MD5: 224758c0676fc26ceb4fdc6da35bfe14
SHA1: 79b94678068826376510b18be1e7252a034ce9ef
SHA256: a887eef3fdec32b3f992f39f8b8d5d944686d3748273d488b7a27ca1332c9bed
SSDeep: 49152:gRAVQ5kT5y86nED56FLFv03tivnsvD/DX y4onCYDoDBApGr:NU8CO56FLh03tIsvD/D donCYUGg
Size: 3219456 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: Borland International
Created at: 2011-01-01 17:41:24
Analyzed on: WindowsXPESX SP3 32-bit

Summary:

Backdoor. Malware that enables a remote control of victim's machine.

Payload

Process activity

The Backdoor creates the following process(es):

%original file name%.exe:1060

The Backdoor injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1060 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\foot_20141112[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\20141218[2].js (136 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@2345[1].txt (3007 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lazyloading[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\i_tmall[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index_20141217_01[2].css (3397 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\siteClicks[1].xml (250 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\siteClicks[2].xml (250 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@2345[2].txt (2111 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\mystyle_wait[1].gif (381 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo135x57[1].png (2717 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tip_stopXP_2[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\mz_toggle[2].png (986 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\skin0_20[1].png (1 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\lc[1].xml (126 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mz_1112_jhs_01[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bgs14[1].png (78 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\2345[2].htm (3901 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lazyloading[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\mz_pop[1].png (663 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\entertainChannel_20140903[1].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\func_20141215[1].js (2533 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (21208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico_ganji[1].png (167 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\mz_movie_3[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ico_amazon[1].png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2345[1] (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[1].php (8179 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\__indifference__[1].xml (510 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cert-cyberpolice_0829[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\2345[1].htm (3214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\wea_0829[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\body0_2[1].png (183 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\zx110_0829[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ajax[2].txt (328 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\main_spr_0829[1].png (975 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\blank[1].png (953 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ico_ganji[1].png (167 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cert-cyberpolice_0829[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\mz_movie_3[1].png (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@2345[3].txt (2037 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\baidu_web[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\google_web[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\kz_tmall_20141212[1].gif (7890 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mz_pop[1].png (663 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tipSet_ie6[1].png (731 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\data-userdata[1].xml (230 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\newsChannel_20140611[1].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index_20141217_01[1].css (3193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\baidu_web[2].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico_vipshop[2].png (439 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ico_amazon[1].png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\zjsVersion[2].js (292 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tip_stopXP_2[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\foot_20141112[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\func_20141215[1].js (1675 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2345_1201[1].eot (5161 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\data-userdata[1].xml (870 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\body0_2[1].png (183 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\go_top[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\index[1].php (8179 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\login_1217[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\i_tmall[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common_20140911[1].js (2536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\baidu_20141107[1].js (3000 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ico_taobao[1].png (958 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (670 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico_vipshop[1].png (439 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mz_taobao_1209[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bgs14[1].png (6 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ajax43[2].txt (335 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\common_20140911[1].js (15 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\__siteClicksTip__[1].xml (142 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\time[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cert-beian_0829[1].png (2 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\data-userdata[1].xml (652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\top_1022_2[1].png (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ajax43[1].txt (158 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\login_1217[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\skin0_20[1].png (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\time[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\myfav_0610[2].png (78 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\stopXPTime[1].xml (162 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\wc[1].xml (126 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\search_140829[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\w_day40[1].png (78 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\entertainChannel_20140903[1].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\kz_tmall_20141212[2].gif (9904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\mz_1112_jhs_01[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\20141218[1].js (136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\zx110_0829[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\google_web[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\input_20141218[1].js (10 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\__his__[1].xml (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\top_1022_2[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\myfav_0610[1].png (1653 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\topic_anquan_1011[1].png (2222 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20141210105941[1].jpg (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20141210105941[2].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\topic_anquan_1011[1].png (1347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico_suning[1].png (306 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\newsChannel_20140611[1].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\i_mz_travel_1103[1].png (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ajax[1].txt (154 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\mz_ic_tmall2[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\mz_taobao_1209[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ico_taobao[1].png (958 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\54511[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\search_140829[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mz_ic_tmall2[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\i_mz_travel_1103[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\go_top[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cert-beian_0829[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\zjsVersion[1].js (292 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ico_suning[1].png (306 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\mz_toggle[1].png (986 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218\index.dat (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\data-userdata[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico_vipshop[1].png (0 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\data-userdata[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\mz_1112_jhs_01[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\20141218[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@2345[3].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cert-cyberpolice_0829[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\zx110_0829[1].png (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\google_web[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\baidu_web[1].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@2345[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\top_1022_2[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\i_tmall[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\myfav_0610[1].png (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\2345[1].htm (0 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\siteClicks[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\go_top[1].png (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@2345[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218 (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\foot_20141112[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\newsChannel_20140611[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cert-beian_0829[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\skin0_20[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\topic_anquan_1011[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico_suning[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\login_1217[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lazyloading[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302 (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ajax[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ico_ganji[1].png (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ajax43[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\mz_movie_3[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ico_taobao[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\body0_2[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mz_taobao_1209[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\search_140829[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mz_ic_tmall2[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\i_mz_travel_1103[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bgs14[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\mz_pop[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\kz_tmall_20141212[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tip_stopXP_2[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\entertainChannel_20140903[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common_20140911[1].js (0 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\data-userdata[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\func_20141215[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index_20141217_01[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ico_amazon[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\mz_toggle[1].png (0 bytes)

Registry activity

The process %original file name%.exe:1060 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014121820141219]
"CacheOptions" = "11"
"CachePrefix" = ":2014121820141219:"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014121820141219]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014121820141219]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014121820141219\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1293896484"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014121820141219]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 1C 0F C8 1D 48 71 79 ED 25 51 3E 1D C3 97 EF"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Backdoor adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"auto" = "c:\%original file name%.exe"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013030120130302]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021120130218]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021820130225]

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: R
Product Name: ?????????? 2011
Product Version: 1.0.0.0
Legal Copyright: ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ??
Comments: ?????????? 2011
Language: Chinese (Simplified, PRC)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://42.62.30.180/time.txt?t=1418903256161
hxxp://42.62.30.180/time.txt?t=1418903264411
hxxp://42.62.30.180/css/index_20141217_01.css?v=5.28.1
hxxp://42.62.30.180/fonts/2345_1201.eot?
hxxp://42.62.30.180/images/logo135x57.png
hxxp://42.62.30.180/i/blank.png
hxxp://42.62.30.180/images/tipSet_ie6.png
hxxp://42.62.30.180/images/common/top_1022_2.png
hxxp://42.62.30.180/images/body0_2.png
hxxp://42.62.30.180/images/common/login_1217.png
hxxp://42.62.30.180/images/lazyloading.gif
hxxp://42.62.30.180/images/bgs14.png
hxxp://42.62.30.180/i/search0320/baidu_web.gif
hxxp://42.62.30.180/i/search0320/google_web.gif
hxxp://42.62.30.180/images/skin0_20.png
hxxp://42.62.30.180/images/common/search_140829.png
hxxp://42.62.30.180/right/homepage/zjsVersion.js?t=1418903269317
hxxp://42.62.30.180/right/homepage/zjsVersion.js?t=1418903269333
hxxp://42.62.30.180/css/func_20141215.js?ver=1.0
hxxp://42.62.30.180/css/input_20141218.js?ver=1.0
hxxp://union2.50bang.org/js/2345	42.62.4.61
hxxp://guess.union2.50bang.org/index.php?a2=1418903275130&ver=1.0	183.136.203.26
hxxp://42.62.30.180/images/kz_tmall_20141212.gif
hxxp://union2.50bang.org/web/2345?uId2=RSNVXNQSPV&r=&fBL=1024*768	42.62.4.61
hxxp://guess.union2.50bang.org/index.php?a2=1418903276239&ver=1.0	183.136.203.26
hxxp://42.62.30.180/i/topic_anquan_1011.png
hxxp://union2.50bang.org/web/ajax43?uId2=SPTNPQRLSX&r=http://www.2345.com/?6225&fBL=1024*768&lO=10188|9976|9986|10337|10338|10339|10189|10152|10265|10331|9751|10303|371|10301|10212|10251|7743|6796|8965|9681|10220|f2|f4|f999	42.62.4.61
hxxp://tianqi.2345.com/t/detect2009v2.php?ver=1.0	42.62.30.188
hxxp://42.62.30.180/right/homepage/newsChannel_20140611.js?t=1418869995&ver=11.18.13.2
hxxp://42.62.30.180/right/homepage/entertainChannel_20140903.js?t=1418882098&ver=1.0
hxxp://42.62.30.180/i/cert-beian_0829.png
hxxp://42.62.30.180/i/cert-cyberpolice_0829.png
hxxp://42.62.30.180/i/zx110_0829.png
hxxp://42.62.30.180/images/ico_taobao.png
hxxp://42.62.30.180/images/mz_taobao_1209.png
hxxp://42.62.30.180/images/mz_movie_3.png
hxxp://union2.50bang.org/web/ajax?uId2=SPTNPQRLSX&r=http://www.2345.com/?6225&fBL=1024*768&lO=detected	42.62.4.61
hxxp://42.62.30.180/images/i_mz_travel_1103.png
hxxp://42.62.30.180/images/mz_ic_tmall2.png
hxxp://42.62.30.180/images/mz_pop.png
hxxp://42.62.30.180/images/ico_ganji.png
hxxp://42.62.30.180/images/mz_toggle.png
hxxp://42.62.30.180/images/mz_1112_jhs_01.gif
hxxp://42.62.30.180/images/ico_amazon.png
hxxp://42.62.30.180/images/ico_suning.png
hxxp://42.62.30.180/images/ico_vipshop.png
hxxp://42.62.30.180/images/i_tmall.png
hxxp://42.62.30.180/images/go_top.png
hxxp://42.62.30.180/images/foot_20141112.png
hxxp://42.62.30.180/css/baidu_20141107.js?ver=1.0
hxxp://www.2345.com/css/index_20141217_01.css?v=5.28.1
hxxp://www.2345.com/i/zx110_0829.png
hxxp://www.2345.com/i/cert-beian_0829.png
hxxp://www.2345.com/images/mz_toggle.png
hxxp://www.2345.com/images/lazyloading.gif
hxxp://www.2345.com/images/logo135x57.png
hxxp://www.2345.com/images/common/login_1217.png
hxxp://www.2345.com/images/ico_ganji.png
hxxp://www.2345.com/images/common/top_1022_2.png
hxxp://www.2345.com/i/blank.png
hxxp://www.2345.com/i/search0320/google_web.gif
hxxp://www.2345.com/right/homepage/newsChannel_20140611.js?t=1418869995&ver=11.18.13.2
hxxp://www.2345.com/css/input_20141218.js?ver=1.0
hxxp://www.2345.com/images/ico_suning.png
hxxp://www.2345.com/images/ico_amazon.png
hxxp://www.2345.com/images/mz_taobao_1209.png
hxxp://www.2345.com/images/mz_1112_jhs_01.gif
hxxp://www.2345.com/images/ico_taobao.png
hxxp://www.2345.com/time.txt?t=1418903256161
hxxp://www.2345.com/images/ico_vipshop.png
hxxp://www.2345.com/images/mz_movie_3.png
hxxp://www.2345.com/i/search0320/baidu_web.gif
hxxp://www.2345.com/images/go_top.png
hxxp://www.2345.com/images/i_tmall.png
hxxp://www.2345.com/css/func_20141215.js?ver=1.0
hxxp://www.2345.com/right/homepage/entertainChannel_20140903.js?t=1418882098&ver=1.0
hxxp://www.2345.com/images/mz_ic_tmall2.png
hxxp://www.2345.com/images/kz_tmall_20141212.gif
hxxp://www.2345.com/i/cert-cyberpolice_0829.png
hxxp://www.2345.com/i/topic_anquan_1011.png
hxxp://www.2345.com/images/i_mz_travel_1103.png
hxxp://www.2345.com/images/body0_2.png
hxxp://www.2345.com/images/bgs14.png
hxxp://www.2345.com/right/homepage/zjsVersion.js?t=1418903269317
hxxp://www.2345.com/images/mz_pop.png
hxxp://www.2345.com/right/homepage/zjsVersion.js?t=1418903269333
hxxp://www.2345.com/images/tipSet_ie6.png
hxxp://www.2345.com/time.txt?t=1418903264411
hxxp://www.2345.com/images/skin0_20.png
hxxp://www.2345.com/images/common/search_140829.png
hxxp://www.2345.com/css/baidu_20141107.js?ver=1.0
hxxp://www.2345.com/images/foot_20141112.png
hxxp://www.2345.com/fonts/2345_1201.eot?

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /images/kz_tmall_20141212.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

...0............i.<.`.a.=|.BD.W-.%........'..>..p..;....Ca.]$u..
u...C....fl....Y%S...........y.....vV..b....^..9..,L....F.S..Y........
...r...W..,........k..De.R .!.....i.,D...$.......i.............9((....
,.(......(........(....,.......i.....i.!..(i...9...!..........(,....!.
,.....0.9....!..0.....0............i.<.`.a.=|.BD.W-.%........'..>
;..p..;....Ca.]$u...8......36.D....)QU..........y.....P......W.jN. ...
..`4.:.E..W...........r..'...hUm...m...^*....!.....i.,D...$.......i...
..........9((....,.(......(........(....,.......i.....i.!..(i...9...!.
.........(,....!.,.....0.9....!..0.....0............i.<.`.a..H...r.
"R.ji..(8.....>..H..)..0.J3...w..........0.d5..Iw.N.DUa...........w
.NNCU..Gj@_..9..,L.....@kI...... ...... ...O..p......\.l..dZ)..!.....i
.,D...$.......i.............9((....,.(......(........(....,.......i...
..i.!..(i...9...!..........(,....!.,.....0.9....!..0.....0............
i.<.`.a..H...r."R.ji..(8.....>..H..)..0.J3...w..........0.d5..Iw
.N.D.............w.NNCU!.,....2wsZ.Y.X.........z0P............R....K..
`$U.:..:.,..< ...!.....i.,D...$.......i.............9((....,.(.....
.(........(....,.......i.....i.!..(i...9...!..........(,....!.,.....0.
9....!..0.....0............i.<.`.a..H...r."R.ji..(8.....p...*..S(.q
.8...w......C...Y.J....Y'Wv.......>..y.....PU.1k.9.....VA.&.,`p.``.
..,<.(..W....b....)G.....z0..M.``.K........!.....i.,D...$.......i..
...........9((....,.(......(........(....,.......i.....i.!..(i...9...!
..........(,....!.,.....0.HTTP/1.1 200 OK..Date: Thu, 18 Dec 2014 
<<< skipped >>>

GET /images/mz_taobao_1209.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

GET /images/mz_taobao_1209.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:40 GMT

Server: Apache

Last-Modified: Tue, 09 Dec 2014 11:29:02 GMT

ETag: "b9d-509c6d992bb80"

Accept-Ranges: bytes

Content-Length: 2973

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:40 GMT

Keep-Alive: timeout=5, max=99

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR...$...F.............tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:B1A022F47F9211E4A156854C
72ECD771" xmpMM:DocumentID="xmp.did:B1A022F57F9211E4A156854C72ECD771"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B1A022F27F9211E4A1
56854C72ECD771" stRef:documentID="xmp.did:B1A022F37F9211E4A156854C72EC
D771"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.. .....PLTE.f.....3..............z".]3....
k..N!.......W [email protected]#.9.........y.......G......
s.u.....[1.....b.|$.............X-.d<.U)...../..B.lE.c:............
...........p..w....a8.....v..d._5.......Q%..,.....]..n..]..}.f=..{..p.
....}..............Q...........h..........nH.....f....B.....nG........
...8.Z/.jC....J..rM....uP....pJ..@..........._..I.vR..m.............g?
.....H..S....iA..*.....r..........w......h.......x...L.....\.....Y....
.`..m....F..W,.H........}&....D......Z..|..~.....t........J.......~(..
.....`7.~[.rL.....b.;...<.....3.....W.xT....t...............^..
<<< skipped >>>

GET /images/ico_amazon.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

.Q.!.....e.CM.O...?.n........2.E.%..(....d......h'gG=V..6L.y..8..6kK}.
..H..%.YGlAM.k...;.....>1....F,c\#.d-..q@{......8..h.`]b....v.Y8.5&
lt;)/6.....e..I.A'..Y..Q...&.p.u.}2...x.Oo.o.b....2.\M~..u..h.i>.Gv
..-%..%.....n.J.d.O4...........l...I...c.q...sBcGG._ F0.*.}.p..{%.U...
Q.h..1|..4.MG..%.Ga..5.w.db.07i(......p;.H..5.U...A....9.&:..ekn)..}hh
"T..;2i.._.Ev..ygs.......B..........{vW.......IEND.B`.

GET /index.php?a2=1418903276239&ver=1.0 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: guess.union2.50bang.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:07 GMT

Server: Apache

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR

Cache-Control: max-age=86400

Expires: Fri, 19 Dec 2014 16:57:07 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: application/x-javascript;charset=gbk
2af0..T.gul && T.gul.init([{"category":{"name":"\u6e38\u620f","url":"h
ttp:\/\/game.2345.com\/","flid":"f2"},"sites":[{"name":"\u4e00\u520099
9\u7ea7","url":"http:\/\/VVV.602.com\/poster\/59.html?uid=2345cpc&
suid=zlcq","ggid":10188,"mrid":"m0"},{"name":"\u88c5\u5907\u5168\u9760
\u6253","url":"http:\/\/baidu.code.junminshuiku.com\/htmlcode\/594.htm
l","ggid":9976,"mrid":"m0"},{"name":"\u975eRMB\u7f51\u6e38","url":"htt
p:\/\/mx.jzyx.com\/home\/ad?ad_id=251496","ggid":9986,"mrid":"m0"},{"n
ame":"\u70ed\u8840\u4f20\u5947","url":"http:\/\/cdn.9377.com\/welcome.
html?id=5034","ggid":10337,"mrid":"m0"},{"name":"\u6728\u74dc\u5947\u8
ff9","url":"http:\/\/cdn.9377.com\/welcome.html?id=5036","ggid":10338,
"mrid":"m0"},{"name":"\u9b45\u5f71\u4f20\u8bf4","url":"http:\/\/cdn.93
77.com\/welcome.html?id=5032","ggid":10339,"mrid":"m0"},{"name":"\u4f2
0\u59471.76","url":"http:\/\/VVV.602.com\/poster\/57.html?uid=2345cpc&
amp;suid=mycs","ggid":10189,"mrid":"m0"},{"name":"\u6302\u673a\u6ee1\u
7ea7","url":"http:\/\/cdn.9377.com\/welcome.html?id=4262","ggid":9853,
"mrid":"m0"},{"name":"\u72c2\u64b8BOSS","url":"http:\/\/g.qqq937.com\/
s\/1\/728\/19634.html?uid=515372","ggid":10341,"mrid":"m0"},{"name":"\
u6c38\u6052\u5947\u8ff9","url":"http:\/\/cdn.9377.com\/welcome.html?id
=5035","ggid":9938,"mrid":"m0"},{"name":"\u88c5\u5907\u65e0\u9650\u638
9","url":"http:\/\/mx.jzyx.com\/home\/wmad?ad_id=251870","ggid":9770,"
mrid":"m0"},{"name":"\u5c71\u6d77\u7ecf","url":"http:\/\/g.qqq937.com\
/s\/1\/728\/20572.html?uid=515572","ggid":10340,"mrid":"m0"},{"nam
<<< skipped >>>

GET /right/homepage/newsChannel_20140611.js?t=1418869995&ver=11.18.13.2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:35 GMT

Server: Apache

Last-Modified: Thu, 18 Dec 2014 16:51:29 GMT

ETag: "1a3a-50a806750e640"

Accept-Ranges: bytes

Cache-Control: max-age=1296000

Expires: Fri, 02 Jan 2015 16:57:35 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1518

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: application/javascript
...........X.O.G..W. U...}?..J.!$MB"."...n..Ss...I.......s.p.5?ds...g.
y|3{.Y.......0.....w..3....`.........f...bX....7.....I1..q!..F]..8..q.
..>.:.....b.-..\iE...e..&.t.'&.:...b....rg...J.:..lO.;..W.P....,x..
.n'....J..t\......Xm1|.w(..gG.0...g......b6.M...W.P.E(]1........... ..
...{.U.X..* XCLg8.....xv...`...j...X."[email protected]...%..h....GU.. }... .....
.%.M2... ._y8...z..~.v....E....wD....3...I9#...7.:$...J..4..k..3:....#
.....,&'.7...-..._.!.....z1..V......Z.`....Q_.g....R.y.U..~.v.#....>
;xj..4..Z.Y./....b.....D.*...X..a1M..."[email protected]:.....-.
.............L6=.n\N.!!Z...{.p\...>...7....M.]~.as.......P ...#....
....o.%!.R...80......U..c).Ms...tuy&&Fe......:...b Az... .v..........o
.....l.........E#0,.......a.4....%..ET......,.."....?..T.........?..b.
a.f..".......q..U..Xz#2.En.V.V....:!......I".W......X<...Em..S..L..
.D.b..R....R6K..]..SE,...,.8.T.V@.)...[...E......."[V.3........4\.....
X..P.4....R.`...Q..qr.gW.|.....J]..s.U...$..d~...%...t.t.Uj8.....p....
{^I...*..*..%..22D....6....r&._ir}'-J.QvG..u... .F.N...".,...S......&}
@.D"..6.^i...,...<......v............F....M.RW......y.Hl...<..O.
FZg...B........1.5.<?$....eJF.S...%..-.}..\$...9......?Rq... ..dw..
.,....V...(.<x. B.d.L......B#.e.R.]...x{.._..H............/.....69.
T......v]...z:.ccP....P...f.0t.m..18S.QX..u.f.m.NRa..6^.I.d.....6^<
.tZ..;.Y,..VFH.%.A%.M...HH.Dfh.L2.Z4Q.lM..hP.;.6j...Ul.D..;.Z:E...^.$.
,.Z...j..kskgRRD.\..278}iD.]..]QT.VA.Sx'BK.....Kc.\U...H.f.. ..fk1....
I...m.4.....h..;.Z:...._.....n..)nY.E.<..7..6)...............F~
<<< skipped >>>

GET /right/homepage/entertainChannel_20140903.js?t=1418882098&ver=1.0 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:35 GMT

Server: Apache

Last-Modified: Thu, 18 Dec 2014 16:30:02 GMT

ETag: "1bf6-50a801a9ad680"

Accept-Ranges: bytes

Cache-Control: max-age=1296000

Expires: Fri, 02 Jan 2015 16:57:35 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1458

Keep-Alive: timeout=5, max=99

Connection: Keep-Alive

Content-Type: application/javascript
...........X.n#7....O-..%..M.._.[.....v.v.d."[..K.../...Y.Ql..!)...._.
m_........mY_.....?..-....&^...6....;....qS.)...S......?7.f..u.J...a.O
g...3.4/>..y1`...c.^......\....v...e..og.fi...........TQsAG..\...z.
o..&..~M...`J..lF.u..p*zE{46..g.-....4s.Y\=?.....b.7....<.Ei...f...
...E.J.!.....!..).0A........*.K.&..\*[email protected]|..{..}.(.....4.x
P.s>...4.ZK...F{.o.^].D.$Y..so..A5..1&.eQ.d.L.....Fr^.....x:....Z.x
..x"oX<o5....wn!k...y.'1.c...}.W`..<`.-E..F;|....-.Y.1....,.....
}[email protected]..,...!.J..1.mM.*"DrTW..].y.j...[.........
$!....rX'<..rpYE.L1.eZ.3.....H..%/...u.]..g:'.I.......@*c..;T..S..N
QX....*m...e0.2XIc..\..I<.V.j.U...gVg0.CGt.&t...V.j......E...HS5...
..szW.\..Y.......3_b..r.W.5......%.*E..d<.0O....M.A2.{.~N....~._@N.
.7.&..S.z..e...=y. a.M.) j".....ePr..4..E2.`;I.r....I\...........H....
....*]......]Ar.........w..w....a.x]....p..4.S....".0(.....AQ2..BN....
..:...j8...vM".b......w..E.0. ih........;9.$.bUl..9...A...B.*.L....'Y.
.b5l.Zc/|.....8..E....1(.$.`k.s.v(....o,..".R.v..!$..q......D.j4...ZS.
|\.....d...8. .....P....2mX:....z.rB6.f..2.y.,....wsl....QL.?d...w....
.j.X.a.@p...).d..KZp.B....f.......&Nj.!M.)..eg.............?w[=...}A..
...m$.S..G...d.A....:.}.................4.....D...]%.5?...8....BR..V..
...>}....XX.A..."-y.-.u..f..M....Xk.}..)..g... [email protected]].Ia..../.@.
.o|(.p..!..'.e.i...[`.n~.}.I]...'1.m..4...T.}....cgA6.JH.FF!Ck.V.....j
... O7..>.....3..V.e'?>.A)~..b..6S....L....*4?...... ."[:#u.>
S.m..!$.2r......`f..........
<<< skipped >>>

GET /i/cert-beian_0829.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:36 GMT

Server: Apache

Last-Modified: Wed, 10 Sep 2014 06:11:23 GMT

ETag: "888-502afebd9b8c0"

Accept-Ranges: bytes

Content-Length: 2184

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:36 GMT

Keep-Alive: timeout=5, max=98

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:E434EB51324E11E4A4029D98
459EA8DB" xmpMM:DocumentID="xmp.did:E434EB52324E11E4A4029D98459EA8DB"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E434EB4F324E11E4A4
029D98459EA8DB" stRef:documentID="xmp.did:E434EB50324E11E4A4029D98459E
A8DB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>F.......PLTE...gggrrr.....................h
hh........................................D..F.....`..-...........M..\
......<.............^.........J.....5....~........7......r........l
.....-.................^.q.........l........].g.....s........Q..y.....
x......>....A...N....W.....M......(......................I..u......
......b...................&..'...........9......U..............`....n.
..........>.................M...K....o.....p...........v.."...>.
..................u.....................9....Q...e."........{..z.....{
..................H.............=......=........................ii
<<< skipped >>>

GET /i/cert-cyberpolice_0829.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:36 GMT

Server: Apache

Last-Modified: Wed, 10 Sep 2014 06:11:23 GMT

ETag: "939-502afebd9b8c0"

Accept-Ranges: bytes

Content-Length: 2361

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:36 GMT

Keep-Alive: timeout=5, max=97

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:F0A3CEA7324E11E4AD06B19B
7D68C118" xmpMM:DocumentID="xmp.did:F0A3CEA8324E11E4AD06B19B7D68C118"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F0A3CEA5324E11E4AD
06B19B7D68C118" stRef:documentID="xmp.did:F0A3CEA6324E11E4AD06B19B7D68
C118"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>........PLTEgggrrr............hhh..........
.............t..v...qp......{....!.......CBI.....fC@IFMS...........}k.
...............nf....a....."...C>.JE<.........OML...............
...O.......}......oh......}./C9;Asq....%&6w..^..TTf......o..m..pj.^\e.
.{|..wkl.....33..43.;7.....D3......&A]..................IKIc........_x
..... ......................bc`.................n.........m..?B.......
|xw............g..........jQNM{wr.1D...R[_...vup..................( ..
......#8......~qk.............?LNMC......rm.ae..LJ.........bk.\.....91
5~..>.....i.....z...........JH|4.h............zmV..............
<<< skipped >>>

GET /i/zx110_0829.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:37 GMT

Server: Apache

Last-Modified: Wed, 10 Sep 2014 06:11:23 GMT

ETag: "964-502afebd9b8c0"

Accept-Ranges: bytes

Content-Length: 2404

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:37 GMT

Keep-Alive: timeout=5, max=96

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:EB0FAE11324E11E4AF348FBF
63CE8F4C" xmpMM:DocumentID="xmp.did:EB0FAE12324E11E4AF348FBF63CE8F4C"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EB0FAE0F324E11E4AF
348FBF63CE8F4C" stRef:documentID="xmp.did:EB0FAE10324E11E4AF348FBF63CE
8F4C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.".s....PLTE..U.C.....c..)~.P...Z..b..%..v.
.s.:...=..[..T..:...gggrrr......hhh.................>...=..N....qL.
..Z...6.g.._.Q.......<X.l q....X..r..R..j..m...J.......F.....L.....
f...Q...W.....d.O.'}.H|......8.%{T..?z....=..s../......T.Lt....L.....7
..$U.....?.z.......{.U..'.3....88..4].7w.i..#......L})R.J..h..h..T...O
..!u.H..\[email protected]. ..>..M..Z..?..0..0.b...X.%Z...P
/^..<...X.!y(..\...J.....^.-gt.T.....0y...H..Up.!.....z.........6.A
{.,O.{..7M.2......}....E....:X.....c...B.....K......^..........F.....[
....k...!..(.H..)...>.1..7].:T...V1{.f..O..M...$s..^...>...@
<<< skipped >>>

GET /images/ico_taobao.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:37 GMT

Server: Apache

Last-Modified: Fri, 27 Sep 2013 10:25:50 GMT

ETag: "3be-4e75ae90f2780"

Accept-Ranges: bytes

Content-Length: 958

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:37 GMT

Keep-Alive: timeout=5, max=95

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.............(-.S....PLTE....i/.m4.J...V..............
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..........................................Y....tRNS.........SOx....dID
AT..U.A..1..$.,..q.I..n.X.......n.X....d.4..m....yN!.........F|.G.n...
.`...-....I..YLej.j..1.e..<......K.e....IEND.B`.....


GET /images/mz_movie_3.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:38 GMT

Server: Apache

Last-Modified: Mon, 22 Sep 2014 09:46:53 GMT

ETag: "c5f-503a454a25d40"

Accept-Ranges: bytes

Content-Length: 3167

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:38 GMT

Keep-Alive: timeout=5, max=94

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR...............h6....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /images/i_mz_travel_1103.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:38 GMT

Server: Apache

Last-Modified: Mon, 03 Nov 2014 11:19:01 GMT

ETag: "4e4-506f28376b340"

Accept-Ranges: bytes

Content-Length: 1252

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:38 GMT

Keep-Alive: timeout=5, max=93

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:22C792FE634A11E490B3FA52
8DB0B9EB" xmpMM:DocumentID="xmp.did:22C792FF634A11E490B3FA528DB0B9EB"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:22C792FC634A11E490
B3FA528DB0B9EB" stRef:documentID="xmp.did:22C792FD634A11E490B3FA528DB0
B9EB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>........PLTE.........g..|..................
..q........f..........................................................
.........................P........D.......Zc.../tRNS..................
.............................Z.8.....IDATx.\....0...4...7..t.}..#..%..
...:...=5$.o...B......dO...G-04.....j...Y.&.\2N..c.g..4......(O.X....7
3,...Z;.......e.;........[....S%.N.^.....IEND.B`.....
<<< skipped >>>

GET /images/mz_ic_tmall2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:39 GMT

Server: Apache

Last-Modified: Thu, 10 Jul 2014 10:04:51 GMT

ETag: "4fc-4fdd3f4a196c0"

Accept-Ranges: bytes

Content-Length: 1276

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:39 GMT

Keep-Alive: timeout=5, max=92

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:0480117407206811822AB97ADF869A58" xmpMM:DocumentID="xmp.did:CDF9
C3FAFF3E11E3A69CE6CFEC5F358C" xmpMM:InstanceID="xmp.iid:CDF9C3F9FF3E11
E3A69CE6CFEC5F358C" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:058011740720681182
2AB97ADF869A58" stRef:documentID="xmp.did:0480117407206811822AB97ADF86
9A58"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.='Z...*IDATx...Oj.@.._B.e.Rs...7.M....&7p.
....7..........&H.........&....0......(..f.'....).X... ._...o?<D...
.F.X.k!.#...h.l.;.......bMx.J.....k....`p..~}@...k:EK..M&.:..6....2. .
.%....=.z...h....w.E...\.J.}]....#.....o.L,....K4.....e...........u]&.
.Z.k.f.$I>!...Y..=...!Vu.g..qD..A.4M..|.l}....yH..&._...>.....IN
....IEND.B`.....
<<< skipped >>>

GET /images/mz_pop.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:39 GMT

Server: Apache

Last-Modified: Mon, 14 Apr 2014 01:40:15 GMT

ETag: "297-4f6f6c3d8ddc0"

Accept-Ranges: bytes

Content-Length: 663

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:39 GMT

Keep-Alive: timeout=5, max=91

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR...$.........#..)....PLTE..ml.!......|.9......k.......
.p.&......g..n.$i...........................p..................b....}&
.....v........p............r.)................................s..{..]e
...m..h....e...f..............@tRNS...................................
..............................{.D...FIDATX....n.@..` ......%....j.53..
.U..:......?..l....S'..X.t.Y.......PZ...w..... ......iM.......Mg..S..p
&i.,?c.o...&..2..WE....E!.)>.Bk.fA..G...&..H.H.H.H..*a=a..-....).My
tA(...d.>......E....P.s....9........P.?....(...4Hkj.7h%.'l:.....5g.
...........`..*..:..y.v..0.m......S....B{.."d.hDHhb..............6...N
.-oBBO<zo.b.}5..o~...{.QM......IEND.B`.....


GET /images/ico_ganji.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:40 GMT

Server: Apache

Last-Modified: Mon, 27 Jan 2014 10:41:10 GMT

ETag: "a7-4f0f15888fd80"

Accept-Ranges: bytes

Content-Length: 167

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:40 GMT

Keep-Alive: timeout=5, max=90

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR................a...nIDAT8..SI.. .....2....E..p.!h$..\
...Dg.E..\l.4. B.Y..-.K.,Yk%..c~....k..~:B. q5...........s.Lv...Kl.x..
?.w;.....(8&.......IEND.B`.....


GET /images/mz_toggle.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:40 GMT

Server: Apache

Last-Modified: Fri, 22 Nov 2013 06:18:20 GMT

ETag: "3da-4ebbdfb0b2300"

Accept-Ranges: bytes

Content-Length: 986

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:40 GMT

Keep-Alive: timeout=5, max=89

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR...2..........M}.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:C9B44CDB531F11E38858E484
3E3FEE07" xmpMM:DocumentID="xmp.did:C9B44CDC531F11E38858E4843E3FEE07"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C9B44CD9531F11E388
58E4843E3FEE07" stRef:documentID="xmp.did:C9B44CDA531F11E38858E4843E3F
EE07"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>$b......PLTE......c.p.....tRNS....0J....IDA
Tx.b`[email protected]!\:..2...n..^'`u.hT.N-.....L.eR)......IEND.B`.
....


GET /images/mz_1112_jhs_01.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:41 GMT

Server: Apache

Last-Modified: Wed, 12 Nov 2014 06:55:55 GMT

ETag: "751-507a3e31dd4c0"

Accept-Ranges: bytes

Content-Length: 1873

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:41 GMT

Keep-Alive: timeout=5, max=88

Connection: Keep-Alive

Content-Type: image/gif
GIF89aa..........ST.23.......@A.}}....... !....`a............!..XMP Da
taXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x
:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.
155772, 2014/01/13-19:44:00        "> <rdf:RDF xmlns:rdf="http:/
/VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:abo
ut="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpM
M="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/x
ap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xm
pRights:Marked="False" xmpMM:OriginalDocumentID="xmp.did:91695398A26DE
111951AE4839BBBE675" xmpMM:DocumentID="xmp.did:E61CE5816A3511E4882A940
6B996065D" xmpMM:InstanceID="xmp.iid:E61CE5806A3511E4882A9406B996065D"
 xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:f89bbdba-2977-4045-a3e2-6b7cc9abb3ab" stR
ef:documentID="adobe:docid:photoshop:f6eab62f-7678-11e1-82f0-c1042319e
464"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>............................................
......................................................................
................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJI
HGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .......................
..........!.......,....a........I..8....`(.di.h..l..p,.tm.....c(.@EapH
...d.`.F..tj.J..B..x....dA.......x~..CUn........t...w..Z.{..QhF.b.....
........B........H......J.U?..pY.f..H...B...V.....Z.........R..Ug.
<<< skipped >>>

GET /images/ico_suning.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:41 GMT

Server: Apache

Last-Modified: Tue, 03 Jun 2014 05:59:19 GMT

ETag: "132-4fae836683bc0"

Accept-Ranges: bytes

Content-Length: 306

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:41 GMT

Keep-Alive: timeout=5, max=87

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.............(-.S...`PLTE4....."........Y.............
..........k..|........P........p.....?..L.._........................fG
[email protected]..!1....W./.......<.!.........-.PJ.
k.\..a9......2M=.{.U,...&(.n.,..}.*...,...c.....e.P.1.H..........r....
..3......u...,D......IEND.B`.....


GET /images/ico_vipshop.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:41 GMT

Server: Apache

Last-Modified: Tue, 03 Jun 2014 05:59:19 GMT

ETag: "132-4fae836683bc0"

Accept-Ranges: bytes

Content-Length: 306

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:41 GMT

Keep-Alive: timeout=5, max=87

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.............(-.S...`PLTE4....."........Y.............
..........k..|........P........p.....?..L.._........................fG
[email protected]..!1....W./.......<.!.........-.PJ.
k.\..a9......2M=.{.U,...&(.n.,..}.*...,...c.....e.P.1.H..........r....
..3......u...,D......IEND.B`.....


GET /images/ico_vipshop.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:43

GET /t/detect2009v2.php?ver=1.0 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tianqi.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Set-Cookie: wc=54511; expires=Sun, 15-Dec-2024 16:57:08 GMT; path=/; domain=2345.com

Set-Cookie: lc=54511; expires=Sun, 15-Dec-2024 16:57:08 GMT; path=/; domain=2345.com

Set-Cookie: lc2=54511; expires=Sun, 15-Dec-2024 16:57:08 GMT; path=/; domain=2345.com

Cache-Control: max-age=0

Expires: Thu, 18 Dec 2014 16:57:08 GMT

P3P: CP=CAO PSA OUR

Vary: Accept-Encoding

Content-Type: text/html; charset=gbk

Content-Length: 1106

Accept-Ranges: bytes

Date: Thu, 18 Dec 2014 16:57:08 GMT

Age: 0

Connection: keep-alive
var wea_ = {city:"\u5317\u4eac",day1:["-5\uff5e5\u2103","\u4e94","\u66
74","\u5317\u98ce4-5\u7ea7","32"],day2:["-5\uff5e2\u2103","\u516d","\u
6674","\u5317\u98ce3-4\u7ea7","32"],day3:["-6\uff5e3\u2103","\u65e5","
\u6674","\u5fae\u98ce","32"],has15day:"yes",title:"\u63d0\u793a\uff1a\
u67e5\u770b\u6700\u65b0\u5929\u6c14\u9884\u62a5\uff0c\u8bf7\u6309Ctrl 
F5\u5237\u65b0\uff01
12\u670819\u65e5,\u5468\u4e94,\u6674,-5\uff5e
5\u2103,\u5317\u98ce4-5\u7ea7
12\u670820\u65e5,\u5468\u516d,\u6674
,-5\uff5e2\u2103,\u5317\u98ce3-4\u7ea7
12\u670821\u65e5,\u5468\u65
e5,\u6674,-6\uff5e3\u2103,\u5fae\u98ce
12\u670822\u65e5,\u5468\u4e
00,\u6674,-5\uff5e5\u2103,\u5fae\u98ce
12\u670823\u65e5,\u5468\u4e
8c,\u6674\u8f6c\u591a\u4e91,-4\uff5e6\u2103,\u5317\u98ce
12\u67082
4\u65e5,\u5468\u4e09,\u6674,-5\uff5e4\u2103,\u5fae\u98ce
12\u67082
5\u65e5,\u5468\u56db,,\u2103,",id:54511,pinyin:"beijing",rc:["7","39"]
,rl:["16","49"]};if(typeof(weaCallBack)!="undefined"){weaCallBack(wea_
,54511,54511)}var weaAlert_ = {};if(typeof(weaAlertCallBack)!="undefin
ed"){weaAlertCallBack(weaAlert_)}clickCount('detected');..
<<< skipped >>>

GET /js/2345 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: union2.50bang.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:07 GMT

Server: Apache

Content-Length: 229

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: application/x-javascript
var urlref = encodeURIComponent(document.referrer);document.write('<
;img  border=0 hspace=0 vspace=0 height=0 width=0 src="hXXp://union2.5
0bang.org/web/2345?uId2=RSNVXNQSPV&r=' urlref '&fBL=' screen.width '*'
 screen.height '"/>');....


GET /web/2345?uId2=RSNVXNQSPV&r=&fBL=1024*768 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: union2.50bang.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:07 GMT

Server: Apache

Content-Length: 229

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: application/x-javascript
var urlref = encodeURIComponent(document.referrer);document.write('<
;img  border=0 hspace=0 vspace=0 height=0 width=0 src="hXXp://union2.5
0bang.org/web/2345?uId2=RSNVXNQSPV&r=' urlref '&fBL=' screen.width '*'
 screen.height '"/>');....

GET /i/topic_anquan_1011.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:23 GMT

Server: Apache

Last-Modified: Fri, 10 Oct 2014 10:05:32 GMT

ETag: "26ae-5050eb079b300"

Accept-Ranges: bytes

Content-Length: 9902

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:23 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.......2......U-.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...viTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:10232b79-b08f-1942-83cf-64dfa00c99e3" xmpMM:DocumentID="xmp.did:
9167E913506411E4BC8798170BCC4A93" xmpMM:InstanceID="xmp.iid:9167E91250
6411E4BC8798170BCC4A93" xmp:CreatorTool="Adobe Photoshop CC 2014 (Wind
ows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7c1397ad-604
9-7744-9d97-2450e8e7137a" stRef:documentID="xmp.did:10232b79-b08f-1942
-83cf-64dfa00c99e3"/> </rdf:Description> </rdf:RDF> <
;/x:xmpmeta> <?xpacket end="r"?>.&\B....PLTE..........|......
......................m.h.......................W.........;.....1.....
.`eh..]........h.....i..............u..R...t..!(......../.............
x.&........h.....$.....E........U.....................................
.}.................&.....B{.(x.I..!...........j..;.........Y..........
.g....M.. ......................................i............a....... 
i..........:........x.....8..g................./..f........Z.........{
.......B..Q......s....#........m........3......................>
<<< skipped >>>

GET /time.txt?t=1418903256161 HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://VVV.2345.com/?6225

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:56:55 GMT

Server: Apache

Last-Modified: Thu, 07 Nov 2013 02:56:19 GMT

ETag: "0-4ea8d68f4bac0"

Accept-Ranges: bytes

Cache-Control: max-age=1296000

Expires: Fri, 02 Jan 2015 16:56:55 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 20

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/plain; charset=gb2312
........................


GET /time.txt?t=1418903264411 HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://VVV.2345.com/?6225

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:56:55 GMT

Server: Apache

Last-Modified: Thu, 07 Nov 2013 02:56:19 GMT

ETag: "0-4ea8d68f4bac0"

Accept-Ranges: bytes

Cache-Control: max-age=1296000

Expires: Fri, 02 Jan 2015 16:56:55 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 20

Keep-Alive: timeout=5, max=99

Connection: Keep-Alive

Content-Type: text/plain; charset=gb2312
........................


GET /css/index_20141217_01.css?v=5.28.1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:56:56 GMT

Server: Apache

Last-Modified: Wed, 17 Dec 2014 02:05:42 GMT

ETag: "12f51-50a5fe9aaa980"

Accept-Ranges: bytes

Cache-Control: max-age=1296000

Expires: Fri, 02 Jan 2015 16:56:56 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 15974

Keep-Alive: timeout=5, max=98

Connection: Keep-Alive

Content-Type: text/css
...........}i..F.....?p.`.. .xKz....t.=.n`....Y.@."%.%..D.;...7oFfF&..
...z..G...w.y.-O....l.8..7..~..v_..z.=L....S...T].4../...<L..I.....
6.l..6.l..6.l..q..7.z7..I]O...5..|.N....R....uw.O...Y..u..j...=./....}
w...c_..../O..p.....n.....s..............\.9..>oLt..[w........Y..xj
..........5./M........Nus........._...2. ..=.......>7wQ..i..r....-.
...;4/...n..nZ......./.~..A.E3....;.Y w.t4..Yu..o...k.....]w.y(.h.....
....Y..G.....Gww..y..5..Z....|.og...}. .}s...4...7.7..`..V...M...d.X..
...._.s[.......u.....?<w...z)..x..tw...I...w[.!.rd.....,.N.....cw..
C.2[....z.95.A....,.........d...f...|.X./..\.....!j..7.k.d......_.H...
G...l...pL...K...Y...Q......}.*.f......h.....f..}7.-....Y.......f....)
.`..........X.........UW..j......o.....wQ~|...}..H..].n.UD..g..V..J...
.....C.pT."'.9M. .......jC....L...._.dNEGa.&.=.DU...TmNf.'v,)...T5....
..{.Zt...K...l.....l..Z.,#...y.....'.[.w.Z.......][.o.M.....f...C..tF.
.....mY......A...&........vB......O......R._..O.}.i.........q.p....".g
...=.....2.C'...V....... .b.......y.k.....}..............p./o...`..|.6
....r.P.......|?#_............C. P..qO....]Aw\.~..V.d.d.v...N.hO..l.".
.......ddpg....Z.......y}....^......c.t;rn.k.O..?.&.7..B..V.SQ..J...8.
b.T...C.p.j.#.y$......}I.~>....x.z..-..N..\F_...iK....H!.0.....%UB.
1.1o~j.'I.L9...3.dv.r..t.'o...-..3...v.'....2h.!A..H...!7.5.v.j......Y
.[.`....|i...i........[mtr...Ih...<....b k.k......W.4yH..W...{.....
.....z..a....O....F....e.._.^....7.|E...^........I..!...$..<...u.n.
.v.)`...l...B.....5/o.Oq.f..G..-3......-j.....BJ...i.n..r.jP....3.
<<< skipped >>>

GET /fonts/2345_1201.eot? HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:56:58 GMT

Server: Apache

Last-Modified: Mon, 01 Dec 2014 02:48:11 GMT

ETag: "3688-5091ea42350c0"

Accept-Ranges: bytes

Content-Length: 13960

Cache-Control: max-age=1296000

Expires: Fri, 02 Jan 2015 16:56:58 GMT

Keep-Alive: timeout=5, max=97

Connection: Keep-Alive

Content-Type: application/vnd.ms-fontobject
.6...5............................LP....J..P........... ...A.#.~......
..............2.3.4.5.....R.e.g.u.l.a.r...Z.V.e.r.s.i.o.n. .1...0.0. .
J.a.n.u.a.r.y. .2.,. .2.0.1.4.,. .i.n.i.t.i.a.l. .r.e.l.e.a.s.e.....2.
3.4.5................0OS/2?......8...Vcmap............gasp......5.....
glyf.U........ .head..:........6hhea.q.j.......$hmtx............locaA.
L.........maxp.Q......... name.0ME..0(....post...(..4.............~.#.
_.<............5.................................>.N.C..........
...............8.....?.......................................3.......3
.....f..................P..J........HL  .@.!.....Q.3.>.. ...A......
......................................1.......)...'...................
(...........................................4...W...-...........)...K.
................................................../...................
....................<...3.......................................$. 
.......!.:.B.L.P.x.......P.Y.i.y............. .#.A.D.N.x.......K.Q.`.p
.......................`.`............................................
.............`... ....................................................
........................... .!.".#.$.%.&...'.(.)......................
......................................................................
......................................................................
......................................................................
.................Z.....Z.....P..... .b.....D.z. .....&.l.....6.Z.....&
lt;.....P.....h...B.........,...4.d.....&...........x.......b.....
<<< skipped >>>

GET /images/logo135x57.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:56:59 GMT

Server: Apache

Last-Modified: Thu, 16 Oct 2014 08:38:14 GMT

ETag: "29e6-505862b506980"

Accept-Ranges: bytes

Content-Length: 10726

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:56:59 GMT

Keep-Alive: timeout=5, max=96

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.......9......'8.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...liTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:bbf3ea10-0e0c-5741-96d0-b0e8721a124f" xmpMM:DocumentID="xmp.did:
66BBAD50550611E4A999AE4C102EF6BE" xmpMM:InstanceID="xmp.iid:66BBAD4F55
0611E4A999AE4C102EF6BE" xmp:CreatorTool="Adobe Photoshop CS5 Windows"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6CB4D6E60355E4119B
0ACE99012AAC09" stRef:documentID="xmp.did:bbf3ea10-0e0c-5741-96d0-b0e8
721a124f"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>Cs....&.IDATx..}.x.......{..dY.e....| .
.s.bC..f!.GH...96!...I .!$!$.......$$!.....9...._..lK.a....|[..Zz.....
.....g..t.~..WU..W=f.s....uB..1.U4...S m;.`.....X6.T.....\[email protected]
b>.E.Zf.....7l......$..q(mA1.i....._.8w..3..5e...`..i0....z..0.....
....i._.A.(o.E./....~.!...&...M.V.d%....;|.7~eE.....P...c:.J.*t.v0.|FP
S.V..T.Wgj8.xN.O...A......p....A..A..,.,..h.#..b.P.p.b..J.P.{..(e.O.5.
.C>vf..knC....Y..j.W..|..H..2K..!.]...f...M.......x>..`...t..Z..
....R..k.=.\.O..Z...^.8.O.......m......Y....glvm..?.m..x...1}..!8G
<<< skipped >>>

GET /i/blank.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:56:59 GMT

Server: Apache

Last-Modified: Fri, 18 May 2012 05:59:19 GMT

ETag: "3b9-4c04940ca7bc0"

Accept-Ranges: bytes

Content-Length: 953

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:56:59 GMT

Keep-Alive: timeout=5, max=95

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR...............?.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:BE04A97D9F3C11E1BC65ED9A
1562F288" xmpMM:DocumentID="xmp.did:BE04A97E9F3C11E1BC65ED9A1562F288"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BE04A97B9F3C11E1BC
65ED9A1562F288" stRef:documentID="xmp.did:BE04A97C9F3C11E1BC65ED9A1562
F288"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.H"[email protected]
x.b`.'..0..n..........IEND.B`.....


GET /images/tipSet_ie6.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:00 GMT

Server: Apache

Last-Modified: Wed, 04 Sep 2013 09:49:02 GMT

ETag: "a6f-4e58bb71a1f80"

Accept-Ranges: bytes

Content-Length: 2671

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:00 GMT

Keep-Alive: timeout=5, max=94

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR...............V....6IDATh..[}l.W.o....d.....8.Cc...D.
S..M..(..c..V'c.%|F>.1...........>.'[email protected]......=9
..^..}.~...._......>......{.8".{[email protected]....'... .._2.d..
.........-....eLg.g`.c..N...$X.p(~...5F=...b|...p......y..4CxS..Ex.c..
.b?..:.g.U.=..............R...j..hG._..Z.... .6...u. ie...d.c4.....?..
.x...._.1y8.4.rLd..(.q.0N2~....`&0...}....HL...YB....W....M..m8..V.$..
....is ...,.v...l........ ...fi...m.\F2#8/.!J..=m>.,...uJ=.o..?N.-!
j.n.....V.i=O.6|@....N..G..X.B (.!...Q&..b ..c.c7.s2.T2....v..?.H]tx..
xr......U...A..t^.....Tq...d...N.w v......M.5..|.`..oXX..!.f.r.......p
.Q.E.....r..O.N.:w...J.r.%....X..{....U..............5.A.c..2G.M.e..SR
.F....),.....ic.::..O.m51.fwO7]......PeS.}.P.......~8Q...;.\Eum....B. 
.j.U.sm>....?.d.=.....F..81~x....A./yM!O.r.:..j..L.et....G.... H...
M..B..=\..;..J_..B..M...a...o...$.h$. .$1.hd.)1.W.....q.[...Ce..7.$..$
.VcI.*y..F....'1..O..:..o%.<.z...J.....l... ........W.......=nm*0.-
y5...lg_..n..CQ..|.:.9-.....7<..~....'....c..... .......d.p#.bY.O.j
[;X.ejwO..@....#l}.WN$ ..`...A.f.>....$..3.c*C.M...b,v.P8H.. ......
........Ir.e...}......{{.W6=. *...]... ..lM. ...1..[=vOA.."M_q.0.w...;
."........:.V.G=.....C;...MO...E.H^...Q...^/K.u[...p#.9>...az.h....
[email protected]$D .=.b.W....5..".d.w*g.8....y.e...S..1-...h(.m
.PK...L!.~X....AL.....=e)9.i..]"!.....)..PVV..B!*//...L*--.."..1....B.
..Ge...9[.fL/.Z.%1...... ....c......2.......,......;.i...Qo.K......8.)
..6.kf.f{..m.Th....m......455QNN.C........A... G....Y......]v.1}.b
<<< skipped >>>

GET /images/common/top_1022_2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:00 GMT

Server: Apache

Last-Modified: Wed, 22 Oct 2014 11:39:34 GMT

ETag: "ae8-5060166dc4980"

Accept-Ranges: bytes

Content-Length: 2792

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:00 GMT

Keep-Alive: timeout=5, max=93

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.......L.............tEXtSoftware.Adobe ImageReadyq.e&
lt;...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:02EB2AA2DB59E411A450A31A7A3C5854" xmpMM:DocumentID="xmp.did:EED6
337759DF11E48698BD530B7A2145" xmpMM:InstanceID="xmp.iid:EED6337659DF11
E48698BD530B7A2145" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:03EB2AA2DB59E411A450A3
1A7A3C5854" stRef:documentID="xmp.did:02EB2AA2DB59E411A450A31A7A3C5854
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>...8....PLTE.....[......8.........9#.....%..R..
... y................-q.......................a.....~..B.....h.%......
..-.."..).ya..'..&...../..,D....$....ya.xaS......N#............\.....V
.... :.............&~....#..............[d..9..s.......... ..!...v.i..
.........6........W...o......yW..$...H.... ..'..$.....................
........0...........*e..............z.............0...pvl...E..<...
........../..-..'.{Y../.. ........5...|....!.............{[.....(h..g.
....k....0.....0........(..... .....8R.........{[..4.........M....
<<< skipped >>>

GET /images/common/login_1217.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:01 GMT

Server: Apache

Last-Modified: Wed, 17 Dec 2014 02:05:51 GMT

ETag: "575-50a5fea33fdc0"

Accept-Ranges: bytes

Content-Length: 1397

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:01 GMT

Keep-Alive: timeout=5, max=92

Connection: Keep-Alive

Content-Type: image/png
[email protected] ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:3E13F04E9F31E4118E06FC0B05C7E7DF" xmpMM:DocumentID="xmp.did:72AE
E638859011E484A69228404F635C" xmpMM:InstanceID="xmp.iid:72AEE637859011
E484A69228404F635C" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D17513E18B85E411ACC5
B2DF4C75ECA7" stRef:documentID="xmp.did:3E13F04E9F31E4118E06FC0B05C7E7
DF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>!ud....QPLTE.....................MMM.3.......
................................................33......tRNS..........
.................'4.5...!IDATx......0...q....H..A..Y.....C....}..9T...
..&c.0..3&.Ub.[GLpk....\........V.P.5.Z..0.....a2.....b.[{Lp...4.....4
...X.Q..bn.&...c.....\)M......0....X......&..s=/.:..5..v)M....~Y..e.d.
..aV.....7_%.?DZ.y).DKo..hU.-....%Zz..DK.em...fcZ.-...[9.u...h..{.E.o,
v%.*...[.....E..v...S....An6....0.P|[email protected]`.....
<<< skipped >>>

GET /images/bgs14.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:01 GMT

Server: Apache

Last-Modified: Fri, 06 Dec 2013 07:08:26 GMT

ETag: "197f-4ecd84ffe4e80"

Accept-Ranges: bytes

Content-Length: 6527

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:01 GMT

Keep-Alive: timeout=5, max=91

Connection: Keep-Alive

Content-Type: image/png
[email protected]...............
........................................fff...........................
............................................j.........................
................>..........[.N.W..A..............S.................
....f....*............................................................
...........................|||........................................
.....qqq..Niii......ggg..................Z.c..9...q......g$.._........
..............p............n......{{{...................p......yp.....
.....................hhh.....8.f#........^uuuZ.b.................z...}
}}......kkk..o....q..u..................................zzz...~~~.....
.nnn......sssooo................................................yyy...
......lllvvv...ppp..........................4.....tRNS................
......................................................................
......................................................................
......................................................................
..............................S..%....IDATx....x..y.`T,....P..j.6Gs .A
...P.,..eK.d.. .L[..IY.M.....%Y....-;...Gl...'q.&i..Ms.g.....n.h......
.....;...@. .x93{...B...........I..........IC......,?.*...t9.S.....D..
..K1.......... .....!..-.U..-............ ...7.|.C..c..j.k..j....d...,
.#...[U..2...j..../^...)..6.....-.....l..!E.%bi#X.XJ./9 D..../.......Z
[email protected]..[[email protected]_". ....D0..!1....V...j.H.}..... ....\
ya%.b.`V......\. ..T.H........n|..p.ii(..ii.C.2v^..F........)h.d..
<<< skipped >>>

GET /i/search0320/google_web.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:01 GMT

Server: Apache

Last-Modified: Wed, 20 Mar 2013 08:43:40 GMT

ETag: "a8b-4d85737fe2700"

Accept-Ranges: bytes

Content-Length: 2699

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:01 GMT

Keep-Alive: timeout=5, max=90

Connection: Keep-Alive

Content-Type: image/gif
GIF89aU. .................ni.......4....q..Dt..H....Sn.....Xb..W....l.
3k....-Z.(Q.....pu....KP...g......5F..............5.............r.....
......-........... 0.. .........V.............`...K.S...........b..*..
..............MX..........................y.....).;I..........`g......
........(.....R>S.eu.B]......G.....-....B..rz..........~.|...zD(D.{
.~..(........P.......................e..~.\...a...!..XMP DataXMP<?x
packet begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xm
lns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 201
0/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org
/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns
:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://n
s.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sTyp
e/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Mar
ked="False" xmpMM:OriginalDocumentID="xmp.did:91695398A26DE111951AE483
9BBBE675" xmpMM:DocumentID="xmp.did:8747AD2F913811E28F84A47C37DA91B2" 
xmpMM:InstanceID="xmp.iid:8747AD2E913811E28F84A47C37DA91B2" xmp:Creato
rTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:in
stanceID="xmp.iid:536B10EE3691E211B095E8EF82D82440" stRef:documentID="
adobe:docid:photoshop:f6eab62f-7678-11e1-82f0-c1042319e464"/> </
rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket e
nd="r"?>...........................................................
..................................................................
<<< skipped >>>

GET /images/body0_2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

GET /images/body0_2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:03 GMT

Server: Apache

Last-Modified: Wed, 08 May 2013 03:53:33 GMT

ETag: "b7-4dc2ce0adc940"

Accept-Ranges: bytes

Content-Length: 183

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:03 GMT

Keep-Alive: timeout=5, max=89

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.............*<V....0PLTE..........................
......................cL.....BIDATHK..G.....@.w...D..m.eN..u......PO..
p..zW.e.cP~'.....vU.....Z ....<.......IEND.B`.....


GET /i/search0320/baidu_web.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:04 GMT

Server: Apache

Last-Modified: Wed, 20 Mar 2013 08:34:57 GMT

ETag: "78a-4d85718d1ce40"

Accept-Ranges: bytes

Content-Length: 1930

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:04 GMT

Keep-Alive: timeout=5, max=88

Connection: Keep-Alive

Content-Type: image/gif
GIF89aU. .................cZ.............9/......ZU..........!..XMP Da
taXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x
:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.
134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="http:/
/VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:abo
ut="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpM
M="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/x
ap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xm
pRights:Marked="False" xmpMM:OriginalDocumentID="xmp.did:91695398A26DE
111951AE4839BBBE675" xmpMM:DocumentID="xmp.did:6E0F9B15912F11E29525B1A
BCBF93F2A" xmpMM:InstanceID="xmp.iid:6E0F9B14912F11E29525B1ABCBF93F2A"
 xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:C68C50D22D91E2119448AF4ED6042198" stRef:d
ocumentID="adobe:docid:photoshop:f6eab62f-7678-11e1-82f0-c1042319e464"
/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <
;?xpacket end="r"?>................................................
......................................................................
............~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFE
DCBA@?>=<;:9876543210/.-, *)('&%$#"! ...........................
......!.......,....U. ......I..x6.j.`(.....'5...p,S......|..6@ ...|.d.
.....(..d<.(.t.3...k..-S.P*...0l..\Rc>........}s\jO!..q.JX.;.C.o
6V.Jup..(..`vr.......#.....c.E..c........................d.....o..
<<< skipped >>>

GET /i/search0320/google_web.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:04 GMT

Server: Apache

Last-Modified: Wed, 20 Mar 2013 08:43:40 GMT

ETag: "a8b-4d85737fe2700"

Accept-Ranges: bytes

Content-Length: 2699

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:04 GMT

Keep-Alive: timeout=5, max=87

Connection: Keep-Alive

Content-Type: image/gif
GIF89aU. .................ni.......4....q..Dt..H....Sn.....Xb..W....l.
3k....-Z.(Q.....pu....KP...g......5F..............5.............r.....
......-........... 0.. .........V.............`...K.S...........b..*..
..............MX..........................y.....).;I..........`g......
........(.....R>S.eu.B]......G.....-....B..rz..........~.|...zD(D.{
.~..(........P.......................e..~.\...a...!..XMP DataXMP<?x
packet begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xm
lns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 201
0/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org
/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns
:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://n
s.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sTyp
e/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Mar
ked="False" xmpMM:OriginalDocumentID="xmp.did:91695398A26DE111951AE483
9BBBE675" xmpMM:DocumentID="xmp.did:8747AD2F913811E28F84A47C37DA91B2" 
xmpMM:InstanceID="xmp.iid:8747AD2E913811E28F84A47C37DA91B2" xmp:Creato
rTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:in
stanceID="xmp.iid:536B10EE3691E211B095E8EF82D82440" stRef:documentID="
adobe:docid:photoshop:f6eab62f-7678-11e1-82f0-c1042319e464"/> </
rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket e
nd="r"?>...........................................................
..................................................................
<<< skipped >>>

GET /images/skin0_20.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:05 GMT

Server: Apache

Last-Modified: Mon, 16 Jun 2014 01:45:37 GMT

ETag: "5e6-4fbea2f0ad240"

Accept-Ranges: bytes

Content-Length: 1510

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:05 GMT

Keep-Alive: timeout=5, max=86

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR...F...C......J......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:91A143FBF06511E39C2ED910
0F3FF0F9" xmpMM:DocumentID="xmp.did:91A143FCF06511E39C2ED9100F3FF0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:91A143F9F06511E39C
2ED9100F3FF0F9" stRef:documentID="xmp.did:91A143FAF06511E39C2ED9100F3F
F0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>[email protected].........
......................................x...............................
..m....."tRNS.....................................q....IDATx....r.0..a
(....cj.G..%[.T.H6d..../...%$...b..(.....%.V&....cbc..:S]5'f...s.dW.{j
4..D.......rT....#b....:B..H..#f..9...`...g:.^.L.s.&'.....y.0...51....
....#.S....3...I..0L...4..L.........a.. f..1.N S9....f~.pf....A0?..o..
..S..;E;.):......MM.x1I..v.....H..bW...., .]c...aVo..{{....0V..Vt.A..Q
..0[StP..-N.2d..!C...2d..!.g2Y.&....2d..Q..&..K..I.]..}j.V.F1..@"Cf.3.
D....y..b. ..\C"3>..)..D..Y@"..\A"3>s.)N.....0...d. .!CF's.)
<<< skipped >>>

GET /images/common/search_140829.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:05 GMT

Server: Apache

Last-Modified: Wed, 10 Sep 2014 06:11:48 GMT

ETag: "904-502afed573100"

Accept-Ranges: bytes

Content-Length: 2308

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:05 GMT

Keep-Alive: timeout=5, max=85

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.......m.............tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:D23E308D3C2FE411AD20F759CC993D01" xmpMM:DocumentID="xmp.did:97EE
EE3A2F4911E4909BD568623D741A" xmpMM:InstanceID="xmp.iid:97EEEE392F4911
E4909BD568623D741A" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D93E308D3C2FE411AD20
F759CC993D01" stRef:documentID="xmp.did:D23E308D3C2FE411AD20F759CC993D
01"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>*..E....PLTE.................................
......................................................................
......................................................................
......................................................................
............................<.....ZtRNS............................
.................................................................o....
IDATx....R.0.E.$..........]RH.......l..-.20.\...3..cA|t.dKv.......~2.k
p..'....N.....:=...\.x...N~...,..HLY.&b*...0>$qe.}..|...,....~.
<<< skipped >>>

GET /images/skin0_20.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:06 GMT

Server: Apache

Last-Modified: Mon, 16 Jun 2014 01:45:37 GMT

ETag: "5e6-4fbea2f0ad240"

Accept-Ranges: bytes

Content-Length: 1510

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:06 GMT

Keep-Alive: timeout=5, max=84

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR...F...C......J......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:91A143FBF06511E39C2ED910
0F3FF0F9" xmpMM:DocumentID="xmp.did:91A143FCF06511E39C2ED9100F3FF0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:91A143F9F06511E39C
2ED9100F3FF0F9" stRef:documentID="xmp.did:91A143FAF06511E39C2ED9100F3F
F0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>[email protected].........
......................................x...............................
..m....."tRNS.....................................q....IDATx....r.0..a
(....cj.G..%[.T.H6d..../...%$...b..(.....%.V&....cbc..:S]5'f...s.dW.{j
4..D.......rT....#b....:B..H..#f..9...`...g:.^.L.s.&'.....y.0...51....
....#.S....3...I..0L...4..L.........a.. f..1.N S9....f~.pf....A0?..o..
..S..;E;.):......MM.x1I..v.....H..bW...., .]c...aVo..{{....0V..Vt.A..Q
..0[StP..-N.2d..!C...2d..!.g2Y.&....2d..Q..&..K..I.]..}j.V.F1..@"Cf.3.
D....y..b. ..\C"3>..)..D..Y@"..\A"3>s.)N.....0...d. .!CF's.)
<<< skipped >>>

GET /right/homepage/zjsVersion.js?t=1418903269333 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:06 GMT

Server: Apache

Last-Modified: Thu, 18 Dec 2014 16:30:04 GMT

ETag: "124-50a801ab95b00"

Accept-Ranges: bytes

Cache-Control: max-age=1296000

Expires: Fri, 02 Jan 2015 16:57:06 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 221

Keep-Alive: timeout=5, max=83

Connection: Keep-Alive

Content-Type: application/javascript
..........E.1o.0.....N......N.Q'$P.vcA.........VB...4...{z....w.......
.m....g..Sd.......}Gx...i."j..'wJ.........0..w.Z .e)`g...C.5.:K...X.b.
..`.....*.....[.Tee.[[email protected]..$../.%.
.......$.......


GET /css/input_20141218.js?ver=1.0 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:07 GMT

Server: Apache

Last-Modified: Thu, 18 Dec 2014 08:03:25 GMT

ETag: "2891-50a7906cd6d40"

Accept-Ranges: bytes

Cache-Control: max-age=1296000

Expires: Fri, 02 Jan 2015 16:57:07 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 4264

Keep-Alive: timeout=5, max=82

Connection: Keep-Alive

Content-Type: application/javascript
...........Z.W.L..W.....i`&.Ki...Z.V..]|9...$H.h....w'..A{>k&w../s.
z3kX.N.'...4.[e.<({......uGy.x.t...._,..Jck.y'A\r*..({..c:.g).j..e&
lt;.........59.].......Q.0.-i5EY..n.E..N...r.R...r..(...?.......o...\9
.B....WK..L...^/.[ .g[.v{.W\...-Z.....*cs..".../^..n\..].#.{.,.{E.,1Z)
...T.....v.i.....R..........vQQ...e.:..7.^.x....G84..........'q..H.D.,
.x..%.t..J[ .J.......\]..E.*.w.T. ..6...%.K... .T.....u..x....r......v
[...<.{.w......~r.}...,.M....F..X\......g.N.{N..5).Xk..j.....#.s.)o
0..&.Wx..&.?[[email protected]>o........p....J.......6.#A.f..<.
r...T.h..Y...X..[......Fd;..K..2z....i.....M....g.E.Q...)..x..TZ!..M..
9........C..J. I....*......_T]e7kaq...C......l`..K6Z..}...Q.Gax....$..
....M.f2 f......?.Fy..(..1tRy.x.....mFO.#..........g.<.?...>_J..
.yy.97.y.....w.KS....9.2_...k...'.>.........g..3_D.Oz?.o...."^|....
msM.xdL6...V..F....^........ .V.u._.....z...k..?...X......rQO..v..'*.C
......n...F|...n.........m..n.....n...*...}.~..-..HK...y.2.7.D.. |' ..
U.xF[".....zsm..=..H........|e..I..&.$..(.T}...0?J..Ha.....s....t..dfJ
......S.O....j\.lr...}....T>[j..i..*..M&.<..Y..s.#.;<.j..I..s
..w.)..V......~.z...~.\.....o.u.pz...&......i.....o......v=k*.`...w...
M6.!......>.q40...,...`..t...2........'.2{cr4..-...._.7-.oOy.)Y... 
.Zy.M...-.... ....;...."6D....H60...v.6.:C.RT...yrN..........m*..P.gub
b............w*;S.......V.3U...xOGZ.....~.....GM~.X(.....%....lI.Y....
a....].(9.G.' 2....c...FU2.?.q..x..K.&[!.}....6S}.._.I...../$l....o...
..s.}2..Ie...d.......~k.G..b....~......w.......p.....c.....EAd.@..
<<< skipped >>>

GET /images/kz_tmall_20141212.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:07 GMT

Server: Apache

Last-Modified: Fri, 12 Dec 2014 08:21:09 GMT

ETag: "8d7f-50a00932c8740"

Accept-Ranges: bytes

Content-Length: 36223

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:07 GMT

Keep-Alive: timeout=5, max=81

Connection: Keep-Alive

Content-Type: image/gif
GIF87a}....i.......#. .00....pp...ZWW...............0  .``...@...``.PP
.  .........@@@000.........gee...ppp.@@.......@@.00.........P..   ,...
..P00`PP....ppq..p``.pp.``..........00@  .pp......`@@P@@.ss.PP...`00p 
 .00...`  .pp.00.@@@00......z...@@P  .  ..........PPp...``p@@.OP.@@.PP
.@@}??6...##.``.  .PP.``...y/0.))g...op......p__......................
...............................................!.....i.,....}.....f.i.
......................................................................
...........!.....((....0.(!...!.....i.,F...#.....?.i...............((.
.....(......(.i9..........,......!....9.....!.....i.,E...$.......i....
...!.9.....(........(......(,..,,!....(..0....!...i....9..(9.........,
..,.!............................9.i,.9.........(......!.....i.,E...$.
......i........,0......(.......(..................i........!i,.....!..
....i..,9.....0..,.,..!....,.....(...(.i0............i..9.(9......C!..
...&y..b..U9r.b$N`B..4h...C<|.^.Bp.E...X..Xn..w.jm..!G.I.4.K...%...
..X!M .!.....i.,D...$.......i.............9((....,.(......(........(..
..,.......i.....i.!..(i...9...!..........(,....!.,.....0.9....!..0....
.0............i.<.`.a.=|.BD.W-.%........'..>..p..;....Ca.]$u..u.
..C....fl....Y%S...........y.....vV..b....^..9..,L....F.S..Y..........
.r...W..,........k..De.R .!.....i.,D...$.......i.............9((....,.
(......(........(....,.......i.....i.!..(i...9...!..........(,....!.,.
....0.9....!..0.....0............i.<.`.a.=|.BD.W-.%........'..>.
.p..;....Ca.]$u...8......36.D....)QU..........y.....P......W.jN. .
<<< skipped >>>

GET /i/cert-beian_0829.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:09 GMT

Server: Apache

Last-Modified: Wed, 10 Sep 2014 06:11:23 GMT

ETag: "888-502afebd9b8c0"

Accept-Ranges: bytes

Content-Length: 2184

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:09 GMT

Keep-Alive: timeout=5, max=80

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:E434EB51324E11E4A4029D98
459EA8DB" xmpMM:DocumentID="xmp.did:E434EB52324E11E4A4029D98459EA8DB"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E434EB4F324E11E4A4
029D98459EA8DB" stRef:documentID="xmp.did:E434EB50324E11E4A4029D98459E
A8DB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>F.......PLTE...gggrrr.....................h
hh........................................D..F.....`..-...........M..\
......<.............^.........J.....5....~........7......r........l
.....-.................^.q.........l........].g.....s........Q..y.....
x......>....A...N....W.....M......(......................I..u......
......b...................&..'...........9......U..............`....n.
..........>.................M...K....o.....p...........v.."...>.
..................u.....................9....Q...e."........{..z.....{
..................H.............=......=........................ii
<<< skipped >>>

GET /i/zx110_0829.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:09 GMT

Server: Apache

Last-Modified: Wed, 10 Sep 2014 06:11:23 GMT

ETag: "964-502afebd9b8c0"

Accept-Ranges: bytes

Content-Length: 2404

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:09 GMT

Keep-Alive: timeout=5, max=79

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:EB0FAE11324E11E4AF348FBF
63CE8F4C" xmpMM:DocumentID="xmp.did:EB0FAE12324E11E4AF348FBF63CE8F4C"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EB0FAE0F324E11E4AF
348FBF63CE8F4C" stRef:documentID="xmp.did:EB0FAE10324E11E4AF348FBF63CE
8F4C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.".s....PLTE..U.C.....c..)~.P...Z..b..%..v.
.s.:...=..[..T..:...gggrrr......hhh.................>...=..N....qL.
..Z...6.g.._.Q.......<X.l q....X..r..R..j..m...J.......F.....L.....
f...Q...W.....d.O.'}.H|......8.%{T..?z....=..s../......T.Lt....L.....7
..$U.....?.z.......{.U..'.3....88..4].7w.i..#......L})R.J..h..h..T...O
..!u.H..\[email protected]. ..>..M..Z..?..0..0.b...X.%Z...P
/^..<...X.!y(..\...J.....^.-gt.T.....0y...H..Up.!.....z.........6.A
{.,O.{..7M.2......}....E....:X.....c...B.....K......^..........F.....[
....k...!..(.H..)...>.1..7].:T...V1{.f..O..M...$s..^...>...@
<<< skipped >>>

GET /images/mz_taobao_1209.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:10 GMT

Server: Apache

Last-Modified: Tue, 09 Dec 2014 11:29:02 GMT

ETag: "b9d-509c6d992bb80"

Accept-Ranges: bytes

Content-Length: 2973

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:10 GMT

Keep-Alive: timeout=5, max=78

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR...$...F.............tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:B1A022F47F9211E4A156854C
72ECD771" xmpMM:DocumentID="xmp.did:B1A022F57F9211E4A156854C72ECD771"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B1A022F27F9211E4A1
56854C72ECD771" stRef:documentID="xmp.did:B1A022F37F9211E4A156854C72EC
D771"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.. .....PLTE.f.....3..............z".]3....
k..N!.......W [email protected]#.9.........y.......G......
s.u.....[1.....b.|$.............X-.d<.U)...../..B.lE.c:............
...........p..w....a8.....v..d._5.......Q%..,.....]..n..]..}.f=..{..p.
....}..............Q...........h..........nH.....f....B.....nG........
...8.Z/.jC....J..rM....uP....pJ..@..........._..I.vR..m.............g?
.....H..S....iA..*.....r..........w......h.......x...L.....\.....Y....
.`..m....F..W,.H........}&....D......Z..|..~.....t........J.......~(..
.....`7.~[.rL.....b.;...<.....3.....W.xT....t...............^..
<<< skipped >>>

GET /images/mz_movie_3.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:10 GMT

Server: Apache

Last-Modified: Mon, 22 Sep 2014 09:46:53 GMT

ETag: "c5f-503a454a25d40"

Accept-Ranges: bytes

Content-Length: 3167

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:10 GMT

Keep-Alive: timeout=5, max=77

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR...............h6....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /images/i_mz_travel_1103.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:11 GMT

Server: Apache

Last-Modified: Mon, 03 Nov 2014 11:19:01 GMT

ETag: "4e4-506f28376b340"

Accept-Ranges: bytes

Content-Length: 1252

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:11 GMT

Keep-Alive: timeout=5, max=76

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:22C792FE634A11E490B3FA52
8DB0B9EB" xmpMM:DocumentID="xmp.did:22C792FF634A11E490B3FA528DB0B9EB"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:22C792FC634A11E490
B3FA528DB0B9EB" stRef:documentID="xmp.did:22C792FD634A11E490B3FA528DB0
B9EB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>........PLTE.........g..|..................
..q........f..........................................................
.........................P........D.......Zc.../tRNS..................
.............................Z.8.....IDATx.\....0...4...7..t.}..#..%..
...:...=5$.o...B......dO...G-04.....j...Y.&.\2N..c.g..4......(O.X....7
3,...Z;.......e.;........[....S%.N.^.....IEND.B`.....
<<< skipped >>>

GET /images/mz_pop.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:11 GMT

Server: Apache

Last-Modified: Mon, 14 Apr 2014 01:40:15 GMT

ETag: "297-4f6f6c3d8ddc0"

Accept-Ranges: bytes

Content-Length: 663

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:11 GMT

Keep-Alive: timeout=5, max=75

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR...$.........#..)....PLTE..ml.!......|.9......k.......
.p.&......g..n.$i...........................p..................b....}&
.....v........p............r.)................................s..{..]e
...m..h....e...f..............@tRNS...................................
..............................{.D...FIDATX....n.@..` ......%....j.53..
.U..:......?..l....S'..X.t.Y.......PZ...w..... ......iM.......Mg..S..p
&i.,?c.o...&..2..WE....E!.)>.Bk.fA..G...&..H.H.H.H..*a=a..-....).My
tA(...d.>......E....P.s....9........P.?....(...4Hkj.7h%.'l:.....5g.
...........`..*..:..y.v..0.m......S....B{.."d.hDHhb..............6...N
.-oBBO<zo.b.}5..o~...{.QM......IEND.B`.....


GET /images/mz_toggle.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:12 GMT

Server: Apache

Last-Modified: Fri, 22 Nov 2013 06:18:20 GMT

ETag: "3da-4ebbdfb0b2300"

Accept-Ranges: bytes

Content-Length: 986

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:12 GMT

Keep-Alive: timeout=5, max=74

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR...2..........M}.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:C9B44CDB531F11E38858E484
3E3FEE07" xmpMM:DocumentID="xmp.did:C9B44CDC531F11E38858E4843E3FEE07"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C9B44CD9531F11E388
58E4843E3FEE07" stRef:documentID="xmp.did:C9B44CDA531F11E38858E4843E3F
EE07"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>$b......PLTE......c.p.....tRNS....0J....IDA
Tx.b`[email protected]!\:..2...n..^'`u.hT.N-.....L.eR)......IEND.B`.
....


GET /images/ico_amazon.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:12 GMT

Server: Apache

Last-Modified: Fri, 16 Aug 2013 07:32:51 GMT

ETag: "218-4e40b99166ec0"

Accept-Ranges: bytes

Content-Length: 536

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:12 GMT

Keep-Alive: timeout=5, max=73

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.............(-.S....PLTE......................I......
.....G..a.....G..H....ZZZ....! ...WWW........g.o............i.........
.. ....{....kkk........x..I.......n... ..........i.........#...ppp....
...................^|||..5.....f.c....NNN........9..........,A....LtRN
S.....................................................................
...............IDAT.WM.U..0.................|X..F2af..b....>...@...
Br E!3..[Q.......%.Z@|}...,.....z...;.l....4.nC.$..vb..L8...yJ.!.|.qM2
.Y}g..Y...p@..:......{...Y.....<[email protected]`.....


GET /images/ico_vipshop.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:12 GMT

Server: Apache

Last-Modified: Fri, 16 Aug 2013 07:32:51 GMT

ETag: "218-4e40b99166ec0"

Accept-Ranges: bytes

Content-Length: 536

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:12 GMT

Keep-Alive: timeout=5, max=73

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.............(-.S....PLTE......................I......
.....G..a.....G..H....ZZZ....! ...WWW........g.o............i.........
.. ....{....kkk........x..I.......n... ..........i.........#...ppp....
...................^|||..5.....f.c....NNN........9..........,A....LtRN
S.....................................................................
...............IDAT.WM.U..0.................|X..F2af..b....>...@...
Br E!3..[Q.......%.Z@|}...,.....z...;.l....4.nC.$..vb..L8...yJ.!.|.qM2
.Y}g..Y...p@..:......{...Y.....<[email protected]`.....


GET /images/ico_vipshop.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:14 GMT

Server: Apache

Last-Modified: Fri, 15 Nov 2013 03:05:29 GMT

ETag: "1b7-4eb2e78781040"

Accept-Ranges: bytes

Content-Length: 439

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:14 GMT

Keep-Alive: timeout=5, max=72

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.............(-.S....PLTE.............................
......................................................................
......................................................................
[email protected]......=`D....o...n..!g.............
....Qmi...w..}...(...:.a{..A.D..x.......x..)._..... ..f.l...<:.....
.]^.M.F..}.....eb!p.Za.zg5!R../.....JB...vH...?.gB...M..r .. .6.Y\...]
..z.%..1......IEND.B`.....


GET /css/baidu_20141107.js?ver=1.0 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:14 GMT

Server: Apache

Last-Modified: Fri, 07 Nov 2014 03:14:13 GMT

ETag: "3113-5073c350c8b40"

Accept-Ranges: bytes

Cache-Control: max-age=1296000

Expires: Fri, 02 Jan 2015 16:57:14 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 6523

Keep-Alive: timeout=5, max=71

Connection: Keep-Alive

Content-Type: application/javascript
...........Z.W....*.....#...N{[email protected]..>.[U....3.cRuk..R..
W..... ...u..z....>.>Co....y.,.h}......:..qx2I.`..4-...........v
2.&..?.. C.^..B5.Y.Z10...U...-KQ_...6..l......]].k...0.a...6..[{.^..G.
.]z..W..)y.L|\>.6HO.....r..R....zg..M..7[.1..2.pP{..X......o...mM. 
J..l.n....e..?......^T..s'.,K..U..c...YG.....iK.3.#.U.zU.4_..L%.|d.q..
..Q .D....U.X...#O...K.7..5...-W...y..L..r..d.[..5c..s..K...r6...G..:.
c2o.C..^^..fH...........de.E..%b.A... ..iJ.,..:Z.l........f.3.].....L.
...t.^/.!..c.....u.~_{.>..:....#.aFkf)..a..D..[...X.............4V1
..jj.SS.......'].^[email protected]#..s...9.*.....R.G..."........
Z....T...1]7L........K..&[G..5.[...X41.....Z'...jZ..)....J6[1...z`...k
.P...64... ..z..u.:U.%.#.GR.#.L.3..u.].8.><.r...^.nd.w.......L.{
.6.<Q.......2k.........pc...y....TN.a'.....g.[..i. PL..=8.u.y.s.HK~
.J...i...]..V...}WI''^......DxI..U]1.....g.pH.1........y....z.f....n1.
....9..5.x......S...y...S.zs....`.h.d6....Nic....T.@_..m.T..0[:m.7..].
.~.....b.....w.*.}.......j.I.R.........BtG.},......#<.]..R....M..s.
{.....P...$Xg..T......E..$.r.d.d.YVh...<U.-.<......3..._.......%
K....j'..2..nG..bc.......W{`...B.....72.oi..fX.'.K....N~j......?.5...(
@C.9...U(0...}...N3>....M..{.Q7}...o..&2F..VS.B......*vE.$=..?|.]].
`...<..f...%W.... ./....3...LI.L.E.....F:\.....dg.I..w.........v)r.
m_.......=.Y.H!...fB.e.......B..pz..:.N.I2...4...-.....).v.3}..)...T..
.......({.K.x..d....r. (T..T........d.G.....Yj SlQ.9B.r.#...b.a..C....
.'...c.L.ul[.N..su.q...v]5c.i.N.p.H.NK75....-.....q.BQ.5S.`.....FX
<<< skipped >>>

GET /index.php?a2=1418903275130&ver=1.0 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: guess.union2.50bang.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:07 GMT

Server: Apache

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR

Cache-Control: max-age=86400

Expires: Fri, 19 Dec 2014 16:57:07 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: application/x-javascript;charset=gbk
2af0..T.gul && T.gul.init([{"category":{"name":"\u6e38\u620f","url":"h
ttp:\/\/game.2345.com\/","flid":"f2"},"sites":[{"name":"\u4e00\u520099
9\u7ea7","url":"http:\/\/VVV.602.com\/poster\/59.html?uid=2345cpc&
suid=zlcq","ggid":10188,"mrid":"m0"},{"name":"\u88c5\u5907\u5168\u9760
\u6253","url":"http:\/\/baidu.code.junminshuiku.com\/htmlcode\/594.htm
l","ggid":9976,"mrid":"m0"},{"name":"\u975eRMB\u7f51\u6e38","url":"htt
p:\/\/mx.jzyx.com\/home\/ad?ad_id=251496","ggid":9986,"mrid":"m0"},{"n
ame":"\u70ed\u8840\u4f20\u5947","url":"http:\/\/cdn.9377.com\/welcome.
html?id=5034","ggid":10337,"mrid":"m0"},{"name":"\u6728\u74dc\u5947\u8
ff9","url":"http:\/\/cdn.9377.com\/welcome.html?id=5036","ggid":10338,
"mrid":"m0"},{"name":"\u9b45\u5f71\u4f20\u8bf4","url":"http:\/\/cdn.93
77.com\/welcome.html?id=5032","ggid":10339,"mrid":"m0"},{"name":"\u4f2
0\u59471.76","url":"http:\/\/VVV.602.com\/poster\/57.html?uid=2345cpc&
amp;suid=mycs","ggid":10189,"mrid":"m0"},{"name":"\u6302\u673a\u6ee1\u
7ea7","url":"http:\/\/cdn.9377.com\/welcome.html?id=4262","ggid":9853,
"mrid":"m0"},{"name":"\u72c2\u64b8BOSS","url":"http:\/\/g.qqq937.com\/
s\/1\/728\/19634.html?uid=515372","ggid":10341,"mrid":"m0"},{"name":"\
u6c38\u6052\u5947\u8ff9","url":"http:\/\/cdn.9377.com\/welcome.html?id
=5035","ggid":9938,"mrid":"m0"},{"name":"\u88c5\u5907\u65e0\u9650\u638
9","url":"http:\/\/mx.jzyx.com\/home\/wmad?ad_id=251870","ggid":9770,"
mrid":"m0"},{"name":"\u5c71\u6d77\u7ecf","url":"http:\/\/g.qqq937.com\
/s\/1\/728\/20572.html?uid=515572","ggid":10340,"mrid":"m0"},{"nam
<<< skipped >>>

GET /web/ajax43?uId2=SPTNPQRLSX&r=http://VVV.2345.com/?6225&fBL=1024*768&lO=10188|9976|9986|10337|10338|10339|10189|10152|10265|10331|9751|10303|371|10301|10212|10251|7743|6796|8965|9681|10220|f2|f4|f999 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: union2.50bang.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:08 GMT

Server: Apache

Set-Cookie: uidFlag=1; path=/; domain=union2.50bang.org; expires=Sun,22-Feb-2099 00:00:00 GMT

Set-Cookie: uUid=A9DA549307640006A2FF01950246; path=/; domain=union2.50bang.org; expires=Sun,22-Feb-2099 00:00:00 GMT

Set-Cookie: uHTL=1; path=/web/ajax43; expires=Sun,22-Feb-2099 00:00:00 GMT

Set-Cookie: uHTT=1418921828; path=/web/ajax43; expires=Sun,22-Feb-2099 00:00:00 GMT

P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Cache-Control: no-cache, must-revalidate

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Content-Length: 0

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/plain
....


GET /web/2345?uId2=RSNVXNQSPV&r=&fBL=1024*768 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: union2.50bang.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:08 GMT

Server: Apache

Set-Cookie: uidFlag=1; path=/; domain=union2.50bang.org; expires=Sun,22-Feb-2099 00:00:00 GMT

Set-Cookie: uUid=388D54930764000DCD552AEA0247; path=/; domain=union2.50bang.org; expires=Sun,22-Feb-2099 00:00:00 GMT

Set-Cookie: uHTL=1; path=/web/2345; expires=Sun,22-Feb-2099 00:00:00 GMT

Set-Cookie: uHTT=1418921828; path=/web/2345; expires=Sun,22-Feb-2099 00:00:00 GMT

P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Cache-Control: no-cache, must-revalidate

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Content-Length: 0

Keep-Alive: timeout=5, max=99

Connection: Keep-Alive

Content-Type: text/plain
....


GET /web/ajax43?uId2=SPTNPQRLSX&r=http://VVV.2345.com/?6225&fBL=1024*768&lO=10188|9976|9986|10337|10338|10339|10189|10152|10265|10331|9751|10303|371|10301|10212|10251|7743|6796|8965|9681|10220|f2|f4|f999 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: union2.50bang.org

Connection: Keep-Alive

Cookie: uHTL=1; uHTT=1418921828; uidFlag=1; uUid=A9DA549307640006A2FF01950246

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:09 GMT

Server: Apache

P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Cache-Control: no-cache, must-revalidate

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Content-Length: 0

Keep-Alive: timeout=5, max=98

Connection: Keep-Alive

Content-Type: text/plain
....


GET /web/ajax?uId2=SPTNPQRLSX&r=http://VVV.2345.com/?6225&fBL=1024*768&lO=detected HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: union2.50bang.org

Connection: Keep-Alive

Cookie: uidFlag=1; uUid=A9DA549307640006A2FF01950246

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:11 GMT

Server: Apache

Set-Cookie: uHTL=1; path=/web/ajax; expires=Sun,22-Feb-2099 00:00:00 GMT

Set-Cookie: uHTT=1418921831; path=/web/ajax; expires=Sun,22-Feb-2099 00:00:00 GMT

P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Cache-Control: no-cache, must-revalidate

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Content-Length: 0

Keep-Alive: timeout=5, max=97

Connection: Keep-Alive

Content-Type: text/plain
....


GET /web/2345?uId2=RSNVXNQSPV&r=&fBL=1024*768 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: union2.50bang.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:12 GMT

Server: Apache

Set-Cookie: uidFlag=1; path=/; domain=union2.50bang.org; expires=Sun,22-Feb-2099 00:00:00 GMT

Set-Cookie: uUid=9F895493076800092D0AF9C2024C; path=/; domain=union2.50bang.org; expires=Sun,22-Feb-2099 00:00:00 GMT

Set-Cookie: uHTL=1; path=/web/2345; expires=Sun,22-Feb-2099 00:00:00 GMT

Set-Cookie: uHTT=1418921832; path=/web/2345; expires=Sun,22-Feb-2099 00:00:00 GMT

P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Cache-Control: no-cache, must-revalidate

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Content-Length: 0

Keep-Alive: timeout=5, max=96

Connection: Keep-Alive

Content-Type: text/plain

GET /css/index_20141217_01.css?v=5.28.1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:56:56 GMT

Server: Apache

Last-Modified: Wed, 17 Dec 2014 02:05:42 GMT

ETag: "12f51-50a5fe9aaa980"

Accept-Ranges: bytes

Cache-Control: max-age=1296000

Expires: Fri, 02 Jan 2015 16:56:56 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 15974

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/css
...........}i..F.....?p.`.. .xKz....t.=.n`....Y.@."%.%..D.;...7oFfF&..
...z..G...w.y.-O....l.8..7..~..v_..z.=L....S...T].4../...<L..I.....
6.l..6.l..6.l..q..7.z7..I]O...5..|.N....R....uw.O...Y..u..j...=./....}
w...c_..../O..p.....n.....s..............\.9..>oLt..[w........Y..xj
..........5./M........Nus........._...2. ..=.......>7wQ..i..r....-.
...;4/...n..nZ......./.~..A.E3....;.Y w.t4..Yu..o...k.....]w.y(.h.....
....Y..G.....Gww..y..5..Z....|.og...}. .}s...4...7.7..`..V...M...d.X..
...._.s[.......u.....?<w...z)..x..tw...I...w[.!.rd.....,.N.....cw..
C.2[....z.95.A....,.........d...f...|.X./..\.....!j..7.k.d......_.H...
G...l...pL...K...Y...Q......}.*.f......h.....f..}7.-....Y.......f....)
.`..........X.........UW..j......o.....wQ~|...}..H..].n.UD..g..V..J...
.....C.pT."'.9M. .......jC....L...._.dNEGa.&.=.DU...TmNf.'v,)...T5....
..{.Zt...K...l.....l..Z.,#...y.....'.[.w.Z.......][.o.M.....f...C..tF.
.....mY......A...&........vB......O......R._..O.}.i.........q.p....".g
...=.....2.C'...V....... .b.......y.k.....}..............p./o...`..|.6
....r.P.......|?#_............C. P..qO....]Aw\.~..V.d.d.v...N.hO..l.".
.......ddpg....Z.......y}....^......c.t;rn.k.O..?.&.7..B..V.SQ..J...8.
b.T...C.p.j.#.y$......}I.~>....x.z..-..N..\F_...iK....H!.0.....%UB.
1.1o~j.'I.L9...3.dv.r..t.'o...-..3...v.'....2h.!A..H...!7.5.v.j......Y
.[.`....|i...i........[mtr...Ih...<....b k.k......W.4yH..W...{.....
.....z..a....O....F....e.._.^....7.|E...^........I..!...$..<...u.n.
.v.)`...l...B.....5/o.Oq.f..G..-3......-j.....BJ...i.n..r.jP....3.
<<< skipped >>>

GET /images/body0_2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:00 GMT

Server: Apache

Last-Modified: Wed, 08 May 2013 03:53:33 GMT

ETag: "b7-4dc2ce0adc940"

Accept-Ranges: bytes

Content-Length: 183

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:00 GMT

Keep-Alive: timeout=5, max=99

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.............*<V....0PLTE..........................
......................cL.....BIDATHK..G.....@.w...D..m.eN..u......PO..
p..zW.e.cP~'.....vU.....Z ....<.......IEND.B`.....


GET /images/lazyloading.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:01 GMT

Server: Apache

Last-Modified: Tue, 07 Jan 2014 05:58:06 GMT

ETag: "6fb-4ef5b0f623780"

Accept-Ranges: bytes

Content-Length: 1787

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:01 GMT

Keep-Alive: timeout=5, max=98

Connection: Keep-Alive

Content-Type: image/gif
GIF89a . ............................444...............TTT...!..NETSCA
PE2.0.....!.......,.... . ......I)K....JJ5....U.RK....(..&...05 /.mbp.
z...1...;$.1C....I*..HCh`A.o..."3qT5.\.8a....B....d..wxG=Y..g...wHb..v
.A=.0.V\.\.;........;...H.........0..t%.Hs..rY<H...........b..Z.b.O
Eg:...GY]..=.A.OQ.s....\b.h.9.=sg...c..e....*....f.7D..!.......,......
....r..I..5........bRH.h.W...*lkL&-)..1-..v.m...).....M..t.\.....Rd..A
..H..... .......o............................Gz{..!.......,..........r
[email protected]!(.(.(..8.........J..Kb..r....3.h..K!..6..3u`.&.D.A..z.
fL.Z*..^`n.F.....O..ssyJ}T....N.aqXshC..XJ...!.......,..........i....Y
4.......Cv....A.M.A."....J..j..A'.0T....*.b..JI.I..ZF..P.MM...s.bg.qV$
........v.!...5....?}..........!.......,..........ep....80....#^.q..X.
...[..(\.-......S..@ P....0". ....L......z...xL....*Z....._..H......D.
.eU..ywZt.n..!.......,.....................A.2.W..E.&j.....B.&..w~.6..
b8....p`4r|.F...M.>.......,bLv|?.4B.v......P..u.9.. .&..2..x&...k..
&...U]..vo...o..p..raT&..!.......,..........{.........'..e.7......\l.-
).S7@.&..4. `.yT.SL.\:=.....J..k...:......;.e....8.c.A.8O.j@b/. :.{..t
y....t#....|.....-...mN..qK..!.......,..........l..I .8.b....y ..h..*.
...Zp=.....3...`.....C....`B.".p..X..9bP...B.`Z=.....8.>.u,.S..t"..
O..T\um.|.;....8.~*..!.......,..........x..I.......A.]G...e..AP.b.)...
"!s...... .B..I..........V...5q(.(.X2=.,.I.........n#&..A....Vq5t..sn.
y\)_.....g......|r.5..!.......,..........g..D .8.[{.`&y_h..I.).(L.". g
N.8..l5.."....L..A ...%@%[email protected] ............p.us/.j...j.Vj..
<<< skipped >>>

GET /i/search0320/baidu_web.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:01 GMT

Server: Apache

Last-Modified: Wed, 20 Mar 2013 08:34:57 GMT

ETag: "78a-4d85718d1ce40"

Accept-Ranges: bytes

Content-Length: 1930

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:01 GMT

Keep-Alive: timeout=5, max=97

Connection: Keep-Alive

Content-Type: image/gif
GIF89aU. .................cZ.............9/......ZU..........!..XMP Da
taXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x
:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.
134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="http:/
/VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:abo
ut="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpM
M="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/x
ap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xm
pRights:Marked="False" xmpMM:OriginalDocumentID="xmp.did:91695398A26DE
111951AE4839BBBE675" xmpMM:DocumentID="xmp.did:6E0F9B15912F11E29525B1A
BCBF93F2A" xmpMM:InstanceID="xmp.iid:6E0F9B14912F11E29525B1ABCBF93F2A"
 xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:C68C50D22D91E2119448AF4ED6042198" stRef:d
ocumentID="adobe:docid:photoshop:f6eab62f-7678-11e1-82f0-c1042319e464"
/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <
;?xpacket end="r"?>................................................
......................................................................
............~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFE
DCBA@?>=<;:9876543210/.-, *)('&%$#"! ...........................
......!.......,....U. ......I..x6.j.`(.....'5...p,S......|..6@ ...|.d.
.....(..d<.(.t.3...k..-S.P*...0l..\Rc>........}s\jO!..q.JX.;.C.o
6V.Jup..(..`vr.......#.....c.E..c........................d.....o..
<<< skipped >>>

GET /images/common/top_1022_2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:01 GMT

Server: Apache

Last-Modified: Wed, 22 Oct 2014 11:39:34 GMT

ETag: "ae8-5060166dc4980"

Accept-Ranges: bytes

Content-Length: 2792

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:01 GMT

Keep-Alive: timeout=5, max=96

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.......L.............tEXtSoftware.Adobe ImageReadyq.e&
lt;...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:02EB2AA2DB59E411A450A31A7A3C5854" xmpMM:DocumentID="xmp.did:EED6
337759DF11E48698BD530B7A2145" xmpMM:InstanceID="xmp.iid:EED6337659DF11
E48698BD530B7A2145" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:03EB2AA2DB59E411A450A3
1A7A3C5854" stRef:documentID="xmp.did:02EB2AA2DB59E411A450A31A7A3C5854
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>...8....PLTE.....[......8.........9#.....%..R..
... y................-q.......................a.....~..B.....h.%......
..-.."..).ya..'..&...../..,D....$....ya.xaS......N#............\.....V
.... :.............&~....#..............[d..9..s.......... ..!...v.i..
.........6........W...o......yW..$...H.... ..'..$.....................
........0...........*e..............z.............0...pvl...E..<...
........../..-..'.{Y../.. ........5...|....!.............{[.....(h..g.
....k....0.....0........(..... .....8R.........{[..4.........M....
<<< skipped >>>

GET /images/common/login_1217.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:02 GMT

Server: Apache

Last-Modified: Wed, 17 Dec 2014 02:05:51 GMT

ETag: "575-50a5fea33fdc0"

Accept-Ranges: bytes

Content-Length: 1397

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:02 GMT

Keep-Alive: timeout=5, max=95

Connection: Keep-Alive

Content-Type: image/png
[email protected] ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:3E13F04E9F31E4118E06FC0B05C7E7DF" xmpMM:DocumentID="xmp.did:72AE
E638859011E484A69228404F635C" xmpMM:InstanceID="xmp.iid:72AEE637859011
E484A69228404F635C" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D17513E18B85E411ACC5
B2DF4C75ECA7" stRef:documentID="xmp.did:3E13F04E9F31E4118E06FC0B05C7E7
DF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>!ud....QPLTE.....................MMM.3.......
................................................33......tRNS..........
.................'4.5...!IDATx......0...q....H..A..Y.....C....}..9T...
..&c.0..3&.Ub.[GLpk....\........V.P.5.Z..0.....a2.....b.[{Lp...4.....4
...X.Q..bn.&...c.....\)M......0....X......&..s=/.:..5..v)M....~Y..e.d.
..aV.....7_%.?DZ.y).DKo..hU.-....%Zz..DK.em...fcZ.-...[9.u...h..{.E.o,
v%.*...[.....E..v...S....An6....0.P|[email protected]`.....
<<< skipped >>>

GET /images/lazyloading.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:02 GMT

Server: Apache

Last-Modified: Tue, 07 Jan 2014 05:58:06 GMT

ETag: "6fb-4ef5b0f623780"

Accept-Ranges: bytes

Content-Length: 1787

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:02 GMT

Keep-Alive: timeout=5, max=94

Connection: Keep-Alive

Content-Type: image/gif
GIF89a . ............................444...............TTT...!..NETSCA
PE2.0.....!.......,.... . ......I)K....JJ5....U.RK....(..&...05 /.mbp.
z...1...;$.1C....I*..HCh`A.o..."3qT5.\.8a....B....d..wxG=Y..g...wHb..v
.A=.0.V\.\.;........;...H.........0..t%.Hs..rY<H...........b..Z.b.O
Eg:...GY]..=.A.OQ.s....\b.h.9.=sg...c..e....*....f.7D..!.......,......
....r..I..5........bRH.h.W...*lkL&-)..1-..v.m...).....M..t.\.....Rd..A
..H..... .......o............................Gz{..!.......,..........r
[email protected]!(.(.(..8.........J..Kb..r....3.h..K!..6..3u`.&.D.A..z.
fL.Z*..^`n.F.....O..ssyJ}T....N.aqXshC..XJ...!.......,..........i....Y
4.......Cv....A.M.A."....J..j..A'.0T....*.b..JI.I..ZF..P.MM...s.bg.qV$
........v.!...5....?}..........!.......,..........ep....80....#^.q..X.
...[..(\.-......S..@ P....0". ....L......z...xL....*Z....._..H......D.
.eU..ywZt.n..!.......,.....................A.2.W..E.&j.....B.&..w~.6..
b8....p`4r|.F...M.>.......,bLv|?.4B.v......P..u.9.. .&..2..x&...k..
&...U]..vo...o..p..raT&..!.......,..........{.........'..e.7......\l.-
).S7@.&..4. `.yT.SL.\:=.....J..k...:......;.e....8.c.A.8O.j@b/. :.{..t
y....t#....|.....-...mN..qK..!.......,..........l..I .8.b....y ..h..*.
...Zp=.....3...`.....C....`B.".p..X..9bP...B.`Z=.....8.>.u,.S..t"..
O..T\um.|.;....8.~*..!.......,..........x..I.......A.]G...e..AP.b.)...
"!s...... .B..I..........V...5q(.(.X2=.,.I.........n#&..A....Vq5t..sn.
y\)_.....g......|r.5..!.......,..........g..D .8.[{.`&y_h..I.).(L.". g
N.8..l5.."....L..A ...%@%[email protected] ............p.us/.j...j.Vj..
<<< skipped >>>

GET /images/bgs14.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

GET /images/bgs14.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:05 GMT

Server: Apache

Last-Modified: Fri, 06 Dec 2013 07:08:26 GMT

ETag: "197f-4ecd84ffe4e80"

Accept-Ranges: bytes

Content-Length: 6527

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:05 GMT

Keep-Alive: timeout=5, max=93

Connection: Keep-Alive

Content-Type: image/png
[email protected]...............
........................................fff...........................
............................................j.........................
................>..........[.N.W..A..............S.................
....f....*............................................................
...........................|||........................................
.....qqq..Niii......ggg..................Z.c..9...q......g$.._........
..............p............n......{{{...................p......yp.....
.....................hhh.....8.f#........^uuuZ.b.................z...}
}}......kkk..o....q..u..................................zzz...~~~.....
.nnn......sssooo................................................yyy...
......lllvvv...ppp..........................4.....tRNS................
......................................................................
......................................................................
......................................................................
..............................S..%....IDATx....x..y.`T,....P..j.6Gs .A
...P.,..eK.d.. .L[..IY.M.....%Y....-;...Gl...'q.&i..Ms.g.....n.h......
.....;...@. .x93{...B...........I..........IC......,?.*...t9.S.....D..
..K1.......... .....!..-.U..-............ ...7.|.C..c..j.k..j....d...,
.#...[U..2...j..../^...)..6.....-.....l..!E.%bi#X.XJ./9 D..../.......Z
[email protected]..[[email protected]_". ....D0..!1....V...j.H.}..... ....\
ya%.b.`V......\. ..T.H........n|..p.ii(..ii.C.2v^..F........)h.d..
<<< skipped >>>

GET /right/homepage/zjsVersion.js?t=1418903269317 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:06 GMT

Server: Apache

Last-Modified: Thu, 18 Dec 2014 16:30:04 GMT

ETag: "124-50a801ab95b00"

Accept-Ranges: bytes

Cache-Control: max-age=1296000

Expires: Fri, 02 Jan 2015 16:57:06 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 221

Keep-Alive: timeout=5, max=92

Connection: Keep-Alive

Content-Type: application/javascript
..........E.1o.0.....N......N.Q'$P.vcA.........VB...4...{z....w.......
.m....g..Sd.......}Gx...i."j..'wJ.........0..w.Z .e)`g...C.5.:K...X.b.
..`.....*.....[.Tee.[[email protected]..$../.%.
.......$.......


GET /images/common/search_140829.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:06 GMT

Server: Apache

Last-Modified: Wed, 10 Sep 2014 06:11:48 GMT

ETag: "904-502afed573100"

Accept-Ranges: bytes

Content-Length: 2308

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:06 GMT

Keep-Alive: timeout=5, max=91

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.......m.............tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:D23E308D3C2FE411AD20F759CC993D01" xmpMM:DocumentID="xmp.did:97EE
EE3A2F4911E4909BD568623D741A" xmpMM:InstanceID="xmp.iid:97EEEE392F4911
E4909BD568623D741A" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D93E308D3C2FE411AD20
F759CC993D01" stRef:documentID="xmp.did:D23E308D3C2FE411AD20F759CC993D
01"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>*..E....PLTE.................................
......................................................................
......................................................................
......................................................................
............................<.....ZtRNS............................
.................................................................o....
IDATx....R.0.E.$..........]RH.......l..-.20.\...3..cA|t.dKv.......~2.k
p..'....N.....:=...\.x...N~...,..HLY.&b*...0>$qe.}..|...,....~.
<<< skipped >>>

GET /css/func_20141215.js?ver=1.0 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:06 GMT

Server: Apache

Last-Modified: Tue, 16 Dec 2014 02:09:38 GMT

ETag: "bd87-50a4bd9e45c80"

Accept-Ranges: bytes

Cache-Control: max-age=1296000

Expires: Fri, 02 Jan 2015 16:57:06 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 21362

Keep-Alive: timeout=5, max=90

Connection: Keep-Alive

Content-Type: application/javascript
.............W.../.U.......h.G.0....IH...d[.d<0E.......,.......u.Z.
;.R..v....wn.....I...C.U|......3t.t..s.N.#<.s..}.....h...&E..-.J ..
.......z.>.E........;...........Nb.[4.RiV...7o...p.s......".K......
.......K7N...I.z.w....0.o..of7...i..........h...e.O....0.b../.....a...
. ...?*o[oK............_.]...~[.p...)..be...q........7.....W... Z...K&
lt;z. ..P..gZt.I.,j......*ni6...............XRl...x.6..~.....k..W.F...
......k......{p}].x..{..n....[..%........f.>....#j!..!(...f.VA!S__[
...pS.^...B..Y.wW.............. ..Ix.....S..&..Rx\.Cl..9.....g....,...
...\.OT.UX.s...j.y=<.....|=...6...|.....K|........y....O....l6 .J..
..I.jO..5...m*K....d-....@...].]...K?..d.Y^.....j...a....iiF....V.....
.;t*G..q..J.Q..=.7.1p...%..c.....(.4........(..I.........-....8\/.Fa.p
.O....Ko...r\.T...<[email protected]..
...p.[d.f......{LJ.......n7~....x....m........B.....F....h..,5..R.8...
....Y)0d.N.V... ..x}}..Y...za..)...R......<......|..(.o..o.........
Q.n.=U>._.;uE...w....D..v......{...YwL.........~a.*-q..\....f *.O..
...k....6......m..).a.....3..;...).......U..N.b. .2. ......V.L..e...R;
.J=.......-............~N~.Y....Z.\d.%..r.8m....C...f.(.N .s.....HrBo.
e-.8...b...vZ\....*[email protected]...._[K'TR.....am.r..,.
..m.F..k...kH,(......6;.Q......O.M....b....K...x..o7 ..R.I.V.../E.....
/DAa}k.F^....oZ....x...f>.....*.....*.P.{/.....L.....U.E..U..FVE$4.
..&..Y..p.U....H0. M5..B...}...P..IXT-&.r.o.....q.o....ST....g.i....e 
o....hrg.....I9......$.Y..>ob................{r........y......8
<<< skipped >>>

GET /i/topic_anquan_1011.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:08 GMT

Server: Apache

Last-Modified: Fri, 10 Oct 2014 10:05:32 GMT

ETag: "26ae-5050eb079b300"

Accept-Ranges: bytes

Content-Length: 9902

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:08 GMT

Keep-Alive: timeout=5, max=89

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.......2......U-.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...viTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:10232b79-b08f-1942-83cf-64dfa00c99e3" xmpMM:DocumentID="xmp.did:
9167E913506411E4BC8798170BCC4A93" xmpMM:InstanceID="xmp.iid:9167E91250
6411E4BC8798170BCC4A93" xmp:CreatorTool="Adobe Photoshop CC 2014 (Wind
ows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7c1397ad-604
9-7744-9d97-2450e8e7137a" stRef:documentID="xmp.did:10232b79-b08f-1942
-83cf-64dfa00c99e3"/> </rdf:Description> </rdf:RDF> <
;/x:xmpmeta> <?xpacket end="r"?>.&\B....PLTE..........|......
......................m.h.......................W.........;.....1.....
.`eh..]........h.....i..............u..R...t..!(......../.............
x.&........h.....$.....E........U.....................................
.}.................&.....B{.(x.I..!...........j..;.........Y..........
.g....M.. ......................................i............a....... 
i..........:........x.....8..g................./..f........Z.........{
.......B..Q......s....#........m........3......................>
<<< skipped >>>

GET /right/homepage/newsChannel_20140611.js?t=1418869995&ver=11.18.13.2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:08 GMT

Server: Apache

Last-Modified: Thu, 18 Dec 2014 16:51:29 GMT

ETag: "1a3a-50a806750e640"

Accept-Ranges: bytes

Cache-Control: max-age=1296000

Expires: Fri, 02 Jan 2015 16:57:08 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1518

Keep-Alive: timeout=5, max=88

Connection: Keep-Alive

Content-Type: application/javascript
...........X.O.G..W. U...}?..J.!$MB"."...n..Ss...I.......s.p.5?ds...g.
y|3{.Y.......0.....w..3....`.........f...bX....7.....I1..q!..F]..8..q.
..>.:.....b.-..\iE...e..&.t.'&.:...b....rg...J.:..lO.;..W.P....,x..
.n'....J..t\......Xm1|.w(..gG.0...g......b6.M...W.P.E(]1........... ..
...{.U.X..* XCLg8.....xv...`...j...X."[email protected]...%..h....GU.. }... .....
.%.M2... ._y8...z..~.v....E....wD....3...I9#...7.:$...J..4..k..3:....#
.....,&'.7...-..._.!.....z1..V......Z.`....Q_.g....R.y.U..~.v.#....>
;xj..4..Z.Y./....b.....D.*...X..a1M..."[email protected]:.....-.
.............L6=.n\N.!!Z...{.p\...>...7....M.]~.as.......P ...#....
....o.%!.R...80......U..c).Ms...tuy&&Fe......:...b Az... .v..........o
.....l.........E#0,.......a.4....%..ET......,.."....?..T.........?..b.
a.f..".......q..U..Xz#2.En.V.V....:!......I".W......X<...Em..S..L..
.D.b..R....R6K..]..SE,...,.8.T.V@.)...[...E......."[V.3........4\.....
X..P.4....R.`...Q..qr.gW.|.....J]..s.U...$..d~...%...t.t.Uj8.....p....
{^I...*..*..%..22D....6....r&._ir}'-J.QvG..u... .F.N...".,...S......&}
@.D"..6.^i...,...<......v............F....M.RW......y.Hl...<..O.
FZg...B........1.5.<?$....eJF.S...%..-.}..\$...9......?Rq... ..dw..
.,....V...(.<x. B.d.L......B#.e.R.]...x{.._..H............/.....69.
T......v]...z:.ccP....P...f.0t.m..18S.QX..u.f.m.NRa..6^.I.d.....6^<
.tZ..;.Y,..VFH.%.A%.M...HH.Dfh.L2.Z4Q.lM..hP.;.6j...Ul.D..;.Z:E...^.$.
,.Z...j..kskgRRD.\..278}iD.]..]QT.VA.Sx'BK.....Kc.\U...H.f.. ..fk1....
I...m.4.....h..;.Z:...._.....n..)nY.E.<..7..6)...............F~
<<< skipped >>>

GET /right/homepage/entertainChannel_20140903.js?t=1418882098&ver=1.0 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:09 GMT

Server: Apache

Last-Modified: Thu, 18 Dec 2014 16:30:02 GMT

ETag: "1bf6-50a801a9ad680"

Accept-Ranges: bytes

Cache-Control: max-age=1296000

Expires: Fri, 02 Jan 2015 16:57:09 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1458

Keep-Alive: timeout=5, max=87

Connection: Keep-Alive

Content-Type: application/javascript
...........X.n#7....O-..%..M.._.[.....v.v.d."[..K.../...Y.Ql..!)...._.
m_........mY_.....?..-....&^...6....;....qS.)...S......?7.f..u.J...a.O
g...3.4/>..y1`...c.^......\....v...e..og.fi...........TQsAG..\...z.
o..&..~M...`J..lF.u..p*zE{46..g.-....4s.Y\=?.....b.7....<.Ei...f...
...E.J.!.....!..).0A........*.K.&..\*[email protected]|..{..}.(.....4.x
P.s>...4.ZK...F{.o.^].D.$Y..so..A5..1&.eQ.d.L.....Fr^.....x:....Z.x
..x"oX<o5....wn!k...y.'1.c...}.W`..<`.-E..F;|....-.Y.1....,.....
}[email protected]..,...!.J..1.mM.*"DrTW..].y.j...[.........
$!....rX'<..rpYE.L1.eZ.3.....H..%/...u.]..g:'.I.......@*c..;T..S..N
QX....*m...e0.2XIc..\..I<.V.j.U...gVg0.CGt.&t...V.j......E...HS5...
..szW.\..Y.......3_b..r.W.5......%.*E..d<.0O....M.A2.{.~N....~._@N.
.7.&..S.z..e...=y. a.M.) j".....ePr..4..E2.`;I.r....I\...........H....
....*]......]Ar.........w..w....a.x]....p..4.S....".0(.....AQ2..BN....
..:...j8...vM".b......w..E.0. ih........;9.$.bUl..9...A...B.*.L....'Y.
.b5l.Zc/|.....8..E....1(.$.`k.s.v(....o,..".R.v..!$..q......D.j4...ZS.
|\.....d...8. .....P....2mX:....z.rB6.f..2.y.,....wsl....QL.?d...w....
.j.X.a.@p...).d..KZp.B....f.......&Nj.!M.)..eg.............?w[=...}A..
...m$.S..G...d.A....:.}.................4.....D...]%.5?...8....BR..V..
...>}....XX.A..."-y.-.u..f..M....Xk.}..)..g... [email protected]].Ia..../.@.
.o|(.p..!..'.e.i...[`.n~.}.I]...'1.m..4...T.}....cgA6.JH.FF!Ck.V.....j
... O7..>.....3..V.e'?>.A)~..b..6S....L....*4?...... ."[:#u.>
S.m..!$.2r......`f..........
<<< skipped >>>

GET /i/cert-cyberpolice_0829.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:09 GMT

Server: Apache

Last-Modified: Wed, 10 Sep 2014 06:11:23 GMT

ETag: "939-502afebd9b8c0"

Accept-Ranges: bytes

Content-Length: 2361

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:09 GMT

Keep-Alive: timeout=5, max=86

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:F0A3CEA7324E11E4AD06B19B
7D68C118" xmpMM:DocumentID="xmp.did:F0A3CEA8324E11E4AD06B19B7D68C118"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F0A3CEA5324E11E4AD
06B19B7D68C118" stRef:documentID="xmp.did:F0A3CEA6324E11E4AD06B19B7D68
C118"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>........PLTEgggrrr............hhh..........
.............t..v...qp......{....!.......CBI.....fC@IFMS...........}k.
...............nf....a....."...C>.JE<.........OML...............
...O.......}......oh......}./C9;Asq....%&6w..^..TTf......o..m..pj.^\e.
.{|..wkl.....33..43.;7.....D3......&A]..................IKIc........_x
..... ......................bc`.................n.........m..?B.......
|xw............g..........jQNM{wr.1D...R[_...vup..................( ..
......#8......~qk.............?LNMC......rm.ae..LJ.........bk.\.....91
5~..>.....i.....z...........JH|4.h............zmV..............
<<< skipped >>>

GET /images/ico_taobao.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

GET /images/ico_taobao.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:11 GMT

Server: Apache

Last-Modified: Fri, 27 Sep 2013 10:25:50 GMT

ETag: "3be-4e75ae90f2780"

Accept-Ranges: bytes

Content-Length: 958

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:11 GMT

Keep-Alive: timeout=5, max=85

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.............(-.S....PLTE....i/.m4.J...V..............
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..........................................Y....tRNS.........SOx....dID
AT..U.A..1..$.,..q.I..n.X.......n.X....d.4..m....yN!.........F|.G.n...
.`...-....I..YLej.j..1.e..<......K.e....IEND.B`.....


GET /images/mz_ic_tmall2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:11 GMT

Server: Apache

Last-Modified: Thu, 10 Jul 2014 10:04:51 GMT

ETag: "4fc-4fdd3f4a196c0"

Accept-Ranges: bytes

Content-Length: 1276

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:11 GMT

Keep-Alive: timeout=5, max=84

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:0480117407206811822AB97ADF869A58" xmpMM:DocumentID="xmp.did:CDF9
C3FAFF3E11E3A69CE6CFEC5F358C" xmpMM:InstanceID="xmp.iid:CDF9C3F9FF3E11
E3A69CE6CFEC5F358C" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:058011740720681182
2AB97ADF869A58" stRef:documentID="xmp.did:0480117407206811822AB97ADF86
9A58"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.='Z...*IDATx...Oj.@.._B.e.Rs...7.M....&7p.
....7..........&H.........&....0......(..f.'....).X... ._...o?<D...
.F.X.k!.#...h.l.;.......bMx.J.....k....`p..~}@...k:EK..M&.:..6....2. .
.%....=.z...h....w.E...\.J.}]....#.....o.L,....K4.....e...........u]&.
.Z.k.f.$I>!...Y..=...!Vu.g..qD..A.4M..|.l}....yH..&._...>.....IN
....IEND.B`.....
<<< skipped >>>

GET /images/ico_ganji.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:12 GMT

Server: Apache

Last-Modified: Mon, 27 Jan 2014 10:41:10 GMT

ETag: "a7-4f0f15888fd80"

Accept-Ranges: bytes

Content-Length: 167

Cache-Control: max-age=31536000

Expires: Fri, 18 Dec 2015 16:57:12 GMT

Keep-Alive: timeout=5, max=83

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR................a...nIDAT8..SI.. .....2....E..p.!h$..\
...Dg.E..\l.4. B.Y..-.K.,Yk%..c~....k..~:B. q5...........s.Lv...Kl.x..
?.w;.....(8&.......IEND.B`.....


GET /images/mz_1112_jhs_01.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.2345.com/?6225

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.2345.com

Connection: Keep-Alive

Cookie: sts=0; _CC_={"closeSpotlight":0,"ggbd":0}

HTTP/1.1 200 OK

Date: Thu, 18 Dec 2014 16:57:12 GMT