CapTipper Report

CapTipper

Analysis Info

PCAP File	Analysis Time	CapTipper Version	Traffic Time
/opt/Malware-Project/BigDataset/Scenarios/CTU-Malware-Capture-Botnet-116-3//2012-05-30-capture-3.pcap	04/09/15 21:27:51	0.2 b09	05/30/12 00:42:18

Flow View

Client Details

IP	192.168.0.250
MAC	08:00:27:3c:8d:c9
USER-AGENT	Microsoft NCSI

Conversations

192.168.0.151:5357 (192.168.0.151:5357)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

/acc7fe12-3135-466d-a131-c5ba9b41ee06/

application/soap+xml

0.html

200

XML

2.1 KB

05/30/12 00:42:18

Download
SHA256	3a35d357e0f6c6062e436106e3d0e4db6c78ee614cb2dafae66f19df54c1317b
Referer
Magic	EXtensible Markup Language (XML)
Request	POST /acc7fe12-3135-466d-a131-c5ba9b41ee06/ HTTP/1.1 Cache-Control: no-cache Connection: Close Pragma: no-cache Content-Type: application/soap+xml User-Agent: WSDAPI Content-Length: 733 Host: 192.168.0.151:5357
Response Header	HTTP/1.1 200 Content-Type: application/soap+xml Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 May 2012 00:41:58 GMT Connection: close Content-Length: 2192
HEX Peek (128 B)	0000 3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31 PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxu czpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndz YT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxu czp3c3g9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDQvMDkvbWV4IiB4bWxuczp3 c2RwPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA2LzAyL2RldnByb2YiIHhtbG5z OnVuMD0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93aW5kb3dzL3BucHgvMjAwNS8xMCIg eG1sbnM6cHViPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvcHViLzIwMDUv MDciPjxzb2FwOkhlYWRlcj48d3NhOlRvPmh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIw MDQvMDgvYWRkcmVzc2luZy9yb2xlL2Fub255bW91czwvd3NhOlRvPjx3c2E6QWN0aW9uPmh0dHA6 Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDQvMDkvdHJhbnNmZXIvR2V0UmVzcG9uc2U8L3dz YTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6YTEzMDRkZjEtNGQ4NC00ZmU3LTk2ODUt NzM4NTY3NjlhNjQ0PC93c2E6TWVzc2FnZUlEPjx3c2E6UmVsYXRlc1RvPnVybjp1dWlkOjNkYmJl ODM1LWZkMmQtNDU3ZS1hZDk5LTZkYTNjYjIwMmQzOTwvd3NhOlJlbGF0ZXNUbz48L3NvYXA6SGVh ZGVyPjxzb2FwOkJvZHk+PHdzeDpNZXRhZGF0YT48d3N4Ok1ldGFkYXRhU2VjdGlvbiBEaWFsZWN0 PSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA2LzAyL2RldnByb2YvVGhpc0Rldmlj ZSI+PHdzZHA6VGhpc0RldmljZT48d3NkcDpGcmllbmRseU5hbWU+TWljcm9zb2Z0IFB1YmxpY2F0 aW9uIFNlcnZpY2UgRGV2aWNlIEhvc3Q8L3dzZHA6RnJpZW5kbHlOYW1lPjx3c2RwOkZpcm13YXJl VmVyc2lvbj4xLjA8L3dzZHA6RmlybXdhcmVWZXJzaW9uPjx3c2RwOlNlcmlhbE51bWJlcj4yMDA1 MDcxODwvd3NkcDpTZXJpYWxOdW1iZXI+PC93c2RwOlRoaXNEZXZpY2U+PC93c3g6TWV0YWRhdGFT ZWN0aW9uPjx3c3g6TWV0YWRhdGFTZWN0aW9uIERpYWxlY3Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNv YXAub3JnL3dzLzIwMDYvMDIvZGV2cHJvZi9UaGlzTW9kZWwiPjx3c2RwOlRoaXNNb2RlbD48d3Nk cDpNYW51ZmFjdHVyZXI+TWljcm9zb2Z0IENvcnBvcmF0aW9uPC93c2RwOk1hbnVmYWN0dXJlcj48 d3NkcDpNYW51ZmFjdHVyZXJVcmw+aHR0cDovL3d3dy5taWNyb3NvZnQuY29tPC93c2RwOk1hbnVm YWN0dXJlclVybD48d3NkcDpNb2RlbE5hbWU+TWljcm9zb2Z0IFB1YmxpY2F0aW9uIFNlcnZpY2U8 L3dzZHA6TW9kZWxOYW1lPjx3c2RwOk1vZGVsTnVtYmVyPjE8L3dzZHA6TW9kZWxOdW1iZXI+PHdz ZHA6TW9kZWxVcmw+aHR0cDovL3d3dy5taWNyb3NvZnQuY29tPC93c2RwOk1vZGVsVXJsPjx3c2Rw OlByZXNlbnRhdGlvblVybD5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb208L3dzZHA6UHJlc2VudGF0 aW9uVXJsPjx1bjA6RGV2aWNlQ2F0ZWdvcnk+Q29tcHV0ZXJzPC91bjA6RGV2aWNlQ2F0ZWdvcnk+ PC93c2RwOlRoaXNNb2RlbD48L3dzeDpNZXRhZGF0YVNlY3Rpb24+PHdzeDpNZXRhZGF0YVNlY3Rp b24gRGlhbGVjdD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNi8wMi9kZXZwcm9m L1JlbGF0aW9uc2hpcCI+PHdzZHA6UmVsYXRpb25zaGlwIFR5cGU9Imh0dHA6Ly9zY2hlbWFzLnht bHNvYXAub3JnL3dzLzIwMDYvMDIvZGV2cHJvZi9ob3N0Ij48d3NkcDpIb3N0Pjx3c2E6RW5kcG9p bnRSZWZlcmVuY2U+PHdzYTpBZGRyZXNzPnVybjp1dWlkOmFjYzdmZTEyLTMxMzUtNDY2ZC1hMTMx LWM1YmE5YjQxZWUwNjwvd3NhOkFkZHJlc3M+PC93c2E6RW5kcG9pbnRSZWZlcmVuY2U+PHdzZHA6 VHlwZXM+cHViOkNvbXB1dGVyPC93c2RwOlR5cGVzPjx3c2RwOlNlcnZpY2VJZD51cm46dXVpZDph Y2M3ZmUxMi0zMTM1LTQ2NmQtYTEzMS1jNWJhOWI0MWVlMDY8L3dzZHA6U2VydmljZUlkPjxwdWI6 Q29tcHV0ZXI+TU9WVElOWTcyL05vdEpvaW5lZDwvcHViOkNvbXB1dGVyPjwvd3NkcDpIb3N0Pjwv d3NkcDpSZWxhdGlvbnNoaXA+PC93c3g6TWV0YWRhdGFTZWN0aW9uPjwvd3N4Ok1ldGFkYXRhPjwv c29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4=

www.msftncsi.com (65.55.119.90:80)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

/ncsi.txt

text/plain

ncsi.txt

200 OK

TEXT

14.0 B

05/30/12 00:42:49

www.geoiptool.com (190.210.100.78:80)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

text/html

2.html

200 OK

HTML

11.7 KB

05/30/12 00:45:02

PCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBYSFRNTCAxLjAgVHJhbnNpdGlvbmFs Ly9FTiIgImh0dHA6Ly93d3cudzMub3JnL1RSL3hodG1sMS9EVEQveGh0bWwxLXRyYW5zaXRpb25h bC5kdGQiPgo8aHRtbCB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94aHRtbCIgeG1sOmxh bmc9IiIgbGFuZz0iIj4KPGhlYWQ+CjxtZXRhIG5hbWU9IkRFU0NSSVBUSU9OIiBjb250ZW50PSJN eSBJUCBBZGRyZXNzIExvb2t1cCBhbmQgR2VvVGFyZ2V0aW5nIGluZm9ybWF0aW9uIj4KPE1FVEEg TkFNRT0iS0VZV09SRFMiIENPTlRFTlQ9Imdlb2dyYXBoaWNhbCwgZ2VvZ3JhZmljYSwgbWFwYSwg Z29vZ2xlIG1hcCwgZ29vZ2xlIG1hcHMsIG1hcHMsIG1hcCwgaXAsIGhvc3RuYW1lLCBjaXR5LCBs b2NhdGlvbiwgaXAgYWRkcmVzcywgZGlyZWNjaW9uIGlwIj4KPG1ldGEgaHR0cC1lcXVpdj0iQ29u dGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiIC8+Cjx0aXRsZT5H ZW8gSVAgIFRvb2wgLSAgVmlldyBteSBJUCBpbmZvcm1hdGlvbjwvdGl0bGU+CjxsaW5rIGhyZWY9 Ii9pbWFnZXMvZXN0aWxvcy5jc3MiIHJlbD0ic3R5bGVzaGVldCIgdHlwZT0idGV4dC9jc3MiPgo8 bGluayByZWw9ImltYWdlX3NyYyIgaHJlZj0iaHR0cDovL2dlb2lwdG9vbC5jb20vaW1hZ2VzL3Nj cmVlbi5wbmciIC8+Cgo8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCIgc3JjPSJodHRwOi8v dmsuY29tL2pzL2FwaS9zaGFyZS5qcz8xMSIgY2hhcnNldD0id2luZG93cy0xMjUxIj48L3Njcmlw dD4KCgo8c2NyaXB0IHNyYz0iaHR0cDovL21hcHMuZ29vZ2xlLmNvbS9tYXBzP2ZpbGU9YXBpJnY9 MSZrZXk9QUJRSUFBQUFuMUdHVE51UjBMczc4bFFUU20xYVp4UlNLZmkxUW1HRDBfUmVxcWlDQy13 dHFTZ18zQlNFQzB4R0FyQ0RWOEpXOGhldlByOVF0UVllSlEiIHR5cGU9InRleHQvamF2YXNjcmlw dCI+PC9zY3JpcHQ+CjwvaGVhZD4KPGJvZHk+Cgo8c2NyaXB0IHNyYz0iaHR0cDovL21hcHMuZ29v Z2xlLmNvbS9tYXBzP2ZpbGU9YXBpJnY9MSZrZXk9QUJRSUFBQUFuMUdHVE51UjBMczc4bFFUU20x YVp4UlNLZmkxUW1HRDBfUmVxcWlDQy13dHFTZ18zQlNFQzB4R0FyQ0RWOEpXOGhldlByOVF0UVll SlEiIHR5cGU9InRleHQvamF2YXNjcmlwdCI+PC9zY3JpcHQ+Cgo8c2NyaXB0IGxhbmd1YWdlPSJq YXZhc2NyaXB0Ij4KZnVuY3Rpb24gYWRkRW5naW5lKCkKewoJaWYgKCh0eXBlb2Ygd2luZG93LnNp ZGViYXIgPT0gIm9iamVjdCIpICYmICh0eXBlb2Ygd2luZG93LnNpZGViYXIuYWRkU2VhcmNoRW5n aW5lID09ICJmdW5jdGlvbiIpKQoJewoJCXdpbmRvdy5zaWRlYmFyLmFkZFNlYXJjaEVuZ2luZSgK CQkiaHR0cDovL3d3dy5nZW9pcHRvb2wuY29tL2ZpcmVmb3gvZ2VvaXB0b29sLnNyYyIsCgkJImh0 dHA6Ly93d3cuZ2VvaXB0b29sLmNvbS9maXJlZm94L2dlb2lwdG9vbC5naWYiLAoJCSJHZW8gSVAg VG9vbCIsCgkJIkdlbmVyYWwiICk7Cgl9CgllbHNlCgl7CgkJYWxlcnQoIkVzdGUgcGx1Zy1pbiBl cyBwYXJhIE1vemlsbGEgRmlyZUZveCEgKGh0dHA6Ly9tb3ppbGxhLm9yZy9wcm9kdWN0b3MvZmly ZWZveCkiKTsKCX0KfQo8L3NjcmlwdD4KCjx0YWJsZSB3aWR0aD0iNzg2IiBib3JkZXI9IjAiIGFs aWduPSJjZW50ZXIiIGNlbGxwYWRkaW5nPSI0IiBjZWxsc3BhY2luZz0iMCI+CiAgPHRyPgogICAg PHRkIHdpZHRoPSIzODUiIGhlaWdodD0iNjUiIHZhbGlnbj0ibWlkZGxlIj4KCSA8YSBocmVmPSIv LyI+CgkgPGltZyBzcmM9Ii9pbWFnZXMvbG9nby5naWYiIHdpZHRoPSIyNjQiIGhlaWdodD0iNDQi IHZzcGFjZT0iNSIgYm9yZGVyPSIwIi8+CSA8L2E+CSA8L3RkPgogICAgPHRkIHdpZHRoPSI0MDEi IGFsaWduPSJyaWdodCIgdmFsaWduPSJib3R0b20iPgoJPHNwYW4gY2xhc3M9ImFyaWFsIj5sYW5n dWFnZTo8L3NwYW4+CgkJICAgIDxhIGhyZWY9Ii9lbi8iPjxpbWcgc3JjPSIvZmxhZ3MvdXMuZ2lm IiB3aWR0aD0iMTYiIGhlaWdodD0iMTEiIGFsaWduPSJhYnNtaWRkbGUiICBhbHQ9IkVuZ2xpc2gi IHRpdGxlPSJFbmdsaXNoIiBib3JkZXI9IjAiLz48L2E+CgkJICAgIDxhIGhyZWY9Ii9lcy8iPjxp bWcgc3JjPSIvZmxhZ3MvZXMuZ2lmIiB3aWR0aD0iMTYiIGhlaWdodD0iMTEiIGFsaWduPSJhYnNt aWRkbGUiIGFsdD0iU3BhbmlzaCIgdGl0bGU9IlNwYW5pc2giIGJvcmRlcj0iMCIvPjwvYT4KCQkJ PGEgaHJlZj0iL3J1LyI+PGltZyBzcmM9Ii9mbGFncy9ydS5naWYiIHdpZHRoPSIxNiIgaGVpZ2h0 PSIxMSIgYWxpZ249ImFic21pZGRsZSIgYWx0PSIiIHRpdGxlPSIiIGJvcmRlcj0iMCIvPjwvYT4K CQkJPGEgaHJlZj0iL3B0LyI+PGltZyBzcmM9Ii9mbGFncy9ici5naWYiIHdpZHRoPSIxNiIgaGVp Z2h0PSIxMSIgYWxpZ249ImFic21pZGRsZSIgYWx0PSJQb3J0dWd1ZXNlIiB0aXRsZT0iUG9ydHVn dWVzZSIgYm9yZGVyPSIwIi8+PC9hPgoJCQk8YSBocmVmPSIvZnIvIiA+PGltZyBzcmM9Ii9mbGFn cy9mci5naWYiIHdpZHRoPSIxNiIgaGVpZ2h0PSIxMSIgYWxpZ249ImFic21pZGRsZSIgLyBhbHQ9 IkZyZW5jaCIgdGl0bGU9IkZyZW5jaCIgYm9yZGVyPSIwIi8+PC9hPgoJCQk8YSBocmVmPSIvZGUv IiA+PGltZyBzcmM9Ii9mbGFncy9kZS5naWYiIHdpZHRoPSIxNiIgaGVpZ2h0PSIxMSIgYWxpZ249 ImFic21pZGRsZSIgLyBhbHQ9Ikdlcm1hbiIgdGl0bGU9Ikdlcm1hbiIgYm9yZGVyPSIwIi8+PC9h PgoJCSAgICA8YSBocmVmPSIvemgvIj48aW1nIHNyYz0iL2ZsYWdzL2NuLmdpZiIgd2lkdGg9IjE2 IiBoZWlnaHQ9IjExIiBhbGlnbj0iYWJzbWlkZGxlIiAgYWx0PSJDaGluZXNlIiB0aXRsZT0iQ2hp bmVzZSIgYm9yZGVyPSIwIi8+PC9hPgoJCSAgICA8YSBocmVmPSIvaXQvIj48aW1nIHNyYz0iL2Zs YWdzL2l0LmdpZiIgd2lkdGg9IjE2IiBoZWlnaHQ9IjExIiBhbGlnbj0iYWJzbWlkZGxlIiAgYWx0 PSJJdGFsaWFuIiB0aXRsZT0iSXRhbGlhbiIgYm9yZGVyPSIwIi8+PC9hPgoJCTwvdGQ+CiAgPC90 cj4KICA8dHI+CiAgICA8dGQgaGVpZ2h0PSIzNSIgY29sc3Bhbj0iMiIgYmFja2dyb3VuZD0iL2lt YWdlcy9iZ19iYXIuZ2lmIiBiZ2NvbG9yPSIjOTk5OTk5IiBjbGFzcz0idGJsX3N0eWxlIj48dGFi bGUgd2lkdGg9Ijc2MCIgYm9yZGVyPSIwIiBjZWxsc3BhY2luZz0iMCIgY2VsbHBhZGRpbmc9IjAi PgogICAgICAgIDx0cj4KICAgICAgICAgIDx0ZCBhbGlnbj0iY2VudGVyIj48c3BhbiBjbGFzcz0i YXJpYWwxMyI+PHN0cm9uZz48YSBocmVmPSIvLyI+VmlldyBteSBJUCBpbmZvcm1hdGlvbjwvYT48 L3N0cm9uZz48L3NwYW4+PC90ZD4KICAgICAgICAgIDx0ZCB3aWR0aD0iNSIgYWxpZ249ImNlbnRl ciI+PGltZyBzcmM9Ii9pbWFnZXMvc2VwYXJhZG9yLmdpZiIgd2lkdGg9IjUiIGhlaWdodD0iMjgi IC8+PC90ZD4KICAgICAgICAgIDx0ZCBhbGlnbj0iY2VudGVyIj48c3BhbiBjbGFzcz0iYXJpYWwx MyI+PGEgaHJlZj0iLy9pcF9pbmZvLyI+TW9yZSBpbmZvIGFib3V0IElQczwvYT48L3NwYW4+PC90 ZD4KICAgICAgICAgIDx0ZCB3aWR0aD0iNSIgYWxpZ249ImNlbnRlciI+PGltZyBzcmM9Ii9pbWFn ZXMvc2VwYXJhZG9yLmdpZiIgd2lkdGg9IjUiIGhlaWdodD0iMjgiIC8+PC90ZD4KICAgICAgICAg IDx0ZCBhbGlnbj0iY2VudGVyIj48c3BhbiBjbGFzcz0iYXJpYWwxMyI+PGEgaHJlZj0iamF2YXNj cmlwdDphZGRFbmdpbmUoKTsiPkZpcmVmb3ggUGx1Z2luPC9hPjwvc3Bhbj48L3RkPgoJCSAgPHRk IHdpZHRoPSI1IiBhbGlnbj0iY2VudGVyIj48aW1nIHNyYz0iL2ltYWdlcy9zZXBhcmFkb3IuZ2lm IiB3aWR0aD0iNSIgaGVpZ2h0PSIyOCIgLz48L3RkPgoJCSAgPHRkIGFsaWduPSJjZW50ZXIiPjxz cGFuIGNsYXNzPSJhcmlhbDEzIj48YSBocmVmPSIvL29ubGluZS8iPk5vdyBvbmxpbmU8L2E+PC9z cGFuPjwvdGQ+CgkJICA8dGQgd2lkdGg9IjUiIGFsaWduPSJjZW50ZXIiPjxpbWcgc3JjPSIvaW1h Z2VzL3NlcGFyYWRvci5naWYiIHdpZHRoPSI1IiBoZWlnaHQ9IjI4IiAvPjwvdGQ+CgkJICA8dGQg YWxpZ249ImNlbnRlciI+PHNwYW4gY2xhc3M9ImFyaWFsMTMiPjxzdHJvbmc+PGEgaHJlZj0iLy93 ZWJ0b29scy8iPkluIHlvdXIgV2Vic2l0ZTwvYT48L3N0cm9uZz48L3NwYW4+PC90ZD4JCSAgCgkJ ICAKCQkgIAoJCTwvdHI+CiAgICA8L3RhYmxlPjwvdGQ+CiAgPC90cj4KPC90YWJsZT4KCgoKPHRh YmxlIHdpZHRoPSI3ODQiIGhlaWdodD0iNDAwIiBib3JkZXI9IjEiIGFsaWduPSJjZW50ZXIiIGNl bGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgYm9yZGVyY29sb3I9IiM5OTk5OTkiIGJhY2tn cm91bmQ9Ii9pbWFnZXMvYmcuZ2lmIiBiZ2NvbG9yPSIjMEE3MEI0Ij4KICA8dHI+CiAgICA8dGQg YWxpZ249ImNlbnRlciIgdmFsaWduPSJtaWRkbGUiIGJhY2tncm91bmQ9Ii9pbWFnZXMvYmcuZ2lm Ij4KCgkgPHRhYmxlIHdpZHRoPSI3NTAiIGJvcmRlcj0iMCIgY2VsbHNwYWNpbmc9IjAiIGNlbGxw YWRkaW5nPSIwIj4KICAgICAgICA8dHI+CiAgICAgICAgICA8dGQgYWxpZ249ImNlbnRlciIgdmFs aWduPSJ0b3AiPgoJCQkgCiAgICAgICAgICAgIDx0YWJsZSB3aWR0aD0iMzAwIiBib3JkZXI9IjAi IGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgY2xhc3M9InRibF9zdHlsZSI+CiAgICAg ICAgICAgICAgPHRyPgogICAgICAgICAgICAgICAgPHRkIGhlaWdodD0iNzAiIGFsaWduPSJjZW50 ZXIiPgoJCQkJCgkJCQkJPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPjwhLS0KCQkJCQln b29nbGVfYWRfY2xpZW50ID0gInB1Yi02NTYwODA0MTU1MTA0MDQxIjsKCQkJCQkvKiAyMzR4NjAs IGNyZWFkbyA3LzAyLzA4ICovCgkJCQkJZ29vZ2xlX2FkX3Nsb3QgPSAiNDk2NDc1OTkxMyI7CgkJ CQkJZ29vZ2xlX2FkX3dpZHRoID0gMjM0OwoJCQkJCWdvb2dsZV9hZF9oZWlnaHQgPSA2MDsKCQkJ CQkvLy0tPgoJCQkJCTwvc2NyaXB0PgoJCQkJCTxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0 IgoJCQkJCXNyYz0iaHR0cDovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9z aG93X2Fkcy5qcyI+CgkJCQkJPC9zY3JpcHQ+CgkJCQkKCQkJCQogICAgICAgICAgICAgIDwvdHI+ CiAgICAgICAgICAgIDwvdGFibGU+CgoJCQkgPHRhYmxlIHdpZHRoPSIzMDAiIGJvcmRlcj0iMCIg Y2VsbHBhZGRpbmc9IjMiIGNlbGxzcGFjaW5nPSIwIiBjbGFzcz0idGJsX3N0eWxlIj4KICAgICAg ICAgICAgICA8dHI+CgkJCQkgIDxmb3JtIG1ldGhvZD0iZ2V0IiBpZD0ic2VhcmNoZm9ybSJhY3Rp b249Ii8vIj4KICAgICAgICAgICAgICAgIDx0ZCBoZWlnaHQ9IjQwIiBhbGlnbj0iY2VudGVyIiB2 YWxpZ249Im1pZGRsZSI+PHNwYW4gY2xhc3M9ImFyaWFsX2JvbGQiPkhvc3QgLyBJUDo8L3NwYW4+ CiAgICAgICAgICAgICAgICAgIDxpbnB1dCBuYW1lPSJJUCIgdHlwZT0idGV4dCIgY2xhc3M9ImFy aWFsIiBpZD0iSVAiIHZhbHVlPSIiIHNpemU9IjE4IiAvPgogICAgICAgICAgICAgICAgICA8aW5w dXQgdHlwZT0ic3VibWl0IiBjbGFzcz0iYnRuX3NhcmNoIiB2YWx1ZT0iVmlldyBpbmZvIiAvPgog ICAgICAgICAgICAgICAgPC90ZD48L0ZPUk0+CiAgICAgICAgICAgICAgPC90cj4KICAgICAgICAg ICAgPC90YWJsZT4KICAgICAgICAgICAgPHRhYmxlIHdpZHRoPSIzMDAiIGhlaWdodD0iMzAwIiBi b3JkZXI9IjAiIGNlbGxwYWRkaW5nPSI0IiBjZWxsc3BhY2luZz0iMCIgY2xhc3M9InRibF9zdHls ZSI+CiAgICAgICAgICAgICAgPHRyPgogICAgICAgICAgICAgICAgPHRkIGFsaWduPSJyaWdodCI+ PHNwYW4gY2xhc3M9ImFyaWFsIj5Ib3N0IE5hbWU6PC9zcGFuPjwvdGQ+CiAgICAgICAgICAgICAg ICA8dGQgd2lkdGg9IjE5OCIgYWxpZ249ImxlZnQiIGNsYXNzPSJhcmlhbF9ib2xkIj4xNTItMTc0 LTE5LTE5MC5maWJlcnRlbC5jb20uYXI8L3RkPgogICAgICAgICAgICAgIDwvdHI+CiAgICAgICAg ICAgICAgPHRyPgogICAgICAgICAgICAgICAgPHRkIGFsaWduPSJyaWdodCI+PHNwYW4gY2xhc3M9 ImFyaWFsIj5JUCBBZGRyZXNzOjwvc3Bhbj48L3RkPgogICAgICAgICAgICAgICAgPHRkIGFsaWdu PSJsZWZ0IiBjbGFzcz0iYXJpYWxfYm9sZCI+MTkwLjE5LjE3NC4xNTI8L3RkPgogICAgICAgICAg ICAgIDwvdHI+CiAgICAgICAgICAgICAgPHRyPgogICAgICAgICAgICAgICAgPHRkIGFsaWduPSJy aWdodCI+PHNwYW4gY2xhc3M9ImFyaWFsIj5Db3VudHJ5Ojwvc3Bhbj48L3RkPgogICAgICAgICAg ICAgICAgPHRkIGFsaWduPSJsZWZ0IiBjbGFzcz0iYXJpYWxfYm9sZCI+PGEgaHJlZj0iaHR0cDov L2VuLndpa2lwZWRpYS5vcmcvd2lraS9hcmdlbnRpbmEiIHRhcmdldD0iX2JsYW5rIj4gQXJnZW50 aW5hPC9hPiA8aW1nIHNyYz0nL2ZsYWdzL2FyLmdpZicgYWx0PSJhcmdlbnRpbmEiIGFsaWduPSJh YnNtaWRkbGUiID48L3RkPgogICAgICAgICAgICAgIDwvdHI+CiAgICAgICAgICAgICAgPHRyPgog ICAgICAgICAgICAgICAgPHRkIGFsaWduPSJyaWdodCI+PHNwYW4gY2xhc3M9ImFyaWFsIj5Db3Vu dHJ5IGNvZGU6PC9zcGFuPjwvdGQ+CiAgICAgICAgICAgICAgICA8dGQgYWxpZ249ImxlZnQiIGNs YXNzPSJhcmlhbF9ib2xkIj5BUiAoQVJHKTwvdGQ+CiAgICAgICAgICAgICAgPC90cj4KICAgICAg ICAgICAgICA8dHI+CiAgICAgICAgICAgICAgICA8dGQgYWxpZ249InJpZ2h0Ij48c3BhbiBjbGFz cz0iYXJpYWwiPlJlZ2lvbjo8L3NwYW4+PC90ZD4KICAgICAgICAgICAgICAgIDx0ZCBhbGlnbj0i bGVmdCIgY2xhc3M9ImFyaWFsX2JvbGQiPjxhIGhyZWY9Imh0dHA6Ly9lbi53aWtpcGVkaWEub3Jn L3dpa2kvRGlzdHJpdG9fRmVkZXJhbCIgdGFyZ2V0PSJfYmxhbmsiPkRpc3RyaXRvIEZlZGVyYWw8 L2E+PC90ZD4KICAgICAgICAgICAgICA8L3RyPgogICAgICAgICAgICAgIDx0cj4KICAgICAgICAg ICAgICAgIDx0ZCBhbGlnbj0icmlnaHQiPjxzcGFuIGNsYXNzPSJhcmlhbCI+Q2l0eTo8L3NwYW4+ PC90ZD4KICAgICAgICAgICAgICAgIDx0ZCBhbGlnbj0ibGVmdCIgY2xhc3M9ImFyaWFsX2JvbGQi PkJ1ZW5vcyBBaXJlczwvdGQ+CiAgICAgICAgICAgICAgPC90cj4KICAgICAgICAgICAgICA8dHI+ CiAgICAgICAgICAgICAgICA8dGQgYWxpZ249InJpZ2h0Ij48c3BhbiBjbGFzcz0iYXJpYWwiPlBv c3RhbCBjb2RlOjwvc3Bhbj48L3RkPgogICAgICAgICAgICAgICAgPHRkIGFsaWduPSJsZWZ0IiBj bGFzcz0iYXJpYWxfYm9sZCI+PC90ZD4KICAgICAgICAgICAgICA8L3RyPgogICAgICAgICAgICAg IDx0cj4KICAgICAgICAgICAgICAgIDx0ZCBhbGlnbj0icmlnaHQiPjxzcGFuIGNsYXNzPSJhcmlh bCI+Q2FsbGluZyBjb2RlOjwvc3Bhbj48L3RkPgogICAgICAgICAgICAgICAgPHRkIGFsaWduPSJs ZWZ0IiBjbGFzcz0iYXJpYWxfYm9sZCI+PGEgaHJlZj0iaHR0cDovL2VuLndpa2lwZWRpYS5vcmcv d2lraS9BcmVhX2NvZGUjQXJnZW50aW5hIj4rNTQ8L2E+PC90ZD4KICAgICAgICAgICAgICA8L3Ry PgogICAgICAgICAgICAgIDx0cj4KICAgICAgICAgICAgICAgIDx0ZCBhbGlnbj0icmlnaHQiPjxz cGFuIGNsYXNzPSJhcmlhbCI+TG9uZ2l0dWRlOjwvc3Bhbj48L3RkPgogICAgICAgICAgICAgICAg PHRkIGFsaWduPSJsZWZ0IiBjbGFzcz0iYXJpYWxfYm9sZCI+LTU4LjY3MjU8L3RkPgogICAgICAg ICAgICAgIDwvdHI+CiAgICAgICAgICAgICAgPHRyPgogICAgICAgICAgICAgICAgPHRkIGFsaWdu PSJyaWdodCI+PHNwYW4gY2xhc3M9ImFyaWFsIj5MYXRpdHVkZTo8L3NwYW4+PC90ZD4KICAgICAg ICAgICAgICAgIDx0ZCBhbGlnbj0ibGVmdCIgY2xhc3M9ImFyaWFsX2JvbGQiPi0zNC41ODc1PC90 ZD4KICAgICAgICAgICAgICA8L3RyPgogICAgICAgICAgICA8L3RhYmxlPgo8L3RkPgogICAgICAg ICAgPHRkIGFsaWduPSJjZW50ZXIiIHZhbGlnbj0idG9wIj4KICAgICAgICAgIAogICAgICAgICAg ICA8dGFibGUgd2lkdGg9IjQ2OCIgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMCIgY2VsbHNwYWNp bmc9IjAiICBiZ2NvbG9yPSIjRkZGQ0UyIiBjbGFzcz0idGJsX2Jhc2ljIGFyaWFsMTQiPgogICAg ICAgICAgICAgIDx0cj4KICAgICAgICAgICAgICAgIDx0ZCBoZWlnaHQ9IjMwIiBhbGlnbj0iY2Vu dGVyIj4KICAgICAgICAgICAgICAgPGEgaHJlZj0iLy93ZWJ0b29scy8iPiBOZXcgdG9vbCBmb3Ig eW91ciBXZWIhIDwvYT4KICAgICAgICAgICAgICAgIDwvdGQ+CiAgICAgICAgICAgICAgPC90cj4K ICAgICAgICAgICAgPC90YWJsZT4KICAgICAgICAgIDx0YWJsZSB3aWR0aD0iNDY4IiBoZWlnaHQ9 IjMyNiIgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMCIgY2VsbHNwYWNpbmc9IjAiIGNsYXNzPSJ0 Ymxfc3R5bGUiPgogICAgICAgICAgICAgIDx0cj4KICAgICAgICAgICAgICAgIDx0ZCBhbGlnbj0i Y2VudGVyIiB2YWxpZ249InRvcCI+Cgk8ZGl2IGlkPSJtYXAiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpu b3dyYXA7IHdpZHRoOiA0NjhweDsgaGVpZ2h0OiAzMjZweCI+PC9kaXY+CjxzY3JpcHQgdHlwZT0i dGV4dC9qYXZhc2NyaXB0Ij48IS0tCmdvb2dsZV9hZF9jbGllbnQgPSAicHViLTY1NjA4MDQxNTUx MDQwNDEiOwovKiAgKi8KZ29vZ2xlX2FkX3Nsb3QgPSAiNjAxMDMzNzA4NSI7Cmdvb2dsZV9hZF93 aWR0aCA9IDQ2ODsKZ29vZ2xlX2FkX2hlaWdodCA9IDYwOwovLy0tPgo8L3NjcmlwdD4KPHNjcmlw dCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiCnNyYz0iaHR0cDovL3BhZ2VhZDIuZ29vZ2xlc3luZGlj YXRpb24uY29tL3BhZ2VhZC9zaG93X2Fkcy5qcyI+Cjwvc2NyaXB0PgoKICAgICAgICAgICAgICAg IDwvdGQ+CiAgICAgICAgICAgICAgPC90cj4KICAgICAgICAgIDwvdGFibGU+CgoJPC90ZD4KCSAg ICAgICAgPC90cj4KCSAgICA8L3RhYmxlPgoKCjwvdGQ+CiAgPC90cj4KPC90YWJsZT4KPHNjcmlw dCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPgoKCWZ1bmN0aW9uIGNyZWF0ZU1hcmtlcihwb2ludCxo dG1sKSB7CgkJdmFyIG1hcmtlciA9IG5ldyBHTWFya2VyKHBvaW50KTsKCQlHRXZlbnQuYWRkTGlz dGVuZXIobWFya2VyLCAiY2xpY2siLCBmdW5jdGlvbigpIHsKCQltYXJrZXIub3BlbkluZm9XaW5k b3dIdG1sKGh0bWwpOwoJCX0pOwoJCXJldHVybiBtYXJrZXI7CiAgICAgICAgfQoKCWlmIChHQnJv d3NlcklzQ29tcGF0aWJsZSgpKSB7CgkJdmFyIG1hcCA9IG5ldyBHTWFwKGRvY3VtZW50LmdldEVs ZW1lbnRCeUlkKCJtYXAiKSk7CgkJbWFwLmFkZENvbnRyb2wobmV3IEdMYXJnZU1hcENvbnRyb2wo KSk7CgkJbWFwLmFkZENvbnRyb2wobmV3IEdNYXBUeXBlQ29udHJvbCgpKTsKCQltYXAuY2VudGVy QW5kWm9vbShuZXcgR1BvaW50KC01OC42NzI1LCAtMzQuNTg3NSksIDEzKTsKCgkJCQl2YXIgcG9p bnQgPSBuZXcgR1BvaW50KC01OC42NzI1LCAtMzQuNTg3NSk7CgkJCXZhciBtYXJrZXIgPSBjcmVh dGVNYXJrZXIocG9pbnQsIjxkaXYgc3R5bGU9XCJmb250LWZhbWlseTpBcmlhbCxIZWx2ZXRpY2Es VGFob21hO2ZvbnQtc2l6ZToxMXB4O1wiIGFsaWduPVwibGVmdFwiPjxzdHJvbmc+Q2l0eTwvc3Ry b25nPjogQnVlbm9zIEFpcmVzPGJyPjxzdHJvbmc+Q291bnRyeTwvc3Ryb25nPjogQXJnZW50aW5h PGJyPjxzdHJvbmc+SVAgQWRkcmVzczwvc3Ryb25nPjogMTkwLjE5LjE3NC4xNTI8YnI+IDwvZGl2 PiIpCgkJCW1hcC5hZGRPdmVybGF5KG1hcmtlcik7CgkKCX0KCjwvc2NyaXB0PgoKPGRpdiBzdHls ZT0iaGVpZ2h0OiAzMHB4O3dpZHRoOjc4NnB4O3RleHQtYWxpZ246IGNlbnRlcjttYXJnaW46IDVw eCBhdXRvIDVweCBhdXRvOyI+CgoJPGRpdiBzdHlsZT0iZmxvYXQ6bGVmdDt3aWR0aDogNTUwcHg7 aGVpZ2h0OjMwcHg7cGFkZGluZy10b3A6NnB4Ij4KCgo8c2NyaXB0IHR5cGU9InRleHQvamF2YXNj cmlwdCI+KGZ1bmN0aW9uKCl7dmFyIHg9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyks IHM9ZG9jdW1lbnQuZ2V0RWxlbWVudHNCeVRhZ05hbWUoJ3NjcmlwdCcpWzBdO3guYXN5bmM9dHJ1 ZTt4LnNyYz0naHR0cDovL3dpZGdldHMuaXRhcmluZ2EubmV0L3NoYXJlLmpzJztzLnBhcmVudE5v ZGUuaW5zZXJ0QmVmb3JlKHgscyl9KSgpPC9zY3JpcHQ+Cjx0OnNoYXJlciBkYXRhLXVybD0iaHR0 cDovL3d3dy5nZW9pcHRvb2wuY29tLyIgZGF0YS1sYXlvdXQ9Im1lZGl1bV9jb3VudGVyIj48L3Q6 c2hhcmVyPgoKPGEgaHJlZj0iaHR0cHM6Ly90d2l0dGVyLmNvbS9zaGFyZSIgY2xhc3M9InR3aXR0 ZXItc2hhcmUtYnV0dG9uIiBkYXRhLXVybD0iaHR0cDovL3d3dy5nZW9pcHRvb2wuY29tLyIgIGRh dGEtaGFzaHRhZ3M9Ikdlb0lQVG9vbCI+VHdpdHRlYXI8L2E+CjxzY3JpcHQ+IWZ1bmN0aW9uKGQs cyxpZCl7dmFyIGpzLGZqcz1kLmdldEVsZW1lbnRzQnlUYWdOYW1lKHMpWzBdO2lmKCFkLmdldEVs ZW1lbnRCeUlkKGlkKSl7anM9ZC5jcmVhdGVFbGVtZW50KHMpO2pzLmlkPWlkO2pzLnNyYz0iLy9w bGF0Zm9ybS50d2l0dGVyLmNvbS93aWRnZXRzLmpzIjtmanMucGFyZW50Tm9kZS5pbnNlcnRCZWZv cmUoanMsZmpzKTt9fShkb2N1bWVudCwic2NyaXB0IiwidHdpdHRlci13anMiKTs8L3NjcmlwdD4K PGc6cGx1c29uZSBzaXplPSJtZWRpdW0iPjwvZzpwbHVzb25lPgo8c2NyaXB0IHR5cGU9InRleHQv amF2YXNjcmlwdCI+CiAgKGZ1bmN0aW9uKCkgewogICAgdmFyIHBvID0gZG9jdW1lbnQuY3JlYXRl RWxlbWVudCgnc2NyaXB0Jyk7IHBvLnR5cGUgPSAndGV4dC9qYXZhc2NyaXB0JzsgcG8uYXN5bmMg PSB0cnVlOwogICAgcG8uc3JjID0gJ2h0dHBzOi8vYXBpcy5nb29nbGUuY29tL2pzL3BsdXNvbmUu anMnOwogICAgdmFyIHMgPSBkb2N1bWVudC5nZXRFbGVtZW50c0J5VGFnTmFtZSgnc2NyaXB0Jylb MF07IHMucGFyZW50Tm9kZS5pbnNlcnRCZWZvcmUocG8sIHMpOwogIH0pKCk7Cjwvc2NyaXB0PgoK PGlmcmFtZSBzcmM9Ii8vd3d3LmZhY2Vib29rLmNvbS9wbHVnaW5zL2xpa2UucGhwP2hyZWY9aHR0 cCUzQSUyRiUyRnd3dy5nZW9pcHRvb2wuY29tJTJGJmFtcDtzZW5kPWZhbHNlJmFtcDtsYXlvdXQ9 YnV0dG9uX2NvdW50JmFtcDt3aWR0aD0xNTAmYW1wO3Nob3dfZmFjZXM9ZmFsc2UmYW1wO2FjdGlv bj1saWtlJmFtcDtjb2xvcnNjaGVtZT1saWdodCZhbXA7Zm9udCZhbXA7aGVpZ2h0PTIxJmFtcDth cHBJZD0yMjMwNTk2NDEwODI5OTYiIHNjcm9sbGluZz0ibm8iIGZyYW1lYm9yZGVyPSIwIiBzdHls ZT0iYm9yZGVyOm5vbmU7IG92ZXJmbG93OmhpZGRlbjsgd2lkdGg6MTUwcHg7IGhlaWdodDoyMXB4 OyIgYWxsb3dUcmFuc3BhcmVuY3k9InRydWUiPjwvaWZyYW1lPgoKCjxkaXYgc3R5bGU9ImZsb2F0 OnJpZ2h0O3dpZHRoOjU1cHgiPgo8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCI+PCEtLQpk b2N1bWVudC53cml0ZShWSy5TaGFyZS5idXR0b24oe3VybDogImh0dHA6Ly93d3cuZ2VvaXB0b29s LmNvbS8ifSx7dHlwZTogInJvdW5kIn0pKTsKLS0+PC9zY3JpcHQ+CjwvZGl2PgoKPC9kaXY+CgoJ PGRpdiBzdHlsZT0iZmxvYXQ6cmlnaHQiPgoJPGEgaHJlZj0iaHR0cDovL3d3dy53aXJvb3MuY29t IiB0aXRsZT0iSG9zdGluZywgQWxvamFtaWVudG8gd2ViLCBXZWJob3N0aW5nIiBhbHQ9Ikhvc3Rp bmcsIEFsb2phbWllbnRvIHdlYiwgV2ViaG9zdGluZyI+PGltZyBzcmM9Ii9pbWFnZXMvd2lyb29z XzIucG5nIiBib3JkZXI9IjAiIC8+PC9hPgoJPC9kaXY+CjwvZGl2PgoKPC9kaXY+Cgo8c2NyaXB0 IHNyYz0iaHR0cDovL3d3dy5nb29nbGUtYW5hbHl0aWNzLmNvbS91cmNoaW4uanMiIHR5cGU9InRl eHQvamF2YXNjcmlwdCI+Cjwvc2NyaXB0Pgo8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCI+ Cl91YWNjdCA9ICJVQS04Mjg3OC02IjsKdXJjaGluVHJhY2tlcigpOwo8L3NjcmlwdD4KCgo8YnIg Lz4KCjwvYm9keT4KPC9odG1sPgo=

Download
SHA256	8b05b0dbdc636c6012ef1cd9d989ee7a54d1b98b65d63a81e90141135b6b7b70
Referer
Magic	HyperText Markup Language (HTML)
Request	GET / HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: www.geoiptool.com Connection: Keep-Alive
Response Header	HTTP/1.1 200 OK Server: nginx/0.7.65 Date: Wed, 30 May 2012 00:45:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/5.2.17 Content-Encoding: gzip
Response Peek (128 B)	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html ...

netping.bounceme.net (8.23.224.90:80)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

/(2)

text/html

(2)

302 Found

0.0 B

05/30/12 01:15:11

/(3)

text/html

(3)

302 Found

0.0 B

05/30/12 01:17:17

/(4)

text/html

(4)

302 Found

0.0 B

05/30/12 01:17:34

/(5)

text/html

(5)

302 Found

0.0 B

05/30/12 01:19:41

/(6)

text/html

(6)

302 Found

0.0 B

05/30/12 01:20:09

/(7)

text/html

(7)

302 Found

0.0 B

05/30/12 01:21:36

/(8)

text/html

(8)

302 Found

0.0 B

05/30/12 01:21:46

/(9)

text/html

(9)

302 Found

0.0 B

05/30/12 01:24:50

/(10)

text/html

(10)

302 Found

0.0 B

05/30/12 01:25:57

/(11)

text/html

(11)

302 Found

0.0 B

05/30/12 01:27:18

/(12)

text/html

(12)

302 Found

0.0 B

05/30/12 01:27:56

/(13)

text/html

(13)

302 Found

0.0 B

05/30/12 01:29:50

/(14)

text/html

(14)

302 Found

0.0 B

05/30/12 01:32:52

/(15)

text/html

(15)

302 Found

0.0 B

05/30/12 01:36:17

/(16)

text/html

(16)

302 Found

0.0 B

05/30/12 01:40:57

/(17)

text/html

(17)

302 Found

0.0 B

05/30/12 01:41:04

/(18)

text/html

(18)

302 Found

0.0 B

05/30/12 01:42:19

/(19)

text/html

(19)

302 Found

0.0 B

05/30/12 01:42:40

/(20)

text/html

(20)

302 Found

0.0 B

05/30/12 01:44:12

/(21)

text/html

(21)

302 Found

0.0 B

05/30/12 01:44:51

/(22)

text/html

(22)

302 Found

0.0 B

05/30/12 01:47:05

/(23)

text/html

(23)

302 Found

0.0 B

05/30/12 01:47:27

/(24)

text/html

(24)

302 Found

0.0 B

05/30/12 01:49:26

/(25)

text/html

(25)

302 Found

0.0 B

05/30/12 01:50:48

/(26)

text/html

(26)

302 Found

0.0 B

05/30/12 01:53:26

/(27)

text/html

(27)

302 Found

0.0 B

05/30/12 01:57:55

/(28)

text/html

(28)

302 Found

0.0 B

05/30/12 02:02:26

/(29)

text/html

(29)

302 Found

0.0 B

05/30/12 02:02:56

/(30)

text/html

(30)

302 Found

0.0 B

05/30/12 02:05:41

/(31)

text/html

(31)

302 Found

0.0 B

05/30/12 02:07:56

/(32)

text/html

(32)

302 Found

0.0 B

05/30/12 02:10:26

/(33)

text/html

(33)

302 Found

0.0 B

05/30/12 02:22:03

/(34)

text/html

(34)

302 Found

0.0 B

05/30/12 02:26:07

/(35)

text/html

(35)

302 Found

0.0 B

05/30/12 02:28:16

/(36)

text/html

(36)

302 Found

0.0 B

05/30/12 02:34:29

/(37)

text/html

(37)

302 Found

0.0 B

05/30/12 02:36:46

/(38)

text/html

(38)

302 Found

0.0 B

05/30/12 02:39:00

/(39)

text/html

(39)

302 Found

0.0 B

05/30/12 02:40:52

/(40)

text/html

(40)

302 Found

0.0 B

05/30/12 02:51:06

/(41)

text/html

(41)

302 Found

0.0 B

05/30/12 02:52:28

/(42)

text/html

(42)

302 Found

0.0 B

05/30/12 02:54:52

/(43)

text/html

(43)

302 Found

0.0 B

05/30/12 02:56:03

/(44)

text/html

(44)

302 Found

0.0 B

05/30/12 03:02:56

/(45)

text/html

(45)

302 Found

0.0 B

05/30/12 03:05:02

/(46)

text/html

(46)

302 Found

0.0 B

05/30/12 03:06:26

/(47)

text/html

(47)

302 Found

0.0 B

05/30/12 03:06:50

/(48)

text/html

(48)

302 Found

0.0 B

05/30/12 03:08:17

/(49)

text/html

(49)

302 Found

0.0 B

05/30/12 03:08:22

/(50)

text/html

(50)

302 Found

0.0 B

05/30/12 03:10:28

/(51)

text/html

(51)

302 Found

0.0 B

05/30/12 03:11:53

/(52)

text/html

(52)

302 Found

0.0 B

05/30/12 03:13:58

/(53)

text/html

(53)

302 Found

0.0 B

05/30/12 03:14:16

/(54)

text/html

(54)

302 Found

0.0 B

05/30/12 03:16:33

/(55)

text/html

(55)

302 Found

0.0 B

05/30/12 03:16:35

/(56)

text/html

(56)

302 Found

0.0 B

05/30/12 03:18:21

/(57)

text/html

(57)

302 Found

0.0 B

05/30/12 03:18:40

/(58)

text/html

(58)

302 Found

0.0 B

05/30/12 03:19:33

/(59)

text/html

(59)

302 Found

0.0 B

05/30/12 03:21:12

/(60)

text/html

(60)

302 Found

0.0 B

05/30/12 03:22:17

/(61)

text/html

(61)

302 Found

0.0 B

05/30/12 03:23:34

/(62)

text/html

(62)

302 Found

0.0 B

05/30/12 03:24:58

/(63)

text/html

(63)

302 Found

0.0 B

05/30/12 03:25:15

/(64)

text/html

(64)

302 Found

0.0 B

05/30/12 03:27:15

/(65)

text/html

(65)

302 Found

0.0 B

05/30/12 03:30:56

/(66)

text/html

(66)

302 Found

0.0 B

05/30/12 03:31:45

/(67)

text/html

(67)

302 Found

0.0 B

05/30/12 03:32:45

/(68)

text/html

(68)

302 Found

0.0 B

05/30/12 03:33:34

/(69)

text/html

(69)

302 Found

0.0 B

05/30/12 03:34:48

/(70)

text/html

(70)

302 Found

0.0 B

05/30/12 03:35:56

/(71)

text/html

(71)

302 Found

0.0 B

05/30/12 03:36:00

/(72)

text/html

(72)

302 Found

0.0 B

05/30/12 03:38:06

/(73)

text/html

(73)

302 Found

0.0 B

05/30/12 03:38:23

/(74)

text/html

(74)

302 Found

0.0 B

05/30/12 03:40:17

/(75)

text/html

(75)

302 Found

0.0 B

05/30/12 03:41:24

/(76)

text/html

(76)

302 Found

0.0 B

05/30/12 03:43:07

/(77)

text/html

(77)

302 Found

0.0 B

05/30/12 03:43:15

/(78)

text/html

(78)

302 Found

0.0 B

05/30/12 03:45:18

/(79)

text/html

(79)

302 Found

0.0 B

05/30/12 03:45:30

/(80)

text/html

(80)

302 Found

0.0 B

05/30/12 03:46:50

/(81)

text/html

(81)

302 Found

0.0 B

05/30/12 03:46:55

/(82)

text/html

(82)

302 Found

0.0 B

05/30/12 03:47:53

/(83)

text/html

(83)

302 Found

0.0 B

05/30/12 03:47:58

/(84)

text/html

(84)

302 Found

0.0 B

05/30/12 03:52:18

/(85)

text/html

(85)

302 Found

0.0 B

05/30/12 03:53:02

/(86)

text/html

(86)

302 Found

0.0 B

05/30/12 03:53:47

/(87)

text/html

(87)

302 Found

0.0 B

05/30/12 03:55:46

/(88)

text/html

(88)

302 Found

0.0 B

05/30/12 03:56:54

/(89)

text/html

(89)

302 Found

0.0 B

05/30/12 03:57:34

/(90)

text/html

(90)

302 Found

0.0 B

05/30/12 03:59:17

/(91)

text/html

(91)

302 Found

0.0 B

05/30/12 03:59:17

/(92)

text/html

(92)

302 Found

0.0 B

05/30/12 04:00:55

/(93)

text/html

(93)

302 Found

0.0 B

05/30/12 04:01:21

/(94)

text/html

(94)

302 Found

0.0 B

05/30/12 04:02:18

/(95)

text/html

(95)

302 Found

0.0 B

05/30/12 04:03:27

/(96)

text/html

(96)

302 Found

0.0 B

05/30/12 04:05:42

100

/(97)

text/html

(97)

302 Found

0.0 B

05/30/12 04:06:25

101

/(98)

text/html

(98)

302 Found

0.0 B

05/30/12 04:08:34

102

/(99)

text/html

(99)

302 Found

0.0 B

05/30/12 04:09:30

103

/(100)

text/html

(100)

302 Found

0.0 B

05/30/12 04:10:05

104

/(101)

text/html

(101)

302 Found

0.0 B

05/30/12 04:12:43

105

/(102)

text/html

(102)

302 Found

0.0 B

05/30/12 04:14:31

106

/(103)

text/html

(103)

302 Found

0.0 B

05/30/12 04:14:39

107

/(104)

text/html

(104)

302 Found

0.0 B

05/30/12 04:16:17

108

/(105)

text/html

(105)

302 Found

0.0 B

05/30/12 04:17:02

109

/(106)

text/html

(106)

302 Found

0.0 B

05/30/12 04:18:18

110

/(107)

text/html

(107)

302 Found

0.0 B

05/30/12 04:18:38

111

/(108)

text/html

(108)

302 Found

0.0 B

05/30/12 04:20:05

112

/(109)

text/html

(109)

302 Found

0.0 B

05/30/12 04:21:02

113

/(110)

text/html

(110)

302 Found

0.0 B

05/30/12 04:21:11

114

/(111)

text/html

(111)

302 Found

0.0 B

05/30/12 04:22:25

115

/(112)

text/html

(112)

302 Found

0.0 B

05/30/12 04:25:20

116

/(113)

text/html

(113)

302 Found

0.0 B

05/30/12 04:25:32

117

/(114)

text/html

(114)

302 Found

0.0 B

05/30/12 04:26:28

118

/(115)

text/html

(115)

302 Found

0.0 B

05/30/12 04:29:13

119

/(116)

text/html

(116)

302 Found

0.0 B

05/30/12 04:31:00

120

/(117)

text/html

(117)

302 Found

0.0 B

05/30/12 04:33:46

121

/(118)

text/html

(118)

302 Found

0.0 B

05/30/12 04:34:54

122

/(119)

text/html

(119)

302 Found

0.0 B

05/30/12 04:35:02

123

/(120)

text/html

(120)

302 Found

0.0 B

05/30/12 04:36:37

124

/(121)

text/html

(121)

302 Found

0.0 B

05/30/12 04:37:58

125

/(122)

text/html

(122)

302 Found

0.0 B

05/30/12 04:39:02

126

/(123)

text/html

(123)

302 Found

0.0 B

05/30/12 04:39:05

127

/(124)

text/html

(124)

302 Found

0.0 B

05/30/12 04:41:48

128

/(125)

text/html

(125)

302 Found

0.0 B

05/30/12 04:43:18

129

/(126)

text/html

(126)

302 Found

0.0 B

05/30/12 04:43:53

130

/(127)

text/html

(127)

302 Found

0.0 B

05/30/12 04:44:48

131

/(128)

text/html

(128)

302 Found

0.0 B

05/30/12 04:45:59

132

/(129)

text/html

(129)

302 Found

0.0 B

05/30/12 04:48:43

133

/(130)

text/html

(130)

302 Found

0.0 B

05/30/12 04:49:59

134

/(131)

text/html

(131)

302 Found

0.0 B

05/30/12 04:51:17

135

/(132)

text/html

(132)

302 Found

0.0 B

05/30/12 04:51:19

136

/(133)

text/html

(133)

302 Found

0.0 B

05/30/12 04:52:22

137

/(134)

text/html

(134)

302 Found

0.0 B

05/30/12 04:52:24

138

/(135)

text/html

(135)

302 Found

0.0 B

05/30/12 04:53:50

139

/(136)

text/html

(136)

302 Found

0.0 B

05/30/12 04:53:51

140

/(137)

text/html

(137)

302 Found

0.0 B

05/30/12 04:55:12

141

/(138)

text/html

(138)

302 Found

0.0 B

05/30/12 04:55:50

142

/(139)

text/html

(139)

302 Found

0.0 B

05/30/12 04:57:48

143

/(140)

text/html

(140)

302 Found

0.0 B

05/30/12 04:58:19

144

/(141)

text/html

(141)

302 Found

0.0 B

05/30/12 05:00:00

145

/(142)

text/html

(142)

302 Found

0.0 B

05/30/12 05:00:31

146

/(143)

text/html

(143)

302 Found

0.0 B

05/30/12 05:02:40

147

/(144)

text/html

(144)

302 Found

0.0 B

05/30/12 05:02:42

148

/(145)

text/html

(145)

302 Found

0.0 B

05/30/12 05:05:21

149

/(146)

text/html

(146)

302 Found

0.0 B

05/30/12 05:06:25

150

/(147)

text/html

(147)

302 Found

0.0 B

05/30/12 05:08:27

151

/(148)

text/html

(148)

302 Found

0.0 B

05/30/12 05:09:55

152

/(149)

text/html

(149)

302 Found

0.0 B

05/30/12 05:10:47

153

/(150)

text/html

(150)

302 Found

0.0 B

05/30/12 05:13:28

154

/(151)

text/html

(151)

302 Found

0.0 B

05/30/12 05:16:26

155

/(152)

text/html

(152)

302 Found

0.0 B

05/30/12 05:18:49

156

/(153)

text/html

(153)

302 Found

0.0 B

05/30/12 05:19:18

157

/(154)

text/html

(154)

302 Found

0.0 B

05/30/12 05:20:26

158

/(155)

text/html

(155)

302 Found

0.0 B

05/30/12 05:21:52

159

/(156)

text/html

(156)

302 Found

0.0 B

05/30/12 05:22:59

160

/(157)

text/html

(157)

302 Found

0.0 B

05/30/12 05:23:09

161

/(158)

text/html

(158)

302 Found

0.0 B

05/30/12 05:24:34

162

/(159)

text/html

(159)

302 Found

0.0 B

05/30/12 05:25:11

163

/(160)

text/html

(160)

302 Found

0.0 B

05/30/12 05:26:30

164

/(161)

text/html

(161)

302 Found

0.0 B

05/30/12 05:26:57

165

/(162)

text/html

(162)

302 Found

0.0 B

05/30/12 05:28:22

166

/(163)

text/html

(163)

302 Found

0.0 B

05/30/12 05:30:50

167

/(164)

text/html

(164)

302 Found

0.0 B

05/30/12 05:31:05

168

/(165)

text/html

(165)

302 Found

0.0 B

05/30/12 05:32:35

169

/(166)

text/html

(166)

302 Found

0.0 B

05/30/12 05:35:29

170

/(167)

text/html

(167)

302 Found

0.0 B

05/30/12 05:36:34

171

/(168)

text/html

(168)

302 Found

0.0 B

05/30/12 05:38:06

172

/(169)

text/html

(169)

302 Found

0.0 B

05/30/12 05:40:45

173

/(170)

text/html

(170)

302 Found

0.0 B

05/30/12 05:43:35

174

/(171)

text/html

(171)

302 Found

0.0 B

05/30/12 05:45:21

175

/(172)

text/html

(172)

302 Found

0.0 B

05/30/12 05:50:01

176

/(173)

text/html

(173)

302 Found

0.0 B

05/30/12 05:50:35

177

/(174)

text/html

(174)

302 Found

0.0 B

05/30/12 05:52:35

178

/(175)

text/html

(175)

302 Found

0.0 B

05/30/12 05:53:01

179

/(176)

text/html

(176)

302 Found

0.0 B

05/30/12 05:54:23

180

/(177)

text/html

(177)

302 Found

0.0 B

05/30/12 05:55:37

181

/(178)

text/html

(178)

302 Found

0.0 B

05/30/12 05:56:52

182

/(179)

text/html

(179)

302 Found

0.0 B

05/30/12 05:57:17

183

/(180)

text/html

(180)

302 Found

0.0 B

05/30/12 05:58:48

184

/(181)

text/html

(181)

302 Found

0.0 B

05/30/12 06:01:34

185

/(182)

text/html

(182)

302 Found

0.0 B

05/30/12 06:02:23

186

/(183)

text/html

(183)

302 Found

0.0 B

05/30/12 06:03:21

187

/(184)

text/html

(184)

302 Found

0.0 B

05/30/12 06:05:29

188

/(185)

text/html

(185)

302 Found

0.0 B

05/30/12 06:07:47

189

/(186)

text/html

(186)

302 Found

0.0 B

05/30/12 06:09:26

190

/(187)

text/html

(187)

302 Found

0.0 B

05/30/12 06:09:50

191

/(188)

text/html

(188)

302 Found

0.0 B

05/30/12 06:11:22

192

/(189)

text/html

(189)

302 Found

0.0 B

05/30/12 06:14:24

193

/(190)

text/html

(190)

302 Found

0.0 B

05/30/12 06:16:55

194

/(191)

text/html

(191)

302 Found

0.0 B

05/30/12 06:16:57

195

/(192)

text/html

(192)

302 Found

0.0 B

05/30/12 06:20:04

196

/(193)

text/html

(193)

302 Found

0.0 B

05/30/12 06:22:33

197

/(194)

text/html

(194)

302 Found

0.0 B

05/30/12 06:23:08

198

/(195)

text/html

(195)

302 Found

0.0 B

05/30/12 06:24:27

199

/(196)

text/html

(196)

302 Found

0.0 B

05/30/12 06:24:47

200

/(197)

text/html

(197)

302 Found

0.0 B

05/30/12 06:27:01

201

/(198)

text/html

(198)

302 Found

0.0 B

05/30/12 06:27:09

202

/(199)

text/html

(199)

302 Found

0.0 B

05/30/12 06:29:09

203

/(200)

text/html

(200)

302 Found

0.0 B

05/30/12 06:30:08

204

/(201)

text/html

(201)

302 Found

0.0 B

05/30/12 06:32:03

205

/(202)

text/html

(202)

302 Found

0.0 B

05/30/12 06:34:17

206

/(203)

text/html

(203)

302 Found

0.0 B

05/30/12 06:34:36

207

/(204)

text/html

(204)

302 Found

0.0 B

05/30/12 06:37:35

208

/(205)

text/html

(205)

302 Found

0.0 B

05/30/12 06:39:38

209

/(206)

text/html

(206)

302 Found

0.0 B

05/30/12 06:39:45

210

/(207)

text/html

(207)

302 Found

0.0 B

05/30/12 06:42:11

211

/(208)

text/html

(208)

302 Found

0.0 B

05/30/12 06:42:52

212

/(209)

text/html

(209)

302 Found

0.0 B

05/30/12 06:44:37

213

/(210)

text/html

(210)

302 Found

0.0 B

05/30/12 06:45:20

214

/(211)

text/html

(211)

302 Found

0.0 B

05/30/12 06:47:56

215

/(212)

text/html

(212)

302 Found

0.0 B

05/30/12 06:49:26

216

/(213)

text/html

(213)

302 Found

0.0 B

05/30/12 06:49:35

217

/(214)

text/html

(214)

302 Found

0.0 B

05/30/12 06:51:40

218

/(215)

text/html

(215)

302 Found

0.0 B

05/30/12 06:54:37

219

/(216)

text/html

(216)

302 Found

0.0 B

05/30/12 06:54:42

220

/(217)

text/html

(217)

302 Found

0.0 B

05/30/12 06:56:00

221

/(218)

text/html

(218)

302 Found

0.0 B

05/30/12 06:56:51

222

/(219)

text/html

(219)

302 Found

0.0 B

05/30/12 06:58:05

223

/(220)

text/html

(220)

302 Found

0.0 B

05/30/12 06:58:35

224

/(221)

text/html

(221)

302 Found

0.0 B

05/30/12 07:00:27

225

/(222)

text/html

(222)

302 Found

0.0 B

05/30/12 07:00:52

226

/(223)

text/html

(223)

302 Found

0.0 B

05/30/12 07:02:27

227

/(224)

text/html

(224)

302 Found

0.0 B

05/30/12 07:03:49

228

/(225)

text/html

(225)

302 Found

0.0 B

05/30/12 07:05:05

229

/(226)

text/html

(226)

302 Found

0.0 B

05/30/12 07:05:24

230

/(227)

text/html

(227)

302 Found

0.0 B

05/30/12 07:07:06

231

/(228)

text/html

(228)

302 Found

0.0 B

05/30/12 07:07:29

232

/(229)

text/html

(229)

302 Found

0.0 B

05/30/12 07:09:39

233

/(230)

text/html

(230)

302 Found

0.0 B

05/30/12 07:09:51

234

/(231)

text/html

(231)

302 Found

0.0 B

05/30/12 07:11:37

235

/(232)

text/html

(232)

302 Found

0.0 B

05/30/12 07:13:32

236

/(233)

text/html

(233)

302 Found

0.0 B

05/30/12 07:14:49

237

/(234)

text/html

(234)

302 Found

0.0 B

05/30/12 07:15:30

238

/(235)

text/html

(235)

302 Found

0.0 B

05/30/12 07:17:05

239

/(236)

text/html

(236)

302 Found

0.0 B

05/30/12 07:17:13

240

/(237)

text/html

(237)

302 Found

0.0 B

05/30/12 07:18:58

241

/(238)

text/html

(238)

302 Found

0.0 B

05/30/12 07:19:50

242

/(239)

text/html

(239)

302 Found

0.0 B

05/30/12 07:21:46

243

/(240)

text/html

(240)

302 Found

0.0 B

05/30/12 07:23:35

244

/(241)

text/html

(241)

302 Found

0.0 B

05/30/12 07:24:05

245

/(242)

text/html

(242)

302 Found

0.0 B

05/30/12 07:25:25

246

/(243)

text/html

(243)

302 Found

0.0 B

05/30/12 07:25:25

247

/(244)

text/html

(244)

302 Found

0.0 B

05/30/12 07:28:00

248

/(245)

text/html

(245)

302 Found

0.0 B

05/30/12 07:30:18

249

/(246)

text/html

(246)

302 Found

0.0 B

05/30/12 07:30:26

250

/(247)

text/html

(247)

302 Found

0.0 B

05/30/12 07:31:46

251

/(248)

text/html

(248)

302 Found

0.0 B

05/30/12 07:32:50

252

/(249)

text/html

(249)

302 Found

0.0 B

05/30/12 07:33:20

253

/(250)

text/html

(250)

302 Found

0.0 B

05/30/12 07:35:11

254

/(251)

text/html

(251)

302 Found

0.0 B

05/30/12 07:35:47

255

/(252)

text/html

(252)

302 Found

0.0 B

05/30/12 07:36:27

256

/(253)

text/html

(253)

302 Found

0.0 B

05/30/12 07:38:51

257

/(254)

text/html

(254)

302 Found

0.0 B

05/30/12 07:39:21

258

/(255)

text/html

(255)

302 Found

0.0 B

05/30/12 07:40:48

259

/(256)

text/html

(256)

302 Found

0.0 B

05/30/12 07:41:12

260

/(257)

text/html

(257)

302 Found

0.0 B

05/30/12 07:42:38

261

/(258)

text/html

(258)

302 Found

0.0 B

05/30/12 07:43:16

262

/(259)

text/html

(259)

302 Found

0.0 B

05/30/12 07:44:27

263

/(260)

text/html

(260)

302 Found

0.0 B

05/30/12 07:45:40

264

/(261)

text/html

(261)

302 Found

0.0 B

05/30/12 07:46:11

265

/(262)

text/html

(262)

302 Found

0.0 B

05/30/12 07:49:50

266

/(263)

text/html

(263)

302 Found

0.0 B

05/30/12 07:50:53

267

/(264)

text/html

(264)

302 Found

0.0 B

05/30/12 07:51:51

268

/(265)

text/html

(265)

302 Found

0.0 B

05/30/12 07:53:01

269

/(266)

text/html

(266)

302 Found

0.0 B

05/30/12 07:53:21

270

/(267)

text/html

(267)

302 Found

0.0 B

05/30/12 07:54:19

271

/(268)

text/html

(268)

302 Found

0.0 B

05/30/12 07:55:13

272

/(269)

text/html

(269)

302 Found

0.0 B

05/30/12 07:55:51

273

/(270)

text/html

(270)

302 Found

0.0 B

05/30/12 07:56:37

274

/(271)

text/html

(271)

302 Found

0.0 B

05/30/12 07:58:19

275

/(272)

text/html

(272)

302 Found

0.0 B

05/30/12 08:00:28

276

/(273)

text/html

(273)

302 Found

0.0 B

05/30/12 08:02:02

277

/(274)

text/html

(274)

302 Found

0.0 B

05/30/12 08:02:09

278

/(275)

text/html

(275)

302 Found

0.0 B

05/30/12 08:04:44

279

/(276)

text/html

(276)

302 Found

0.0 B

05/30/12 08:04:46

280

/(277)

text/html

(277)

302 Found

0.0 B

05/30/12 08:06:28

281

/(278)

text/html

(278)

302 Found

0.0 B

05/30/12 08:07:43

282

/(279)

text/html

(279)

302 Found

0.0 B

05/30/12 08:07:55

283

/(280)

text/html

(280)

302 Found

0.0 B

05/30/12 08:09:04

284

/(281)

text/html

(281)

302 Found

0.0 B

05/30/12 08:09:05

285

/(282)

text/html

(282)

302 Found

0.0 B

05/30/12 08:10:06

286

/(283)

text/html

(283)

302 Found

0.0 B

05/30/12 08:10:38

287

/(284)

text/html

(284)

302 Found

0.0 B

05/30/12 08:11:29

288

/(285)

text/html

(285)

302 Found

0.0 B

05/30/12 08:14:21

289

/(286)

text/html

(286)

302 Found

0.0 B

05/30/12 08:15:40

290

/(287)

text/html

(287)

302 Found

0.0 B

05/30/12 08:17:51

291

/(288)

text/html

(288)

302 Found

0.0 B

05/30/12 08:19:19

292

/(289)

text/html

(289)

302 Found

0.0 B

05/30/12 08:21:42

293

/(290)

text/html

(290)

302 Found

0.0 B

05/30/12 08:22:11

294

/(291)

text/html

(291)

302 Found

0.0 B

05/30/12 08:23:47

295

/(292)

text/html

(292)

302 Found

0.0 B

05/30/12 08:24:31

296

/(293)

text/html

(293)

302 Found

0.0 B

05/30/12 08:27:17

297

/(294)

text/html

(294)

302 Found

0.0 B

05/30/12 08:28:23

298

/(295)

text/html

(295)

302 Found

0.0 B

05/30/12 08:30:37

299

/(296)

text/html

(296)

302 Found

0.0 B

05/30/12 08:30:45

300

/(297)

text/html

(297)

302 Found

0.0 B

05/30/12 08:31:57

301

/(298)

text/html

(298)

302 Found

0.0 B

05/30/12 08:32:58

302

/(299)

text/html

(299)

302 Found

0.0 B

05/30/12 08:34:28

303

/(300)

text/html

(300)

302 Found

0.0 B

05/30/12 08:34:56

304

/(301)

text/html

(301)

302 Found

0.0 B

05/30/12 08:36:12

305

/(302)

text/html

(302)

302 Found

0.0 B

05/30/12 08:37:17

306

/(303)

text/html

(303)

302 Found

0.0 B

05/30/12 08:38:34

307

/(304)

text/html

(304)

302 Found

0.0 B

05/30/12 08:40:33

308

/(305)

text/html

(305)

302 Found

0.0 B

05/30/12 08:41:18

309

/(306)

text/html

(306)

302 Found

0.0 B

05/30/12 08:43:08

310

/(307)

text/html

(307)

302 Found

0.0 B

05/30/12 08:43:51

311

/(308)

text/html

(308)

302 Found

0.0 B

05/30/12 08:44:56

312

/(309)

text/html

(309)

302 Found

0.0 B

05/30/12 08:45:36

313

/(310)

text/html

(310)

302 Found

0.0 B

05/30/12 08:46:55

314

/(311)

text/html

(311)

302 Found

0.0 B

05/30/12 08:47:21

315

/(312)

text/html

(312)

302 Found

0.0 B

05/30/12 08:48:31

316

/(313)

text/html

(313)

302 Found

0.0 B

05/30/12 08:49:35

317

/(314)

text/html

(314)

302 Found

0.0 B

05/30/12 08:49:47

318

/(315)

text/html

(315)

302 Found

0.0 B

05/30/12 08:51:15

319

/(316)

text/html

(316)

302 Found

0.0 B

05/30/12 08:52:17

320

/(317)

text/html

(317)

302 Found

0.0 B

05/30/12 08:53:46

321

/(318)

text/html

(318)

302 Found

0.0 B

05/30/12 08:54:02

322

/(319)

text/html

(319)

302 Found

0.0 B

05/30/12 08:54:54

323

/(320)

text/html

(320)

302 Found

0.0 B

05/30/12 08:55:22

324

/(321)

text/html

(321)

302 Found

0.0 B

05/30/12 08:57:09

325

/(322)

text/html

(322)

302 Found

0.0 B

05/30/12 08:57:33

326

/(323)

text/html

(323)

302 Found

0.0 B

05/30/12 08:58:58

327

/(324)

text/html

(324)

302 Found

0.0 B

05/30/12 09:00:04

328

/(325)

text/html

(325)

302 Found

0.0 B

05/30/12 09:01:20

329

/(326)

text/html

(326)

302 Found

0.0 B

05/30/12 09:01:26

330

/(327)

text/html

(327)

302 Found

0.0 B

05/30/12 09:03:46

331

/(328)

text/html

(328)

302 Found

0.0 B

05/30/12 09:04:11

332

/(329)

text/html

(329)

302 Found

0.0 B

05/30/12 09:05:54

333

/(330)

text/html

(330)

302 Found

0.0 B

05/30/12 09:06:36

334

/(331)

text/html

(331)

302 Found

0.0 B

05/30/12 09:08:44

335

/(332)

text/html

(332)

302 Found

0.0 B

05/30/12 09:10:05

336

/(333)

text/html

(333)

302 Found

0.0 B

05/30/12 09:10:18

337

/(334)

text/html

(334)

302 Found

0.0 B

05/30/12 09:11:43

338

/(335)

text/html

(335)

302 Found

0.0 B

05/30/12 09:11:42

339

/(336)

text/html

(336)

302 Found

0.0 B

05/30/12 09:13:17

340

/(337)

text/html

(337)

302 Found

0.0 B

05/30/12 09:14:31

341

/(338)

text/html

(338)

302 Found

0.0 B

05/30/12 09:15:51

342

/(339)

text/html

(339)

302 Found

0.0 B

05/30/12 09:17:00

343

/(340)

text/html

(340)

302 Found

0.0 B

05/30/12 09:18:25

344

/(341)

text/html

(341)

302 Found

0.0 B

05/30/12 09:19:06

345

/(342)

text/html

(342)

302 Found

0.0 B

05/30/12 09:25:19

346

/(343)

text/html

(343)

302 Found

0.0 B

05/30/12 09:26:20

347

/(344)

text/html

(344)

302 Found

0.0 B

05/30/12 09:27:32

348

/(345)

text/html

(345)

302 Found

0.0 B

05/30/12 09:29:06

349

/(346)

text/html

(346)

302 Found

0.0 B

05/30/12 09:29:31

350

/(347)

(347)

0.0 B

05/30/12 01:23:04

351

/(348)

(348)

0.0 B

05/30/12 01:30:05

352

/(349)

(349)

0.0 B

05/30/12 01:33:15

353

/(350)

(350)

0.0 B

05/30/12 01:34:31

354

/(351)

(351)

0.0 B

05/30/12 01:37:54

355

/(352)

(352)

0.0 B

05/30/12 01:38:56

356

/(353)

(353)

0.0 B

05/30/12 01:45:40

357

/(354)

(354)

0.0 B

05/30/12 01:49:02

358

/(355)

(355)

0.0 B

05/30/12 01:51:23

359

/(356)

(356)

0.0 B

05/30/12 01:52:45

360

/(357)

(357)

0.0 B

05/30/12 01:55:22

361

/(358)

(358)

0.0 B

05/30/12 01:56:11

362

/(359)

(359)

0.0 B

05/30/12 01:58:23

363

/(360)

(360)

0.0 B

05/30/12 01:59:59

364

/(361)

(361)

0.0 B

05/30/12 02:00:06

365

/(362)

(362)

0.0 B

05/30/12 02:12:18

366

/(363)

(363)

0.0 B

05/30/12 02:15:13

367

/(364)

(364)

0.0 B

05/30/12 02:17:08

368

/(365)

(365)

0.0 B

05/30/12 02:19:46

369

/(366)

(366)

0.0 B

05/30/12 02:23:39

370

/(367)

(367)

0.0 B

05/30/12 02:30:44

371

/(368)

(368)

0.0 B

05/30/12 02:32:31

372

/(369)

(369)

0.0 B

05/30/12 02:42:41

373

/(370)

(370)

0.0 B

05/30/12 02:44:52

374

/(371)

(371)

0.0 B

05/30/12 02:48:01

375

/(372)

(372)

0.0 B

05/30/12 02:57:45

376

/(373)

(373)

0.0 B

05/30/12 03:01:04

377

/(374)

(374)

0.0 B

05/30/12 03:03:38

378

/(375)

(375)

0.0 B

05/30/12 03:10:43

379

/(376)

(376)

0.0 B

05/30/12 03:22:33

380

/(377)

(377)

0.0 B

05/30/12 03:27:26

381

/(378)

(378)

0.0 B

05/30/12 03:29:03

382

/(379)

(379)

0.0 B

05/30/12 03:29:05

383

/(380)

(380)

0.0 B

05/30/12 03:49:42

384

/(381)

(381)

0.0 B

05/30/12 03:50:40

385

/(382)

(382)

0.0 B

05/30/12 03:55:23

386

/(383)

(383)

0.0 B

05/30/12 04:04:38

387

/(384)

(384)

0.0 B

05/30/12 04:07:52

388

/(385)

(385)

0.0 B

05/30/12 04:11:18

389

/(386)

(386)

0.0 B

05/30/12 04:22:45

390

/(387)

(387)

0.0 B

05/30/12 04:28:08

391

/(388)

(388)

0.0 B

05/30/12 04:30:24

392

/(389)

(389)

0.0 B

05/30/12 04:32:44

393

/(390)

(390)

0.0 B

05/30/12 04:40:44

394

/(391)

(391)

0.0 B

05/30/12 04:42:17

395

/(392)

(392)

0.0 B

05/30/12 04:46:31

396

/(393)

(393)

0.0 B

05/30/12 04:48:18

397

/(394)

(394)

0.0 B

05/30/12 05:05:07

398

/(395)

(395)

0.0 B

05/30/12 05:08:16

399

/(396)

(396)

0.0 B

05/30/12 05:11:54

400

/(397)

(397)

0.0 B

05/30/12 05:13:03

401

/(398)

(398)

0.0 B

05/30/12 05:16:12

402

/(399)

(399)

0.0 B

05/30/12 05:29:02

403

/(400)

(400)

0.0 B

05/30/12 05:33:46

404

/(401)

(401)

0.0 B

05/30/12 05:34:36

405

/(402)

(402)

0.0 B

05/30/12 05:38:56

406

/(403)

(403)

0.0 B

05/30/12 05:42:07

407

/(404)

(404)

0.0 B

05/30/12 05:45:02

408

/(405)

(405)

0.0 B

05/30/12 05:46:41

409

/(406)

(406)

0.0 B

05/30/12 05:47:37

410

/(407)

(407)

0.0 B

05/30/12 05:59:47

411

/(408)

(408)

0.0 B

05/30/12 06:05:43

412

/(409)

(409)

0.0 B

05/30/12 06:08:04

413

/(410)

(410)

0.0 B

05/30/12 06:12:43

414

/(411)

(411)

0.0 B

05/30/12 06:14:19

415

/(412)

(412)

0.0 B

05/30/12 06:20:01

416

/(413)

(413)

0.0 B

05/30/12 06:31:41

417

/(414)

(414)

0.0 B

05/30/12 06:36:24

418

/(415)

(415)

0.0 B

05/30/12 06:47:29

419

/(416)

(416)

0.0 B

05/30/12 06:52:38

420

/(417)

(417)

0.0 B

05/30/12 07:11:36

421

/(418)

(418)

0.0 B

05/30/12 07:21:42

422

/(419)

(419)

0.0 B

05/30/12 07:28:24

423

/(420)

(420)

0.0 B

05/30/12 07:47:33

424

/(421)

(421)

0.0 B

05/30/12 07:47:35

425

/(422)

(422)

0.0 B

05/30/12 07:58:50

426

/(423)

(423)

0.0 B

05/30/12 08:13:24

427

/(424)

(424)

0.0 B

05/30/12 08:16:06

428

/(425)

(425)

0.0 B

05/30/12 08:18:24

429

/(426)

(426)

0.0 B

05/30/12 08:25:44

430

/(427)

(427)

0.0 B

05/30/12 08:28:59

431

/(428)

(428)

0.0 B

05/30/12 08:37:19

432

/(429)

(429)

0.0 B

05/30/12 08:59:49

433

/(430)

(430)

0.0 B

05/30/12 09:08:45

434

/(431)

(431)

0.0 B

05/30/12 09:21:16

435

/(432)

(432)

0.0 B

05/30/12 09:22:06

436

/(433)

(433)

0.0 B

05/30/12 09:24:07

46.105.227.69 (46.105.227.69:80)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

/cmd.php

text/html

cmd.php

200 OK

0.0 B

05/30/12 01:15:16

glassandlock.co.uk (85.233.160.70:80)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

/html/admin/lol.exe

application/octet-stream

lol.exe

200 OK

EXE

2.6 KB

05/30/12 02:02:29

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAuAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v ZGUuDQ0KJAAAAAAAAACLI8Tbz0KqiM9CqojPQqqITF6kiM5CqoiAYKOIzUKqiPlkp4jOQqqIUmlj aM9CqogAAAAAAAAAAFBFAABMAQMArWrFTwAAAAAAAAAA4AAPAQsBBgAA0AAAAHAAAAAAAACQFAAA ABAAAADgAAAAAEAAABAAAAAQAAAEAAAABgAHAAQAAAAAAAAAAFABAAAQAACoTgIAAgAAAAAAEAAA EAAAAAAQAAAQAAAAAAAAEAAAAAAAAAAAAAAAFNEAACgAAAAA8AAAIFQAAAAAAAAAAAAAAFABAAgc AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAgAAIAAA AAAQAAA4AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALnRleHQAAABQxwAAABAAAADQAAAAEAAA AAAAAAAAAAAAAAAAIAAAYC5kYXRhAAAACAUAAADgAAAAEAAAAOAAAAAAAAAAAAAAAAAAAEAAAMAu cnNyYwAAACBUAAAA8AAAAGAAAADwAAAAAAAAAAAAAAAAAABAAABAhqECSBAAAAAAAAAAAAAAAE1T VkJWTTYwLkRMTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAA=

Download
SHA256	1ab759653c1a1e789805b43730c49469f28bbb7daad14b6135df7afdf2d18915
Referer
Magic	Windows executable file (EXE)
Request	GET /html/admin/lol.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: glassandlock.co.uk Connection: Keep-Alive
Response Header	HTTP/1.1 200 OK Server: Zeus/4.3 Content-Type: application/octet-stream Date: Wed, 30 May 2012 02:02:29 GMT Accept-Ranges: bytes Set-Cookie: X-Mapping-kjicghkc=EC29F43E3C591577CEF8786D49DA3F6B; path=/ Last-Modified: Wed, 30 May 2012 00:38:11 GMT Content-Length: 93192
HEX Peek (128 B)	0000 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 MZ.............. 0010 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@....... 0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0030 00 00 00 00 00 00 00 00 00 00 00 00 B8 00 00 00 ................ 0040 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 ........!..L.!Th 0050 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F is program canno 0060 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 t be run in DOS 0070 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 mode....$.......
PE Info	Meta-data ================================================================================ Size: 2642 bytes MD5: d5f675d2fa3cd488dc7741f38a314779 SHA1: b43ace5332ffe7beda37da66d17d0665261c0685 Date: 0x4FC56AAD [Wed May 30 00:32:45 2012 UTC] EP: 0x401490 .text 0/3 CRC: Claimed: 0x24ea8, Actual: 0xb9f7 [SUSPICIOUS] Sections ================================================================================ Name VirtAddr VirtSize RawSize Entropy -------------------------------------------------------------------------------- .text 0x1000 0xc750 0xd000 0.000000 .data 0xe000 0x508 0x1000 0.000000 .rsrc 0xf000 0x5420 0x6000 0.000000