application

hXXp://

PictureEx.cpp

c:\logFile.txt

hXXp://42e546f0ea2d40afa114ea020951ec9d:9538ea5acbbe4fc6b42811c415685653@

.cpp" ,

errormsg

Error opening key.

Key not found.

CheckRegistryKeyExistance

_virtualGetStringKey

_virtualSetStringKey

_virtualSetDwordKey

_virtualcheckRegkKey

SetStringKey

CWebBrowser2

0.0.0.0

mb_00000000-0000-0000-0807-060504030201

mb_09F005AE-AC9D-4FC1-AB7A-24004F6C043A

mb_01010101-0101-0101-0101-010101010101

mb_58585858-5858-5858-5858-585858585858

mb_4c4c4544-0000-2010-8020-80c04f202020

mb_11111111-2222-3333-4444-555555555555

mb_11111111-1111-1111-1111-111111111111

mb_00020003-0004-0005-0006-000700080009

mb_890E2D14-CACD-45D1-AE66-BC80E8BFEB0F

mb_8E275844-178F-44A8-ACEB-A7D7E5178C63

mb_52309712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_DC698397-FA54-4CF2-82C8-B1B5307A6A7F

mb_61F39712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_50FB9712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_93309712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_56F49712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_07090201-0103-0301-0807-060504030201

mb_03000200-0400-0500-0006-000700080009

mb_FEFEFEFE-FEFE-FEFE-FEFE-FEFEFEFEFEFE

mb_FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_00000000-0000-0000-0000-000000000000

CNotSupportedException

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\except.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxtls_.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olemisc.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winstr.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\strcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxtempl.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\afx.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\thrdcore.cpp

m_nMsgLast =

m_msgCur = {

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxtls.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occmgr.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occdlg.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

m_pszExeName =

m_nCmdShow =

m_lpCmdLine =

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxadv.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

Warning: no message line prompt for ID 0xX.

Warning: OnUpdateKeyIndicator - unknown indicator 0xX.

Warning: scroll bars in frame windows may cause unusual behaviour.

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxpriv.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcoll.inl

CCmdTarget

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\cmdtarg.cpp

SENDING control notification %d from control id 0xX to %hs window.

SENDING command id 0xX to %hs target.

No handler for command ID 0xX, disabling it.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui1.cpp

Error: failed to load message box prompt string 0xx.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wincore.cpp

Warning: unknown WM_MEASUREITEM for menu item 0xX.

hhctrl.ocx

Implementation Warning: control notification = $%X.

Warning: not executing disabled command %d

hWnd = $X (nIDC=$X) is not a %hs.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afximpl.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winocc.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occsite.cpp

IOleInPlaceObject not supported on OLE control (dialog ID %d).

Persistence not supported on OLE control %ls.

%d. Column ordinal %d: Binding as native data type

%d. Column ordinal %d: Binding a COM object

F%d. Column ordinal %d: Binding as an IStream object

%d. Column ordinal %d: Binding as an ISequentialStream object

neither ISequentialStream nor IStream are supported!

IStream is supported

ISequentialStream is supported

Testing streams support...

%d. Column ordinal %d: Binding by reference in provider allocated, consumer owned memory

%d. Column ordinal %d: Binding length and status ONLY

Number of columns: %d

f:\dd\vctools\vc7libs\ship\atlmfc\include\atldbcli.h

Unsupported DBTYPE (%d) in column %d

$@Column %d not bound

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occcont.cpp

Error: no data exchange control with ID 0xX.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgdata.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgcore.cpp

IGNORING command id 0xX sent to %hs dialog.

Routing command id 0xX to app.

Routing command id 0xX to owner window.

Warning: Creating dialog from within a COleControlModule application is not a supported scenario.

Warning: ExecuteDlgInit failed during dialog init.

ERROR: Dialog with IDD 0xX must have the child style.

ERROR: Dialog with IDD 0xX must be invisible.

ERROR: Cannot find dialog template with IDD 0xX.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wingdi.cpp

m_ps.rcPaint =

m_ps.fErase =

m_ps.hdc =

lgpn.lopnColor =

lgpn.lopnWidth.x (width) =

lgpn.lopnStyle =

lb.lbColor =

lb.lbHatch =

lb.lbStyle =

lf.lfFaceName =

lf.lfPitchAndFamily =

lf.lfQuality =

lf.lfClipPrecision =

lf.lfOutPrecision =

lf.lfCharSet =

lf.lfStrikeOut =

lf.lfUnderline =

lf.lfItalic =

lf.lfWeight =

lf.lfOrientation =

lf.lfEscapement =

lf.lfWidth =

lf.lfHeight =

bm.bmBitsPixel =

bm.bmPlanes =

bm.bmWidthBytes =

bm.bmWidth =

bm.bmHeight =

bm.bmType =

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl1.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\elements.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleunk.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxole.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxstate.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\objcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcobj.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arccore.cpp

CHttpConnection

CHttpFile

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\inet.cpp

Unknown status: %d

Internet ctxt=%d:

Warning: throwing CInternetException for error %d

Warning: Extended error reported with no response info

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filex.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appinit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olevar.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cpp

WM_HOTKEY

WM_SETHOTKEY

WM_IDLEUPDATECMDUI

WM_DDE_EXECUTE

WM_KEYLAST

WM_SYSKEYUP

WM_SYSKEYDOWN

WM_KEYUP

WM_KEYDOWN

WM_VKEYTOITEM

WM_CTLCOLORMSGBOX

WM_USER 0xX

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxtrace.cpp

Warning: Unable to unpack WM_DDE_EXECUTE lParam lX.

Warning: failed to reclaim %d bytes for memory safety pool.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winhand.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpcont.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxcrit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occevent.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filemem.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\plex.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui3.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olelock.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winutil.cpp

Warning: Shrinking safety pool from %d to %d to satisfy request of %d bytes.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\list_p.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmenu.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wingdix.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\bartool.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_o.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcmn2.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcmn.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_b.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_w.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_d.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_p.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_pp.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_wo.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_so.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_ss.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgcomm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledisp2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleinit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcstrm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleenum.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\apphelp.cpp

Error: failed to load AfxFormatString string 0xx.

Error: illegal string index requested %d.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgtempl.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxmt.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filest.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpout.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\fixalloc.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledisp1.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olecnvrt.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olemsgf.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occlock.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olefact.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledobj2.cpp

a %hs object at $%p, %u bytes long

an invalid object at $%p, %u bytes long

faulted while dumping object at $%p, %u bytes long

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpinit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledlgs2.cpp

m_bz.hTask =

m_bz.hResource =

m_bz.lpszTemplate =

m_bz.hInstance =

m_bz.lCustData =

m_bz.lpszCaption =

m_bz.hWndOwner =

m_bz.dwFlags =

m_bz.cbStruct =

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledoc1.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\list_o.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\_tolower.c

f:\dd\vctools\crt_bld\self_x86\crt\src\locale0.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xmbtowc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\streambuf

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale

%s(%d) :

%s_%0x

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atlbase.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c

Client hook allocation failure at file %hs line %d.

Memory allocated at %hs(%d).

Client hook re-allocation failure at file %hs line %d.

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory after end of heap buffer.

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory before start of heap buffer.

CRT detected that the application wrote to a heap buffer that was freed.

crt block at 0x%p, subtype %x, %Iu bytes long.

client block at 0x%p, subtype %x, %Iu bytes long.

%hs(%d) :

#File Error#(%d) :

Data: %s

f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setvbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c

_CrtDbgReport: String too long or IO Error

Debug %s!

Program: %s%s%s%s%s%s%s%s%s%s%s%s

f:\dd\vctools\crt_bld\self_x86\crt\src\osfinfo.c

%s(%d) : %s

_CrtDbgReport: String too long or Invalid characters in String

f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initctyp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\w_env.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c

This is an unsupported way to load Visual C DLLs. You need to modify your application to build with a manifest.

- Attempt to initialize the CRT more than once.

- CRT not initialized

Please contact the application's support team for more information.

- floating point support not loaded

f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c

GetProcessWindowStation

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\drive.c

ADVAPI32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\inithelp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tzset.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\read.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stream.c

USER32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\convrtcp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\inittime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initnum.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initmon.c

portuguese-brazilian

operator

Run-Time Check Failure #%d - %s

%s%s%s%s

%s%s%p%s%ld%s%d%s

user32.dll

f:\dd\vctools\crt_bld\self_x86\crt\src\wtombenv.c

MSPDB80.DLL

RegCloseKey

RegOpenKeyExA

f:\dd\vctools\crt_bld\self_x86\crt\src\setenv.c

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appmodul.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmain.cpp

GetProcessHeap

KERNEL32.dll

SetWindowsHookExW

GetKeyState

UnhookWindowsHookEx

CreateDialogIndirectParamW

USER32.dll

RegOpenKeyExW

RegEnumKeyExW

RegQueryInfoKeyW

RegDeleteKeyW

RegCreateKeyW

RegEnumKeyW

RegOpenKeyW

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

ShellExecuteExW

ShellExecuteW

SHELL32.dll

OLEAUT32.dll

UrlUnescapeW

SHLWAPI.dll

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GDI32.dll

COMDLG32.dll

WINSPOOL.DRV

oledlg.dll

URLDownloadToFileW

urlmon.dll

dbghelp.dll

IPHLPAPI.DLL

RPCRT4.dll

OLEACC.dll

InternetCrackUrlW

InternetCanonicalizeUrlW

InternetOpenUrlW

HttpOpenRequestW

HttpSendRequestW

HttpQueryInfoW

WININET.dll

GetCPInfo

GetConsoleOutputCP

MaxCore.cpp

.?AVCCmdTarget@@

MaxCoreDlg.cpp

.?AVCWebBrowser2@@

.?AVExecuteBase@@

.?AVExecuteFacade@@

Idispimp.cpp

.PAVCFileException@@

.PAVCInternetException@@

.PAVexception@std@@

Text.cpp

.PAVCMemoryException@@

.PAVCSimpleException@@

.PAVCException@@

.PAVCObject@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.PAVCOleException@@

.?AVCNotSupportedException@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCUserException@@

.PAVCResourceException@@

.PAVCArchiveException@@

.?AVCHttpConnection@@

.?AVCHttpFile@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.PAVCOleDispatchException@@

zcÁ

v%U}@%1

.oEH'

;.CZz

o&.CqZ

.uUhUb

K.Ac#

*"9%uL2]

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xutility

AtlThrow: hr = 0x%x

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlsimpstr.h

std::_Vector_const_iterator >::operator *

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\vector

std::_Vector_const_iterator >::operator =

std::_Vector_const_iterator >::operator *

std::_Vector_const_iterator > *,class std::allocator > *> >::operator *

std::_Vector_const_iterator >::operator =

std::_Vector_const_iterator > *,class std::allocator > *> >::operator =

std::basic_string,class std::allocator >::operator []

hWarning: implicit LoadString(%u) failed

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

Windows

IsWindowsServer,

std::_Vector_const_iterator >::operator *

std::_Vector_const_iterator >::operator =

std::_Vector_const_iterator,class std::allocator >,class std::allocator,class std::allocator > > >::operator =

std::_Vector_const_iterator,class std::allocator >,class std::allocator,class std::allocator > > >::operator *

std::_Vector_const_iterator,class std::allocator >,class std::allocator,class std::allocator > > >::operator

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\ostream

std::_String_const_iterator,class std::allocator >::operator *

std::_String_const_iterator,class std::allocator >::operator

std::_Tree,class std::allocator >,0> >::const_iterator::operator ==

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xtree

std::_Tree,class std::allocator >,0> >::const_iterator::operator *

std::vector,class std::allocator >,class std::allocator,class std::allocator > > >::operator []

invalid operator

std::_Tree > >,unsigned long,struct std::less > > >,class std::allocator > > const ,unsigned long> >,0> >::const_iterator::operator ==

std::_Tree > >,class ATL::CStringT > >,struct std::less > > >,class std::allocator > > const ,class ATL::CStringT > > > >,0> >::const_iterator::operator ==

std::_Tree > >,__int64,struct std::less > > >,class std::allocator > > const ,__int64> >,0> >::const_iterator::operator ==

std::_Tree > >,unsigned long,struct std::less > > >,class std::allocator > > const ,unsigned long> >,0> >::const_iterator::operator *

std::_Tree > >,class ATL::CStringT > >,struct std::less > > >,class std::allocator > > const ,class ATL::CStringT > > > >,0> >::const_iterator::operator *

std::_Tree > >,__int64,struct std::less > > >,class std::allocator > > const ,__int64> >,0> >::const_iterator::operator *

std::_Tree > >,class ATL::CStringT > >,struct std::less > > >,class std::allocator > > const ,class ATL::CStringT > > > >,0> >::const_iterator::_Inc

std::_Tree > >,unsigned long,struct std::less > > >,class std::allocator > > const ,unsigned long> >,0> >::const_iterator::_Dec

std::_Tree > >,unsigned long,struct std::less > > >,class std::allocator > > const ,unsigned long> >,0> >::const_iterator::_Inc

std::_Tree > >,class ATL::CStringT > >,struct std::less > > >,class std::allocator > > const ,class ATL::CStringT > > > >,0> >::const_iterator::_Dec

std::_Tree > >,__int64,struct std::less > > >,class std::allocator > > const ,__int64> >,0> >::const_iterator::_Dec

std::_Tree > >,__int64,struct std::less > > >,class std::allocator > > const ,__int64> >,0> >::const_iterator::_Inc

ExtractIcon.cpp

std::list,class std::allocator >,class std::allocator,class std::allocator > > >::_Const_iterator::operator

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\list

std::list,class std::allocator >,class std::allocator,class std::allocator > > >::_Const_iterator::operator --

std::_String_const_iterator,class std::allocator >::operator --

std::_String_const_iterator,class std::allocator >::operator *

std::_String_const_iterator,class std::allocator >::operator

std::_String_const_iterator,class std::allocator >::operator =

std::_Vector_const_iterator,class std::allocator > >::operator =

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\regex

_std::_Vector_const_iterator >::operator *

std::list,class std::allocator >,class std::allocator,class std::allocator > > >::_Const_iterator::operator *

Bstd::vector,class std::allocator > >::operator []

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\algorithm

std::_Tree > >,class CWinThread *,struct std::less > > >,class std::allocator > > const ,class CWinThread *> >,0> >::const_iterator::operator ==

std::_Tree > >,class CWinThread *,struct std::less > > >,class std::allocator > > const ,class CWinThread *> >,0> >::const_iterator::operator *

std::_Tree > >,class CWinThread *,struct std::less > > >,class std::allocator > > const ,class CWinThread *> >,0> >::const_iterator::_Dec

std::_Tree > >,class CWinThread *,struct std::less > > >,class std::allocator > > const ,class CWinThread *> >,0> >::const_iterator::_Inc

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlcomcli.h

helpJavaScript.cpp

std::_Vector_const_iterator >::operator =

std::_Vector_const_iterator >::operator *

std::_Vector_const_iterator >::operator

std::vector >::operator []

E_OUTOFMEMORY FAIL URLDownloadToFile

INET_E_DOWNLOAD_FAILURE FAIL URLDownloadToFile

SUCCEEDED URLDownloadToFile

SUCCEEDED default URLDownloadToFile

default URLDownloadToFile

hXXps://

std::vector >::operator []

std::_Vector_const_iterator >::operator =

std::_Vector_const_iterator >::operator *

std::_Vector_const_iterator >::operator

ddata.exe

start.gif

std::vector >::operator []

std::_Vector_const_iterator >::operator *

std::_Vector_const_iterator >::operator

std::_Vector_const_iterator >::operator =

"sentry.interfaces.Message": {

std::_Tree,class std::allocator >,0> >::const_iterator::operator ==

std::_Tree,class std::allocator >,0> >::const_iterator::operator *

%s%s%s

SELECT * FROM Win32_OperatingSystem

_hd_%S

0mb_%S

CACHE_S_FORMATETC_NOTSUPPORTED

CO_E_SERVER_EXEC_FAILURE

MK_E_INTERMEDIATEINTERFACENOTSUPPORTED

OLE_E_ADVISENOTSUPPORTED

REGDB_E_KEYMISSING

SCACHE_E_FIRST...CACHE_E_LAST

CACHE_S_FIRST...CACHE_S_LAST

CLASSFACTORY_E_FIRST...CLASSFACTORY_E_LAST

CLASSFACTORY_S_FIRST...CLASSFACTORY_S_LAST

CLIENTSITE_E_FIRST...CLIENTSITE_E_LAST

CLIENTSITE_S_FIRST...CLIENTSITE_S_LAST

CLIPBRD_E_FIRST...CLIPBRD_E_LAST

CLIPBRD_S_FIRST...CLIPBRD_S_LAST

CONVERT10_E_FIRST...CONVERT10_E_LAST

CONVERT10_S_FIRST...CONVERT10_S_LAST

CO_E_FIRST...CO_E_LAST

CO_S_FIRST...CO_S_LAST

DATA_E_FIRST...DATA_E_LAST

DATA_S_FIRST...DATA_S_LAST

DRAGDROP_E_FIRST...DRAGDROP_E_LAST

DRAGDROP_S_FIRST...DRAGDROP_S_LAST

ENUM_E_FIRST...ENUM_E_LAST

ENUM_S_FIRST...ENUM_S_LAST

INPLACE_E_FIRST...INPLACE_E_LAST

INPLACE_S_FIRST...INPLACE_S_LAST

MARSHAL_E_FIRST...MARSHAL_E_LAST

MARSHAL_S_FIRST...MARSHAL_S_LAST

MK_E_FIRST...MK_E_LAST

MK_S_FIRST...MK_S_LAST

OLEOBJ_E_FIRST...OLEOBJ_E_LAST

OLEOBJ_S_FIRST...OLEOBJ_S_LAST

OLE_E_FIRST...OLE_E_LAST

OLE_S_FIRST...OLE_S_LAST

REGDB_E_FIRST...REGDB_E_LAST

REGDB_S_FIRST...REGDB_S_LAST

VIEW_E_FIRST...VIEW_E_LAST

VIEW_S_FIRST...VIEW_S_LAST

FACILITY_WINDOWS

severity: %s, facility: %s ($lX)

range: %s ($lX)

%s ($lX)

Warning: constructing COleException, scode = %s.

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlalloc.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomcli.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlsimpstr.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\cstringt.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlconv.h

ntdll.dll

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

%s%s.dll

%s (%s:%d)

Ff:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

Error: failed to execute DDE command '%s'.

Warning: DDE command '%s' ignored because window is disabled.

pMRU: open file (%d) '%s'.

Can't register window class named %s

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

WinHelp: pszHelpFile = '%s', dwData: $%lx, fuCommand: %d.

HtmlHelp: pszHelpFile = '%s', dwData: $%lx, fuCommand: %d.

accKeyboardShortcut

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcom.h

commctrl_DragListMsg

Hf:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Binding entry %d failed. Status: %d

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlbase.h

GetData failed - HRESULT = 0x%X

m_pColumnInfo[nColumn].ulColumnSize == sizeof(ctype)

ERROR: Dialog named '%s' must have the child style.

ERROR: Dialog named '%s' must be invisible.

ERROR: Cannot find dialog template named '%s'.

CLSID\%s

Interface\%s

mfcm90ud.dll

QueryInterface(%s) failed

QueryInterface(%s) succeeded

Hcomctl32.dll

Hcomdlg32.dll

Hshell32.dll

connecting to socket address '%s'

resolved name for %s!

resolving name for %s

Warning: destroying an open %s with handle %8.8X

Warning: Disconnecting %s handle %8.8X in context %8.8X at destruction.

IHTTP/1.0

WININET.DLL

Warning: could not get volume information '%s'.

Warning: could not parse the path '%s'. Path is too long.

Warning: could not parse the path '%s'.

CFile exception: %hs, File %s, OS error information = %ld.

AppMsg

WinMsg

CmdRouting

%s: hwnd=0xX, msg = 0xX (0xX, 0xX)

%s: hwnd=0xX, msg = %hs (0xX, 0xX)

%s: Advise item='%s', Format='%s', Ack=%d, Defer Update= %d

%s: Execute '%s'.

0xx

Warning: OleInitialize returned scode = %s.

mscoree.dll

nf:\dd\vctools\crt_bld\self_x86\crt\src\xstring

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atldebugapi.cpp

%S(%d) :

ppCategory && pfnCrtDbgReport

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlmem.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atltime.inl

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlbase.inl

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomtime.inl

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcore.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\allocate.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atltracemodulemanager.h

f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c

f:\dd\vctools\crt_bld\self_x86\crt\src\memmove_s.c

mode == _CRT_RPTHOOK_INSTALL || mode == _CRT_RPTHOOK_REMOVE

wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)

wcscpy_s(szExeName, 260, L"")

__crtMessageWindowW

f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c

_CrtCheckMemory()

_CrtIsValidHeapPointer(pUserData)

_CrtSetDbgFlag

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAYS_DF | _CRTDBG_CHECK_CRT_DF | _CRTDBG_LEAK_CHECK_DF) ) == 0)

_CrtMemCheckpoint

f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\printf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tmakepath_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tsplitpath_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\loctim64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgetc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc_nolock.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgetpos.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fsetpos.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fclose.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fread.c

f:\dd\vctools\crt_bld\self_x86\crt\src\rewind.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ftell.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strftime.c

("Invalid MBCS character sequence passed to strftime",0)

("Invalid MBCS character sequence passed into strftime",0)

f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.h

("Corrupted pointer passed to _freea", 0)

f:\dd\vctools\crt_bld\self_x86\crt\src\fprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mktime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcslwr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\atof.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wtof.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstol.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsinc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsstr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbschr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsdup.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c

T_CrtSetReportHook2

strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")

strcpy_s(szExeName, 260, "")

__crtMessageWindowA

f:\dd\vctools\crt_bld\self_x86\crt\src\fullpath.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fdopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\feoferr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fputws.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgets.c

f:\dd\vctools\crt_bld\self_x86\crt\src\clearerr.c

fMode == _CRTDBG_REPORT_MODE || (fMode & ~(_CRTDBG_MODE_FILE | _CRTDBG_MODE_DEBUG | _CRTDBG_MODE_WNDW)) == 0

_CrtSetReportMode

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c

nRptType >= 0 && nRptType

wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")

strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportA

strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")

wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportW

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[category].wlocale == NULL) && (ptloci->lc_category[category].wrefcount == NULL))

f:\dd\vctools\crt_bld\self_x86\crt\src\fputwc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetwc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgetwc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\a_cmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtod.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime64.c

KERNEL32.DLL

strcat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), rterrs[tblindx].rterrtxt)

strcat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), "\n\n")

strcpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), "Runtime Error!\n\nProgram: ")

_NMSG_WRITE

f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\typname.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c

WUSER32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c

f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\expand.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dtoxtm64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\timeset.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\commit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\write.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_freebuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ftelli64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\lseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fseeki64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\close.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_open.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stricmp.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\getcwd.c

strcpy_s(resultstr, resultsize, autofos.man)

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getqloc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbtowc.c

_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2

f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\lseeki64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\isatty.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\tran\contrlfp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_fptostr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getenv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\open.c

0 && "Only UTF-16 little endian & UTF-8 is supported for reads"

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbicm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcmp.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\x10fout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsnicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbico.c

$f:\dd\vctools\crt_bld\self_x86\crt\src\setmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicol.c

("CRT Logic error during setenv",0)

__crtsetenv

c:\%original file name%.exe

{8856F961-340A-11D0-A96B-00C04FD705A2}

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

%original file name%.exe_928_rwx_00401000_00190000: