HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Strictor.29584 (B) (Emsisoft), Gen:Variant.Strictor.29584 (AdAware), Backdoor.Win32.Farfli.FD, Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.IEDummy.FD, GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Backdoor
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a7a99907eb098fde3b5ec91c15ff1eb9
SHA1: f94f64204488ddbfac17c1d93fe75ad456b5c8b3
SHA256: d4cabe0e0390ae2cad660a4d3812accfe98f56884f4a7cc79aa479dc4b094e6b
SSDeep: 24576:ED9tl5 OzeVuDRXqYVnSbR VrKcSwV0vOVyNzKRBehm9dN3YvandAk hr7o8hM:EhfqGdVSbQNMOVsYs8dFYvanGVhr7C
Size: 2121728 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2015-03-03 22:43:52
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-PSW. Trojan program intended for stealing users passwords.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
attrib.exe:1236
attrib.exe:1840
attrib.exe:544
attrib.exe:1264
qudongrensheng.dat:1796
cacls.exe:1632
cacls.exe:1040
cacls.exe:1028
cacls.exe:940
cacls.exe:1012
The Trojan injects its code into the following process(es):
%original file name%.exe:1156
wscntmx.exe:244
Mutexes
The following mutexes were created/opened:
__DDrawCheckExclMode____DDrawExclMode__DDrawWindowListMutexDDrawDriverObjectListMutexCTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_RasPbFileShimCacheMutex
File activity
The process qudongrensheng.dat:1796 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\hao123_res.tmp (35 bytes)
The process %original file name%.exe:1156 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (13991 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\6330cf46f68cd2c7c40a422626d1cb30[1].png (362 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (753 bytes)
%System%\drivers\etc\protocol (799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\game[1].htm (16716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2014052276129177[1].gif (832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\binglang[1].png (2149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\941pojie[1].htm (438 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.lszwg[2].txt (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\daosu[1].jpg (17388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\soso.hcjd56[1].htm (1201 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2014052276129177[1].gif (832 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\daofeng[1].png (1835 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\yinyue[1].png (4941 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.941pojie[1].txt (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sky25145.hbgyzs[1].htm (1600 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.941pojie[2].txt (519 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tianyi[1].png (3218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6330cf46f68cd2c7c40a422626d1cb30[1].png (1941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\kl[1].gif (4786 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].php (1073 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (13108 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tee5_net_logo[1].jpg (24983 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\miaosha[1].gif (12204 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\longtian[1].jpg (8453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\haobangshou[1].jpg (2195 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\footer[1].jpg (12388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\wangpai[1].jpg (48243 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.lszwg[1].txt (325 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\miaosha[1].png (2498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lingfeng[1].jpg (4462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\click[2].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\mojian[1].jpg (3321 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (326 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xgz[1].jpg (2658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tianlang[1].jpg (24673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgheader[1].gif (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lszwg[1].htm (10245 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\27[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6330cf46f68cd2c7c40a422626d1cb30[1] (2016 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gif008[1].gif (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bgtitle[1].gif (3 bytes)
%System%\drivers\etc\services (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\longshen[1].jpg (18297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\046bt[1].gif (1692 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\style[1].css (3893 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\miaosha[1].gif (12807 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sky25145.hbgyzs[2].htm (1600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\game[1].js (911 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\linggua[1].png (219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic2[1].gif (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gg[1].png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\top[1].png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\shicai[1].png (6215 bytes)
%System%\drivers\etc\lmhosts.sam (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jiaqun[1].htm (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[2].php (682 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style[1].css (258 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\click[1].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (9625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\weihu[1].jpg (10658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jisu[1].png (2769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\zsf[1].gif (10523 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\zsf[1].gif (23271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (753 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[2].txt (406 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (404 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bgnav[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bg[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sansha[1].png (17181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gif008[2].gif (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[2].php (753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA5OWN9L.gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bgh[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jianhun[1].png (1923 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].php (1073 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%System%\drivers\etc\networks (407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qingtian[1].gif (8985 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bg[1].jpg (156378 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\anlong[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\game[2].htm (25649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yds[1].gif (7768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tianxunzhe[1].png (13455 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qijian[1].jpg (61723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jsq[1].png (6514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\046bt[1].gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\soso.hcjd56[1].htm (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic2[1].gif (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\6330cf46f68cd2c7c40a422626d1cb30[1] (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cb386.tmp (15 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\6330cf46f68cd2c7c40a422626d1cb30[1].png (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sky25145.hbgyzs[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\click[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\click[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic1[1].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.lszwg[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bg[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tee5_net_logo[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\soso.hcjd56[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6330cf46f68cd2c7c40a422626d1cb30[1] (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.941pojie[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\game[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sky25145.hbgyzs[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\game[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\group[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic2[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\6330cf46f68cd2c7c40a422626d1cb30[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cb386.tmp (0 bytes)
The process wscntmx.exe:244 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cj[1].txt (2948 bytes)
C:\b.bat (255 bytes)
%System%\drivers\etc\hosts.ics (17013 bytes)
C:\a.bat (356 bytes)
%System%\drivers\etc\hosts (16478 bytes)
Registry activity
The process attrib.exe:1236 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 8E 7C E1 72 58 A7 AF 64 8D 18 3B 26 D1 E3 9E"
The process attrib.exe:1840 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 86 E9 CD 6A 55 DE 50 72 50 83 F0 CA 45 53 32"
The process attrib.exe:544 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A E7 30 92 81 94 08 4D 86 11 12 06 09 F4 01 A1"
The process attrib.exe:1264 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC 67 5D 41 BF 04 94 72 0B 8F DB C4 41 CE 6A E9"
The process qudongrensheng.dat:1796 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 68 AC 58 6B E9 03 45 B8 2C 2E F2 13 CE C2 38"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\System\CurrentControlSet\Services\WinHelp32\Parameters]
"ServiceDll" = "%System%\ackupw.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"krnlsrvc" = "WinHelp32"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\System\CurrentControlSet\Services\WinHelp32\Parameters]
"seRVicemAIN" = "RunDllEntry"
[HKLM\System\CurrentControlSet\Services\WinHelp32]
"Description" = "Windows Help System for X32 windows desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process %original file name%.exe:1156 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1425415432"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 2C 18 A8 21 F3 18 5A 58 A2 CE 15 5E 83 C7 13"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process wscntmx.exe:244 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AD FE 4C 01 34 D3 1B A8 4C 03 2E 7D 17 45 CD E7"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wscntmx" = "D:\\wscntmx.exe"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process cacls.exe:1632 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 70 12 E9 55 70 20 45 FC 7A C5 DC 31 A6 A6 04"
The process cacls.exe:1040 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 96 F3 5D F0 35 86 FF D6 4F 16 2A 29 22 EE 01"
The process cacls.exe:1028 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 4B 18 FA 5F AA C6 A9 38 08 54 2B C4 8B 28 0C"
The process cacls.exe:940 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 DE 8A 9F E7 AA 96 BA E8 40 43 28 1D 80 E9 BC"
The process cacls.exe:1012 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 7A 44 13 7C A1 07 ED C8 BF 3D D6 5E 3D 8C 91"
Dropped PE files
MD5 | File path |
---|---|
623cdebf1ed65aaba993745ad979881f | c:\WINDOWS\system32\ackupw.dll |
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 65537 bytes in size. The following strings are added to the hosts file listed below:
23.234.20.24 | 988.pa579.com |
23.234.20.24 | 5k.611739.com |
23.234.20.24 | h.081983.com |
23.234.20.24 | www.121578.com |
23.234.20.24 | b.memekr.com |
23.234.20.24 | www.zhaosf.com.cn |
23.234.20.24 | www.xr-1688.com |
23.234.20.24 | g.zhenhgw.com |
23.234.20.24 | v.zhenhgw.com |
23.234.20.24 | c.vbbse4.com |
23.234.20.24 | www1.memekr.com |
23.234.20.24 | www.kfb126.com |
23.234.20.24 | huikaimin.blog.163.com |
23.234.20.24 | k.memekr.com |
23.234.20.24 | p.veletuan.com |
23.234.20.24 | c.btg55.com |
23.234.20.24 | v.cpjp737.com |
23.234.20.24 | www.agou920.com |
23.234.20.24 | first.cpjp737.com |
23.234.20.24 | c.veletuan.com |
23.234.20.24 | head.memekr.com |
23.234.20.24 | g.veletuan.com |
23.234.20.24 | g.zhenhgw.com |
23.234.20.24 | v.cpjp737.com |
23.234.20.24 | s.vzhishu.com |
23.234.20.24 | memekr.com |
23.234.20.24 | v.zhenhgw.com |
23.234.20.24 | c.vbbse4.com |
23.234.20.24 | k.memekr.com |
23.234.20.24 | p.veletuan.com |
23.234.20.24 | www.schzhp.cn |
23.234.20.24 | memekr.com |
23.234.20.24 | www.jlwfbdc.com |
23.234.20.24 | t.vzhishu.com |
23.234.20.24 | 8.zhenhgw.com |
23.234.20.24 | www.210cq.com |
23.234.20.24 | z.veletuan.com |
23.234.20.24 | 1.zhenhgw.com |
23.234.20.24 | y.vzhishu.com |
23.234.20.24 | www.680sf.com |
23.234.20.24 | www.81945.com |
23.234.20.24 | www.45574.com |
23.234.20.24 | 680sf.com |
23.234.20.24 | 81945.com |
23.234.20.24 | 45574.com |
23.234.20.24 | c.cpjp737.com |
23.234.20.24 | lm.363.com |
23.234.20.24 | v.wxyxe.com |
23.234.20.24 | www.ahzttz.com |
23.234.20.24 | xup.88448.com |
23.234.20.24 | www.88448.com |
23.234.20.24 | www.aaastor.com |
23.234.20.24 | www.delos-lighting.com |
23.234.20.24 | www.tlwz.org |
23.234.20.24 | www.zddiu.com |
23.234.20.24 | www.monthidc.com |
23.234.20.24 | www.chinawlf.com |
23.234.20.24 | www.blueanimalbio.com |
23.234.20.24 | www.dfac.com |
23.234.20.24 | www.glzyz.com |
23.234.20.24 | www.hxsiyuan.cn |
23.234.20.24 | www.wohuixue.com |
23.234.20.24 | wvw.1234pk.com |
23.234.20.24 | 1234pk.com |
23.234.20.24 | www.nc334yy.com |
23.234.20.24 | www.cqjztc.com |
23.234.20.24 | www.cdsdsy.net |
23.234.20.24 | www.cjfans.com |
23.234.20.24 | www.jsfoundry.com |
23.234.20.24 | www.handanyz.com |
23.234.20.24 | www.lingxiao.com.cn |
23.234.20.24 | www.jfpgs.com |
23.234.20.24 | hjc.bingdaofz.com |
23.234.20.24 | www.romanting.com |
23.234.20.24 | dns.ic123.cc |
23.234.20.24 | ad.036yx.com |
23.234.20.24 | www.lingxiao.com.cn |
23.234.20.24 | www.hwxxkj.com |
23.234.20.24 | www.ypdzkj.com |
23.234.20.24 | www.starworldhk.com |
23.234.20.24 | www.nfgt.com |
23.234.20.24 | v.vzhishu.com |
23.234.20.24 | 8.zhenhgw.com |
23.234.20.24 | www.blgmj.com |
23.234.20.24 | www.962sf.com |
23.234.20.24 | www.bingdaofz.com |
23.234.20.24 | bingdaofz.com |
23.234.20.24 | zhaof.icloud3g.com |
23.234.20.24 | www.326sf.com |
23.234.20.24 | www.813sf.com |
23.234.20.24 | www.45chuanqi45.com |
23.234.20.24 | www.1213sf.com |
23.234.20.24 | g.zhenhgw.com |
23.234.20.24 | as.xfgzs.net |
23.234.20.24 | b.memekr.com |
23.234.20.24 | n.veletuan.com |
23.234.20.24 | cdn.9377t.com |
23.234.20.24 | v.memekr.com |
23.234.20.24 | www.dnkbl.com |
23.234.20.24 | 6.zhenhgw.com |
23.234.20.24 | j.cpjp737.com |
23.234.20.24 | 1.veletuan.com |
23.234.20.24 | www.sjcjlb.cn |
23.234.20.24 | p.cpjp737.com |
23.234.20.24 | p.cpjp737.com |
23.234.20.24 | zhaof1.wgmtrade.com |
23.234.20.24 | www.xinjiasu.com |
23.234.20.24 | www.jwbjc.com |
23.234.20.24 | www.mmgyz.net |
23.234.20.24 | i.611739.com |
23.234.20.24 | www.eggtt.com |
23.234.20.24 | www.gm635.com |
23.234.20.24 | k.7it7.com |
23.234.20.24 | www.zizhixuke.com |
23.234.20.24 | www.nfgt.com |
23.234.20.24 | www.mmgyz.net |
23.234.20.24 | www.ku30.com |
23.234.20.24 | ku30.com |
23.234.20.24 | f.081983.com |
23.234.20.24 | 7.081983.com |
23.234.20.24 | www.chuge8.com |
23.234.20.24 | www.wanms.com |
23.234.20.24 | 1.kitefeung.com |
23.234.20.24 | 1.liaochengjiayuan.com |
23.234.20.24 | www.foodzhan.com |
23.234.20.24 | eggtt.com |
23.234.20.24 | www.915youxi.com |
23.234.20.24 | 915youxi.com |
23.234.20.24 | d.131f.com |
23.234.20.24 | y.118902.com |
23.234.20.24 | 1.7it7.com |
23.234.20.24 | www.91wanfu.com |
23.234.20.24 | 91wanfu.com |
23.234.20.24 | www.quwanfu.com |
23.234.20.24 | quwanfu.com |
23.234.20.24 | www.91wuc.com |
23.234.20.24 | www.zhaosf.com |
23.234.20.24 | www.gykailijx.com |
23.234.20.24 | q.611739.com |
23.234.20.24 | www.588by.com |
23.234.20.24 | duang.5com.cc |
23.234.20.24 | 91wuc.com |
23.234.20.24 | www.sy170.com |
23.234.20.24 | tzlsofa.com |
23.234.20.24 | www.tzlsofa.com |
23.234.20.24 | k.v58d.com |
23.234.20.24 | www.119021.com |
23.234.20.24 | 121578.com |
23.234.20.24 | www.cq7373.com |
23.234.20.24 | ht.80honey.com |
23.234.20.24 | www.hongbzn.com |
23.234.20.24 | www.cfbingyue.cc |
23.234.20.24 | www.zgjingyi.com |
23.234.20.24 | youxi.036yx.com |
23.234.20.24 | www.wxboao.com |
23.234.20.24 | jh.j550.com |
23.234.20.24 | 33ok.com |
23.234.20.24 | www.52zhaosf.com |
23.234.20.24 | 52zhaosf.com |
23.234.20.24 | www.zhaosf123.co |
23.234.20.24 | www.455151.com |
23.234.20.24 | 455151.com |
23.234.20.24 | www.zhaosf.at |
23.234.20.24 | zhaosf.cc |
23.234.20.24 | www.zhaosf.cc |
23.234.20.24 | www.zhaosf.org.cn |
23.234.20.24 | www.mcjd.net |
23.234.20.24 | z.611739.com |
23.234.20.24 | www.911wanwan.com |
23.234.20.24 | www.517zg.com |
23.234.20.24 | www.dju8.com |
23.234.20.24 | www.kfb163.com |
23.234.20.24 | www.7t57.com |
23.234.20.24 | 33ok.cm |
23.234.20.24 | www.33ok.com |
23.234.20.24 | www1.33ok.com |
23.234.20.24 | www2.33ok.com |
23.234.20.24 | www3.33ok.com |
23.234.20.24 | www4.33ok.com |
23.234.20.24 | www.520mc.cn |
23.234.20.24 | x.118902.com |
23.234.20.24 | www.2kfb.com |
23.234.20.24 | www.mcjiuju.cn |
23.234.20.24 | zgjingyi.com |
23.234.20.24 | aaa.xu98.com |
23.234.20.24 | pk05.90523.com |
23.234.20.24 | www.chasf.com |
23.234.20.24 | 9.611739.com |
23.234.20.24 | m.611739.com |
23.234.20.24 | k.118902.com |
23.234.20.24 | www.338mu.com |
23.234.20.24 | first.611739.com |
23.234.20.24 | p.081983.com |
23.234.20.24 | www.sxrdwy.com |
23.234.20.24 | happy.118902.com |
23.234.20.24 | sxrdwy.com |
23.234.20.24 | www.zhxsjc.com |
23.234.20.24 | zhxsjc.com |
23.234.20.24 | bg.118902.com |
23.234.20.24 | www.234wy.com |
23.234.20.24 | ku.081983.com |
23.234.20.24 | 1010fz.com |
23.234.20.24 | www.1000q.com |
23.234.20.24 | 1000q.com |
23.234.20.24 | vip.h1995.com |
23.234.20.24 | www.1745.com |
23.234.20.24 | www.1010fz.com |
23.234.20.24 | www.hzmeixin.com |
23.234.20.24 | hzmeixin.com |
23.234.20.24 | g.mt30.net |
23.234.20.24 | www.miehunsha.com |
23.234.20.24 | miehunsha.com |
23.234.20.24 | www.miehunwg.com |
23.234.20.24 | miehunwg.com |
23.234.20.24 | www.qdcyrc.com |
23.234.20.24 | www.180sf.net |
23.234.20.24 | www.zhengzhouzp.cn |
23.234.20.24 | pd.mt30.net |
23.234.20.24 | j.118902.com |
23.234.20.24 | n.611739.com |
23.234.20.24 | www.988wanwan.com |
23.234.20.24 | www.909wanwan.com |
23.234.20.24 | www.999wanwan.com |
23.234.20.24 | www.57ab.com |
23.234.20.24 | kh.mt30.net |
23.234.20.24 | zhaof.ctc0.com |
23.234.20.24 | kd.611739.com |
23.234.20.24 | www.456yx.com |
23.234.20.24 | 456yx.com |
23.234.20.24 | www.3355sf.com |
23.234.20.24 | xx.611739.com |
23.234.20.24 | 3355sf.com |
23.234.20.24 | www.3355sf.com |
23.234.20.24 | ee.mt30.net |
23.234.20.24 | tb.25jx.net |
23.234.20.24 | ko.u25u.com |
23.234.20.24 | hc.25jx.net |
23.234.20.24 | kk.u25u.com |
23.234.20.24 | y.611739.com |
23.234.20.24 | co.118902.com |
23.234.20.24 | stat.5pk.com |
23.234.20.24 | sk.081983.com |
23.234.20.24 | ee.mt30.ne |
23.234.20.24 | bdtg.37.com |
23.234.20.24 | v.61173f9.com |
23.234.20.24 | to.118902.com |
23.234.20.24 | www.dfsj521.com |
23.234.20.24 | a.118902.com |
23.234.20.24 | x.081983.com |
23.234.20.24 | jc.mt30.net |
23.234.20.24 | www.vis752.com |
23.234.20.24 | dd.yang868.com |
23.234.20.24 | baidu.pk05.com |
23.234.20.24 | zhaof.3737wyx.cn |
23.234.20.24 | www.5336.com |
23.234.20.24 | www.kaifu1.com |
23.234.20.24 | a.611739.com |
23.234.20.24 | cx.j550.com |
23.234.20.24 | www.st945.com |
23.234.20.24 | st945.com |
23.234.20.24 | 6x.u25u.com |
23.234.20.24 | 9kk.wd258.com |
23.234.20.24 | kx.u25u.com |
23.234.20.24 | bx.25jx.net |
23.234.20.24 | www.chengdongsteel.com |
23.234.20.24 | ss.u25u.com |
23.234.20.24 | ye.25jx.net |
23.234.20.24 | pk.j550.com |
23.234.20.24 | 7s.u25u.com |
23.234.20.24 | ss.u25u.com |
23.234.20.24 | p.u25u.com |
23.234.20.24 | x.j550.com |
23.234.20.24 | nl.25jx.net |
23.234.20.24 | sw.u25u.com |
23.234.20.24 | 5.25jx.net |
23.234.20.24 | 9.k1f.net |
23.234.20.24 | 9k2.wd258.com |
23.234.20.24 | www.9377b.com |
23.234.20.24 | www.5ding.com |
23.234.20.24 | www.lyh23.com |
23.234.20.24 | x.25jx.net |
23.234.20.24 | cc.u25u.com |
23.234.20.24 | tg.95k.com |
23.234.20.24 | www.bjwcl.com |
23.234.20.24 | www.9377o.com |
23.234.20.24 | bdtg.9377e.com |
23.234.20.24 | bbs.121210.com |
23.234.20.24 | 121210.com |
23.234.20.24 | www.121210.com |
23.234.20.24 | g.02qu.com |
23.234.20.24 | 6.u25u.com |
23.234.20.24 | bbs.wg78.com |
23.234.20.24 | wg78.com |
23.234.20.24 | f.25jx.net |
23.234.20.24 | y.j550.com |
23.234.20.24 | 1.nanyang2012.com |
23.234.20.24 | sx.fans8979.com |
23.234.20.24 | d.416191.com |
23.234.20.24 | vip.h1995.com |
23.234.20.24 | youxi.baidu.com |
23.234.20.24 | d.k1f.net |
23.234.20.24 | dd.yang898.com |
23.234.20.24 | dd.yang858.com |
23.234.20.24 | www.daishichuchen.com |
23.234.20.24 | www.yzshule.com |
23.234.20.24 | fb.98zsjm.com |
23.234.20.24 | www.hqa.cn.com |
23.234.20.24 | www.zx-cj.com |
23.234.20.24 | www.628552.com |
23.234.20.24 | y.02qu.com |
23.234.20.24 | d.416191.com |
23.234.20.24 | www.sith.cc |
23.234.20.24 | www.9377t.com |
23.234.20.24 | www.tianxiang-intl.com |
23.234.20.24 | www.yn30.com |
23.234.20.24 | 1.bzhtwqx.com |
23.234.20.24 | www.zzhttex.com |
23.234.20.24 | haocq.131sf.com |
23.234.20.24 | zhaof.aassdd.net |
23.234.20.24 | zhaof.98zslc.com |
23.234.20.24 | zhaof.youxizx.net |
23.234.20.24 | www.300sf.com |
23.234.20.24 | www.45uc.com |
23.234.20.24 | www.chasf.com |
23.234.20.24 | 999.wd258.com |
23.234.20.24 | yyy.wd258.com |
23.234.20.24 | go.sf999.com |
23.234.20.24 | www.haost.com |
23.234.20.24 | 1.hhyouxi.net |
23.234.20.24 | cq.98zslc.com |
23.234.20.24 | www.112fu.com |
23.234.20.24 | www.kaiqu.com |
23.234.20.24 | 1.youxizx.net |
23.234.20.24 | www.777sf.com |
23.234.20.24 | www.hdjddl.com |
23.234.20.24 | 112fu.huashengshipin.com |
23.234.20.24 | 58sf.58sf-1.com |
23.234.20.24 | www.yx19.com |
23.234.20.24 | www.yx31.com |
23.234.20.24 | dn.67cx.com |
23.234.20.24 | t.u25u.com |
23.234.20.24 | w.hsdbm.com |
23.234.20.24 | dd.yang808.com |
23.234.20.24 | iwan.baidu.com |
23.234.20.24 | www.83cq.com |
23.234.20.24 | 1.aassdd.net |
23.234.20.24 | www.hfhybjgs.com |
23.234.20.24 | www.haoqj.com |
23.234.20.24 | www.haojuezhan.com |
23.234.20.24 | www.zskunshang.com |
23.234.20.24 | a.mt30.net |
23.234.20.24 | www.377f.com |
23.234.20.24 | t.25jx.net |
23.234.20.24 | d.be-real.cn |
23.234.20.24 | d.diaoyiyuan.cn |
23.234.20.24 | www.xlmqt.com |
23.234.20.24 | www.528day.com |
23.234.20.24 | www.789zt.com |
23.234.20.24 | 6.shangwanghui.com |
23.234.20.24 | 1.shangwanghui.com |
23.234.20.24 | yx.minyouxi.com |
23.234.20.24 | 1.678bigfoot.com |
23.234.20.24 | 45uc.0731gfang.com |
23.234.20.24 | d.baidudiyi.net |
23.234.20.24 | u1.yhwl88.net |
23.234.20.24 | pojie.wwpan.com |
23.234.20.24 | www.9945.com |
23.234.20.24 | www.23u.com |
23.234.20.24 | www.haofu.com |
23.234.20.24 | www.sf184.com |
23.234.20.24 | www.sfw.com |
23.234.20.24 | www.5pk.com |
23.234.20.24 | tg.applx85.com |
23.234.20.24 | aa.liaochengjiayuan.com |
23.234.20.24 | ht.v58d.com |
23.234.20.24 | 45uc.pf8898.com |
23.234.20.24 | 61.115163.com |
23.234.20.24 | haocq.0553dx.com |
23.234.20.24 | d.baidudiyi.net |
23.234.20.24 | 1.baidudiyi.net |
23.234.20.24 | 11.baidudiyi.net |
23.234.20.24 | www.hycartoon.com |
23.234.20.24 | 6.115163.com |
23.234.20.24 | www.sybnzh.cn |
23.234.20.24 | aa.kitefeung.com |
23.234.20.24 | 11s.pf8898.com |
23.234.20.24 | 1.mt30.net |
23.234.20.24 | www.snzad.com |
23.234.20.24 | www.uq2558.com |
23.234.20.24 | www.hada5688.com |
23.234.20.24 | www.zzctech.com |
23.234.20.24 | www.kf521.com |
23.234.20.24 | ss99.927wz.com |
23.234.20.24 | zhaocq.aassdd.net |
23.234.20.24 | haocq.youxizx.net |
23.234.20.24 | 160uc.600co.com |
23.234.20.24 | fa.oz9es.com |
23.234.20.24 | nx.5cn.cc |
23.234.20.24 | 889tt.d3yy.cn |
23.234.20.24 | vip.jzc123.com |
23.234.20.24 | www.oryin.com |
23.234.20.24 | 776tt.d3yy.cn |
23.234.20.24 | www.meihaomianjia.com |
23.234.20.24 | www.zgr999.com |
23.234.20.24 | www.yxzhaofu.com |
23.234.20.24 | pk6666.isitestar.cn |
23.234.20.24 | www.lwmoyu.com |
23.234.20.24 | www.pk515.com |
23.234.20.24 | www.uc277.com |
23.234.20.24 | www.uc828.com |
23.234.20.24 | 885ok.52fanfou.com |
23.234.20.24 | www.pk05.com |
23.234.20.24 | 3355t.jybz66.com |
23.234.20.24 | www.134p.com |
23.234.20.24 | 88pkdxy.plpl123.com |
23.234.20.24 | rt.5cn.cc |
23.234.20.24 | www.521jjj.com |
23.234.20.24 | www.wst86.cn |
23.234.20.24 | 1199t.kao77.com |
23.234.20.24 | 6677y.szxmmw.com |
23.234.20.24 | www.weilai99.com |
23.234.20.24 | zhaocq.98zslc.com |
23.234.20.24 | lk.yhwl88.net |
23.234.20.24 | 9911.9zph.com |
23.234.20.24 | z.67cx.com |
23.234.20.24 | www.longyi-group.com |
23.234.20.24 | www.genehi.com |
23.234.20.24 | www.362g.com |
23.234.20.24 | www.3sbl.net |
23.234.20.24 | www.herbalife888.cn |
23.234.20.24 | ns.78lc.net |
23.234.20.24 | dd.guidawang.com |
23.234.20.24 | 3355t.jybz66.com |
23.234.20.24 | www.sf123uu.com |
23.234.20.24 | 1.25jx.net |
23.234.20.24 | xd.qicaimofang.com |
23.234.20.24 | www.sz-lb.com |
23.234.20.24 | www.zo6knln.com |
23.234.20.24 | www.o68js.com |
23.234.20.24 | pk789a.52fanfou.com |
23.234.20.24 | zhaocq.700uc.com |
23.234.20.24 | www.06954.com |
23.234.20.24 | 168tg.psc8.com |
23.234.20.24 | www.69945.com |
23.234.20.24 | 160uc.600co.com |
23.234.20.24 | www.09846.com |
23.234.20.24 | 88pkjx.mei12a.com |
23.234.20.24 | www.xhtk.net |
23.234.20.24 | www.45569.com |
23.234.20.24 | www.njzs58.com |
23.234.20.24 | 8pk.mei12a.com |
23.234.20.24 | 88pkh1.kkk21sd.com |
23.234.20.24 | 88pkdxw.mei12a.com |
23.234.20.24 | 88pkdxy.mei12a.com |
23.234.20.24 | www.anansf.com |
23.234.20.24 | www.haowz.com |
23.234.20.24 | 999.23dpw.com |
23.234.20.24 | st.scdcyb.com |
23.234.20.24 | xs.qicaimofang.com |
23.234.20.24 | zhaosf.2866101.com |
23.234.20.24 | www.jyjyh.com |
23.234.20.24 | www.zhaohuajx.com |
23.234.20.24 | www.8iss.com |
23.234.20.24 | www.jnlvjie.com |
23.234.20.24 | sf123.21daikuan.com |
23.234.20.24 | zhaosf.2866101.com |
23.234.20.24 | tuiguang.8iss.com |
23.234.20.24 | tuiguang.8msm.com |
23.234.20.24 | fe.yueworld.net |
23.234.20.24 | 920aa.changyc.com |
23.234.20.24 | xb.qicaimofang.com |
23.234.20.24 | www.yx003.com |
23.234.20.24 | www1.pkokok.com |
23.234.20.24 | cz.yueworld.net |
23.234.20.24 | tuiguang.muu9.com |
23.234.20.24 | haosf.98zsjm.com |
23.234.20.24 | www.75945.com |
23.234.20.24 | www.lpf010.com |
23.234.20.24 | www.6000pk.com |
23.234.20.24 | 9pk.2766161.com |
23.234.20.24 | www.zhaof7.com |
23.234.20.24 | www.cqhr.org |
23.234.20.24 | www.ddzhe.com |
23.234.20.24 | pk789.52fanfou.com |
23.234.20.24 | 160uc.com |
23.234.20.24 | www.1nhh.com |
23.234.20.24 | www.52sol.com |
23.234.20.24 | www.cpu500.com |
23.234.20.24 | www.2381sfcq.com |
23.234.20.24 | www.uc37.com |
23.234.20.24 | www.98pk97.com |
23.234.20.24 | www.hbcyly.com |
23.234.20.24 | haosf.lfweibo.com |
23.234.20.24 | cq.kgfanli.com |
23.234.20.24 | www.999yc.com |
23.234.20.24 | www1.jjj.com |
23.234.20.24 | zhaosf.acrmbs.com |
23.234.20.24 | www.uc900.com |
23.234.20.24 | www2.jjj.com |
23.234.20.24 | www3.jjj.com |
162.211.182.3 | 1711ok.zz135.com |
23.234.20.24 | w13518.hr.jw.tczj.net |
23.234.20.24 | zhaofu7.com |
23.234.20.24 | tuiguang.592097.com |
23.234.20.24 | v.yueworld.net |
23.234.20.24 | zhaosf.ofyn.net |
23.234.20.24 | dk.qicaimofang.com |
23.234.20.24 | 578101.com |
23.234.20.24 | www.578101.com |
23.234.20.24 | www.126disk.com |
23.234.20.24 | tui99.592097.com |
23.234.20.24 | tui99.8msm.com |
23.234.20.24 | dd.guidawang.com |
23.234.20.24 | bb.fushilu.com |
23.234.20.24 | www.zhaofu7.com |
23.234.20.24 | www.baiduzhaokf.com |
23.234.20.24 | www.haosf.com |
23.234.20.24 | www.jsl-cn.com |
23.234.20.24 | www.88858.com |
23.234.20.24 | www.heshilurong.com |
23.234.20.24 | www.168fm.com |
23.234.20.24 | www.artobrain.com |
23.234.20.24 | wwv.jb345.com |
23.234.20.24 | www.zhaosf9999.com |
23.234.20.24 | www.uc1000.com |
23.234.20.24 | www4.jjj.com |
23.234.20.24 | www.uc900.com |
23.234.20.24 | www.uc900.com |
23.234.20.24 | www.cctv-kowann.com |
23.234.20.24 | www5.jjj.com |
23.234.20.24 | www.artobrain.com |
23.234.20.24 | www.jxytqz.com |
23.234.20.24 | www.as9z.com |
23.234.20.24 | pk789.52fanfou.com:81 |
23.234.20.24 | 36cq.dg8681.com:3636 |
23.234.20.24 | www.444yx.com |
23.234.20.24 | www.993yx.com |
23.234.20.24 | jjj.com |
23.234.20.24 | www1.99s.com |
23.234.20.24 | www2.99s.com |
23.234.20.24 | 99s.com |
23.234.20.24 | www99s.com |
23.234.20.24 | www.uc1000.com |
23.234.20.24 | 2410.eodfmr.cn |
23.234.20.24 | www.www99s.com |
23.234.20.24 | www.woool99s.com |
23.234.20.24 | www3.99s.com |
23.234.20.24 | 9k1.pa579.com |
23.234.20.24 | new.fa111.com |
23.234.20.24 | www4.99s.com |
23.234.20.24 | www5.99s.com |
23.234.20.24 | www.09445.com |
23.234.20.24 | www.cdxxzs.com |
23.234.20.24 | www.angelsimple.cn |
23.234.20.24 | www.lida00.cn |
23.234.20.24 | www.zbzishen.com |
23.234.20.24 | www.86jiewang.cn |
23.234.20.24 | www.itcr.cn |
23.234.20.24 | www.99u.net.ru |
23.234.20.24 | www.wan345.com |
23.234.20.24 | www.525uc.com |
23.234.20.24 | www.1cq.com |
23.234.20.24 | www.jjj.com |
23.234.20.24 | www.99s.com |
23.234.20.24 | www.gm005.com |
23.234.20.24 | www.68kf.com |
23.234.20.24 | wwk.astbw.com |
23.234.20.24 | zz.sf163.com |
23.234.20.24 | www.sotrip.com |
23.234.20.24 | 33k.pa579.com |
23.234.20.24 | www.555sf.com |
23.234.20.24 | www.66hst.com |
23.234.20.24 | 66hst.com |
23.234.20.24 | www.xin45.com |
23.234.20.24 | xin45.com |
23.234.20.24 | www.zhaocq.com |
23.234.20.24 | 1.52yanzheng.sinaapp.com |
23.234.20.24 | www.175sf.com |
23.234.20.24 | www.yxyhx.com |
23.234.20.24 | www.168fm.com |
23.234.20.24 | habourbiotech.com |
23.234.20.24 | www.pydwlm.com |
23.234.20.24 | www.ux99.com |
23.234.20.24 | www.hn17173.net |
23.234.20.24 | www.5s98.com |
23.234.20.24 | www.880s.com |
23.234.20.24 | www.118uc.com |
23.234.20.24 | www.zf777.com |
23.234.20.24 | 81.2381f.com |
23.234.20.24 | www.njkaidu.com |
23.234.20.24 | www.9szf.com |
23.234.20.24 | www.999zsf.com |
23.234.20.24 | www.85zf.com |
23.234.20.24 | www.951pk.com |
23.234.20.24 | www.851pk.com |
23.234.20.24 | 988.pa579.com |
23.234.20.24 | ad.97uu.com |
23.234.20.24 | www.i8pk.com |
23.234.20.24 | www.sf996.com |
23.234.20.24 | www.0579st.com |
23.234.20.24 | www.mc1314.com |
23.234.20.24 | gm016.comforum.php |
23.234.20.24 | www.whsfzx.com |
23.234.20.24 | dd.sh-tongy.com |
23.234.20.24 | 111.kaihu365.com |
23.234.20.24 | www.dddgm.com |
23.234.20.24 | www.ok126.net |
23.234.20.24 | www.wanshituliao.com |
23.234.20.24 | www.zaxue.net |
23.234.20.24 | www.4006517008.com |
23.234.20.24 | www.tcrhy.com |
23.234.20.24 | www.vdisk.cnyy6018 |
23.234.20.24 | www.sf383.com |
23.234.20.24 | www.001gm.net |
23.234.20.24 | www.006it.com |
23.234.20.24 | www.gm5555.com |
23.234.20.24 | www.yxyhx.com |
23.234.20.24 | www.3jidi-gz.com |
23.234.20.24 | www.100gczg.com |
23.234.20.24 | haosf.lgknow.com |
23.234.20.24 | habourbiotech.com |
23.234.20.24 | www.satsalt.com |
23.234.20.24 | tg1.37.com |
23.234.20.24 | pi.nuwa-mountain.org |
23.234.20.24 | www.jafdc.net |
23.234.20.24 | 941pk.com |
23.234.20.24 | www.5iwowo.com |
23.234.20.24 | www.bonopt.com |
23.234.20.24 | www.jzdkfj.com |
23.234.20.24 | henuedu.cn |
23.234.20.24 | www.sdjialiang.com |
23.234.20.24 | www.10010cq.com |
23.234.20.24 | www.z0137cx.comkwcs |
23.234.20.24 | www.0512rc.net |
23.234.20.24 | www.dahanjg.com |
23.234.20.24 | www.ht-vision.com |
23.234.20.24 | www.3159wine.com |
23.234.20.24 | www.jfy8rv.comzjp6bw |
23.234.20.24 | www.yxyhx.com |
23.234.20.24 | www.9uzg.com |
23.234.20.24 | www.gm667.com |
23.234.20.24 | www.znspyq.com9dzf7w |
23.234.20.24 | www.18-81.net |
23.234.20.24 | www.ht-vision.com |
23.234.20.24 | www.gmwly.com |
23.234.20.24 | user.qzone.qq.com5674167 |
23.234.20.24 | t.qq.comchuanqisf8997 |
23.234.20.24 | www.njjqgck.com |
23.234.20.24 | www.hkalu.com |
23.234.20.24 | www.60sf.com |
23.234.20.24 | www.pk123.com |
23.234.20.24 | www.52anzu.com |
23.234.20.24 | www1.52anzu.com |
23.234.20.24 | 52anzu.com |
23.234.20.24 | www.sopojie.com |
23.234.20.24 | www1.sopojie.com |
23.234.20.24 | sopojie.com |
23.234.20.24 | www.wf22.com |
23.234.20.24 | xingyoufz.wwpan.com |
23.234.20.24 | www.36ok.com |
23.234.20.24 | www.32fa.com |
23.234.20.24 | wws.99acc.com |
23.234.20.24 | www.916cq.com |
23.234.20.24 | 1711ok.sh77577.com |
23.234.20.24 | www.18uc.com |
23.234.20.24 | 18uc.com |
23.234.20.24 | 88pk.com |
23.234.20.24 | www.88pk.com |
23.234.20.24 | 162.212.180.86 |
23.234.20.24 | 36ok.com |
23.234.20.24 | 118.99.26.156 |
23.234.20.24 | 23.234.60.34 |
23.234.20.24 | www.52anzu.net |
23.234.20.24 | www.77250.com |
23.234.20.24 | 77250.com |
23.234.20.24 | www1.52anzu.net |
23.234.20.24 | tt.1kuv.com |
23.234.20.24 | www.33ok.com |
23.234.20.24 | 916cq.com |
23.234.20.24 | 91ww.91fu.com |
23.234.20.24 | www1.pk777.com |
23.234.20.24 | www.sf999.com |
23.234.20.24 | www.yeahooo.net |
23.234.20.24 | 1.townhall.cn |
23.234.20.24 | www.bjjijiubao.com |
23.234.20.24 | 1.xa1314.com.cn |
23.234.20.24 | www.yvwtjf.com |
23.234.20.24 | www.stylepacking.com |
23.234.20.24 | www.cnfengye.com |
23.234.20.24 | www.zazgame.com |
23.234.20.24 | www.zrplay.com |
23.234.20.24 | www.yczdwj.com |
23.234.20.24 | www.zheyutegang.com |
23.234.20.24 | www.sf123.com |
23.234.20.24 | www.daqiandoor.com |
23.234.20.24 | www.77d8.com |
23.234.20.24 | www.3159wine.com |
23.234.20.24 | www.wwesf.com |
23.234.20.24 | www.7988ok.com |
23.234.20.24 | www.shfengyi.com |
23.234.20.24 | pg.iflu.com.cn |
23.234.20.24 | www.gdtrane.com |
23.234.20.24 | www.scxlm.com |
23.234.20.24 | www.kisspk.com |
23.234.20.24 | www.cqxz.com.cn |
23.234.20.24 | www.kanonsh.com |
23.234.20.24 | www.gm1208.com |
23.234.20.24 | www.provoxav.com |
23.234.20.24 | dgdimei.com |
23.234.20.24 | www.cntzdh.com |
23.234.20.24 | www.hanwise.com |
23.234.20.24 | www.mfttj.com |
23.234.20.24 | www.shenqi.com |
23.234.20.24 | www.52345.com |
23.234.20.24 | 81f.hao899.com |
23.234.20.24 | www.sf123.com |
23.234.20.24 | www.3159wine.com |
23.234.20.24 | www.daqiandoor.com |
23.234.20.24 | www.941jb.com |
23.234.20.24 | 2sogo.com |
23.234.20.24 | mobanbbs.com |
23.234.20.24 | 91ww.555uc.com |
23.234.20.24 | www.99j.com |
23.234.20.24 | www.91ww.com |
23.234.20.24 | www.777uc.com |
23.234.20.24 | www.xbkdq.com |
23.234.20.24 | 66sf.77zhao.com |
23.234.20.24 | www.184pk.com |
23.234.20.24 | www.sf999.com |
23.234.20.24 | www.pk777.com |
23.234.20.24 | www.alfatoyota.com |
23.234.20.24 | mobanbbs.com |
23.234.20.24 | www.stbshg.com |
23.234.20.24 | www.daqiandoor.com |
23.234.20.24 | www.1cq.com |
23.234.20.24 | www.xbkdq.com |
23.234.20.24 | www.sf123.com |
23.234.20.24 | www.3159wine.com |
23.234.20.24 | www.buyishijia.com |
23.234.20.24 | www.sf999.com |
23.234.20.24 | www.shenqi.com |
23.234.20.24 | www.52345.com |
23.234.20.24 | www.92045.com |
23.234.20.24 | www.926.com |
23.234.20.24 | www.99j.com |
23.234.20.24 | www.945pk.com |
23.234.20.24 | 8uc.haosf33.com |
23.234.20.24 | www.91ww.com |
23.234.20.24 | www.8uu.com |
23.234.20.24 | 81f.hao883.com |
23.234.20.24 | 81f.hao979.com |
23.234.20.24 | 81f.hao899.com |
23.234.20.24 | www.81f.com |
23.234.20.24 | www.nihao119.com |
23.234.20.24 | www.66sf.com |
23.234.20.24 | kkkfu.sylytz.com |
23.234.20.24 | 83aa.sf078.com |
23.234.20.24 | 521fu.9173uc.com |
23.234.20.24 | www.777uc.com |
23.234.20.24 | www.pk777.com |
23.234.20.24 | www.30ok-1.com |
23.234.20.24 | www.haocq.com |
23.234.20.24 | www.1000ok.com |
23.234.20.24 | wvw.rq23.com |
23.234.20.24 | wvw.2013wan.com |
23.234.20.24 | wvw.9377z.com |
23.234.20.24 | mmm.wopaijs.com |
23.234.20.24 | www.yyy279.com |
23.234.20.24 | wvw.9377s.com |
23.234.20.24 | www.zhujiutx.com |
23.234.20.24 | www.hbwxkj.com |
23.234.20.24 | www.sh-chengshan.com |
23.234.20.24 | zhaosfcq.com |
23.234.20.24 | www.subpig.net |
23.234.20.24 | www.jlzcfx.com |
23.234.20.24 | www.66sf.com |
23.234.20.24 | www.cdxxlh.com |
23.234.20.24 | www.83uc.com |
23.234.20.24 | www.shjwd.com |
23.234.20.24 | www.jingming-sh.com |
23.234.20.24 | www.aerosun.cn |
23.234.20.24 | www.qdhd.com.cn |
23.234.20.24 | www.flyxg.com |
23.234.20.24 | www.zggljt.com |
23.234.20.24 | www.99mc.com |
23.234.20.24 | www.138zg.com |
23.234.20.24 | www.523zg.com |
23.234.20.24 | www.98zg.com |
23.234.20.24 | www.78zg.cn |
23.234.20.24 | www.99ting.cn |
23.234.20.24 | www.27zg.com |
23.234.20.24 | www.92sanduo.com |
23.234.20.24 | www.527zg.com |
23.234.20.24 | www.xstylxx.com |
23.234.20.24 | www.xrsd-water.com |
23.234.20.24 | www.tttjsq.com |
23.234.20.24 | www.y1995.com |
23.234.20.24 | www.883sf.com |
23.234.20.24 | sf123.com |
23.234.20.24 | changjing.759rsq.com |
23.234.20.24 | xinqing.kqgf69.com |
23.234.20.24 | www.xahdc.com |
23.234.20.24 | www.haotl.com |
23.234.20.24 | www.chinajin-hui.com |
23.234.20.24 | www.fullkang.net.com |
23.234.20.24 | tanxian.u895.com |
23.234.20.24 | www.m526.com |
23.234.20.24 | www.majorsoul.com |
23.234.20.24 | changjing.pbbxy.com |
23.234.20.24 | sf225.com |
23.234.20.24 | www.haosf.com |
23.234.20.24 | www.tcrhy.com |
23.234.20.24 | www.001gm.net |
23.234.20.24 | cqdl321.com |
23.234.20.24 | www.b9jojo.com |
23.234.20.24 | www.9kf.com |
23.234.20.24 | www.sf138.com |
23.234.20.24 | www.628118.com |
23.234.20.24 | www.hezol.com |
23.234.20.24 | www.qjkutrgw.com |
23.234.20.24 | www.ashijia.com |
23.234.20.24 | www.1200sf.com |
23.234.20.24 | www.aarongj.com |
23.234.20.24 | www.53my.com |
23.234.20.24 | www.888cnc.com |
23.234.20.24 | www.sf3000.com |
23.234.20.24 | www.29u.in |
23.234.20.24 | www.96sf.com |
23.234.20.24 | www.3159wine.com |
23.234.20.24 | www.sf800.com |
23.234.20.24 | www.77mxd.com |
23.234.20.24 | www.9uzg.com |
23.234.20.24 | www.sf999.com.ru |
23.234.20.24 | www.szmajsy.com |
23.234.20.24 | www.jptea.cn |
23.234.20.24 | www.cqpk11.com |
23.234.20.24 | www.insdfjisd.com |
23.234.20.24 | www.828kk.com |
23.234.20.24 | www.irrchina.com |
23.234.20.24 | www.22nf.com |
23.234.20.24 | www.jiutianzs.com |
23.234.20.24 | www.103la.com |
23.234.20.24 | www.889ok.com |
23.234.20.24 | huanshou.8236r.com |
23.234.20.24 | www.1129f.com |
23.234.20.24 | 345ye.861sf.com |
23.234.20.24 | www.861sf.com |
23.234.20.24 | 861sf.com |
23.234.20.24 | www.sf985.com |
23.234.20.24 | www.bonopt.com |
23.234.20.24 | cq45.cn |
23.234.20.24 | www.cq45.cn |
23.234.20.24 | www.bgdtw.com |
23.234.20.24 | www.930t.com |
23.234.20.24 | www.tianhuao.com |
23.234.20.24 | www.99a.net.ru |
23.234.20.24 | www.hmyigou.com |
23.234.20.24 | www.fzjx.net |
23.234.20.24 | www.ez-max.net |
23.234.20.24 | www.zhuoranfm.com |
23.234.20.24 | www.ccadly.net |
23.234.20.24 | www.chinasysw.com |
23.234.20.24 | www.dyjkdd.com |
23.234.20.24 | www.cnbaoerte.com |
23.234.20.24 | www.sf895.com |
23.234.20.24 | www.joywei.com |
23.234.20.24 | www.yalincs.com |
23.234.20.24 | www.kkstar.com |
23.234.20.24 | www.949g.com |
23.234.20.24 | www.zhaosf.com.co |
23.234.20.24 | www.3000ok.com.cn |
23.234.20.24 | n813.com |
23.234.20.24 | uc88.com |
23.234.20.24 | qu45.com |
23.234.20.24 | www.aop9988.com |
23.234.20.24 | www.sdytgj.com |
23.234.20.24 | www.gzgien.com |
23.234.20.24 | www.chuanqige.com |
23.234.20.24 | 51my8.com |
23.234.20.24 | www.99j.com.es |
23.234.20.24 | www.sf452.com |
23.234.20.24 | www.981sf.com |
23.234.20.24 | www.sf382.com |
23.234.20.24 | www.hldly.com |
23.234.20.24 | www.sf062.com |
23.234.20.24 | www.8345sf.com |
23.234.20.24 | www.sdfwesq.com |
23.234.20.24 | www.sjxt123.com |
23.234.20.24 | www.daqiandoor.com |
23.234.20.24 | www.125sf.com |
23.234.20.24 | www.xieqiyy.com |
23.234.20.24 | www.ldyeya.com |
23.234.20.24 | www.088sf.net |
23.234.20.24 | 83so.com |
23.234.20.24 | www.sf421.com |
23.234.20.24 | www.4f920.com |
23.234.20.24 | www.tiaolou8.com |
23.234.20.24 | www.taocooler.com |
23.234.20.24 | www.wanpp.com |
23.234.20.24 | www.fhzsm.com |
23.234.20.24 | www.pt12319.com |
23.234.20.24 | www.hx-lace.com |
23.234.20.24 | www.jiagao.net |
23.234.20.24 | 76776.com |
23.234.20.24 | www.htwjcy.com |
23.234.20.24 | www.win757.com |
23.234.20.24 | www.hnjxzz.cn |
23.234.20.24 | www.xmdvip.com |
23.234.20.24 | swqzp.com |
23.234.20.24 | www.tungsten-moly.com |
23.234.20.24 | jingyan.986jj.com |
23.234.20.24 | www.xxf888.com |
23.234.20.24 | www.cnrsyy.com |
23.234.20.24 | www.txingzuo.com |
23.234.20.24 | www.ykmir.com |
23.234.20.24 | www.xjxianping.cn |
23.234.20.24 | www.web01.cn |
23.234.20.24 | www.yijiaedu.cn |
23.234.20.24 | dushisuanlafen.cn |
23.234.20.24 | www.zzyichen.com |
23.234.20.24 | www.cnnoblelight.com |
23.234.20.24 | klkemu.net |
23.234.20.24 | www.faith-forever.com |
23.234.20.24 | www.bopuai.cn |
23.234.20.24 | www.xzchuitou.cn |
23.234.20.24 | www.ccxbzk.cn |
23.234.20.24 | www.915788.com |
23.234.20.24 | www.sdxtcnc.com |
23.234.20.24 | www.sz-stv.com |
23.234.20.24 | www.fjoss.com |
23.234.20.24 | www.204sf.com |
23.234.20.24 | www.tech-sss.com |
23.234.20.24 | www.mywowpl.com |
23.234.20.24 | www.shi-yi.net |
23.234.20.24 | www.hzlyfashion.com |
23.234.20.24 | www.freeshu.com |
23.234.20.24 | www.chinatianmei.com |
23.234.20.24 | 00pk.com |
23.234.20.24 | www.tqb88.com |
23.234.20.24 | 4593.9kf.com |
23.234.20.24 | www.120yi.com |
23.234.20.24 | www.hdmchina.com |
23.234.20.24 | www.zzfuxi.com |
23.234.20.24 | www.sdicl.com |
23.234.20.24 | www.ebontec.com |
23.234.20.24 | www.3000oksf.com |
23.234.20.24 | www.shqing8.com |
23.234.20.24 | www.666mir.com |
23.234.20.24 | www.adchy.com |
23.234.20.24 | www.pyprint.com |
23.234.20.24 | www.56chuanqi.com |
23.234.20.24 | www.simicc.com |
23.234.20.24 | www.a5zg.com |
23.234.20.24 | www.szhcgroup.com |
23.234.20.24 | www.57ssy.com |
23.234.20.24 | www.qingzhou8.com |
23.234.20.24 | tt292.com |
23.234.20.24 | www.jiatianneiyi.com |
23.234.20.24 | www.leeed.com |
23.234.20.24 | www.20020505.com |
23.234.20.24 | www.kl-chem.com |
23.234.20.24 | www.tjzssd.com |
23.234.20.24 | www.nnhxjh.com |
23.234.20.24 | www.dwmir.com |
23.234.20.24 | www.kk519.com |
23.234.20.24 | www.chinanewhope.net |
23.234.20.24 | www.yalimei-group.com |
23.234.20.24 | www.jiulongbelt.com |
23.234.20.24 | www.dushisuanlafen.cn |
23.234.20.24 | www.cn0796.com |
23.234.20.24 | www.hnfengyuan.com |
23.234.20.24 | www.yixinghai.com |
23.234.20.24 | www.zgtjsteel.com |
23.234.20.24 | www.51disky.com |
23.234.20.24 | www.zhybbs.com |
23.234.20.24 | www.91kaixue.com |
23.234.20.24 | www.fyplay.com |
23.234.20.24 | www.wowidc.com |
23.234.20.24 | www.jiahongtex.com |
23.234.20.24 | www.diselife.com |
23.234.20.24 | www.yygdz.com |
23.234.20.24 | www.kexingco.com |
23.234.20.24 | www.88fb.com |
23.234.20.24 | www.botaofan.com |
23.234.20.24 | www.zzhdjx.cn |
23.234.20.24 | www.cntuliao.com |
23.234.20.24 | www.m5y6.cn |
23.234.20.24 | www.songzhilu.com |
23.234.20.24 | zhaopeng.net |
23.234.20.24 | www.xiayunfei.com |
23.234.20.24 | soyoesd.cn |
23.234.20.24 | www.523zg.com |
23.234.20.24 | regongjixie.com |
23.234.20.24 | www.mir87.com |
23.234.20.24 | chinachengyang.cn |
23.234.20.24 | www.dgguanglin.com |
23.234.20.24 | www.huayuebz.com |
23.234.20.24 | www.xxsw028.com |
23.234.20.24 | www.myppchina.com |
23.234.20.24 | www.gzsuper.com |
23.234.20.24 | www.txhtc.com |
23.234.20.24 | www.cdcx1956.com |
23.234.20.24 | www.yaliwood.com |
23.234.20.24 | www.flower024.com |
23.234.20.24 | www.5ttb.com |
23.234.20.24 | www.i193.com |
23.234.20.24 | www.shweiheng.com |
23.234.20.24 | www.65wt.com |
23.234.20.24 | u17766.com |
23.234.20.24 | www.600sf.com |
23.234.20.24 | www.baodaobike.com |
23.234.20.24 | www.56fabu.com |
23.234.20.24 | www.pt12319.com |
23.234.20.24 | pk.sydahe.com |
23.234.20.24 | cnpeishi.cn |
23.234.20.24 | www.2-55.com |
23.234.20.24 | www.cdfufu.com |
23.234.20.24 | www.bzydzs.com |
23.234.20.24 | www.dhl.gov.cn |
23.234.20.24 | www.81cq.com |
23.234.20.24 | www.sxfyxyq.com |
23.234.20.24 | 111wt.com |
23.234.20.24 | 81sf.com |
23.234.20.24 | 44dy.com |
23.234.20.24 | 30wy.com |
23.234.20.24 | 999wg.net |
23.234.20.24 | 915m.com |
23.234.20.24 | 66kf.net |
23.234.20.24 | www.qs930.com |
23.234.20.24 | www.shutu.cc |
23.234.20.24 | sf666.75gm.com |
23.234.20.24 | www.kkksf.com |
23.234.20.24 | www.zhao3f.com |
23.234.20.24 | 6cq.cc |
23.234.20.24 | u7u73.com |
23.234.20.24 | sf923.com |
23.234.20.24 | oryin.com |
23.234.20.24 | gm777.com |
23.234.20.24 | gm333.com |
23.234.20.24 | cseht.com |
23.234.20.24 | 520f.com |
23.234.20.24 | 258x.com |
23.234.20.24 | 57ww.com |
23.234.20.24 | 57591.com |
23.234.20.24 | 33sf.com |
23.234.20.24 | sf509.com |
23.234.20.24 | 803cq.com |
23.234.20.24 | 25930.com |
23.234.20.24 | 812315.com |
23.234.20.24 | 11cq.cn |
23.234.20.24 | 94ww.com |
23.234.20.24 | 777wt.com |
23.234.20.24 | www.99mc.com |
23.234.20.24 | 980cq.com |
23.234.20.24 | hdhjgs.com |
23.234.20.24 | 51zzsf.com |
23.234.20.24 | 0574k.com |
23.234.20.24 | wjlon.cn |
23.234.20.24 | d518.com |
23.234.20.24 | sf29.com |
23.234.20.24 | 222sf.com |
23.234.20.24 | 23qianbao.com |
23.234.20.24 | 195ca.com |
23.234.20.24 | 118967.com |
23.234.20.24 | 10000ok.com |
23.234.20.24 | 72cq.com |
23.234.20.24 | 5zaoxie.com |
23.234.20.24 | 555beian.com |
23.234.20.24 | 55hj.com |
23.234.20.24 | 45758.com |
23.234.20.24 | 41345.com |
23.234.20.24 | 258sf.com |
23.234.20.24 | 9000sf.com |
23.234.20.24 | 87sf.com |
23.234.20.24 | 89946.com |
23.234.20.24 | 88f.com |
23.234.20.24 | 86rs.com |
23.234.20.24 | 77yu.com |
23.234.20.24 | 81592.com |
23.234.20.24 | 74981.com |
23.234.20.24 | 818wy.com |
23.234.20.24 | 9826w.com |
23.234.20.24 | www.myidc.cc |
23.234.20.24 | www.whygjt.com |
23.234.20.24 | www.nd-zk.com |
23.234.20.24 | haosf.com.cn |
23.234.20.24 | www.sf3000ok.com |
23.234.20.24 | www.145930.com |
23.234.20.24 | www.80ww.com |
23.234.20.24 | www.258x.com |
23.234.20.24 | www.sf509.com |
23.234.20.24 | www.tjklm.com |
23.234.20.24 | 17sz.net |
23.234.20.24 | www.81sf.com |
23.234.20.24 | www.0663yh.com |
23.234.20.24 | whygjt.com |
23.234.20.24 | www.cc816.com |
23.234.20.24 | www.bohaomj.com |
23.234.20.24 | www.blbfg.com |
23.234.20.24 | jndd.com.cn |
23.234.20.24 | www.ba45.com |
23.234.20.24 | www.bjwztc.com |
23.234.20.24 | www.bangbangtuan.com |
23.234.20.24 | 1.wzca.com.cn |
23.234.20.24 | www.51yygw.com |
23.234.20.24 | www.912kf.com |
23.234.20.24 | www.eduqc.com |
23.234.20.24 | www.ebssfp.com |
23.234.20.24 | www.dingfengtop.com |
23.234.20.24 | www.dc-superglue.com |
23.234.20.24 | www.daweilp.com |
23.234.20.24 | www.czacyq.com |
23.234.20.24 | www.cqxiexin.com |
23.234.20.24 | www.cltqgs.com |
23.234.20.24 | www.cnaxchem.com |
23.234.20.24 | www.chengdajc.com |
23.234.20.24 | www.cdztnt.com |
23.234.20.24 | www.chinawoollen.com |
23.234.20.24 | www.chinaenyu.com |
23.234.20.24 | www.ihc360.com |
23.234.20.24 | www.hrener.com |
23.234.20.24 | www.howelltoy.com |
23.234.20.24 | www.fzqmw.com |
23.234.20.24 | www.hongweimotor.com |
23.234.20.24 | www.gardenhn.com |
23.234.20.24 | www.fzghj.com |
23.234.20.24 | www.fhouse360.com |
23.234.20.24 | www.fdzyy.com |
23.234.20.24 | www.fujunsh.com |
23.234.20.24 | www.funkan.com |
23.234.20.24 | www.pxfangbao.com |
23.234.20.24 | www.pk138.com |
23.234.20.24 | www.oursuzuki.com |
23.234.20.24 | www.movfox.com |
23.234.20.24 | www.nbyongxiang.com |
23.234.20.24 | www.maoshanchem.com |
23.234.20.24 | www.longyundianli.com |
23.234.20.24 | www.linxiatravel.com |
23.234.20.24 | www.jhrace.com |
23.234.20.24 | www.jxytoys.com |
23.234.20.24 | www.kpaofeite.com |
23.234.20.24 | www.jiang456.com |
23.234.20.24 | www.szgargen.com |
23.234.20.24 | www.szelcc.com |
23.234.20.24 | www.sun-sand-sea.com |
23.234.20.24 | www.shzhuwang.com |
23.234.20.24 | www.ssbrakepad.com |
23.234.20.24 | www.shxianghao.com |
23.234.20.24 | www.shchenggang.com |
23.234.20.24 | www.quhi-tech.com |
23.234.20.24 | www.sh16pu.com |
23.234.20.24 | www.reach-way.com |
23.234.20.24 | www.sddzauto.com |
23.234.20.24 | www.yhszy.com |
23.234.20.24 | www.xinfengjixie.com |
23.234.20.24 | www.xiduanpress.com |
23.234.20.24 | www.xuyetrade.com |
23.234.20.24 | www.xaxhny.com |
23.234.20.24 | www.wzxiyin.com |
23.234.20.24 | www.wxlujia.com |
23.234.20.24 | www.usnaike.com |
23.234.20.24 | www.tyhzh.com |
23.234.20.24 | www.szhmxled.com |
23.234.20.24 | yaosf.net |
23.234.20.24 | www.zjyingguan.com |
23.234.20.24 | www.zzwzgn.com |
23.234.20.24 | www.zjtsmj.com |
23.234.20.24 | www.zjgujia.com |
23.234.20.24 | www.30fu.com |
23.234.20.24 | www.zgshunxing.com |
23.234.20.24 | www.zhcrane.com |
23.234.20.24 | www.zhao5f.com |
23.234.20.24 | www.ytjiangyou.com |
23.234.20.24 | www.yinghongjixie.com |
23.234.20.24 | www.zwyt.net |
23.234.20.24 | zzhdjx.cn |
23.234.20.24 | www.szmhk.com |
23.234.20.24 | www.ccggge.com |
23.234.20.24 | www.0007590.com |
23.234.20.24 | 941qq.com |
23.234.20.24 | www4.29u.com |
23.234.20.24 | www.nlcoad.com |
23.234.20.24 | 26ss.com |
23.234.20.24 | zhaohaosf.net |
23.234.20.24 | www.eanfang.com |
23.234.20.24 | www.ntwmyy.com |
23.234.20.24 | eanfang.com |
23.234.20.24 | www.88pknb.com |
23.234.20.24 | www.hh8gg.pw |
23.234.20.24 | www.hycygy.com |
23.234.20.24 | 114code.com |
23.234.20.24 | www.legendpw.net |
23.234.20.24 | www.dgyuanyang.com |
23.234.20.24 | www.sf999.name |
23.234.20.24 | www.125kkk.com |
23.234.20.24 | go.sf999.com |
23.234.20.24 | wwww.017cq.com |
23.234.20.24 | cnc.sf999.com |
23.234.20.24 | www.xztd888.com |
23.234.20.24 | www.iyqxkcqw.com |
23.234.20.24 | www.fenfa1688.com |
23.234.20.24 | www.huahuiye.com |
23.234.20.24 | www.sdqinuo.com |
23.234.20.24 | www.njhxztz.com |
23.234.20.24 | www.qibone.com |
23.234.20.24 | www.aimkm.com |
23.234.20.24 | www.195eeweqsc.com |
23.234.20.24 | www.007sf.com |
23.234.20.24 | www.512qz.com |
23.234.20.24 | www.jxdpx.com |
23.234.20.24 | www.haosf.org |
23.234.20.24 | www.17123.com |
23.234.20.24 | 999sf.com |
23.234.20.24 | www.7000hj.com |
23.234.20.24 | 67pp.com |
23.234.20.24 | 56chuanqi.com |
23.234.20.24 | www.k8765.com |
23.234.20.24 | www.haosf9999.com |
23.234.20.24 | www.fw000.com |
23.234.20.24 | www.gm333.com |
23.234.20.24 | www.anmeiexpo.com |
23.234.20.24 | www.999sf.com |
23.234.20.24 | www.95ok.com |
23.234.20.24 | sedio.cc |
23.234.20.24 | www.5d5y.com |
23.234.20.24 | www.gm777.com |
23.234.20.24 | zhaosf.88654.com |
23.234.20.24 | www.xifulei.com |
23.234.20.24 | www.sf903.com |
23.234.20.24 | www.syjm.net |
23.234.20.24 | www.sf7000.com |
23.234.20.24 | www.nbwanfeng.com |
23.234.20.24 | 677g.com |
23.234.20.24 | sf63.com |
23.234.20.24 | www.91kang.com |
23.234.20.24 | cqniangzao.com |
23.234.20.24 | www.999ok.com |
23.234.20.24 | 92gg.com |
23.234.20.24 | 921ww.com |
23.234.20.24 | 520sf.com |
23.234.20.24 | 239ok.com |
23.234.20.24 | shdongqiao.com |
23.234.20.24 | sd-yuhui.com |
23.234.20.24 | meiri.vqkp35.com |
23.234.20.24 | moni.227y.com |
23.234.20.24 | gzonisi.cn |
23.234.20.24 | 345cc.cn.com |
23.234.20.24 | chinayat.com |
23.234.20.24 | www.3f6f.com |
23.234.20.24 | www.258sf.com |
23.234.20.24 | www.13su.com |
23.234.20.24 | www.118967.com |
23.234.20.24 | www.sardar.cc |
23.234.20.24 | www.21sjzg.com |
23.234.20.24 | www.0769hongri.com |
23.234.20.24 | www.0574k.com |
23.234.20.24 | www.020rencai.net |
23.234.20.24 | uc99.com |
23.234.20.24 | www.001info.com |
23.234.20.24 | www.67pp.net |
23.234.20.24 | www.666666s.com |
23.234.20.24 | www.66kf.net |
23.234.20.24 | www.5zaoxie.com |
23.234.20.24 | www.55hj.com |
23.234.20.24 | www.520sf.com |
23.234.20.24 | www.51miehun.co |
23.234.20.24 | www.51huigo.com |
23.234.20.24 | www.45758.com |
23.234.20.24 | www.5199g.com |
23.234.20.24 | www.30wy.com |
23.234.20.24 | www.941qq.com |
23.234.20.24 | www.922gg.com |
23.234.20.24 | www.88f.com |
23.234.20.24 | www.88102888.com |
23.234.20.24 | www.921ww.com |
23.234.20.24 | www.89946.com |
23.234.20.24 | www.818wy.com |
23.234.20.24 | www.86rs.com |
23.234.20.24 | www.789sf.net |
23.234.20.24 | www.77yu.com |
23.234.20.24 | www.789is.com |
23.234.20.24 | www.6836999.com |
23.234.20.24 | www.boxianfengguan.com |
23.234.20.24 | www.allaboutprogram.com |
23.234.20.24 | www.avoio.com |
23.234.20.24 | www.autohid.com |
23.234.20.24 | www.aptx4869.net |
23.234.20.24 | www.art-verb.com |
23.234.20.24 | www.94haokan.com |
23.234.20.24 | www.dj149.com |
23.234.20.24 | www.dgdtw.com |
23.234.20.24 | www.digrj.com |
23.234.20.24 | www.dgzichi.com |
23.234.20.24 | www.cqsfcn.com |
23.234.20.24 | www.dfhero.com |
23.234.20.24 | www.dabanwu.com |
23.234.20.24 | www.chuanqisifu99.com |
23.234.20.24 | www.chinakelly.com |
23.234.20.24 | www.cfaninfo.com |
23.234.20.24 | www.cgxgf.com |
23.234.20.24 | www.byetee.com |
23.234.20.24 | www.idcdong.com |
23.234.20.24 | www.i-blinks.com |
23.234.20.24 | www.hnlangjie.com |
23.234.20.24 | www.hxfamily.com |
23.234.20.24 | www.hzruili.com |
23.234.20.24 | www.hnggfz.com |
23.234.20.24 | www.hzkjy.com |
23.234.20.24 | www.hlmodule.com |
23.234.20.24 | www.hbwyw.net |
23.234.20.24 | www.hbqdxjmf.com |
23.234.20.24 | www.gzxlzs.com |
23.234.20.24 | www.gzplay.com |
23.234.20.24 | www.gxxjl.com |
23.234.20.24 | www.guanhaiyujia.com |
23.234.20.24 | www.dqzypx.com |
23.234.20.24 | www.krksjx.com |
23.234.20.24 | www.lishi99.com |
23.234.20.24 | www.leiming-bulb.com |
23.234.20.24 | www.lanyue2003.com |
23.234.20.24 | www.laosf.com |
23.234.20.24 | www.jzfsk.com |
23.234.20.24 | www.knschina.com |
23.234.20.24 | www.jsxgm.com |
23.234.20.24 | www.jshhw.com |
23.234.20.24 | www.jka77.com |
23.234.20.24 | www.jn333.com |
23.234.20.24 | www.j8y.net |
23.234.20.24 | www.jieer.net |
23.234.20.24 | www.jietewq.com |
23.234.20.24 | www.i-dphoto.com |
23.234.20.24 | www.pgmary.com |
23.234.20.24 | www.pxfyzs.com |
23.234.20.24 | www.pai4f.com |
23.234.20.24 | www.njrybj.com |
23.234.20.24 | www.oshococo.com |
23.234.20.24 | www.nibou.net |
23.234.20.24 | www.newseaswan.com |
23.234.20.24 | www.myuheng.com |
23.234.20.24 | www.mzwq.info |
23.234.20.24 | www.lypfc.com |
23.234.20.24 | www.lzyinfeng.com |
23.234.20.24 | www.ly1000.com |
23.234.20.24 | www.lvislife.com |
23.234.20.24 | www.lx188.com |
23.234.20.24 | www.shundaglass.com |
23.234.20.24 | www.shyuanli.com |
23.234.20.24 | www.sh-liuxin.com |
23.234.20.24 | www.shi18.com |
23.234.20.24 | www.sf920.net |
23.234.20.24 | www.sea-reach.com |
23.234.20.24 | www.sertai.com |
23.234.20.24 | www.sf123-1.com |
23.234.20.24 | www.sf123.cc |
23.234.20.24 | www.saiyilong.com |
23.234.20.24 | www.scienthoer.com |
23.234.20.24 | www.ruichilida.com |
23.234.20.24 | www.qunhuan.net |
23.234.20.24 | www.qmxfw.com |
23.234.20.24 | www.qhsdkj.com |
23.234.20.24 | www.twdmly.com |
23.234.20.24 | www.szyangcai.com |
23.234.20.24 | www.tococi.com |
23.234.20.24 | www.tcbl88.com |
23.234.20.24 | www.sz-wells.com |
23.234.20.24 | www.szpangzhi.com |
23.234.20.24 | www.szjundaled.com |
23.234.20.24 | www.szcmon.com |
23.234.20.24 | www.szjlskj.com |
23.234.20.24 | www.szabj.com |
23.234.20.24 | www.syzwdj.com |
23.234.20.24 | www.syqtdz.com |
23.234.20.24 | www.sxhtdl.com |
23.234.20.24 | www.sougousf.com |
23.234.20.24 | www.zwnoon.com |
23.234.20.24 | www.zszhongzhi.com |
23.234.20.24 | www.z-sheng.com |
23.234.20.24 | www.zpmc-cz.com |
23.234.20.24 | www.zjtl.com |
23.234.20.24 | www.zjpages.com |
23.234.20.24 | www.zdhw-lighting.com |
23.234.20.24 | www.youxi119.com |
23.234.20.24 | www.ysmtc8.com |
23.234.20.24 | www.yongdingfm.com |
23.234.20.24 | www.yiqi163.com |
23.234.20.24 | www.yingxiangceliangyi.com |
23.234.20.24 | www.wjnmyy.com |
23.234.20.24 | www.wzcjyy.com |
23.234.20.24 | www.wudait.com |
23.234.20.24 | www.xhcsolar.com |
23.234.20.24 | www.kmnc.net |
23.234.20.24 | www2.8845sf.com |
23.234.20.24 | 120sf.0755nk.net |
23.234.20.24 | www.muhon.com.cn |
23.234.20.24 | www1.8845sf.com |
23.234.20.24 | 922gg.com |
23.234.20.24 | www.yts189.com |
23.234.20.24 | www.chakansdfj.com |
23.234.20.24 | www.steelrq.com |
23.234.20.24 | yindao.jfsm79.com |
23.234.20.24 | www.zx0411.com |
23.234.20.24 | www.kt516.com |
23.234.20.24 | 66sf.69ao.com |
23.234.20.24 | www.lt925.com |
23.234.20.24 | www.45wj.com |
23.234.20.24 | www.tt371.com |
23.234.20.24 | www.goule88.com |
23.234.20.24 | www.ranwen.cm |
23.234.20.24 | www.verosale.com |
23.234.20.24 | grambox.com |
23.234.20.24 | down.16kbook.com |
23.234.20.24 | www.grambox.com |
23.234.20.24 | cq.51zzsf.com |
23.234.20.24 | www.ka688.com |
23.234.20.24 | www.hj010.com |
23.234.20.24 | www.64sf.com |
23.234.20.24 | www.921pk.com |
23.234.20.24 | kt516.com |
23.234.20.24 | www.gc771.com |
23.234.20.24 | www.su315.com |
23.234.20.24 | www.jindepower.com |
23.234.20.24 | 88uc.sf19.cn |
23.234.20.24 | www.hrm123.net |
23.234.20.24 | www.bjyjy.com |
23.234.20.24 | www.uc99.com |
23.234.20.24 | wvw.9kf.com |
23.234.20.24 | 97sf.com |
23.234.20.24 | www.70uc.com |
23.234.20.24 | www.zhaoqiqi.com |
23.234.20.24 | www.hnrbysc.com |
23.234.20.24 | www.69ao.com |
23.234.20.24 | 32feef.11cq.cn |
23.234.20.24 | 176.01kp.com |
23.234.20.24 | www.kuj8.com |
23.234.20.24 | 81f.27-88.com |
23.234.20.24 | www.917se.com |
23.234.20.24 | www.fabumir.com |
23.234.20.24 | www.uc007.com |
23.234.20.24 | www.sf999.com.de |
23.234.20.24 | www.zhaosf.co |
23.234.20.24 | haosf12345.gm127.com |
23.234.20.24 | zhaosf.co |
23.234.20.24 | 66sf.com |
23.234.20.24 | www.chuanqisf.com |
23.234.20.24 | zhuzaigua.com |
23.234.20.24 | www.1pk.com |
23.234.20.24 | 28uc.com |
23.234.20.24 | chenmo.cc |
23.234.20.24 | www.sf22.com |
23.234.20.24 | www.sf405.com |
23.234.20.24 | www.cz45.com |
23.234.20.24 | 115cq.com |
23.234.20.24 | www.803cq.com |
23.234.20.24 | www.25930.com |
23.234.20.24 | 123f.com |
23.234.20.24 | hongxuda.com |
23.234.20.24 | haocqsf.com |
23.234.20.24 | www.100rcw.com |
23.234.20.24 | www.10000ok.com |
23.234.20.24 | www.05uc.com |
23.234.20.24 | www.23qianbao.com |
23.234.20.24 | www.222sf.com |
23.234.20.24 | www.72cq.com |
23.234.20.24 | www.ahmcks.com |
23.234.20.24 | www.90zzs.com |
23.234.20.24 | www.csqnw.com |
23.234.20.24 | www.dlz888.com |
23.234.20.24 | www.jx789.com |
23.234.20.24 | www.jsywg.com |
23.234.20.24 | www.tccyg.com |
23.234.20.24 | www.wcfm103.com |
23.234.20.24 | www.wjdhfz.com |
23.234.20.24 | www.zzz7.net |
23.234.20.24 | www.m3088tv.com |
23.234.20.24 | www.cxhdl.com |
23.234.20.24 | www.szbiaoyu.com |
23.234.20.24 | www.gzpioneer.com |
23.234.20.24 | www.mi-sc.com |
23.234.20.24 | www.hosisoft.com |
23.234.20.24 | www.huakangpc.com |
23.234.20.24 | www.zjkylsk.com |
23.234.20.24 | www.casscno.com |
23.234.20.24 | www.0808sf.com |
23.234.20.24 | www.jinhuachang.com |
23.234.20.24 | www.dongya888.com |
23.234.20.24 | www.fhxzd.com |
23.234.20.24 | www.sgwjg.com |
23.234.20.24 | www.pntfrc.com |
23.234.20.24 | www.sf9.cn |
23.234.20.24 | www.lxsqrfms.com |
23.234.20.24 | www.ygpkndz.com |
23.234.20.24 | www.jrxktdy.com |
23.234.20.24 | www.1007movie.net |
23.234.20.24 | 30.9youwang.com |
23.234.20.24 | 51huigo.com |
23.234.20.24 | 51sf.com |
23.234.20.24 | 520cq.com |
23.234.20.24 | 520cq.net |
23.234.20.24 | 765wg.com |
23.234.20.24 | 789is.com |
23.234.20.24 | www.23vo.com |
23.234.20.24 | 8aa.com |
23.234.20.24 | 91545.com |
23.234.20.24 | 941lt.com |
23.234.20.24 | 99245.com |
23.234.20.24 | 95sf.com |
23.234.20.24 | 99ting.cn |
23.234.20.24 | 99ting.com |
23.234.20.24 | aaa.xz667.com |
23.234.20.24 | ac198.com |
23.234.20.24 | aa.606wz.com |
23.234.20.24 | bbs.1x.la |
23.234.20.24 | dbconsys.com |
23.234.20.24 | gaosf.com |
23.234.20.24 | gg.herom2.net |
23.234.20.24 | hao-sf-123.com |
23.234.20.24 | haosf.org |
23.234.20.24 | hao119.com |
23.234.20.24 | laosf.com |
23.234.20.24 | search.sf999.com |
23.234.20.24 | sf3000.com |
23.234.20.24 | sf86.com |
23.234.20.24 | sf99.com |
23.234.20.24 | sf999.net |
23.234.20.24 | sfsf.d518.com |
23.234.20.24 | shenqi.com |
23.234.20.24 | www.fzrhcopper.com |
23.234.20.24 | www.008fy.com |
23.234.20.24 | www.022hs.com |
23.234.20.24 | www.123qf.com |
23.234.20.24 | www.13xp.com |
23.234.20.24 | www.163fb.com |
23.234.20.24 | www.450sf.com |
23.234.20.24 | 23vo.com |
23.234.20.24 | www.1x.la |
23.234.20.24 | www.23bb.net |
23.234.20.24 | www.28uc.com |
23.234.20.24 | www.33sf.com |
23.234.20.24 | 450sf.com |
23.234.20.24 | www.55ip.com |
23.234.20.24 | www.58751.com |
23.234.20.24 | www.6090sf.com |
23.234.20.24 | www.67pp.com |
23.234.20.24 | www.77145.com |
23.234.20.24 | www.707wz.com |
23.234.20.24 | www.7pv.net |
23.234.20.24 | www.78x8.com |
23.234.20.24 | www.810f.com |
23.234.20.24 | www.8u8uu.com |
23.234.20.24 | www.915m.com |
23.234.20.24 | www.941cq.com |
23.234.20.24 | www.96cs.com |
23.234.20.24 | www.92gg.com |
23.234.20.24 | www.99245.com |
23.234.20.24 | www.sfniu.com |
23.234.20.24 | www.sihai-musical.com |
23.234.20.24 | www.cq588.com |
23.234.20.24 | 91084.com |
23.234.20.24 | www.dobgame.com |
23.234.20.24 | www.fireol.com |
23.234.20.24 | www.fei24.com |
23.234.20.24 | www.game-114.com |
23.234.20.24 | www.gaosf.com |
23.234.20.24 | www.gmhaosf.com |
23.234.20.24 | www.hao3a.com |
23.234.20.24 | www.haosf.bz |
23.234.20.24 | www.htdqsec.com |
23.234.20.24 | www.hzhswj.com |
23.234.20.24 | www.pk920.com |
23.234.20.24 | www.liwoma.com |
23.234.20.24 | 7000uc.com |
23.234.20.24 | www.nwpbl.com |
23.234.20.24 | www.ok3000.com |
23.234.20.24 | www.23c.com |
23.234.20.24 | www.pk555.com |
23.234.20.24 | www.pk920.com |
23.234.20.24 | www.rbtvs.com |
23.234.20.24 | www.91084.com |
23.234.20.24 | www.sdzblj.com |
23.234.20.24 | www.sf121.com |
23.234.20.24 | www.sebxa.com |
23.234.20.24 | www.sf3000.com |
23.234.20.24 | www.sf86.com |
23.234.20.24 | www.sf999.net |
23.234.20.24 | www.shuo321.com |
23.234.20.24 | www.shuiguanyin.com |
23.234.20.24 | www.sxzkzx.com |
23.234.20.24 | www.uc88.com |
23.234.20.24 | www.weihuangsz.com |
23.234.20.24 | www.weizhixs.com |
23.234.20.24 | www.wodewww.com |
23.234.20.24 | www.wsf520.com |
23.234.20.24 | 23c.com |
23.234.20.24 | www.xcwsg.com |
23.234.20.24 | www.xjlgc.com |
23.234.20.24 | www.zhuzaicq.com |
23.234.20.24 | www1.uc88.com |
23.234.20.24 | www2.520cq.com |
23.234.20.24 | www5.29u.com |
23.234.20.24 | www4.520cq.com |
23.234.20.24 | www5.520cq.com |
23.234.20.24 | 3000ko.com |
23.234.20.24 | www.sdjnxy.com |
23.234.20.24 | sf999.com |
23.234.20.24 | www.51okf.com |
23.234.20.24 | www.iiwoool.com |
23.234.20.24 | www.rxshige.com |
23.234.20.24 | www.dghke.com |
23.234.20.24 | www.7kkb.net |
23.234.20.24 | www.789518.com |
23.234.20.24 | www.cqfff.com |
23.234.20.24 | www4.beer51.com |
23.234.20.24 | www.cseht.com |
23.234.20.24 | www.82926.com |
23.234.20.24 | 8uc.558uc.com |
23.234.20.24 | www.99cangzhou.com |
23.234.20.24 | www.pjzbw.com |
23.234.20.24 | www.52375.com |
23.234.20.24 | www.xdhmotor.com |
23.234.20.24 | www.shmeigu168.com |
23.234.20.24 | www.comvod.com |
23.234.20.24 | www.gz-sc.com |
23.234.20.24 | www.stylepacking.com |
23.234.20.24 | www.hnfdczj.com |
23.234.20.24 | www.wfxycc.com |
23.234.20.24 | www.26ss.com |
23.234.20.24 | www.hezhihui.com |
23.234.20.24 | www.wuxihuaxia.com |
23.234.20.24 | www.nblongyi.com |
23.234.20.24 | www.7zcq.com |
23.234.20.24 | 7ugg.com |
23.234.20.24 | www.dliuren.com |
23.234.20.24 | www.wmult.com |
23.234.20.24 | www.3159wine.com |
23.234.20.24 | www.sf5137.com |
23.234.20.24 | www.cxxcqp.com |
23.234.20.24 | www.qz92.com |
23.234.20.24 | www.stronger-filter.com |
23.234.20.24 | www1.65cf.com |
23.234.20.24 | i8pk.com |
23.234.20.24 | www.trnly.com |
23.234.20.24 | www.zhaokj.com |
23.234.20.24 | www.yaojuezhan.com |
23.234.20.24 | www.tt2sf.com |
23.234.20.24 | www.qupaike.com |
23.234.20.24 | www.luowenqi.com |
23.234.20.24 | qqfcwgw.com |
23.234.20.24 | www.taosf.com.ru |
23.234.20.24 | www.zj-xd.com |
23.234.20.24 | www.mgszyc.com |
23.234.20.24 | 9pk.dgjt.net |
23.234.20.24 | www.2umm.com |
23.234.20.24 | www.yxyhx.com |
23.234.20.24 | zhaokf.com |
23.234.20.24 | www.sf010.com |
23.234.20.24 | www.sfdawang.com |
23.234.20.24 | www.17fg.com |
23.234.20.24 | abc.top258.cn |
23.234.20.24 | www.gm7.cc |
23.234.20.24 | 9kf.rzsport.com |
23.234.20.24 | ss.sg368.com |
23.234.20.24 | www.yy-bags.com |
23.234.20.24 | video.shunlo.com |
23.234.20.24 | www.45yes.com |
23.234.20.24 | www.cnyongli.com |
23.234.20.24 | www.sf03.com |
23.234.20.24 | www.88kf.net |
23.234.20.24 | www.88kf.com |
23.234.20.24 | www.sf168.com |
23.234.20.24 | 555sf.com |
23.234.20.24 | www.ourbep.com |
23.234.20.24 | www.manmank.com |
23.234.20.24 | sebxa.com |
23.234.20.24 | hchxh.com |
23.234.20.24 | z34.sf19.cn |
23.234.20.24 | www.mobilefad.com |
23.234.20.24 | www.sf22-2.com |
23.234.20.24 | www.tlsfwz.com |
23.234.20.24 | www.westmm.com |
23.234.20.24 | 7080st.com |
23.234.20.24 | www.sf322.com |
23.234.20.24 | www.zyjms.com |
23.234.20.24 | yy.7080st.com |
23.234.20.24 | jcniao.com |
23.234.20.24 | letanju.com |
23.234.20.24 | soso.8kst.com |
23.234.20.24 | www.taleclub.com |
23.234.20.24 | 008cqsf.com |
23.234.20.24 | 112sf.com |
23.234.20.24 | 114.75sf.cn |
23.234.20.24 | 123sf.com |
23.234.20.24 | 138bt.com |
23.234.20.24 | 138sf.com |
23.234.20.24 | 139.limulu.com |
23.234.20.24 | 163.fuatw.com |
23.234.20.24 | 168.w198.net |
23.234.20.24 | 168.zh-db.com |
23.234.20.24 | 178bifen.com |
23.234.20.24 | 17fg.com |
23.234.20.24 | 23c.com |
23.234.20.24 | 23ok.com |
23.234.20.24 | 28yes.com |
23.234.20.24 | 29u.com |
23.234.20.24 | 500sf.com |
23.234.20.24 | 513ux.com |
23.234.20.24 | 515.zh-db.com |
23.234.20.24 | 51xunt.com |
23.234.20.24 | 520.szgumi.com |
23.234.20.24 | 52345.com |
23.234.20.24 | 523sf.com |
23.234.20.24 | 523u.com |
23.234.20.24 | 55z5.com |
23.234.20.24 | 666sf.com |
23.234.20.24 | 66cq.com |
23.234.20.24 | 73sf.com |
23.234.20.24 | 777gm.com |
23.234.20.24 | 7uc.com |
23.234.20.24 | 81f.com |
23.234.20.24 | 81fu.com |
23.234.20.24 | 8845.com |
23.234.20.24 | 88858.com |
23.234.20.24 | www.qizhu.cc |
23.234.20.24 | www.as9z.com |
23.234.20.24 | 8uu.com |
23.234.20.24 | 91ww.com |
23.234.20.24 | 92045.com |
23.234.20.24 | 920sf.com |
23.234.20.24 | 926.com |
23.234.20.24 | 92fu.com |
23.234.20.24 | 999hj.com |
23.234.20.24 | 99j.com |
23.234.20.24 | 9kf.com |
23.234.20.24 | 9pk.k197.com |
23.234.20.24 | 9pk.u7u73.com |
23.234.20.24 | ad.97uu.com |
23.234.20.24 | haocq.com |
23.234.20.24 | pk123.com |
23.234.20.24 | plinm.com |
23.234.20.24 | qiqi530.com |
23.234.20.24 | qq.007uc.com |
23.234.20.24 | sf138.com |
23.234.20.24 | sf168.com |
23.234.20.24 | sf176.com |
23.234.20.24 | sf215.com |
23.234.20.24 | sf222.com |
23.234.20.24 | sf30.com |
23.234.20.24 | sf777.com |
23.234.20.24 | www.xhnano.com |
23.234.20.24 | sogou.1000ok.com |
23.234.20.24 | ww.1388fu.com |
23.234.20.24 | www.005sf.com |
23.234.20.24 | www.008n.com |
23.234.20.24 | www.015999.com |
23.234.20.24 | www.023cz.com |
23.234.20.24 | www.023toilet.com |
23.234.20.24 | www.027fruit.com |
23.234.20.24 | www.0313hybj.com |
23.234.20.24 | www.0532oa.com |
23.234.20.24 | www.055735.com |
23.234.20.24 | www.07186.com |
23.234.20.24 | www.1000gsf.com |
23.234.20.24 | www.112sf.com |
23.234.20.24 | www.114haosf.com |
23.234.20.24 | www.115cq.com |
23.234.20.24 | www.11811445.com |
23.234.20.24 | www.11cq.cn |
23.234.20.24 | www.120sf.com |
23.234.20.24 | www.123cq.com |
23.234.20.24 | www.123f.com |
23.234.20.24 | www.123hj.com |
23.234.20.24 | www.123sf.com |
23.234.20.24 | www.123uu.com |
23.234.20.24 | www.130136.com |
23.234.20.24 | www.134sf.com |
23.234.20.24 | www.138bt.com |
23.234.20.24 | www.145sf.com |
23.234.20.24 | www.15ss.com |
23.234.20.24 | www.16753.com |
23.234.20.24 | www.17fabu8.com |
23.234.20.24 | www.215pk.com |
23.234.20.24 | www.22j.com |
23.234.20.24 | www.234sfww.com |
23.234.20.24 | www.23c.com |
23.234.20.24 | www.23fu.com |
23.234.20.24 | www.23ok.com |
23.234.20.24 | www.23sfu.cn |
23.234.20.24 | www.27sf.com |
23.234.20.24 | www.28yes.com |
23.234.20.24 | www.29u.com |
23.234.20.24 | www.3000ok.cc |
23.234.20.24 | www.3000pk.com |
23.234.20.24 | www.31cqsf.com |
23.234.20.24 | www.31i.cn |
23.234.20.24 | 300sf.com |
23.234.20.24 | www.3300sf.com |
23.234.20.24 | www.33345.com |
23.234.20.24 | www.333ok.com |
23.234.20.24 | www.33pk.com |
23.234.20.24 | www.33wt.com |
23.234.20.24 | www.361cq.com |
23.234.20.24 | www.365taoba.com |
23.234.20.24 | www.371cyw.com |
23.234.20.24 | www.37ok.com |
23.234.20.24 | www.3dmeibang.com |
23.234.20.24 | www.3qsf.com |
23.234.20.24 | www.418sf.in |
23.234.20.24 | www.425sf.com |
23.234.20.24 | www.44dy.com |
23.234.20.24 | www.45195.com |
23.234.20.24 | www.34ok.com |
23.234.20.24 | www.8cq.cc |
23.234.20.24 | www.45bang.com |
23.234.20.24 | 34ok.com |
23.234.20.24 | www.45hs.com |
23.234.20.24 | www.4nic-dy.com |
23.234.20.24 | www.500sf.com |
23.234.20.24 | www.51sf.com |
23.234.20.24 | www.52058.com |
23.234.20.24 | www.520cq.com |
23.234.20.24 | www.520jy.com |
23.234.20.24 | zhaosf.hsdbm.com |
23.234.20.24 | www.523sf.com |
23.234.20.24 | www.523u.com |
23.234.20.24 | www.531U.com |
23.234.20.24 | www.533ok.com |
23.234.20.24 | www.53sf.com |
23.234.20.24 | www.53uc.com |
23.234.20.24 | www.53w.com.cn |
23.234.20.24 | www.54ss.net |
23.234.20.24 | www.pk920.com |
23.234.20.24 | www.55z5.com |
23.234.20.24 | www.565sf.com |
23.234.20.24 | www.56ss.com |
23.234.20.24 | cdchuanghui.com |
23.234.20.24 | www.57591.com |
23.234.20.24 | www.57f.com |
23.234.20.24 | www.57fg.com |
23.234.20.24 | www.57ww.com |
23.234.20.24 | www.5800sf.com |
23.234.20.24 | www.58sf.com |
23.234.20.24 | www.58uc.com |
23.234.20.24 | www.5index.net |
23.234.20.24 | www.5qu.com |
23.234.20.24 | www.64pk.com |
23.234.20.24 | www.6645.com |
23.234.20.24 | www.666sf.com |
23.234.20.24 | www.676711.com |
23.234.20.24 | www.677g.com |
23.234.20.24 | www.67m2.com |
23.234.20.24 | www.686f.com |
23.234.20.24 | www.697sf.com |
23.234.20.24 | www.6cq.cc |
23.234.20.24 | www.73sf.com |
23.234.20.24 | www.75sf.cn |
23.234.20.24 | www.777gm.com |
23.234.20.24 | www.77d8.com |
23.234.20.24 | www.77kl.com |
23.234.20.24 | www.79j.com |
23.234.20.24 | www.7j773.com |
23.234.20.24 | www.7uc.com |
23.234.20.24 | www.80845.com |
23.234.20.24 | www.812315.com |
23.234.20.24 | www.81267.com |
23.234.20.24 | www.81fu.com |
23.234.20.24 | www.823f.com |
23.234.20.24 | www.82506.com |
23.234.20.24 | www.860572.com |
23.234.20.24 | www.860580.com |
23.234.20.24 | www.87sf.com |
23.234.20.24 | www.8845.com |
23.234.20.24 | www.88845.com |
23.234.20.24 | www.88858.com |
23.234.20.24 | www.89176.com |
23.234.20.24 | www.8aa.com |
23.234.20.24 | www.8uc.com |
23.234.20.24 | www.900hj.com |
23.234.20.24 | www.909f.com |
23.234.20.24 | www.9100sf.com |
23.234.20.24 | www.915301.com |
23.234.20.24 | www.91545.com |
23.234.20.24 | www.91ff.com |
23.234.20.24 | www.91wuc.com |
23.234.20.24 | www.920666.com |
23.234.20.24 | www.920gg.com |
23.234.20.24 | www.920sf.com |
23.234.20.24 | www.923u.com |
23.234.20.24 | www.92fu.com |
23.234.20.24 | www.92ww.com |
23.234.20.24 | www.93sf.com |
23.234.20.24 | www.94432.com |
23.234.20.24 | www.95sf.com |
23.234.20.24 | www.96645.com |
23.234.20.24 | www.9800sf.com |
23.234.20.24 | www.980cq.com |
23.234.20.24 | www.99964.com |
23.234.20.24 | www.999hj.com |
23.234.20.24 | www.999wg.net |
23.234.20.24 | www.99a.com |
23.234.20.24 | www.99ji.com |
23.234.20.24 | www.99pk.com |
23.234.20.24 | www.apbfhl.com |
23.234.20.24 | www.aifugu.com |
23.234.20.24 | www.33pk.com |
23.234.20.24 | 33pk.com |
23.234.20.24 | www.bjhdshengda.com |
23.234.20.24 | www.bjtdyz.com |
23.234.20.24 | www.bsfzjx.com |
23.234.20.24 | www.bsrcsc.com |
23.234.20.24 | www.cnycta.com |
23.234.20.24 | www.cq45.com |
23.234.20.24 | www.cq91530.com |
23.234.20.24 | www.cqy6.com |
23.234.20.24 | www.csrxj.com |
23.234.20.24 | www.cy4f.com |
23.234.20.24 | www.fy371.com |
23.234.20.24 | www.gm888.com |
23.234.20.24 | www.gxxgy.com |
23.234.20.24 | www.gzxing.com |
23.234.20.24 | www.heli-cn.com |
23.234.20.24 | www.hnyuhai.com |
23.234.20.24 | www.hstztc.com |
23.234.20.24 | www.hwhaosf.com |
23.234.20.24 | www.7000uc.com |
23.234.20.24 | www.ksd777.com |
23.234.20.24 | www.laisf.com |
23.234.20.24 | www.laohaosf.com |
23.234.20.24 | www.lovewg.com |
23.234.20.24 | www.luckysz.com |
23.234.20.24 | www.mai101.com |
23.234.20.24 | www.mikating.com |
23.234.20.24 | www.mtv110.com |
23.234.20.24 | www.nj-row.com |
23.234.20.24 | www.nybxm.com |
23.234.20.24 | www.ocerlight.com |
23.234.20.24 | www.oksf.net |
23.234.20.24 | www.pk123.com |
23.234.20.24 | www.plinm.com |
23.234.20.24 | www.qiqi530.com |
23.234.20.24 | www.qzrt.com |
23.234.20.24 | www.recairen.com |
23.234.20.24 | www.rexuesf.in |
23.234.20.24 | www.sf0058.com |
23.234.20.24 | www.sf1003.com |
23.234.20.24 | www.sf17.com |
23.234.20.24 | www.sf176.com |
23.234.20.24 | www.sf215.com |
23.234.20.24 | www.sf222.com |
23.234.20.24 | www.sf231.com |
23.234.20.24 | www.sf29.com |
23.234.20.24 | www.sf30.com |
23.234.20.24 | www.sf520.com.cn |
23.234.20.24 | www.sf555.com |
23.234.20.24 | www.sf5858.com |
23.234.20.24 | www.sf63.com |
23.234.20.24 | www.sf777.com |
23.234.20.24 | www.sf8500.com |
23.234.20.24 | www.sf92045.com |
23.234.20.24 | www.sf930.com |
23.234.20.24 | www.sf99.com |
23.234.20.24 | www.shaibar.com |
23.234.20.24 | www.shamandi.com |
23.234.20.24 | www.ksjxyy.com |
23.234.20.24 | www.sktpcbic.com |
23.234.20.24 | www.stkj66.com |
23.234.20.24 | www.tj-aote.com |
23.234.20.24 | www.haosf999.com |
23.234.20.24 | www.wan45.com |
23.234.20.24 | www.whjdwxw.com |
23.234.20.24 | www.whlinuo.com |
23.234.20.24 | www.worldkcc.com |
23.234.20.24 | www.wtcqsf.com |
23.234.20.24 | www.xiaomeisf.com |
23.234.20.24 | www.xihaihotel.com |
23.234.20.24 | www.xindudu.com |
23.234.20.24 | www.xinganchem.com |
23.234.20.24 | www.ovytgnby.com |
23.234.20.24 | www.xinsf.com |
23.234.20.24 | www.yeschongcao.com |
23.234.20.24 | www.ynyeer.com |
23.234.20.24 | www.ysguandao.com |
23.234.20.24 | www.yxzhidao.com |
23.234.20.24 | www.zhaochenmo.com |
23.234.20.24 | www.zhaofg.com |
23.234.20.24 | www.zhaohaosf.net |
23.234.20.24 | www.zhaokf.com |
23.234.20.24 | www.zhaosf88.com |
23.234.20.24 | www.zhaoss.com |
23.234.20.24 | www1.pk123.com |
23.234.20.24 | www10.138sf.com |
23.234.20.24 | xiaomeisf.com |
23.234.20.24 | xinsf.com |
23.234.20.24 | www.500ok.com |
23.234.20.24 | www.wancm.com |
23.234.20.24 | jjj.la |
23.234.20.24 | zhaochenmo.com |
23.234.20.24 | zuhukang.com |
23.234.20.24 | www.shangkequ.com |
23.234.20.24 | www.9527cqsf.com |
23.234.20.24 | www.tjtuliao.com |
23.234.20.24 | www.szplas.com |
23.234.20.24 | www.hlxyx.com |
23.234.20.24 | www.012sf.com |
23.234.20.24 | www.zhaosf.cc |
23.234.20.24 | www.07sf.com |
23.234.20.24 | www.duoduosf.com |
23.234.20.24 | www.sf66666.com |
23.234.20.24 | www.my7su.com |
23.234.20.24 | www.725sf.com |
23.234.20.24 | 725sf.com |
23.234.20.24 | www.96sf.com |
23.234.20.24 | www.pk196.com |
23.234.20.24 | www.letanju.com |
23.234.20.24 | 50ss.com |
23.234.20.24 | www.50ss.com |
23.234.20.24 | sfdawang.com |
23.234.20.24 | taocq.com |
23.234.20.24 | www.73uu.com |
23.234.20.24 | www.taocq.com |
23.234.20.24 | www.30uc.com |
23.234.20.24 | www.nz999.net |
23.234.20.24 | www.ww45.com |
23.234.20.24 | www.xt-dz.com |
23.234.20.24 | www.pk99.com |
23.234.20.24 | www.1e2w.cn |
23.234.20.24 | 8845.678uc.com |
23.234.20.24 | cq.3q33.com |
23.234.20.24 | www.baojingqi.net |
23.234.20.24 | www.didihc.com |
23.234.20.24 | www.bangnijie.com |
23.234.20.24 | www.chenmo.cc |
23.234.20.24 | www.sina35.com |
23.234.20.24 | www.175sf.com |
23.234.20.24 | sf123.cc |
23.234.20.24 | www.shfiro.com |
23.234.20.24 | bjyocy.com |
23.234.20.24 | www.pochanlawyer.com |
23.234.20.24 | www.138sf.cc |
23.234.20.24 | 99pk.com |
23.234.20.24 | www.22cq.com |
23.234.20.24 | www.888ww.com |
23.234.20.24 | www.2sifu.com |
23.234.20.24 | wvw.uc99.com |
23.234.20.24 | 123.uc99.com |
23.234.20.24 | 999ok.com |
23.234.20.24 | www.sf99.cc |
23.234.20.24 | www.80sf.com |
23.234.20.24 | www.33221.com |
23.234.20.24 | www.pk9090.com |
23.234.20.24 | pk9090.com |
23.234.20.24 | www2.uc88.com |
23.234.20.24 | www3.uc88.com |
23.234.20.24 | www4.uc88.com |
23.234.20.24 | 88845.com |
23.234.20.24 | www.sf9.com |
23.234.20.24 | www.700sf.com |
23.234.20.24 | 920gg.com |
23.234.20.24 | www.23c.com |
23.234.20.24 | www.021sx.com |
23.234.20.24 | www.sf78.com |
23.234.20.24 | www.qjfang.cn |
23.234.20.24 | 23c.com |
23.234.20.24 | www.yaofg.com |
23.234.20.24 | www.07ket.com |
23.234.20.24 | www.17hhg.com |
23.234.20.24 | www.46cq.com |
23.234.20.24 | www.wan345.com |
23.234.20.24 | www.htlq.com |
23.234.20.24 | www.nbkst.com |
23.234.20.24 | www.meishipai.com |
23.234.20.24 | www.987pk.com |
23.234.20.24 | www.weisf.com |
23.234.20.24 | www.baqisf.com |
23.234.20.24 | www.91530.com |
23.234.20.24 | www.zhaohaosf.com |
23.234.20.24 | www.s400.com |
23.234.20.24 | www.aichenmo.com |
23.234.20.24 | www.sf315.com |
23.234.20.24 | 425sf.com |
23.234.20.24 | www.23gg.com |
23.234.20.24 | yaofg.com |
23.234.20.24 | www.44woool.com |
23.234.20.24 | www.17166.com |
23.234.20.24 | www.wt789.com |
23.234.20.24 | www.591maimai.com |
23.234.20.24 | www.gggsf.com |
23.234.20.24 | www.cecri.com |
23.234.20.24 | www.cnpxba.com |
23.234.20.24 | www.cqrcxx.com |
23.234.20.24 | www.zhaowt.net |
23.234.20.24 | 3000ak.com |
23.234.20.24 | www.3000ak.com |
23.234.20.24 | 027gg.net |
23.234.20.24 | www.85sf.com |
23.234.20.24 | www.cnxinghang.com |
23.234.20.24 | www.sf19.com |
23.234.20.24 | www.uc600.com |
23.234.20.24 | www.255uc.com |
23.234.20.24 | 255uc.com |
23.234.20.24 | 111.kaihu365.com |
23.234.20.24 | www.3000ok-1.com |
23.234.20.24 | www.3000ok.com |
23.234.20.24 | www.sf588.com |
23.234.20.24 | www.jjj3000ok.com |
23.234.20.24 | 1000ok.com |
23.234.20.24 | www.666923.com |
23.234.20.24 | www.920313.com |
23.234.20.24 | www.616st.com |
23.234.20.24 | www.53my.com |
23.234.20.24 | www.945176.net |
23.234.20.24 | www.999sf.cc |
23.234.20.24 | 933gg.com |
23.234.20.24 | haosf.com |
23.234.20.24 | www.haosf.com.cn |
23.234.20.24 | tg.cnm78.com |
23.234.20.24 | www.1213sf.com |
23.234.20.24 | www.678sf.com |
23.234.20.24 | www.250sf.com |
23.234.20.24 | www.92188.com |
23.234.20.24 | 888.hyds888.com |
23.234.20.24 | www.646sf.com |
23.234.20.24 | www.82cq.com |
23.234.20.24 | sf99.cc |
23.234.20.24 | www.50ww.com |
23.234.20.24 | sf590.com |
23.234.20.24 | www.sf590.com |
23.234.20.24 | www.35fg.com |
23.234.20.24 | www.sf526.com |
23.234.20.24 | www.18ux.com |
23.234.20.24 | www.520cq.net |
23.234.20.24 | www.haosf12345.com |
23.234.20.24 | sf22.com |
23.234.20.24 | pk99.com |
23.234.20.24 | 79j.com |
23.234.20.24 | 55sf.com |
23.234.20.24 | www.55sf.com |
23.234.20.24 | www.zm63.com |
23.234.20.24 | 926.syslx.com |
23.234.20.24 | 1000ok.cc |
23.234.20.24 | www.1000ok.cc |
23.234.20.24 | 3000ok.isosf.com |
23.234.20.24 | 3000ok.com |
23.234.20.24 | tt.syslx.com |
23.234.20.24 | www.zhaofq.com |
23.234.20.24 | 2013.cqmdl.com |
23.234.20.24 | www.19fu.com |
23.234.20.24 | 19fu.com |
23.234.20.24 | www.zhaosifu.com |
23.234.20.24 | www.kom999.com |
23.234.20.24 | www.ok777.com |
23.234.20.24 | www.757sf.com |
23.234.20.24 | www.50999.com |
23.234.20.24 | 33345.com |
23.234.20.24 | 999zg.com |
23.234.20.24 | www.13ss.com |
23.234.20.24 | www.520zf.com |
23.234.20.24 | 88pk.com |
23.234.20.24 | www.990yx.com |
23.234.20.24 | www.cqacura.com |
23.234.20.24 | www.tldsny.com |
23.234.20.24 | www.wzggwz.com |
23.234.20.24 | www.tjnhey.com |
23.234.20.24 | www.51friends.com |
23.234.20.24 | aa.707wz.com |
23.234.20.24 | www.cn-skf.com |
23.234.20.24 | www.6sf.com |
23.234.20.24 | www.jianfeixy.com |
23.234.20.24 | www.shkingdu.com |
23.234.20.24 | www.707wz.com |
23.234.20.24 | www.suoyinm.com |
23.234.20.24 | www.zcmeter.com |
23.234.20.24 | www.115book.com |
23.234.20.24 | 9kst.com |
23.234.20.24 | 9u.7080st.com |
23.234.20.24 | www.118uc.om |
23.234.20.24 | www.haofwd.com |
23.234.20.24 | www.zhaowoool.com |
23.234.20.24 | www.gdhttz.com |
23.234.20.24 | www.fzdbdz.com |
23.234.20.24 | www.tianguhotel.com |
23.234.20.24 | www.chinahjly.com |
23.234.20.24 | tgaxved8.com |
23.234.20.24 | 5a189.com |
23.234.20.24 | www.wuwoool.com |
23.234.20.24 | www.shitongdg.com |
23.234.20.24 | www.sbqcssf.com |
23.234.20.24 | www.51cssf.net.cn |
23.234.20.24 | www.65535cs.com |
23.234.20.24 | zhao.559woool.com |
23.234.20.24 | www.559woool.com |
23.234.20.24 | www.5sdl.com |
23.234.20.24 | www.dandong-window.com |
23.234.20.24 | www.xinyumen.com |
23.234.20.24 | www.ahzhishang.com |
23.234.20.24 | www.xd163.com |
23.234.20.24 | www.trm-china.com |
23.234.20.24 | www.aoyue168.com |
23.234.20.24 | www.gdcable.com |
23.234.20.24 | www.zhuwulong.com |
23.234.20.24 | www.szjapson.com |
23.234.20.24 | www.swan-storage.com |
23.234.20.24 | www.cseptc.com |
23.234.20.24 | www.zcgddz.com |
23.234.20.24 | www.dycssf.com |
23.234.20.24 | www.9965478.com |
23.234.20.24 | www.jshgzb.com |
23.234.20.24 | www.qd-qinggang.com |
23.234.20.24 | gzgm.27pyki.com |
23.234.20.24 | www.hcs888.com |
23.234.20.24 | www.woool578.com |
23.234.20.24 | www.jntex.com |
23.234.20.24 | 917wool.cn |
23.234.20.24 | chuanqifj.com |
23.234.20.24 | www.lqgz.com |
23.234.20.24 | www.suwoool.com |
23.234.20.24 | www.45ci.com |
23.234.20.24 | www.sdyjt.com |
23.234.20.24 | www1.bai12.com |
23.234.20.24 | www.889cs.com |
23.234.20.24 | www.cjphb.com |
23.234.20.24 | www.szosun.com |
23.234.20.24 | www.garment5.com |
23.234.20.24 | www.gm66.com |
23.234.20.24 | www.com15.com |
23.234.20.24 | www.emc120.com |
23.234.20.24 | ktjia.com |
23.234.20.24 | www.05woool.com |
23.234.20.24 | www.cnsjjs.com |
23.234.20.24 | www.jnxsfr.com |
23.234.20.24 | www.99cishan.com |
23.234.20.24 | 44woool.com |
23.234.20.24 | www.mm886.net |
23.234.20.24 | zhaosf.com |
23.234.20.24 | www.shyssteel.com |
23.234.20.24 | www.ywool.com |
23.234.20.24 | www.hao123woool.com |
23.234.20.24 | aixin168.com |
23.234.20.24 | www.wooolfbw.com |
23.234.20.24 | www.525pc.com |
23.234.20.24 | www.zhaowooolsf.com |
23.234.20.24 | www.cn-tyn.com |
23.234.20.24 | www.917wool.cn |
23.234.20.24 | www.hy225.com |
23.234.20.24 | www.10gamer.com |
23.234.20.24 | www.zv2o.com |
23.234.20.24 | www.411wed.com |
23.234.20.24 | www.lewoool.com |
23.234.20.24 | gtcc2008.com |
23.234.20.24 | 945pk.com |
23.234.20.24 | pk777.com |
23.234.20.24 | www.168gamer.com |
23.234.20.24 | new.guguyu.com |
23.234.20.24 | web.longhoo.net |
23.234.20.24 | www.8090yxs.com |
23.234.20.24 | aszt.6268.com |
23.234.20.24 | kf.07073.com |
23.234.20.24 | www.mcncc.com |
23.234.20.24 | www.wudijz.com |
23.234.20.24 | lhzs.9377.com |
23.234.20.24 | lhzs.37wan.com |
23.234.20.24 | lhzs.yaowan.com |
23.234.20.24 | lhzs.49you.com |
23.234.20.24 | lhzs.8090yxs.com |
23.234.20.24 | wz.49you.com |
23.234.20.24 | wz.6711.com |
23.234.20.24 | asqx.yaowan.com |
23.234.20.24 | www.sifucun.com |
23.234.20.24 | bbs.to4f.com |
23.234.20.24 | www.pg666.cn |
23.234.20.24 | www.yeyoubbs.com |
23.234.20.24 | www.ucwawa.com |
23.234.20.24 | www.hgyouxi.net |
23.234.20.24 | www.xiaolou8.com |
23.234.20.24 | bbs.houdao.com |
23.234.20.24 | www.iopq.com |
23.234.20.24 | wangyesifu.com |
23.234.20.24 | ok1399.com |
23.234.20.24 | www.wy090.com |
23.234.20.24 | www.yx315.net |
23.234.20.24 | www.yrabc.com |
23.234.20.24 | 67uc.com |
23.234.20.24 | www.yxsjqk.com |
23.234.20.24 | www.wangyesifu.com |
23.234.20.24 | bbs.games.qq.com |
23.234.20.24 | www.uc266.com |
23.234.20.24 | www.luanshi.net |
23.234.20.24 | www.180b.com |
23.234.20.24 | www.gamemx.com |
23.234.20.24 | www.9kld.com |
23.234.20.24 | bbs2.99nets.me |
23.234.20.24 | www.to4f.com |
23.234.20.24 | ejxx.jdjy.cn |
23.234.20.24 | www.920520.com |
23.234.20.24 | www.gifts52.com |
23.234.20.24 | www.jjj.com.co |
23.234.20.24 | www.cq200.com |
23.234.20.24 | www.239ok.com |
23.234.20.24 | www.97heji.com |
23.234.20.24 | www.173bt.com |
23.234.20.24 | www.1745.com |
23.234.20.24 | www.96sf.com |
23.234.20.24 | www.sffb.net |
23.234.20.24 | www.5uwl.net |
23.234.20.24 | www.qtgcjx.com |
23.234.20.24 | www.bdqn.net |
23.23 |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
attrib.exe:1236
attrib.exe:1840
attrib.exe:544
attrib.exe:1264
qudongrensheng.dat:1796
cacls.exe:1632
cacls.exe:1040
cacls.exe:1028
cacls.exe:940
cacls.exe:1012 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\hao123_res.tmp (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (13991 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\6330cf46f68cd2c7c40a422626d1cb30[1].png (362 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (753 bytes)
%System%\drivers\etc\protocol (799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\game[1].htm (16716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2014052276129177[1].gif (832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\binglang[1].png (2149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\941pojie[1].htm (438 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.lszwg[2].txt (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\daosu[1].jpg (17388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\soso.hcjd56[1].htm (1201 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2014052276129177[1].gif (832 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\daofeng[1].png (1835 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\yinyue[1].png (4941 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.941pojie[1].txt (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sky25145.hbgyzs[1].htm (1600 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.941pojie[2].txt (519 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tianyi[1].png (3218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6330cf46f68cd2c7c40a422626d1cb30[1].png (1941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\kl[1].gif (4786 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].php (1073 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (13108 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tee5_net_logo[1].jpg (24983 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\miaosha[1].gif (12204 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\longtian[1].jpg (8453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\haobangshou[1].jpg (2195 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\footer[1].jpg (12388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\wangpai[1].jpg (48243 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.lszwg[1].txt (325 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\miaosha[1].png (2498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lingfeng[1].jpg (4462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\click[2].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\mojian[1].jpg (3321 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (326 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xgz[1].jpg (2658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tianlang[1].jpg (24673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgheader[1].gif (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lszwg[1].htm (10245 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\27[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gif008[1].gif (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bgtitle[1].gif (3 bytes)
%System%\drivers\etc\services (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\longshen[1].jpg (18297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\046bt[1].gif (1692 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\style[1].css (3893 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\miaosha[1].gif (12807 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sky25145.hbgyzs[2].htm (1600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\game[1].js (911 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\linggua[1].png (219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic2[1].gif (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gg[1].png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\top[1].png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\shicai[1].png (6215 bytes)
%System%\drivers\etc\lmhosts.sam (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jiaqun[1].htm (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[2].php (682 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style[1].css (258 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\click[1].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (9625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\weihu[1].jpg (10658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jisu[1].png (2769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\zsf[1].gif (10523 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\zsf[1].gif (23271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (753 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[2].txt (406 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (404 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bgnav[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bg[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sansha[1].png (17181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gif008[2].gif (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[2].php (753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA5OWN9L.gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bgh[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jianhun[1].png (1923 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].php (1073 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%System%\drivers\etc\networks (407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qingtian[1].gif (8985 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bg[1].jpg (156378 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\anlong[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\game[2].htm (25649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yds[1].gif (7768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tianxunzhe[1].png (13455 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qijian[1].jpg (61723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jsq[1].png (6514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\046bt[1].gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\soso.hcjd56[1].htm (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic2[1].gif (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cb386.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cj[1].txt (2948 bytes)
C:\b.bat (255 bytes)
%System%\drivers\etc\hosts.ics (17013 bytes)
C:\a.bat (356 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wscntmx" = "D:\\wscntmx.exe" - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: Chinese (Simplified, PRC)
Company Name: Product Name: ?????Product Version: 1.0.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ?????Comments: ??????????(http://www.eyuyan.com)Language: Chinese (Simplified, PRC)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 505655 | 507904 | 4.54078 | 1c4dc59cca6ae500ade9ebe798612e30 |
.rdata | 512000 | 1506782 | 1507328 | 5.373 | 0dfd99a2a8aad8f4c7c920630b83976e |
.data | 2019328 | 242378 | 65536 | 3.50794 | 82da6aa345f8d1ef3605bcb0e0ff8e34 |
.rsrc | 2265088 | 34688 | 36864 | 3.97453 | 4e86e6e868659ba8adafb0cfbc03a990 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://jc.941pojie.com/jiaqun.htm | 125.88.186.134 |
hxxp://jc.941pojie.com/cxbt.txt | 125.88.186.134 |
hxxp://jc.941pojie.com/zy.txt | 125.88.186.134 |
hxxp://jc.941pojie.com/tc.txt | 125.88.186.134 |
hxxp://jc.941pojie.com/ | 125.88.186.134 |
hxxp://jc.941pojie.com/img/gif008.gif | 125.88.186.134 |
hxxp://jc.941pojie.com/css/style.css | 125.88.186.134 |
hxxp://p21.tcdn.qq.com/wpa/images/group.png | |
hxxp://jc.941pojie.com/img/zsf.gif | 125.88.186.134 |
hxxp://jc.941pojie.com/cj.txt | 125.88.186.134 |
hxxp://jc.941pojie.com/img/miaosha.gif | 125.88.186.134 |
hxxp://www.lszwg.com/ | 23.234.40.36 |
hxxp://www.lszwg.com/css/style.css | 23.234.40.36 |
hxxp://jc.941pojie.com/pie.htc | 125.88.186.134 |
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=5076676&show=pic2 | |
hxxp://jc.941pojie.com/img/qingtian.gif | 125.88.186.134 |
hxxp://www.lszwg.com/img/gif008.gif | 23.234.40.36 |
hxxp://jc.941pojie.com/img/yds.gif | 125.88.186.134 |
hxxp://www.lszwg.com/img/zsf.gif | 23.234.40.36 |
hxxp://www.lszwg.com/img/miaosha.gif | 23.234.40.36 |
hxxp://www.lszwg.com/pie.htc | 23.234.40.36 |
hxxp://www.lszwg.com/img/2014052276129177.gif | 23.234.40.36 |
hxxp://www.lszwg.com/img/046bt.gif | 23.234.40.36 |
hxxp://www.lszwg.com/img/bg.gif | 23.234.40.36 |
hxxp://jc.941pojie.com/img/kl.gif | 125.88.186.134 |
hxxp://www.lszwg.com/img/bgheader.gif | 23.234.40.36 |
hxxp://www.lszwg.com/img/bgnav.gif | 23.234.40.36 |
hxxp://www.lszwg.com/img/bgh.gif | 23.234.40.36 |
hxxp://www.lszwg.com/img/gg.png | 23.234.40.36 |
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=5076676&show=pic2&t=z | |
hxxp://oz.cnzz.com/stat.htm?id=5076676&r=http://www.941pojie.com/&lg=en-us&ntime=none&cnzz_eid=455095186-1433777105-http://www.941pojie.com/&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1029977702 | 198.11.132.200 |
hxxp://oz.cnzz.com/stat.htm?id=5076676&r=&lg=en-us&ntime=none&cnzz_eid=369179300-1433777105-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=2004535038 | 198.11.132.200 |
hxxp://www.lszwg.com/img/1.jpg | 23.234.40.36 |
hxxp://www.lszwg.com/img/2.jpg | 23.234.40.36 |
hxxp://all.cnzz.com.danuoyi.tbcache.com/img/pic2.gif | |
hxxp://www.lszwg.com/img/top.png | 23.234.40.36 |
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=3325108&show=pic1 | |
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=34393770 | 42.120.219.171 |
hxxp://www.lszwg.com/img/logo.gif | 23.234.40.36 |
hxxp://jc.941pojie.com/img/weihu.jpg | 125.88.186.134 |
hxxp://www.lszwg.com/img/bgtitle.gif | 23.234.40.36 |
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=3325108&show=pic1&t=z | |
hxxp://oz.cnzz.com/stat.htm?id=3325108&r=&lg=en-us&ntime=none&cnzz_eid=1076296874-1433777109-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=851769781 | 198.11.132.200 |
hxxp://cnzz.mmstat.com/app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8 | 42.120.219.171 |
hxxp://count46.51yes.com/click.aspx?id=460737107&logo=1 | 61.147.124.247 |
hxxp://oz.cnzz.com/stat.htm?id=3325108&r=http://www.941pojie.com/&lg=en-us&ntime=none&cnzz_eid=1649022423-1433777109-http://www.941pojie.com/&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1844789414 | 198.11.132.200 |
hxxp://count46.51yes.com/count1.gif | 61.147.124.247 |
hxxp://jc.941pojie.com/img/2014052276129177.gif | 125.88.186.134 |
hxxp://count46.51yes.com/sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) | 61.147.124.247 |
hxxp://count46.51yes.com/sa.htm?id=460737107&refe=http://www.941pojie.com/&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) | 61.147.124.247 |
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=967329697 | 42.120.219.171 |
hxxp://all.cnzz.com.danuoyi.tbcache.com/img/pic1.gif | |
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1417281194 | 42.120.219.171 |
hxxp://img.webscan.360.cn/status/pai/hash/6330cf46f68cd2c7c40a422626d1cb30 | 220.181.158.213 |
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=702683976 | 42.120.219.171 |
hxxp://zhanzhang.anquan.org/static/common/images/zhanzhang.png | 183.60.243.220 |
hxxp://cnzz.mmstat.com/app.gif?&cna=2KH8DTH0XjQCAcGK9Ofwcxcp | 42.120.219.171 |
hxxp://count26.51yes.com/click.aspx?id=261222598&logo=2 | 61.147.125.67 |
hxxp://count26.51yes.com/count2.gif | 61.147.125.67 |
hxxp://count26.51yes.com/sa.htm?id=261222598&refe=http://soso.hcjd56.com:88/&location=http://sky25145.hbgyzs.com:83/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) | 61.147.125.67 |
hxxp://count46.51yes.com/sa.htm?id=460737107&refe=http://www.lszwg.com/&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) | 61.147.124.247 |
hxxp://jc.941pojie.com/img/046bt.gif | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/yinyue.png | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/jiechi.jpg | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/jsq.png | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/27.png | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/qijian.jpg | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/jianhun.png | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/haobangshou.jpg | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/wangpai.jpg | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/binglang.png | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/mojian.jpg | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/miaosha.png | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/anlong.png | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/tianlang.jpg | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/daosu.jpg | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/jisu.png | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/sansha.png | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/linggua.png | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/daofeng.png | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/shicai.png | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/longshen.jpg | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/tianxunzhe.png | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/lingfeng.jpg | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/longtian.jpg | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/xgz.jpg | 125.88.186.134 |
hxxp://jc.941pojie.com/ico/tianyi.png | 125.88.186.134 |
hxxp://www.941pojie.com/ico/daosu.jpg | 125.88.186.134 |
hxxp://www.941pojie.com/ico/haobangshou.jpg | 125.88.186.134 |
hxxp://www.941pojie.com/ico/anlong.png | 125.88.186.134 |
hxxp://pcookie.cnzz.com/app.gif?&cna=2KH8DTH0XjQCAcGK9Ofwcxcp | 42.120.219.171 |
hxxp://www.941pojie.com/ico/longtian.jpg | 125.88.186.134 |
hxxp://www.941pojie.com/css/style.css | 125.88.186.134 |
hxxp://pub.idqqimg.com/wpa/images/group.png | 103.7.29.190 |
hxxp://www.941pojie.com/img/qingtian.gif | 125.88.186.134 |
hxxp://c.cnzz.com/core.php?web_id=3325108&show=pic1&t=z | 195.27.31.246 |
hxxp://cj.941pojie.com/zy.txt | 125.88.186.134 |
hxxp://www.941pojie.com/ | 125.88.186.134 |
hxxp://www.941pojie.com/ico/wangpai.jpg | 125.88.186.134 |
hxxp://www.941pojie.com/ico/xgz.jpg | 125.88.186.134 |
hxxp://www.941pojie.com/ico/tianlang.jpg | 125.88.186.134 |
hxxp://www.941pojie.com/ico/miaosha.png | 125.88.186.134 |
hxxp://www.941pojie.com/ico/qijian.jpg | 125.88.186.134 |
hxxp://www.941pojie.com/ico/jisu.png | 125.88.186.134 |
hxxp://cj.941pojie.com/tc.txt | 125.88.186.134 |
hxxp://www.941pojie.com/ico/jianhun.png | 125.88.186.134 |
hxxp://pcookie.cnzz.com/app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8 | 42.120.219.171 |
hxxp://www.941pojie.com/ico/tianxunzhe.png | 125.88.186.134 |
hxxp://s85.cnzz.com/stat.php?id=3325108&show=pic1 | 1.99.192.16 |
hxxp://www.941pojie.com/ico/longshen.jpg | 125.88.186.134 |
hxxp://www.941pojie.com/img/2014052276129177.gif | 125.88.186.134 |
hxxp://www.941pojie.com/ico/lingfeng.jpg | 125.88.186.134 |
hxxp://www.941pojie.com/ico/27.png | 125.88.186.134 |
hxxp://www.941pojie.com/img/zsf.gif | 125.88.186.134 |
hxxp://www.941pojie.com/ico/shicai.png | 125.88.186.134 |
hxxp://www.941pojie.com/ico/mojian.jpg | 125.88.186.134 |
hxxp://icon.cnzz.com/img/pic2.gif | 195.27.31.248 |
hxxp://c.cnzz.com/core.php?web_id=5076676&show=pic2&t=z | 195.27.31.246 |
hxxp://www.941pojie.com/pie.htc | 125.88.186.134 |
hxxp://s25.cnzz.com/stat.php?id=5076676&show=pic2 | 1.99.192.16 |
hxxp://www.941pojie.com/img/kl.gif | 125.88.186.134 |
hxxp://www.941pojie.com/img/046bt.gif | 125.88.186.134 |
hxxp://www.941pojie.com/img/yds.gif | 125.88.186.134 |
hxxp://www.941pojie.com/ico/sansha.png | 125.88.186.134 |
hxxp://www.941pojie.com/img/gif008.gif | 125.88.186.134 |
hxxp://icon.cnzz.com/img/pic1.gif | 195.27.31.248 |
hxxp://www.941pojie.com/img/miaosha.gif | 125.88.186.134 |
hxxp://www.941pojie.com/ico/yinyue.png | 125.88.186.134 |
hxxp://www.941pojie.com/ico/binglang.png | 125.88.186.134 |
hxxp://www.941pojie.com/img/weihu.jpg | 125.88.186.134 |
hxxp://www.941pojie.com/ico/jsq.png | 125.88.186.134 |
hxxp://www.941pojie.com/ico/daofeng.png | 125.88.186.134 |
hxxp://cj.941pojie.com/cxbt.txt | 125.88.186.134 |
hxxp://www.941pojie.com/ico/linggua.png | 125.88.186.134 |
sky25145.hbgyzs.com | 115.231.174.114 |
soso.hcjd56.com | 115.231.174.114 |
941pojie.meibu.net | 110.28.187.170 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /click.aspx?id=460737107&logo=1 HTTP/1.1
Accept: */*
Referer: hXXp://soso.hcjd56.com:88/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count46.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:20 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Type: text/html; charset=gb2312
Content-Length: 1777
..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(endstr==-1) endstr=document.cookie.length;return document.cookie.substring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.length;var clen=document.cookie.length;var i=0;var j;while(i<clen) {j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=document.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..function cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*36000;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=0; expires=" y_e.toGMTString() "; path=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_count");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' escape(document.location) '&color=' screen.colorDepth 'x&resolution=' screen.width 'x' screen.height '&returning=' cc_k() '&language=' navigator.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('<a href="hXXp://countt.51yes.com/index.aspx?id=460737107" target=_blank><img width=20 height=20 border=0 hspace=0 vspace=0 src=
<<< skipped >>>
GET /sa.htm?id=460737107&refe=http://VVV.941pojie.com/&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://soso.hcjd56.com:88/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count46.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:23 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Length: 0
....
GET /sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://soso.hcjd56.com:88/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count46.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:23 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Length: 0
HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:25:23 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Control: private..Content-Length: 0..
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 36800
Content-Type: text/html
Content-Location: hXXp://VVV.lszwg.com/index.html
Last-Modified: Mon, 08 Jun 2015 04:50:11 GMT
Accept-Ranges: bytes
ETag: "ec292b9aa6a1d01:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:11 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />..<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />..<title>941......-........-VVV.941pojie.com</title>..<meta name="keywords" content="..................................,............941........941..........">..<meta name="description" content="941......,......................................,........,....................">..<link href="css/style.css" rel="stylesheet" type="text/css" />..<link href="css/style.css" rel="stylesheet" type="text/css" />..<style type="text/css">..<!--...down td { font-family: Arial, Helvetica, sans-serif; height: 24px; line-height: 24px; padding-left: 5px; }...down img { width: 87px; height: 24px; border: 0 }...STYLE1 { color: #FF0000 }...STYLE2 { color: #00FFFF }...STYLE3 { color: #FF0000; font-weight: bold; }...STYLE4 { color: #0000FF }...STYLE5 { color: #FF3300 }...STYLE6 { color: #315500 }...STYLE7 { color: #FFFFFF }...gf2 { font-family: "...."; font-size: 18px; font-weight: bold; color: #BD0000; float: right; line-height: 33px; }...gf3 { font-family: "...."; font-size: 18px; font-weight: bold; color: #BD0000; float: left; line-height: 33px; }...tp { background: url(img/zs.gif) repeat-y; overflow: hidden }...lf { float: left; }...rg { float: right; }..
<<< skipped >>>
GET /img/gif008.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 565
Content-Type: image/gif
Content-Location: hXXp://VVV.lszwg.com/img/gif008.gif
Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT
Accept-Ranges: bytes
ETag: "05c92394b7cf1:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:12 GMT
GIF89a ..........R.......!..NETSCAPE2.0.....!.......,.... ....._....m...PZ.D.6.N...}Q)....M..1@.i,.....|.... ..K.v.....-yJ.R6;....Tx...Y Y5i......i...9......F..!.......,.... ....._........PZ.D.6.N...}Q)....M..1@.i,.....|.... ..K.v.....-yJ.R6;....Tx...Y Y5i......i...9.....|E..!.......,.... .....`........PZ.D.6.N...}Q).......1@.i..KF....m.<..h..0.d..U....Q6S..U.5..r...R9i....[....r1.a.7......!.......,.... ....._........PZ.D.6.N...}Q)....M..1@.i,.....|.... ..K.v.....-yJ.R6;....Tx...Y Y5i......i...9.....|E..!.3Reduced 73% @ VVV.raspberryhill.com/gifwizard.html..;....
GET /img/zsf.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 85308
Content-Type: image/gif
Content-Location: hXXp://VVV.lszwg.com/img/zsf.gif
Last-Modified: Thu, 14 Aug 2014 07:47:38 GMT
Accept-Ranges: bytes
ETag: "089c3494b7cf1:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:12 GMT
GIF89a..Z....9Z.(\.,e.4i.<`.Lr.Uv.Gk.Ae.:s. f.5j.;r.4k..l.,h.4m.8n.2m.1g..p..q.5p.9q.=x.4s.;u.6x.<x.5u.:v.6x.:y.Lu.Bn.Bt.Dw.Q{.Qw.Eu.Hv.Dy.J{.@v.Iu.D|.I}.R}.C~.H..Y..f..r..v..l..w..i..z..E..L..M..Y..U..\..R..Y..T..[..S..\..Z..C..K..M..N..P..S..X..P..Y..M..N..T..\..^..R..Z..^..e..a..h..d..c..k..e..l..k..q..t..y..v..`..b..i..d..j..`..k..a..s..y.._..^..l..t..{..{..l..d..j..j..t..{..u..|..t..z..u..y..~..v..|.....~.............................................................................................................................................................................................................................................................................................................................................................................CWz!.......!..NETSCAPE2.0.....,......Z......9....8..."<H..6....4.."...1b.hp.G...U...d... n....H...}.H...o8.e{.......=...g.......Si..B.=.:..P......S.R......S.2....Sw..P..v..9.(..S..-J.....r.{.8.N...g..m.....'..-n.l;....x..l.!C.)...i.7cN.m....q&.M;.3..W...[&hh....-<8...qos.:8.m.o.|.M.u...O.........gk..Z..'..7.pZ....^l).f.....t.......tRC..._H$...}.zd.I.m.........N....Z....b..5....x&.g"A. d...\..A..'".".TcA..h.C...S......7.y..7....I..d.KF9..U*.%.O.)..\~.e.^.i&.\N...d...!.$..cT9..`.$C...9..c.:......L.y.......L..0.h..*.h..:..".VZ)....i2...).........."..\.j..(..%...L"...H2......F.*,.......J.%.n.....b.".,.k".*..%.h....^.........,.M..$.H&......$.. . r.%...H..L.l"q...".[r.%.3.p.q2....S....X.1..ol.....g..../"...2"F....5.L..8..3.H....<..3.8.@..6
<<< skipped >>>
GET /pie.htc HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Content-Length: 1308
Content-Type: text/html
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:13 GMT
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "hXXp://VVV.w3.org/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>............</TITLE>..<META HTTP-EQUIV="Content-Type" Content="text/html; charset=GB2312">..<STYLE type="text/css">.. BODY { font: 9pt/12pt .... }.. H1 { font: 12pt/15pt .... }.. H2 { font: 9pt/12pt .... }.. A:link { color: red }.. A:visited { color: maroon }..</STYLE>..</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>..<h1>............</h1>....................................................<hr>..<p>................</p>..<ul>..<li>........................................................</li>..<li>..................................................................................</li>..<li>....<a href="javascript:history.back(1)">....</a>....................</li>..</ul>..<h2>HTTP .... 404 - ..................<br>Internet ........ (IIS)</h2>..<hr>..<p>..............................</p>..<ul>..<li>.... <a href="hXXp://go.microsoft.com/fwlink/?linkid=8180">Microsoft ............</a>..........“HTTP”..“404”........</li>..<li>....“IIS ....”...... IIS ...... (inetmgr) ........................“........”..“............”..“..................”........</li>..</ul>..</TD><
<<< skipped >>>
GET /img/2014052276129177.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 832
Content-Type: image/gif
Content-Location: hXXp://VVV.lszwg.com/img/2014052276129177.gif
Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT
Accept-Ranges: bytes
ETag: "05c92394b7cf1:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:13 GMT
GIF89aX..................!..copyright. 1996 Charles H. Tupper All rights reserved. not to be used on another graphics download site or on software. All other uses permitted. hXXp://VVV.cyberspace.com/tup.!..NETSCAPE2.0.....!.......,....X.....*.............0....H.........6.L........? ..!.......,%...j...................<....H............!.......,W...j...................<....H............!.......,....j...................<....H............!.......,....j...................<....H............!.......,....j...................<....H............!.......,....X.....*..................H...........L.........(..!.......,1.........!..................H...........L...!.......,c.........!..................H...........L...!.......,..........!..................H...........L...!.......,....X.....)................n.H...........L.......>S..;....
GET /img/046bt.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 6215
Content-Type: image/gif
Content-Location: hXXp://VVV.lszwg.com/img/046bt.gif
Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT
Accept-Ranges: bytes
ETag: "05c92394b7cf1:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:13 GMT
GIF89aK....!......U.......$..$U.$..$..I..IU.I..I..m..mU.m..m......U...........U...........U...........U......$..$.U$..$..$$.$$U$$.$$.$I.$IU$I.$I.$m.$mU$m.$m.$..$.U$..$..$..$.U$..$..$..$.U$..$..$..$.U$..$..I..I.UI..I..I$.I$UI$.I$.II.IIUII.II.Im.ImUIm.Im.I..I.UI..I..I..I.UI..I..I..I.UI..I..I..I.UI..I..m..m.Um..m..m$.m$Um$.m$.mI.mIUmI.mI.mm.mmUmm.mm.m..m.Um..m..m..m.Um..m..m..m.Um..m..m..m.Um..m.......U.......$..$U.$..$..I..IU.I..I..m..mU.m..m......U...........U...........U...........U...........U.......$..$U.$..$..I..IU.I..I..m..mU.m..m......U...........U...........U...........U...........U.......$..$U.$..$..I..IU.I..I..m..mU.m..m......U...........U...........U...........U...........U.......$..$U.$..$..I..IU.I..I..m..mU.m..m......U...........U...........U...........U......!..NETSCAPE2.0.....!.......,....K..........H......*\......#J.H..@`.1.$...9r....7..........cI........1........Ar.^.#...A0AR....]L.K......Ux..!#.u$ ..........-..|.`f........ )R....I./1..A.(... .R..ML..>|.....u.HP.J....s..*3.d..&.v....FO22.N...I.0A.4........r.R.........Q.{`..{..n-p21t'.~4....@*..o...#)d..Q.n2.A.@....J<.r.....{`..!...|..'^Xh.5[r....K..T.r..4. .......f\X.....e..QJPa..A....GC.(".fU...mEe.ZK.FHf|.x..A.U!.a...J,iD.bo..]P.l...@...}$.(..3.W.MK.w.w..gV...&.._...A.EG.B....}.t...J..P..1..L`.....6....F...!.......,....K..........H......*\......#J.H..@0.2.....1``.%.E.#1r.......(...m.(0#I..<.$........C...I@:I....&.....l...O.:..C.. :.......).. ........H.b.8..V..H.$G.-I.f...*p%).Uk....%9.Z..........:...%..,I..L.......%...O.....jw......;..
<<< skipped >>>
GET /img/bg.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 1065
Content-Type: image/gif
Content-Location: hXXp://VVV.lszwg.com/img/bg.gif
Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT
Accept-Ranges: bytes
ETag: "05c92394b7cf1:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:13 GMT
GIF89a..................f..3..............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3..............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3..............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...f..f..f..f.ff.3f..f..f..f..f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3..3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3..............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...f..e..d..a..`..Rn.Je.Id.Gb.Mg.Oi.Qk.Pj.Zw.Vq.^|.Xs.\y.Yt.`}.a~._|.f..Fa.Hc.Kf.Nj.Lg.Pl.So.Vt.Tp.Yv._~.[x.Zw.c..b..^{....!.......,...............H......*\.0..l..J.H......i...c.. C....d.~(S.\..%.m0a.|...M..r.....O............&=.....G.5e..j..X..... ..`........h..]..m..p...;7..r.....W.......L.pa{.. 6.......I.L..e..2k.......A..=.....S.FM.....b..G.....r............;w.... ........I.N.zux..k..];.........|...;....
GET /img/bgheader.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 1978
Content-Type: image/gif
Content-Location: hXXp://VVV.lszwg.com/img/bgheader.gif
Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT
Accept-Ranges: bytes
ETag: "05c92394b7cf1:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:13 GMT
GIF89a.........................a}....BV..........Yu....Rk.^z....Ja.Nf.=P.......... 8[xxxTo.......]x....I_....w..TVU...F[.d........3Ak...9M|............[w....Vq.:Jw......IJK# ESm....e.._{.Uo....b..hhi4EoG]....OUcc.....Ne.........0d.....@R.......Un................jr.6Gs...Ys....]dw............Ys..........o~.............Pe.9Et...DX. <]...Mc..........Xt.........._|.Pi.\i....Nj.......Qg....7Jx...'4Q...Jb........................................Wq.b...................................... (C..................Og....Zx....................................................\y........................................Ph...................w..\a_`ab...1Dk............L_...........................................DS....f..............\u.Kd.~~}...\s.sus>N}......]m.......Ql......................,...............A....Bx.XH.N....@.......3j...... C..I....(S.\.....0c..I....8s...3e...]...a....s.`.....8."....S!.......;v.L1.K....h..].....p...K....x............L...... ....c8.#.A..l...\0..u.R.....104$H..j.......3..m.v...s...........N...... _.......K.N......k..=...:n.........i..O.v.....u..............t...k68...{..........D(...Vh...f....v... .(..$.h..(....,....0.(..4.h..8~H..;..c;.....D.A...B. )...!.uDiC.0L&......T....D...C.......D.A.l....p.)..t.i..x....|......*....j...&....6....F*...Vj..i..............o.I.....H..Dd.S....U..0.E.u...5?x.F... ....k...&....6....F ...Vk...f....v..... ....k.......J....J......k..i..f;D...... ..O...V]Xa..Dx0....1D...b...[.H..w... .,..$.l..(....,....0.,..4.l..8....<....@....D.Mt.H#=..IS....o|...[.K..4c...H....?.%
<<< skipped >>>
GET /img/bgnav.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 3645
Content-Type: image/gif
Content-Location: hXXp://VVV.lszwg.com/img/bgnav.gif
Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT
Accept-Ranges: bytes
ETag: "05c92394b7cf1:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:14 GMT
GIF89aa.N.........................................................................EQ.Tk.Ma.CT.8Fr.$;DU....Un.Un.CW.Xr.@S.Pg.;M}a~.Zt.Tm.Ri.Ne.DW.CW.9Jxb..]x.Qi.H].f..e..d..@R.o}....Xv.c..\z.Yu.Xt.Vq.To.Jb.3Cme..d..c..^{.Zv.Zv.Rl.E[.7Hu5Fqb.._|.Zw.Yv.Xt.Xs.Vp.CX.BV.>Q.`}.^z.^|.Zu.Uo.Tm.I_.AU.Ka.J`.BV.)6U`}.Sg................[z.Le.Kd.Sp.La.{|~.........TVX.................................................................... ..)..2..6..7..>..C..J..S..T..o.............................!..&..&..(.. .. ..,........5..6..9..9..=..>..[..]..]..e..g..m..p..q..|...............................................0..6..G..T..W....................................................................................sqo.................................................................................!.......,....a.N........2d..%4.(....C a..xH... ......... C..h... a:Vq...........H.4:^.8ad...@...J.(..H."m...P.O..e..'..U..$x....'D@.....,h..@.6m..p?..K..].(....e...b.......%..|..C..#)R..<..e..3G.......C.....\('&.Y....&P|d..BE./].x..{..............._.{w...1k....j.W^....F..[b ..1e......7.........O.~|.....2.I.-.....=T.B.DXaDc0..E.b.`....a..f.....vx.. ..a.$.!..(.xC..ZX.......*....O.. .G..C.c........6..0..I6.d..<)..TVI%.On#N...1F......L=...b.Q.-.p..&.....t.i..x....|...&.<2I!.x ..$....)...!.x"...T....f....v....^....x..1...C..f!.....a.,.$..'...H'....... .... J(.......B..1..E...@....2."..B.).| ....k.....n(..B."..2L.t..D.)..C.!x.K)..R.1......'....7....#..*....)..........>.....4.J#.8..*,....0.,..4..r#&......Q..?dPm....H1.<.H1H3...P
<<< skipped >>>
GET /img/bgh.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 5439
Content-Type: image/gif
Content-Location: hXXp://VVV.lszwg.com/img/bgh.gif
Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT
Accept-Ranges: bytes
ETag: "05c92394b7cf1:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:14 GMT
GIF89a.......Wr.Jb.\v.Gb....Id.To.Yt.Pi....Mb....Nh.`}.H^.Fa.Me.Yt.j..Wr.Yv....t..DY.Rk.z..k..^|.Nf.Ys.Nf.Sl.n..m.....a..|.....Ok.^{.q.....Pj.{..Nc....v..^y.Rk.f.....CX.H\.Ri.o..Xo.Un.J`.Qe.f..Vt....Yu.Rj.G\.k..F[.Xo.Pg.CZ.l..Tk.f..d..b..b..a~.c..c..e..d..a..`}._|.c..\x.c.....e..^z.Xs.d..[w.`{.Zv.^{.]y.Kf.Je.b..]z.\y.Yv.Rn.Up.Vq._z.`..`}.[x.Tp.a|.b..Mg._|.So.f.._|.\x.Up._~.Hc.Nj.Zt.[w.a..Lg.Qm.Pl.Uq.Pl.Xs.a~.Hc....Vq.a~.~..Tm.e..Sn....d.....Vr.Mg.Zw.}..Zt.c..p..b..^z.Wr.d.._{.`{.t..Ni.[x.Lf.Vq.Wt.Xs.Vt.Lf.^}....w..x..e..]{.q..Yv.Rm.Zu.b}.Up.[u.e..p..e..[u._{.......]{.Xu....Qm.^{.Kb.b..]|.]x.]z.Rn.Rl.b..Og.c..c.....Ur.c..Sn....l..n..h..u..To.Qh.Pl.......]z.Ld....~..Tm.s..Vo.Zv....g..`~.w..\w.l..x..c~....Xt.Od.y..]y.Qj.K_.b.....Kc.[v....g..f........Rn....`..o.....Vq.......!.......,.............t...C."..).7...#i..Q.D..4......./.......K.x..u.w...X|.0.h.....S.P....M3.pAS.&...vbH.E&.).1....#..G.}s.5MQ.Hg....)E.D.vL..../#..5`.jN.d.|.......S.-.W...U...........eZ..."..I^.XI.461....sF..I..\3....9.T.E.....^.W-../Jh...{.U.................n.../'~.Zv.S...........g.*..y.Sd.g..;z%.....^H<.].'.~.Y...L......h...|....4X...N.`..>...\(......a&v.(.....!.*..H....bzU......P..9.h`.>.h!....a......H..$.?6...Q*4e.U..$.I....@....Y.C..d.h&.a...@A..........uQ'.R..g.|.)..q.Z.......{...".8.&.yFJ...ZJ...(*).......vjj..B..>....@G"....v.:E...* ....k.Z.........Z..c....l..BK...2.,~.2....&k ..z.n..r....*$...:K.T..K ..hQE.T.kG.........o..2r...../..v........`.;...?.o..7.q...L...3...&.|..*....`.{L..t.H.........0.:..3.R.}s...|.4Z....I....M..
<<< skipped >>>
GET /img/gg.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 23328
Content-Type: image/png
Content-Location: hXXp://VVV.lszwg.com/img/gg.png
Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT
Accept-Ranges: bytes
ETag: "05c92394b7cf1:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:14 GMT
.PNG........IHDR.......'.............sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..Z.IDATx^....VG....T.tv..O./s2.y..5..i...A00......j< ........b....2X..l...v.....,6x_0...,6`6.6^.J......s...........O....D.._Fd&U..,.?cL.\..........P.?.).....2...y.......)....o./....E|DK.*4).._L......./?.T.w.....,....7z].Zj..r...\.o..o.?>.y:......c...Bu_...~..|..q...J......s...X.....R..{G[.;.;.....r...OGO....T...........h.ok.....h/E..m@....-...;.G.......9..ON...??......./..e....~..S.......Nz..$.....=..g..S....#..x..?W...,...y.c..8..~.....>..~}..W.t ./.u. .%..c.#.%lY..O...Y|.....N}E.....{.....&O.s....G.#G!.%y...!...0t....C.N...........=.O.......=. .z.~..i......:..l..,...............=w@......}..^....k..w..e..o~.s.7..q.............;X..w'....[..[......lX.|."....R,.N.;G,F.<.....RX.=..a...|.,...a\"3.7...X....^..r..M..x.....T0..g.. .B...i.?BlE.K......_..Mx..............1...c=....o........{.>9..<?.-.1..g...Rr.j.......C.....{..va....:}.....;.._y)cm...I...h...[..z.6.K......1g.......cd,..5..n!.._...g...,....'N..{..$.......B.....'.:G...7!..q../N6......<./.7.V.z.h.0.{.0..?..q.....s.~v....?....t.>@.j-'....o.E.G?w..V....d.....gP......x............O.=D>...D..q....`.w|q.l.....[..^........../OO.../w|...................>...i0.....1.k.U1N#...._._"..s.I._.|..g...O.4... .(>.n.&}..!..b.4.`..N >..!>....8.qs8..R8..M.'.......?..Cxa.6..<..{.....C.w....(..~...KY*..[....|.X@..x...d..'a...7.H.s.<.C.....y...._.:.../a...I^.....c.W<.....<.1y.|..).........'B>...V<.=.4..G.?....YN.&l
<<< skipped >>>
GET /img/1.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Content-Length: 1308
Content-Type: text/html
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:14 GMT
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "hXXp://VVV.w3.org/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>............</TITLE>..<META HTTP-EQUIV="Content-Type" Content="text/html; charset=GB2312">..<STYLE type="text/css">.. BODY { font: 9pt/12pt .... }.. H1 { font: 12pt/15pt .... }.. H2 { font: 9pt/12pt .... }.. A:link { color: red }.. A:visited { color: maroon }..</STYLE>..</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>..<h1>............</h1>....................................................<hr>..<p>................</p>..<ul>..<li>........................................................</li>..<li>..................................................................................</li>..<li>....<a href="javascript:history.back(1)">....</a>....................</li>..</ul>..<h2>HTTP .... 404 - ..................<br>Internet ........ (IIS)</h2>..<hr>..<p>..............................</p>..<ul>..<li>.... <a href="hXXp://go.microsoft.com/fwlink/?linkid=8180">Microsoft ............</a>..........“HTTP”..“404”........</li>..<li>....“IIS ....”...... IIS ...... (inetmgr) ........................“........”..“............”..“..................”........</li>..</ul>..</TD><
<<< skipped >>>
GET /img/2.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Content-Length: 1308
Content-Type: text/html
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:14 GMT
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "hXXp://VVV.w3.org/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>............</TITLE>..<META HTTP-EQUIV="Content-Type" Content="text/html; charset=GB2312">..<STYLE type="text/css">.. BODY { font: 9pt/12pt .... }.. H1 { font: 12pt/15pt .... }.. H2 { font: 9pt/12pt .... }.. A:link { color: red }.. A:visited { color: maroon }..</STYLE>..</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>..<h1>............</h1>....................................................<hr>..<p>................</p>..<ul>..<li>........................................................</li>..<li>..................................................................................</li>..<li>....<a href="javascript:history.back(1)">....</a>....................</li>..</ul>..<h2>HTTP .... 404 - ..................<br>Internet ........ (IIS)</h2>..<hr>..<p>..............................</p>..<ul>..<li>.... <a href="hXXp://go.microsoft.com/fwlink/?linkid=8180">Microsoft ............</a>..........“HTTP”..“404”........</li>..<li>....“IIS ....”...... IIS ...... (inetmgr) ........................“........”..“............”..“..................”........</li>..</ul>..</TD><
<<< skipped >>>
GET /img/top.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 23243
Content-Type: image/png
Content-Location: hXXp://VVV.lszwg.com/img/top.png
Last-Modified: Thu, 14 Aug 2014 07:47:38 GMT
Accept-Ranges: bytes
ETag: "089c3494b7cf1:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:15 GMT
.PNG........IHDR.......F......:\.....bKGD..............pHYs.......... .... .IDATx...{t..}.......nt..J .Q....M.z..-.....5Y..d.h...:.Lv}.MN2..Y....&qv2.x.....8^;.# vlZR2.i..![.@.A..H..A. ..4..zW...]....."myN....QU}..}.......{....F.m..F...H?....F.m..F.q..s.m..F.m...f.m..F.m...C.9..F.m...{.m..F.m..F..1..s.m..F.m...f.m..F.m...C.9..F.m...{.m..F.m..F..1..s.m..F.m...f.m..F.m...C.9..F.m...{.m..F.m..F..x....f.m..F.m....f............6.h...6.$..Q#...?....h..6.h.G.u(.m..F.m..F.?..C.n3.6.h..6.x.Ay....F....&o.qu..p.P..|..O.......(.Y|.Z.d?.......xy...".......n....l_D..X.d....&n.......^..._.Mn%......-.Xg.~..~....Xg......_.7<#...S.W..R....Jb-.....G..D..U]Wm.q% ~..^..88....#........%...W.A.K/.uC.......... KL.....-......................u.g.x..;NA..@$.>...^O~.GJ<D`#.E$w..X....\b....]..O.u..].p....9v..^............*.......G.F.S..*.A].G~..o#..1r.8C.M...w...M...<.........0/...U..g..&...06>.Ek.U.r....c[.$....aX..7_.......-.Z...x.m.R.O..Kl....u...\..'9:4..|......si.....{R@k...U5g....r...,{.ws...*..px.4..M.....4B.-.....-.<....]....K_...."Nj`..5C.)>..........5c1.....1..A..s.. (....}.[........:zo..5=.s..&.;7y#.v.U..e.".........=........-.3...........C.L>.c[....L....g)A.t.|g.u.....\..Q...?.. ......dE.j.-.;..;.i .......8.......q..w..k`G..|.?....g..Y...~......'.._mT.b..j.....E.0~v....n...^.RXV.7...b... ...P(..=y..O_................>.b...;.r.]Y....y.f... ..3c\...|..n..<.....W.6=K....3.Y.0........R.g'.fX........ds....)...7vo[..~...............[S..4?tK.b......._.n...;........n.6.....^.....s..........?}Y.i5..Y.....1
<<< skipped >>>
GET /img/logo.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 4437
Content-Type: image/gif
Content-Location: hXXp://VVV.lszwg.com/img/logo.gif
Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT
Accept-Ranges: bytes
ETag: "05c92394b7cf1:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:15 GMT
GIF89a..F....a..a..b..c..c..d..d..d..d..e..e..e..e..e..f..f..f..f..g..f..g..f..i..m..n..k..p..s..w..t..}..{..|....d..^..j..g..j..l..n..r..s..t..u..u..v..x..y..z..{..|..}..~.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,......F.....#..H.....%.\......#J.H.....!:...... JP.....(S.\9q.I.....xL..r:`....g../=.......H3>P.r`P.C..@.....X.j......`...{u...Q.V%.....Y ...taZ.;......&T.@..1....|.\.......#Kf....$.3K6r.a..X14.C.4i.Yw.........c.p......7..."......>...H......4hd..`..\....V...i..%.....z...3..._...'1b.....}.`h.C.V...u.P..V.........%.,!..A..^*....p..6..YyB.; l..<.YdS.)....,..b3.. ..,..F,*vaK.-.pK..^....UgI.`...*_Y..<.\.AxL.(.;;\..r;P.....(..4.I#...S.09.P..z.b.#...b @:.W..%#.k.E....qh.2.......a.&......X....`..MH.U..f..b.O.c.1..P...L.B..-..B.*..K..a..;...ZW ....]A...V..I*.........t."s....c...m`.M%Vt....h...0B..e....)^...)......)`A\9i%2]a..p.j....!{...Ze.%....k6....6.....fKb...Zn.(..j....."........K3....@\...&A.qNp.m.1p.[..&?.......C...v...!..j.'.
<<< skipped >>>
GET /img/bgtitle.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 3274
Content-Type: image/gif
Content-Location: hXXp://VVV.lszwg.com/img/bgtitle.gif
Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT
Accept-Ranges: bytes
ETag: "05c92394b7cf1:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:15 GMT
GIF89a~.#....Z........W..~..|....Z..=..............B..o}....'|...."`....%T.....q. x..|.....{.......:........... ...|....kM..........!...~....!.........{............. }.... ......x.....{..}.......... ............|....".. }..........G........"......{........z..y..z........\.....M..z....................x....!^.......!...{........T..Y.......m..:........p.....!..<..5........"...L....=o.*K..v..v..y.1.........i.!..... ..H..#....._..o..6..L..N......{.6e.#.."..!..`.. ..l.."~....K.. ............t..K..~....*n.)......L..z....].."..>.."z..y..........8..Q.....-l....bn....Cu.0...|....8..;L....?.. .....G............k.'..<..............\........7..#.....J..Li..o..w....(..*..x..}..m...m.&W....$..%..&..LQ....O~....2u..w....[.....8i.%k.$..&..... .....)........... .........}...........z.... ,....~.#......(.$H[.8l..X......#J.H.....3j...... C..I....(S.\.....0c...h..l..%...]-Cz.<;.....H.*].....P.J.J....X.j......`...K....h..]..j.6...K..S)f.~]{ ........L...... ^......#K.L.....3k.......C..M.....f.KG*..p.$.9......s...........N...... _.......K.N......k....q...L..v..%p.....m.......O...............(....h...&....6....F(...V..mK...;..b.3*H........(....,....0.(..4.h..8....<....@.)..D.i..H&...L6...*.0...\.....p..W.S..O.)..d.i..h....l....p....C,..#.ly..q......*....j....yB=...'9..#...NJi=.f....v.....*....j...............*....j......................J..D>......F ...Vk...f....v..... ....k.............. .....-.\\...= ..=....=..L...'....7....G,...Wl...g....w... .,..$.l..(....,..r...@O.1.../1..3.4....@.-..D.m..H'...L7...PG-..TWm..Xg...
<<< skipped >>>
GET /9.gif?abc=1&rnd=34393770 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Server: Tengine
Date: Mon, 08 Jun 2015 15:25:09 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; expires=Thu, 05-Jun-25 15:25:09 GMT; path=/; domain=.mmstat.com
Set-Cookie: sca=f7c655f7; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=9e4191ae19d103fd53d6abd5_1433777109; expires=Thu, 05-Jun-25 15:25:09 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server: Tengine..Date: Mon, 08 Jun 2015 15:25:09 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; expires=Thu, 05-Jun-25 15:25:09 GMT; path=/; domain=.mmstat.com..Set-Cookie: sca=f7c655f7; path=/; domain=.cnzz.mmstat.com..Set-Cookie: atpsida=9e4191ae19d103fd53d6abd5_1433777109; expires=Thu, 05-Jun-25 15:25:09 GMT; path=/; domain=.cnzz.mmstat.com..Location: http://pcookie.cnzz.com/app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;....
GET /9.gif?abc=1&rnd=967329697 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive
Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; sca=f7c655f7; atpsida=9e4191ae19d103fd53d6abd5_1433777109
HTTP/1.1 302 Found
Server: Tengine
Date: Mon, 08 Jun 2015 15:25:11 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: atpsida=9e4191ae19d103fd53d6abd5_1433777111; expires=Thu, 05-Jun-25 15:25:11 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;....
GET /9.gif?abc=1&rnd=702683976 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive
Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; sca=f7c655f7; atpsida=9e4191ae19d103fd53d6abd5_1433777109
HTTP/1.1 302 Found
Server: Tengine
Date: Mon, 08 Jun 2015 15:25:12 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: atpsida=9e4191ae19d103fd53d6abd5_1433777112; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server: Tengine..Date: Mon, 08 Jun 2015 15:25:12 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: atpsida=9e4191ae19d103fd53d6abd5_1433777112; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.mmstat.com..Location: hXXp://pcookie.cnzz.com/app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..
GET /stat.htm?id=3325108&r=http://VVV.941pojie.com/&lg=en-us&ntime=none&cnzz_eid=1649022423-1433777109-http://VVV.941pojie.com/&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1844789414 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: oz.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine/1.4.6
Date: Mon, 08 Jun 2015 15:25:10 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..
GET /core.php?web_id=5076676&show=pic2&t=z HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 753
Connection: keep-alive
Date: Mon, 08 Jun 2015 15:25:08 GMT
Last-Modified: Mon, 08 Jun 2015 15:25:08 GMT
Expires: Mon, 08 Jun 2015 15:40:08 GMT
Via: cache7.l2de1[313,200-0,M], cache10.l2de1[315,0], cache5.de1[314,200-0,H], cache4.de1[312,0]
Age: 0
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:08 GMT
X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="5076676",c="pic2",d="",e="online_v3.php",f="zs25.cnzz.com",g="1",h="pic",i="z",j="站长统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a href='" q "' target=_blank title='" j "'>" j "</a>",k.createIcon([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: application/javascript..Content-Length: 753..Connection: keep-alive..Date: Mon, 08 Jun 2015 15:25:08 GMT..Last-Modified: Mon, 08 Jun 2015 15:25:08 GMT..Expires: Mon, 08 Jun 2015 15:40:08 GMT..Via: cache7.l2de1[313,200-0,M], cache10.l2de1[315,0], cache5.de1[314,200-0,H], cache4.de1[312,0]..Age: 0..X-Cache: HIT TCP_MEM_HIT dirn:-2:-2..X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:08 GMT..X-Swift-CacheTime: 900..!function(){var p,q,r,a=encodeURIComponent,b="5076676",c="pic2",d="",e="online_v3.php",f="zs25.cnzz.com",g="1",h="pic",i="z",j="站长统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on="
<<< skipped >>>
GET /core.php?web_id=3325108&show=pic1&t=z HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 753
Connection: keep-alive
Date: Mon, 08 Jun 2015 15:25:11 GMT
Last-Modified: Mon, 08 Jun 2015 15:25:11 GMT
Expires: Mon, 08 Jun 2015 15:40:11 GMT
Via: cache16.l2de1[1611,200-0,M], cache4.l2de1[1612,0], cache2.de1[1612,200-0,H], cache4.de1[1441,0]
Age: 0
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:11 GMT
X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="3325108",c="pic1",d="",e="online_v3.php",f="hzs2.cnzz.com",g="1",h="pic",i="z",j="站长统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a href='" q "' target=_blank title='" j "'>" j "</a>",k.createIcon([p])))}();..
GET /core.php?web_id=5076676&show=pic2&t=z HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 753
Connection: keep-alive
Date: Mon, 08 Jun 2015 15:25:08 GMT
Last-Modified: Mon, 08 Jun 2015 15:25:08 GMT
Expires: Mon, 08 Jun 2015 15:40:08 GMT
Via: cache7.l2de1[313,200-0,M], cache10.l2de1[315,0], cache5.de1[314,200-0,M], cache5.de1[316,0]
X-Cache: MISS TCP_REFRESH_MISS dirn:4:436988533
X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:08 GMT
X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="5076676",c="pic2",d="",e="online_v3.php",f="zs25.cnzz.com",g="1",h="pic",i="z",j="站长统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a href='" q "' target=_blank title='" j "'>" j "</a>",k.createIcon([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: application/javascript..Content-Length: 753..Connection: keep-alive..Date: Mon, 08 Jun 2015 15:25:08 GMT..Last-Modified: Mon, 08 Jun 2015 15:25:08 GMT..Expires: Mon, 08 Jun 2015 15:40:08 GMT..Via: cache7.l2de1[313,200-0,M], cache10.l2de1[315,0], cache5.de1[314,200-0,M], cache5.de1[316,0]..X-Cache: MISS TCP_REFRESH_MISS dirn:4:436988533..X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:08 GMT..X-Swift-CacheTime: 900..!function(){var p,q,r,a=encodeURIComponent,b="5076676",c="pic2",d="",e="online_v3.php",f="zs25.cnzz.com",g="1",h="pic",i="z",j="站长统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("o
<<< skipped >>>
GET /core.php?web_id=3325108&show=pic1&t=z HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 753
Connection: keep-alive
Date: Mon, 08 Jun 2015 15:25:11 GMT
Last-Modified: Mon, 08 Jun 2015 15:25:11 GMT
Expires: Mon, 08 Jun 2015 15:40:11 GMT
Via: cache16.l2de1[1611,200-0,M], cache4.l2de1[1612,0], cache2.de1[1612,200-0,M], cache5.de1[1614,0]
X-Cache: MISS TCP_REFRESH_MISS dirn:4:829866476
X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:11 GMT
X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="3325108",c="pic1",d="",e="online_v3.php",f="hzs2.cnzz.com",g="1",h="pic",i="z",j="站长统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a href='" q "' target=_blank title='" j "'>" j "</a>",k.createIcon([p])))}();..
GET /zy.txt HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: cj.941pojie.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:11 GMT
Content-Length: 26
Content-Type: text/plain
Content-Location: hXXp://cj.941pojie.com/zy.txt
Last-Modified: Sun, 26 Apr 2015 14:12:28 GMT
Accept-Ranges: bytes
ETag: "02ed062b80d01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
hXXp://soso.hcjd56.com:88/HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:25:11 GMT..Content-Length: 26..Content-Type: text/plain..Content-Location: hXXp://cj.941pojie.com/zy.txt..Last-Modified: Sun, 26 Apr 2015 14:12:28 GMT..Accept-Ranges: bytes..ETag: "02ed062b80d01:751dc"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..hXXp://soso.hcjd56.com:88/..
GET / HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:10 GMT
Content-Length: 6398
Content-Type: text/html
Content-Encoding: gzip
Content-Location: hXXp://VVV.941pojie.com/index.html
Last-Modified: Mon, 08 Jun 2015 04:42:24 GMT
Accept-Ranges: bytes
ETag: "0386783a5a1d01:751dc"
Vary: Accept-Encoding
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
...........]{s....;..w@.qm../P|H..Id.6..uZ...s'.$A....$h=:.02....T/R.)J.HK..4%...~%q.k.m.4r.8s..A.$A....sk....q......g..C?8......?...`.;....z....&.o.=&...........0......L..h.!.&........P.....g......t...~(......S.4z8......x.......S....]..$.H.\..Gb..@........~......H.v.(.s..G1\.....#.h...7.8p.T7{...pb ...Q....wbn?..P\..EX-.X.Gs.....2?.....0y}"..xs..5@.C.{4et..C&!.D.!.T..K...aODAq...}..X.:<..|}~......J. .........".0...W...~.r^<W..[......|'..`.....W.6.'G._$rW..*d/....x......a....#.S.......*..@...G.......Zlb>.i/..... .... /.=l..q..w..5..K...@..Z.&..b?...(.v..b..TC....N.O.>?...m..N.qH...B..C3>C...g6x.{....!j}...w`N...3....p.f.....;o....n6...?<z....q.".l>...q..|.B=.D..6..........8..,.U..].g..l.8.*_.?...nt<uc..\.0B.R....-R.e........$..C....Z...y...M.dM.\.Qt..^_..2..,...@.0.F.>.{..8D..a..cOQaTd_...=..........<....b....@.E.!.tbA..1|.21T....Cw.(2....|*...02...r..9...Z...N..."N................>.C..r.a..P....%$....(7....."~......`....2...3..A....(W/..v[..=C......G..\Bm\.g!VPi. .P.O...(?y...@.....s........M*..`7..h....q.-.c..|?UaRL!H.vE....L......B.K<...Q&._....1"....}....J.(.W...J....Z.1.e...P.D...`....#]....*@hA.........h.C.w`..F.\?'W.B.j..E.V.9dts.E.hj..J..l...*..0."..).P2...72..p.e!.Rj...D$..z#.h0..:#.x..U....`......@e\...V...t.N.md..K..G.aE.v....l..V..2[k2{..]P..H..Xh.^[..Q..MC....g.2.'..6v[9Y.HY.fQ1jf%.........*%e....ki)..U.L.@..h.....Eu.=#I...fVu..J..l*..z......lqhj!..QHO.J..D......Z*.-......U.....[.A9......`.......P.m..o.&R..Y.V..Q..YU.6..bo{.J...4Gl.J.v.m.U.C3a:P#,........%^[.1...
<<< skipped >>>
GET /img/gif008.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:11 GMT
Content-Length: 565
Content-Type: image/gif
Content-Location: hXXp://VVV.941pojie.com/img/gif008.gif
Last-Modified: Thu, 14 Aug 2014 07:47:37 GMT
Accept-Ranges: bytes
ETag: "80f22a494b7cf1:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
GIF89a ..........R.......!..NETSCAPE2.0.....!.......,.... ....._....m...PZ.D.6.N...}Q)....M..1@.i,.....|.... ..K.v.....-yJ.R6;....Tx...Y Y5i......i...9......F..!.......,.... ....._........PZ.D.6.N...}Q)....M..1@.i,.....|.... ..K.v.....-yJ.R6;....Tx...Y Y5i......i...9.....|E..!.......,.... .....`........PZ.D.6.N...}Q).......1@.i..KF....m.<..h..0.d..U....Q6S..U.5..r...R9i....[....r1.a.7......!.......,.... ....._........PZ.D.6.N...}Q)....M..1@.i,.....|.... ..K.v.....-yJ.R6;....Tx...Y Y5i......i...9.....|E..!.3Reduced 73% @ VVV.raspberryhill.com/gifwizard.html..;....
GET /img/zsf.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:12 GMT
Content-Length: 85308
Content-Type: image/gif
Content-Location: hXXp://VVV.941pojie.com/img/zsf.gif
Last-Modified: Thu, 14 Aug 2014 07:47:38 GMT
Accept-Ranges: bytes
ETag: "089c3494b7cf1:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
GIF89a..Z....9Z.(\.,e.4i.<`.Lr.Uv.Gk.Ae.:s. f.5j.;r.4k..l.,h.4m.8n.2m.1g..p..q.5p.9q.=x.4s.;u.6x.<x.5u.:v.6x.:y.Lu.Bn.Bt.Dw.Q{.Qw.Eu.Hv.Dy.J{.@v.Iu.D|.I}.R}.C~.H..Y..f..r..v..l..w..i..z..E..L..M..Y..U..\..R..Y..T..[..S..\..Z..C..K..M..N..P..S..X..P..Y..M..N..T..\..^..R..Z..^..e..a..h..d..c..k..e..l..k..q..t..y..v..`..b..i..d..j..`..k..a..s..y.._..^..l..t..{..{..l..d..j..j..t..{..u..|..t..z..u..y..~..v..|.....~.............................................................................................................................................................................................................................................................................................................................................................................CWz!.......!..NETSCAPE2.0.....,......Z......9....8..."<H..6....4.."...1b.hp.G...U...d... n....H...}.H...o8.e{.......=...g.......Si..B.=.:..P......S.R......S.2....Sw..P..v..9.(..S..-J.....r.{.8.N...g..m.....'..-n.l;....x..l.!C.)...i.7cN.m....q&.M;.3..W...[&hh....-<8...qos.:8.m.o.|.M.u...O.........gk..Z..'..7.pZ....^l).f.....t.......tRC..._H$...}.zd.I.m.........N....Z....b..5....x&.g"A. d...\..A..'".".TcA..h.C...S......7.y..7....I..d.KF9..U*.%.O.)..\~.e.^.i&.\N...d...!.$..cT9..`.$C...9..c.:......L.y.......L..0.h..*.h..:..".VZ)....i2...).........."..\.j..(..%...L"...H2......F.*,.......J.%.n.....b.".,.k".*..%.h....^.........,.M..$.H&......$.. . r.%...H..L.l"q...".[r.%.3.p.q2....S....X.1..ol.....g..../"...2"F....5.L..8..3.H....<..3.8.@..6
<<< skipped >>>
GET /img/yds.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:16 GMT
Content-Length: 33312
Content-Type: image/gif
Content-Location: hXXp://VVV.941pojie.com/img/yds.gif
Last-Modified: Sun, 08 Feb 2015 14:08:25 GMT
Accept-Ranges: bytes
ETag: "80922ab4a843d01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
......JFIF.............7copyright(c)2009-2015Admaker@baidu.com_2512264_220670....x....N.0.._...u.8.% ..T..A.U...IL.d.8s...bA%.]..M.7`..L.....a.T*.........s>/..,c....v.....`.A"..........:..1SJ....(J%.<b3....)>.g..P?....Q..!\.:...V.v*.sL.iA0..{.47eY...d3.s&"%My$S......\..@P....:..FH.*.r.|[..R.$k"..`.....65.uG.....C...../..O7.W.....2......<...y[...... .2l......T.e..(.j......Sm.5=....E.....VM.6......&[..7/Q5.......X.m:./..../..a..O.6`.4.U..B..... &F..h`.E........d..@0.....x&1{<...\..|>...d.....~.............Q..`8..,F..u.a........nO.........8..=..q....o.......U.......o..71.........................................%...#... , #&')*)..-0-(0%()(...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......Z.............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......s.o.j.W.u....%..j.n.....W...}..!...4..V...y.......U....X.o...W.i.).(...q^D6.c....{.9.:.f. .`...io......u...l..:B...(......(....x~-f.J..
<<< skipped >>>
GET /img/weihu.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:22 GMT
Content-Length: 33376
Content-Type: image/jpeg
Content-Location: hXXp://VVV.941pojie.com/img/weihu.jpg
Last-Modified: Wed, 22 Apr 2015 11:34:35 GMT
Accept-Ranges: bytes
ETag: "8017d04ef07cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.....0Exif..MM.*.......1..............VVV.meitu.com....C....................................................................C.......................................................................2.................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?........(......Oo.|F..t....#/.]c...p]..s.......rT.X.n=..;..^k..El&2..%:.M(E..6.OG.....P.....u7............5...F...Z.........3..........;......_xt.ZsB..gy,..d."].....r... ...J...1..`.S.w.q.Z''.y..m...As3.j.X.(.......t...|W.o..Y.".u.b.M....%.&.c....F...q..s.e\. ..h$.N..N.7..gf....E^I3.?........?...x'..3..O..y....$..D"(."E..d*..'h....k..ni.c.,^.K..........3vJ.v...gD...$.<...../.e..iB...[.....6.4!.n.G...........&.........s.S.M........O...3.O..#.*.@.....j.........<..c.Fx5....-...kH.R..:....rx...........gp.....q.v|.R.v[4........G.<...-.qCu4pM..U.R].w.<6.L.q_...QNJ..c...N.o.?...M......ok3...."...#8'.....<...".NP....I..!.wc....../....m...i~=....Guq.M.....Q............)......x..b.x.e|$f...B......^..e}{j.%B)......./\...... ..Q.....t....d.0$...7.....e=.?[.~-..e..(......]...k.t.*..n..!.G.5... ..5....kz.. [E.#20R...(...W....6W..3.>ZpWn....7..$...m...z....N.........
<<< skipped >>>
GET /img/046bt.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:25 GMT
Content-Length: 6215
Content-Type: image/gif
Content-Location: hXXp://VVV.941pojie.com/img/046bt.gif
Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT
Accept-Ranges: bytes
ETag: "05c92394b7cf1:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
GIF89aK....!......U.......$..$U.$..$..I..IU.I..I..m..mU.m..m......U...........U...........U...........U......$..$.U$..$..$$.$$U$$.$$.$I.$IU$I.$I.$m.$mU$m.$m.$..$.U$..$..$..$.U$..$..$..$.U$..$..$..$.U$..$..I..I.UI..I..I$.I$UI$.I$.II.IIUII.II.Im.ImUIm.Im.I..I.UI..I..I..I.UI..I..I..I.UI..I..I..I.UI..I..m..m.Um..m..m$.m$Um$.m$.mI.mIUmI.mI.mm.mmUmm.mm.m..m.Um..m..m..m.Um..m..m..m.Um..m..m..m.Um..m.......U.......$..$U.$..$..I..IU.I..I..m..mU.m..m......U...........U...........U...........U...........U.......$..$U.$..$..I..IU.I..I..m..mU.m..m......U...........U...........U...........U...........U.......$..$U.$..$..I..IU.I..I..m..mU.m..m......U...........U...........U...........U...........U.......$..$U.$..$..I..IU.I..I..m..mU.m..m......U...........U...........U...........U......!..NETSCAPE2.0.....!.......,....K..........H......*\......#J.H..@`.1.$...9r....7..........cI........1........Ar.^.#...A0AR....]L.K......Ux..!#.u$ ..........-..|.`f........ )R....I./1..A.(... .R..ML..>|.....u.HP.J....s..*3.d..&.v....FO22.N...I.0A.4........r.R.........Q.{`..{..n-p21t'.~4....@*..o...#)d..Q.n2.A.@....J<.r.....{`..!...|..'^Xh.5[r....K..T.r..4. .......f\X.....e..QJPa..A....GC.(".fU...mEe.ZK.FHf|.x..A.U!.a...J,iD.bo..]P.l...@...}$.(..3.W.MK.w.w..gV...&.._...A.EG.B....}.t...J..P..1..L`.....6....F...!.......,....K..........H......*\......#J.H..@0.2.....1``.%.E.#1r.......(...m.(0#I..<.$........C...I@:I....&.....l...O.:..C.. :.......).. ........H.b.8..V..H.$G.-I.f...*p%).Uk....%9.Z..........:...%..,I..L.......%...O.....jw......;..
<<< skipped >>>
GET /ico/yinyue.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:25 GMT
Content-Length: 21219
Content-Type: image/png
Content-Location: hXXp://VVV.941pojie.com/ico/yinyue.png
Last-Modified: Wed, 01 Apr 2015 15:47:40 GMT
Accept-Ranges: bytes
ETag: "0761a2f936cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.PNG........IHDR.............\r.f.. .IDATx...y.%.}.......2=..p.....A.\.E.d..%....v$..t.....$Nl..899N.....8.......(.....D.LY....A.$...g..,=3=.....7...U........~...}n....Wu....o.P.F..5j..Q.F..5j..Q.F..5j..Q.F..5j..Q.F..5j..Q.F......T...7P............D>..kFPc70....f.9.{}.w.5a...F..Qc.......}n.0...f.^n.&..Q..L".8......v.0m.@y..........5..Q-.....(....Laj..ia..f..".7.m;.o~.c.z...3...-..juN7[...a.8.......5.5.$^...*.h..4../.z..........[......`.A.1...=g.{..lD.>.7.D?...~.....].XX8.xgn.q.T...q..%h.....7..W...k..7O=.;..=,3p.!........K.P..}.o.m.......{..'..=.C.f.\."..w..g.s..A..Y......>t.....x......}n.\.............x.*..^.{.h4x...[...3......7..3.'...`O..^0.....0...>..G.../.8p.....:y...}.........h5.......6...F..B...[.P.A`..0.......o...^.....gWW.....?.kO?..g...1..`.w..L".L.........C.......x.}...y.....=.z.S...k..."..l.".c.....$.ZkL..j..".R. ...!. ....f..F...B.o]Z. O>.W..<....:..../~.k.. _..'.u.*..1....&Y........g?.......>....gN.....C.....k..`0..... "....]3.`.A.=.....PJ!".3p-......v.v.:.h......kO.....'y...n...._..?.[o.......l0..9..................w.;.E..................,.w....z.>Q...qF.5j...#...F.A..f~A1?o.B...~.U..o}..^....$../|.........`....D..m.P&~......S...G~..-.8.Q...6...?..?.8..%..5X[.0.......kL#D$..Z....m.,...U....o.........X[........Wo\......^....v..Lr.9]..{....~.....5.......c..O........Z.......8.....LA)E....m...Y:....'...g.._........o>..........L.l$.U&...E.'.&....C......<....o....j5.._........B.-.....n............k...F..C......f......g....^..Y8y..O..8.|.......)5I..b7$.I..........O....?....
<<< skipped >>>
GET /ico/jsq.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:27 GMT
Content-Length: 16729
Content-Type: image/png
Content-Location: hXXp://VVV.941pojie.com/ico/jsq.png
Last-Modified: Wed, 01 Apr 2015 16:03:53 GMT
Accept-Ranges: bytes
ETag: "807ae73956cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.PNG........IHDR.............k.XT....gAMA......a.....PLTE...DDD...JJJ...```.........222.........$$$))).....................)))......bbb......... 111SSS......;;;...QQQzzz...FFF.........bbb...666.........mmm.....................................x.YZZ..q.r=..[^__.."..K..!h8..q%.W..K..n.....D..v..?..>..N.....d..J.!....Y.x...2......A..........r..DW).6......|.g-..[...O..<..)....}..T..V...~.................e....o............. ..y;.K .....j........s........|.....h..}..........._.............................d........j.....t..d..f...........{..a..v......................444...333.y..t....<<<.........###222===???%%%$$$888&&&......;;;555......>>>}}}{{{||| SSS...PPPJJJMMMzzzoooVVVvvvsssyyy WWW...000rrr\\\jjj^^^___[[[]]]666......HHH'''...999)))XXXYYYBBB,,,FFFDDDNNNKKKQQQ@@@ZZZTTTmmmkkkwwwtttppphhhfffdddbbb```""".b..........y......>tRNS......y....7...l..B..`.M.H....}I*.g.R(.\...=.p...2.............Q.... .IDATx..}.\S......]....k..:.u *...7.....{o;nk...ek.uu..UA...4..d.H.!l.{..F.$$@H..........$.Pk.......>...>...s&..r.pu..s.].W-....w....y.....;.x...>..EW......7.....8..~........p.....A..[...H.{.. ..yp...[.p.d.o...p.m(.9{.v...............g/....|.......w..M.l.n............wt......"...!$..&.......~....T..~......\s..{..][.t&2......7...9 ..d.o..Z=...3'......{..9|....A.dh.w8..o..o....:g...|.#...3.....:.....}...Y.8Y.~.............i.............)..5....Z*....H{........7..H.\......>.sx.._[.....:..t....|.4..*...F..;V.t)..^..]x...u.../....t..W..(.....(.......T..1)....#G.......k.. ._.......Z.l.L.u..
<<< skipped >>>
GET /ico/27.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:27 GMT
Content-Length: 2536
Content-Type: image/png
Content-Location: hXXp://VVV.941pojie.com/ico/27.png
Last-Modified: Wed, 01 Apr 2015 15:17:39 GMT
Accept-Ranges: bytes
ETag: "80ab9ffd8e6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........o.d...}IDAThC..yt.w.....%.XS.$v...H. .DH.[#..1..........5..5....*..E#.....AD$...F.A.g....M.kn2G..9~.|.='...|....}.Wy...kn,l..z.>.P...=>>.........c..|..s....a..<L...&E.012....b.......>2\g....k~LA........;3.(.#..L.......6...R.....$..D ,....#.......q......P.2.....K..B.&....o..).u......&......,..|.3.z..#7f`x......[...... ....XO$.o(-...WL}...q.XF..._p.W.20.' d[6..MS..Zo.........EM..jM..L\."...R./...S..KF......da..T..0-:O..y`.\....),..sI\..Q\R...C/.3..)..p...1.. ..?..(.:.@.A.....kF.....=..E|.......s.{...$0x]......&F......$M..S..i......I\R..,0.4........_../,......Q'~..9..Qy..C.....Ve..'3q..OqI=.8....:..Y}.=.%Z...[..q.r.NI.";UKZj2..R...~.....G.!.......4x/I....6d..D.0..&DV....h.R..Z.">...........n_....k..`..........Q$D..~...G.U....x........@.=@./R...%..&.|.7g..M..aL9HKz0..2....g...x.}L}/.......d......o.IS.l.2...&,..Ga.H_&-.=......S....Q@.H...[h.....0he..?<..c..W..eE.;...t.Jw.........&..[.i...0.m>.l.../O...U....6HzQR...L.....HK.N;(..h..h..h..x}}.Z.^A...'k.....K......{M.\#..^....) ..tkM......4..k....E._...3...'...=.oX.K..n$.,...a)....=,.n.R..y.....%..f.-CUZ~r....D.y.".f.~Jj1=.E;..[...|.....R....Tu.@U{w....#..e...8.....^....W....@.Il90.`...!..s..%w..1.....^..)....'..{...9.\r...L...Kkf.9L. ..0O..BT.j......PL..<.".]..I......>.:N....J.)...........%.<.........(..DQ....z...w<.....:.......)...\Pt|...........b........B.....X.....w...N...qS..4...3.p........'7.....Q2. .......:.v.?x....dRDP.J..mI.........VO/I..S.T..(=C
<<< skipped >>>
GET /ico/qijian.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:28 GMT
Content-Length: 201458
Content-Type: image/jpeg
Content-Location: hXXp://VVV.941pojie.com/ico/qijian.jpg
Last-Modified: Wed, 01 Apr 2015 15:17:40 GMT
Accept-Ranges: bytes
ETag: "04238fe8e6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
......JFIF.....H.H......Exif..MM.*.................V...........^.(...........1.........f.2.........t.i....................'.......'.VVV.meitu.com.2010:06:18 09:46:38..................................................................................(.........................................H.......H.......C....................................................................C.........................................................................................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...|......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...<......O...}...P.@....P.@..
<<< skipped >>>
GET /ico/jianhun.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:34 GMT
Content-Length: 8924
Content-Type: image/png
Content-Location: hXXp://VVV.941pojie.com/ico/jianhun.png
Last-Modified: Wed, 01 Apr 2015 16:52:30 GMT
Accept-Ranges: bytes
ETag: "05bb93d9c6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.PNG........IHDR...@...@.....%.......bKGD..............pHYs.......... .... .IDATh.mz..\.q^w.s..}..c.....A...s.eZ."Y.,.J..I...... ...\v..D^d..)R"..... .....3...s......} ]....75...s.|..u..o......?y.h.z9@..U..P....DD.PAP...".".""!.1.......JH..4M.../.h..,....q.....QUPU.P.P.}S..U............1....Sg..F.q...G........" .Q.......0...A.TE$0.SU...P.....asg..{..j....1J*......-.D.|``...D... .%..8......2....H`.,.d..D...H....e....H..!...2....Xc=/..(......>Q.m9.e.r>..8a.U..fffI.d'.....2;v..&...0.!V'..!..B.h.HY.@......n............Xc....""v..K....k.Ak<c<...G.#GO.3........ ..R.8.x(.. ...OH..". *.KYUQ.Pwm...,...%.!M........%@P.E....{....../...{.o=k=.....Q.'i..I...z....>0.V*.....~.v>q....f..|.P...|..}c.(.$I..K...!{.Yc.$A..p*hPEPQT.9P4.X$B..@..Y...Zk....%s-.@.QU\............r...I.n.Z.V..i.....{..i..(..UI..A}./.....S...\......0..XUE$q..x...9.......(..$.|.Q...O...o...",....k. G.8eM9a...4.=o8..........=..D.......I..s.A.6..$.U..i.......wO.RQ......v..K...8N.4.D.Y..E$.. ...KScH.. *j.N....n.! D%........g=.[D..4M.$^. ..H..9IA.c.x...w.............\.z...%D..Vz.N<...../\8......./7....z.8....D.....`.E..M.(...^....|..&.....H.-(.......8."2.%k.T..1`}...|$T`2.{6MS...{.K..V.G.O........(..k.vs.....'N...nln.}poskk0....=....T5.si..Q.......1M...2..*..kh$R"D.O...(.D...O. VavD.....(.4I......y.. j.-.....Q...j5.../..........Z}zb..K/.M..... W.....k=. ....N.A.". LSg}/...1...~.....R..="...9V.'.@...Y.Ú$..y..|c-..s.)....he.. .c#...?....|)...47R-.1.......[_.......:22.......n....dbr\....9o8..t.......[odtTU.;;.86......sd..F..(*.!$.D.$.". ...
<<< skipped >>>
GET /ico/haobangshou.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:34 GMT
Content-Length: 11638
Content-Type: image/jpeg
Content-Location: hXXp://VVV.941pojie.com/ico/haobangshou.jpg
Last-Modified: Wed, 01 Apr 2015 16:58:33 GMT
Accept-Ranges: bytes
ETag: "80c216169d6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
......JFIF.............C....................................................................C......................................................................................................................R.............................!a.1AQq.."2BRS........#$Ur...%'Vst..&34CETbc..D.du..................................>.........................!.1Q.2Aq......."RSa..$3.#4Br................?.....mF..."..:c..p.T..zk.L>Ni.....m;..d......yGk.....7..3<..5.|..L{......5.|..L.......\w..........5.|..L.......\w..........5.|..L.......\w..........5.|..L.......\w..........5.|..L.......\w..........5.|..L.......\w..........5.|..L........>.M...lxX....<t..LF....I...N..u.\.s..B...Fi.Q.$E.NCP.F..4...^.&.,E..q...##.}e@..T.zqO.V.\..k.E.Tt....4.2.....,..J ...(...4.."...,..9.l6..Y...fBn`].WV9..j21....e.5..m.Z....w.0.....E....t....7m.o...?..4... ...... ...$F.c.s......Q..ctiD.E...Y.F.Ad].Q..tiD.E...Y.[.j..t-..s...<X...cu.~.j)......X..3......30LLOT3uG.=.g4D.4Y#.T.]?)1..$i.c..;24.0Y........?L.Fdi.`.3%.].v.F....u{.=..,...:..)....8.'\...d.M8.....O."..{...z,.6.!..K........{.......qR..8...tF...!.!b.hu% JV...x..7,KC..IS.Z.8..h.|&.y....R....Z.$...&.S..I..\.M.A.C..$b.c.v.BO.......7V..QJ.J..... .:..M..X..c./3#O.....~.,.....dfF...#2p....:.T{...7.}dY..).6|....4_.....5...[`._s.8..X.....b.#25.,..6...Km.KZ..S....4\..w........-%3. ...c.=<..QZO..jj...Fy.<<..)Kh.H.H....E.I.L@.,..[...d.8f^..;m.x..*9e...U.Q.S...~..;.9.....,.{g.<I.....u..33.l........s.^7....G[i.n.......y\..0M....Y...x-.....j..rq.v..GB.bac..,.U3y.=.FS..%m
<<< skipped >>>
GET /ico/wangpai.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:34 GMT
Content-Length: 174607
Content-Type: image/jpeg
Content-Location: hXXp://VVV.941pojie.com/ico/wangpai.jpg
Last-Modified: Wed, 01 Apr 2015 15:17:40 GMT
Accept-Ranges: bytes
ETag: "04238fe8e6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
......JFIF.....`.`.....0Exif..MM.*.......1..............VVV.meitu.com....C....................................................................C.........................................................................................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(......(......(......(......(.....M.7..v...k.[h.....q..z....8.=ej.P..5c..>g.......,5(.d.....g.~...^.'8!H#.S.;...R..N?...&.....].JI-^....r....N....t.....~.r.....}2:.*`....8.q..<#N*....k ...b.9.{..t....G{.m...6..i.M....GN..@.>.t.h........j.3>/.l....f.}*4.9..\m.8S.e*..UT..S|....:he..&|.Z5 ...!*.N...9En.m.ZI.5.....4B.I.kMBs....m&....[h...Y.......}2..9.*....|....H}W...F...(...J0...k..g.kk.7......1q..T...../.qw...S..........m_...#Lh>......W.^.y..........y.. ....i>[.U.K....sJ<..w...&......;;J.k...g......6....^..[..].rup...I?&.c.......K(.._.i.....T.......^.A.....?h....jG...).s...>..7....ekl...~...<...AU.b.M%..c.......m..][.......1....SA...{m'Ew..r...........o...Y...^6..S.u*....q.i.I......~h.J>..%'..U.h...q.W..._^.6..X.'....._:...-.Z.......H............8.)K6..>i9'J<.M.-6.wv./S...vEJ...2..,-...........>..E....|C._...?...
<<< skipped >>>
GET /ico/binglang.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:40 GMT
Content-Length: 12029
Content-Type: image/png
Content-Location: hXXp://VVV.941pojie.com/ico/binglang.png
Last-Modified: Wed, 01 Apr 2015 15:17:42 GMT
Accept-Ranges: bytes
ETag: "06f69ff8e6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.PNG........IHDR...r...r........}....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..k.u.].....%.....p1.Z".SJQ..@hJ..J.MI.BE.X.(.h.....h0'...^Z....b!A.....\.......m..Z.u9?......=.~.......w...>....c...~.CO...>..'z.g...w=........4=...vz..........~.........{z.K_........^.u{.Q..J.3O......._.....P. ..m...7~..../.../|.......h{.Gyu....O.O.....:=...s.....7...~.V.5=....-.g}._=..s..K_...........M........._..{.i_..%| }..O.........o...O...{..gO?..?vK...?{.......o|...>.i...I.vz...=.........x. N.y.-..../....2.mn..z6....@.|......Z...........o|.....?.....~.G..z.9'..k..........u?y.....7.~.W....W.g....|....~..\......?......|.[v... .7...?............g`..`s...?.9....H..oz...x_<O.P...4.......}....c..K..Y...<./...e...m..m[@.....n.O...}...........nxi...~.?........_..GN.. .....=....o..}.?..}...w...k....`l....@.7A.Q...9...O|.-.....?..-D .k........N.l.1.....@......'@...=.>.... .y.6...D............^i.....|...^...|x.k.3>h@14....y..8.........P.y......<...>0........w[i y......G.....S.9Z.......]......... .(HG.sJ...mW....p.p.2.d..=@....H.......;......@....~....9 .....oo...... .K..R..7o4~....=..8 .."...!.4./.3..c.5.'.sBd...7......y.]R>x..0H....z.>.V...j..& ..gL..b..m.Ql..........1..w..@....... .ya..7 ..............].i..../n<d..i..f.....1z..b.#.y....e...}..#..4y0..8....H.........v.).,....~.......gH...."../......(.n.....v.s{...4. ....Tc._p....Vu.......'.4.g\.0I...wK...1......0..E..m...H......(...4..p<K....... .`.;c...Oo$..I.... m....W.@...x...s.I....yf.p....v.....;'.#...&D....zd[..i{..ye .Z...d..=
<<< skipped >>>
GET /ico/mojian.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:41 GMT
Content-Length: 16185
Content-Type: image/jpeg
Content-Location: hXXp://VVV.941pojie.com/ico/mojian.jpg
Last-Modified: Wed, 01 Apr 2015 15:17:41 GMT
Accept-Ranges: bytes
ETag: "80d8d0fe8e6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
......JFIF.....H.H.....0Exif..MM.*.......1..............VVV.meitu.com....C....................................................................C.......................................................................x.x...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......?.S.....c.>..............|#.I...X.g.[.PY..M/Kk..h....{{..........\......5..xw\...6/.7..;.......(..t............_..f][T.`.E.S;.u...=.?.<E..C....{..4;..O....h..3X...N..^..Z......P~....u.}.Q.>5.J....a...>.....K.[...y.7..Q..DU....?.V..O...M.z.(..T~..........~0.D."3..G...........,.....o..T... Z....w.....T.. .wI[m...m..?.U.O.......u_...T..<...B.......'...U.E......g...b..Ns.....n.....o.......'?....9........8.|C...#.....D).UTg^I..}...k....\ C.I.*t........E.....S...8..>=.....>!.F.1....,.1P6e.h@.k.qT4.YMO..?y.5e..l.z.QqJ.j.....W..ME.)...9...'n]n..KF........w...;..........[n..[}.......v....m.........T~...q......B.....m-X...?.........:.........O........O ..Z...l...... .n...........<.............5G.=..G........./.hh...W..o"...g.TX][_X..........7Vw...~#[.Z.[..[..\C.D...&D...u.).].YA..ml.w.Wk.Z.............'..K.<!.`|S......Y...~..#.
<<< skipped >>>
GET /ico/miaosha.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:41 GMT
Content-Length: 13854
Content-Type: image/png
Content-Location: hXXp://VVV.941pojie.com/ico/miaosha.png
Last-Modified: Wed, 01 Apr 2015 16:31:40 GMT
Accept-Ranges: bytes
ETag: "07eaa54996cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.PNG........IHDR...J...K.....X.......bKGD..............pHYs.......... .... .IDATx.M.w..e.>..2}v?...WH....A.*M....U......W,`..^.xQ..JU..Hh!..!.$9.IN.}..3o......|....=.........E.y...F...TE^..w.........P.9.i3.91>.{...G..C.1.=Vq..3.X..=..rujrR'J.R.r..Y......;z.Q..$.M...7..l6.$...9..HU.|&/.....J#....R.q.O..(.5....Z..x..w.wFN@%..*..C.m.^k.._,.S..A4."..,......w.-UJ.s..8..8.W....:.T.EG...5........s.......w/9.d.<-.....|........[...Qk:1.t.`..4Co... .B....RJ.....Z=..(.9..@....~....9......ag{.....I...R<.F........nJ.. /.j.Z...@I.p...B......^....o}m....]..Z.^.2..e3..gw.......~_.*6 n.TU]...~......=] ..`....`......B."./")%.....3.T.r..... ...nUU%.a....s..U.H.L&.6..P.\....'....,...`L.D..[...n...7...%..D.RbL)...-..r.i.t.I........._.t!g...|P/.....7..k.O.u..h.f8../d..._^y.. ..;..!@[...}K...EL..D...l.,D.#.L.......1=>699.d..t:.P.l6...R....&RT?.f..Z.......l:H....N...l.<..Z. ...v..h4, ..[.<_p..).R(.|.o4..@{..].......ut.v.F3eK...w...@.z. %....h(X..s..a...P.B.T..l.R@Q....q.(.....".)...$...-\|.........Q!..i.4.j ..9.FFt..z...!.....f....Y.g,.b .c0mC.(!$.Iuww....:e.PU.c.9....h.8m.RX!....g....W....?Z.?v.).:....9.`/........B0(...z);m(..*....`*'@.E... %P..&p..Ou..*`..........AD..E...r.t.'LU..C...N..X...y..97.j.J......vC......q.EQ....rA.....Z(.TK.d.:%iD4L.f...&..h#a.....F.i...wd$...x.G.N]..K..v`.......$.AX)V..O4.%.k.....!HW.\>...c.:!$a1!DJ.8N..EQ.......K.B.....0..7.\...4M.n{:...)...2]....3!!d||....8n....|>.9....hwO..i....5}'.m........92...U.V.w\.B......8j./.=;...tr*../.E).....{.......8x.Q.U.u...M.T...C.G..==.q.".RJ....
<<< skipped >>>
GET /ico/anlong.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:42 GMT
Content-Length: 6316
Content-Type: image/png
Content-Location: hXXp://VVV.941pojie.com/ico/anlong.png
Last-Modified: Wed, 01 Apr 2015 16:21:09 GMT
Accept-Ranges: bytes
ETag: "80888fdc976cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.PNG........IHDR...D...A........V....bKGD..............pHYs.......... .....LIDATh..zk.].u.....q_.._jI.n.=.$d!.F......*@.pel........85..3.G2UI%..2.L....2.O.&.[.0...!.$!..,.%..z.Z-...o.{..{....9}.!.$.cN.......................Sb..~.i...!`-....l..C.>.}}....]....y...... |....W....Z..u2....@...d....xi..>ei.'..1....EJ......h....C_..R...t...K.*..g4>.33.....f.Kg...x.....{...?....o.....F.=td|\....[..............j.D`fk....f...x........ch.W>..y..D\.Bk~...W.....(... ..W......01.1.v...e.LZC.i.3q....g...%..\....b.}.....Rm.....,%..H.........n..D.....tt...xbb.1L......E.....|..../...k.......`.........-.\x..%..Z^.t......../....nw?...YbF......>:=5....<h.c..[...1#...m..[>.....o.....D........R......10..e!Eb..g.f....6.......=[......J9./..t..=.....}.......d....!.......u.Q..\....LL..9R'..}..q.cHJ..Z.....D,D.!)!D......3&..y....I/..XkhMB..-CD.Bk'..-.c.d....O~........8nk4..W*.k......FC.J.\....yV.........GQ=..(jo4|c....ba..6..S..}S7C..X@.....E.Zgg....l.F33.R..M7}t.h.R.AP&...W..W.8V.MNO.|..j.T.^.....Q.Q..c...e..`..............D.X&%..g,k...`a.....%.6f......:88...W...DW...Q...5&...j=z......D..`....5......h..M.9.h!@...7.^&.3g.'n.|.q.8...Y..uxx.1...!..at... ..R.q.`b|...H)..R).&..(7.6.../_..;..t..GQP.....E.@..r....8A].....i.........h .........R.I)....mB.f67.....C.O..=.v....Z.(...g.{..kaL.......j.....C.:../m.....q......rydlL....E.kr.3.........l6....9.q.Ic}..F.q...7.rQ..\No.x.....C._......c.P...^WJ.`..D@...y......[...[....(.3..&..)....1G.....3U*..n....022....@..eW.m{..o|p0..... .<......\}....%@.......KY7f......'y...D0...,.
<<< skipped >>>
GET /ico/tianlang.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:42 GMT
Content-Length: 79911
Content-Type: image/jpeg
Content-Location: hXXp://VVV.941pojie.com/ico/tianlang.jpg
Last-Modified: Wed, 01 Apr 2015 15:17:40 GMT
Accept-Ranges: bytes
ETag: "04238fe8e6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.PNG........IHDR.............K.......gAMA....7.......bKGD.......X......pHYs...H...H.F.k>....vpAg.........]..N....IDATx...g......=3.O"..s..D@..."(Q.((b.Q.... ........(.@.. H.9.N.03.~.^..^...<.N.v...L.LUW.SU.....>.Q.{....J..hy.~.....(Y..~=@..K...*Y.u%s.T.M....?_D...?v.....wH..V%.T%O.U.P_.....-.L.......q.s.....e... %#........*...C\.......0J*.E .....6E.$m..jCT`...R....|. .xJ.8S..E....Z..v.:f...A.8qN.n../p..2.~.........._.._..r.~?.DJ.%O..d...HT...J.........J.=.d.6...?x}Wq..........xX..o)Y,^....*...%.(Y&C...C.}.>N.O;....>P..T......... J.g....k.O|..G.:...711..lg;........v.~%O.T....]A%.VQ.@c%...>...w.>.....].U..XW..........J...d.5...J......)._.....8o...;..w*Q.*@/z..e......Db.a.H....D?...P.b....e..D..../.*T..w........../......|.e....49AN.`.[....../.@.....p@>.r..........C..c......Le*S.ml...=...y...z...>p....)y\......>=O..y.....z%....|.ip.W.......?...I......oS....5...Zz....Z..[.%.8............n......Mo.3\..@iJc.. ....K]1^..7..........@L.S).2.......wr.H..F.!...h1.(@...((....h.....4O..jQKd.....W...I.$.2H..A.gyT....q.#. ...@...H.^.5.....$...........Y.....|...?....3@v..9..f7..?|g..0.).;..,.........'..)..*=o.:.|t....E...J....C.i...:.......*..w.j..*..J ..!..~]Rk....Zh2Ca...6B.............(.!......b...%)I...5@..cEY...(.... ..._....2....xA..<......xQ..Q\..N.3..Y...n...F7. .E....x1..@Q..% ..."........x.D....1T.....x.....|o.2....(..&.ar...... o.....`.;A..%... .e .w....2N..I...M&....,....2'..r?...".....<LG...... [...C..}.].%g..,..C.L..e.\`/{9.t. 7.g9{.@.}]..P.w.Z..e....G.<.=.e.......KJf.V2.C...
<<< skipped >>>
GET /ico/daosu.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:48 GMT
Content-Length: 46598
Content-Type: image/jpeg
Content-Location: hXXp://VVV.941pojie.com/ico/daosu.jpg
Last-Modified: Wed, 01 Apr 2015 15:17:41 GMT
Accept-Ranges: bytes
ETag: "80d8d0fe8e6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
......JFIF.....`.`.....0Exif..MM.*.......1..............VVV.meitu.com....C....................................................................C.........................................................................................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....h..;...O....03.:.........$K.x.WH..ol..;-:.^)u.bt{m6.a_....O..|. ....`......I..........c...U.Z.N4.ZJr.%..YV'6.:8t..%:..........rwT..si.......|K....~....E...x.P._..x...?.j.>...2.<..kv.E.}JY.....V.s.co...$...9..q.n.,6>x.O.....a.....#.....j..5.......k'.Asa....r..Q...4.YS.Z...j......]x...........j......3....-.j#.A.Si%.....f..V.....5.j.T.1.h....:..I>i97eg..$.Ku....Ia0...F.QJ..Wz....Z....o..'.....M.'..K..~ f.Q.l........\.C.s..~>..c..V.;..SM......v..T0i...t.\....uRM .......O...%.,.4..y.9.8.Q....2p6..hy.rn..v..p..zx.t.......X..&..ni(............../.....7h..m...Z..%....k=..,...m..s.}l,,........o(rF.,G..51..X.BM.Z.u...7d...knr..B>...Z...[V...4.....s.m[...oog.?.Ix..M..........0......q]t*...63......Q.....}.}.]|...r_W........y$....~........O....6....k..GR.N.H/.b."4#....uJ.&.../..m>j.o{Y]).%f.KMo.cjR....E]m...f.Wqv....U...5?....).W..$.c..:..
<<< skipped >>>
GET /ico/jisu.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:51 GMT
Content-Length: 8504
Content-Type: image/png
Content-Location: hXXp://VVV.941pojie.com/ico/jisu.png
Last-Modified: Wed, 01 Apr 2015 17:06:40 GMT
Accept-Ranges: bytes
ETag: "0105d389e6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.PNG........IHDR...N...M......\......bKGD..............pHYs.......... .... .IDATx..|..$Gv.9.=2.........0.H..g....Ez...*.....}.>@f...h....H.....l.......t7....2#..=zp.............p...{.........../..$R....H...0.l.R...."i.4..q.p..."B..).-...P..q.T.PV.<$I....Po.@.!H.H..........@..(...A....\.=.............E........A...%...?.Y.d4....>.Q.IV...........$..t.........RO.....i.~h..\..... !....I...W.3IRB@`.(h.z....8h.....P...v.m..;.M"......].@yx....._^..."Dj.q...................F7.@...@.$P.h..:.f4.......c.FHP.$C.SL.!.$@..9..@...h..H!!..'.....%.8.>..0&...!."HA.(..^...vVD."o....h.EL......5.l-.Q..y....V[d.N633..s#)"J)... D..J..& (I.&.`..QMB..x...}$B....W.C. .~r3RIdH..R..m'...V3&.=..W...a(...D.E0..r2.6.....$.@=.q..$v..]....G-f*....#S.$L...@...f..l.In~i..<Y.%<.Q]..-...'.w...DH.YE5...d5E..7.....wg.Rx. ..Wo......M[..V....Km^vl..l../.."..Y. ..h.%....$LP0Db..5.lN.........."bk.....Cm.....SN.Y.s.P.a...b..>.$..Q.....0.ZS......ek ..s.$.j.jn2-G[.z...|.G.U.G#p..Q.)Y..Y.J).(......P)....j.........$l..5El...p. .V...u....`.......-.L..@.Z...V.$N....&"...q......-...:.. ...=67.@%vl5....Du.P....R.}...E\"A..8..W..K..!...K....Z.#%......"".!.Al..q.`.D2<1...OHE2C.#..K.@..H...N._.iyL.&8A.-0...E........A... .4..C@D. P...;.d.tcr. dc....w7c...Q$.GW|_.dr.b0...mA....<...%.L..G...b..qf.5... .c`.SC.@`...1.C.V.... .<..@.,...k....V.DP..."...9-.:3"k....f..@8..`.....N.f..^..g\..].r6_.............sX.A....../..[...8}.c.Y...Y......@.u"Cc.............`5Vl.a..[...i...k`'.n.x.....y.rG..!.p.....z..w..E(.(H.....K.?}..'.....r...k..I.((.......
<<< skipped >>>
GET /ico/sansha.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:51 GMT
Content-Length: 59148
Content-Type: image/png
Content-Location: hXXp://VVV.941pojie.com/ico/sansha.png
Last-Modified: Wed, 01 Apr 2015 17:10:38 GMT
Accept-Ranges: bytes
ETag: "0fb38c69e6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.PNG........IHDR.............N.j.....bKGD..............pHYs.......... .... .IDATx.l.i.m.U.8....s..y..z....I..q0!..L......&..TeT.....I.....P0......)H0a....q.....7.....H..'=..k........{.....o<}.m..{5s.5.....}.?..~.c?./.....@0.A.5F.&..h......,.....H..#....E..@f.......Q .0..........d.........T.....3.`.?@F... ......{.y...Rw.v(...8l...O....w...s..#......D.<..d...F.Pv..BB.........2B@v...t.u...3..(.,.K..$.$..H.@RB..bYM.W....[p.........{,6..!._z.....~.?.G..`.....7.DX0....hD X...\..."...Cd...#.X.Qp..'@..0 ............I...c..../K.b.....\..,......p.....|]w.%.... 2vP.g.{...|.3.9.....N...V6Y......... .):..>....$.\.t...........d.)R...DQ,o].A.a....8Y^.MD5...U.>..m.................[.o..7...?|..2) .F..36...5k...h..lz.i.........v....,G...:....". .A.....b1J.;0@..)!.-.$.eb5|.@.L...m......f..~.?.}......a.wp.. ...w...?.?......,.`.!....F.......$.A.RB].@......#.%@......X@.`Q....@^....`&0.....E33...S.. d.P..............i........X..F.$..u..`%..l....=.).\.,.; ..S8....L.IY.ss.H...d$.h4.. .%....I/{[7.....G.I.=..t....>.6.1......7v.....'..bT: ....%.............?......`$..^.....K..@..5..I...f....0H.......f.f.@...^.....t.).9T\e...!.!X.B.,D.....4Z....].@.|/..E..%_q...hw.....Fd.zF.h.]..hd....>.&...}.C.(..,..f$I#.d2...sY...K.,..d4F O".h..@..c.A4.....p...VBb .X.=...Zh.....u..!..M..~.......F........P!......|.......f].F....X..A/...L..iF'.Fc[.J:..H..*....YBc ...'.......<.O.#..>...'_.4$O..$I..kf'X..Y.D....].r..?n_....y[.......I.1..H;d..7)...4e.d.j,.r...M/X1R.v....@......7........W.6%O.T`1.....p.)......k......%..........?.gQy..).
<<< skipped >>>
GET /ico/linggua.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:57 GMT
Content-Length: 4410
Content-Type: image/png
Content-Location: hXXp://VVV.941pojie.com/ico/linggua.png
Last-Modified: Wed, 01 Apr 2015 17:21:34 GMT
Accept-Ranges: bytes
ETag: "0a33a4da06cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.PNG........IHDR...0...4.....C.,.....bKGD..............pHYs.......... ......IDATX..YY.%.U]{.sNU......m.NH...2...<d.e.C..$... .........."..H....>P.......B0...&8q......o...TUg.........?......:{^.hy..L...z........{.E.Y.L..fP ..B.........p...q.....H..fV...............|Q.F.Jf.C.C.....>......5.b.f...ef....@Dk...@..g....-3..h`f...}...q.r.M....On5.jl...u.Tw.......c..3._.G.A..#..OD...s.g]..@@......#..K.. ....Bd.T.."....c..c........uP.Y......o_..}...,{E.q.,S`...BU!o%.... -.a..*..)8Je..1S..y/._r)..U...x.PCF....e..U.\5.Tq...5......Q.Ix.....=..ES....^3.K...y...A...Y&...L..."q...2V.B-Q...1..4.>z#-.eKF "...s...g.Ki=..3.9.......M...O.F..%.*..A-.m..3....T=.{.#..(.k..S)j%[_..X.,,.C<..m..g....,bj%.f..."....cs...N...}..x.@.S.e..Jd?...CX9.E.m..R..1.H.d......<..U.1Z.-.....9.Y5....IM..!3.3-TR....JZ:..u....;.?./..Q......&....b.r..PJ[...3. .rE.}u...E_...u......n:.r.....Y<.H..g..^..2.UV....b..:'x.LVWU.^r'..V....bs..I....V....c...:.jwq..oU.t....[\........m.7.K..o.>..cG1cV...............~(....;/.....y.b.Z......O.....YS..X.3.$(...(z.e..F......l..!...Cg...;.....c...4....H.L.>.r(4".TA~Y.>.X..}...q..GS...]..y.`...o.m..!0...E..U..a)......[o..!K..P...I...U...A.u0.......-{.]...t....`Q.I.)....j.....x.m..n9~...s..,.f...V...... ......]ImSk.F...K..%.......XL2...<=U..........:5...W..\@nIR1{..'Sbt.....r.*...T..d......n.A6.....A.....).@......;\........X...WfDy)/})~....^<a.b....F.|.......~>|.l.....P_......8..c' 8..'d...'.v.v.......h....ubfLa......NL.7~..W.~..X.X.Bb%.6>......|..f..'..........yV?.....p.u[S.......s
<<< skipped >>>
GET /ico/daofeng.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:58 GMT
Content-Length: 5777
Content-Type: image/png
Content-Location: hXXp://VVV.941pojie.com/ico/daofeng.png
Last-Modified: Wed, 01 Apr 2015 17:15:07 GMT
Accept-Ranges: bytes
ETag: "801f8f669f6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.PNG........IHDR...N...N........J....bKGD..............pHYs.......... .....1IDATx..\Is.Wr......n....F ..Hj..b....;b...v.........8.....\..F.9\F$@....Z].[|..bc!%.E ....BU}/.e~..k.?........J.r............/.o.......[..C..Z....7Q..A.?..u....P ..........2~2....7......7...8.0..^....@...N....!..J).t..!.Rz.8..\.h.w\*....(..Zk.@(..%..QJi....!.......b).7w.A..G...g.m...b..-..P.4.@...._..e......\o`.o.$.<......0.. ..^..a.J.z...G.}.X].-[I.(.@...Z*.........[i.............O.>}..Y..RJ....8e4......._....V>.'.=K.....k......f1>...4.T)....?......I.....RiJ..8.l.P(...F....@..z.j.k...\.....H)..T*e2....@....R.P!..M. L2.p-....W..,...0.RB.....!..d.(.d!-./..J..WJM.......!%..j3.U"8c&7....r.L.v]..V*...`.n...)NB.RJc.&.0..u]....N.e.QJ..7.~.@.Bv..g...aT*Wl...Zi.............F.4)cR.^..._|..._.'c.Zt..RiM..!...6.....~..rc.u].;......Z..x....y.....JQB2.[..=..c7.-...j..L..h<z.........v..).@.iHi .......%.R.VY.....[).o.R.R.H&q4$..&..h..SFh...a..I.U.4h!.x<.v...@...Rk...R.$....}.:-?R.8..$..u.Pg9B..K(!@@iB..8.R.Z...9B.P"I.(..$....}...2.X5.....6.....Jk....!.eU........b.h...J.1..A..!R..B.9.!...~Df.PJ9...[.....y ....B.m..R.Z.frY.0....Z .@9K...g'.[ D..B(c...aPJ...1.0......y.*.....U,.....J.2..O..... .C..M.L9U.D..VJ \...o........{......J.RY2M.;1..d<.v:S.SJ....z.57:.2h...Mi.4.........Nm...7..b..\).-.......i....Gq.k.qJ...v...b.. )....\.:7...q..R!...@4R..t:..}..B.$....[*....Zk....B6.e.j..H|........m%.?..~.T..9.m.0MJ.. ..N..n...z....,. 7....]..Rf.......i)E...^..lN&.......[$..C..3...@.....A..F..h.E.R.9.......OK.q...v.AH...h4........[...c...M..9..
<<< skipped >>>
GET /ico/shicai.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:58 GMT
Content-Length: 21714
Content-Type: image/png
Content-Location: hXXp://VVV.941pojie.com/ico/shicai.png
Last-Modified: Wed, 01 Apr 2015 17:25:23 GMT
Accept-Ranges: bytes
ETag: "8043b9d5a06cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.PNG........IHDR...o...l......3{.....bKGD..............pHYs.......... .... .IDATx.l.g.eI.%v....O.......3.\3.....h./k6......)"C<u......Y.M.Y...v..qpp<h.....`r..9.......0..;..._o.....X%"'"..j..j^}.@..j...|>f[D|w....c$s.(....O.i....v...... .y<.^.O..\...)t}.V...LK=^.i...s..B.^f.6.}.i......Q .V3.BL.d...0.N .8..u.0z[............ r<.>.z3........................w:.9Hs..a...4;k. F......7..:....if..V......2.....mK..r...........g/...0.]"....G......3.j.....F......$P3S%... ...... .....'..i.g............Zw..........oV.{..@p....N"......q./.p)uaj...bbI.8R.]...b.....T...~.S.....O.4..=..s.K&......)..8.O4fn.......]...3..H..*.....I.j.i.I."bf.......6.1.a..].....Qo/.......~.X...n.......3.......;..{.....8..^....]#..........P.Y...%.M/...tiS.i..n.AV..R.eP]j.....v .UL/u.y9~.v.P9.v{.........k.B0#2.Uy\.T.Q..a....)H$r..-.........'#...?............d......LD........O.b...2N.<..%m.~.......`....8./...j.c&.UYk_..r...m.7.<P)........*..........N.k9V.S....w..A.;....2...B..l....R.a.]...B....-..FN ...p.W..'.....d.......r........f.7.$....d....@ .k..<..Y.S.o...L.`A=....1....'..D3.d.......Z.}..o7..._.i>J...S..<._...uz.v.~.r..j.YG.S....R8/...m.m..V....^O.8..!. 5..5..n.._.....|5..?.....o...[..h.c.v.....-o:. f"...DoU......0..x9.%wq...n.H<..Jy*.....j.H|aY.>....Z`"|....lv.h.a.&]Z....p....M.z............F...h..r..K..g..f......z........,.....8$a2W...F..&.........V.2._..Mv..7..u.h.j..........9..f.}....B..j.s.9.. .I!.........G...#.@6(&..Ye.I .kMn..Fxt..gp...Ib..-.C..%...D..lvq..J 7.e.R.h........m..p...|.lQU...fd...L.....2.
<<< skipped >>>
GET /ico/longshen.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:26:00 GMT
Content-Length: 45212
Content-Type: image/jpeg
Content-Location: hXXp://VVV.941pojie.com/ico/longshen.jpg
Last-Modified: Wed, 01 Apr 2015 15:17:40 GMT
Accept-Ranges: bytes
ETag: "04238fe8e6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
......JFIF.....i.......0Exif..MM.*.......1..............VVV.meitu.com....C....................................................................C.........................................................................................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(............?cO....s..<3...g.......U.?V....~.Y.x$...GV.........s......k>....{"Z.x.R...k.v.).......shRr.W.._.|... .h../.......nu.......#g<7.q.O.g.o.g.........]x{..x&.....F.3....Nx.[.B.....O.......S........`........~...^..].e...>6.K........W>&.y. .^I...g.R....W,{/......?jo.9_....y>"...GE.w...........7.......<..........Yv_r$........nW..g..'.Q...3.Z.........Q....]...!...?jo.9O....y>"...........V.....^_?.K....6.|*.]v{.?..._....7.......<...........u..........~....9.......O.^O.....w.....oM^....?.?..?jo.9_....y>"...GN.....RIYh....k.....W.....O.....w...,./...5..M..G ......'._.h......]..................../..4t]..{....A...a.S..............:......e. .........~?...........}.........X~...r......|E........ae.}.?..?jo.9_....y>"...GE.w...........7.......<..........Yv_r..k.....W.....O.....w...,./...5..M..G ......'._.h......]...!..
<<< skipped >>>
GET /ico/tianxunzhe.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:26:02 GMT
Content-Length: 44659
Content-Type: image/png
Content-Location: hXXp://VVV.941pojie.com/ico/tianxunzhe.png
Last-Modified: Wed, 01 Apr 2015 15:17:40 GMT
Accept-Ranges: bytes
ETag: "04238fe8e6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
.PNG........IHDR..............X......sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.....g..kp..wVVV.l.m.l6...... ......N h........9.9_..|Tz.d!!.3.s........o.{?......]...W_a.........7.`...N.}..a...R...g..m..!;;;..=.~......6lp..../.u.V.../.p.si..-.uX..Y.Z..5...[.o........._~...}...._.>..k..... .b..|...X.j.V.^.5k....Z.n.a.._.Dq.xU.*~.x.{....3.=W..n..D)....>...........>p .....G..O?...c....a....Tq..U. ....qI..=.....8 ...E..."L....&.....iS<..=.dS.uX.....,.R......[..l....,X...... ....3..H>Q..../Tm..F....~{X....bVR.*....E |...q7.9..Y.f....2g.....Eoja.!.D.V./.....{....N?...a...B..._...Yq...L@......S...@....c...M...Md..Z.V.c.....ON?...a...J...c.... Q....LB.1i.$.S.Lq.....J.T..C.$.....v...Z.|..?..:...Y..@...$J.T.X.....1z.h.}..EVV../^.,F...J.(j......l....uX.k.4:.....j..Z*..E-\...F.B..W/...%K.=.H4.{.4........a....D..8W..r..veT#F.@..{w.....`..T{...]..w.D_zX..w....[...Ae......d........z.e7.......I.e.uX.G..(.e.2. ..Q....t...$Z.......d.(..:D..2..K........D.....@Wu....._...../.e.*9\."@..... *X..rX..R\. .w.CB@.A.....j...c..S.....c..K.0....X9:H..9|0.-.@.K...^[...............S..w.w......DE...r...R.C...j.`....&...d.w.GZ^..k]:.Z..C..@2x.]:..._.:....~..0W.q<....._.,.V[....u..z..|.j5>X....k..r..eX.d)./Y......g....?X.... ?...k...S.K...n.?m.....CcN..w...a@..,U.o.>...6..........O..u..5k..>d./....0m.lL.4...da..!....z.......G.......;4F..........M.S....={tA...1`.@.....f.......mX.r...]......].A. h|`.?........3.0 ."i?(.Q.}..'X.V .....1m.Lde....#0l.@....}..E.....U.t.HG....U...E.'.....(..Z.\..)..U.5h.|.o.2...*
<<< skipped >>>
GET /ico/lingfeng.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:26:04 GMT
Content-Length: 12122
Content-Type: image/jpeg
Content-Location: hXXp://VVV.941pojie.com/ico/lingfeng.jpg
Last-Modified: Wed, 01 Apr 2015 15:17:40 GMT
Accept-Ranges: bytes
ETag: "04238fe8e6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
......JFIF.....d.d......Ducky.......G......Adobe.d.................................................................................................................................................................................................................................................!1A..Qa.q"....2B#..$.Vv...Rr.S..eu..b.3C.....%....4fW...........................!1QAaq."R.......2Br...s.....#St.b.3%...Cc.$T....45............?....L/W.F\....f.o..AvT...........'8.R..'H.......x.Sr...E....Q.......3..Rp..:.* .6!....~Q..9...>.5\.~#u.......Ls..[...$......n.:.!.Vhp..5F....V...W...2z.......8....].....!................4......E..?|.....2z...._0.q.J....L.G....^....={q.j.2.q.F0k..3...?{.....2z...._2.q.J....L.[.C...._.'..?-E./..4..]....|.~..w..d.....|.... .[..3.o.`..]...=yq.j.2.q.F0K..3.o......~..........x...u.&z-.,............./..4..]....|..{....2z...._2.q.G.%..........._.'..?-G./..4_.]....|.>..w..d.....|......n...E...{....2z....>e.....[..3.o.n.."........O.a.Ou7....LK...q.....>\..i...OqX.0....f.....id#.....G.g.....JiG..:.G..W..vE.....~.*..oV..k.z.Lj.j...iq..m..!C..Q..T*$..7..P....6...4.....X........6..2..w...4JkK.........]b.N@...l.np.....%I$zS...{..r;.....^h5-[...u`s......&.....;.cQ*.V...Q.`G..RIN.:.B.....#..&.X..7Ei8!F.QZJ...QZJ...P..!F.QZK........=* H...*... :T-!...P..B..B.....Gi$...Gi ...F.;I......^..A.....rNB......T".d.Je<.}.G...T....hu*.b...Gi..7V....]-....Jl.z.........N.6.^].....V9.:..i.).....@.,i.\.ot.p.....N..#......P..MA.%..mV......gS;.W}y...m....\"V........,...D...$..d}>...K...qi.......~S.}..
<<< skipped >>>
GET /ico/longtian.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:26:05 GMT
Content-Length: 36268
Content-Type: image/jpeg
Content-Location: hXXp://VVV.941pojie.com/ico/longtian.jpg
Last-Modified: Wed, 01 Apr 2015 15:17:41 GMT
Accept-Ranges: bytes
ETag: "80d8d0fe8e6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
......JFIF.....H.H.....0Exif..MM.*.......1..............VVV.meitu.com....C....................................................................C.........................................................................................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(............?c?....r...3...k.......U.?V....~.Y.x$...GV.........s.......g.^....K[...Z...xj...~....._.WO.s^..|y.w.{.....YG.?..1...<...z.G..u......o.Z.y........<....r..........m.^.jZ..I.E.z...k..C.o.....H..qus.i'.B.......p..S.........~?................7.......<........o.].N..i...7.A[.......^..q,...g. s.x....i#.....P....\.N......7N..$'Q&.Nr...'$.)(.F-.:.u.!...... ...*b......xb.a.s...k....(.*Q..R.}.'RQP.Jrjq........,-.[..=~.~2.,..f.....t..st...m/O...!...V..._.&.b....)x.....C.........#...`(.wn.3..rs...V.;..c.)....9....2....~.....(.jI.9.n..a.%....3.[#.3..C....<...N......kK.....5j....|..O....4.^..|M.....hi|...T....-..e..W.&....(o............X.xu.n..R..(..IS.....15...X.T.WQ....C.. .[.~...|k...9.....{...b3.F^.b.^*..T.<.....x...l.X.....9(..|}...I,,4.t=*.._...|j.V.{3@...]N....\...Qqwo.E.=...O-|....O._..<.b..`....3.B.n...GN4....y....d..I.ow(..
<<< skipped >>>
GET /ico/xgz.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:26:09 GMT
Content-Length: 9106
Content-Type: image/jpeg
Content-Location: hXXp://VVV.941pojie.com/ico/xgz.jpg
Last-Modified: Wed, 01 Apr 2015 15:17:40 GMT
Accept-Ranges: bytes
ETag: "04238fe8e6cd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
......JFIF.....&.&.....C....................................................................C.......................................................................|.|..".........................................J...........................!."1AQ.2aq..B..#3br.....R.$%&CS.....45cds.....................................=........................!.1.A.."Qaq......2R...B..#3Crs.................?...............W.'u.v..-.......z.#..}s..MZ.L.j. ..#$...X..W).... ..B..."T..w..qI...YI.A!P...P..d$...:.7.2.....w.\...&..c.Rq....s...1)......._....c....A'f..zD."..fU.,!......7....z....Vz]...|C.A..)k.M....MJ2....t?08..../.%5...$.q........~.V....N.}}...i.|..B.. ...|[..<....A...l...{...8v.s........(.g..j..........g..ki=S....v..t....T.....!n...bpdH#........]..Km4..g....z.|...[kMe-.Q..VK4...J./..6q..r.H....D*FT....)m....j...r.......7.S&.\.j*.:.l..7~w.?.y..../O.KU]w..D........K&..fM...T.`..-... .l..."...X.b...1KQ{........E;B..^..a.$m....D......]'q.....^..b.4...S.0.....F.0...K2.wg.:9.Y8....A...y3b....2.Z.{u:..s..g.K,..g#f.....kP...*N?. ...&..Uu2..5.P<... .=...%..U.Rz....Rcfy...0...t.."...w.&.FFv........8.rx!.nNE)....T..T..-U.D...d. ..8........>...'..k..:..w............k.\?eBbH.......1...=G.}L...(.T.....)2/.j0...3..u....^.Ax.M_CA;...P........D.~Z...._m.x).0. ..........YH....,./OkT.........{\.K...Q..n.I....7..7....p..T..9.F....l....u0....2.. d.~..|.o.6.s..i:.e.....{K-U[.;.{4..L../X..`'xli_......ST;<v.....g.X..... ..#.../n.T....B..S......{.....>......t......OP.0..'X.......*q........R...&.j.....6>x.|5...Q\..S@D..@8>a....
<<< skipped >>>
GET /stat.php?id=3325108&show=pic1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s85.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Date: Mon, 08 Jun 2015 15:25:09 GMT
Last-Modified: Mon, 08 Jun 2015 15:25:09 GMT
Cache-Control: max-age=5400,s-maxage=5400
Via: cache37.l2de1[789,200-0,M], cache3.l2de1[790,0], cache1.de1[789,200-0,M], cache5.de1[791,0]
X-Cache: MISS TCP_REFRESH_MISS dirn:1:802275853
X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:09 GMT
X-Swift-CacheTime: 5400
4aa..(function(){function k(){this.c="3325108";this.R="z";this.N="pic1";this.K="";this.M="";this.r="1433777109";this.P="oz.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=3325108");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURIComponent,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ..1104.. ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_accoun
<<< skipped >>>
GET /img/pic2.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: icon.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: image/gif
Content-Length: 431
Connection: keep-alive
Date: Mon, 08 Jun 2015 02:59:10 GMT
Last-Modified: Thu, 12 Feb 2015 08:15:09 GMT
Expires: Tue, 09 Jun 2015 02:59:10 GMT
Cache-Control: max-age=86400
Accept-Ranges: bytes
Via: cache61.l2de1[0,304-0,H], cache6.l2de1[0,0], cache4.de1[0,200-0,H], cache6.de1[0,0]
Age: 44758
X-Cache: HIT TCP_MEM_HIT dirn:2:948705605
X-Swift-SaveTime: Mon, 08 Jun 2015 02:59:19 GMT
X-Swift-CacheTime: 86400
GIF89aP.........eee000...........................e...00...0..................................................!..Powered by AFEI.!.....S.,....P......` .di.h.....p,.tm.x..|....a..._..1i,...&3.\2...v{.-...xL.s.g.b-h...5......;.=g......".......m......................m...............".........................".......m..............."..w.....u.n..m..........".....H......*.Q.....#J.H.b...3j..Q... C..I......9.\)b...0c..I....8[........;HTTP/1.1 200 OK..Server: Tengine..Content-Type: image/gif..Content-Length: 431..Connection: keep-alive..Date: Mon, 08 Jun 2015 02:59:10 GMT..Last-Modified: Thu, 12 Feb 2015 08:15:09 GMT..Expires: Tue, 09 Jun 2015 02:59:10 GMT..Cache-Control: max-age=86400..Accept-Ranges: bytes..Via: cache61.l2de1[0,304-0,H], cache6.l2de1[0,0], cache4.de1[0,200-0,H], cache6.de1[0,0]..Age: 44758..X-Cache: HIT TCP_MEM_HIT dirn:2:948705605..X-Swift-SaveTime: Mon, 08 Jun 2015 02:59:19 GMT..X-Swift-CacheTime: 86400..GIF89aP.........eee000...........................e...00...0..................................................!..Powered by AFEI.!.....S.,....P......` .di.h.....p,.tm.x..|....a..._..1i,...&3.\2...v{.-...xL.s.g.b-h...5......;.=g......".......m......................m...............".........................".......m..............."..w.....u.n..m..........".....H......*.Q.....#J.H.b...3j..Q... C..I......9.\)b...0c..I....8[........;....
<<< skipped >>>
GET /img/pic1.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: icon.cnzz.com
Connection: Keep-Alive
Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8
HTTP/1.1 200 OK
Server: Tengine
Content-Type: image/gif
Content-Length: 428
Connection: keep-alive
Date: Mon, 08 Jun 2015 07:39:10 GMT
Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT
Expires: Tue, 09 Jun 2015 07:39:10 GMT
Cache-Control: max-age=86400
Accept-Ranges: bytes
Via: cache3.l2de1[560,304-0,H], cache37.l2de1[561,0], cache4.de1[0,200-0,H], cache6.de1[0,0]
Age: 27961
X-Cache: HIT TCP_MEM_HIT dirn:6:814361188
X-Swift-SaveTime: Mon, 08 Jun 2015 07:39:10 GMT
X-Swift-CacheTime: 86400
GIF89a.......f..3...33.......................................!..NETSCAPE2.0.....!..Powered by AFEI.!.......,.............I........08bX....d.n...CS.3......_..`..H..H\8....)...S.b.UX.....(...r.L....tb]&"......#...o.V.a..D..o.V.a..........D..o.V.a..........D...........!.......,.............I........08bX....d.n...CS.3......_..`..H..H\8....).:...@..z...x ..........D.| .#.u.a....n~D..[....n..........D..[...n..........D...........;HTTP/1.1 200 OK..Server: Tengine..Content-Type: image/gif..Content-Length: 428..Connection: keep-alive..Date: Mon, 08 Jun 2015 07:39:10 GMT..Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT..Expires: Tue, 09 Jun 2015 07:39:10 GMT..Cache-Control: max-age=86400..Accept-Ranges: bytes..Via: cache3.l2de1[560,304-0,H], cache37.l2de1[561,0], cache4.de1[0,200-0,H], cache6.de1[0,0]..Age: 27961..X-Cache: HIT TCP_MEM_HIT dirn:6:814361188..X-Swift-SaveTime: Mon, 08 Jun 2015 07:39:10 GMT..X-Swift-CacheTime: 86400..GIF89a.......f..3...33.......................................!..NETSCAPE2.0.....!..Powered by AFEI.!.......,.............I........08bX....d.n...CS.3......_..`..H..H\8....)...S.b.UX.....(...r.L....tb]&"......#...o.V.a..D..o.V.a..........D..o.V.a..........D...........!.......,.............I........08bX....d.n...CS.3......_..`..H..H\8....).:...@..z...x ..........D.| .#.u.a....n~D..[....n..........D..[...n..........D...........;..
<<< skipped >>>
GET /wpa/images/group.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pub.idqqimg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: X2S_Platform
Connection: keep-alive
Cache-Control: max-age=2592000
Last-Modified: Fri, 12 Apr 2013 09:22:21 GMT
Content-Type: image/png
Content-Length: 1827
Keep-Alive: timeout=60
X-Cache-Lookup: Hit From MemCache
.PNG........IHDR...Z.........w.{'....PLTEV...dE)r.Ip..........F........F..Kyy...r.....~E ......m..c..........d3.....S.....r...S1...#.....c........A..l3....d.............ynvc......"..]Z@.mZ..jB..............&..I...\BH.....................rHh........z4$...X..0.....R.....s@6...{RL(.......Xs.y......S........%.........vb...4......bW...[%..........L..t..s..c>'...2..............wsw..i.............yM...WwaR...?-.fU...~K;.`H...t..V..:..d...........h/#.......Z74..........pt5(...K...vb=......lM.........N.kr......I A............pVs..k.....f'.p.....c..%...SG.J;..r6......fBr..o=5...T..J...jB......5.....|......n^....XLm3#......y.f.}X....]6...,y....8..........q.D-Mt....^* z= y>#.dK...^...........>..s..J..............B....q...................xy...'..t.....7..M...~Re........s: .K(.rP`)..^=.........3......G:V......WE..2.....pHYs.................IDAT8....T.U...lCs..It.....5r,*....I.K.].5p.d....2.4Fw.m}.....e.v7r.........S.D.IVR.&.....y8G;.................N.r...9.t......p9.....].......,Ko..i.......Mh.|@..hyw..9...n..qo-....C.....s.fpo..:{..vtQQG........'..zmr.......H...m.u4.;..t...7....C.........a...?....{)...W..4...u......(....l..Q.|......R.u.3K.;.!..}vy([.e.~YhG[^. y......C...<....~.<-^I3......$..B....z...?$......u...S.7....qF$?.wF..G..lkC#...=...A...C.......#x...Ea.yvS(..P..e..2..*....yD]]d.\.....{..h.....5.UK.@J....ux7...>5.H_....}...T]2x,EO7SEmf.6.u:sk(..4...-.,...o6;B...Me. .\..._.]SSs..._....?g.,.x.$.tL...)..u.<Mv`4..Q<QiU.1O.X%......q..-.w.h... **.....e}..E...'...51t...0...0v....)^1.'.^..U.u`| 3.8l.)
<<< skipped >>>
GET /static/common/images/zhanzhang.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: zhanzhang.anquan.org
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Mon, 08 Jun 2015 15:25:13 GMT
Content-Type: image/png
Content-Length: 5075
Last-Modified: Wed, 03 Dec 2014 14:46:30 GMT
Connection: keep-alive
Expires: Mon, 08 Jun 2015 15:25:13 GMT
Cache-Control: max-age=0
Cache-Control: no-cache
Accept-Ranges: bytes
.PNG........IHDR...|.../.....!.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:12842C66B96C11E3B1D2FC24D7F17EB2" xmpMM:DocumentID="xmp.did:12842C67B96C11E3B1D2FC24D7F17EB2"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:12842C64B96C11E3B1D2FC24D7F17EB2" stRef:documentID="xmp.did:12842C65B96C11E3B1D2FC24D7F17EB2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......GIDATx..\.t.......! K..... Bd., ..,..........r.xT.*.[...*...ZE.E.., ..a..v....v.^.7...7....d...=gN.Y.....{..L..5~Wo"..[.E..,...{..~............4I.\.E1.$.=.5..~....<.^...Q...^.R.s.....:....DJ].7_.Q......Q ...C*....MX.......v..no.......g.fl".....S%MJ'.w...y... c..F...{.cg...'Z.-i...5...K...K$=...IU.........FT.b.........Q)..O.L......D..K..~<H.;7......jS..U...9....QR%AI...T"*w..{..B...............I{........g;|..8..g...".T....a..>.`.a).^Y^t-..fE..n...........E...-......`.....q...C.&0!....r.........(.H....8~..kk.uI....QY.m...o.IZ.E....Kr.|..eP...V.]...n..\n. ht...G..i;..k.3..SPb.{..
<<< skipped >>>
GET /click.aspx?id=460737107&logo=1 HTTP/1.1
Accept: */*
Referer: hXXp://soso.hcjd56.com:88/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count46.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:19 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Type: text/html; charset=gb2312
Content-Length: 1777
..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(endstr==-1) endstr=document.cookie.length;return document.cookie.substring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.length;var clen=document.cookie.length;var i=0;var j;while(i<clen) {j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=document.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..function cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*36000;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=0; expires=" y_e.toGMTString() "; path=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_count");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' escape(document.location) '&color=' screen.colorDepth 'x&resolution=' screen.width 'x' screen.height '&returning=' cc_k() '&language=' navigator.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('<a href="hXXp://countt.51yes.com/index.aspx?id=460737107" target=_blank><img width=20 height=20 border=0 hspace=0 vspace=0 src=
<<< skipped >>>
GET /count1.gif HTTP/1.1
Accept: */*
Referer: hXXp://soso.hcjd56.com:88/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count46.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 715
Content-Type: image/gif
Last-Modified: Thu, 07 Apr 2005 17:25:22 GMT
Accept-Ranges: bytes
ETag: "02d4c7963bc51:38c2"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Mon, 08 Jun 2015 15:25:20 GMT
GIF89a.....~........n...............................B.....x..[.....(c............................RS....wv...................Y.....~{....'...........|........A.................ie.Z[.__..g.M.................v..sr.`^.....................................>{.............&r....'..............F......g.O.....lo.^..jj..........NN.............n...s.................m...................S..$~................!.....~.,............~......stY..i..E@Tr9]9x~SM.4[z).V.R~JK*..W:0...0..nmA5&..Gy..%..^a?\.11D>..k-...-%3NC..=d(.~Hg...L:3?o...}..~Ol....w4p}}(. .{.@.<.8....l(..p0a...<^....N...5L..1.....i)..@C...D`0B...!.....!..;.`P..A.5.D..Qf...;. pa!...f..2b"......`A....8......R.M.`..F....(>`.. ....N.x.HF...jx.s.F.1...H2.....#....;HTTP/1.1 200 OK..Content-Length: 715..Content-Type: image/gif..Last-Modified: Thu, 07 Apr 2005 17:25:22 GMT..Accept-Ranges: bytes..ETag: "02d4c7963bc51:38c2"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Mon, 08 Jun 2015 15:25:20 GMT..GIF89a.....~........n...............................B.....x..[.....(c............................RS....wv...................Y.....~{....'...........|........A.................ie.Z[.__..g.M.................v..sr.`^.....................................>{.............&r....'..............F......g.O.....lo.^..jj..........NN.............n...s.................m...................S..$~................!.....~.,............~......stY..i..E@Tr9]9x~SM.4[z).V.R~JK*..W:0...0..nmA5&..Gy..%..^a?\.11D>..k-...-%3NC..=d(.~Hg...L:3?o...}..~Ol....w4p}}(. .{.@.<.8..
<<< skipped >>>
GET /css/style.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 16918
Content-Type: text/css
Content-Location: hXXp://VVV.lszwg.com/css/style.css
Last-Modified: Fri, 25 Jul 2014 01:50:28 GMT
Accept-Ranges: bytes
ETag: "0a3acfaaa7cf1:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:11 GMT
/* CSS Document */..body{font-size:12px;font-family:Arial, "....";background:url(../img/bg.gif) #6483d5 bottom repeat-x}..*{}..form,ul,li,p,h1,h2,h3,h4,h5,h6{margin:0;padding:0;font-size:12px}..ul,li{list-style-type:none}..img{border:0}..a{text-decoration:none}..a:hover{text-decoration:underline}...blank{clear:both}...dashed{clear:both;margin-top:30px;height:10px;border-top:#ccc 1px dashed}..#header,#menu,#center{margin:0 auto;width:960px;height:100%}..#top{margin:0 auto;padding-right:16px;width:944px;text-align:right;color:#fff}..#top a{color:#fff}..#header{margin-top:5px;height:70px;background:url(../img/top.png) 390px 0px no-repeat}..#header a{display:block;margin-left:55px;width:215px;height:70px;background:url(../img/logo.gif) no-repeat}..#menu{height:48px;background:url(../img/bgheader.gif) bottom no-repeat}..#menu ul{margin-left:35px}..#menu li{float:left;height:39px;width:97px;background:url(../img/bgnav.gif) 0 -39px no-repeat}..#menu li.active{background:url(../img/bgnav.gif) 0 0 no-repeat}..#menu li a{display:block;padding-top:17px;height:22px;text-align:center;font-size:14px;font-weight:bold;color:#345602}..#menu li a:hover{text-decoration:none;background:url(../img/bgnav.gif) 0 0 no-repeat}...leftbg{padding-left:8px;width:952px;background:url(../img/bgh.gif) 0 0 no-repeat}...rightbg{padding-right:7px;width:950px;background:url(../img/bgh.gif) right 0 no-repeat}...content{...width:944px;...min-height:800px;...background-color:#fff;..}...banner{margin-bottom:10px;height:215px;background:url(../img/ban
<<< skipped >>>
GET /img/miaosha.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.lszwg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 46434
Content-Type: image/gif
Content-Location: hXXp://VVV.lszwg.com/img/miaosha.gif
Last-Modified: Fri, 20 Mar 2015 12:33:36 GMT
Accept-Ranges: bytes
ETag: "010c815a63d01:5b4"
Server: IIS
X-Powered-By: WAF/2.0
Date: Mon, 08 Jun 2015 15:25:12 GMT
GIF89a..(................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................q.-]..E]h.Z!\.Z!..-].......P0#..h.Z!!..NETSCAPE2.0.....!.......,......(..|6z....$.3..,3.(\.,c.-^.=G.3k.4q.z<.M..^U.Ae.uF.jR.}z.rw.X\.LX.Mk.Gq.a\.jP.ql.jx.=..y..v..K..J..J..K..X..W..W..^..d..k..s..x..j..h..i..e..x..v..u..{..z..l..d..m..t..u..x..........B.%V.0l.|w.q[.yq..../..11.2t.<G..8.L..O1.u..q3.L[.W[.Vz.mZ.jw.OO.nL.ff.j{.ww.?..V..w..k..G..Q..c..l..q..g..i..r..y..\..i..i..w..j..g..t..y..y..k..s..y..;..X..^..m..l..w..}..|..x...z..X..p..Y..w..}..3..4.....1...../..S..r..Q..m..N..e..C..x..... ........P........................................................................................................................................................................................................................................................................................
<<< skipped >>>
GET /sa.htm?id=261222598&refe=http://soso.hcjd56.com:88/&location=http://sky25145.hbgyzs.com:83/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://sky25145.hbgyzs.com:83/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count26.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:24:49 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Length: 0
HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:24:49 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Control: private..Content-Length: 0......
GET /sa.htm?id=261222598&refe=http://soso.hcjd56.com:88/&location=http://sky25145.hbgyzs.com:83/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://sky25145.hbgyzs.com:83/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count26.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:24:50 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Length: 0
HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:24:50 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Control: private..Content-Length: 0......
GET /sa.htm?id=261222598&refe=http://soso.hcjd56.com:88/&location=http://sky25145.hbgyzs.com:83/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://sky25145.hbgyzs.com:83/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count26.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:24:51 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Length: 0
HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:24:51 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Control: private..Content-Length: 0..
GET /cj.txt HTTP/1.1
Accept: */*
Accept-Language: en-us
If-Modified-Since: Thu, 01 Jan 1970 00:00:00 GMT
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: jc.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:12 GMT
Content-Length: 12753
Content-Type: text/plain
Content-Encoding: gzip
Content-Location: hXXp://jc.941pojie.com/cj.txt
Last-Modified: Mon, 08 Jun 2015 01:28:40 GMT
Accept-Ranges: bytes
ETag: "094f5728aa1d01:751dc"
Vary: Accept-Encoding
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
...........}i..8...n..Cn 0.....J..H...0..‡.*...y..*...?.......8..w..A.....`.IV.b...../Z..)cYL.T....c...{.".d9A,....n..].O.v.@...X^,...7..jT.N..<4.|.........]].(..g............Bu..s.U......r.6IBNT....../o.....3...Y=O...T.%.K.{..mx<&...6j#hp$.....>..7B]j....l..{]JAPW..s...[#...A.|s`........y..e.f..;..w.d.>...w...._.C.... ......R..^.... ........97...DV.d^.n........W0-.%j..h..i\.&9....#.{..e.U|...K=..........4u.}..J...d..........=w..#.{.(..}.h)>...u.F.3...".5.......Q.......p.z......H.zn.......i....}..>...vJZ.........a.........k...,/H4 _.i....\7 y....-.f@.*...F...hNw.....&c$..(.......P..}4..V....]...G.\.8#.Mq.jGr..8......r....x<3h=....v.../.....R..f......\....c..A.....I.ah..............i....!..R....4.K.syl].{....@).[Li.....A..>........q0$;uz..j#%/...O.2jcw..LWO...B.}.T....C.d.I.,f5.<2..aD.......So.(..=....S...Q..o.*...5.{.R....\.</.._.]m...!......5'.(.^..L5G.#.v.W.Kt.0...T..S.Q..H...Z.<T.XA]h...B..jwg.N).......).}X....G9qJ.mU.&...q<!.$. ;yH....tM.=..F.H4.?x.....F"<.....#.v7.V.R......S.Ca...B..l....I....$.[K*]p....yh.....L.....8.4.].v=.m*Z.......,k...VP.?wa..a........|2`R..w.....e.....7."wJ.)>..{.>.....j.$../6=~._.6<=.....,.............Z..6F|.P.Pi..S;.IM0.V....AWj....K...g..>.#....\...no.=\g.4....pM......3.BL..WL.a...~z.qJ@u.M.1..*Hu_.g.Nh......$!..q.....o.*4.....*.?S.)....uJ.g:....$&..[..$.'.tX..5..K8.6.i(.=......_.......r....o..G.|i.%....Nk..).f.Zn.}."G...... ..%q."...z.g.7.@..........@|WX..e.PK.....q..pXY)..a....C..cP..[............}.....^..G..c.MSt...[..Y...D..
<<< skipped >>>
GET /img/pic2.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: icon.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: image/gif
Content-Length: 431
Connection: keep-alive
Date: Mon, 08 Jun 2015 02:59:10 GMT
Last-Modified: Thu, 12 Feb 2015 08:15:09 GMT
Expires: Tue, 09 Jun 2015 02:59:10 GMT
Cache-Control: max-age=86400
Accept-Ranges: bytes
Via: cache61.l2de1[0,304-0,H], cache6.l2de1[0,0], cache4.de1[0,200-0,H], cache7.de1[0,0]
Age: 44758
X-Cache: HIT TCP_MEM_HIT dirn:2:948705605
X-Swift-SaveTime: Mon, 08 Jun 2015 02:59:19 GMT
X-Swift-CacheTime: 86400
GIF89aP.........eee000...........................e...00...0..................................................!..Powered by AFEI.!.....S.,....P......` .di.h.....p,.tm.x..|....a..._..1i,...&3.\2...v{.-...xL.s.g.b-h...5......;.=g......".......m......................m...............".........................".......m..............."..w.....u.n..m..........".....H......*.Q.....#J.H.b...3j..Q... C..I......9.\)b...0c..I....8[........;HTTP/1.1 200 OK..Server: Tengine..Content-Type: image/gif..Content-Length: 431..Connection: keep-alive..Date: Mon, 08 Jun 2015 02:59:10 GMT..Last-Modified: Thu, 12 Feb 2015 08:15:09 GMT..Expires: Tue, 09 Jun 2015 02:59:10 GMT..Cache-Control: max-age=86400..Accept-Ranges: bytes..Via: cache61.l2de1[0,304-0,H], cache6.l2de1[0,0], cache4.de1[0,200-0,H], cache7.de1[0,0]..Age: 44758..X-Cache: HIT TCP_MEM_HIT dirn:2:948705605..X-Swift-SaveTime: Mon, 08 Jun 2015 02:59:19 GMT..X-Swift-CacheTime: 86400..GIF89aP.........eee000...........................e...00...0..................................................!..Powered by AFEI.!.....S.,....P......` .di.h.....p,.tm.x..|....a..._..1i,...&3.\2...v{.-...xL.s.g.b-h...5......;.=g......".......m......................m...............".........................".......m..............."..w.....u.n..m..........".....H......*.Q.....#J.H.b...3j..Q... C..I......9.\)b...0c..I....8[........;....
<<< skipped >>>
GET /img/pic1.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: icon.cnzz.com
Connection: Keep-Alive
Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8
HTTP/1.1 200 OK
Server: Tengine
Content-Type: image/gif
Content-Length: 428
Connection: keep-alive
Date: Mon, 08 Jun 2015 07:39:10 GMT
Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT
Expires: Tue, 09 Jun 2015 07:39:10 GMT
Cache-Control: max-age=86400
Accept-Ranges: bytes
Via: cache3.l2de1[560,304-0,H], cache37.l2de1[561,0], cache4.de1[0,200-0,H], cache7.de1[0,0]
Age: 27961
X-Cache: HIT TCP_MEM_HIT dirn:6:814361188
X-Swift-SaveTime: Mon, 08 Jun 2015 07:39:10 GMT
X-Swift-CacheTime: 86400
GIF89a.......f..3...33.......................................!..NETSCAPE2.0.....!..Powered by AFEI.!.......,.............I........08bX....d.n...CS.3......_..`..H..H\8....)...S.b.UX.....(...r.L....tb]&"......#...o.V.a..D..o.V.a..........D..o.V.a..........D...........!.......,.............I........08bX....d.n...CS.3......_..`..H..H\8....).:...@..z...x ..........D.| .#.u.a....n~D..[....n..........D..[...n..........D...........;HTTP/1.1 200 OK..Server: Tengine..Content-Type: image/gif..Content-Length: 428..Connection: keep-alive..Date: Mon, 08 Jun 2015 07:39:10 GMT..Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT..Expires: Tue, 09 Jun 2015 07:39:10 GMT..Cache-Control: max-age=86400..Accept-Ranges: bytes..Via: cache3.l2de1[560,304-0,H], cache37.l2de1[561,0], cache4.de1[0,200-0,H], cache7.de1[0,0]..Age: 27961..X-Cache: HIT TCP_MEM_HIT dirn:6:814361188..X-Swift-SaveTime: Mon, 08 Jun 2015 07:39:10 GMT..X-Swift-CacheTime: 86400..GIF89a.......f..3...33.......................................!..NETSCAPE2.0.....!..Powered by AFEI.!.......,.............I........08bX....d.n...CS.3......_..`..H..H\8....)...S.b.UX.....(...r.L....tb]&"......#...o.V.a..D..o.V.a..........D..o.V.a..........D...........!.......,.............I........08bX....d.n...CS.3......_..`..H..H\8....).:...@..z...x ..........D.| .#.u.a....n~D..[....n..........D..[...n..........D...........;..
<<< skipped >>>
GET /9.gif?abc=1&rnd=1417281194 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Server: Tengine
Date: Mon, 08 Jun 2015 15:25:12 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=2KH8DTH0XjQCAcGK9Ofwcxcp; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.mmstat.com
Set-Cookie: sca=b86e224b; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=0eb8d8df8d3ca1d9277f4f3f_1433777112; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=2KH8DTH0XjQCAcGK9Ofwcxcp
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server: Tengine..Date: Mon, 08 Jun 2015 15:25:12 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=2KH8DTH0XjQCAcGK9Ofwcxcp; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.mmstat.com..Set-Cookie: sca=b86e224b; path=/; domain=.cnzz.mmstat.com..Set-Cookie: atpsida=0eb8d8df8d3ca1d9277f4f3f_1433777112; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.mmstat.com..Location: http://pcookie.cnzz.com/app.gif?&cna=2KH8DTH0XjQCAcGK9Ofwcxcp..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..
GET /status/pai/hash/6330cf46f68cd2c7c40a422626d1cb30 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.webscan.360.cn
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: 360Server
Date: Mon, 08 Jun 2015 15:25:12 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Content-Encoding: gzip
2669.............R&...PNG........IHDR......./......3......pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6...
<<< skipped >>>
GET /click.aspx?id=460737107&logo=1 HTTP/1.1
Accept: */*
Referer: hXXp://soso.hcjd56.com:88/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count46.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:22 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Type: text/html; charset=gb2312
Content-Length: 1777
..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(endstr==-1) endstr=document.cookie.length;return document.cookie.substring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.length;var clen=document.cookie.length;var i=0;var j;while(i<clen) {j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=document.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..function cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*36000;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=0; expires=" y_e.toGMTString() "; path=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_count");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' escape(document.location) '&color=' screen.colorDepth 'x&resolution=' screen.width 'x' screen.height '&returning=' cc_k() '&language=' navigator.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('<a href="hXXp://countt.51yes.com/index.aspx?id=460737107" target=_blank><img width=20 height=20 border=0 hspace=0 vspace=0 src=
<<< skipped >>>
GET /sa.htm?id=460737107&refe=http://VVV.lszwg.com/&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://soso.hcjd56.com:88/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count46.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:23 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Length: 0
HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:25:23 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Control: private..Content-Length: 0..
GET /stat.php?id=5076676&show=pic2 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s25.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Date: Mon, 08 Jun 2015 15:25:06 GMT
Last-Modified: Mon, 08 Jun 2015 15:25:05 GMT
Cache-Control: max-age=5400,s-maxage=5400
Via: cache54.l2de1[806,200-0,M], cache17.l2de1[807,0], cache10.de1[807,200-0,H], cache6.de1[231,0]
Age: 0
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:06 GMT
X-Swift-CacheTime: 5400
29d..(function(){function k(){this.c="5076676";this.R="z";this.N="pic2";this.K="";this.M="";this.r="1433777105";this.P="oz.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=5076676");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=enco..18bd..deURIComponent,l=decodeURIComponent,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_accoun
<<< skipped >>>
GET /click.aspx?id=261222598&logo=2 HTTP/1.1
Accept: */*
Referer: hXXp://sky25145.hbgyzs.com:83/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count26.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:24:48 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Type: text/html; charset=gb2312
Content-Length: 1777
..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(endstr==-1) endstr=document.cookie.length;return document.cookie.substring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.length;var clen=document.cookie.length;var i=0;var j;while(i<clen) {j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=document.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..function cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*36000;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=0; expires=" y_e.toGMTString() "; path=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_count");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctime "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' escape(document.location) '&color=' screen.colorDepth 'x&resolution=' screen.width 'x' screen.height '&returning=' cc_k() '&language=' navigator.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('<a href="hXXp://countt.51yes.com/index.aspx?id=261222598" target=_blank><img width=20 height=20 border=0 hspace=0 vspace=0 src=
<<< skipped >>>
GET /count2.gif HTTP/1.1
Accept: */*
Referer: hXXp://sky25145.hbgyzs.com:83/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count26.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 1160
Content-Type: image/gif
Last-Modified: Thu, 07 Apr 2005 17:25:24 GMT
Accept-Ranges: bytes
ETag: "05a35c8963bc51:b3d"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Mon, 08 Jun 2015 15:24:49 GMT
GIF89a..................@J.#...........l...........e..~DD-T....c....NNY..M. .....G..f.....n..F..kBE5AA39__.Xb)))..^'%/.......RR.ww.._........)U.....M.$..P..fb.......H..Mg........;. .....r..O........jva.n||8ZZ..'?..l..ggn...gg<..6..(.....@...ZXXJ7KZ..]]]..G ..N.!AJJ..aK."uu...@...rg{s..|.%c.5..Jx....?..R...AA...7..EBB..*'k....J.ELAggLQ5@&.....I8N....;CNL.....)s.......O...qqR..e..k..@8'.ZZ`w.....V....G...&II...II*_. ;``..g$pp.::...ll*.....E]).tta..*X. ...9B8'...ESl.....A.&............aam......q..X..v``...N#;i.G.....b..~`..B.(..6zgg...JJ....0PPo]z.....B:dd..\..=%HH...JJ(..h...;^^.EH.._.W`..]..f..m..f.EJ\XX..d_....i..U....._\VV!cg...LL....k..JJ ...II-W.&..g.tt..i..F....EMy.A QQ.....jHH/!II.LPp[v.....@{h..>>HVVEJJ..>f..GKJ/.1...................................................!.......,...............Hp.9kM*P .p`."`.li..`'Y...1'C..\.............B.K.....Qu....{.|..I .A.LD.....S^D..B.Q.J.X..u.(Q_.b..e...w........4...PP...=.Z..`.*.a...{.@....$..ZlW....-`0.....j.8. ...%..m.GD.wz......&.a.9#...)...d.T... ...h... 9l..8Q..5'op..v.[:`.tP..o..?>..1$e.Ü..e[c.B.m...#U...R.....h.2p.B.H...2#y.`.<.4....x".....M..0..*.$0P.L...:.@..1.$....<..C........N5..Q.'....;HTTP/1.1 200 OK..Content-Length: 1160..Content-Type: image/gif..Last-Modified: Thu, 07 Apr 2005 17:25:24 GMT..Accept-Ranges: bytes..ETag: "05a35c8963bc51:b3d"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Mon, 08 Jun 2015 15:24:49 GMT..GIF89a..................@J.#...........l...........e..~DD-T....c....NNY..M. .....G..f.....n..F..kBE5AA39__.X
<<< skipped >>>
GET /cxbt.txt HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: cj.941pojie.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:09 GMT
Content-Length: 31
Content-Type: text/plain
Content-Location: hXXp://cj.941pojie.com/cxbt.txt
Last-Modified: Sun, 01 Mar 2015 05:20:17 GMT
Accept-Ranges: bytes
ETag: "eafeb367df53d01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
......................@............
GET /tc.txt HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: cj.941pojie.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:09 GMT
Content-Length: 26
Content-Type: text/plain
Content-Location: hXXp://cj.941pojie.com/tc.txt
Last-Modified: Sun, 26 Apr 2015 14:12:08 GMT
Accept-Ranges: bytes
ETag: "246922fb2a80d01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
hXXp://soso.hcjd56.com:88/HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:25:09 GMT..Content-Length: 26..Content-Type: text/plain..Content-Location: hXXp://cj.941pojie.com/tc.txt..Last-Modified: Sun, 26 Apr 2015 14:12:08 GMT..Accept-Ranges: bytes..ETag: "246922fb2a80d01:751dc"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..hXXp://soso.hcjd56.com:88/..
GET /stat.htm?id=5076676&r=&lg=en-us&ntime=none&cnzz_eid=369179300-1433777105-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=2004535038 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: oz.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine/1.4.6
Date: Mon, 08 Jun 2015 15:25:08 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..
GET /sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://soso.hcjd56.com:88/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count46.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:20 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Length: 0
HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:25:20 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Control: private..Content-Length: 0..
GET /wpa/images/group.png HTTP/1.1
Accept: */*
Referer: hXXp://jc.941pojie.com/jiaqun.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pub.idqqimg.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: X2S_Platform
Connection: keep-alive
Cache-Control: max-age=2592000
Last-Modified: Fri, 12 Apr 2013 09:22:21 GMT
Content-Type: image/png
Content-Length: 1827
Keep-Alive: timeout=60
X-Cache-Lookup: Hit From MemCache
.PNG........IHDR...Z.........w.{'....PLTEV...dE)r.Ip..........F........F..Kyy...r.....~E ......m..c..........d3.....S.....r...S1...#.....c........A..l3....d.............ynvc......"..]Z@.mZ..jB..............&..I...\BH.....................rHh........z4$...X..0.....R.....s@6...{RL(.......Xs.y......S........%.........vb...4......bW...[%..........L..t..s..c>'...2..............wsw..i.............yM...WwaR...?-.fU...~K;.`H...t..V..:..d...........h/#.......Z74..........pt5(...K...vb=......lM.........N.kr......I A............pVs..k.....f'.p.....c..%...SG.J;..r6......fBr..o=5...T..J...jB......5.....|......n^....XLm3#......y.f.}X....]6...,y....8..........q.D-Mt....^* z= y>#.dK...^...........>..s..J..............B....q...................xy...'..t.....7..M...~Re........s: .K(.rP`)..^=.........3......G:V......WE..2.....pHYs.................IDAT8....T.U...lCs..It.....5r,*....I.K.].5p.d....2.4Fw.m}.....e.v7r.........S.D.IVR.&.....y8G;.................N.r...9.t......p9.....].......,Ko..i.......Mh.|@..hyw..9...n..qo-....C.....s.fpo..:{..vtQQG........'..zmr.......H...m.u4.;..t...7....C.........a...?....{)...W..4...u......(....l..Q.|......R.u.3K.;.!..}vy([.e.~YhG[^. y......C...<....~.<-^I3......$..B....z...?$......u...S.7....qF$?.wF..G..lkC#...=...A...C.......#x...Ea.yvS(..P..e..2..*....yD]]d.\.....{..h.....5.UK.@J....ux7...>5.H_....}...T]2x,EO7SEmf.6.u:sk(..4...-.,...o6;B...Me. .\..._.]SSs..._....?g.,.x.$.tL...)..u.<Mv`4..Q<QiU.1O.X%......q..-.w.h... **.....e}..E...'...51t...0...0v....)^1.'.^..U.u`| 3.8l.)
<<< skipped >>>
GET /jiaqun.htm HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: jc.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:11 GMT
Content-Length: 213
Content-Type: text/html
Content-Encoding: gzip
Content-Location: hXXp://jc.941pojie.com/jiaqun.htm
Last-Modified: Tue, 19 May 2015 16:30:53 GMT
Accept-Ranges: bytes
ETag: "80dc7a2c5192d01:751dc"
Vary: Accept-Encoding
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
..........l.Mn. .E.BX.."O..Ki>.......[{..^.I..E...ut..$..@2$...of.m.dJ8vt.9.0vL.."... .....]....?;.X.8......2Bh.X.|.l..Rr!nbD,54.......T.M..o..........#.g;...C............E..%.\...a....u.}|..q.$.....o.......'g....HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:25:11 GMT..Content-Length: 213..Content-Type: text/html..Content-Encoding: gzip..Content-Location: hXXp://jc.941pojie.com/jiaqun.htm..Last-Modified: Tue, 19 May 2015 16:30:53 GMT..Accept-Ranges: bytes..ETag: "80dc7a2c5192d01:751dc"..Vary: Accept-Encoding..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET............l.Mn. .E.BX.."O..Ki>.......[{..^.I..E...ut..$..@2$...of.m.dJ8vt.9.0vL.."... .....]....?;.X.8......2Bh.X.|.l..Rr!nbD,54.......T.M..o..........#.g;...C............E..%.\...a....u.}|..q.$.....o.......'g......
GET /css/style.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:12 GMT
Content-Length: 3923
Content-Type: text/css
Content-Encoding: gzip
Content-Location: hXXp://VVV.941pojie.com/css/style.css
Last-Modified: Fri, 25 Jul 2014 01:50:27 GMT
Accept-Ranges: bytes
ETag: "8073a1ceaaa7cf1:751dc"
Vary: Accept-Encoding
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
...........[K....^g`.C..!..{TRK..Y..c......uK.....V..........da."^..1.y.L.d.../.&...N=..w<.L.VU.:u.W.U....[.~.._......G..>x.`U....>..S.I....y.~n.}Y...l......../.y-]e....>......;.<......d[n.@W.t..1Z.m[.QS....?.........n..s5...q...]8.E..t..G...g..<,....yy..'./B.....D^..U1no...P...HX.Vu...2 ?..-....X.M...A.....Y.8.dUES......U...v....%Y......iW..e.....q..Dv.....%.....v.^..>>G...u. 2.:.".8...D%.')....:.).v.\$...u...!ku...7.gBF...)yf...r{X......fy..l^pz(..w...,3....*.. ='.....-H'D...1..^=.0/O.*.]..z.T..*6.2...B|..U..9.....;1z:....r.8..b..:W.d3..4y.A....vI.$..Bkb60.!{........]..l......"...#s...\<.r.C.4..pSN....#Vu.KTE.8.Bc..}G.ez....He..v......u..i.Ou.v. ....P........DPD...........(.......3...$...*;....8..Gj.m..&.`.g....&oGy.......f....i.Wg2.....(.nk.&'......QS.a8............|>...c.....\k29...h..9.....R..}Q62~...{.;....BKL...f.*..:p.c. .....H?.K.Ue..Sh....9...uI5B.;.k.........n.-...b.T#......T..fr..}.......0..%....F.)........>.......VU1...Tc$9.M.....[%.h.uV.%..).G.q....q8....\.Ig..ri..P....d...6Q4`..m..v.].Y55.:......,.E..`../by.(.F.@...S..po... "@...1Po1..H..F..D[A.\.l6.d#.....d.l.X..w..y.Yo...w...hs.d...'...!iOPnR........`..k.......Z:.U.C.\mb...!M%.........K...:........%....Z..2.l.Q...z...9..3..t,...2_.c......WE2..I&*{jx;.#^^C.&..T...q"XN......n5-...TG.|E..q......_n~)3<......U..@ ..7uM....=)(M.R..1V..[.'HYS.<k..8.Q(...s.eNGO....U.ad..f^.N}...d..#;W.-......''.}^.c`!] ......2)...k..p...62 ........mW=.....(.Y..jp....I,...=.v....<...).Mx...A.B...pNS..... ...U..6...v.l..3..X.)F;.
<<< skipped >>>
GET /img/miaosha.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:12 GMT
Content-Length: 46434
Content-Type: image/gif
Content-Location: hXXp://VVV.941pojie.com/img/miaosha.gif
Last-Modified: Fri, 20 Mar 2015 12:33:36 GMT
Accept-Ranges: bytes
ETag: "010c815a63d01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
GIF89a..(................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................q.-]..E]h.Z!\.Z!..-].......P0#..h.Z!!..NETSCAPE2.0.....!.......,......(..|6z....$.3..,3.(\.,c.-^.=G.3k.4q.z<.M..^U.Ae.uF.jR.}z.rw.X\.LX.Mk.Gq.a\.jP.ql.jx.=..y..v..K..J..J..K..X..W..W..^..d..k..s..x..j..h..i..e..x..v..u..{..z..l..d..m..t..u..x..........B.%V.0l.|w.q[.yq..../..11.2t.<G..8.L..O1.u..q3.L[.W[.Vz.mZ.jw.OO.nL.ff.j{.ww.?..V..w..k..G..Q..c..l..q..g..i..r..y..\..i..i..w..j..g..t..y..y..k..s..y..;..X..^..m..l..w..}..|..x...z..X..p..Y..w..}..3..4.....1...../..S..r..Q..m..N..e..C..x..... ........P........................................................................................................................................................................................................................................................................................
<<< skipped >>>
GET /pie.htc HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Mon, 08 Jun 2015 15:25:14 GMT
Content-Length: 83
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
<html><head><title>Error</title></head><body>........................</body></html>....
GET /img/qingtian.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:15 GMT
Content-Length: 34464
Content-Type: image/gif
Content-Location: hXXp://VVV.941pojie.com/img/qingtian.gif
Last-Modified: Tue, 03 Feb 2015 08:35:42 GMT
Accept-Ranges: bytes
ETag: "0c339658c3fd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
GIF89a..<.................#.. ..4..;..C..L..S..[..c..k..s..|............................?............................................/..'..#..*..7..2..;.._..O..G..C..K..W..T..[..o..g..c..j..w..s..{...?.._..o..w..{..s..g..k..c..O..W..[..S..G..K..C...../..7..;..3..'.. ..#...............................................................................................................................!.......!..NETSCAPE2.0.....,......<.....#..................................................................................................."....."..." ...............c%.0......L........<.!B........ ....64........0h.AC*....H......d..P.A...8v,` ....~...s....2=@p.....*0.un.........@...\..pA.....*.E..... .X.@......(P@..MU...,..A...Wup..c...,p.p..D...q.`A.....\^. .u.6........#P...........H.L...(.|.....E........F^.X.9G..<....{....(8..!...E=0...N..&.`.....#..R..i.O:..G.... .N........\.....W.1..v.t.AwB..T- |P.w.8."!.TX^G...]yDm..!....!.0.....7@.....@..d....p.........0..e.$5Hx.. SJ..w.j..X.H.l.@.....>.\4.P.,..0K.).........e.......Er.@:.D .N&BE.....i....i..~z...8..G-ir..'!G...a.....@@v..#@....@h.P.A.sA....D.@..$@...........r.4..% `.X.D.&....WP...k..., .&D.'@...F.;.m.Ii.r....\...x%....1..J.*....7.p..."@@..9.l#.kd ..% ..$SU...V...$.....(T.. .Y^....ny.<5H......A.PTV.|..A."..s."..k#`.r........P.NVEP..}."B..L.3..V.v...z......c..h3J...b`*.<....^.....I.j...0..K...{....U.9.bzw....W...=..A..LxN0....".\...3`..x:..'.<.....2.....9.bC.Y........".......^. .}..4X....W...F...e#......%..!...<...r.T."%....Q*#..`w.V..(..
<<< skipped >>>
GET /img/kl.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:18 GMT
Content-Length: 30696
Content-Type: image/gif
Content-Location: hXXp://VVV.941pojie.com/img/kl.gif
Last-Modified: Wed, 28 Jan 2015 13:58:58 GMT
Accept-Ranges: bytes
ETag: "0fda98f23bd01:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
GIF87a..Z................!"!...9311 )B;9...JDB)()RKJ101ZSR10)989)(!)#!c\Z...kbcZZZ.AB......{qkBAB.........{}.sicRQJcYRcac.ys9<.kaZ........{sjk.........{mkJIB....us......JA9sec..........}{RIB! .)$)......ZYR!.!ZQJ...JIJ.........k]Z......cUR...{ts............ZMJ.....................................|{...caZ.........RQR..............{.........kjk.ys............BA9...Z].!..................... !....ac...............km..01),....981......................QR...{y{...........................................qssqs.qk........{.........JM................sqk............kic...................................................kYR...{ys................us!!..........{ic11....B81.........! ..........)).scZ...))....!...........REBc]c......90)......)$.............Zac........{....}{...............,......Z........H......*\......#J|...E.. z..1c.. C..I....(S.\.....!=..Y.....fz....M.>...i.'..G.*]..)S.N........XA...5"W.X.v.J....h..]K.#F.p......X...n...*.....v...`....uy.....#K.L..e.n.....'R.r..-\..N..S.^......c..M....W3.DZ..^.qA..]..........9....C...........}.A.....n......!._...L.m/..;.xG......T.....6.R.m7..<...v.6....>(...V..x....Z2m..m....3$..V.&Rv.M.etW...$.f....T.......xS..B.....P..H&....J....>)...V)V.Xf..e.....q...fcv...=....A5X..o2)...N)..v....<....NF ..v.j...&.hV."..DH..(Jp.....f.iC...\A`.'S.p.i*`.>........QN......9 ............. ....z...&{@..6.,J.e8)K..TmC.]9.......u.$.^. .@.dl..U...h....eFo.U.F..W........ x ....k...Z.../....&.l..OL...<....w.q......7%...b...Y.Z...d.A...x..W.~4..E\.rFW. ..1z...Vm..C2....,......Wu
<<< skipped >>>
GET /img/2014052276129177.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.941pojie.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:25:25 GMT
Content-Length: 832
Content-Type: image/gif
Content-Location: hXXp://VVV.941pojie.com/img/2014052276129177.gif
Last-Modified: Thu, 14 Aug 2014 07:47:36 GMT
Accept-Ranges: bytes
ETag: "05c92394b7cf1:751dc"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
GIF89aX..................!..copyright. 1996 Charles H. Tupper All rights reserved. not to be used on another graphics download site or on software. All other uses permitted. hXXp://VVV.cyberspace.com/tup.!..NETSCAPE2.0.....!.......,....X.....*.............0....H.........6.L........? ..!.......,%...j...................<....H............!.......,W...j...................<....H............!.......,....j...................<....H............!.......,....j...................<....H............!.......,....j...................<....H............!.......,....X.....*..................H...........L.........(..!.......,1.........!..................H...........L...!.......,c.........!..................H...........L...!.......,..........!..................H...........L...!.......,....X.....)................n.H...........L.......>S..;....
GET /stat.htm?id=5076676&r=http://VVV.941pojie.com/&lg=en-us&ntime=none&cnzz_eid=455095186-1433777105-http://VVV.941pojie.com/&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1029977702 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: oz.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine/1.4.6
Date: Mon, 08 Jun 2015 15:25:08 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..
GET /stat.htm?id=3325108&r=&lg=en-us&ntime=none&cnzz_eid=1076296874-1433777109-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=851769781 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: oz.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine/1.4.6
Date: Mon, 08 Jun 2015 15:25:10 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..
GET /sa.htm?id=261222598&refe=http://soso.hcjd56.com:88/&location=http://sky25145.hbgyzs.com:83/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://sky25145.hbgyzs.com:83/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: count26.51yes.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 08 Jun 2015 15:24:49 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Length: 0
HTTP/1.1 200 OK..Date: Mon, 08 Jun 2015 15:24:49 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Control: private..Content-Length: 0..
GET /stat.php?id=5076676&show=pic2 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s25.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Date: Mon, 08 Jun 2015 15:25:06 GMT
Last-Modified: Mon, 08 Jun 2015 15:25:05 GMT
Cache-Control: max-age=5400,s-maxage=5400
Via: cache54.l2de1[806,200-0,M], cache17.l2de1[807,0], cache10.de1[807,200-0,M], cache1.de1[808,0]
X-Cache: MISS TCP_REFRESH_MISS dirn:4:517450486
X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:06 GMT
X-Swift-CacheTime: 5400
29d..(function(){function k(){this.c="5076676";this.R="z";this.N="pic2";this.K="";this.M="";this.r="1433777105";this.P="oz.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=5076676");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=enco..18bd..deURIComponent,l=decodeURIComponent,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_accoun
<<< skipped >>>
GET /app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: pcookie.cnzz.com
HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 08 Jun 2015 15:25:10 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; expires=Thu, 05-Jun-25 15:25:10 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Tengine..Date: Mon, 08 Jun 2015 15:25:10 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; expires=Thu, 05-Jun-25 15:25:10 GMT; path=/; domain=.cnzz.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;....
GET /app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pcookie.cnzz.com
Connection: Keep-Alive
Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8
HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 08 Jun 2015 15:25:12 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;....
GET /app.gif?&cna=1aH8DQnb DgCAcGK9Od5gcj8 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pcookie.cnzz.com
Connection: Keep-Alive
Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8
HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 08 Jun 2015 15:25:12 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Tengine..Date: Mon, 08 Jun 2015 15:25:12 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..
GET /app.gif?&cna=2KH8DTH0XjQCAcGK9Ofwcxcp HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: cna=1aH8DQnb DgCAcGK9Od5gcj8
Connection: Keep-Alive
Host: pcookie.cnzz.com
HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 08 Jun 2015 15:25:12 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=2KH8DTH0XjQCAcGK9Ofwcxcp; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Tengine..Date: Mon, 08 Jun 2015 15:25:12 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=2KH8DTH0XjQCAcGK9Ofwcxcp; expires=Thu, 05-Jun-25 15:25:12 GMT; path=/; domain=.cnzz.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..
GET /static/common/images/zhanzhang.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: zhanzhang.anquan.org
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Mon, 08 Jun 2015 15:25:12 GMT
Content-Type: image/png
Content-Length: 5075
Last-Modified: Wed, 03 Dec 2014 14:46:30 GMT
Connection: keep-alive
Expires: Mon, 08 Jun 2015 15:25:12 GMT
Cache-Control: max-age=0
Cache-Control: no-cache
Accept-Ranges: bytes
.PNG........IHDR...|.../.....!.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:12842C66B96C11E3B1D2FC24D7F17EB2" xmpMM:DocumentID="xmp.did:12842C67B96C11E3B1D2FC24D7F17EB2"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:12842C64B96C11E3B1D2FC24D7F17EB2" stRef:documentID="xmp.did:12842C65B96C11E3B1D2FC24D7F17EB2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......GIDATx..\.t.......! K..... Bd., ..,..........r.xT.*.[...*...ZE.E.., ..a..v....v.^.7...7....d...=gN.Y.....{..L..5~Wo"..[.E..,...{..~............4I.\.E1.$.=.5..~....<.^...Q...^.R.s.....:....DJ].7_.Q......Q ...C*....MX.......v..no.......g.fl".....S%MJ'.w...y... c..F...{.cg...'Z.-i...5...K...K$=...IU.........FT.b.........Q)..O.L......D..K..~<H.;7......jS..U...9....QR%AI...T"*w..{..B...............I{........g;|..8..g...".T....a..>.`.a).^Y^t-..fE..n...........E...-......`.....q...C.&0!....r.........(.H....8~..kk.uI....QY.m...o.IZ.E....Kr.|..eP...V.]...n..\n. ht...G..i;..k.3..SPb.{..
<<< skipped >>>
GET /stat.php?id=3325108&show=pic1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.lszwg.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s85.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Date: Mon, 08 Jun 2015 15:25:09 GMT
Last-Modified: Mon, 08 Jun 2015 15:25:09 GMT
Cache-Control: max-age=5400,s-maxage=5400
Via: cache37.l2de1[789,200-0,M], cache3.l2de1[790,0], cache1.de1[789,200-0,H], cache4.de1[790,0]
Age: 0
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Mon, 08 Jun 2015 15:25:09 GMT
X-Swift-CacheTime: 5400
4aa..(function(){function k(){this.c="3325108";this.R="z";this.N="pic1";this.K="";this.M="";this.r="1433777109";this.P="oz.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=3325108");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURIComponent,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ..1104.. ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_accoun
<<< skipped >>>
GET /status/pai/hash/6330cf46f68cd2c7c40a422626d1cb30 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.941pojie.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.webscan.360.cn
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: 360Server
Date: Mon, 08 Jun 2015 15:25:12 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Content-Encoding: gzip
2669.............R&...PNG........IHDR......./......3......pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f.HTTP/1.1 200 OK..Server: 360Server..Date: Mon, 08 Jun 2015 15:25:12 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: close..Content-Encoding: gzip..2669.............R&...PNG........IHDR......./......3..
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1156:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
kernel32.dll
kernel32.dll
shlwapi.dll
shlwapi.dll
suming.dll
suming.dll
%System%\drivers\etc
%System%\drivers\etc
%System%\drivers\etc\hosts
%System%\drivers\etc\hosts
127.0.0.1 VVV.52anzu.com
127.0.0.1 VVV.52anzu.com
127.0.0.1 www1.52anzu.com
127.0.0.1 www1.52anzu.com
127.0.0.1 52anzu.com
127.0.0.1 52anzu.com
127.0.0.1 VVV.sopojie.com
127.0.0.1 VVV.sopojie.com
127.0.0.1 www1.sopojie.com
127.0.0.1 www1.sopojie.com
127.0.0.1 sopojie.com
127.0.0.1 sopojie.com
127.0.0.1 1.52yanzheng.sinaapp.com
127.0.0.1 1.52yanzheng.sinaapp.com
%System%\drivers\etc\protocol
%System%\drivers\etc\protocol
tcp 6 TCP # Transmission control protocol
tcp 6 TCP # Transmission control protocol
udp 17 UDP # User datagram protocol
udp 17 UDP # User datagram protocol
%System%\drivers\etc\services
%System%\drivers\etc\services
# This file contains port numbers for well-known services defined by IANA
# This file contains port numbers for well-known services defined by IANA
# / [aliases...] [#]
# / [aliases...] [#]
echo 7/tcp
echo 7/tcp
echo 7/udp
echo 7/udp
discard 9/tcp sink null
discard 9/tcp sink null
discard 9/udp sink null
discard 9/udp sink null
systat 11/tcp users #Active users
systat 11/tcp users #Active users
daytime 13/tcp
daytime 13/tcp
daytime 13/udp
daytime 13/udp
qotd 17/tcp quote #Quote of the day
qotd 17/tcp quote #Quote of the day
qotd 17/udp quote #Quote of the day
qotd 17/udp quote #Quote of the day
chargen 19/tcp ttytst source #Character generator
chargen 19/tcp ttytst source #Character generator
chargen 19/udp ttytst source #Character generator
chargen 19/udp ttytst source #Character generator
ftp-data 20/tcp #FTP, data
ftp-data 20/tcp #FTP, data
ftp 21/tcp #FTP. control
ftp 21/tcp #FTP. control
telnet 23/tcp
telnet 23/tcp
smtp 25/tcp mail #Simple Mail Transfer Protocol
smtp 25/tcp mail #Simple Mail Transfer Protocol
time 37/tcp timserver
time 37/tcp timserver
time 37/udp timserver
time 37/udp timserver
rlp 39/udp resource #Resource Location Protocol
rlp 39/udp resource #Resource Location Protocol
nameserver 42/tcp name #Host Name Server
nameserver 42/tcp name #Host Name Server
nameserver 42/udp name #Host Name Server
nameserver 42/udp name #Host Name Server
nicname 43/tcp whois
nicname 43/tcp whois
domain 53/tcp #Domain Name Server
domain 53/tcp #Domain Name Server
domain 53/udp #Domain Name Server
domain 53/udp #Domain Name Server
bootps 67/udp dhcps #Bootstrap Protocol Server
bootps 67/udp dhcps #Bootstrap Protocol Server
bootpc 68/udp dhcpc #Bootstrap Protocol Client
bootpc 68/udp dhcpc #Bootstrap Protocol Client
tftp 69/udp #Trivial File Transfer
tftp 69/udp #Trivial File Transfer
gopher 70/tcp
gopher 70/tcp
finger 79/tcp
finger 79/tcp
http 80/tcp www www-http #World Wide Web
http 80/tcp www www-http #World Wide Web
kerberos 88/tcp krb5 kerberos-sec #Kerberos
kerberos 88/tcp krb5 kerberos-sec #Kerberos
kerberos 88/udp krb5 kerberos-sec #Kerberos
kerberos 88/udp krb5 kerberos-sec #Kerberos
hostname 101/tcp hostnames #NIC Host Name Server
hostname 101/tcp hostnames #NIC Host Name Server
iso-tsap 102/tcp #ISO-TSAP Class 0
iso-tsap 102/tcp #ISO-TSAP Class 0
rtelnet 107/tcp #Remote Telnet Service
rtelnet 107/tcp #Remote Telnet Service
pop2 109/tcp postoffice #Post Office Protocol - Version 2
pop2 109/tcp postoffice #Post Office Protocol - Version 2
pop3 110/tcp #Post Office Protocol - Version 3
pop3 110/tcp #Post Office Protocol - Version 3
sunrpc 111/tcp rpcbind portmap #SUN Remote Procedure Call
sunrpc 111/tcp rpcbind portmap #SUN Remote Procedure Call
sunrpc 111/udp rpcbind portmap #SUN Remote Procedure Call
sunrpc 111/udp rpcbind portmap #SUN Remote Procedure Call
auth 113/tcp ident tap #Identification Protocol
auth 113/tcp ident tap #Identification Protocol
uucp-path 117/tcp
uucp-path 117/tcp
nntp 119/tcp usenet #Network News Transfer Protocol
nntp 119/tcp usenet #Network News Transfer Protocol
ntp 123/udp #Network Time Protocol
ntp 123/udp #Network Time Protocol
epmap 135/tcp loc-srv #DCE endpoint resolution
epmap 135/tcp loc-srv #DCE endpoint resolution
epmap 135/udp loc-srv #DCE endpoint resolution
epmap 135/udp loc-srv #DCE endpoint resolution
netbios-ns 137/tcp nbname #NETBIOS Name Service
netbios-ns 137/tcp nbname #NETBIOS Name Service
netbios-ns 137/udp nbname #NETBIOS Name Service
netbios-ns 137/udp nbname #NETBIOS Name Service
netbios-dgm 138/udp nbdatagram #NETBIOS Datagram Service
netbios-dgm 138/udp nbdatagram #NETBIOS Datagram Service
netbios-ssn 139/tcp nbsession #NETBIOS Session Service
netbios-ssn 139/tcp nbsession #NETBIOS Session Service
imap 143/tcp imap4 #Internet Message Access Protocol
imap 143/tcp imap4 #Internet Message Access Protocol
pcmail-srv 158/tcp #PCMail Server
pcmail-srv 158/tcp #PCMail Server
snmp 161/udp #SNMP
snmp 161/udp #SNMP
snmptrap 162/udp snmp-trap #SNMP trap
snmptrap 162/udp snmp-trap #SNMP trap
print-srv 170/tcp #Network PostScript
print-srv 170/tcp #Network PostScript
bgp 179/tcp #Border Gateway Protocol
bgp 179/tcp #Border Gateway Protocol
irc 194/tcp #Internet Relay Chat Protocol
irc 194/tcp #Internet Relay Chat Protocol
ipx 213/udp #IPX over IP
ipx 213/udp #IPX over IP
ldap 389/tcp #Lightweight Directory Access Protocol
ldap 389/tcp #Lightweight Directory Access Protocol
https 443/tcp MCom
https 443/tcp MCom
https 443/udp MCom
https 443/udp MCom
microsoft-ds 445/tcp
microsoft-ds 445/tcp
microsoft-ds 445/udp
microsoft-ds 445/udp
kpasswd 464/tcp # Kerberos (v5)
kpasswd 464/tcp # Kerberos (v5)
kpasswd 464/udp # Kerberos (v5)
kpasswd 464/udp # Kerberos (v5)
isakmp 500/udp ike #Internet Key Exchange
isakmp 500/udp ike #Internet Key Exchange
exec 512/tcp #Remote Process Execution
exec 512/tcp #Remote Process Execution
biff 512/udp comsat
biff 512/udp comsat
login 513/tcp #Remote Login
login 513/tcp #Remote Login
who 513/udp whod
who 513/udp whod
cmd 514/tcp shell
cmd 514/tcp shell
syslog 514/udp
syslog 514/udp
printer 515/tcp spooler
printer 515/tcp spooler
talk 517/udp
talk 517/udp
ntalk 518/udp
ntalk 518/udp
efs 520/tcp #Extended File Name Server
efs 520/tcp #Extended File Name Server
router 520/udp route routed
router 520/udp route routed
timed 525/udp timeserver
timed 525/udp timeserver
tempo 526/tcp newdate
tempo 526/tcp newdate
courier 530/tcp rpc
courier 530/tcp rpc
conference 531/tcp chat
conference 531/tcp chat
netnews 532/tcp readnews
netnews 532/tcp readnews
netwall 533/udp #For emergency broadcasts
netwall 533/udp #For emergency broadcasts
uucp 540/tcp uucpd
uucp 540/tcp uucpd
klogin 543/tcp #Kerberos login
klogin 543/tcp #Kerberos login
kshell 544/tcp krcmd #Kerberos remote shell
kshell 544/tcp krcmd #Kerberos remote shell
new-rwho 550/udp new-who
new-rwho 550/udp new-who
remotefs 556/tcp rfs rfs_server
remotefs 556/tcp rfs rfs_server
rmonitor 560/udp rmonitord
rmonitor 560/udp rmonitord
monitor 561/udp
monitor 561/udp
ldaps 636/tcp sldap #LDAP over TLS/SSL
ldaps 636/tcp sldap #LDAP over TLS/SSL
doom 666/tcp #Doom Id Software
doom 666/tcp #Doom Id Software
doom 666/udp #Doom Id Software
doom 666/udp #Doom Id Software
kerberos-adm 749/tcp #Kerberos administration
kerberos-adm 749/tcp #Kerberos administration
kerberos-adm 749/udp #Kerberos administration
kerberos-adm 749/udp #Kerberos administration
kerberos-iv 750/udp #Kerberos version IV
kerberos-iv 750/udp #Kerberos version IV
kpop 1109/tcp #Kerberos POP
kpop 1109/tcp #Kerberos POP
phone 1167/udp #Conference calling
phone 1167/udp #Conference calling
ms-sql-s 1433/tcp #Microsoft-SQL-Server
ms-sql-s 1433/tcp #Microsoft-SQL-Server
ms-sql-s 1433/udp #Microsoft-SQL-Server
ms-sql-s 1433/udp #Microsoft-SQL-Server
ms-sql-m 1434/tcp #Microsoft-SQL-Monitor
ms-sql-m 1434/tcp #Microsoft-SQL-Monitor
ms-sql-m 1434/udp #Microsoft-SQL-Monitor
ms-sql-m 1434/udp #Microsoft-SQL-Monitor
wins 1512/tcp #Microsoft Windows Internet Name Service
wins 1512/tcp #Microsoft Windows Internet Name Service
wins 1512/udp #Microsoft Windows Internet Name Service
wins 1512/udp #Microsoft Windows Internet Name Service
ingreslock 1524/tcp ingres
ingreslock 1524/tcp ingres
l2tp 1701/udp #Layer Two Tunneling Protocol
l2tp 1701/udp #Layer Two Tunneling Protocol
pptp 1723/tcp #Point-to-point tunnelling protocol
pptp 1723/tcp #Point-to-point tunnelling protocol
radius 1812/udp #RADIUS authentication protocol
radius 1812/udp #RADIUS authentication protocol
radacct 1813/udp #RADIUS accounting protocol
radacct 1813/udp #RADIUS accounting protocol
nfsd 2049/udp nfs #NFS server
nfsd 2049/udp nfs #NFS server
knetd 2053/tcp #Kerberos de-multiplexor
knetd 2053/tcp #Kerberos de-multiplexor
man 9535/tcp #Remote Man Server
man 9535/tcp #Remote Man Server
%System%\drivers\etc\lmhosts.sam
%System%\drivers\etc\lmhosts.sam
# This is a sample LMHOSTS file used by the Microsoft TCP/IP for Windows.
# This is a sample LMHOSTS file used by the Microsoft TCP/IP for Windows.
# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
# \0xnn (non-printing character support)
# \0xnn (non-printing character support)
# browser and logon services behave in TCP/IP environments. To preload
# browser and logon services behave in TCP/IP environments. To preload
# be able to read the lmhosts file successfully. This key is under
# be able to read the lmhosts file successfully. This key is under
# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
# 102.54.94.97 rhino #PRE #DOM:networking #net group's DC
# 102.54.94.97 rhino #PRE #DOM:networking #net group's DC
# 102.54.94.102 "appname \0x14" #special app server
# 102.54.94.102 "appname \0x14" #special app server
# 102.54.94.123 popular #PRE #source server
# 102.54.94.123 popular #PRE #source server
# 102.54.94.117 localsrv #PRE #needed for the include
# 102.54.94.117 localsrv #PRE #needed for the include
%System%\drivers\etc\networks
%System%\drivers\etc\networks
# campus 284.122.107
# campus 284.122.107
# london 284.122.108
# london 284.122.108
D:\wscntmx.exe
D:\wscntmx.exe
`.data
`.data
@.vmp0
@.vmp0
`.vmp1
`.vmp1
.reloc
.reloc
}~/%D(
}~/%D(
.;6 (&%
.;6 (&%
1
1
1=;;6 )%#
1=;;6 )%#
=
=
=
=
=
=
==
==
=
=
=
=
=
=
==
==
=
=
e{TP.cda8
e{TP.cda8
U#ex'B-n}
U#ex'B-n}
MSVBVM60.DLL
MSVBVM60.DLL
user32.dll
user32.dll
5i.Id(HE
5i.Id(HE
~32.bd~
~32.bd~
.sKpK
.sKpK
.soAw?
.soAw?
.qT3
.qT3
D:\qudongrensheng.dat
D:\qudongrensheng.dat
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
ShellExecuteExA
ShellExecuteExA
SHELL32.dll
SHELL32.dll
GetCPInfo
GetCPInfo
@.reloc
@.reloc
(3-!0,1'8"5.*2$
(3-!0,1'8"5.*2$
ADVAPI32.dll
ADVAPI32.dll
WS2_32.dll
WS2_32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegSetKeySecurity
RegSetKeySecurity
RegEnumKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCreateKeyA
RegCreateKeyA
RegOpenKeyA
RegOpenKeyA
WinExec
WinExec
ExitWindowsEx
ExitWindowsEx
MSVCRT.dll
MSVCRT.dll
ackpw.dll
ackpw.dll
SetImageFileKey
SetImageFileKey
SOFTWARE\Microsoft\Windows NT\CurrentVersion
SOFTWARE\Microsoft\Windows NT\CurrentVersion
wininet.dll
wininet.dll
C:\log.pif
C:\log.pif
ShellExecuteA
ShellExecuteA
Shell32.dll
Shell32.dll
SYSTEM\CurrentControlSet\Services\%s\Parameters
SYSTEM\CurrentControlSet\Services\%s\Parameters
RegOpenKeyEx(Svchost)
RegOpenKeyEx(Svchost)
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
m32\svchost.exe -k krnlsrvc
m32\svchost.exe -k krnlsrvc
%SystemRoot%\Syste
%SystemRoot%\Syste
SYSTEM\CurrentControlSet\Services\%s
SYSTEM\CurrentControlSet\Services\%s
Rundll32 %s,RunUninsta3l
Rundll32 %s,RunUninsta3l
\lockmedia.tmp
\lockmedia.tmp
hXXp://
hXXp://
%u MB
%u MB
%s SP%d
%s SP%d
%d.%d.%d.%d
%d.%d.%d.%d
GetProcessHeap
GetProcessHeap
GET / HTTP/1.1
GET / HTTP/1.1
Host: %s:%d
Host: %s:%d
Host: %s
Host: %s
User-Agent: Mozilla/5.0 (compatible; Baiduspider/2.0; hXXp://VVV.baidu.com/search/spider.html)
User-Agent: Mozilla/5.0 (compatible; Baiduspider/2.0; hXXp://VVV.baidu.com/search/spider.html)
GET %s HTTP/1.1
GET %s HTTP/1.1
Referer: hXXp://%s
Referer: hXXp://%s
GET %s?=%d HTTP/1.1
GET %s?=%d HTTP/1.1
Mozilla/5.0 (compatible; Baiduspider/2.0; hXXp://VVV.baidu.com/search/spider.html)
Mozilla/5.0 (compatible; Baiduspider/2.0; hXXp://VVV.baidu.com/search/spider.html)
User-Agent: Mozilla/5.0 (compatible; Baiduspider/2.0; hXXp://VVV.baidu.com/search/spider.html)
User-Agent: Mozilla/5.0 (compatible; Baiduspider/2.0; hXXp://VVV.baidu.com/search/spider.html)
#%d
#%d
4!4,41474>4{4
4!4,41474>4{4
> >(>8>=>
> >(>8>=>
%s\hao123_res.tmp
%s\hao123_res.tmp
%s\ack%cpw.dll
%s\ack%cpw.dll
hXXp://VVV.941pojie.com/
hXXp://VVV.941pojie.com/
hXXp://cj.941pojie.com/tc.txt
hXXp://cj.941pojie.com/tc.txt
hXXp://cj.941pojie.com/zy.txt
hXXp://cj.941pojie.com/zy.txt
hXXp://cj.941pojie.com/cxbt.txt
hXXp://cj.941pojie.com/cxbt.txt
hXXp://cj.941pojie.com/wbzz.txtCreateFileA
hXXp://cj.941pojie.com/wbzz.txtCreateFileA
.aspack
.aspack
.adata
.adata
.xqrq
.xqrq
.pH`X|
.pH`X|
.YON=
.YON=
p*.LIAt
p*.LIAt
5].NQg
5].NQg
=.cw| r\
=.cw| r\
C @Qb%3Ua@.5
C @Qb%3Ua@.5
l(8i?ZiDf\.SQ
l(8i?ZiDf\.SQ
%C*pig
%C*pig
The procedure entry point %s could not be located in the dynamic link library %s
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
comctl32.dll
comctl32.dll
gdi32.dll
gdi32.dll
msimg32.dll
msimg32.dll
msvcrt.dll
msvcrt.dll
msvfw32.dll
msvfw32.dll
hXXp://VVV.eyybc.com
hXXp://VVV.eyybc.com
\skinh.she
\skinh.she
M.GG^
M.GG^
%s T5
%s T5
]E4%F(
]E4%F(
.Funr
.Funr
.yyw'
.yyw'
%sX@:`
%sX@:`
J|.jv
J|.jv
p4%xcEm
p4%xcEm
.Jr1Z
.Jr1Z
7.YT"
7.YT"
.Uf!0
.Uf!0
!a%U}
!a%U}
[I(3/#N0.bd
[I(3/#N0.bd
j"%u=w
j"%u=w
q%Xn`
q%Xn`
@|H.NI
@|H.NI
.wdd!
.wdd!
S|%u4
S|%u4
5.ff)
5.ff)
;)?/\%~|/
;)?/\%~|/
U%D?~;
U%D?~;
l2.Ue
l2.Ue
9%crU
9%crU
XKw-k}
XKw-k}
zx/%FN[
zx/%FN[
LY.eo
LY.eo
z{.Do
z{.Do
%s=\RI
%s=\RI
}j%c%Y)
}j%c%Y)
Rx.GR
Rx.GR
4o#.dM
4o#.dM
IeS`%C
IeS`%C
[n 4\.UY
[n 4\.UY
,4.qO,
,4.qO,
gQ'.Io
gQ'.Io
%cLur?
%cLur?
s%DHB
s%DHB
]I%%X
]I%%X
I %d)
I %d)
.aEd(
.aEd(
Õ6m*
Õ6m*
5r.US
5r.US
:mD].tB
:mD].tB
fJ.WM_
fJ.WM_
fTpe
fTpe
.LLbX
.LLbX
f%fUZ
f%fUZ
.fOuV12
.fOuV12
*_.dC
*_.dC
&-N}
&-N}
({?.cQm
({?.cQm
R>o2.YN>
R>o2.YN>
.Cqx~c
.Cqx~c
.`.Qw
.`.Qw
.Onwj
.Onwj
Tn&.hL
Tn&.hL
**.dU
**.dU
%s;7*
%s;7*
0%x@w
0%x@w
%C^L:
%C^L:
CX%xm
CX%xm
!n]%x
!n]%x
%X,Cr
%X,Cr
*.Ea]S
*.Ea]S
Q.CGo
Q.CGo
tn!ay%F
tn!ay%F
2.kKX
2.kKX
Avi.CT
Avi.CT
xhZ_6%U
xhZ_6%U
%SY!8i
%SY!8i
&.PFy{xh
&.PFy{xh
sG.qmf
sG.qmf
5.ZrW
5.ZrW
%Ucda
%Ucda
n.BjCw
n.BjCw
.um ZZE7L
.um ZZE7L
/^p%u$
/^p%u$
I.NoQY
I.NoQY
zu.ew
zu.ew
D/.nT
D/.nT
z.LP"
z.LP"
.IRIx
.IRIx
"%Sh9
"%Sh9
&;%sUwa
&;%sUwa
kBS%dR
kBS%dR
VVV.meitu.com
VVV.meitu.com
M%u{$
M%u{$
;s.iF
;s.iF
9E.nV
9E.nV
X-.RP
X-.RP
>.xKA
>.xKA
uDPf
uDPf
jc.941pojie.com/jiaqun.htm
jc.941pojie.com/jiaqun.htm
F%*.*f
F%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
ole32.dll
ole32.dll
RASAPI32.dll
RASAPI32.dll
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WINMM.dll
WINMM.dll
VERSION.dll
VERSION.dll
GetKeyState
GetKeyState
GetViewportOrgEx
GetViewportOrgEx
GDI32.dll
GDI32.dll
WINSPOOL.DRV
WINSPOOL.DRV
OLEAUT32.dll
OLEAUT32.dll
COMCTL32.dll
COMCTL32.dll
oledlg.dll
oledlg.dll
WSOCK32.dll
WSOCK32.dll
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
WININET.dll
WININET.dll
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
comdlg32.dll
comdlg32.dll
%x.tmp
%x.tmp
.PAVCException@@
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
VVV.dywt.com.cn
VVV.dywt.com.cn
.PAVCOleException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
zcÃ
zcÃ
hXXp://soso.hcjd56.com:88/
hXXp://soso.hcjd56.com:88/
c:\%original file name%.exe
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
360.cn
360.cn
hosts2.exe
hosts2.exe
6.1.7601.17514 (winsp1_rtm.101119-1850)
6.1.7601.17514 (winsp1_rtm.101119-1850)
Rasmedia.dll
Rasmedia.dll
Microsoft Windows Operating System
Microsoft Windows Operating System
6.1.7601.17514
6.1.7601.17514
4.20.0
4.20.0
Uninstall.exe
Uninstall.exe
1, 0, 6, 6
1, 0, 6, 6
SkinH_EL.dll
SkinH_EL.dll
(*.*)
(*.*)
1.0.0.0
1.0.0.0
(hXXp://VVV.eyuyan.com)
(hXXp://VVV.eyuyan.com)
wscntmx.exe_244:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.vmp0
@.vmp0
`.vmp1
`.vmp1
.reloc
.reloc
}~/%D(
}~/%D(
.;6 (&%
.;6 (&%
1
1
1=;;6 )%#
1=;;6 )%#
=
=
=
=
=
=
==
==
=
=
=
=
=
=
==
==
=
=
attrib -r -s -h %windir%\system32\drivers\etc\hosts.ics
attrib -r -s -h %windir%\system32\drivers\etc\hosts.ics
attrib -r -s -h %windir%\system32\wbem\window\winxp.ics
attrib -r -s -h %windir%\system32\wbem\window\winxp.ics
#vb6chs.dll
#vb6chs.dll
%Program Files%\VB
%Program Files%\VB
\VB6.OLB
\VB6.OLB
advapi32.dll
advapi32.dll
RegCloseKey
RegCloseKey
RegCreateKeyA
RegCreateKeyA
RegOpenKeyA
RegOpenKeyA
VBA6.DLL
VBA6.DLL
e{TP.cda8
e{TP.cda8
U#ex'B-n}
U#ex'B-n}
MSVBVM60.DLL
MSVBVM60.DLL
user32.dll
user32.dll
5i.Id(HE
5i.Id(HE
~32.bd~
~32.bd~
.sKpK
.sKpK
.soAw?
.soAw?
.qT3
.qT3
kernel32.dll
kernel32.dll
SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Microsoft.XMLHTTP
Microsoft.XMLHTTP
hXXp://jc.941pojie.com/cj.txt
hXXp://jc.941pojie.com/cj.txt
%System%\drivers\etc
%System%\drivers\etc
%System%\drivers\etc\hosts
%System%\drivers\etc\hosts
c:\windows\system32\drivers\etc\hosts
c:\windows\system32\drivers\etc\hosts
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\drivers\etc\hosts.ics
c:\a.bat
c:\a.bat
c:\b.bat
c:\b.bat
zhaosf.com
zhaosf.com
Adodb.Stream
Adodb.Stream
360.cn
360.cn
windows
windows
hosts2.exe
hosts2.exe
wscntmx.exe_244_rwx_0041F000_00001000:
MSVBVM60.DLL
MSVBVM60.DLL
user32.dll
user32.dll
svchost.exe_1484:
.text
.text
`.data
`.data
.rsrc
.rsrc
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
RPCRT4.dll
RPCRT4.dll
NETAPI32.dll
NETAPI32.dll
ole32.dll
ole32.dll
ntdll.dll
ntdll.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
GetProcessHeap
GetProcessHeap
NtOpenKey
NtOpenKey
svchost.pdb
svchost.pdb
\PIPE\
\PIPE\
Software\Microsoft\Windows NT\CurrentVersion\Svchost
Software\Microsoft\Windows NT\CurrentVersion\Svchost
\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\
\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\
5.1.2600.5512 (xpsp.080413-2111)
5.1.2600.5512 (xpsp.080413-2111)
svchost.exe
svchost.exe
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
wscntmx.exe_244_rwx_00426000_00001000:
.soAw?
.soAw?
.qT3
.qT3
kernel32.dll
kernel32.dll
iexplore.exe_476:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.fg>
IIIIIB(II<.fg>
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512