Trojan.Win32.Sasfis_708710c4ef

by malwarelabrobot on August 27th, 2014 in Malware Descriptions.

Trojan-Dropper.Win32.StartPage.pgh (Kaspersky), Adware.Win32.StartPage (A) (Emsisoft), Trojan.Win32.Sasfis.FD, BankerGeneric.YR (Lavasoft MAS)
Behaviour: Trojan-Dropper, Banker, Trojan, Adware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 708710c4ef41961c2407ec8ea1eff96e
SHA1: b18896dbbec9c18f2420304e601d49c81e22ff8d
SHA256: 98e6f82e0aff797abc58ea25e78d2c1ecf45e28b22565169faeb1b254bf89cb0
SSDeep: 12288:BapniPiWEyHEjac1VJ0jOT5DdAmdCicWbGORPsa3nklOYnSi2uyG/3VOXspM:8pniNErjaczJV5RzCMbnhsa3kY2 mO8e
Size: 747871 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:128
is-JNBNC.tmp:1072

The Trojan injects its code into the following process(es):

fcssq.exe:1756

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process fcssq.exe:1756 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\23[1].jpg (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\31[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1409018148[1].jpg (1301 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\1408930308[1].jpg (5303 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\7[1].jpg (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\baidu[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\20[1].jpg (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\30[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\friend-down[1].gif (933 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\1408930419[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\32[1].jpg (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\28[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\&pis=-1x-1&cfv=6&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=250&tlm=1363765561&tcn=1409030684&tpr=1409030684121&dpt=none&coa=&baidu_ (319 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\core[1].php (749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1408954420[1].jpg (1065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\s[2].js (986 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\36[1].jpg (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\8[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\1408930505[1].jpg (1738 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\4[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\tuijian[1].htm (11037 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\45[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\1408954313[1].jpg (1992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\popup7o[2].js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\1409043350[1].jpg (5273 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\16[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\47[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\22[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\6[1].jpg (877 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\1409042868[1].jpg (3991 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\29[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\1409016761[1].jpg (1403 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\42[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\26[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\19[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\1408954395[1].jpg (2027 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\softcount[1].htm (97 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\1408699061[1].jpg (3050 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\41[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\43[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\17[1].jpg (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\stat[1].php (1163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\s[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\popup7o[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\24[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1409042948[1].jpg (1814 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\14[1].jpg (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\46[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1408954367[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\1409016784[1].jpg (2194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\db380x60[1].gif (1755 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\49[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\12[1].jpg (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\5[1].jpg (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\35[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1409042922[1].jpg (1605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\21[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\9[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\db100x60[1].gif (1224 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1409016738[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\40[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\10[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\27[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\1408930483[1].jpg (761 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\11[1].jpg (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\50[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\13[1].jpg (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\popup[1].htm (794 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@adsvc1.unadnet.com[1].txt (256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\360buy[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\2[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\1408954346[1].jpg (2536 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cb.baidu[1].txt (126 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\37[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\u_12480[1].htm (15217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\44[1].jpg (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\1409016707[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\34[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\1409042972[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\1409042898[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\18[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\1408932833[1].jpg (4082 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\38[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\39[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\48[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\down[1].gif (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\33[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\123logo[1].gif (1224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\25[1].jpg (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\1409016807[1].jpg (1274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\15[1].jpg (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\3[1].jpg (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\1408930446[1].jpg (2446 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\popup7o[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\s[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\u_12480[1].htm (0 bytes)

The process %original file name%.exe:128 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-TIEEM.tmp\is-JNBNC.tmp (3722 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-TIEEM.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-TIEEM.tmp\is-JNBNC.tmp (0 bytes)

The process is-JNBNC.tmp:1072 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Start Menu\Programs\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6\жÔØ ¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6.lnk (623 bytes)
%Documents and Settings%\%current user%\Desktop\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6.lnk (638 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6.lnk (650 bytes)
%Program Files%\fcssq\is-LP1K2.tmp (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6 ÍøÕ¾.lnk (433 bytes)
%Program Files%\fcssq\is-EC8F0.tmp (249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-UU57A.tmp\_isetup\_shfoldr.dll (23 bytes)
%Program Files%\fcssq\is-SQQN4.tmp (9605 bytes)
%Program Files%\fcssq\unins000.dat (932 bytes)
%Program Files%\fcssq\is-GM0S0.tmp (9605 bytes)
%Program Files%\fcssq\fcssq.url (51 bytes)
%Program Files%\fcssq\is-QR747.tmp (6907 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-UU57A.tmp (0 bytes)
%Program Files%\fcssq\fcssq.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-UU57A.tmp\_isetup (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-UU57A.tmp\_isetup\_shfoldr.dll (0 bytes)

Registry activity

The process fcssq.exe:1756 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 B0 CB AE 06 5C A0 42 AF 93 20 4E C2 12 CE 6F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process is-JNBNC.tmp:1072 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6_is1]
"NoModify" = "1"
"Inno Setup: Setup Version" = "5.1.4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6_is1]
"InstallLocation" = "%Program Files%\fcssq\"
"URLInfoAbout" = "http://www.feiyang163.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6_is1]
"NoRepair" = "1"
"UninstallString" = "%Program Files%\fcssq\unins000.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6_is1]
"Inno Setup: App Path" = "%Program Files%\fcssq"
"Inno Setup: User" = "%CurrentUserName%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6_is1]
"Inno Setup: Icon Group" = "¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6"
"HelpLink" = "http://www.feiyang163.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c14c4f6-74da-11e2-81b0-000c29ec7fc5}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6_is1]
"Publisher" = "·ÉÑïÈí¼þ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 53 77 18 91 A8 28 60 DD 0D 71 08 4A 7B 7C 75"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6_is1]
"URLUpdateInfo" = "http://www.feiyang163.com"
"DisplayName" = "¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6"
"QuietUninstallString" = "%Program Files%\fcssq\unins000.exe /SILENT"

Dropped PE files

MD5 File path
a32061902fcd599b91576ea0ed2f8408 c:\Program Files\fcssq\fcssq.exe
dcdd047484af45a64b229a4f29b625ab c:\Program Files\fcssq\unins000.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: ????
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description: ????????? 1.6 ??
Comments: This installation was built with Inno Setup: http://www.innosetup.com
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
CODE 4096 36756 36864 4.56898 5b5fa5263e160a2eeee2ce0fa1f8a7db
DATA 40960 584 1024 1.87796 d8b6954551cae1ae096a5422ff951dd5
BSS 45056 3684 0 0 d41d8cd98f00b204e9800998ecf8427e
.idata 49152 2288 2560 2.97652 1dd439711b01bd6df25c589b77cf553c
.tls 53248 8 0 0 d41d8cd98f00b204e9800998ecf8427e
.rdata 57344 24 512 0.138011 d293bf8d4ebe9826d58e1d27c25fe4b6
.reloc 61440 2180 0 0 d41d8cd98f00b204e9800998ecf8427e
.rsrc 65536 10240 10240 2.97752 7b5504a187db9d51f6535732a86d28ec

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
19329dcedde0b6270fb429ce30b230f9

URLs

URL IP
hxxp://cbjs.e.shifen.com/js/s.js
hxxp://c.split.cnzz.com/core.php?web_id=555586&t=z
hxxp://z11.cnzz.com/stat.htm?id=555586&r=&lg=en-us&ntime=none&cnzz_eid=540886874-1409048682-&showp=1024x768&t=&h=1&rnd=1183407369
hxxp://219.239.223.191/tc.htm
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=893227110
hxxp://cb.e.shifen.com/ecom?di=98364&dcb=BAIDU_DUP_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=4&dai=1&dds=&drs=3&dvi=7o&ltu=http://adsvc1.unadnet.com.cn/ad/softad/popup.htm&liu=&ltr=&lcr=&ps=13x8&psr=1024x768&par=1024x740&pcs=0x0&pss=20x30&pis=-1x-1&cfv=6&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=250&tlm=1363765561&tcn=1409030684&tpr=1409030684121&dpt=none&coa=&baidu_id=
hxxp://dh.cdn.etedns.com/u_12480.html
hxxp://pcookie.split.cnzz.com/app.gif?&cna=b06DDIJWbA4CAbhrJiYpVv3T
hxxp://dh.cdn.etedns.com/images/123logo.gif
hxxp://dh.cdn.etedns.com/theme/newhao123/css/global.css
hxxp://dh.cdn.etedns.com/static/images/s/360buy.gif
hxxp://cbjs.e.shifen.com/painter/clb/popup7o.js
hxxp://dh.cdn.etedns.com/images/db380x60.gif
hxxp://dh.cdn.etedns.com/images/db100x60.gif
hxxp://dh.cdn.etedns.com/static/images/s/baidu.gif
hxxp://dh.cdn.etedns.com/images/upload/1408699061.jpg
hxxp://dh.cdn.etedns.com/images/upload/1408932833.jpg
hxxp://dh.cdn.etedns.com/images/upload/1409018148.jpg
hxxp://dh.cdn.etedns.com/images/upload/1409042868.jpg
hxxp://dh.cdn.etedns.com/images/upload/1409043350.jpg
hxxp://219.239.223.191/ad/softad/images/1.JPG
hxxp://dh.cdn.etedns.com/images/upload/1409042948.jpg
hxxp://dh.cdn.etedns.com/images/upload/1409042922.jpg
hxxp://dh.cdn.etedns.com/images/upload/1409042898.jpg
hxxp://dh.cdn.etedns.com/images/upload/1409042972.jpg
hxxp://dh.cdn.etedns.com/images/upload/1409016707.jpg
hxxp://dh.cdn.etedns.com/images/upload/1409016738.jpg
hxxp://dh.cdn.etedns.com/images/upload/1409016761.jpg
hxxp://dh.cdn.etedns.com/images/upload/1409016784.jpg
hxxp://dh.cdn.etedns.com/images/upload/1409016807.jpg
hxxp://dh.cdn.etedns.com/images/upload/1408954346.jpg
hxxp://dh.cdn.etedns.com/images/upload/1408954313.jpg
hxxp://dh.cdn.etedns.com/images/upload/1408954367.jpg
hxxp://dh.cdn.etedns.com/images/upload/1408954395.jpg
hxxp://dh.cdn.etedns.com/images/upload/1408954420.jpg
hxxp://dh.cdn.etedns.com/images/upload/1408930308.jpg
hxxp://dh.cdn.etedns.com/images/upload/1408930419.jpg
hxxp://dh.cdn.etedns.com/images/upload/1408930446.jpg
hxxp://dh.cdn.etedns.com/images/upload/1408930483.jpg
hxxp://dh.cdn.etedns.com/images/upload/1408930505.jpg
hxxp://219.239.223.191/ad/softad/images/down.gif
hxxp://219.239.223.191/ad/softad/images/3.JPG
hxxp://219.239.223.191/ad/softad/images/5.JPG
hxxp://219.239.223.191/ad/softad/images/7.JPG
hxxp://219.239.223.191/ad/softad/images/11.JPG
hxxp://219.239.223.191/ad/softad/images/9.JPG
hxxp://219.239.223.191/ad/softad/images/15.JPG
hxxp://219.239.223.191/ad/softad/images/13.JPG
hxxp://219.239.223.191/ad/softad/images/2.JPG
hxxp://219.239.223.191/ad/softad/images/4.JPG
hxxp://219.239.223.191/ad/softad/images/6.JPG
hxxp://219.239.223.191/ad/softad/images/8.JPG
hxxp://219.239.223.191/ad/softad/images/10.JPG
hxxp://219.239.223.191/ad/softad/images/12.JPG
hxxp://219.239.223.191/ad/softad/images/14.JPG
hxxp://219.239.223.191/ad/softad/images/16.JPG
hxxp://219.239.223.191/ad/softad/images/17.JPG
hxxp://219.239.223.191/ad/softad/images/19.JPG
hxxp://219.239.223.191/ad/softad/images/21.JPG
hxxp://219.239.223.191/ad/softad/images/18.JPG
hxxp://219.239.223.191/ad/softad/images/20.JPG
hxxp://219.239.223.191/ad/softad/images/22.JPG
hxxp://219.239.223.191/ad/softad/images/23.JPG
hxxp://219.239.223.191/ad/softad/images/25.JPG
hxxp://219.239.223.191/ad/softad/images/27.JPG
hxxp://219.239.223.191/ad/softad/images/29.JPG
hxxp://219.239.223.191/ad/softad/images/31.JPG
hxxp://219.239.223.191/ad/softad/images/33.JPG
hxxp://219.239.223.191/ad/softad/images/35.JPG
hxxp://219.239.223.191/ad/softad/images/37.JPG
hxxp://219.239.223.191/ad/softad/images/39.JPG
hxxp://219.239.223.191/ad/softad/images/41.JPG
hxxp://219.239.223.191/ad/softad/images/43.JPG
hxxp://219.239.223.191/ad/softad/images/45.JPG
hxxp://219.239.223.191/ad/softad/images/47.JPG
hxxp://219.239.223.191/ad/softad/images/49.JPG
hxxp://219.239.223.191/ad/softad/images/24.JPG
hxxp://219.239.223.191/ad/softad/images/26.JPG
hxxp://219.239.223.191/ad/softad/images/28.JPG
hxxp://219.239.223.191/ad/softad/images/30.JPG
hxxp://219.239.223.191/ad/softad/images/32.JPG
hxxp://219.239.223.191/ad/softad/images/34.JPG
hxxp://219.239.223.191/ad/softad/images/36.JPG
hxxp://219.239.223.191/ad/softad/images/38.JPG
hxxp://219.239.223.191/ad/softad/images/40.JPG
hxxp://219.239.223.191/ad/softad/images/42.JPG
hxxp://219.239.223.191/ad/softad/images/44.JPG
hxxp://219.239.223.191/ad/softad/images/46.JPG
hxxp://219.239.223.191/ad/softad/images/48.JPG
hxxp://219.239.223.191/ad/softad/images/50.JPG
hxxp://www.5w123.com/images/upload/1409042898.jpg 122.225.100.200
hxxp://www.5w123.com/images/upload/1408954367.jpg 122.225.100.200
hxxp://www.5w123.com/images/upload/1408954313.jpg 122.225.100.200
hxxp://www.5w123.com/images/upload/1409042948.jpg 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/5.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/26.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/10.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/46.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/40.JPG
hxxp://www.5w123.com/images/upload/1408930446.jpg 122.225.100.200
hxxp://www.5w123.com/images/upload/1408699061.jpg 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/15.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/37.JPG
hxxp://www.5w123.com/images/upload/1409042868.jpg 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/31.JPG
hxxp://www.5w123.com/images/upload/1408932833.jpg 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/2.JPG
hxxp://cbjs.baidu.com/js/s.js 123.125.65.120
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/12.JPG
hxxp://js.hao2266.com/images/123logo.gif 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/16.JPG
hxxp://dup.baidustatic.com/painter/clb/popup7o.js 123.125.65.120
hxxp://www.5w123.com/images/upload/1409016707.jpg 122.225.100.200
hxxp://www.5w123.com/images/upload/1409016761.jpg 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/49.JPG
hxxp://www.5w123.com/images/upload/1408930505.jpg 122.225.100.200
hxxp://hzs7.cnzz.com/stat.htm?id=555586&r=&lg=en-us&ntime=none&cnzz_eid=540886874-1409048682-&showp=1024x768&t=&h=1&rnd=1183407369 42.156.140.24
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/44.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/17.JPG
hxxp://js.hao2266.com/theme/newhao123/css/global.css 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/22.JPG
hxxp://pcookie.cnzz.com/app.gif?&cna=b06DDIJWbA4CAbhrJiYpVv3T 42.120.219.171
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/7.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/25.JPG
hxxp://www.5w123.com/images/upload/1408954420.jpg 122.225.100.200
hxxp://www.5w123.com/images/upload/1408954395.jpg 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/42.JPG
hxxp://www.5w123.com/images/upload/1408954346.jpg 122.225.100.200
hxxp://adsvc1.haoda123.com/tc.htm
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/14.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/24.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/29.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/11.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/33.JPG
hxxp://www.5w123.com/images/upload/1409016738.jpg 122.225.100.200
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=893227110 42.120.219.171
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/friend-down.gif
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/43.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/28.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/47.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/41.JPG
hxxp://www.afwfb.com/u_12480.html 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/39.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/18.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/48.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/23.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/45.JPG
hxxp://c.cnzz.com/core.php?web_id=555586&t=z 42.120.219.6
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/32.JPG
hxxp://www.5w123.com/images/upload/1408930308.jpg 122.225.100.200
hxxp://www.5w123.com/static/images/s/baidu.gif 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/down.gif
hxxp://www.5w123.com/images/db100x60.gif 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/1.JPG
hxxp://www.5w123.com/images/upload/1409016784.jpg 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/3.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/8.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/27.JPG
hxxp://www.5w123.com/images/upload/1408930419.jpg 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/9.JPG
hxxp://www.5w123.com/images/upload/1408930483.jpg 122.225.100.200
hxxp://www.afwfb.com/static/images/s/360buy.gif 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/34.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/19.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/38.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/30.JPG
hxxp://www.5w123.com/images/upload/1409042972.jpg 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/21.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/20.JPG
hxxp://www.5w123.com/images/upload/1409016807.jpg 122.225.100.200
hxxp://www.5w123.com/images/upload/1409043350.jpg 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/13.JPG
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/36.JPG
hxxp://www.5w123.com/images/db380x60.gif 122.225.100.200
hxxp://www.5w123.com/images/upload/1409042922.jpg 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/6.JPG
hxxp://cb.baidu.com/ecom?di=98364&dcb=BAIDU_DUP_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=4&dai=1&dds=&drs=3&dvi=7o&ltu=http://adsvc1.unadnet.com.cn/ad/softad/popup.htm&liu=&ltr=&lcr=&ps=13x8&psr=1024x768&par=1024x740&pcs=0x0&pss=20x30&pis=-1x-1&cfv=6&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=250&tlm=1363765561&tcn=1409030684&tpr=1409030684121&dpt=none&coa=&baidu_id= 123.125.115.99
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/4.JPG
hxxp://www.5w123.com/images/upload/1409018148.jpg 122.225.100.200
hxxp://adsvc1.unadnet.com.cn/ad/softad/images/35.JPG


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ad/softad/images/friend-down.gif HTTP/1.1
Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive

GET /ad/softad/images/friend-down.gif HTTP/1.1
Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 933
Content-Type: image/gif
Last-Modified: Wed, 20 Mar 2013 06:45:51 GMT
Accept-Ranges: bytes
ETag: "962f3d903625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:37 GMT
GIF89a.....?.e........O.m..3........ ...".Q...).V..K..3....d3.........
...<.f............../..@..H...@.`.....<........6.........~......
....B...N.}..A......s..........9..0..1.....'........5.....5D.d........
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.................!.....?.,....................?.d.a.......80.....ll.1.
....&.X`c....<.. @E...l...........Q.....B.0@..L.5..T..iJ.62...@...3
..\.....G.f......9.4......o....;
....



GET /ad/softad/images/35.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1517
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:32 GMT
Accept-Ranges: bytes
ETag: "98a4a9843625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:38 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?..M.....;%.j.F7K4...oE,{...!A<..iR.i.t..6.B."..I]...<
;#.i.\........Q.#|..?..8...[......B:.w.[}.._3..|;N..%.>.o.w.|./.x_.
...>?.u.%.s.{{v.t....gz.V.Wo5..zm..d....:.z..k.....#_<|..x......
.u.-.C4s...}.K`.........<va.I.g7..u......3..{:...v[.K.K..t....\....
8...\k.y....&q.!<.y...'kuV......G...;....^.M......C......4...W...6K
M6.....R.K.s_........I.#.V....1.g4.^4.......9..AF..As>.?...k.......
K....l..!.$(.(n.A..`....k..X....l|.&.X(..yT............v].t..1j2I.:m.t
'0..C.:..#....]..415}...D....}...v<..kQJ....g.}..t.....u.O.W... 9^.
.{_........`.H.q....:,.}.%..7..u..../O.....K..]f.T.(.B-....GN.w.. ...;
....L5/.k.ebw%...a...2.. ...8..y..R....]......k.C.o.C..iY...~.....s...
.......~M*.......p........9#...T./u5......u...R..I..m..s.. ...R..h4=].
[....9..s..... ....O......o.EZ.'..v^ku-..I&r}_..=7d.]...>...i.n....
.....%...Z.-KR...x.......pv.#9.gVR\.E.m....I..is. .6...O.....nZy.U

<<< skipped >>>

GET /ad/softad/images/39.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1726
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:35 GMT
Accept-Ranges: bytes
ETag: "10b943863625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:38 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?..O.x~...)..P...Dy.d.%Pd...u.....ap...v.e..K....."M.F.K._.
.........4.......S.(...-..B..t........hbk.Ec`..._.D.N.......Z'........
.....5...r.....m...;.^j.....&(O.aa.w'......fX...............g..o....Zi
>.Z.....t...-...........D.....1........1.X.9.O...%e'..=...^...{ ...
..s\G....x.@.i?u. ......f.,~2.G...5.....M.*.t.{]k..te.Q..v^Z&........;
.5}b. K.$.....)3..eV.f,N...x.#=....e.....[.C.r.;5g..n....o........N.R.
....m.....YT}.....0.....9^..c.......t...e......'..&...V...,.iI....8..k
7..z...........S../....%P...9l.O........D(...*.J:..T...JSm.G r..I{.Q..
k.g..~....... ...N..e.....'.....7O...e..g.|eO.Z..xC...oz.-....}...4...
v..........vv..."........z...M../_...x<m....*..T#N..yZw.._...v.....
%'...?m#......-F .9.4..I?......s_].....Zq.......m...F..z.j...9..3.....
.a...N..S.../j....$.<.#.F{....'...`......;M...[E.j...'m^.j...q^.v..
..I....i.3kvvW6..H.:.r...6#..<.v..w$.....jJ....%.....7u)...k\..

<<< skipped >>>

GET /ad/softad/images/43.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1299
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:41 GMT
Accept-Ranges: bytes
ETag: "aaed258a3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:38 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?......(...|.ki.y.R_..k.k....?.&1|.f...o.>v$......Z.G...
7....$....x.B\.s.....U/m....u.........."`...U....v%F..zoRI.^3....WG.R.
.I.j.... .j.K.Y[..E..E......m`....w..\g...^.....Y....M^ ..{.x.....c. .
#..T#..L).~^z..#_M.......".yB.A.. ...eV....^mj6....\.3S..<ZS..._.i.
..Y.l^.....Q....<...$#.....z........v.o.....h...~...{.[.......Q.tC.
.mcy#$....U.I..r.*....o#{/ ......!.. /..z.O....5.........)h...N..,...%
dC.O).OA...(..y.>jNNRm...rwoS.._..?I../#..O..H.\.......y....w).#...
2.[.F..QMt....7O..%.W..|6P c$....#;B>>~.;K.q.....F.s...^.sZ.>
D......Yj:....^.Z..M....E.k.h....2#^.72.....m..7.yC}....=.~vk_z2...W.S
...........=-.x..O..1.. [.ta...y.en....C(.B......y(.>W.N.......nt>....

<<< skipped >>>

GET /ad/softad/images/47.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1156
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:44 GMT
Accept-Ranges: bytes
ETag: "4c77d58b3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:38 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?......(.....xcT.v....A.\I.3p. ..{(...$.M....>.....8..{h
o...v...7%0w2..E=..r9,.8.......Gc..o...........`.K.g.?/G......$}.MT]..
...,xW.< .xV.mu.2k).........*..3.q...4......y....?.R.r.<.|..)..a
..t.8.0. `~f....Y..J.........E/..b...\1R.t....j...e.s..%..%ih...d.el..
..v6....*..-.nv.Is.....J.CH..)._..g...>...I..Lmf....8.g....~...C...
=(.[....]...A.6w..]%....H .GC...r.........SVd...x..Im.MPIu.x.0.5.DK.).
.......[.nE..O...u...EJ?4..-....}^.V...3..}.=...y-.p.$v..7`.... `.. ..
.*.,.&...*.......~.....rV<.{.n\<.. `g..@;.a^.Ild...
....



GET /ad/softad/images/24.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1406
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:23 GMT
Accept-Ranges: bytes
ETag: "f01b8f7f3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:39 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?..k;9.....,z..z.j..H..4.....6..E]...............k...a.;#h.
. ..(=q..q.p.._5T........^.5.....Pm...GD.Z-.n.;i....T.u... al.M....3.I
#PY1.Fy9......w(...0Q.'....2VoG...z...3....K.,.*~.....f.n.7md...t.....
..........>.kZ.'..,..N...|......<*c..v$ 3........=<<u..>
;..]8P.'.o.J...E.{i...#..lvE......HTU....I.N{..c.z.mA.I[..w..w.~..X.ft
.c ..m5k5.. >f.. .....}F.S..f.......=.:.....\......Q.[......T...]Y5
#..aJ5.WK..^V.u..j......|.......D<q8.............1..R.}-.._..."...(
U...X..k; .w.......H..E.1,.6......#....MTVg...T.T......wM4........m...
.m...pA....c.c......3,n<.v}.....~.....T..X.<..W.Mk.....9..(.."..
........hx.N....z..t.h#.......6.....j[.....~l!.._.........Un...W.x.f..
}.."..Ny.Mu.q>.E....~......C......3t.....N....E7......~.O*.n...1.Z&
..#..$.c......)I.K...._...j:jJ .r..4?..
....

<<< skipped >>>

GET /ad/softad/images/28.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1170
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:26 GMT
Accept-Ranges: bytes
ETag: "d0b932813625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:39 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?...#K.W.[h."..........$..rI..;_..=..<p.d.7.c.z^H.hZ..L8
d...m'*.....~(...i..).... ..F..U..B.o.*..'...d...nm..@.U...u.]}G.. ...
....>..-.....CLv....-..J.......$.c..I..4..z..c.isj...%..Ige$E.4b.S4
[.3!.).... .H*...."j....k.2..9W..(......DwG(...vI-.9..msB......&.@...#
..q.v.[.T..?.../.x.ZO..pi.L. <C..El.......v.7u.....z...ms....1..zp.
n..0....6.....}.\.X;..N..t$......W..Wu.*..Y.vV2..G...HK........m......
.E....S.nAV..O.Y...<t..]?P.M...T..tq..OUa......Cwg.X5.....I.t.<.
l..G'88.OoRI..[....J...y....R..P.J.1.......sr.2.`..6.k......I'$.@...font>....



GET /ad/softad/images/32.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1669
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:30 GMT
Accept-Ranges: bytes
ETag: "f2d97a833625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:39 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?......WR.m..-.N........y#.v.m.........*......\....Wv..d.o.
...&.(.l.<[.c..V...m....^..5:..^.$m.QI.H...7..;Ny...f.iW. h.]&..mRn
.I.~.i.....a a.]5.w.I.......W...'..-.....Ie.kC*.... .v.w..0m.:..T2....
5...Z6.nkj..^.#..F&....LM.....m.k.7.u.L.C.0......H.. .v. ..b.2$b...F?J
.3....R1.;...S.....Z.Uy.Q.... .)vE-1..N....&&.1.C..............O..7..;
..^...2..........4...{....k.Ou......p.?....yp.*...S_.=..Mv.q..)R......
.....i .6. Iut.5..*. ..e<.x....x.q.v]..`.IZ.K.~...~.;i..aV.D.......
..|;y.....Z..&...4.f..K.......n=.....8..J.`.Z....J...^....Oh.|......3E
.......6b...].Y...Pv.....8.Nj....8..w.n...5.....S....[[......}o.}..iWg
E.......*...f.....<.g....A.7:v.........uk,M5^1..g.j_x.^..^F..G.g..'
.....N{.}........j...G...{]y.^z...m.{..~..yk{O......<..._.}...o..O'
f6....s....xy..9...w..6....W.e...W..[...5...ko......4z\.....H.&...&%i.
.bl...7n..:.6T.......|.j..0.Q....^.....b.i.,zt.B....T.... .p1...9.

<<< skipped >>>

GET /ad/softad/images/36.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1466
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:33 GMT
Accept-Ranges: bytes
ETag: "1eb319853625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:39 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....;...zE...s5....>ZAt....uA.1..'.......g....m.?..}7[R
.d...z.....X...kgg{.$..J(..2.~`1.=y..t.....*.Z:%.m......w.Y.W.PwJ..-~.
.}58:.Fw~..u....... X.S8.D..y!|....A....a.....&T.7..w...K=.U....u{..3.
.GI.,&..!Kk....,..v.....]z.....V.2....-6..... b#R.-h ..O].....x:..Q.5.
.........32..... .Q...@....:j)7.h..W....[,.!V.V....l..~..[_.w....u.. Y
n_..t.....Y,K.$g..O.........|.WR...M6..w0.q.g.i{sa8..w.A.N3.p}G..w....
....v....xu};I...Yd.U.0.(.b....-.........C..T...... __..-=j9.L..ta.i&.
...w..V.6..^..I..]M...YC;C5.q!'a.....c.<...P..9NkO[... i...........
...Mid..Iu^.......3.nn....q H......{W{m....8R.,..cF....l./....Y..3....
..`N.H..$s.*N.)N..ih...^...R..=.....t..}.O...D.Ag.Sy.0.V-.6..8.6...|..
.6.G......V..~......[..=....xc........N....".qL._.I ..m......#.....8.U
J.|...v.. .....u9..$........gV..../ ..Oi..........s.|..|<.:Q.Ei5...
..d.....
....

<<< skipped >>>

GET /ad/softad/images/40.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1145
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:36 GMT
Accept-Ranges: bytes
ETag: "ac9dea863625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:41 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....:..xI|U.N..I...n..#qc.Tg.Bs..q.W.3..h]n..5.m =../.....
...=....8.:..w....p2*........5..3.C....G..*E.3..*...O@.&.W`..G.h....j.
Z.........#........6)...A.Mx..NR........=ZQ..%7kn../#...~#.,.....%....
$..$..g...........~U.......s;..zg..x/MI/..................J....y.S..N.
..;K.....D@.[L.8.p....N...:x~[>.l*s]v..F......b...S%..S..~I..N...`.
...S..n..z.......$d...~?.^...4y^...S....[/.-..6.c..q.7..zw94K..' .k..
..-i.n...{Yvyl.',.L......i.\..z...3...O.......sp..i&......S:<.'dT r
.....N..R.=.......c......I.T.. X..
....



GET /ad/softad/images/42.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1649
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:40 GMT
Accept-Ranges: bytes
ETag: "22a85d893625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:41 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?..]#A....|...O.7a\..T(h..V6.k'..w.....&..iO..%.(kK..O.....
.F....<.-..3.*..z/....k..xL.,..eB............7.7...&......6.sz.-.B.
Q.\.!.x....cN.j.EG{.......kC...%J2.2M.o'._N.1.iv.u.l.`..s.....p2..L..|
W...e{..]{k.....|%y...E...s....5...C8.a_.2....m.w.8.}........r.R......
..v.....[....(k.u.0$.i.....1....XD...9.....n)`#..Z.Mk.[[....n...ldqm..
.z..n._....~.<m..8....dD..[`......p#..u.l..:T..V..[..|Y.W..i.%.=]..
[...4~ j:....g..^j6....5#...r.D\.6..0..5..P.....[.Z._;...=.<....8..
..-I~.... ...DV........H... .....x....-..{..]w.....>g......:o.~....
.o.F.DBd.....r.K.e-..c.P..0B.. .....9b.Zi%k=..o...>..,.(TV.....GG.D
..._.Z.....<.....'h.S..~...W....p>.,l1.v.S...%g.. .m~.}of....q.\
........K.Y]..^i.e........*F...Q..N\........'.R....r....Owv...m...>
o2tg..N.....K../|3.Y..j:.6....5..b.{F.3..K.y .p.....cj.R.........Z4...
.....E..v..cCT...m.em?U..n..YS|..P......|.j....A.y0..v".h.Q..^..}.

<<< skipped >>>

GET /ad/softad/images/46.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1259
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:43 GMT
Accept-Ranges: bytes
ETag: "668e8b8b3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:41 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....O...3)=.d...~....8....pXI.u..g..E...m~K...]J..:"=KF.(Z
h.....A...j.....*.gkt....={...9IFJ..|Y...^..|..C.f\3.H.....J.<... .
K..O.t...o.......=...Q,.e....1......Y...G.>.W........6..to.k~ /...K
:.C?...dnb.y.g5...#..g.J.J...OR...{...m%....E.FH.=..<.....&p.7.%`..
.'...2 ne'............Xz......; Y.W.U}o.Z....t^...n..RP..D....n8..}.7.
,..5a%&.M.{.o.U.....^.i....{>....u.O.E...D{a.`@..y.q..9bO.y...9r...
......*....g...u..o.[.}./ZMF....m.`.... .3....i....C.8...G._.V..... ..
.kK......S.....PC.......&.....$...........^.Y}%....J.?*..8*...7 .@= .P
.U...T.T.Ts.....k z? ...D6.ZYj........I!.`Op.#..t.......iSi.K.8q..u".R
.^.....%......
....


GET /images/db100x60.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:22 GMT
Content-Type: image/gif
Content-Length: 4147
Connection: keep-alive
Last-Modified: Wed, 07 May 2014 06:19:50 GMT
Etag: 19323BE41033
Expires: Thu, 25 Sep 2014 10:13:22 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
GIF89ad.<........3l.2p.....)..F....Hz.kT.;v.S3.E~.......(V.$;..../n
.....R..)..^..&.......6e..a.]..{.....w:.{d.k1.I.....JK.r..L..@z.......
!6.w..)i.b.....R.....:R.....!....V.."e.)`.U..#T....Cv.2Z.N.....$g.XP..
5.m......>. K.03..&..?.h.....m..:>.8o..;....Y`.Q.._........L.. c
.Yc.)H.R..C|....U?.P..;m..#...../....^A........*. `.e..P.. e..`.>x.
'h.6s.W..O..S..-b....'c.Xx.0i.,l..R. Z.%d..\....... f......!..NETSCAPE
2.0.....!.......,....d.<.....}z.}.}j}.}U}5}>} }v}.}.}m}..}&}Y}.}
!}%}<}P}p}7}n........................z....j..U55>>l vv...mm.
.k&&Y..!!%%<\P.p774n.4.p.P\<......[....n."h.....*.4.iVa..A..)b..
.$J.0i...S.Q.N.Z..U.X.Z.Ju...P.Hf.TiR.G..%:T..2=..E.V.Z.m....W.`.u....
W....... ...@........C.5. B...b....v.....N&s...r..Y2m......_>..-F..
..I#J.f..6n...#g..:v....g..>~.B.<..`..m..x..nEe......cO........K
Y1k..us.N_=..%6...e..rv.9...TK/..Z..._..& ....k..\.pw....EHF....O!...r
.....Q.`.t..t.M....v..4.P....f..CO.5.....@P..HH!E.4.....aE..|t@.W.. ..
.p........9o....A4.G.H.`%..`.....p..ah.B.Y...]...c.%.!B.<...'.$...&
lt;j..)At........=.r$.v:1..x6....(...5h.G..........3|....n..(..H...S..
..1...." 1........p0..a. ..\d........2..V...y.owat.................c..
')].;i....@.........E.pv...C....~FA..($.*.r....A|........|l..../.*B.-j
......c.1.\r.~....| . .ap@....(.... ..,....@. ..a.]...Z...p.0d......Tk
....t1J./....`k1..$....R.Q.....f.I.......m.k............B......H....3.
..iY...W7....l.......9.7....*.P..=..D.g.xm..~.(.=A.f...b..a. ..0......
...p.-..Zt..%.....Q.j.*z?\......._*.....${8...13....'.%. ...[.E...

<<< skipped >>>

GET /images/upload/1408699061.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:23 GMT
Content-Type: image/jpeg
Content-Length: 14299
Connection: keep-alive
Last-Modified: Fri, 22 Aug 2014 09:17:41 GMT
Etag: 193B8E0437DB
Expires: Thu, 25 Sep 2014 10:13:23 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:613D430D29DC11E481FADDE64048E308" xmpMM:DocumentI
D="xmp.did:613D430E29DC11E481FADDE64048E308"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:613D430B29DC11E481FADDE64048E308" stRef:doc
umentID="xmp.did:613D430C29DC11E481FADDE64048E308"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................V...................................................
...........................................!..1A".Q2..aq#...B.3$.R4%..
..bScD.......................!1..AQ..a."2q.....B#..R3C...b$.4.........
....?....._.z...|...3.....F......WW.@...jaO.^e.#..RZ......'...[...._.@
......0x.3......3D..H.9/Sj.QF..h.@.C.......".x:XU..5..[[.F.3.[.....M.k
"..._..H....l...k....p).1..T..}..K.q_[...r......r-Q.c.....&]1s.V.X.=5.
.)..........m.s)#..cp=.6.Y.-..ii..ol.>.. h4.z'.C..`!&.Aq.dS..1k

<<< skipped >>>

GET /images/upload/1409018148.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:23 GMT
Content-Type: image/jpeg
Content-Length: 14030
Connection: keep-alive
Last-Modified: Tue, 26 Aug 2014 01:55:48 GMT
Etag: 1FC8363436CE
Expires: Thu, 25 Sep 2014 10:13:23 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:452566252CC311E49613F49230256D27" xmpMM:DocumentI
D="xmp.did:452566262CC311E49613F49230256D27"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:452566232CC311E49613F49230256D27" stRef:doc
umentID="xmp.did:452566242CC311E49613F49230256D27"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................V...................................................
...........................................!.1..A"Qa2..#.q...$BR..b34.
......................!1.2AqQ"a..3..BR..............?..<.....7..{{.
.l7....m(r.^.?4`..Tqq,z.D,..bj.YD.](.`.4...g\i.!q.{(..]x.q.Ij....G82H.
.P.7k........{z."..z.)j...ST.....H.n|...,k.......U......f...:^.|.w0..i
.Mv.....DT.....M.kq..........i'7O....)..(.o1e_. .?.=.{.>.;$.wb..!&.
......W..z.. ....3#.)7'.<v.hJ.....a..F;:{.@.Je....]o~.gW]^.]...

<<< skipped >>>

GET /images/upload/1409043350.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:24 GMT
Content-Type: image/jpeg
Content-Length: 25485
Connection: keep-alive
Last-Modified: Tue, 26 Aug 2014 08:55:50 GMT
Etag: 152AF1D4638D
Expires: Thu, 25 Sep 2014 10:13:24 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:947D1C232CFE11E49FC0EE33D720C6FA" xmpMM:DocumentI
D="xmp.did:947D1C242CFE11E49FC0EE33D720C6FA"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:947D1C212CFE11E49FC0EE33D720C6FA" stRef:doc
umentID="xmp.did:947D1C222CFE11E49FC0EE33D720C6FA"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................V...................................................
................................................!..."..1.AQ2#aq$...B3.
R4%DU&........................!1..AQa"...q2....B...R#....br3.C......4.
$..............?...7..7S.*.....>?W..Gy...W..h.....|7.<.qVE......
n.D.....o.?...I..f.b.U.N........Z...W.s..i....M.A..fc....H...ob..$.."s
...=.U~F$....zi...19.CAr.|..(........9...k{........j.6#.v.?....?~.....
..<.$...7)....M#.../eS.{..[..#.....<*`.c@.....-...JG..0l....

<<< skipped >>>

GET /images/upload/1409042922.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:24 GMT
Content-Type: image/jpeg
Content-Length: 17230
Connection: keep-alive
Last-Modified: Tue, 26 Aug 2014 08:48:42 GMT
Etag: 1B62CDB4434E
Expires: Thu, 25 Sep 2014 10:13:24 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:478A77C72CFD11E49E7199E7E132F441" xmpMM:DocumentI
D="xmp.did:478A77C82CFD11E49E7199E7E132F441"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:478A77C52CFD11E49E7199E7E132F441" stRef:doc
umentID="xmp.did:478A77C62CFD11E49E7199E7E132F441"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
...............................................!.1A"...Q2..a#.BR3$.q..
..b.CS4...r..c%5........................!1..A..Qaq."...2.....#3..BR.b.
$r..Cc.&............?...l.bM....#..ah..^]/.q.$A....C9....lp.H.!1..A'We
8.j...{.B.0....f..P.......^... 8.q.OCIq9=./......nB!Y.....>....T<
;.x.nW.s..,...Y...V.i.L..?..wciqK..^..&.\E../c...].>..Z#...-b.n..o.
.re @q^.(.$=...$...Dn..m.. .m!R..u.....{{....Oi..n...J.7.......y&

<<< skipped >>>

GET /images/upload/1409042898.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:25 GMT
Content-Type: image/jpeg
Content-Length: 16856
Connection: keep-alive
Last-Modified: Tue, 26 Aug 2014 08:48:18 GMT
Etag: 1B277C9441D8
Expires: Thu, 25 Sep 2014 10:13:25 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:311894832CFD11E4936A8B990216E184" xmpMM:DocumentI
D="xmp.did:311894842CFD11E4936A8B990216E184"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:311894812CFD11E4936A8B990216E184" stRef:doc
umentID="xmp.did:311894822CFD11E4936A8B990216E184"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
................................................!1.."AQ2..a#..BRb345q.
...r$TU67......CScDeVd&X.9.......................!1..AQa.q".....2..B#3
...R..4...C$r..S5............?........V*@.M.....Ku..>.??....z...q).
...ZMEGSD..O*.t.r5../UP).....n.V......$.T..G.kA....@.:..... (t..e5....
U.....x.S.. r...o....v.....;ra.r.{..qg_......6...HR......?...c.....\.b
.(...8{.v.%.-..P\.pQg../.....7.t%G..d.g..i..I8V.....u....]........

<<< skipped >>>

GET /images/upload/1409016707.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:25 GMT
Content-Type: image/jpeg
Content-Length: 11786
Connection: keep-alive
Last-Modified: Tue, 26 Aug 2014 01:31:47 GMT
Etag: 1AD07F442E0A
Expires: Thu, 25 Sep 2014 10:13:25 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:FFAE25312CBE11E4B1F5E08E56A2718B" xmpMM:DocumentI
D="xmp.did:FFAE25322CBE11E4B1F5E08E56A2718B"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:FFAE252F2CBE11E4B1F5E08E56A2718B" stRef:doc
umentID="xmp.did:FFAE25302CBE11E4B1F5E08E56A2718B"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
.....................................................!1..Aq"2#%Qa...$'
.5&...BRr.34EU(.......................!..1.AQ".aq......2....B#..R.r3$.
...........?.....L5_0"....Pl.....l.|..dFbr..\..s....3.|9?..'.s..0cI.Y.
I...= ...7.Haku.?.F._)%....A..7.Z.k]}7[..../^..t..........3J..Qk.W5...
b..=(.4D!:[..z.........o~iY0.g2T..t...Kw~ofE.K.....,3G,..q..Tm.APFNAR.
.8....."..w..>.~v..K?.KF..bq$r6......be.,...>....7F.N......)

<<< skipped >>>

GET /images/upload/1409016761.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:25 GMT
Content-Type: image/jpeg
Content-Length: 21484
Connection: keep-alive
Last-Modified: Tue, 26 Aug 2014 01:32:41 GMT
Etag: 1F777ED453EC
Expires: Thu, 25 Sep 2014 10:13:25 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:CE0165B52CBF11E4BD4EBEB76DE07F16" xmpMM:DocumentI
D="xmp.did:CE0165B62CBF11E4BD4EBEB76DE07F16"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:CE0165B32CBF11E4BD4EBEB76DE07F16" stRef:doc
umentID="xmp.did:CE0165B42CBF11E4BD4EBEB76DE07F16"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
.................................................!1.."..A2#.Q345.a.BRb
$U.ScTd%6W..qCe&V7.............................!1..AQ.aq."....2.....R#
.B3.$..CST.b............?....m.........j39.. ......L...m..*:J..v.e..L2
.O.HH....V..O.[..u..tc...a...Sb....C.....ta.L..L...t...2..;k..'D`...O*
.dx.D.'..5Q...i....,.kjsqj..;.(..w..{T3_v.UjS....A..Tv..".GE,n...!...k
z.4.h....DW......y..RT.e.t..O.$`p.;..k....p...5.....uV...s.....x..

<<< skipped >>>

GET /images/upload/1408954346.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:26 GMT
Content-Type: image/jpeg
Content-Length: 22448
Connection: keep-alive
Last-Modified: Mon, 25 Aug 2014 08:12:26 GMT
Etag: 18471BD457B0
Expires: Thu, 25 Sep 2014 10:13:26 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:511F04672C2E11E4B097F6852A0C24B9" xmpMM:DocumentI
D="xmp.did:511F04682C2E11E4B097F6852A0C24B9"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:511F04652C2E11E4B097F6852A0C24B9" stRef:doc
umentID="xmp.did:511F04662C2E11E4B097F6852A0C24B9"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
.................................................!.."#.125.Qa3$4.AqcTd
%U.BRS6..bV...CD..F..........................!1..AQ..aq"..2....#....BR
b..3$.r4.S...T%..............?..#...}........mB...}...h..........#...?
.Z.>h....[....[..z..j.:..5..P0.#...2..b..k....F.j.U....rE.i.@.ff-h.
Ij....(.k..?..4.B...s.U..h.b...g.s..%.I ...jGe.":.^!t...i........r..P.
......3P8.....Q...s:..N....{*c.e...[..G.:.^:X..#...V..1=...J'5....

<<< skipped >>>

GET /images/upload/1408954367.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:26 GMT
Content-Type: image/jpeg
Content-Length: 15663
Connection: keep-alive
Last-Modified: Mon, 25 Aug 2014 08:12:47 GMT
Etag: 1B7A09243D2F
Expires: Thu, 25 Sep 2014 10:13:26 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:D39BD8252C2E11E48A9AA39B76BB5744" xmpMM:DocumentI
D="xmp.did:D39BD8262C2E11E48A9AA39B76BB5744"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:D39BD8232C2E11E48A9AA39B76BB5744" stRef:doc
umentID="xmp.did:D39BD8242C2E11E48A9AA39B76BB5744"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
............................................!1..A.Qa"2..q.#....R34....
BbrCS$....cTV....DdUeVf(........................!1..AQ.a"..q...2...R
#3....B...b.Sc$4..C%'.sDT............?..[bG.@....U.......D$.5E....[...
x...V...~!..'A.[...sf._..SVK=..!..NZl.........L....Jc..).:.D.n$.R5.v{i
..`.O....u......Ys...g.........~.Q ...6.s.....[=....3..\`Z.wV..A.L'..m
..I..@[.tEk.!..^L...D$....;.T..#.i-r.......G........%.x...d...aOV!

<<< skipped >>>

GET /images/upload/1408954420.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:26 GMT
Content-Type: image/jpeg
Content-Length: 19774
Connection: keep-alive
Last-Modified: Mon, 25 Aug 2014 08:13:40 GMT
Etag: 1970B7744D3E
Expires: Thu, 25 Sep 2014 10:13:26 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:351BE2A72C2F11E4A428D5D7498434B5" xmpMM:DocumentI
D="xmp.did:351BE2A82C2F11E4A428D5D7498434B5"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:351BE2A52C2F11E4A428D5D7498434B5" stRef:doc
umentID="xmp.did:351BE2A62C2F11E4A428D5D7498434B5"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
..................................................!..1"...A2#3.Qab5BR$
4%.q.SU6V.Cer.cDTd.&f7Wg.8.).........................!..1AQa.q"......2
.....BR#.b34.CS..r.$Dc.Td^&'............?....:.?./.3|......}.N...w=.
.E..s.U.I.HWE.R...:......>.....S(W...'.7......4..g##..\X..VVGe.....
..}..`....U.S........H.............0....6..8...&.*...--..#y..N.......1
.". . ....uR.....A..m.T^_...D..).l..F..O..z...40 ...Y.{...Mj.....!

<<< skipped >>>

GET /images/upload/1408930419.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:27 GMT
Content-Type: image/jpeg
Content-Length: 13713
Connection: keep-alive
Last-Modified: Mon, 25 Aug 2014 01:33:39 GMT
Etag: 1E930EF43591
Expires: Thu, 25 Sep 2014 10:13:27 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:4AF7BC3D2BF611E491D68054D3FDA47C" xmpMM:DocumentI
D="xmp.did:4AF7BC3E2BF611E491D68054D3FDA47C"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:4AF7BC3B2BF611E491D68054D3FDA47C" stRef:doc
umentID="xmp.did:4AF7BC3C2BF611E491D68054D3FDA47C"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
...........................................!...1".AQ2#.a34...BRb$T56q.
Sc.7..C.%W...r..s.UV'8......................!1..AQ..aq"2......B34..#..
.C..............?.......2.\.N...........L'....g"{.H..@P.............}.
v. ...3<A..l.....|..m..$.F.A..A*.L..}9.x...G...k".J....E...3E`C.L'h
.&Tv.$@..V..s...3..=XH.$/......h....92x.^e..K5gK.e...x.....uP.......v.
..jl... S#[1K....U......*.i$k.KN"n.*.P.._^.............rv...1yZ.H.

<<< skipped >>>

GET /images/upload/1408930483.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:27 GMT
Content-Type: image/jpeg
Content-Length: 15673
Connection: keep-alive
Last-Modified: Mon, 25 Aug 2014 01:34:43 GMT
Etag: 177EAB643D39
Expires: Thu, 25 Sep 2014 10:13:27 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:8DC0BB4B2BF611E49C68DC0EF5E97BDB" xmpMM:DocumentI
D="xmp.did:8DC0BB4C2BF611E49C68DC0EF5E97BDB"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:8DC0BB492BF611E49C68DC0EF5E97BDB" stRef:doc
umentID="xmp.did:8DC0BB4A2BF611E49C68DC0EF5E97BDB"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
...............................................!1.....AQ".aq.2#..R3$..
..bC4%&....Br..DTd5E.......................!1..AQ..a"q...2......#...BR
.b3$r....CS%............?....:Yn.!.... X.K..}...@.n..IV..k|..'.....[.m
."....\....N...P....8S.....%.zh..(}.;n)0.2....R.B..G.5.{.N....]...j...
H @l..pi....K~J......V.l.@..9.c...E%.41...\3..[....2@..)}......`....@4
*.B...,T........6..R. .. )iR~...gN[.h..S'J\..t....~..............q

<<< skipped >>>

GET /tc.htm HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/popup.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.haoda123.com
Connection: Keep-Alive

GET /tc.htm HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/popup.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.haoda123.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Content-Length: 1308
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:27 GMT
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "hXXp://VVV.w3.or
g/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>.....
.......</TITLE>..<META HTTP-EQUIV="Content-Type" Content="tex
t/html; charset=GB2312">..<STYLE type="text/css">.. BODY { f
ont: 9pt/12pt .... }.. H1 { font: 12pt/15pt .... }.. H2 { font: 9pt/
12pt .... }.. A:link { color: red }.. A:visited { color: maroon }..&
lt;/STYLE>..</HEAD><BODY><TABLE width=500 border=0 c
ellspacing=10><TR><TD>..<h1>............</h1&g
t;....................................................<hr>..<
p>................</p>..<ul>..<li>...............
.........................................</li>..<li>......
......................................................................
......</li>..<li>....<a href="javascript:history.back(1
)">....</a>....................</li>..</ul>..<
h2>HTTP .... 404 - ..................<br>Internet ........ (I
IS)</h2>..<hr>..<p>..............................<
;/p>..<ul>..<li>.... <a href="hXXp://go.microsoft.co
m/fwlink/?linkid=8180">Microsoft ............</a>..........&l
dquo;HTTP”..“404”........</li>..<li>....
“IIS ....”...... IIS ...... (inetmgr) ....................
....“........”..“............”..“.......
...........”........</li>..</ul>..</TD><

<<< skipped >>>

GET /images/123logo.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: js.hao2266.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:22 GMT
Content-Type: image/gif
Content-Length: 6870
Connection: keep-alive
Last-Modified: Wed, 18 Sep 2013 03:06:05 GMT
Etag: 12C9AC141AD6
Expires: Thu, 25 Sep 2014 10:13:22 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
GIF89a..D.....U......................d.W...-.3....................}...
&.5.....yd.e..................=.0..............r...............u......
......c.1.3....j!.......R.2.Bw.q..|......Q.,..........................
..X.A./U.J.Z.............z.b......M.<...I.M..V....d.........[.....m
....i(....^......dZ.h.w:..t...r.a...*.4............@.N.h ....}=...i.tM
.-................c%....\.i.e".5........v....k2.......f.....~O........
....Y.:.uA.zD......Q.Z...........H.....}.]"L.[.....S..P...............
....................|...................................f...n.d....o5.
.......~.....`........................;.09.1......K.-F..O.-E./J..H...a
..`.#.5.........8.1.S.4.2......6.2.l"........Y..........o,........w...
....................o?.?.....................|..............`.H.....p.
..............!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzr
eSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adob
e XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rd
f:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <
rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/
1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef
="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns
.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.di
d:1BF73656200F11E388938271655BCEAA" xmpMM:InstanceID="xmp.iid:1BF73655
200F11E388938271655BCEAA" xmp:CreatorTool="Adobe Photoshop CS3 Windows
"> <xmpMM:DerivedFrom stRef:instanceID="uuid:515A9B77B68EE11

<<< skipped >>>

GET /theme/newhao123/css/global.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: js.hao2266.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:22 GMT
Content-Type: text/css
Content-Length: 15726
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Thu, 25 Jul 2013 10:52:29 GMT
Etag: /theme/newhao123/css/global.css HTTP/1.0
Host_3D6E_51F1036D: 
Expires: Tue, 02 Sep 2014 10:13:22 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
body,p,b,dl,dd,td,th,input,img,form,div,ul,li,h1,h2,h3,h4,h5,h6,span,s
elect,ol{margin:0;padding:0;}img,iframe{border:none;}ol,ul,li{list-sty
le:none;}img,input,label,select{vertical-align:middle;}body{ font: 12p
x/20px arial,......;background:url(../images/topbg.jpg) repeat-x #f5f5
f8}.red{color:#f00;}.green{color:#008000;}.blue{color:#0000fe;}.orange
{color:#f60;}a{outline:none;}a:link,a:visited{text-decoration:none;col
or:#000;}a:hover{text-decoration:underline;color:#f00;}.sethome,.wrap0
2 ul li a,a.my5w,.mzdh_list1 #topsite li .tsbox .arrow{background:url(
../images/images.gif);}#header,#search,#content,.request,.home{width:9
90px;margin:0 auto;}#top{width:970px;height:28px;margin:0 auto;padding
:0 9px;overflow:hidden; font-size:12px; line-height:28px}#weather{floa
t:left;}#set{float:right;width:auto;}#set li{float:left;line-height:23
px;margin:0 5px;height:23px;overflow:hidden;display:inline;}.sethome{b
ackground-position:0 -32px;padding-left:20px;}.sethome a{ color:#0053A
5}#header{height:70px;margin-bottom:10px;padding-bottom:4px;*padding-b
ottom:0;}#logo{float:left;width:230px;height:60px;padding:4px 1px;}#to
pimg{float:left;width:400px;height:60px;padding:4px 2px 4px 27px;overf
low:hidden;}.topimg_s{float:right;width:100px;height:60px;padding:4px
0;overflow:hidden;}.top_login{float:left;overflow:hidden;width:195px;p
adding-top:4px;}p{float:left;}#search{padding-top:0;}.wrap02{height:21
px;border-bottom:1px solid #b2dd8c;}.wrap02 ul{position:absolute;margi
n-left:60px;}.wrap02 .ad3{width:360px;height:30px;line-height:16px

<<< skipped >>>

GET /stat.htm?id=555586&r=&lg=en-us&ntime=none&cnzz_eid=540886874-1409048682-&showp=1024x768&t=&h=1&rnd=1183407369 HTTP/1.1
Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/count/softcount/?fcssq
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hzs7.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine/1.4.1
Date: Tue, 26 Aug 2014 10:24:46 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Tue, 28 May 2013 02:57:17 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..


GET /js/s.js HTTP/1.1
Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/popup.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cbjs.baidu.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Tue, 26 Aug 2014 10:24:45 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 16 Apr 2014 10:22:18 GMT
Transfer-Encoding: chunked
Connection: close
Server: Apache
Expires: Tue, 26 Aug 2014 10:29:45 GMT
Cache-Control: max-age=300
Content-Encoding: gzip
3437..............yW......S..\j...M{zl./..6m...i..,M......B....{. m...
{..].A...~.a{.....bv5.......w..0.....i.n.N&...e.x.-..E.....t...iR...._
_D..YxQ.ic7......pz>..e...........g..|....6%.j%.\.}o.E.d....Y.~....
{x.........0.f.(...i..C>..r...I.g.X..(.2O.Iq.3..i..w..a....4.....`.
..A..{..p?..Q~....Q.}=.q$..I..D..4...'A....n9...<.#.4...0....<|.
.}..0.7.....".E.tk ..j.N~.._...i...|.....Q.q.h.2]].......ux.O....n...|
.-.U.(....~..........t...k....Q{.M.....Z~.OO..".|... a..h6.\5..A...z..
..7d.5....2.4w.0L...w.."k....$..?;H....@..W.......z.......Z.0...t.zb..
..v=1..3...~|..mm=k.|..O[[Y{v..Q..Yf.a.1:..Y..*W.d(.......A5..'. }lo..
....:cj?G..zY{Z...I.Y.........O}?..x.?.OTU....T.9.j"Ozt..c...=.....>
;...}Lq..l.]V..C .5.... ..Y}..X..g.....~o....?..O.4....;.0....e.....yk
....z.c..4..i`>..X...1[...Q........&..4.E2.g...Q;.E.EV..y9....$Z\M.
.c&.$.....aV....Wo...v....(.|p{.|....*....rW>...L .=.....(....y....
e...@O.qc....}.R3o}.=8x..k>..=..9...i6..w ..(N.......H... i...,.Wa.
.!1I.a.......;l....f....."'r.N.q.^.t.!.W...q{1..%..G......Y....7....a.
.A..-...._.@....3[.c....j.....K....2..ej_h..w."l..j.B..I........4.Z...
............,z..;.wv.e.(...:............XV..-]...'.f...H...b&..@~...1M
.O/.M..........A..b.'Ys.<...c.....jM.Y..o?...z....y.">.....0...C
x....yQ...,k..q9...v.M&.^m.7..|.3..C......!.......8........(&Y4m<.g
.G.y1...xq~.g..lx.i..#{..l..M..J....@4.);...H..r.V.Ijy'..,9;a....l.(Zd
@.=.0...D .:I.......vy.M...5..//......qe..>.p..hfV..ld|^f5......A.X
...W..`.v...bA..R.|4....F..' ..x..T.......6.0..L........)l.5.i#.c}

<<< skipped >>>

GET /ecom?di=98364&dcb=BAIDU_DUP_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=4&dai=1&dds=&drs=3&dvi=7o<u=http://adsvc1.unadnet.com.cn/ad/softad/popup.htm&liu=<r=&lcr=&ps=13x8&psr=1024x768&par=1024x740&pcs=0x0&pss=20x30&pis=-1x-1&cfv=6&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=250&tlm=1363765561&tcn=1409030684&tpr=1409030684121&dpt=none&coa=&baidu_id= HTTP/1.1
Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/popup.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cb.baidu.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Aug 2014 10:24:47 GMT
Content-Type: text/javascript;charset=UTF-8
Content-Length: 319
Connection: Keep-Alive
Set-Cookie: BAIDUID=CF9D5D703F06D48C7DAEF60012D78CA6:FG=1; expires=Wed, 26-Aug-45 10:24:47 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1
Set-Cookie: BAIDUID=; path=/; expires=Thu, 01-Jan-70 00:00:01 GMT
P3P: CP=" OTI DSP COR IVA OUR IND COM "
P3P: CP=" OTI DSP COR IVA OUR IND COM "
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Tue Aug 26 18:24:47 2014
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
BAIDU_DUP_define('request!98364_0',[],{deps:['clb/popup7o'],data:{"id"
: "98364","_stype" : 2,"_w" : 350,"_h" : 280,"_type" : "json_html","_
html" : "","_fxp" : false,"_sf" : false,"_st" : 0,"_top" : 0,"_left" :
0,"_hs" : 30,"_vs" : 30,"_bf" : true,"_isMlt" : false,"_fr" : false,"
_qid" : "2afc97c598928329","_v" : 1}});HTTP/1.1 200 OK..Server: nginx.
.Date: Tue, 26 Aug 2014 10:24:47 GMT..Content-Type: text/javascript;ch
arset=UTF-8..Content-Length: 319..Connection: Keep-Alive..Set-Cookie:
BAIDUID=CF9D5D703F06D48C7DAEF60012D78CA6:FG=1; expires=Wed, 26-Aug-45
10:24:47 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1..
Set-Cookie: BAIDUID=; path=/; expires=Thu, 01-Jan-70 00:00:01 GMT..P3P
: CP=" OTI DSP COR IVA OUR IND COM "..P3P: CP=" OTI DSP COR IVA OUR IN
D COM "..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Last-Modified: Tue Au
g 26 18:24:47 2014..Cache-Control: post-check=0, pre-check=0..Pragma:
no-cache..


GET /painter/clb/popup7o.js HTTP/1.1
Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/popup.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dup.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Tue, 26 Aug 2014 10:24:48 GMT
Content-Type: application/x-javascript
Last-Modified: Tue, 04 Mar 2014 07:44:40 GMT
Transfer-Encoding: chunked
Connection: close
Server: Apache
Expires: Tue, 26 Aug 2014 10:29:48 GMT
Cache-Control: max-age=300
Content-Encoding: gzip
dcc.............Ymo.6..._!..]) k......Fl'.qi.4...6.J..t..V........Ii..
..]..K..!9/.g.........J..\.W2[6.....['\&....=.u.[..Hm.&jQ....^..;..q#.
.v.[^Y.p..-.....,...;y}~.......D.......l...|U..)..J.^\.#..h6U...H...?.
....-B.%........OU........W<.n.......Q..o...Ez.fA..E^.$.....R-..U..
.:.W..M..Mu.&"......@..&^....].m).....t]........ ...`#V..gz*.~...!5.V.
.S6....M...eG...j.......|..X.h=X......=..d.....<.. vZC.].W...jY8.l.
...s...n...-..4u!.3=...sw..8m.F..*..$I.:x-,VlV.........0.*.?.z,*.\....
....e..._.....c...T...*.s..e.#......t.....\Y5..J......_.2."..k....<
.7}..$.$L/t.U.........c.q;....Vu\~..l......?...H$G..L....T.)=.a.......
.Z9...z...n.s....J..*......;`G.n- .'l.\.....>g...W.h0.....2-......~
..j]w......q.....K.&oN..Y!P...!.@qR..0Y.@.........t..D.e.....OE"...7P.
V.....#-0.....-.$...... 4.e7'....#..\........e..D.3.......l...z.,V...%
....Y..S.....i....)M.....w%..v,.'......].......!....p.\.......<....
v.`...S.....f..'ap.......1%|v.&.a.,..."k.A2.i..!.H..,.3.t.p}.M.g..5...
.cX...Ev....s....7.s.".....V<'......T..3&iLbl.......A.@$..t......?
.~.............A6.%.......<W.AC}.ng._.......Z...H0\.I../......9\1.y
..A..K%V..%.....1...D....S.>5H....0df=<....<x..8....Wr......Y
!.yx...89.~>U..;..^.....c....9DJ.0....;.xxw....^.g..2.d..b......Q..
.....Gdw ..U..^?.(.F-..}..SF8.>.R....'..F.J.....c&.zDd...>..r...
m....WC.~r..0.]......7.s.Q....sc .f.a..-.f...qtS{..........d..V....mY.
.!..d.k.}...E...s.\B.}.."...m.g.^...:5p.0....2.CY.&....C...&.L.4......
q...7..N......."...A.wS..f.9}.Ngf>.d.v.X...j$.M.......%..E.....

<<< skipped >>>

GET /app.gif?&cna=b06DDIJWbA4CAbhrJiYpVv3T HTTP/1.1
Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/count/softcount/?fcssq
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: pcookie.cnzz.com


HTTP/1.1 200 OK
Server: Tengine
Date: Tue, 26 Aug 2014 10:24:47 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=b06DDIJWbA4CAbhrJiYpVv3T; expires=Fri, 23-Aug-24 10:24:47 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..


GET /9.gif?abc=1&rnd=893227110 HTTP/1.1
Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/count/softcount/?fcssq
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Server: Tengine
Date: Tue, 26 Aug 2014 10:24:47 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=b06DDIJWbA4CAbhrJiYpVv3T; expires=Fri, 23-Aug-24 10:24:47 GMT; path=/; domain=.mmstat.com
Set-Cookie: sca=444c3801; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=357d0af64f81b3ca70382fc9_1409048687; expires=Fri, 23-Aug-24 10:24:47 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=b06DDIJWbA4CAbhrJiYpVv3T
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..


GET /u_12480.html HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/popup.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.afwfb.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:20 GMT
Content-Type: text/html
Content-Length: 54077
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Tue, 26 Aug 2014 09:37:29 GMT
Etag: /u_12480.html HTTP/1.0
Host_D33D_53FC5559: 
Expires: Wed, 27 Aug 2014 10:13:20 GMT
Cache-Control: max-age=86400
Accept-Ranges: bytes
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmln
s="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv="C
ontent-Type" content="text/html; charset=gbk" /><title>......
......</title><meta http-equiv="X-UA-Compatible" content="IE=
EmulateIE7" /><meta name=description content="..................
......................................................................
......................................................................
................................"><link href="hXXp://js.hao2266.
com/theme/newhao123/css/global.css" rel="stylesheet" type="text/css" i
d="links"/><link rel="shortcut icon" href="favicon_zzl.ico">&
lt;base target="_blank"/></head><body onload="lazytq()">
;<div class="auto_hidden" id="auto"></div><div id="top"
><div id="weather"><div id="detail">.................&l
t;/div><div id="choose" style="display:none;"><div id="prv
" class="w_select"><select id="province" onchange="getcity(this.
value)"></select></div><div id="ct" class="w_select
"><select id="city"></select></div><div id="zn
" class="w_select"><select id="zone"></select></div
><input type="button" value="...." onclick="addc();"> | <i
nput type="button" value="...." onclick="rweather()" /></div>
</div><ul id="set"><li class="sethome"><a sty

<<< skipped >>>

GET /ad/softad/images/1.JPG HTTP/1.1
Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive

GET /ad/softad/images/1.JPG HTTP/1.1
Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 1848
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:12 GMT
Accept-Ranges: bytes
ETag: "f8bc97783625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:30 GMT
......JFIF..............LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................0.0...........
...........?..8 ..d../#.*...j*..IE]...?.......3%..W..>....8.....KH.
.GRu<..z.....[.........N?>?..r{....3.?.zT.0..00G.7(....?.~.....d
....vg.x...a'.M.....e..*....#...8.'.S.0.&...U<.x%.....H.....]5%tz..
..=G._....K...<.erq.!.3.....^v&.4...../kW..=;T.,...=.....*....}z..c
..J..R.#..%.v.7.e.p..~s.o..].k.....;......l.R.P.....I...=....y...;.y..
..w.P..n.%..R.b..K.ux.,...G..5........2.I.G..D.....R.5.9|w....=...Vi.3
..Vq.#....rb.c.,.%.]D...`8H..Y....X...w...gqs.k..h......t...$..es...~.
x..k....K-.5........)......\.8.\]..xR/.k1.;.>$...}...xs...J...5[...
.VVqW;..Kj-.f..6......\.N.=..Z..x...!...Y..%&y2H.>.'.?...G..u93..:4
..Ik...W....j.....m.Dn....@.O.>...,..ZJ0.......gk%......0......g...
o.j...}....2...8....z...f..j....S.Hd.D.&h.B.]N..QY.........`.:...hZ"5O
.%..c.zz.==q..'..=..........8.b.Xh.yt.Kt.D.y...l.f`s....m'.S.t8gM....)
....j..S...........[....m..<H.Rp.:....jB.L[I...U........~....us

<<< skipped >>>

GET /ad/softad/images/down.gif HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 1242
Content-Type: image/gif
Last-Modified: Wed, 20 Mar 2013 06:45:51 GMT
Accept-Ranges: bytes
ETag: "d2cd98f3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:30 GMT
GIF89a6...............Z..J...........{.....k..c..............1........
..................{.....1..Z..9u.J..J..!..R..)i.1m...................k
..!..1u....B}.....................................k...................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!.......,....6.......{..H......*..`....#J.H."D...DP........
.H.d..=P.\...J.0...1..M..r..`.....|...t...3.(]J.B...h,U.......b.:....`
........a....6-..o............p.._.....JXp..4. ....c.2.KVlu2...-[...3.
...pX@.Ch..:.....j....^.z...2d.....o...H.q...........r..g..m......o.`.
...2.....5.x.3c...C... J..`.@...c.....z...7S...h.........`C....O.9.V..
..0`....B...`_...x....H.L6....:H.../.h..8.8..<....@.(..D.Y.L8$...L6
...P.9..TVi..Xf...V....`.)&.(=.QLh...@.<`..p....i..P@.;
....



GET /ad/softad/images/3.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 1426
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:28 GMT
Accept-Ranges: bytes
ETag: "6ed531823625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:30 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....=o......U.<N.i.!.>.6.....vp...G;.l..4.W.........
..c'J...].........Fn7<_.~......\..]L..J..3... m.q.tO].\..X._..{....
.%.Ji...........yg.x........D.\[..I.uVS.....=...F.I...M..V.d.!Y.z...~`
.!.R.*0F ..MT.O.....`.F.U..=Z..}SZ...[]#..|Y..[X.n...-.H..v.......@<
;.6... m$.........i.....~{-.D..]-...)v~.Y-|3.Kk).h..g@>Wu.# ....d..
..x.].JJ.G.t.........%9.h.Mm..ZZ.....>.J..|E.f...~.,1[...b..m.\n`2.
.(.....8.:.'..<.JS..........J.d.s....Wn..>.P...K.0:...5...S^....
.S...v... =}.F...,....Vt.H|...U.-..v.2.d(...l9b...:V............8.c...
f.k.>.-...E.^.].j\.....H....T../....(#.8 .m...? .%.)8.......M6.T...
.q..z..........7&........ze.p.B.E....pA.k...K..e.S.J.YI..9..=s..9.RX.{
..Do....R....&.a.#......G...jj...xz.i{l#.......G..k....#.h.YX...p....|
......x..".um....r.*..U.].......3.O$...#.b..$.. ..I%d...
....

<<< skipped >>>

GET /ad/softad/images/5.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 1524
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:46 GMT
Accept-Ranges: bytes
ETag: "2ade208d3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:30 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?.......4...h&._1.PQ.. <.H.};g..h.c..._....]]5'O......{L
B..._d....e.......m'.?l..hX..# ..............iy..[.;N..zk...[...i.R.&g
t;.x...i6...2..0...R..Ib0@..0y>...&.5=.l~y..5p-P..... ....O..u.>
.N.V.......9..1...dg.....J.c.RQV.....V.:.....Gw~.g.K..H..;..X..=..i...
..8.}....o.[..w...k?.'.?..`0..|.o{7......o......ko....F....N.z......H.
j..%....-.n.K4.q.....%.........k_k.........C^..;..X..B..Kd*...C.b.y...
....?^...|.....~I..!....;h..W.._}....vn....g.Y..t..i;.y;.....a..#.L...
l.....(.....w.}m....I98..G..W..>>.....g.e..^........-F2HY-fT8...
!]..8R.......'..jE{k..t......vIZ.t.h..Q.....Y......~[...u$RG$2..<r.
......`.....G@k.uiW.J-5...i.*...m..$<...K...J....../........N..K...
.R$].C(&9.l.G#<....\&.....a...$..........m...>"........im.....&l
t;r>..?|..c.....rx. ..T.3Q...v...Yk.....;IT.RI._...ij.....B..-H...=
.VJ...}..'....=q.>.CJ..,W....iw[...Q|....u.r}z..%...H..E.."(.\.

<<< skipped >>>

GET /ad/softad/images/7.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 1300
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:48 GMT
Accept-Ranges: bytes
ETag: "e67e868e3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:31 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....>..O.|.w..]OJ.a...5.......S...s....8...ne..p.J.j.8.
......[k.....A..c.T......\..iIez.-...<...(*0........mv.X...&4c>h
..mt....K..\.....|._...@.....K..q..Bd.I..n.W!`......Rx..H._5.9[.Q.....
.....|....O...c|J......O...i.m.3a.'...`....(9.k.&.._.Q...{o..z.w....g.
^...o..qu..zcnO:.~.*......z...#......>.<6>k.......;.J.G.|o...
N< ...o....7<...G...=~lt*k.8g t....W.....=.._t.kN..7~...u.4x_P..
........>I^{.......I..%..*.[...|^O.........Y{..............U.......
.!...f<w.p....:.h/....... F..xg...........<f9..r7.km<eI.?....
.r.>:*5.{;.............<.Ks<.. .4.].v,....ORMvF1.Tb..$.f.{..P
j.u.......N...PG...$...i...UW...6..k.^"..S...j.y.....#Q..v.?...Mc....R
Th.%......[.Rrwg..
....

<<< skipped >>>

GET /ad/softad/images/11.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 1244
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:13 GMT
Accept-Ranges: bytes
ETag: "26a05d793625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:31 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?..M......nm.......d..@E....T.s..H...O.&.y'..a...3<.3..b
R.6...........Q.R.EJ..ge%N.?mQ_.....~a.....y......x...0..h.......)S..#
....L=GJ.....O..*.ui.jJ..t.k........>..N..F..* .W..GL....q.F.......
....?..'....;_...dm^'Dt.f.Xdn.w....a.@54.(.....v...^)E{5.._~....a..v..
i..g....7.Wc...,}I&.F..... ...h.......k........?.&.9...|?......QyV.Z.I
.[.;.....>..t....X...m'M....t.:.m.mt.=.....I.I.OS@.Z...x..G...q=...
...3%..=..Z..........;.\....$W..V|.r.p....w..............--.-..h.x.vv
..a...y..Nv.......sY....zU._.}.f.HTF.1.,... ...../\.z..]n...WZ..Z.v...
......;'..6.d...b.A.w{...\.."...;Q....~m....)...DpH...i......{.I..nt>....



GET /ad/softad/images/9.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 1436
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:50 GMT
Accept-Ranges: bytes
ETag: "4cfe688f3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:31 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....:e.`I.d.U........fQ..\g.6..............R.0.}.T.O.....]
_{.l..y#....m2.v.-...I...oLv.Hz...m.......~...~ z.....}........c"..yR.
.A.Nzs..L.x4......M7...l.\..O......i.N...jA{..c...o\.......Fq..r3.....
.....]m...................jV...j.0T.#.Q..;.7.......l.e..........v..~i.
./^.8..q^.......[4.......H..dJ....G..C....U.Q._w...]......."........?.
.....m.x.G..n.[.U3....C.J..n@z.A...i}.........W..g.qT])R~O.h..?..i...x
.....u.t...Ec..=.HT.....^.$...g..P....t<.N....:.-j........=..^..<
;%..MF....%.K'...#.....R...#.R8.J...V...KI/....{..6.#..n]F.sY...^[E:O%
.1:O$.V..."2H~e.A.T>.....kN|.R.^O...G.m...........L..1.....V.0...h"
.........L.{k.P..&..@.J.C....S.f..G...^..S2..H..F.;;..;v.k.=.o.<3..
8..]S.m..A.LF.^;.........`......kx...mN^w.....A.?..Z...a.Ym...&&..T.#.
.{. .W..nHn0...<..v......5]OH.k.....V..b$S....s@...
....

<<< skipped >>>

GET /ad/softad/images/15.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 1811
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:16 GMT
Accept-Ranges: bytes
ETag: "acdbfe7a3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:31 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?...66Z=..e......c...O.\...lv"Q.j1z../.O...*......Tc*......
.n.~..i4....!E....-.....\...O<p:....k.2..]9$..ni].....oU..;~Y...P..
....)/..].w.....u.8...w..K[......?..<6y..%.u.w. 'n..'..?#..u...7 ..
...2...6W0.o.o%.ry`....?Z3L....{...n......f}.]..*.p..F...\.;........[h
.l......iE....c!K.g..~...Q....wm.......{.. ..12.F...4....v_..x....n|8.
=......y_.y...F....pH.NI...EF5.ZWrW....N........h.?.e4.iG..5Z...%.7...
=R.....k.>........Fy...w...R....m. .NH.0...2..c..tci...&...N..Vo.|.
g.......H.i.ZI=..R....S..|V.....[_[..|..U1......C.....N< .U.. P....
....zw....KYu.q.:~.R.Kg..u[Y.......5 I..t.V..^("R.pP..`GL.3.........4.
V.U.V.$.Zmyt.....0T1....Z...[mZw}V.Lu..x.KmgT........X.S'.....#... .\.
.*S.[....S1..a.AU..JV..._..Y.e^.;Q]?...Y%...N.w.....b..QW...9....:Y^.U
..u....M......hbeZX.kQ..e.........]'.#.M.B.!.$......Q...V.....I.^.....
.ZY .vR..j..-mkzTi.9.?.V.....o...'',..x.M.tvS..Y..`.6.lD........0.

<<< skipped >>>

GET /ad/softad/images/13.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 1354
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:14 GMT
Accept-Ranges: bytes
ETag: "a0be1e7a3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:32 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....4.?..gY..^4.r.I.*..n..\.....=...<.Q....-.Vj.....]..
;....c!..r.I.{.<...N..KVv:#%8.-..".z~..j...m......v.4.. g..2G.YU.J.
y..Ey.~cI..A.N.y..&...5.&p.Ff..cVv..r.#.W9.M..&....s....r{$.g..P.U..N7
..^.en...m......R.u{.t....#....J@l......r29.On6...Z.I?..}S..OE.`.....}
...["...6..*'..-.......>.Yj>.....W.\b.4..Yl].l...&.....8$...??..
R.bd.){...._w#z.}.....M8..O.k...'............oo.9..1....FKp3...W...8zR
U(....m7d..%e..Wv.....b.<5H......O......>.....H..5.]. .%.v(.....
p{.rs_k...T......}.......qp..%.....G.....\L.b5).....s.I.....~p.'Y.x{..
m.........D.m...A.........>S.....eJ..a.o...........5".............j
*.o.[.E.....F...PUX..........e8:.zV...o..y.??7..U$...5...q{3Y.w..1.or.
...m....`.......iZ....^.-.....L........<g....?..
....

<<< skipped >>>

GET /ad/softad/images/2.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 1529
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:19 GMT
Accept-Ranges: bytes
ETag: "2ed6207d3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:32 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?...7M.R...yi.R.;*zg`'.. j..i.'.]/....T...Ti.v..w./..;;..i.
j..:>.%.`.-..G.j.0..U.T.I9...Mi.....Z.w.....[y.....q.....*....s$...
.t..5kR...l.t.5....." k.8........l.9.u..iS....-l.....Ow.....Y8,f.i...I
...Y[..O..U.9..RR.;H..r@#5.E..:kF0.....W...6t].R...k=...5....W.A.8...#
.z.\.4.0t]<.pSn..]...k...*I..l..F...Y....m.........|.c..K.]:n*...gu
nmm.ws..a1.........m.k_.O.5..&..".J..7q...f.."H....c.z.Z.l.YT......R~.
}.G.........0i .;F...........! ...8l..Z..s.j.....w....|......0....<
5se......K...D..1......_1..p.b#RS........eyN#.E.......]..I..5..xKI.d..
.cm.;.........yx...N9.ZQ.G1....jsr..VM._{..tb3.<.a.=.U....n..f... .
.GD.Zri......K.Wx..j............5:.n...zr.........KN]......#A.zj. ...F
.....*....`.v....... ....u.~.#....j..1......#h<.#..jP.Q.H..../..N..
.....F....My...'.....q,>Dc.........j....l.-ciF......f...{..y^......
..Z..[]..1.....a..d.q..z.G...18._.J....o......z........Yu.F].?.G..

<<< skipped >>>

GET /ad/softad/images/4.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 1054
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:35 GMT
Accept-Ranges: bytes
ETag: "12f09b863625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:32 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?......(....:.O...F...9"..".... .e.s....;.$`.^..-.jj......k
.D9..oM{.j...k.<......Q.b..Vq.... ..(NH..7p@..G...;....RwG.....I.,.
=..t..>Y......5.........k..w.........M.:.uO........[....U.........@
.....nd..cY"P.I.2.}.6TR.1.^..0.*~....?.......Y..wGa...<2.......S..a
.J..K.x.....O..*..;......F.........cm...u...x.S..t...d..v........N....
.^qf<r<R,..#........@...9.R..;...l.m....:............K.z....)...
...,..#.rA.......s4...
....



GET /ad/softad/images/6.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 2706
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:48 GMT
Accept-Ranges: bytes
ETag: "d620278e3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:32 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................0.0...........
...........?..k .F.;KH...p.8.$...d.x..h.i ....)ia....]...r...#....%..
..".*b]..[~7v.....D.<.N?.J.~...v....tt.T......m....V..K1.v....FG..2
..N.........M.J..M...^V]z...].%$....=...Qo-..Z.$.2..M..!.<...d..NqW
Rk~.]...z..i.$.O...{z.v..V.n.OS..|-iz.Ke[ .u...#'.*.#.~..n6...K.w./._.
~.[....C.uj.=<........k.....M........2...G.......].......~....h1..n
.....pUJ..B.rA..9.<UU.u.....V..Vn.? .....N.....Vn.....'N.V.7.#4....
.@....{...}..)._....|.............pt%Ys..i.....6.j...t..n.....DB.3O...
.e.. ...I ...]X.T..Ih..m...u.I7...[.F0.U.%.M..T...d..M.b..XY,...4J..#.
...A............7{...........j)qO..n.[]....z..uzv.W.vh.............b0.
......g.tsQj.[_....M.]=...p.`..T>........E..H....6._EG...J.c)p#.f..
9*Y......WO./.i.... ..=.S.H...}....X.._...T.6.P. E......z......vZ.{...
.z.ex..~[.>z...wIZ._....}_..>.......!....@.89........t.....R....
5n.....D......Ro...g}^..m.H..=..k....r....P.|.........8..a.i.]..i.

<<< skipped >>>

GET /ad/softad/images/8.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 1350
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:49 GMT
Accept-Ranges: bytes
ETag: "6c8df68e3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:34 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....6.]:.$.k.......Vq.......z..9..........Kk.m$.g.'.Z.N.j.
.i......a.....]G..\A.....(`....x....R.T.:i.V....4.U.H.K.....0...,Y....
.K..Gp.r..<..I..~.e.owrg...7;..[h....8...c..\....;...Eyx...g....4..
.};k..T.S.i_.....Ml....w......F....\<....4....v`..H#.`........4K...
....2...i..G...^......$./.X.e.R. .I;..B..2.....@.Z.U... .RK-1n[s.C..d.
.F'...e=.....iK.........gO..in. F.a.!.....~^9.....^Enh.KG..y...m...Y.b
ag ..Y.4.}[...V[7...X6.J-....$.l........0.pG....h.9NNQVv..O....Q.#6..{
.......[.$...E.6...g.............s...a^...oo{ql4..G-......n..}....u.9.
}.....mO.3...y!....e.<. ......Uv.A.v.'..q.W..g.[]z.}.u....,.&.)h...
.G..\{Y..8m>....G. ..[v2w(...;..E5..'.[ .V.z..Z......f.....v.. ....
..f..W.[=...n....|...X.[...a....?..
....

<<< skipped >>>

GET /ad/softad/images/10.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1363
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:12 GMT
Accept-Ranges: bytes
ETag: "627df9783625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:34 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................0.0...........
...........?.....P.y....z..w..5.....~..........: ....=...."..I.b..@...
f....q ..{.|.D.8.....s....,!k.&k.u...:..Q.?*.......O.;.U...6.{.....#..
$=.....;.@....j..v"i......9.r:.....y~....../...V..(..H.7....... ../...
.@$......'..;....k....&..H..........].R[.t.ku...#w...=.....?...!w...!.
%...uV.8.v.|u..ln......g....~-....K.K..k....v.x...c.7..P.#..4.....Q...
....d.X...;.)l..m.;B.... ~..P.A./NY<.<.|..#..v..Z._.j._.Y n`....
.'..@.Z....9:.....$z...y....M.KY..Ih..<......~ ..4../mm.......:.h..
...^7..%..e4.rd]..E].......o.l..F......t......-.x...B4......\..O......
.....5!.J2.F.T.P.c.Z.. o81.xp..{..E..7.c....{.#.^...~.ko.....P.4.7V...
.yo.o.7......-.X.....~.~.....y..J...?...j.....u.d..{.....t..:E.g.h..dC
.3@...i6..3...D?..9.s....-k..5.p...q....r....
....

<<< skipped >>>

GET /ad/softad/images/12.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1569
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:14 GMT
Accept-Ranges: bytes
ETag: "eac2c1793625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:34 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?...7...........qoe @.p....e..Y..?:u....f.b1.....G{F.7..w..
_&e........i.*..-.....V.c.3m...]..b..nTc...H...p.2....Z....Z'.....Z/C.
....V.}..G5...k2O... ..].Ab...8.5.; .^.5&...].'...Zt...-l.....>..9.
F...J...F.5........>...n.....la..o....u..,....9.G>..s.3,f.2..*:n
P..]....Z.]U...M.m..... .z}...^Z.ku.ZOo..(..Yc.`..`q....3Lv...Q.8._.Ri
......S..-Y....\[....RA..P]..d.,T.....y....Kc1..t.. i......N.;'....f..
J..E..F.l..~...x.......me...4.m..1...1.88R.28.y........O7.._..K...]y..
.....[m......=.....,.........X.7...I....q.{W....K..#7..b..j..^...^_...
.............4......#..w..w.|%.Y^A.wk.Y..DKZ_.,.l....IS..N@.u........S
m....J..{-...,V6.xy....I.ml... ......h..C6.sx<......|.8.l......w$..
..K..Dy.;<Lk....mw%...[..n.....].i...;3..A.E... ..7........q.\..:u'
nIr.......?@...IR..i.-..h..3......?..[~g. ^G.4m..v.......<G...1_..{
x...P.`p...[.V#$};.!G.S.<$...]w.......)>....^.S.....\xkS.x..

<<< skipped >>>

GET /ad/softad/images/14.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1824
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:15 GMT
Accept-Ranges: bytes
ETag: "34f4957a3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:34 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?.......|..)..]..w.[...h..8.x..c'..I..w..%..'d...%......SE.
B[.<.ma...i.ig.....*..>n.x5..~.....W.K6...n.Z..g.<-8.Q.m..K_.
...z.. .l. . }.G..ne.[.x&.p.Y^(..b...$.95......9TJ*/}.....m.Q.....r..u
.)b".[5}.k...E.....G..*........5...7..`.:(... .. ..\.j..4....l..3....H
.A...^F....j....... ....lq.f.h"w...6.c..e...C..q.>...J..[.K....{og.
u0...)Z.....w...6..7......F.."..$l.B. .".....:...<\..r...kU.JK..f..
].}..[..u ..>......4J..F....~.n'.m>H.....s..l.N..2>\......v..
.W/.Ma..; ....~]w.n7.|....{...M....t_...n.]w.......|mgyw,SE~..2.l..l.c
......y*..\H.|V......kt....kM.....T.......<y#.v.e....V]..<D.....
.O......{.snc...o.RE..g...s.`.k..!.e....IYY..J...}o....!:....z~...Z..
...R.:..e...h.x..5..6mev......A.....%.0nXNZxi.R.]#..~.[..-JP.c....!.Gt
.......................V..V.E...*.P|.a. s.2r..N........s-o..^....j....
....$aJq.....WW.;[MtQM.5z..=...m2...ZH...). .....0..D.F@...Db=.x..

<<< skipped >>>

GET /ad/softad/images/16.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1455
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:16 GMT
Accept-Ranges: bytes
ETag: "ca60657b3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:35 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?.....3.|/....3.]...h....{...%..O%.{.=.ug........b....*w...
.{|.;.F.K....>.i6.. 4e...;q.T!*~a....bgN........2\>3..Wv.....m..
ao/...;.._.t.m..sZ.q....._..x.W*."........[..7N..y&.....h..E.m...K...C
*[9Y#..FS....>......1k.....k.t...._.................M'.*2.....<.
.Z..>'Z.gO.x....$.....y...H.Ld............V..QJ..j............c.4..
'.T....wi ...{...|[....x....._.Z.....\5.R$...YS.....;...f.\...N...iZ..
.....6...U*).2.....E...c._.....$....5..F.....d.....S....ta.;........e
3.4.....h..wq.O&.g.y-...lHrA8.H9......I.d.t..!5)..v._.....v...W.'O.8..
Q_..<......d....<..]9>W,F6........._oV{...8...tR...ztV[hI.cFH
<7{..._....w.Lq....H;.A...8...,Z.b.b......>r.m.w.....Mm..Ql....=
?.Q....b.....v^....Z.I.....t.1........nq..@25.....".K.[T.....V7n.\...w
b.......,y(..nK.^.n.w..A.k.7Q..vC.ct....0.GP)b1..TTkM.........w.o.!.Z.
.6..%..".2...q....
....

<<< skipped >>>

GET /ad/softad/images/17.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1363
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:17 GMT
Accept-Ranges: bytes
ETag: "506fd57b3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:35 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?.....r..Z.iV.7R#2/..d.H....Z..f.3._39.. ......Kj.%...J.#.
4 .......8x.....f~......s.{]..7.....}...R........Y.T.''.i...[.X...z...
M..H.6.J..du.dS.....A..V....4M5tw.....V...M......)N^K..JD......b.....u
....Gh.....ex..=...MLD>..'w............'T....]k...)e.G....[.._%..(.
.*XT....w.....*\.....<.jv.A..L...|.1_i_....K..S......Y.|K.oH.....y.
......e...D. .......).......U...H.........=..q..re8J8......iI7.."....)
].....5.......m............./,.<.2..........w............t<#....
q/...gw..S.j.....@W.:...W.T..&...$.....u.....Sk.!h.`.tvRO...z......8.3
.^..]-}.}}.\..Cu.......DWP.F..dpm#.5. l......=.N2P.......~T.......yM.v
.......M.>}B.).'..x$ .....21..... .n]..ye..R....^wOb...............
..[k...k.rc...8.F...rK..z..Wl..#.6.U..w.b).I. k.c..
....

<<< skipped >>>

GET /ad/softad/images/19.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1255
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:19 GMT
Accept-Ranges: bytes
ETag: "6ab3bc7c3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:35 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....-..5..*.#$n...H. .d..Y..$y.....U........W.]J..[.&.HQ.=
I...b...8.H.2...W.T.K[......:..M-.C.......Z.w.)8.@...;......9..:./.O..
..~#...^6.m2?9v;..,.eI.T`..7q..)..qeB...N:5.N...> ....K.8n.........
b.4.rK....c...4.N4...C.VU..KvsZ..y...:N........l.z.?B?.....c.h|.....l.
.K.[..~}...z..A....=F....xn...\m.Lye.T.%..`.m..rCeW#.(.G..m...R.iK..-.
.........u.2..Y...?....7O..A#.......H.../ ...r...gAC./yiw.y.....ad..#.
5.OQ.u..OU,on\....z`...?....WG.V.....\..J...S$...=N.8...%w`=rO..iw.}o.
..7.B]..=.[<G#4{GL...a.N|\G.aeMF...K..Vw..]..7.#[..._..1.x..]...]U.
.vUVp8.>U;q.w.Vj..e4p..._......$:....._......}.V.@...,:.y.......=..
.v.wg..
....



GET /ad/softad/images/21.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1417
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:21 GMT
Accept-Ranges: bytes
ETag: "ccf11f7e3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:35 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?..Kx|..n..,N3..'.....U...}.NK.Y...o.e...C..<.$...>.
...=3.Ol.5*N....J..u(..-..^.Uk.M..f.#T....v.$.}:..U K.=..~.Ek.m-.v.8..
.u...x.Vx.>..%....i5...}z..tY...x..H.L.......$.G.Q\si....U,K.UJ..t.
....h..O..e.Y.8.k.f.9FmVS..BH...l?{i.,..T.5.s........F41Qq.,..Im~.....
..P...i..^[G}..u.o%.?#. 8...i.r..8\.w.........{;..K....^.C..........].
...S&kv.J.G*..2~_....8.J..%...5f.t.K}.. ...........?Qc.$....... .oa.A.
.zs...t*T..Ky;[.....(8...._..k...u."..&......c $.r...H....R.9.{.ZUe_..
JKUuu{_.w.t.[$..z.:...k....m......o{;..Z.<./O.....r..e...9....q.i:.
.'N...o...j.K..}^...N.k.VJ .nVO.....Y.....E.i ....Q..sz.....=y..c.....
..T.Q......u..v F..'.... ..V4jsKf.....W.^...].J.V`......5U B1t.&......
....vVI=.$sF.......e?2.....d....x.._.s..h8.u.il....^]5......4....U.z..
..Jp.....N*.kT...%...........?..
....

<<< skipped >>>

GET /ad/softad/images/18.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1244
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:18 GMT
Accept-Ranges: bytes
ETag: "22b9407c3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:36 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?..M......nm.......d..@E....T.s..H...O.&.y'..a...3<.3..b
R.6...........Q.R.EJ..ge%N.?mQ_.....~a.....y......x...0..h.......)S..#
....L=GJ.....O..*.ui.jJ..t.k........>..N..F..* .W..GL....q.F.......
....?..'....;_...dm^'Dt.f.Xdn.w....a.@54.(.....v...^)E{5.._~....a..v..
i..g....7.Wc...,}I&.F..... ...h.......k........?.&.9...|?......QyV.Z.I
.[.;.....>..t....X...m'M....t.:.m.mt.=.....I.I.OS@.Z...x..G...q=...
...3%..=..Z..........;.\....$W..V|.r.p....w..............--.-..h.x.vv
..a...y..Nv.......sY....zU._.}.f.HTF.1.,... ...../\.z..]n...WZ..Z.v...
......;'..6.d...b.A.w{...\.."...;Q....~m....)...DpH...i......{.I..nt>....



GET /ad/softad/images/20.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1435
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:20 GMT
Accept-Ranges: bytes
ETag: "b4e4907d3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:36 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....=.....x7K..PU.&..ewH...."..(.&..)......x.\^*.&.U?.&.oM
U.......t.%....l......w............3"I.:4.n;K...(..:..e<\c(/d....[_
k-.=m...(..........9|3.....ZLsjM.....m..I..6. H.c.......q8|U\]7..SZ...
l...M..i.........m.[H.{.8.'.l.o.T.'sG..).n..NX..c.9.cZ......[Z..;4..^.
9s4.........[ 9t....g>....x.,.r.9A..y.......C...lE:.'h.v...v..F....
Y!..h./.K..tm2.M.c.RH.7...n..B.....H...,...W.....X..U...I...m....X.n.
MC...........G..c...=.m......X.,.Fv.X..".....M.7...w...Yk....(.....~;.
.. .&..z.[.. E>.S$M.4e... .6......|E.......h....~.$.Dt..h..G.`.".N.
...FE .... ..eb@T....T.].M......R.._o%.k...T..<..........e.I..S...=
.k.q....X..e.v.i1......s..s..l..u..wz..{3........fz%..;&.n.a...T.$I..$
.;.F.a.:4..<..c......p.....U?t.i=uvn.Kk{/..4....Q.x.K..%.....W....[
`....J....n([nT....a..1q......G}m}...............f...
....

<<< skipped >>>

GET /ad/softad/images/22.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1353
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:22 GMT
Accept-Ranges: bytes
ETag: "ac62927e3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:36 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....>..%.X.....I..E....(x.r..Nq..x.>...].m~DJQW.._..
.|$......k;.,t...b.X$L.e6..q.$.......U.WH...xn...QZMs..O..)#.f2HRA....
?Z......*.......K.I-...........x.u...c~..J...uZ|........5i-.....\7.f..
*.....pH;I]...O...............N.=.; ...=-...j.....o.A6.u... k.{[}.....
...A;.j..<................n........<.].o.G....2....8X.......\..k
c..a...`7....!..l..u#.^.=...1S..Y.V....\]....:u.....Q.J.....p..Do...E`
..B.....7.Y..C.u}.i.....i.7.....,.....e.n...).K#...9.Q.Ps..... ...|..e
............n.v_...5...]... (..1...;....#.F gq..a..O...)..............
o....mn...Mm G ..].....J..*S.X..].f...^...(&..d..L..q...8.6..a%(......
.....L...\..]6.I.I.Y-..F.UN3..)......R..}......uq.sk~......s..6:m....v
.Q.s.r.R.G.......9...G.C.. M.[....i...
....

<<< skipped >>>

GET /ad/softad/images/23.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1516
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:23 GMT
Accept-Ranges: bytes
ETag: "a821137f3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:36 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?..n<9~.~....7a4F.._.y(.....G,Dmf.]..O.>o.m.....d..&l
t;\fo...)9..?..k....k.......ck/.....kw...7.^.@.p.............>.....
{.....n..vV....)....S.Qs ..]4.......C........I..4gM.X...)...p.......C.
%.gwd.v...G.].Z..=O5...|..O.u......I.x.=......i.F...%d.O.......z...VTi
{.8...w^....2.^>.lL...%..I....GQ............D%ta?......?.2.....Qv.O
....?o....W.)....W...u.....c....b.B..7.z$.=.[_.=<..Xb#N..&..]......
...O.....>.p.m.;..7p...8 .....G..8..#..IE.[5{.......h.|.......U....
.]..f......v.WE...gB...]...J..'.W....!....O......xF}.......d6.&3*...P&
gt;.........n.Mz7xy.....k...^....j}....l..d..(J..Jn[...t.kv...Q..oV...
y.........1..03. ....t g...>.3..m-m..Z...... . e........zMko$...QMi
.e.q....V...o..l....F........."...Z.)(..~?....N:.ZT.........}4,...w...
.[~g. ..R.c........q.5..]NXu./[..UDO.p..I... ..?\....x.N..ic.~....*...
M..|..n..Y.}4....=9.....yom..\$i2.......=...of...>.9...1...qm6.

<<< skipped >>>

GET /ad/softad/images/25.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1806
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:24 GMT
Accept-Ranges: bytes
ETag: "2aef3803625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:37 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?..].C.Y...@.....{....K..i|?...6.,......."...S.};..V.{ll&.T
H.9J....!Y. .z.2W.y..0X....UF.j...J.I...../W....*:/..9|[^;...u.>...
5n- ...L.....C......YO.......5..p8.5J.x.G..]./{Iu.ggk......:xI.......|
....O.|5y..C.....d.8.Y..#....'.......w.......=.....<u>hh........
:.!.t?..Om.B.w."...Q.NI`ydl(]... n..r..U%[..$b....m;..'.W...7.s,t.s...
e}Z...k...?C...........m..V..g..rDE..n.B......@V~.0..d...!...*j.*.|...
M ...Km[.....:..).-5$...[o....h.}.%.x.....uM?J.;A*jS...HX.0..W'....Rj.
R...t.x\<.I.x.K.j.O..Vn..Z...7....9OV.N.....Wot.s..._]j.E......YA9.
)4n.H).....0......{up....C...:..~zZ.~V<.x<..,gE%;...m.O.<.w..
.P>..".M.I..~I.C......H......|^......'.U5u.X....l.....(....T..ow.ig
.........So..Sj....dZ.\.b.>D......NX.yl(.N.5._.7..C.....8'}[....].Z
...>..,'...4.......v...m.M..e..|3{u.j....H.'V.........l6..73.l.Mu.
e.......&...~.Kow..e..oS..V'.Q..]....oG...CD..Xe..-.s,..3...HO...x

<<< skipped >>>

GET /ad/softad/images/27.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1617
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:25 GMT
Accept-Ranges: bytes
ETag: "c97ce803625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:37 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....xe.K.y-0..!.V.n#.Gs..w...?.<&..(...vv........yy.`..
...........u....-m.D......N...S.......$c......N.O.f.|..E4..uK.M.{8.&..
..as..rx..id...Z....s..w..."[{Kt.g...w.;v......t.5.\5.|CJ.#.ME %..R...
.mZ..~... i...x...*.zi.}on.[~...._.........w 5.............a..s......R
^i......~._.G..'.H..U..}..x.R.F.!y.....g..7.w.........|..7.!K.......Z=
4..v[.....9..X.-Gx..........=DZ.k .$..>c....8`r3...9..T...X.U/y..%~
k.]^.q..f.i..8<.X.\......o..8O....k?m..2..R.O1.0T.. ..\....S.S....Z
...... ..'.r.........m.P.....w..]......N..<!..f..m.x...\k....N.H..~
~[.k......-BN......?(.........z.|m.U.I.......w.......B;.~U.y."8..6. ?.
....3...&u........F.[N..d.....1..$.......}G.,..'...[......KY.%.W.7....
..o.M.J.l.K..t.|8.1.!.eG........F;.5..|K.Frup.....iy...j.}5...}4.4..ko
...p7.m"k.w..?2....AF.}....lV...{y ....n.....V..n......2....F-..@..z..
..7..T...u..?.g..F.55.h%..2$.......X.Dn.%.....\.t......._..f...J..

<<< skipped >>>

GET /ad/softad/images/29.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1447
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:27 GMT
Accept-Ranges: bytes
ETag: "be51ac813625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:37 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?.._.. .'..h.]-mZ.....m .......5\U.2.. ?.....{E..[....xq...
^C.e.....eI.Jp2A..@..p.'......Y.mY7..D.o......(..e:.*T.k_..{..........
.xKW..xct...DP.........q.......Z....$..^~.{j.....j..2..u~^~.{j.... .&g
t;..[.-........~...?..........j.O0......._mm{K....T..o..?[/...u....:.-
.. ;..'.9$d..g..@T........~^N...?.n!......~.....(....t.7B.U..._&....f.
.....x...h.U......w|.n.y.W.-.[.^muw...9VwZ.;......6.m.u.w../........./
.^B...............7..~7..#...h.5.t.-b..w..'u...n.rp8.......p.E.e.e~.w.
.{...D,V.>M...![.J..nH..!R...n^.$q[J..l..............N.Z...>.mn.
...w....x..26..1..4...K(...YYIG=I..S.*w.a.U.i.%..mk......._uV....%....
t^...s.....'..J.d7q.C/.n.W;...c..y=.....aM.J.kk..t...O7.q..t~..$.d..&l
t;.!..I".TV?4n........^r.........{..vk..=.L^....$.O.}.}.x.M...".......
f...8......\}.}.{.U.....%.......[t....i....<J...Z..t...u......t>....

<<< skipped >>>

GET /ad/softad/images/31.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1266
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:29 GMT
Accept-Ranges: bytes
ETag: "507dfc823625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:37 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?../.....I...}N6..m:{.Er..@..9.'<.........:o.V..Q.......
:.`.,......|......H..oZ./.=....P470..z..=E.g..y..QM.X...`.Ki....Y..m..
..W...........E...V.o..iw...<T5.u..lR..C..l....;..|.z.5........?.Lo
.G.....kvW.....<qf[S.m..m.Y%. $..C..9.;[#r.W,T`...?......I..H......
..j.....#...t..Y.....U9Rq.{~>....V5c.....*.*.*.....7|)...f.....s6w.
L...3..x.....k.Ui)^......iJ.'2n.......[...=<1....q......9..da.... .
.?........[....M.......O.?I..5...3.y..M.;..Hv..'...1..v...EiK....yx<
;.....R....Z-4.*.-....~K..V..k.Z.M$7.I. . .Wh.....<mB...[.vi..1...y
l........s.:./.I....;}j..n.e...6rs.C..2:..4.c..)....]]..@..C...m....P.
Y1.9".9.....77{6y...s.d...4...
....

<<< skipped >>>

GET /ad/softad/images/33.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1516
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:31 GMT
Accept-Ranges: bytes
ETag: "9aaed0833625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:38 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?..n<9~.~....7a4F.._.y(.....G,Dmf.]..O.>o.m.....d..&l
t;\fo...)9..?..k....k.......ck/.....kw...7.^.@.p.............>.....
{.....n..vV....)....S.Qs ..]4.......C........I..4gM.X...)...p.......C.
%.gwd.v...G.].Z..=O5...|..O.u......I.x.=......i.F...%d.O.......z...VTi
{.8...w^....2.^>.lL...%..I....GQ............D%ta?......?.2.....Qv.O
....?o....W.)....W...u.....c....b.B..7.z$.=.[_.=<..Xb#N..&..]......
...O.....>.p.m.;..7p...8 .....G..8..#..IE.[5{.......h.|.......U....
.]..f......v.WE...gB...]...J..'.W....!....O......xF}.......d6.&3*...P&
gt;.........n.Mz7xy.....k...^....j}....l..d..(J..Jn[...t.kv...Q..oV...
y.........1..03. ....t g...>.3..m-m..Z...... . e........zMko$...QMi
.e.q....V...o..l....F........."...Z.)(..~?....N:.ZT.........}4,...w...
.[~g. ..R.c........q.5..]NXu./[..UDO.p..I... ..?\....x.N..ic.~....*...
M..|..n..Y.}4....=9.....yom..\$i2.......=...of...>.9...1...qm6.

<<< skipped >>>

GET /ad/softad/images/37.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1357
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:34 GMT
Accept-Ranges: bytes
ETag: "1a729a853625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:38 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?.......8umz..&%ml...n..@;......y.n.tp....o........f..v...A
.m!t.....E5..uve.....}......4.W.`Z......VI.....ob.=gC.-.*...iv_....T^.
..s"..B..a.f.l.....vNzn.....E..q.\.b(5(.I..2Mn..ZuI.............H...h6
....u`...v.:....{...*..j."W....u]=6.t....6......T...G..._...^..A^..n..
...f|.:..kv..1.u.....b.....a..<.... .....i`.J.....F.......O..... .T
Q.KG.Z.v...Vkg.....:.......N.W..$.\..9F:....*jm]%...Y...l.[$..cp8.%nZ.
q....K.b..........)..G...O...^..S_!...._....<.9...;_...T>1......
fY%..4a.l..F>.^O...{.I.F ......7Q..4.....k.X.....n.<E%...X.#....
0SiE..3.A..8XM..&....7......!S......... ..z....8..O......ic....U.2....
08...c.l.8...._0.e.._...m.....K..n..^..8I..N....[.mZ^oKw...n....=.l. .
.w...?.z..],\iU.\.)...Zo.T.....O)s%...c>.....
....

<<< skipped >>>

GET /ad/softad/images/41.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1328
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:39 GMT
Accept-Ranges: bytes
ETag: "2e98c893625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:38 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....$0J.$.'..2,.N.`. .P.s...<.r.....0. ... {x.i.`....gb
p...I.T...e..:...\Y...$.4lW$g.t..T...Ln.:4ox#.......t. .'..(.H...0.v.c
...r..*s........F..a...N.....3....0....99..1'9$......_...O......[tK...
...Z.e..!....&.......W...9....i...].u....w.rG_.jJI....ny..I6..........
o.5..WI<..=.JZ.\.V.8..x( z....T..u...-O7.7..MX]YA ..M.s.>t;._ny)
..ppH.......^e-.&N...j..j.V.r$...n!...........M.....85.bpxzU..8%'.....
.=|..D.)mk.^_....o._..e6.t..........IR...c=..#<2m..[..3..9#8.?e;...
.H...=.K....\5...-.Q,..~.........=..-...[.E...x../....m6.......B.m.*..
TnY8 >20. .&.NJ|............cO......j....O.N..3`.[xO...H.v.......j.
9..O.....:i$...O..0..z... ;8.N.h-....&....U.L.nH...<...2.Y..m..s$.M
. ....3..'.'......
....

<<< skipped >>>

GET /ad/softad/images/45.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1339
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:43 GMT
Accept-Ranges: bytes
ETag: "beb9358b3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:38 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....=.... It...Mn..n.6.......1..A..w.........j.>.....k.
_.w.m...M5vg|@.7g.X...&......gs.B..v8..m.0..k...LD.C...eu.Z..}..U.9Ce.
.u.G..x.....!...W..B......r...A.{.......ew..v=..wS[.3B..'. %...v...Z..
.^p.U..<......K.5...)Ft.~......hZ...g..(...........5._...|.........
}...0.....G.....hs..`(.;$S.~{..y...#5-.....G.Zw.})..d.... ....0.t.YG..
.....~.e*Qq}....hq.S.........?.....g.?..f.....6...!PH...?;...<M7:..
....|....5j...z3.7.kY.mf..h......*.....<...p.,O.....A.....K..o..g9E
K...m_..........7W.w..*.*...;..0..w....0.K..Fmx_...]..~.i....4....@8..
..Gn.s_AC...f....=.q..._...Z.6..;M.I.L.>........?O..&...c.pn.In.W..
......H..eI.{C...nb..ul.....v.Os....{Uo?......_.........(".b.H....*z..
..q....*k.......h....../...
....

<<< skipped >>>

GET /ad/softad/images/49.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1393
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:45 GMT
Accept-Ranges: bytes
ETag: "12d1918c3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:39 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?.....6m~o.^.-...d.....1.m*...I.......?.4..}*.Gn....oc....N
rT..1%......d)....D..A.......6. 0P..,.H.=...j..G......MK.%7..vv...,4M.
.s|'..].a .).|. 7Ea.....KW...T.V^.6..o....?.S....jmU~.........r..vR..O
...e......G..<........a....S'.y.E....Kr........24...F.S.U....9.Ns.`
....~b..q.......T........V..|....^.......f..i...a.&..B.v[.q......U...W
...g.......=Y...`.t.{._.n......j0..:e....<..[.b..I......1.c.,..O..Q
V.DxX...V.;..........)..E.Ct%NF}.......Z.z6.....Ip#X..v".E....g.......
?/...h:.Q^.Y]..[|.t..,.......: o.~>f..|u...I...M.......JG.p..N...[.
...iW.c.......8............#......d@..F.<..dv.S.z`t......T.F..VH..9
T....6~.I.._.j..4.v.>...[q'....]..'.<|.Mpf...Q.....}......u...^.
mmk...-...ot...9...d...>.... ....).^.-...k.....j.....=t]......]_H..
f....>...^..W....
....

<<< skipped >>>

GET /ad/softad/images/26.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1233
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:25 GMT
Accept-Ranges: bytes
ETag: "a2d66c803625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:39 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?......p H................S.@Z......$ :.]..1..`..........Q.
.....d..}.o......}............-.M.u.....BK.N..3...1...*..hJ.........uq
...;=....~k~...494-*.VO.).@.m.i8......r...* .#E...9].{~?..M}\.-.....t.
..7..|.f.2..m.k8#.......b..M....A..c>.'.Y.5.....a.4K'.&.FJ..W..@(..
.7...C..I..8E..C.<Q...Z...]...y......$c.-...)c.C...P.5)%.u..v..okr.
......Q..V^..^./'k$.t...k.V..n.x.LQ..D..[.........<..B.. .7.o......
...B.e*... ......... =)...u`..b"i.v7..S....a....sr{.....o.....7..V..&l
t;.....].\ r1.....$.Q.. .......5(Q....Pzu._a.UFR.........S.Nn..~.T.m.n
.x...v...a...N..9...@>.65.(..f_..me.Kh.....=..@9...u.G4...
..
..



GET /ad/softad/images/30.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1202
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:28 GMT
Accept-Ranges: bytes
ETag: "e6bc9a823625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:39 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?....5,....D..4#*d8.?.....M..qU....W..'...KY...Z=......7...
.=*.b!U.).C....O.:o..$.|..=;[..e.v.uo...R~.\d7.<.p..........s..e.u2
mtH2.B2.8..q..r}p.p@..ek....-^...O.&..... ....z......c..r{F...|*....H%
.4.|.u"..x.P.....{.........r.Q.U.._..._.4...|0........-....(....z..S..
...=:U.Y.....8..........1..i&9....Ss.4o.j.....mj...ewR./R.....xj..-.|.
,%Y...[s..=....,<5...Q._............o.z...5>Ho.jzu..%.g...s..Sv&
lt;......|..........J......F[..)=..n.3..u....{..i..t...V..^q..9....'.w
z......E...YH...U..~...|..7.3....._...O...H....NZY.9.~_.\1..K....C...z
...9.fv,.Y..$..^.I #.I%d...
....



GET /ad/softad/images/34.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1406
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:31 GMT
Accept-Ranges: bytes
ETag: "3cb4f843625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:39 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?..k;9.....,z..z.j..H..4.....6..E]...............k...a.;#h.
. ..(=q..q.p.._5T........^.5.....Pm...GD.Z-.n.;i....T.u... al.M....3.I
#PY1.Fy9......w(...0Q.'....2VoG...z...3....K.,.*~.....f.n.7md...t.....
..........>.kZ.'..,..N...|......<*c..v$ 3........=<<u..>
;..]8P.'.o.J...E.{i...#..lvE......HTU....I.N{..c.z.mA.I[..w..w.~..X.ft
.c ..m5k5.. >f.. .....}F.S..f.......=.:.....\......Q.[......T...]Y5
#..aJ5.WK..^V.u..j......|.......D<q8.............1..R.}-.._..."...(
U...X..k; .w.......H..E.1,.6......#....MTVg...T.T......wM4........m...
.m...pA....c.c......3,n<.v}.....~.....T..X.<..W.Mk.....9..(.."..
........hx.N....z..t.h#.......6.....j[.....~l!.._.........Un...W.x.f..
}.."..Ny.Mu.q>.E....~......C......3t.....N....E7......~.O*.n...1.Z&
..#..$.c......)I.K...._...j:jJ .r..4?..
....

<<< skipped >>>

GET /ad/softad/images/38.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1317
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:34 GMT
Accept-Ranges: bytes
ETag: "b41fe9853625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:41 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?...7.7.../<G.....w...$rs........p..IB....b..Z.~...Y4...
. .1. ...).@.,.^.?..B..~..l..j..]"mK..if$...dW.!.;I,...`...b2O..V....i
7..(.d..C..G.h.....E%...m.....'....._G...6.....M.o..1.........-B[..`.b
......oV=.o...-e...;.w..D.y..L<..^M..W{y/...f..T..Gmo3..D.2n0..H.?
.p{W...Y...f..W.V........Cq...<-...0..l....v.:...W......_......LFK.
8n.i...f.........W.1..i.......,q..H..O'&..%....<E{..............EwF
-.{ ....!.k..R.,...&h..Y"..X...#...s^T......Wn.........].)VU)*.....^^.
]../.h.....E......9.........9...9....(...9s%nn.om;>.....]:.%I?z6...
.&..f.E.*.6... .#..js...g...O...7...O$9.z..o..bp....N....[...;Q..q..EV
.. '..aYR..._.1......SV:...v.....[j1...<..d..s.l.....On..9...P.d.E.
...8.c..
....

<<< skipped >>>

GET /ad/softad/images/44.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1209
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:42 GMT
Accept-Ranges: bytes
ETag: "8a5e988a3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2014 10:17:41 GMT
......JFIF.....`.`......LEAD Technologies Inc. V1.01..................
.............. ."!....#(3 #&0&..,=-0569:9" ?C>8C3897...........7$.$
77777777777777777777777777777777777777777777777777....................
..........................................................}........!1A
..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghij
stuvwxyz..............................................................
...........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%
.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
........................................................ . ...........
...........?...-<. ....6....8..S.q.{..0...V.....{.|...V6..6z...=..o
)..Bc$.q.......H.$9..-.......vq......n.9y....P...........z..e.u..4..|U
..S....mqy$.(....I...q.FNX..Ri7v\jN1p.i=.{w;).![j> ......g.-2"Y.. .
.. H..HuV..q......qTe..$..Z.}..nJ..G,.?..~.......J.....t."...q....<
...;.g..2..>Ys8._.....J..B.Rt.......1....@:. .........O...?....(?..
.......}.w_hx..y.`.3..._-...*.....k\....)biSQ.EyYZ.J.u...99BN./O...xga
..g....$Z:.......|... ..|...=.=..._.|M........r.[G#......#$t._L.......
..Gd..3...T........./|I%...G....?.$....[..........J....F.M..g......Fu.
].Vck...|7<q.,ee..$o.|..w....x.q..
....



GET /ad/softad/images/48.JPG HTTP/1.1

Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: adsvc1.unadnet.com.cn
Connection: Keep-Alive
Cookie: CNZZDATA555586=cnzz_eid=540886874-1409048682-&ntime=1409048682


HTTP/1.1 200 OK
Content-Length: 1573
Content-Type: image/jpeg
Last-Modified: Wed, 20 Mar 2013 06:45:45 GMT
Accept-Ranges: bytes
ETag: "109a398c3625ce1:1cad"
Server: Microsoft-IIS/6.0
X-Powere


GET /static/images/s/360buy.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.afwfb.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:22 GMT
Content-Type: image/gif
Content-Length: 2220
Connection: keep-alive
Last-Modified: Wed, 29 Dec 2010 07:28:57 GMT
Etag: 11E117E48AC
Expires: Thu, 25 Sep 2014 10:13:22 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
GIF89ai.#.....W....P..........P$b.2l..........^.......$m....A.........
...|....^.........{..s........Aw...............2...j..................
.m...........|......b..W..,.....B..M..6.....<s.......rwm...1k.2l...
.s.....$p....I|.t.................)v..............].Y..Y..............
9.....O.......Q?...^.J}......c...)f.9q....F.....G{.Jfw]..j...^.!_.8p.V
..>~....,g. `.$d.D}.n..l.............?..?Bx.9q.M..3p.J}.8s.-u.;s.3m
....Dy.Z..>..T..o......`. g.Dx.Y..a.....W.......#"`.......e..X....0
.g....]........a..e../j.F........(f...1......#c.0m..^.:q.{...[.;r.)j..
..{..<t.......7p...|h....<2..5q.X..=y.......\..A}.(e.Ax.......p.
. g.... _..k.s.....u.. d.M.....W..3m.;....b...........................
......................................................................
..........................!.......,....i.#........H......*\......#J.H.
....3j...... /&. .@.7....A....0.@ .a....T...b@..6.....A..Aq\kP`..."*lT
p.@2'x0\......@.\QH.&...q.]......~.U...N.o.dL..@., R.........`JX.&....
H.,Y....0.|."@..?E.....^...T........(8....c(..... b.1v 4.`.@.....p.E..
.:. h....F.:...n...... nvA...b.).[0...5..!.`....>-0....G]3.Z.5`..?.
6]j.A.........Te.l.1..(U...n...[.2.pDA...@A...@..L..s9..A...P..*D....&
gt;.b.L...c....Z.p0....a..rD..n....30."K55@A..fI`.O.E..k......I..gF...
.m..Y.xA.P.g..$yf...o.DA(.. B.lH........t .U.j....Q....^-F`.j.:.A_0q..
....A..k..S#...$.....P............u.[.Ae.g02D....e.(....Y9P..q....q..!
..fu. f5.{.....A.D..a..F;...xPo..^.S..q@...`x...........LR\..L.<...
f1..@...bH..I...\..L>....(L.S.H..E.....YC...5&.`&.".......S..C.

<<< skipped >>>

GET /core.php?web_id=555586&t=z HTTP/1.1
Accept: */*
Referer: hXXp://adsvc1.unadnet.com.cn/count/softcount/?fcssq
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Date: Tue, 26 Aug 2014 10:24:46 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 26 Aug 2014 10:24:46 GMT
Expires: Tue, 26 Aug 2014 10:39:46 GMT
2ed..!function(){var p,q,r,a=encodeURIComponent,b="555586",c="",d="",e
="online_v3.php",f="hzs7.cnzz.com",g="1",h="text",i="z",j="站
8271;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m
="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=
" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&
k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.create
ScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?
web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/
img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'>&l
t;img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a
href='" q "' target=_blank title='" j "'>" j "</a>",k.createI
con([p])))}();..0..


GET /images/db380x60.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:22 GMT
Content-Type: image/gif
Content-Length: 6442
Connection: keep-alive
Last-Modified: Thu, 26 Dec 2013 06:45:52 GMT
Etag: 15FC5C24192A
Expires: Thu, 25 Sep 2014 10:13:22 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
GIF89a|.<....MNN..#..!..{.q...........HR.C........gi........%.X....
.......#(...............xyz..$.3=.....-../...eeg.ie.rw.5!..H.u}.......
...PS..}................\\.x......%.wt.......LL.BI.NP.V\..e..........\
e.jq.;F....7A.LM.......>B.&1....16....{........lo.U)....").}.......
.f..T...... qac...........*..... ....MO..........l.................w..
.........ZX.)5.............BB........9....qy.^e....T]....y~.# ....vo..
..\^......................HQ........ ._g..|.......xr.?E.= .gc.....%...
...zWZ.BL..1.05..........yt.`d....UY...................2:.......=@.-".
I...........g...z.......................................~.............
......................./4...~..pqq................................%...
...............yln.a)....ks....mt.............rs.......|............M.
.'..,...........&!.......,....|.<........H......*\......#J.H.....3j
...... C..I....(S.\.....0a.......8s.l8....@...J4.. W(.].......\.!c...X
o~!. K.X.R%.....rT0.....Z...5...T.20....!.!...1#...........X,.#....O.
@dV.C...*".=b...r..C. `@..[.):..k...|.^.....>.$H$......._.5$o.(%...
..d...a.i...L...(...b......b^5J.l.....N..........b..@...k.q..ua.W...:a
U..F..V..A.t."..m.%... n..R...D*. .""....'.....Bd...8...D9...F9.......
.?7.xdBI,.O.?n..Jz.U...e.!....`.`.YF8.Q....D!...T.......1.T......A...3
.5.te........q`(?,<.P.=N..=....B..............!..q)F9.....%....=.R.
..m...]~.....S.Bf.......S..4Q......0....6Lt.I/.0........o8.....K....b.
...P..f,.....;......?......1@n)....?......u:.......~|......c.7.....Q..
......b.Z......v{.wP...k....D.:..0.!.P..0-0..4..r.. @....r..2.8.o.

<<< skipped >>>

GET /static/images/s/baidu.gif HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:23 GMT
Content-Type: image/gif
Content-Length: 2310
Connection: keep-alive
Last-Modified: Wed, 29 Dec 2010 07:28:57 GMT
Etag: 18BE7BB4906
Expires: Thu, 25 Sep 2014 10:13:23 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
GIF89ai.#.....%.YR....b[..}v.......ZR....]U.ia."..=3.0&...... ".......
.qj....................................ME........aY.4*.<2.......-"7
..qk.....MD............................J?.........]U................xr
.JB.....d\......VN....sm........G=QH.....D:.........G@..6,......tn.3*.
... ...ld....ys.UL>5.............jc..............?6.......}.$..}w..
.....:1....&..............A9.0'.!......(..........................3)..
...}...........y......................................z(..mg........TK
.zt.........vp..~w......4 ....................f^.............WO.......
&.....tm..................90.....`W..|...<3.D;.......ke..VN.....{.)
.......~y...........B2.:0...g`.. ...1 .LC.....TE.RI.........SU.......
pi.zt.............8/.................ng.......y.......jc..............
..AB.......#........!.......,....i.#........H......*\.......rh.......D
.....:.B.S5...6..!...e.*.D...2....\.......8.=......H........L.$..S..".
.0.@. G..q..P....rVx].p..;L..s.D...7eRc.W!.....)......dz...qAp(EbR..Z.
..=..be..T@BEq...2..........k.0].P@..RawE.....?...@P....-.Y........4s;
.0..S1.B.%.%I$8.\B....$.L.....%6...&..&...b. ..S}.0#....h ..@.O.}$.`".
...?.8.........v....<.C.5.#.a....?.`.T.....S.....8v..?...c2......8.
...8"P7.`..?<....P..YH..`.O....,...f...b&.....?...E......Z..K......
.....`H...]8...3t..A.....F.c..?...7W.4.=..c.*.....(...(.X..?...@..,.AB
..TR.%\4p......(..0!..xB.(......4B.@.$q......T.@1..o@..>.h.A.E.....
\..0%L.@2....5..../Cv.....d..,.S...L..?..X.,Adq.........a....f...z.K.{
P.....0..#.....D. '..!s....O..P.F.<..@...s.?.....D@.O.. ..1..bD

<<< skipped >>>

GET /images/upload/1408932833.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:23 GMT
Content-Type: image/jpeg
Content-Length: 21230
Connection: keep-alive
Last-Modified: Mon, 25 Aug 2014 02:13:53 GMT
Etag: 2062122452EE
Expires: Thu, 25 Sep 2014 10:13:23 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:F2DE725B2BFC11E4889F9543AF919291" xmpMM:DocumentI
D="xmp.did:F2DE725C2BFC11E4889F9543AF919291"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:F2DE72592BFC11E4889F9543AF919291" stRef:doc
umentID="xmp.did:F2DE725A2BFC11E4889F9543AF919291"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................V...................................................
..................................................!..1".A.Q2#.aB$.q..3
..R4bD%5.........................!1..AQ.aq."...2.....BR#.3...C$b...Sc%
5.............?...[...n".../.S............dS....U Jc\x.<.."D...v.I.
UT.........4%R1.e:J...9......2.1.....5M.......k..Dh..UK(RT.)....hX%:."
.zO... F....u.R0.@.6.v......."..E.}>.:.......3..1sq.........8r.....
....1.1{|.<..Z.... ..{a)...cm....s...M.). .. QCOGM..y!.."bxr..o

<<< skipped >>>

GET /images/upload/1409042868.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:24 GMT
Content-Type: image/jpeg
Content-Length: 18954
Connection: keep-alive
Last-Modified: Tue, 26 Aug 2014 08:47:48 GMT
Etag: 1D5CCA744A0A
Expires: Thu, 25 Sep 2014 10:13:24 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:17289F692CFD11E4B24A9BEF3762535A" xmpMM:DocumentI
D="xmp.did:17289F6A2CFD11E4B24A9BEF3762535A"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:17289F672CFD11E4B24A9BEF3762535A" stRef:doc
umentID="xmp.did:17289F682CFD11E4B24A9BEF3762535A"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
..............................................!1..A"..Q2.aR#3.qB$...bC
.....S4DT...c.&F.......................!1..AQ.aq"..........2R#..B3..b$
..r.Sc4...%............?.......n.G.u.....Q,...iR!.O.y..c.!...J\.(... .
....%..0...C..Z0.......o5E...3rt.!.LY.$%..T.@=T.......(..KF.Cn....>
.....>...0j.L~.e..x.La.*y......B7.5.h..w.*.6@...u......KFC<i..b.
{.e.4.. ..u.c..Uqd.n.......q...)..-il)E...j...v~.%......8.}3......

<<< skipped >>>

GET /images/upload/1409042948.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:24 GMT
Content-Type: image/jpeg
Content-Length: 17349
Connection: keep-alive
Last-Modified: Tue, 26 Aug 2014 08:49:08 GMT
Etag: 1BAF48E443C5
Expires: Thu, 25 Sep 2014 10:13:24 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:6228788B2CFD11E48E558534C8BD0F9C" xmpMM:DocumentI
D="xmp.did:6228788C2CFD11E48E558534C8BD0F9C"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:622878892CFD11E48E558534C8BD0F9C" stRef:doc
umentID="xmp.did:6228788A2CFD11E48E558534C8BD0F9C"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
................................................!..1".AQa2..q#..34...B
b%.RCSc5V7.......$TE.........................!..1AQ..aq"2.........#3..
.b4B.5..R...ScsT%6...r..C.$DdEUW............?......r.Du..."%H..."Za..v
..#H....$.~.9.6....n.{..8....JWO..2f!.-.f.....'S]gi..SZR...O.~.'...SbS
...b...T...h..Vi....P.1.....TR... a.j..i..{.[..Q._e9......o.6...w..R..
..[F.u[u.....R........N...A......b=...(..!.S^L8&I/...JRJt.....s..C

<<< skipped >>>

GET /images/upload/1409042972.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:25 GMT
Content-Type: image/jpeg
Content-Length: 16663
Connection: keep-alive
Last-Modified: Tue, 26 Aug 2014 08:49:32 GMT
Etag: 1C3F99244117
Expires: Thu, 25 Sep 2014 10:13:25 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:7D2112AB2CFD11E4A83AADE67D245F57" xmpMM:DocumentI
D="xmp.did:7D2112AC2CFD11E4A83AADE67D245F57"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:7D2112A92CFD11E4A83AADE67D245F57" stRef:doc
umentID="xmp.did:7D2112AA2CFD11E4A83AADE67D245F57"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
...............................................!.1"2.AQ.a#3..Rb$4T.q..
BCS.csf..D%5U.......................!1..A..Qaq"....2......B#..R$.b3C..
............?...g..-d2..3..$.)...%&R..........4!..]us..! .......|.q...
...J...XPO....ON[..=J.S;...b\...&......s..C}.c..x..).(..X....9B4.]..ZX
0.....&..K!;J...d}....T.{{... ..........>..<9..a. /.&@..|..[nG.p
.9g.o.2....x.^....\J..7Q.....C.u..........4....Y;...cY.......F].b.

<<< skipped >>>

GET /images/upload/1409016738.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:25 GMT
Content-Type: image/jpeg
Content-Length: 17746
Connection: keep-alive
Last-Modified: Tue, 26 Aug 2014 01:32:18 GMT
Etag: 1B0F73544552
Expires: Thu, 25 Sep 2014 10:13:25 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:3DEE0B092CBF11E4B842C87CD8207C30" xmpMM:DocumentI
D="xmp.did:3DEE0B0A2CBF11E4B842C87CD8207C30"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:3DEE0B072CBF11E4B842C87CD8207C30" stRef:doc
umentID="xmp.did:3DEE0B082CBF11E4B842C87CD8207C30"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
................................................!1"..2..A#3.QaRb$4.BCS
cT.d6q...DU..t...5e7.(......................!.1..AQq..a."......2..#3..
.BRb..4..S$C.%&.............?...._R>....r.^.....I.s\..-......n.....
.qe2:(....*{.L.....y..].5.fH.F.q..[.........W......;>'.V.?..6.}}.Os
.|....,.0.;A!....i. .U.4.Kum.P.....S...1...n.|.@..Qk..0E...&H.....Z...
.X.i......oV.-%!..P3..).Zq....NPAj.0...B.....dB...............I!..

<<< skipped >>>

GET /images/upload/1409016784.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:25 GMT
Content-Type: image/jpeg
Content-Length: 19648
Connection: keep-alive
Last-Modified: Tue, 26 Aug 2014 01:33:04 GMT
Etag: 1DB3D7944CC0
Expires: Thu, 25 Sep 2014 10:13:25 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:049E43452CC011E4A68ACCC5165C69AE" xmpMM:DocumentI
D="xmp.did:049E43462CC011E4A68ACCC5165C69AE"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:049E43432CC011E4A68ACCC5165C69AE" stRef:doc
umentID="xmp.did:049E43442CC011E4A68ACCC5165C69AE"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
................................................!.1"...AQ2.a#3..qRb456
..BS$U..cTd%e&V7W....C..'X:.......................!1..AQ..aq..."2.....
.R3..B#$..bS4T.r..c..C%V.............?..wm.......5;...2...l.m.,..9!G.B
..*.u%..2.;..P ....v.Kw..d.<...c.y.m..Hm..b..z.6.........m....,X.C.
\..N[.....|..Dk3.B..Uo...(5-.un.v.....0...7`.1.H..o6...\....2.>...f
m.p..mA..f<.t...Yn....U#..\..Ie..*G"B..2....4:...|*<...[H.-.

<<< skipped >>>

GET /images/upload/1409016807.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:25 GMT
Content-Type: image/jpeg
Content-Length: 19117
Connection: keep-alive
Last-Modified: Tue, 26 Aug 2014 01:33:27 GMT
Etag: 155A3D744AAD
Expires: Thu, 25 Sep 2014 10:13:25 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:514B43AF2CC011E4A007C5420A46C087" xmpMM:DocumentI
D="xmp.did:514B43B02CC011E4A007C5420A46C087"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:514B43AD2CC011E4A007C5420A46C087" stRef:doc
umentID="xmp.did:514B43AE2CC011E4A007C5420A46C087"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
................................................!.."..12#34AQa.Bb$5U.C
ScT%&V.6.qR..DtEe.'g9I.......................!1..AQ..a"q..2.....BR...r
#3$....b...cs4T.5............?.....=...|..............2.\N...\ ....~.i
uow.7........p..Q!...........f.{.......H...]...Mq..D...>4.]..<..
7........(&0..}...{...MuXk.E.......d..a.4A.R...UZ.........k.[...q.rW..
....F......tFG5.8..n...m..ll..K....|.nU'".c.P.*bD..9V..N.a.XrHwM..

<<< skipped >>>

GET /images/upload/1408954313.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:26 GMT
Content-Type: image/jpeg
Content-Length: 21684
Connection: keep-alive
Last-Modified: Mon, 25 Aug 2014 08:11:53 GMT
Etag: 1B7A092454B4
Expires: Thu, 25 Sep 2014 10:13:26 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:38AA25332C2E11E497FDA6DD67138FB8" xmpMM:DocumentI
D="xmp.did:38AA25342C2E11E497FDA6DD67138FB8"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:38AA25312C2E11E497FDA6DD67138FB8" stRef:doc
umentID="xmp.did:38AA25322C2E11E497FDA6DD67138FB8"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
..............................................!.....1A"Q2..a#35.q.b$4T
U6BR.....CdteV7X..Sc..%Eg..).........................!1..AQ.aq."...2..
....B#.R.b3S....Cc$4Tr...U&............?..*.... .n..*....}.....j$./.8.
.......-.M.....~.a.v.Q|..VY.=....o.r.*........ r=..u..^.D.C,.$..M.....
r;|...5......K.h..)..........M3jZ....86...{.W;..1......F-].p......l...
h.#ef3.d...x....'.y...5.4...........}J..J$H.....\.....\......}....

<<< skipped >>>

GET /images/upload/1408954395.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:26 GMT
Content-Type: image/jpeg
Content-Length: 19749
Connection: keep-alive
Last-Modified: Mon, 25 Aug 2014 08:13:15 GMT
Etag: 158915544D25
Expires: Thu, 25 Sep 2014 10:13:26 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:18D7E1A92C2F11E48F97EA125C2D2BE4" xmpMM:DocumentI
D="xmp.did:18D7E1AA2C2F11E48F97EA125C2D2BE4"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:18D7E1A72C2F11E48F97EA125C2D2BE4" stRef:doc
umentID="xmp.did:18D7E1A82C2F11E48F97EA125C2D2BE4"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
...............................................!...1"..A..Qa2#qB3$.R%5
7.....bc4D6V...r.UeF'GWX........................!1..A..Qaq"....2...#..
...BR3..rSbC$4T%.5............?.D=.{z..........c.bi.R.F....W...AR.6...
g.....H.r&O.)M..-.#.\1.:fZ...S9.r& .b.r.wm.Y7.X>..d...v..%...q...O
...$.G..:..#.0.$..8..W...p...5.a...o.E....H.lPs.m.H#/..gJ.#wk.r..'....
...:.V*&..F.A7%vVR2J.P.(.a0..A(q.j=....F.P...)....y.........q.p.].

<<< skipped >>>

GET /images/upload/1408930308.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:26 GMT
Content-Type: image/jpeg
Content-Length: 21598
Connection: keep-alive
Last-Modified: Mon, 25 Aug 2014 01:31:48 GMT
Etag: 20546894545E
Expires: Thu, 25 Sep 2014 10:13:26 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:2F4C51BF2BF611E4BE15FBCFA482A2CB" xmpMM:DocumentI
D="xmp.did:2F4C51C02BF611E4BE15FBCFA482A2CB"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:2F4C51BD2BF611E4BE15FBCFA482A2CB" stRef:doc
umentID="xmp.did:2F4C51BE2BF611E4BE15FBCFA482A2CB"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
..................................................!1"..#345.AQa2b$6.RS
c%V7qCTdUgBr...De&'W8X.........................!1..AQ.aq".....2#......
.RB3$..br..CSÄd&.............?...?.....M..f).-C.C....>..u.%t.y \.
2...V..K|.ed...W.W .5.....!2.YC.........02.....bO.)..;..q~z.N.......I.
r.l.d...j..W.XgeL[...#..2...j.Un........H..g.E..k.;.v......|}..S....?q
..^m.....4.......................</x...c.A..lWu9Q\._.v...t.)..b

<<< skipped >>>

GET /images/upload/1408930446.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:27 GMT
Content-Type: image/jpeg
Content-Length: 22747
Connection: keep-alive
Last-Modified: Mon, 25 Aug 2014 01:34:06 GMT
Etag: 1E23AED458DB
Expires: Thu, 25 Sep 2014 10:13:27 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:60E67E2B2BF611E48587CFCC4DCFC779" xmpMM:DocumentI
D="xmp.did:60E67E2C2BF611E48587CFCC4DCFC779"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:60E67E292BF611E48587CFCC4DCFC779" stRef:doc
umentID="xmp.did:60E67E2A2BF611E48587CFCC4DCFC779"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
.................................................!1.."..A2.Qa#34.q.BRb
SW..CcsTU6..$eW...D&FV.........................!1..AQ.aq."2....BR#3.
....b...r..c$.CS4%...D............?...as....{^S......aeUS...|...Y.q,j.
.C$..b".6;.E..E....k.r...{&..Z..JP.I...X..0R.Uk.m4JZn.X.....FR.c.....p
......2l.%.....<. ..W."V\.z{.M..4#jLHf.... ...}Q6.....Z*S....W.8.8.
v......^....._P....1*.>s.....j{.;........Xrux].-....iQ..mP..U$T

<<< skipped >>>

GET /images/upload/1408930505.jpg HTTP/1.1

Accept: */*
Referer: hXXp://VVV.afwfb.com/u_12480.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.5w123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 26 Aug 2014 10:13:27 GMT
Content-Type: image/jpeg
Content-Length: 18340
Connection: keep-alive
Last-Modified: Mon, 25 Aug 2014 01:35:05 GMT
Etag: 177F2B7447A4
Expires: Thu, 25 Sep 2014 10:13:27 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
......Exif..II*.................Ducky.......d.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:A6A80B5F2BF611E49E60D15CE7B8D796" xmpMM:DocumentI
D="xmp.did:A6A80B602BF611E49E60D15CE7B8D796"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:A6A80B5D2BF611E49E60D15CE7B8D796" stRef:doc
umentID="xmp.did:A6A80B5E2BF611E49E60D15CE7B8D796"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................d...................................................
.................................................!.1"..A#.23.Qa$456qBb
ScTd%UV..RC&7W.....98.......................!..1AQ.aq."2.....#.....R3.
Bb.r.4.C...$D.............?........;,x..a4.7!...n.8].1.q...A.LEUGi.|:.
79.s.....0K#ZZ.......;..T...J..1....P.V"........n..Q...~.|.B...u...G..
.j.3..,.2j...........g. ...R6.B.....xcF..<...9..N.v.@.].F&..D..v..*
...x..y...xG..NQ.1x.#.Sl..o%...4..W...M>.N.$.........M..}cQt.dc

<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

fcssq.exe_1756:

.idata
.rdata
P.reloc
P.rsrc
kernel32.dll
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
htKeyword
EInvalidOperation
u%CNu
Uh.uA
%s[%d]
%s_%d
.Owner
EInvalidGraphicOperation
comctl32.dll
USER32.DLL
windows
PasswordChar
OnKeyDown
OnKeyPressX
OnKeyUp
ssHorizontal
Uh5%C
Proportional
%s%s%s%s%s%s%s%s%s%s
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
TKeyEvent
TKeyPressEvent
HelpKeyword @A
crSQLWait
%s (%s)
IMM32.DLL
AutoHotkeys(
AutoHotkeysp
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview
WindowStateT
tagMSG
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
MAPI32.DLL
vsReport
OnKeyDownX
OnKeyPress
EInvalidGridOperation
goAlwaysShowEditor
D:\Soft\Borland\Delphi6\Lib\Components\SUIPack\SUIImagePanel.pas
ole32.dll
olepro32.dll
IWebBrowser
IWebBrowserApp
IWebBrowser2
TWebBrowserStatusTextChange
TWebBrowserProgressChange
TWebBrowserCommandStateChange
TWebBrowserTitleChange
TWebBrowserPropertyChange
TWebBrowserBeforeNavigate2
TWebBrowserNewWindow2
TWebBrowserNavigateComplete2
TWebBrowserDocumentComplete
TWebBrowserOnVisible
TWebBrowserOnToolBar
TWebBrowserOnMenuBar
TWebBrowserOnStatusBar
TWebBrowserOnFullScreen
TWebBrowserOnTheaterMode
TWebBrowser
TWebBrowserXpK
\\.\Scsi0:
\\.\SMARTVSD
hXXp://me.alipay.com/linxiaojian
hXXp://shop.gouwuke.cn/goods.php?id=105
hXXp://VVV.sharebank.com.cn/soft/softbuy.php?soid=10992
170902348
mailto:fysoft@sogou.com
hXXp://VVV.feiyang163.com
OnActionExecute
Webtuijian
webpopup
webcount
Program Files\Internet Explorer\iexplore.exe"
SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
*.lnk
Opera.lnk
WiseBrowser.lnk
TT.lnk
Mozilla Firefox.lnk
3.lnk
Maxthon.lnk
pw.dll
hXXp://adsvc1.unadnet.com.cn/ad/softad/pw.htm
Program Files\Internet Explorer\iexplore.exe
170902348
mailto:170902348@qq.com
)4."1-2(
*5/#2.3)
",71@5  &
3'627-"(
1 '-7#&0
1&,#84 .'*
- 8!3(.%
7&-3!),6%
#5*0' 8$2 .
8'.4"*-7& 0#
("2%!&8-3*#
/5,%!)703
(03!,&6)%* 17.'# 
$/6 *25#.(8 ',"3
&18",47%0*
'2, / 0&7!4-)1#8
(3-!0,1'8"5.*2$
user32.dll
GetKeyboardType
advapi32.dll
RegOpenKeyExA
RegCloseKey
oleaut32.dll
RegFlushKey
RegCreateKeyExA
WinExec
GetWindowsDirectoryA
GetCPInfo
version.dll
gdi32.dll
SetViewportOrgEx
SetViewportExtEx
GetViewportOrgEx
UnhookWindowsHookEx
SetWindowsHookExA
SetKeyboardState
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
winspool.drv
shell32.dll
ShellExecuteA
URLMON.DLL
URLDownloadToFileA
comdlg32.dll
8!8%8)8-8185898
1 1$1(1,101
1 1$1(161>1
141<1\1{1
3?3l3
2(3)424@4~4
1!11x1
6l6G6K6m6y6
3%3S3z3
5 5$5(5,5
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
3333330
55555666666655555
66666666666666666
)),,1)))1,,,))
)),,,1))1,,,))
)),,,1)1
1)1,,,))
)),,,1)))1,,))
0000000
"""3"#2""
"""#23"""
""""32"""
""""3""""
""""#2"""
"""3332""
% ) CmDEpsMOab
00 %%"!000-
00"(&#"00-
00% (%$0-"
00&, (&%$#"!
11!##!.1111
11!&&#".111
11#)'$##.11
11&,)&%$$.1
11'-,)'&%$#"
11/'%#!!
3333334
3323334
3333333330
%UE=-%U=-
|&)(*[**2
pP3}Q }Q }Q }Q }Q }Q }Q }Q yM(wJ%uC
""""3333""""
07$0?;70
0??7;??;70
'#"($%!%&#
-, /54.0123
8566656666666667
76666666666669
3222222222
9422222222
222222249
9999999
!!!::::~
~::!!:~~
i.DD7
&p<',..\\\\\.mm&\d<'mm,..\
\\\.mddxPmmmm,
\\\\W!j&&&mmm.\\\..,W!`j&&&mm,.\\,mmWh``&&&mmm.\.mmmrh
`&&&&mm,.mm&&kB
"2"%UUR"B
%%%###==
=##%%%#/9
%%%####%%####==
<<<\\<<::::
]\[ZY/US*(%F
66666666
..vEeeei4
2"""22%2"2"2"2"
3333""""#
B"""$DDDDDDD"""""""""""""""""""""""""%UUUUUUU""""Va
fffffR"""%UUUUUUU""""(
.LLLHE<
][XUSQL
8521110'*
&8766640
KWindows
UrlMon
Constraints.MinWidth
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
PicNormal.Data
PicMouseOn.Data
PicMouseDown.Data
Picture.Data
Glyph.Data
:170902348@qq.com
*.txt
|*.txt|
2011:12:18 19:07:21
2006:12:14 15:18:31
urlTEXT
MsgeTEXT
HhXXp://ns.adobe.com/xap/1.0/
<x:xapmeta xmlns:x='adobe:ns:meta/' x:xaptk='XMP toolkit 2.8.2-33, framework 1.5'>
<rdf:RDF xmlns:rdf='hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:iX='hXXp://ns.adobe.com/iX/1.0/'>
<rdf:Description about='uuid:5714f904-8b42-11db-8dc0-d0cd5c581488'
xmlns:xapMM='hXXp://ns.adobe.com/xap/1.0/mm/'>
<xapMM:DocumentID>adobe:docid:photoshop:5714f8fd-8b42-11db-8dc0-d0cd5c581488</xapMM:DocumentID>
%D!JL
fysoft@sogou.com
Lines.Strings
tjywmax@sohu.com
9558 8014 0210 3185713
4367 4218 2003 0002 324
6225 8859 1015 3329
95599 8006 15619 40711
hXXp://adsvc1.unadnet.com.cn/ad/softad/tuijian.htm
hXXp://adsvc1.unadnet.com.cn/ad/softad/popup.htm
hXXp://adsvc1.unadnet.com.cn/count/softcount/?fcssq
MSGDLG_ERROR
MSGDLG_INFORMATION
MSGDLG_QUESTION
MSGDLG_WARNING
TSUIPASSWORDDIALOG
TSUIURLLABEL
No GIF Data to writeÊnnot change the Size of a GIF image
Could not load '%s' libraryLFile specified is not an executable file, dynamic-link library, or icon file
All files (*.*)|*.*
7Dispatch methods do not support more than 64 parameters
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s&Cannot change the size of a JPEG image
JPEG error #%d
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count"Unable to find a Table Of Contents
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL
Resource %s not found
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object
Invalid clipboard format Clipboard does not support Icons
Text exceeds memo capacity.There is no default printer currently selected/Menu '%s' is already being used by another form
Invalid input value7Invalid input value. Use escape key to abandon changes
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to set data for '%s'
%s.Seek not implemented$Operation not allowed on sorted list Too many rows or columns deleted$%s not in a class registration group
Property %s does not exist
#A component named %s already exists%String list does not allow duplicates
Cannot create file %s1Fixed column count must be less than column count Fixed row count must be less than row count
Cannot open file %s
Grid too large for operation
Unable to write to %s
Invalid stream format$''%s'' is not a valid component name
Invalid data type for '%s'&Cannot insert or delete rows from grid
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)
System Error. Code: %d.
Invalid variant operation"Variant method calls not supported
External exception %x
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted%Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
I/O error %d


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:128
    is-JNBNC.tmp:1072

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\23[1].jpg (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\31[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1409018148[1].jpg (1301 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\1408930308[1].jpg (5303 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\7[1].jpg (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\baidu[1].gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\20[1].jpg (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\30[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\friend-down[1].gif (933 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\1408930419[1].jpg (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\32[1].jpg (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\28[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\&pis=-1x-1&cfv=6&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=250&tlm=1363765561&tcn=1409030684&tpr=1409030684121&dpt=none&coa=&baidu_ (319 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\core[1].php (749 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1408954420[1].jpg (1065 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\stat[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\s[2].js (986 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (5592 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\36[1].jpg (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\8[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\1408930505[1].jpg (1738 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\4[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\tuijian[1].htm (11037 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\45[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\1408954313[1].jpg (1992 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\popup7o[2].js (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\1409043350[1].jpg (5273 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\16[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\47[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\22[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\6[1].jpg (877 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\1409042868[1].jpg (3991 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\29[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\1409016761[1].jpg (1403 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\42[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\26[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\19[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\1408954395[1].jpg (2027 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\softcount[1].htm (97 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\1408699061[1].jpg (3050 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\41[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\43[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\17[1].jpg (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\stat[1].php (1163 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\s[1].js (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\popup7o[1].js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\24[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1409042948[1].jpg (1814 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\14[1].jpg (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\46[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1408954367[1].jpg (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\1409016784[1].jpg (2194 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\db380x60[1].gif (1755 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\49[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\12[1].jpg (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\5[1].jpg (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\35[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1409042922[1].jpg (1605 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\21[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\9[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (203 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\db100x60[1].gif (1224 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1409016738[1].jpg (776 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\40[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\10[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\27[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\1408930483[1].jpg (761 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\11[1].jpg (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\50[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\13[1].jpg (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\popup[1].htm (794 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@adsvc1.unadnet.com[1].txt (256 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\360buy[1].gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\2[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\1408954346[1].jpg (2536 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@cb.baidu[1].txt (126 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\37[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\u_12480[1].htm (15217 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\44[1].jpg (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\1409016707[1].jpg (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\34[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\1409042972[1].jpg (776 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\1409042898[1].jpg (776 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\18[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\1408932833[1].jpg (4082 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\38[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\39[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\48[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\down[1].gif (211 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\33[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\123logo[1].gif (1224 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\25[1].jpg (210 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\1409016807[1].jpg (1274 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\15[1].jpg (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\3[1].jpg (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\1408930446[1].jpg (2446 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-TIEEM.tmp\is-JNBNC.tmp (3722 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6\жÔØ ¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6.lnk (623 bytes)
    %Documents and Settings%\%current user%\Desktop\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6.lnk (638 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6.lnk (650 bytes)
    %Program Files%\fcssq\is-LP1K2.tmp (2 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6\¸£²ÊË«É«ÇòÔ¤²â´óʦ 1.6 ÍøÕ¾.lnk (433 bytes)
    %Program Files%\fcssq\is-EC8F0.tmp (249 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-UU57A.tmp\_isetup\_shfoldr.dll (23 bytes)
    %Program Files%\fcssq\is-SQQN4.tmp (9605 bytes)
    %Program Files%\fcssq\unins000.dat (932 bytes)
    %Program Files%\fcssq\is-GM0S0.tmp (9605 bytes)
    %Program Files%\fcssq\fcssq.url (51 bytes)
    %Program Files%\fcssq\is-QR747.tmp (6907 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.