MD5: 00956e5276f734217091682b0990d39d
SHA1: 48f18fb8b0e57770c05e38abce663225b44bcbc7
SHA256: 17f9a6563e58032f3be5ee1dbba9dc8837b342d72c818c2b9ebda435f75ba86f
SSDeep: 98304:5F86/qjqdwkLQHHhsSYt815zc1WiJvJBAUZL1c:Y1csKSOTJV6
Size: 3768320 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2014-06-09 03:59:16
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:668

Mutexes

The following mutexes were created/opened:

SHIMLIB_LOG_MUTEX
{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
ShimCacheMutex
746bbf3569adEncrypt

File activity

The process %original file name%.exe:668 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\A4399dv_base[1].swf (5584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\faspbtn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\bg_1[1].gif (791 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\ico_ann[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\logo[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\hottop[1].gif (857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\icon_keys[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\b_2[1].gif (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\t_1[1].gif (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\1GQ340U13[1].gif (527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\zwsf2-3[1].gif (1352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\v134main[1].swf (331219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\c_5[1].gif (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\libg_2[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\MagicWeaponv1240[1].swf (210540 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\jquery-1.2.1.pack[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\bg_9[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\0f000QECn8mWOOje4W2f30[1].swf (810 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\ctrl_mo_v5[1].swf (39156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\t_9[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\crossdomain[1].xml (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\stat[1].php (1163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\4399_14504425052[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\lazy_iframe[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\sy_ico[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\4399_17564382760[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\libg_1[1].gif (899 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\zrsp_1[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\121055423955[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\t_3[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\0f000ZtbOwy2j0IrKBdl36[1].jpg (1943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\zmxy3_20130916[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\go_bbs[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\v134main[1].htm (923 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\stat[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\sszn[1].gif (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\game_bg[1].gif (776 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\bg_3[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\bg[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\n_zm1[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\ucenter[1].js (14244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\click[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\tjrm_img09[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\bds_s_v2[1].js (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\1016440UA2[1].jpg (1855 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\t_lm[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\tgbtn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\bg_5_20130716[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\more_boss[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\play_hs1202[2].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\101639333L6[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\t_4[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\base[1].css (9771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\bg_7[1].png (6 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@163[1].txt (338 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\lmbtn[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\ftbtn[1].gif (477 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@4399[1].txt (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\4399[2].js (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\78072[1].htm (3238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\logger[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\uijs[1].php (1541 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\core[2].php (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\crossdomain[2].xml (331 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\zb_nav_20131205[1].png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\b_4[1].gif (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\jquery-1.2.1.pack[1].js (1740 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\4399_17053265645[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\new5[1].gif (177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\4399[1].js (902 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\c_2[1].gif (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\t_2[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\1016395W521[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\1Q62S330N[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\zmxy3_20130916[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\core[1].php (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\more_boss_s[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\ecom[1].xml (233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\headerBg[1].gif (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\flash_ctrl_version[1].xml (530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\4399_16460972266[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\tjrm_img06[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\play_hs1202[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\t_6[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\0f0000I41e4oSte6MNwG4s[1].jpg (1943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\251424335C5[1].jpg (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\CAUZGLEZ.htm (1 bytes)
C:\SkinH_EL.dll (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\10163ZO2N[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\is[1].png (1017 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\ico_1[1].gif (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\bg_8[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\baiduLoader_as3[1].swf (2515 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\style[2].css (4 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (925 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\c_4[1].gif (81 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\0f000Q1BFocx-cEB3jw0J0[1].swf (5492 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\xml[1].xml (664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\jcsp_1[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (1518 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\tjrm_img011[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\sp_line_1[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\topbg_20140506[1].jpg (4510 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\ico[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\231502413S2[1].gif (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\trace_news[1].js (559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\scbg[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\chkDomain[1].js (554 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\style[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\online_v3[1].htm (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\nav_bg[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\bg_4[1].png (3 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\c_3[1].gif (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\b_5[1].gif (317 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\0f000Q1BFJ3x-cEB3jw0M0[1].jpg (4427 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\bg_6[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\c[1].php (952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\b_1[1].gif (610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\0913524M015[1].gif (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\c_1[1].gif (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\t_5[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\FuYun[1].swf (22194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\rq[1].htm (347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\crossdomain[1].xml (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\CALK4Z5D.swf (5230 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s8.4399.com\settings.sxx (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\zj_btn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\0f000QECn83WOOje4W2fl0[1].swf (1218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\101634512c8[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\t_8[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\0109292I2U[1].jpg (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\core[1].php (751 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\tjrm_img08[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\zmxy3_20140808[2].css (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\bdshare[1].js (182 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\s8.4399.com\seed4399Value.sxx (80 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@163[2].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\b_3[1].gif (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\left[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\tjrm_img07[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\right[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\libg_3[1].gif (542 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\zmxy3_20140808[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\shell_v2[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\4399_14533870073[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\0f000QumSmNHL3kKP0qi86[1].swf (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\78072[1].htm (3936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\0f0000I41e4oSte6MNwG4s[1].jpg (1943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\n_mg_bg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8KDGBQOV\pic[1].gif (719 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\uijs[1].xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\more_zb[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\0f000Q1BFoCx-cEB3jw0C0[1].swf (1654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\bdsstyle[1].css (9 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\0f000Q1BFJcx-cEB3jw0h0[1].jpg (3805 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\sc[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\new_icon_1[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\news_footer[1].js (25 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040820140409\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@163[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\4399[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\jquery-1.2.1.pack[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\78072[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\play_hs1202[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\zmxy3_20140808[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040820140409 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XUIVPI8O\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\uijs[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26GZG3A1\zmxy3_20130916[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@163[1].txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s8.4399.com\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CLWUK2JU\0f0000I41e4oSte6MNwG4s[1].jpg (0 bytes)

Registry activity

The process %original file name%.exe:668 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090420140905]
"CacheOptions" = "11"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090420140905]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090420140905]
"CachePrefix" = ":2014090420140905:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1402275556"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090420140905]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 D9 DC 51 B2 37 18 F9 EE F3 6D 9C 1D D0 6F EB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090420140905]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014090420140905\"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014040820140409]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://203.130.61.17/css/zmxy3_20140808.css
hxxp://203.130.61.17/jss/jquery-1.2.1.pack.js
hxxp://z5.cnzz.com/stat.htm?id=5815340&r=&lg=en-us&ntime=none&cnzz_eid=1722835169-1409794067-&showp=1276x846&t=&h=1&rnd=1856641077	42.156.140.18
hxxp://c.split.cnzz.com/core.php?web_id=5815340&show=line&online=1&t=z
hxxp://123.58.180.119/blog/static/215741063201301204752584/
hxxp://203.130.61.17/jss/trace_news.js
hxxp://online.cnzz.com/online/online_v3.php?id=5815340&h=z5.cnzz.com&on=1&s=line	42.156.162.15
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=851777303
hxxp://203.130.61.17/flashzt/img/zmxy3_20120913/logo.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg.gif
hxxp://pcookie.split.cnzz.com/app.gif?&cna=Gq6ODEoRhRUCASU5EL0s8UhE
hxxp://e.xdwscache.glb0.lxdns.com/moeryongshi/images/headerBg.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/go_bbs.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1406/231502413S2.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1309/121055423955.gif
hxxp://download023.rdb.cnc.ccgslb.net/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.htm
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2014/8/7/4399_17564382760.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2014/6/6/4399_14533870073.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2014/2/12/4399_14504425052.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img08.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/sc.gif
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2014/6/6/4399_16460972266.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img07.jpg
hxxp://e.xdwscache.glb0.lxdns.com/imageyx/seer2012/hottop.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/101634512c8.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/10163ZO2N.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/topbg_20140506.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/zj_btn.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/101639333L6.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/1016395W521.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/game_bg.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_1.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1408/251424335C5.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1408/0109292I2U.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_1.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_5_20130716.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/1016440UA2.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1404/0913524M015.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_6.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/libg_1.gif
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img06.jpg
hxxp://e.xdwscache.glb0.lxdns.com/new5.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy2/icon_keys.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_1.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1302/1Q62S330N.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1209/1GQ340U13.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/n_zm1.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/bg_3.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_4.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_1.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/left.gif
hxxp://download023.rdb.cnc.ccgslb.net/4399swf/js/chkDomain.js
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/sszn.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/nav_bg.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/scbg.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/bg_7.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/n_mg_bg.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/lmbtn.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_2.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/tgbtn.gif
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img011.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2013/5/27/4399_17053265645.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/ico_1.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/ftbtn.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_3.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/faspbtn.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/more_boss.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/more_boss_s.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_8.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/more_zb.gif
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img09.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/libg_2.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_9.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/ico_ann.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_4.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_lm.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_5.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_6.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/jcsp_1.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/sp_line_1.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_5.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_9.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/zb_nav_20131205.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/libg_3.gif
hxxp://e.xdwscache.glb0.lxdns.com/jss/lazy_iframe.js
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/right.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_2.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_2.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_3.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_3.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_4.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_4.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/new_icon_1.png
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/zrsp_1.jpg
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_5.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_8.png
hxxp://e.xdwscache.glb0.lxdns.com/jss/news_footer.js
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/newaobidao/ico.gif
hxxp://e.xdwscache.glb0.lxdns.com/js/bdshare.js?t=844
hxxp://e.xdwscache.glb0.lxdns.com/jss/zmxy3_20130916.js?v=1
hxxp://e.xdwscache.glb0.lxdns.com/resource/ucenter.js?20130513
hxxp://e.xdwscache.glb0.lxdns.com/resource/css/base.css
hxxp://cc00063.h.cnc.ccgslb.net/flashUniLogin/css/style.css?v=20121016
hxxp://bae.jomodns.com/static/js/shell_v2.js?t=4
hxxp://download023.rdb.cnc.ccgslb.net/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.swf
hxxp://bae.jomodns.com/static/js/logger.js?cdnversion=391610
hxxp://bae.jomodns.com/static/js/bds_s_v2.js?cdnversion=391610
hxxp://bae.jomodns.com/static/css/bdsstyle.css?cdnversion=20131219
hxxp://bae.jomodns.com/static/images/is.png?cdnversion=20131219
hxxp://e.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/sy_ico.gif
hxxp://e.xdwscache.glb0.lxdns.com/jss/play_hs1202.js
hxxp://e.xdwscache.glb0.lxdns.com/jss/4399.js
hxxp://4399stat.5054399.com/js/click.js	115.182.52.78
hxxp://stat.d.4399api.net/crossdomain.xml
hxxp://stat.d.4399api.net/flash_ctrl_version.xml?ran=38740.6537309289
hxxp://tauruscz.danuoyi.tbcache.com/c.php?id=30039538
hxxp://c.split.cnzz.com/core.php?web_id=30039538&t=q
hxxp://c.split.cnzz.com/stat.php?id=4073713&web_id=4073713&show=pic
hxxp://q7.cnzz.com/stat.htm?id=30039538&r=&lg=en-us&ntime=none&cnzz_eid=805688180-1409790831-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=2086695384
hxxp://c.split.cnzz.com/core.php?web_id=4073713&show=pic&t=z
hxxp://e.xdwscache.glb0.lxdns.com/crossdomain.xml
hxxp://z3.cnzz.com/stat.htm?id=4073713&r=&lg=en-us&ntime=none&cnzz_eid=916211647-1409794086-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=485620972
hxxp://e.xdwscache.glb0.lxdns.com/control/zwsf2-3.gif?20120719
hxxp://icon.cnzz.com/img/pic.gif	42.156.162.7
hxxp://e.xdwscache.glb0.lxdns.com/control/A4399dv_base.swf?20130625
hxxp://stat.d.4399api.net/xml.php?ran=3799.88020285964&gameid=100015389&url=http://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.htm
hxxp://static.n.shifen.com/v.gif?pid=307&type=3071&sc=1980,4739,1276,818&desturl=&apitype=1&linkid=hznf0pbl823&velo_load=1735&velo_cssload=1016&velo_jsLoad=1000&cite_uid=480925&cite_type=1&cite_mini=1
hxxp://cb.e.shifen.com/crossdomain.xml
hxxp://cb.e.shifen.com/ecom?di=62872&tm=BAIDU_CLB_XML&asp_url=4399.com&return_type=1&ran=810.5809288099408
hxxp://cpro.e.shifen.com/cpro/ui/baiduLoader_as3.swf
hxxp://cpro.e.shifen.com/cpro/ui/uijs.php?at=6&fv=11&ch=417&ie=1&q=www4399com_tp_cpr&n=1&k=鲜花&f=过滤词1 过滤词2 过滤词3&u=4399.com&s=2&t=baiduxml_tiepian_400_300&w=940&h=590
hxxp://ubmcmm.jomodns.com/media/v1/0f000KfF7ujTofNDHryXj6.swf?url_type=1&id_404622239=media/v1/0f000Q1BFJ3x-cEB3jw0M0.jpg&id_404622227=media/v1/0f000Q1BFocx-cEB3jw0J0.swf&id_404622243=media/v1/0f000Q1BFJcx-cEB3jw0h0.jpg&id_881679517=media/v1/0f0000I41e4oSte6MNwG4s.jpg&id_881644586=media/v1/0f000ZtbOwy2j0IrKBdl36.jpg&id_881679517=media/v1/0f0000I41e4oSte6MNwG4s.jpg&id_881641202=media/v1/0f000QECn8mWOOje4W2f30.swf&id_881552664=media/v1/0f000QumSmNHL3kKP0qi86.swf&id_881641210=media/v1/0f000QECn83WOOje4W2fl0.swf&id_404622219=media/v1/0f000Q1BFoCx-cEB3jw0C0.swf&snapshot=&
hxxp://ubmcmm.jomodns.com/media/v1/0f000Q1BFJ3x-cEB3jw0M0.jpg
hxxp://ubmcmm.jomodns.com/media/v1/0f000Q1BFocx-cEB3jw0J0.swf
hxxp://ubmcmm.jomodns.com/media/v1/0f000Q1BFJcx-cEB3jw0h0.jpg
hxxp://ubmcmm.jomodns.com/media/v1/0f0000I41e4oSte6MNwG4s.jpg
hxxp://ubmcmm.jomodns.com/media/v1/0f000ZtbOwy2j0IrKBdl36.jpg
hxxp://ubmcmm.jomodns.com/media/v1/0f000QECn8mWOOje4W2f30.swf
hxxp://ubmcmm.jomodns.com/media/v1/0f000QumSmNHL3kKP0qi86.swf
hxxp://ubmcmm.jomodns.com/media/v1/0f000QECn83WOOje4W2fl0.swf
hxxp://ubmcmm.jomodns.com/media/v1/0f000Q1BFoCx-cEB3jw0C0.swf
hxxp://e.xdwscache.glb0.lxdns.com/control/ctrl_mo_v5.swf?20140327
hxxp://download023.rdb.cnc.ccgslb.net/4399swf/upload_swf/ftp7/hanbao/20120107/6/MagicWeaponv1240.swf
hxxp://download023.rdb.cnc.ccgslb.net/4399swf/upload_swf/ftp7/hanbao/20120107/6/FuYun.swf
hxxp://stat.d.4399api.net/flashflowstatis/submitflowstatis.php?gameid=100015389&seedvalue=b6e3a26a862ef6f78463cfaaaec0c7ed&adid=999&gamekey=asdf&nocache=1409794164497&os=Windows XP&lng=en&hosturl=hxxp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.htm&scres=1276x846&playurl=hxxp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.swf&fp=WIN 11,6,602,168&adLoadTime=0&adPlayTime=0&browser=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)&ctrVer=5
hxxp://imga2.4399.cn/upload_pic/2012/tjyx/tjrm_img07.jpg	203.130.61.17
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/libg_2.gif
hxxp://cdn.comment.4399pk.com/control/ctrl_mo_v5.swf?20140327	203.130.61.17
hxxp://ubmcmm.baidustatic.com/media/v1/0f000Q1BFJ3x-cEB3jw0M0.jpg	183.60.131.49
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_5.gif
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/sc.gif
hxxp://www.4399.com/flashzt/img/zmxy3/new_icon_1.png
hxxp://cb.baidu.com/crossdomain.xml	123.125.115.99
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/right.gif
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_8.png
hxxp://www.4399.com/flashzt/img/zmxy3/jcsp_1.jpg
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/sszn.gif
hxxp://imga3.4399.cn/upload_pic/2012/tjyx/tjrm_img09.jpg	203.130.61.17
hxxp://www.4399.com/flashzt/img/newaobidao/ico.gif
hxxp://www.4399.com/jss/news_footer.js
hxxp://www.4399.com/flashzt/img/zmxy3/bg_7.png
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_lm.png
hxxp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/MagicWeaponv1240.swf	221.204.13.39
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/more_zb.gif
hxxp://bdimg.share.baidu.com/static/css/bdsstyle.css?cdnversion=20131219	211.90.25.48
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/more_boss_s.gif
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_8.png
hxxp://newsimg.5054399.com/uploads/userup/1408/251424335C5.jpg	203.130.61.21
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/left.gif
hxxp://newsimg.5054399.com/uploads/userup/1408/0109292I2U.jpg	203.130.61.21
hxxp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/FuYun.swf	221.204.13.39
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg.gif
hxxp://imga2.4399.cn/upload_pic/2014/6/6/4399_16460972266.jpg	203.130.61.17
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/go_bbs.gif
hxxp://imga4.4399.cn/upload_pic/2013/5/27/4399_17053265645.jpg	203.130.61.21
hxxp://ubmcmm.baidustatic.com/media/v1/0f000QECn83WOOje4W2fl0.swf	183.60.131.49
hxxp://newsimg.5054399.com/uploads/userup/1405/10163ZO2N.jpg	203.130.61.21
hxxp://ubmcmm.baidustatic.com/media/v1/0f000Q1BFJcx-cEB3jw0h0.jpg	183.60.131.49
hxxp://ubmcmm.baidustatic.com/media/v1/0f000Q1BFocx-cEB3jw0J0.swf	183.60.131.49
hxxp://imga4.4399.cn/upload_pic/2012/tjyx/tjrm_img011.jpg	203.130.61.21
hxxp://stat.api.4399.com/flash_ctrl_version.xml?ran=38740.6537309289	115.182.52.104
hxxp://newsimg.5054399.com/uploads/userup/1405/1016395W521.jpg	203.130.61.21
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/nav_bg.gif
hxxp://www.4399.com/flashzt/img/zmxy3/n_zm1.png
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/ico_1.gif
hxxp://newsimg.5054399.com/uploads/userup/1209/1GQ340U13.gif	203.130.61.21
hxxp://bdimg.share.baidu.com/static/js/logger.js?cdnversion=391610	211.90.25.48
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/logo.gif
hxxp://newsimg.5054399.com/uploads/userup/1405/1016440UA2.jpg	203.130.61.21
hxxp://ubmcmm.baidustatic.com/media/v1/0f000QECn8mWOOje4W2f30.swf	183.60.131.49
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/tgbtn.gif
hxxp://stat.api.4399.com/flashflowstatis/submitflowstatis.php?gameid=100015389&seedvalue=b6e3a26a862ef6f78463cfaaaec0c7ed&adid=999&gamekey=asdf&nocache=1409794164497&os=Windows XP&lng=en&hosturl=hxxp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.htm&scres=1276x846&playurl=hxxp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.swf&fp=WIN 11,6,602,168&adLoadTime=0&adPlayTime=0&browser=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)&ctrVer=5	115.182.52.104
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_1.gif
hxxp://www.4399.com/flashzt/img/zmxy3/sp_line_1.jpg
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_6.gif
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_4.gif
hxxp://newsimg.5054399.com/uploads/userup/1309/121055423955.gif	203.130.61.21
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_2.gif
hxxp://s25.cnzz.com/stat.php?id=4073713&web_id=4073713&show=pic	1.99.192.16
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_1.gif
hxxp://www.4399.com/jss/zmxy3_20130916.js?v=1
hxxp://cdn.comment.4399pk.com/control/A4399dv_base.swf?20130625	203.130.61.17
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_3.gif
hxxp://bdimg.share.baidu.com/static/js/bds_s_v2.js?cdnversion=391610	211.90.25.48
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/topbg_20140506.jpg
hxxp://newsimg.5054399.com/uploads/userup/1404/0913524M015.gif	203.130.61.21
hxxp://www.4399.com/jss/4399.js
hxxp://s4.img4399.com/flashUniLogin/css/style.css?v=20121016	123.235.32.26
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/lmbtn.png
hxxp://ubmcmm.baidustatic.com/media/v1/0f000QumSmNHL3kKP0qi86.swf	183.60.131.49
hxxp://imga.4399.cn/upload_pic/2014/2/12/4399_14504425052.jpg	203.130.61.17
hxxp://newsimg.5054399.com/uploads/userup/1405/101634512c8.jpg	203.130.61.21
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_4.png
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_4.gif
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/sy_ico.gif
hxxp://imga.4399.cn/upload_pic/2012/tjyx/tjrm_img08.jpg	203.130.61.17
hxxp://s8.4399.com/4399swf/js/chkDomain.js	221.204.13.39
hxxp://news.4399.com/js/bdshare.js?t=844	203.130.61.21
hxxp://imga5.4399.cn/upload_pic/2014/8/7/4399_17564382760.jpg	203.130.61.21
hxxp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.swf	221.204.13.39
hxxp://www.4399.com/jss/play_hs1202.js
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_1.gif
hxxp://imga5.4399.cn/upload_pic/2014/6/6/4399_14533870073.jpg	203.130.61.21
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/libg_1.gif
hxxp://cdn.comment.4399pk.com/crossdomain.xml	203.130.61.17
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_5.gif
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_5_20130716.gif
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/faspbtn.gif
hxxp://ubmcmm.baidustatic.com/media/v1/0f000ZtbOwy2j0IrKBdl36.jpg	183.60.131.49
hxxp://newsimg.5054399.com/new5.gif	203.130.61.21
hxxp://ubmcmm.baidustatic.com/media/v1/0f000Q1BFoCx-cEB3jw0C0.swf	183.60.131.49
hxxp://cb.baidu.com/ecom?di=62872&tm=BAIDU_CLB_XML&asp_url=4399.com&return_type=1&ran=810.5809288099408	123.125.115.99
hxxp://www.4399.com/flashzt/img/zmxy3/n_mg_bg.png
hxxp://bdimg.share.baidu.com/static/images/is.png?cdnversion=20131219	211.90.25.48
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/game_bg.gif
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/scbg.gif
hxxp://ubmcmm.baidustatic.com/media/v1/0f000KfF7ujTofNDHryXj6.swf?url_type=1&id_404622239=media/v1/0f000Q1BFJ3x-cEB3jw0M0.jpg&id_404622227=media/v1/0f000Q1BFocx-cEB3jw0J0.swf&id_404622243=media/v1/0f000Q1BFJcx-cEB3jw0h0.jpg&id_881679517=media/v1/0f0000I41e4oSte6MNwG4s.jpg&id_881644586=media/v1/0f000ZtbOwy2j0IrKBdl36.jpg&id_881679517=media/v1/0f0000I41e4oSte6MNwG4s.jpg&id_881641202=media/v1/0f000QECn8mWOOje4W2f30.swf&id_881552664=media/v1/0f000QumSmNHL3kKP0qi86.swf&id_881641210=media/v1/0f000QECn83WOOje4W2fl0.swf&id_404622219=media/v1/0f000Q1BFoCx-cEB3jw0C0.swf&snapshot=&	183.60.131.49
hxxp://zs25.cnzz.com/stat.htm?id=4073713&r=&lg=en-us&ntime=none&cnzz_eid=916211647-1409794086-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=485620972	42.156.140.16
hxxp://c.cnzz.com/core.php?web_id=5815340&show=line&online=1&t=z	42.120.219.6
hxxp://www.4399.com/css/zmxy3_20140808.css
hxxp://bdimg.share.baidu.com/static/js/shell_v2.js?t=4	211.90.25.48
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/libg_3.gif
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_4.gif
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/ftbtn.gif
hxxp://stat.api.4399.com/crossdomain.xml	115.182.52.104
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_9.gif
hxxp://www.4399.com/flashzt/img/zmxy3/zrsp_1.jpg
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/more_boss.gif
hxxp://imga1.4399.cn/upload_pic/2012/tjyx/tjrm_img06.jpg	203.130.61.21
hxxp://c.cnzz.com/core.php?web_id=30039538&t=q	42.120.219.6
hxxp://w.cnzz.com/c.php?id=30039538	195.27.31.243
hxxp://www.4399.com/jss/jquery-1.2.1.pack.js
hxxp://hqs10.cnzz.com/stat.htm?id=30039538&r=&lg=en-us&ntime=none&cnzz_eid=805688180-1409790831-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=2086695384	42.156.140.139
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_1.gif
hxxp://www.4399.com/jss/lazy_iframe.js
hxxp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.htm	221.204.13.39
hxxp://nsclick.baidu.com/v.gif?pid=307&type=3071&sc=1980,4739,1276,818&desturl=&apitype=1&linkid=hznf0pbl823&velo_load=1735&velo_cssload=1016&velo_jsLoad=1000&cite_uid=480925&cite_type=1&cite_mini=1	115.239.211.92
hxxp://stat.api.4399.com/xml.php?ran=3799.88020285964&gameid=100015389&url=http://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.htm	115.182.52.104
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_9.gif
hxxp://cpro.baidu.com/cpro/ui/uijs.php?at=6&fv=11&ch=417&ie=1&q=www4399com_tp_cpr&n=1&k=鲜花&f=过滤词1 过滤词2 过滤词3&u=4399.com&s=2&t=baiduxml_tiepian_400_300&w=940&h=590	123.125.70.108
hxxp://ubmcmm.baidustatic.com/media/v1/0f0000I41e4oSte6MNwG4s.jpg	183.60.131.49
hxxp://ptlogin.3304399.net/resource/ucenter.js?20130513	203.130.61.21
hxxp://www.4399.com/jss/trace_news.js
hxxp://c.cnzz.com/core.php?web_id=4073713&show=pic&t=z	42.120.219.6
hxxp://pcookie.cnzz.com/app.gif?&cna=Gq6ODEoRhRUCASU5EL0s8UhE	42.120.219.171
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_2.gif
hxxp://cdn.comment.4399pk.com/control/zwsf2-3.gif?20120719	203.130.61.17
hxxp://www.4399.com/imageyx/seer2012/hottop.gif
hxxp://xiaoyaoqq124311609.blog.163.com/blog/static/215741063201301204752584/
hxxp://newsimg.5054399.com/uploads/userup/1406/231502413S2.gif	203.130.61.21
hxxp://newsimg.5054399.com/uploads/userup/1302/1Q62S330N.gif	203.130.61.21
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=851777303	42.120.219.171
hxxp://www.4399.com/flashzt/img/zmxy3/bg_3.gif
hxxp://www.4399.com/flashzt/img/zmxy3/zb_nav_20131205.png
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/zj_btn.gif
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_2.gif
hxxp://www.4399.com/flashzt/img/zmxy2/icon_keys.gif
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_6.gif
hxxp://news.4399.com/moeryongshi/images/headerBg.gif	203.130.61.21
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_5.gif
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_3.gif
hxxp://cpro.baidu.com/cpro/ui/baiduLoader_as3.swf	123.125.70.108
hxxp://newsimg.5054399.com/uploads/userup/1405/101639333L6.jpg	203.130.61.21
hxxp://ptlogin.3304399.net/resource/css/base.css	203.130.61.21
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_3.gif
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/ico_ann.gif
gprp.4399api.net	42.62.52.249

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0
ET POLICY Outdated Windows Flash Version IE

Traffic

GET /upload_pic/2012/tjyx/tjrm_img06.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga1.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Aug 2014 19:56:49 GMT

Cache-Control: max-age=31536000

Content-Length: 3160

Content-Type: image/jpeg

Last-Modified: Thu, 01 Mar 2012 06:03:41 GMT

Accept-Ranges: bytes

ETag: "48eab0d71f7cc1:34d"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 fra73:2 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......<......hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c060 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xm
lns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.ado
be.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/
1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="xmp.did:7C3C9
0818062E1119A50B0F09DBE5343" xmpMM:DocumentID="xmp.did:48F37DF662B611E
1987FB533819DF614" xmpMM:InstanceID="xmp.iid:48F37DF562B611E1987FB5338
19DF614" xmp:CreatorTool="Adobe Photoshop 7.0"> <xmpMM:DerivedFr
om stRef:instanceID="uuid:02cd31e0-62b0-11e1-a9f2-89007db68855" stRef:
documentID="adobe:docid:photoshop:3e3cd8bb-62a6-11e1-b37d-c0893894c906
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>....Adobe.d....................................
......................................................................
.......................................*.D............................
.............................................................!1Q2..Aa3
."4.qR.....Bb#C....s5E6........................1.AQ.2.!a...".#.q..Br.3
.4.................?....6.....2.m...I.;.F.O.&O6..m-4....k>..WM....9
...P. ......ex.y6...wh...M.K.X#).-RE.}....b..S..6.*...t.qS.=......
<<< skipped >>>

GET /uploads/userup/1309/121055423955.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Mon, 23 Feb 2015 19:57:41 GMT

Date: Wed, 27 Aug 2014 19:57:41 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 2946

Last-Modified: Thu, 12 Sep 2013 02:55:42 GMT

ETag: "52312d2e-b82"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 fra73:1 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a........r..P.....O........n.M'..j.......U.l.....m.iNq:..0....f..
\;j...h"....u.....~..H.f......W.....F.\sX.Y.y......{......;.6..a... ..
-...z\..k..M.rV..G.sP.g.%.y.....Q..b..t..R.k...k w...L... ....X:.y#.p.
.k...2.P.|./..5..'..$..@B`.....A.K.-.E"........~.....f.............iIw
..k..V..u.uh..V.....4..p.......I8.......nKfI-...............jYIyhV.!..
d.....S...................\'@P,`............f3.!.......,............~.
..h#te\.\el#...............9\?...N..?mea...~..O.Kx;.;R...O;....~.OR...
......K.KR..K..O...........R..........?.......'L1..........H.........@
........`..z..........B..Ir$..'=.D..d..*c.T.2$L..az...........@A04{...
h.....t.......X.j......`.f....._l..a..)T{N..L.K....x......_.. ....^..o
.U0......#K.L.....#.@.."............O.i..Hk....>..B...q.v......Q...
[.......].....S.......{.p..q...N.:a.....2*..PA.....W.r.H........?...!!
[email protected]{....|......!q^...P........V.E........a..I...<....x(Hx...$...
|..#..T.B.WTq..z`...H.y...z4.G.!XA...u...8....U...}T.QE.d^.G.?..G.8T..
...(..>[email protected]....|. .a/....rV...xX...{(...{$.A....(.H....X....V....;
v...x....|[email protected]@...7....E=....8.............^[email protected]%....
..........:y*..Z.c.f....P.....\1.....*.S..*.{P.*.X.AE.8..n........ ,..
..$..!.0..."Qg.[H....b{..(.|..=..C.U.qp...1.....B.}..GQ.6.............
.X1..n:......i. .8..8\q.......S......B..H.........>.,r.Q.........:.
.2....*..:...W.........}|.....`..T..&.8.L....a........h...T....dk`....
.j......J(...=.mw.......7.|.|V }...P..n...............P{_9..d....j@...
..n...p...X....#...|.].rT...pm......14..x>X.....hAOz....6.Ai5..
<<< skipped >>>

GET /uploads/userup/1405/101634512c8.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Mon, 15 Dec 2014 14:29:38 GMT

Date: Wed, 18 Jun 2014 14:29:38 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 5179

Last-Modified: Sat, 10 May 2014 08:34:51 GMT

ETag: "536de4ab-143b"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 fra73:6 (Cdn Cache Server V2.0)

Connection: keep-alive
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......K.d...........................................
<..........................!.."1.2A.#BQaq.3....$r..RSb.............
........................5........................!1A.."Qaq..2.........
#B.3R.............?._q..B.......H..........H...Q.....T...<7T#<..
..GC.B.X..E.y.T.e.J.S...*h...,.A(Y.....Im.o-.....m.....q.YP...T.\@#...
P.O....~%0X...BAV..LT?5.t...H..2.......'...^IUuX.y......]A>D|....N%
..2...%.n!Xj##...>.^....p..V.G....RK.r...g.....B..t.y@ |...Q..g|.&g
t;j......B.Q.......!.ZZC.R..._....6.O.L;].B)...Z.^.C.........Ol...C%^d
.*..`...c*%.~..[.:.....[.|@v......e...f4ki.S.en..~hPV....j...pg.C..cen
[email protected]...=.'.2..^......1..D...........#....u7
U.e.I..>..<..^]...l.\.....l.PYp.......8.6.t.o2.........Zz.._....
y..;..A.....(.B@P. .._..b....R..\..:.`.x.m=.t....:2...rP..Q..X.8?.i..U
*....4N.f4..VY.2*.4.q.`....-_e.U.G...9.......R.m......~.......A.L.q...
iRe>b.<....F.Q.}0...<....|-..[.......U.6U%d..".La.......8.T.Z
.R...1Qs.}...ogH=..F.{...p.$.S.T.......>.E...$.j^.....7I.~b..=.%e..
.ruo..[,...oOiK.. ...P=...........M.3R.......%.3.hJ<.?.M....4.D...u
?.#.)er.u%qb...oeh.n......6.........d.~..D.S*..nLQ...M{6.s...T\....).l
1.L.$a8.k' <..v...(...X..s....u.G[.i,....HBI..}~x....q..&fN....Uj.9
o..2c.[...- .A.EB...:;{.....&3\}. ..)...A.4..Y..N...cW....WI..B..."...
...n....w..u.=.%.D....bS...-JQ.-....;z..v......U....H..<TG",vR.
<<< skipped >>>

GET /uploads/userup/1405/101639333L6.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 05 Feb 2015 19:47:18 GMT

Date: Sat, 09 Aug 2014 19:47:18 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 3458

Last-Modified: Sat, 10 May 2014 08:39:33 GMT

ETag: "536de5c5-d82"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 fra77:1 (Cdn Cache Server V2.0)

Connection: keep-alive
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......>.R........................................
...9..........................!..1."AQa.#2q...3Bb.$.....CSc...........
.....................0.......................1.!..AQ2a..."...#Rbq.....
..........?...IhU!,..f....".Y..qX.2.._......O.....\{O......V?.y..:....
..T..--.0.....#`.m{...&...)o..<...y.|.G.#eV8..t.....-.......m......
C.......?.6..n ..O,P..K....> ..\..r....;...(O...v....I..v......!...
>.\.pX|*.x.^.p....*.".......|...mt....Z.....]...U;7p.8.!.:..\I.Z...
...t.)WL7OQst.M0{[email protected]."J-....7...x.._.Vr%...;....T.}...)o...5
e.......}?.=.....tk...f. ^>.....e2R9.K....5.}...K.]..W....<..VI.
..K.hp.y;...._.....IJR...%"[email protected]...~...U.R.H.\. F....
..{..>.R....g......8..t.G.........L.....zG.K.M;O....m.....D.O..Jxk.
.24..~...}H...G.^a....$.V...........;... ON.T,p)2...?...MC.Qt.!.....d.
ZG....=8../3.kvQ........Se.|>.4.P..%_.5......tN.......o.Z... ."i./.
.A....f.5.....cv.g)UjY?6H.. v............:.....[."..L.Ycp..SN..m..T.?G
..f.Er; 6T..%.>....|.... .M.*...T..c...` ,/t.G.../.f.?u.....r.....K
....P.Z......V.AW..G.rHy.......lWWM..~..8'%.v.~.....j..tj$C..... ....r
.ZB...H.....x..,........pZycs....-.w.(_.2.....;\..9|...Zmg...OOQ...b.l
..:.:. ..$.....]M.]...6 ....=X..?S.~c...}.He...0.]...l..e....R.a,i.7.M
..1.e........PT....jJ.vaT:....=..../....Q..x.&....oD..@..?.S...}Vs..."
C..C.[J.J.X...c..X.....,.......n......Ae.-....sR|......S.f.H.....@
<<< skipped >>>

GET /uploads/userup/1408/251424335C5.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 21 Feb 2015 07:01:43 GMT

Date: Mon, 25 Aug 2014 07:01:43 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 26765

Last-Modified: Mon, 25 Aug 2014 06:24:33 GMT

ETag: "53fad6a1-688d"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 fra77:6 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......7......hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c02
1 79.155772, 2014/01/13-19:44:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3fc15e74-4b2f-a74
0-83f3-51e3e1ce649e" xmpMM:DocumentID="xmp.did:B6E2A7B12A9D11E4B0D88EB
CC0D1A0A2" xmpMM:InstanceID="xmp.iid:B6E2A7B02A9D11E4B0D88EBCC0D1A0A2"
 xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)"> <xmpMM:Der
ivedFrom stRef:instanceID="xmp.iid:3fc15e74-4b2f-a740-83f3-51e3e1ce649
e" stRef:documentID="xmp.did:3fc15e74-4b2f-a740-83f3-51e3e1ce649e"/>
; </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xp
acket end="r"?>...!Adobe.d..............#7..B...h..................
..........................................##########................##
###############################################......Z................
......................................................................
......... 0!1.@"2PA3.#.B4`$D%5......................!..1AQ.aq"2.. ...B
3....Rbr#[email protected].$4.P...Sc.sd5.....................!.1 A.0@P`Qa..".q.
.2BR.......................!1A.Qaq. [email protected]`................W9.W.2
...> ..."..Y.....n.H9..9.pLtR.'....<..!..T.........Ic*..$!..
<<< skipped >>>

GET /uploads/userup/1405/1016440UA2.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Mon, 15 Dec 2014 14:29:39 GMT

Date: Wed, 18 Jun 2014 14:29:39 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 32279

Last-Modified: Sat, 10 May 2014 08:44:08 GMT

ETag: "536de6d8-7e17"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 fra73:5 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:102DE30DC7D4E211A
874BFFA03C7D17C" xmpMM:DocumentID="xmp.did:9B7AFFAFD4C711E29A6E80EBBE8
465BF" xmpMM:InstanceID="xmp.iid:9B7AFFAED4C711E29A6E80EBBE8465BF" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:102DE30DC7D4E211A874BFFA03C7D17C" stRef:docum
entID="xmp.did:102DE30DC7D4E211A874BFFA03C7D17C"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................\.....................................................
..................................................!...1A"Q#.aq2$......
..BRb3%..S4...CcT.&6f.....)Y:Z..........................!1..A".Qa.q...
2#..BRb3.....r......Cs$S.%....c...4U&V(.DTdt..56............?....&....
...g...*8....V..5...... .D2.4......>..gV?n3.)..B.......x....J.i."..
:......gR QL.Q......W...t.N.c.q..S...l..@Lu..,`T.`.BiLdf..5.....&l
<<< skipped >>>

GET /uploads/userup/1302/1Q62S330N.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 27 Jan 2015 19:57:20 GMT

Date: Thu, 31 Jul 2014 19:57:20 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 5566

Last-Modified: Mon, 18 Feb 2013 08:28:33 GMT

ETag: "5121e631-15be"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 fra77:3 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89aq.N....3.....................W.....CFf.....R...f.ff..e..D...X...
..h.U...K.U.f3.......lbX5Y.g.g....E..ff&.....333..E..?..3V......3.....
.....Q.Q.k$f$....v::......l[(@>..DDN{N..w.g..s..,..#........t>..
I.......V.........O......q..v....s.}....$.$c.c......3f3.s.......*=...k
....8.8.7.F$~....I.6/.W....J......aYp!(.......c.U#.....W*........V.t.O
`...........//....xx.G......M..z.1..x.R.R.ss.e2........D.}'..........\
\....X..s1B........~m. .....D ..........-....'.......AA...{;...6......
x$.U......e..xx.hN.....!I=>)=#....OO3z.......U>(.wQ......%'6....
f.....V..E..u%.....opa......XpCD.. ..s...:.:.O.V*(.!&.Za{s1._....]....
..=.....v....e....J.....o....r..f..../'..I...o.......W[....w8..G......
poo.....^....zWS..j..:.....fH....t..n.n........!..w#[email protected].
...{..c..qq../W@.......!.......,....q.N........H......*\.. .2...SE%..e
..4..........RK.?qT0\<0....0=Z../..n..`..#..;.b..)a....x\k5.^#jQ...
f..U..F.j(CF..C.T;....)E...v..B.O.0$t...c<...w....j4....pA6.*....g.
[h..\d... CNh.R.../....l..?8eN..r..*.7.h...P..)j.$D@...'2k.;...c....T.
.....l9`.D..<bA.....?.k$..$(..H.5./N...xC.9.n.'$.. .../,....p[.....
..0sJz.i.T1jp../.x..}B.R... s..a..V,..SM-...Jr...../.....<Q.&.AR..0
......../A4...C.w.3BX`.-.|...(.p.7j... .H.....x.......<...,...D^..r
..a....B4..!....n~\3.(-.P.5....yA......(.>....G*D.......2.<..4u4
..(.@[email protected] $.s...<@.5.p(fp..q.Gp...&.hF....AA-N.z.....F.)..
J....G..t........$.'....2,Gj...8.H..9.8...R.....H1m-..`..~x0....q....b
.*.A....HC...n...\.2I.T.p......4Rtr.......`$....,........G.d1.2...
<<< skipped >>>

GET /js/click.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 4399stat.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 04 Sep 2014 01:28:06 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 15 Jan 2014 06:56:45 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Thu, 04 Sep 2014 01:28:07 GMT

Cache-Control: max-age=1

Content-Encoding: gzip
41b............}U.o.6..v.....DT.*...K<-.)6....uOA`0.%3.(....I....EY
...A......}p'.3..d..V....Zj..L.#M.<? {.[.hV...~........)......<.
[email protected]..[. .A=#mo4..1..u.?t.(]..Dv.:[email protected].
*.q.........4=.Fq.....**....Fm%W....!.....5j`.....U..e. .2P..I~$.f....
.......Je.<b.F./(.V<.oQ.....b.I.E.^1..)z..0&...T0OU2n...)..} ...
..a.%...E.......F...-..%ka0>.v.VY.>..I..`.....-g..?....IB^.3.^\.
.....XU...t.....JN......tr.-.t.J..`...H..V.fX.Z.".c.)./ 6......>..M
....=.^....igrp.l.m.//.m..vV....=.Y...$A... ... ...7\F....zr?....Ts..G
.v.....<\.0>.K..*.g:..0.[...g....Y....o.B.M!..ku..m.am.<=..&l
t;a....4r<.x2...&l.."av...............Ya.n([email protected].._2.
.U.vQ.z`f.?>~.....9.[n;...l.....=..^`..S..nvH.D.%...d.K...P:K)<V
..S....P..=........v.....E.Oi'bKuX.'.Ejk.{pknyH.n.g.t..9......n.y...d.
.a$...-..z.........,.Z.....Yb..Ov...@^j..TC..a.i].........i.....v..."O
.#.C..G...ln..D.........&.C......W.r *.o.......%1U..]..:X.jtD:.......R
5"[email protected]@|{<...}...j.;....M.
.}...H...?k.yH...Unc..(Q..Fi.^..t.6..U ..^"...z.F{......0..HTTP/1.1 20
0 OK..Server: nginx..Date: Thu, 04 Sep 2014 01:28:06 GMT..Content-Type
: application/x-javascript..Last-Modified: Wed, 15 Jan 2014 06:56:45 G
MT..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-E
ncoding..Expires: Thu, 04 Sep 2014 01:28:07 GMT..Cache-Control: max-ag
e=1..Content-Encoding: gzip..41b............}U.o.6..v.....DT.*...K<
-.)6....uOA`0.%3.(....I....EY...A......}p'.3..d..V....Zj..L.#M.<
<<< skipped >>>

GET /media/v1/0f000QECn8mWOOje4W2f30.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ubmcmm.baidustatic.com/media/v1/0f000KfF7ujTofNDHryXj6.swf?url_type=1&id_404622239=media/v1/0f000Q1BFJ3x-cEB3jw0M0.jpg&id_4046222

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ubmcmm.baidustatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.0-b

Date: Thu, 04 Sep 2014 01:28:19 GMT

Content-Type: application/x-shockwave-flash

Content-Length: 4272

Connection: close

Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT

Expires: Sun, 26 Jul 2015 02:31:19 GMT

Age: 2973994

Cache-Control: max-age=31536000

media: media
CWS.....x..8kXS..{..d..'AH@$1(*` .QyD....F@.>s..L4$...b..../..S:...
s'.b..6Z......j....-..x.E/v....k...O.Z...?...sr..k.........L-..(......
...._...................Y6.m(.j......d..[.9...Z].677.cdy.;Y....L.U.%P.
x,n{.kw9.\.6.....f..j..B.......Z....g..G.....Y-.u.w=..........i}Y.....
..2Yu..c.k.#rs,n.f].b.ZOoc...{0n.....{l.......kg.Lq.m.6f[\..%NK.z.e..:
7[..3...[...8:....=.F..)Nc..;A%-.w...8h..Fz.S.8..TEG..Ey.,S.......'_.3
.P....~..^.7.....,...QR......:1..-.?.X5.D....%...?..8]1k]n .....{.h...
..X7...,[email protected].../. ...,...@=w.|^.X....rxX.1!{.....E5?....
I.TrVo......E..O.P....i8..r.......&.bcS..Y.b.I.K][email protected]|..wH..d.:7.v..
. .|.x .Rz.......?.....\....M1.J.......l.....o|(.-.[.....Uj....H.S..o.
.0Pg.My-.2r.D.....:._......:j>..DB_........ t.8x.A.........`2...B..
....GC.4......8.wQ/f.u...\?qI.#......?...=^..}Go..D...:......~ ]lV.j..
....'...l.......i ...........c.....\49..;..rl.*^...y..?f......*.v..u._
0.,{9.7.6...l[.zM.'S.-.....^.|F....w-_...^De....B.../....o.h...n."}m.t
[email protected]...*g..o..... .......x....!Y.j..c...mP.~G4_=*.u..d.j-..?_..'@.u.W.
,.'8...?*)S..................G.........h ..y"v.5..Mr?....P....:";...T2
.^...p.._A]6.t}Uj.........N.p[..~Q...t.n....6.I..,.X..8.7.l_....&.I.*.
......y...E...s.s.....tDM0....>..........o-..vW..%........E..)&.O..
]......\.&P_.O...Q........}.k]...T[..0n..>.p..=..N........z1.Y9./F.
1.<%...m.g#E..s..-|.8..........F...........aLN....0hkJQ.H..{.(Fbjex
g`..`..7..;...,JN..N]....... ..Q.?H"[email protected]@...."m..n..6.b
...g...CZs......X.p.......>'....z...u6/....p...EV)TK>k_ ;...
<<< skipped >>>

GET /4399swf/upload_swf/ftp7/hanbao/20120107/6/MagicWeaponv1240.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.swf/[[DYNAMIC]]/4

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s8.4399.com

Connection: Keep-Alive

Cookie: _4399stats_vid=14097941234975701

HTTP/1.1 200 OK

Content-Length: 6643368

Content-Type: application/x-shockwave-flash

Last-Modified: Wed, 25 Jun 2014 07:41:10 GMT

Accept-Ranges: bytes

ETag: "264f3dd54890cf1:2a7"

Server: Microsoft-IIS/6.0

Date: Sun, 31 Aug 2014 09:06:38 GMT

Expires: Mon, 31 Aug 2015 09:06:38 GMT

Powered-By-ChinaCache: HIT from CNC-DZ-2-3XC

Age: 318122

Powered-By-ChinaCache: HIT from CNC-TY-E-3ON

Connection: close
c.m2.d2"..fA.L6Q6.,..........&. @K6IZ.H..Z..".(2.!d..H..._.....}U.....
.....93.}.Ow...L..,.......y..................S. 7.?...........8...' lr
=w.f.q....mk..3.I...V.e..(V4x.%{j...C..^.../....iz...8m......].$.....`
,.......Tz..-.../...@$.....tJ.n=..X|........cA ....wb...\.x:.{..%w.zD.
rMD...j....Z.u.....:CWS.u.j.x...wP.Y./*.......7w~....}..{....So..3....
."...(...no..)u.OA.M.z.Cn~.u.N.......*g...~.jx......Q...M...\..2._r.WT
..~.oi..J......_~;..R.V...O..W.. O....\CQ.M........R......,I.....q....
G..W....w..&!..\"Q&0..P...sm._..8dy=.iS..z].....CG....PD......G...;...
...^;uj.H...y.!........y...g....W.g....[.;=....U.**FD.....2xr(i75.s0..
...]La..T8.....,.J....7.............Hy....*........4r...W.|..i.f.O...C
.....u.U.......k....cN."!.&.../K........|.~.....D.,......<.S.......
B.<.:.n\......y.)...O?......Kx.?_Xh.^"P.}..e.:z.....%[5.}.9...Bo.g.
..'..^.0.fS...m.e^IY.....9..m...o7.fD....{......2.....2...N....$Q....M
...W.6$JF5...4....<..-.........p.|{...G...e.v."...<E(.t.7....H..
.....]Tn...K..(.M.F....]..Ag............y?..b...B.f..../....&F...?:...
h.CO...w.W....!.k..ZG..C.D......L.W.FH......D.i.>...L..s.wj.-......
U).E.D........-X[../4......O;.!.3....>.......2S...6...d..A...d...o.
q..$..]...4.n~-.>......z........t.j.L...OX...........Y.......vP..,h
.e.o~tO..(.....Jo-;`...c6?.....7..4JE.J..m.?l...ml..u=.7.B.y./........
...m....k......f<[email protected]*.~:.....=.......mdo...k...0w..e..y.
_..t7......,n...Z.....{.{.2.6..W_.!.OtH...AO....s.,.......;.X..8......
o.g.....K...3........RJ..\=!......{1....LG.......H]E;O...k..lY...^
<<< skipped >>>

GET /upload_pic/2014/8/7/4399_17564382760.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga5.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 07 Aug 2014 11:10:24 GMT

Cache-Control: max-age=31536000

Content-Length: 3588

Content-Type: image/jpeg

Last-Modified: Thu, 07 Aug 2014 10:01:40 GMT

Accept-Ranges: bytes

ETag: "acbc29526b2cf1:34d"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx37:8105 (Cdn Cache Server V2.0), 1.1 fra73:2 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......F.....ohXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:061013A1AF08E411A
075F51F82FC23A8" xmpMM:DocumentID="xmp.did:285B2CE4197C11E48A35876249F
3F1A6" xmpMM:InstanceID="xmp.iid:285B2CE3197C11E48A35876249F3F1A6" xmp
:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:D45CF2127C19E41188B2CC1B1AC18E92" stRef:doc
umentID="xmp.did:FC63DC0E08CB11E496F0FE7C5609AFC6"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;...&Adobe.d................,........................................
......................................................................
..........................................*.D.........................
.................................................................!1"2.
 AB#3C.4.E......................1A...!Qq"2.aB3......C ..brSs..........
........... ..0.!AQ..@1q.."R.....................!1AQaq.......... ....
...........1w.............~..K.T............ W`.&......y9..[..&g..b...
.%..6i...F..k.$j`.s.Wf.M`..g.~._..._..6..#...4...[.|.D.R.@w.].....
<<< skipped >>>

GET /cpro/ui/baiduLoader_as3.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.swf/[[DYNAMIC]]/2

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=6D2C9CDF0A0DCF8B2D787BD25222C33D:FG=1

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 04 Sep 2014 01:28:11 GMT

Content-Type: application/x-shockwave-flash

Content-Length: 5933

Last-Modified: Thu, 14 Aug 2014 14:00:01 GMT

Connection: close

ETag: "53ecc0e1-172d"

Expires: Fri, 05 Sep 2014 01:28:11 GMT

Cache-Control: max-age=86400

Accept-Ranges: bytes
CWS..$..x..YyxTE...}...^...H'i..N.Y.$.`VLHhH.".....M7...;..AeQ.E..E...
.,.........h....q.}.G.ttp.w.v7..sx..{....:u..N.:un.M.b. ..G(...C.BhE..
 4=....k.L=^./X...LW(.Q.......]..........[....sA"7....=..`Vf.IF...B...
r.}&.....Pyff....q......~..'...=|[email protected].@.....$R.:..t..[.Ms.~I
..a..3=.b.a.b.PE....k-.-,i-((.Z...'Y.Be.nT2..$.x'...)..ZK[.J...e......
...N..{I.C.....y.........3....).... .BApi..R.P&..^>T.wtx..O..{r....
....s%....C...I0...__d.7?...5...K.[{;..f1....".g..........>A....F..
., -...RT0........`jquiMi.........R....q....I..Cs./.....l.w..B..P...O.
R]=yjQ.T........S.j.JJ.q._.8o..pw..... .B.....S..qW.7..-s..M..........
.~..G.._..?B../...~9..c......H$.b..."F.o~..M.L......^..*.?r2.>.7...
!.....wQ5biF.....h.,.@K..%%j..h..z.v..4*I.Uk....Q.H.i...5%....qzS...n"
..m........M...y...H...8.Q..0...h$B...a?.Q...]....0....0......I.....s.
..d. A4.c|...2..0.....S.P`.T0I...=.y.i..2(.h.zg..'......;..n.....}2..U
].?.......V.u....9.6......u..*....?_.w.5..{L?../{.:GY..... ...~...>
\...yO.|=.,X.^W9...-..4.j.s.k".....M.m.......W..x.e....].^M......=.M..
=5gD...B..s.N..Z....2....8..^........4b........y....,..x..k..o...=....
..Z.....k}.......b...^.....]YcM.7..w.....=......^}.1.......-.>.4...
T..'...%..oU?|...?...p..#...^..i>...W...=W.mGp.G....y.....YS?y._wm.
.O.....................).........hY.v..?y........|gu...k.2?........{..
...sT.?..V....f/_?..........._.v.....7M:..~....3.,....w......3E...._xp
q....=.a..~.........].:m..eM....q...|..o.Y....-.7_...wYB.{.<...'...
h....F.Ta......zd...I{.u7.............Y....gn}O.5...h..8dGy? ..Wc.
<<< skipped >>>

GET /static/css/bdsstyle.css?cdnversion=20131219 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bdimg.share.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.0-b

Date: Thu, 04 Sep 2014 01:28:03 GMT

Content-Type: text/css

Content-Length: 2021

Connection: close

ETag: "1092306194"

Last-Modified: Wed, 03 Sep 2014 08:40:41 GMT

Expires: Thu, 04 Sep 2014 01:49:55 GMT

Age: 481

Cache-Control: max-age=1800

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip
...........Z.....~.5.E...../..6...w.A...EY.H...3.1........m.....ER.x..
 ...L.....U..........|..........].699P.X<[email protected].|...vF.Y
,9..i..})hT...%9.Y.9qM..U....R.-.....?..(giJ...fUJO........-/#.>...
....Fn........qKO.M......ae..-.....a.z.ET......}R....2^.8v.C..Q.Y....U
.K....P.m?x..Bl......d...h..3V.]#R.9.f..v.|..a....C*V9...~.RU-_..Y....
8.;*#7.O.=A............{"....".e..3e...V.....-.#W.6.`...K.5N.&S.....8!
............RM9..........j.~...Vv..L.H....wy#D.#...x;...i...NKlol...04
:C...`...)k...DI.w...rD........0._.!w..C....O...l......3`O_^....X.Q..Z
{p..I...|a......I.Z..V.9.].s..`... ..kyA...b..V&.^3rl....R.a......*8..
7{]..y..4D........(zG.lf........gL.B.y..l..#.K}..*O.6......C..b...dO..
.Y...o........z......`U.>...v<U.<e...r.......3B..`2zQ..u.{.4.
...5F7S..8P...-.4B..[.. >.b,.8...V..>..P.'[email protected]...]\fJ4j
..E...p......m....B8;iQ.K...BpZ......_..o)>a..-pV.BIST.x.|KO^j_.V..
.......:h..4..19.8.u...ug!..-.,3<.sV..x. ........l.....&.z...p. .e.
7:.....B.F.t%. ,...T{.(..5j'.W.".j....I67Z.../OC....B.'.....o79...r?..
]..q.,..[......?.#.UFl.....D.........i.<;..qv_..h.....=x. .x|p.....
.[.w....lwg...;`...;..P....Z..m.........G).....].y!.E.z.t.<#% ^....
.;0R.*{....s.U.0..!k.&.2._4........no'...p..c5.... ..lv_7$`...".E!4..u
..v........`55S9..^...^p?.].P....Zo*}.j..~....P......P....?*.=.M...c.p
..x.v..O.&U.............tX.I3.^hM.Wg....^..j......2%.X.:.On.34;.q..(p.
.qJ.....I8.. ....a..E:$..3aGq...j=......h...^zm.....v _.9........oPE.}
0h.|.<O..........]A..-.-b.!.N.....M... 3..7?.Q_....KW`.5 b.].~.
<<< skipped >>>

GET /media/v1/0f000ZtbOwy2j0IrKBdl36.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ubmcmm.baidustatic.com/media/v1/0f000KfF7ujTofNDHryXj6.swf?url_type=1&id_404622239=media/v1/0f000Q1BFJ3x-cEB3jw0M0.jpg&id_4046222

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ubmcmm.baidustatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.0-b

Date: Thu, 04 Sep 2014 01:28:18 GMT

Content-Type: image/jpeg

Content-Length: 10705

Connection: close

Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT

Expires: Wed, 29 Jul 2015 02:46:49 GMT

Age: 2991187

Cache-Control: max-age=31536000

media: media
......JFIF.....`.`.....C.....................................%...#... 
, #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((
((((((((((((((((((..........."........................................
O.........................!.1A."Qa..2q...#.....3B..$RSTbr..4....CU.Vcd
s.....................................$......................!.1AQ..".
23q............?..KZg..C.6.......$b....y.....$Z. .Et...8....v.....SF.K
J....b..~........G.C...ji. .8..P.o.....k3..J.XT..x....OQ..5RQ.E9..%..i
.I...t...q..UC/.".:..#..uX......i...1R..L..m...........2..Y..K.X..M..]
..;..p..k\...R3..X.w....d...)3).e....%....m..CS...-.F.*E....|..%..WW.B
6..6a.u.........cXj....`.;.[..N...# .(fEb..............i...>...$.w6
....p...[.............W=....OU.ES.<.f..b.az,...E..3....Q.|N..;..<
;......B..K.....r;.a...;..= iy!.%mbH..... .....UmX.E.-8...u....lH..`.)
..u.......CS,B.....v....E........XF.......k......Im ..$...O.....tC..S.
Q.W ....-._v;..}U5n...#c.a.4.....u5V.!~.z.....u..2.}... r.......pR....
...;....i......kV..Q..!..0.][email protected]. \n<..xb....\..K....v..N..mv .. 
u.<...3..A7k...(...3\........$O.~.Ox.rF......*.5....:b=.j{.H....N.E
$...jB-n.....Pe.W.xO....,......_.....iH.B:.....}..b]/M.S......B.......
....N.M...&..p..........cN...[......Q.."6....vRZ\..D..}.c.....~x.QRia2
.",@.,Ab. |....<.t.....i4H.~...;u...m0.e.I.(,4.\.I.c..._^O.....*._.
.SU..d........&.C..............l..........36....T....o..t......9.n.|O?
~"......a.6{0......r. ..2..zH......5..r...t.....YGL..g.......I....Lg.m
...\..U=EKf2.....ny[....niKU<....N...W.E.8.8...F.......(Ki.64..
<<< skipped >>>

GET /c.php?id=30039538 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: w.cnzz.com

Connection: Keep-Alive

Cookie: cna=Gq6ODEoRhRUCASU5EL0s8UhE

HTTP/1.1 200 OK

Server: Tengine

Date: Thu, 04 Sep 2014 01:28:06 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Thu, 04 Sep 2014 00:33:51 GMT

Expires: Thu, 04 Sep 2014 02:03:51 GMT

Via: cache27.l2cn201, cache2.de1

Age: 3255

X-Cache: HIT TCP_MEM_HIT dirn:4:535524370

X-Swift-SaveTime: Thu, 04 Sep 2014 00:33:51 GMT

X-Swift-CacheTime: 5400

Content-Encoding: gzip
cbc..............ks.6.....i..bh.v..hT.(N.6qs...Q5...DZ.)......o.$H.n2s
w_...X......,3Z%y..w..LaP.I.S......^..D.....K........g......?|.C..^O..
.(.,{].f....|.....K..'.?.><=D...\X`t.V.".....:.UN.|x.\(..E...=H.
.(!..`..:.. yq{wE.....A./.e..2.X.a..7..K..3.:....t].i^N....%..k.X...MX
Q..ZZ..X..4......g..FV)..\%SR...,Yq.W,Lv#..}t...{R..$.........r._./...
...|...............C\U......U.{.I..........<..........s....Bc..t9..
.._'p..7.,.y.~.x<...<..3.....^f..d..K,. ..E^........-c..(....z..
[email protected](.I..c....=H..Nm.Z.........IR.....
.H..L0..D.9...;~.6Z..e.m...'.Ez.TI1..R.Qu...Q......\..<*H&........a
Q..1..|...OU.dS.i..(....o.......,.Vq@;.W....qP^'..p...w..l....:.4_f...
s...bs.<l....7v..o_N.. ,......*..V...k.Ga...d.....|...mo;......F..k
.y.~.5..\...2..$....R.4...o....U..9.b.......Z..zp?......P...~..;re My 
m..h..u-/...2sQv@l;..Bg...1...}....T.c........0..>.IqX9].nR..`@..^.
9..%g..v..Zc<q........4k....~...eXV.....I.q.<..n.9*..hG2........
.X..e.G#noG,e.3.O.Gm...."B.GW...I.D....8V.F...Y.]kLF{..D.s..$$..1^..do
..T.....<!'rj..7....$.B.....NH.zj...%........e...H!,k......v..t..%$
..t......{L\.7.\...n@ .i..7.Lk5tI..M....$5.f...|..........]>1.....T
....:M..q;........Q8...1.?`..O.L. p....z,%....W [email protected].>.i....)...
.......<...1.`.^h...q.31.T...4.D..q....#.h....a#..C.(.........<.
p.y ..?..1.Y..50.%h...<4....~Z/...................4F..G.{...i...[..
..|k.A..r.B.\M...2....<&.f...F.#D$}...2.3......P.G..."q.......Y....
........Riuf..F...../.^@[email protected](.d7..`._tf..~;..r..b
<<< skipped >>>

GET /static/js/bds_s_v2.js?cdnversion=391610 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bdimg.share.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.0-b

Date: Thu, 04 Sep 2014 01:28:02 GMT

Content-Type: text/javascript

Content-Length: 9992

Connection: close

ETag: "3046823646"

Last-Modified: Wed, 03 Sep 2014 08:40:41 GMT

Expires: Thu, 04 Sep 2014 01:56:30 GMT

Age: 92

Cache-Control: max-age=1800

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip
...........|.r.......;liQ.7.`d..2x.._.Mw..!@[email protected]>ab.i
>g..gLfU......9...RUVUVVVV.J..{0..Nt.P...f.`....5.(...".W....QZ?@..
.m<.4t..%...[.....z..........G.#.....jn.>..~.....|....i.......wU
..K..M.2.D...{,...[..Qx....H..#.gx7..I.}.5. ..........{..yp...2....?..
.....3..=.#.{.w..........p}{[.....z .P.Y.V....K..b.H./..=..`\oa...... 
(..L..U..-g.#.7....R.'.1V..?....;..;{.z..w..o.....cAI..0.....@8....?..
....j.C.C..K..c..E.......q,.=....Os....h..h..h;..2'.eND.......;....a.,
...'...Da.....a?X-U..Iw.-....[.o......>@w5..;..F.Vs.6...m^Uj.3(z...
[email protected]@........1..d.xP.....K[..5..: ..{.SC..s.@ .'...<........
.K[...O.............{9......fS`..Z...q.5Z2.j......L6.[s!.....m..he..D?
.CD.-:.L.......{.M.ax..q.......S.&8.@\..4..g{d.5.]......s...`..pIM....
...F0?.b'.ts.....|..a..{../B.4....fX./.........KooW....K|M."..........
U..=.....2.....|o....H-.*..yc"...6......]..{..[...N....$.... .A.2R..[]
...8k..)a..v.........!..d..M...L[.>...........:.T>....8.......T.
....f..h^..]...g.7...0.....5......H\...\...Z.. ..>N..?....xXa...<
;..s.:$X.@3.|2.B.H.....xX.c...X..X......p.c-.....S.UGe.......#F#g5.qV.
.)bsj.#.....d.t<-...4*$..M..&..H..H.qq.....J-..p.(..vvQi`G...".m..s
>...H8y.EgM....a......v..T._...p...2a.8...t..W*..i...e. 2....:....^
....#.oY....C..8f............H.......2aK.b.XN.....~....8..8%..?..U.|^.
(...i..d....8.Q.!}....!.s....~.s$C.<.N.g.2....L......."..l...N ..Ri
Pd.DX.TZ...P*...3.-....H......].S...\[email protected]..}.s..\..G...".I."
..i.(...V.....q.........:..a.........j.X.R.._...8....A............
<<< skipped >>>

GET /resource/ucenter.js?20130513 HTTP/1.1

Accept: */*

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin.3304399.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 04 Sep 2014 01:33:34 GMT

Date: Thu, 04 Sep 2014 00:33:34 GMT

Server: nginx/1.4.1

Content-Type: application/x-javascript

Content-Length: 42950

Last-Modified: Wed, 22 Jan 2014 03:27:46 GMT

ETag: "52df3ab2-a7c6"

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 zjjhdx36:8106 (Cdn Cache Server V2.0), 1.1 fra77:3 (Cdn Cache Server V2.0)

Connection: keep-alive
uni_login_type_key = "loginType";..uni_login_username_key = "username"
;..uni_login_uid_key = "uid";..uni_login_nick_key = "Pnick";..uni_logi
n_qqnick_key = "Qnick";..uni_login_puser_key = "Puser";..uni_login_ptu
sertype_key = "ptusertype";..uni_login_phonebinded = "phonebinded";..u
ni_login_lastLoginDate = "lastLoginDate";..uni_login_lastLoginAppGame 
= "lastLoginAppGame";..uni_login_lastLoginTime = "lastLoginTimeStamp";
..uni_login_type_qq = "qq";..uni_login_layout_horizontal = "horizontal
";..uni_login_layout_vertical = "vertical";.....var unionLoginProps = 
{};..function getCookieValue(propKey, defaultValue){...uniCookie = JK.
Passport.get();...if(!uniCookie)....return defaultValue;...return uniC
ookie[propKey] || defaultValue;..}..UniLogin = {};..UniLogin.getUid = 
function(){...return getCookieValue(uni_login_uid_key);..}..UniLogin.g
etUname = function(){...return getCookieValue(uni_login_username_key);
..}..UniLogin.getUserType = function(){...return getCookieValue(uni_lo
gin_ptusertype_key);..}..UniLogin.getQnick = function(){...return getC
ookieValue(uni_login_qqnick_key);..}..UniLogin.getNick = function(){..
.if (!UniLogin.getUid()) return null;...var nick = getCookieValue(uni_
login_nick_key);...if (!nick) {....return null;...} else {....if (nick
.replace(/[^x00-xFF]/g,'**').length < 2) {.....return null;....} el
se {.....return nick;....}...}..}..fetchNickTryCount = 0;..UniLogin.fe
tchNick = function(callback){..setTimeout(function(){....if (!UniLogin
.getUid()) return;....var nick = getCookieValue(uni_login_nick_key
<<< skipped >>>

GET /upload_pic/2014/6/6/4399_14533870073.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga5.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 02 Sep 2014 19:55:58 GMT

Cache-Control: max-age=31536000

Content-Length: 5354

Content-Type: image/jpeg

Last-Modified: Fri, 06 Jun 2014 06:58:57 GMT

Accept-Ranges: bytes

ETag: "7a4b6ac95481cf1:34b"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx41:8105 (Cdn Cache Server V2.0), 1.1 fra73:0 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......P.....ohXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:7183AD9F9D55E3119
370AD778E2BCB3D" xmpMM:DocumentID="xmp.did:7881C0E9CEB311E3BAD594BCDB3
2FD0E" xmpMM:InstanceID="xmp.iid:7881C0E8CEB311E3BAD594BCDB32FD0E" xmp
:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:97B3C9150CBAE311867FF2B6425D4337" stRef:doc
umentID="xmp.did:7183AD9F9D55E3119370AD778E2BCB3D"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................*.D.................................................
...........................................!1..A"2345.6.aQ.BSc.7db.#.D
.e..8........................!1A2..Qaq.".BRb3.4.....r.........#c..$C5F
..............?..42al*.G.B.TH.$"s.<.A.^.MQ......"E.........7...P...
Z...Vr(...^....".If**.h..B>.j..zUu....:..R.cg....G:.'.x....\.w'....
..O.`.d...RF-E..U.[.&.&.....f..o.y/.n....c..GP..`.2..Z.J..~=....7/
<<< skipped >>>

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cb.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 04 Sep 2014 01:28:10 GMT

Content-Type: text/xml

Content-Length: 3710

Last-Modified: Wed, 12 Mar 2014 07:45:00 GMT

Connection: Keep-Alive

ETag: "5320107c-e7e"

Accept-Ranges: bytes
<?xml version="1.0"?>..<!DOCTYPE cross-domain-policy SYSTEM "
hXXp://VVV.adobe.com/xml/dtds/cross-domain-policy.dtd">..<cross-
domain-policy>..    <site-control permitted-cross-domain-policie
s="master-only"/> ..    <allow-access-from domain="*.4399.com"/&
gt;..    <allow-http-request-headers-from domain="*.4399.com" heade
rs="SOAPAction"/>..    <allow-access-from domain="*.4399.net"/&g
t;..    <allow-http-request-headers-from domain="*.4399.net" header
s="SOAPAction"/>..    <allow-access-from domain="*.4399api.com"/
>..    <allow-http-request-headers-from domain="*.4399api.com" h
eaders="SOAPAction"/>..    <allow-access-from domain="*.4399pk.c
om"/>..    <allow-http-request-headers-from domain="*.4399pk.com
" headers="SOAPAction"/>..    <allow-access-from domain="*.4399p
k.net"/>..    <allow-http-request-headers-from domain="*.4399pk.
net" headers="SOAPAction"/>..    <allow-access-from domain="*.50
54399.com"/>..    <allow-http-request-headers-from domain="*.505
4399.com" headers="SOAPAction"/>..    <allow-access-from domain=
"*.61.com"/>..    <allow-http-request-headers-from domain="*.61.
com" headers="SOAPAction"/>..    <allow-access-from domain="*.ap
p111.com"/>..    <allow-http-request-headers-from domain="*.app1
11.com" headers="SOAPAction"/>..    <allow-access-from domain="*
.baidu.com"/>..    <allow-http-request-headers-from domain="*.ba
idu.com" headers="SOAPAction"/>..    <allow-access-from doma
<<< skipped >>>

GET /ecom?di=62872&tm=BAIDU_CLB_XML&asp_url=4399.com&return_type=1&ran=810.5809288099408 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.swf/[[DYNAMIC]]/2

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cb.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 04 Sep 2014 01:28:10 GMT

Content-Type: text/xml;charset=UTF-8

Content-Length: 233

Connection: Keep-Alive

Set-Cookie: BAIDUID=6D2C9CDF0A0DCF8B2D787BD25222C33D:FG=1; expires=Fri, 04-Sep-45 01:28:10 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1

Set-Cookie: BAIDUID=; path=/; expires=Thu, 01-Jan-70 00:00:01 GMT

P3P: CP=" OTI DSP COR IVA OUR IND COM "

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Thu Sep  4 09:28:10 2014

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache
<?xml version="1.0" encoding="utf-8"?><adm xmlns="hXXp://cb.b
aidu.com" xmlns:xsi="hXXp://VVV.w3.org/2001/XMLSchema-instance" xsi:sc
hemaLocation="hXXp://cb.baidu.com hXXp://cb.baidu.com/xsd/BAIDU_CLB_XM
L.xsd"><status>0</status></adm>.HTTP/1.1 200 OK..
Server: nginx..Date: Thu, 04 Sep 2014 01:28:10 GMT..Content-Type: text
/xml;charset=UTF-8..Content-Length: 233..Connection: Keep-Alive..Set-C
ookie: BAIDUID=6D2C9CDF0A0DCF8B2D787BD25222C33D:FG=1; expires=Fri, 04-
Sep-45 01:28:10 GMT; max-age=31536000; path=/; domain=.baidu.com; vers
ion=1..Set-Cookie: BAIDUID=; path=/; expires=Thu, 01-Jan-70 00:00:01 G
MT..P3P: CP=" OTI DSP COR IVA OUR IND COM "..P3P: CP=" OTI DSP COR IVA
 OUR IND COM "..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Last-Modified:
 Thu Sep  4 09:28:10 2014..Cache-Control: post-check=0, pre-check=0..P
ragma: no-cache..<?xml version="1.0" encoding="utf-8"?><adm x
mlns="hXXp://cb.baidu.com" xmlns:xsi="hXXp://VVV.w3.org/2001/XMLSchema
-instance" xsi:schemaLocation="hXXp://cb.baidu.com hXXp://cb.baidu.com
/xsd/BAIDU_CLB_XML.xsd"><status>0</status></adm>.
..
<<< skipped >>>

GET /control/A4399dv_base.swf?20130625 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.comment.4399pk.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 04 Sep 2014 01:24:07 GMT

Server: nginx/1.0.4

Content-Type: application/x-shockwave-flash

Last-Modified: Tue, 25 Jun 2013 08:05:23 GMT

ETag: "538199e-841e-4dff5fdb016c0"

Accept-Ranges: bytes

Content-Length: 33822

Age: 1

X-Via: 1.1 fra73:4 (Cdn Cache Server V2.0)

Connection: keep-alive
CWS.A...x....\SG.>~..&77.....5....h.."(*`...........R..}..]q..}....
.....X..V[k..............}..g...9sf....2....8NK..>j..".....*.E.p...
=..Y...Z..YN......b...t.k.=O..0...(........u....\a.3.8..W..CU...1....k
e.!...rC...(8.o...Cw......H.~8..6.5...,.Lk...S..j...6.S.aH7..*...w.?G.
AxU}..b...Z-..T.[LN....cH7[3[T...e?U.}Mv..U.e..C.....[...<}Mk.#..L.
....>..e..9-1...I.F...7.1....m.T...rX.$... .. .[6.........>*.q.E
..j.)..hK_.........%U...9.w`B.._BF<..Xz>...T./....!p...*...K....
A.t..$...:..suVq._~......#..4.q..8.g...}...!....qd......~.P....\..a.0.
. ....p...m[{.........-.....4......?...k....>.?....\..:.H[. .93....
>>.]..}........t....4i...[...\.Mw.k.I..........W$.A\....R..\.|..
..C5|'F..VD..p..*.|.".I...X.=s..MI.....5.W...8..K..*...:D...BU...k..S.
J.J.$..V.R)..h..xi..HIZ.N[Q..PF..xh.^e* .....!W_..L.(....g.....z...?e.
t......0.m..KV....C.>..8W.[.W.....T).5..&:.(..B.Q*...^!(U>..X.A.
.W.~e.."....Q-.S..6..W.L.....`..g......J8^.^.O...>5....h..(|.V..?..
.U:....Q.=....T.1..g.^.{........_o.m..ul..e...L.6wc."nZ\....#k.....5c.
.?.tL...l. .Z..'SF5...8.j.....N..U..o{.YQ...8T:.e./..Y.cI.UE....).n.43
q..Kcz...V.J.....i.l..`..tN..].....9...[..~.!W.t{.G.X.'.-.Z4^w.a...;u{
*d..U.y.....f.....i..57...s.x.....:...}... ..wI..6v.........n~v.....9.
...~...vM...:.O.-}.o........=w}..ql....n.lH..|....Sk.7]T..X.v.}...5y..
....?.0ql.G..].f.......fQV..Y.w.....M.(*...U..-k`,.{.Mka......=Rpf..?6
...x..._<i..X.^... .l..b.q.if.....`}...;..m2...o...;e.6m..C...=.g..
.D7...3...^o?y.}.......G\...I/.~.tQ.G......-.. 7....?..<..o^Z..
<<< skipped >>>

GET /upload_pic/2012/tjyx/tjrm_img07.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga2.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 19 Aug 2014 19:43:44 GMT

Cache-Control: max-age=31536000

Content-Length: 3257

Content-Type: image/jpeg

Last-Modified: Thu, 01 Mar 2012 06:03:42 GMT

Accept-Ranges: bytes

ETag: "b073bad71f7cc1:34b"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx39:8106 (Cdn Cache Server V2.0), 1.1 fra77:3 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......<......hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c060 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xm
lns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.ado
be.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/
1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="xmp.did:7C3C9
0818062E1119A50B0F09DBE5343" xmpMM:DocumentID="xmp.did:48F37DFA62B611E
1987FB533819DF614" xmpMM:InstanceID="xmp.iid:48F37DF962B611E1987FB5338
19DF614" xmp:CreatorTool="Adobe Photoshop 7.0"> <xmpMM:DerivedFr
om stRef:instanceID="uuid:02cd31e0-62b0-11e1-a9f2-89007db68855" stRef:
documentID="adobe:docid:photoshop:3e3cd8bb-62a6-11e1-b37d-c0893894c906
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>....Adobe.d....................................
......................................................................
.......................................*.D............................
...............................................................!1AQ2.4
.a"3..q...BRb.#C...r.c67.......................!1...Q.Aq2..a3...."#.r.
Cc$4............?..........rxY7..H.".-.L...4j,f.QW1.U}.).......5......
.j....e!/~Ko-.s..E...m..8M.q.SH3.......*..gu- R5....m......H.p....
<<< skipped >>>

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.api.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Thu, 04 Sep 2014 01:28:05 GMT

Content-Type: text/xml

Content-Length: 570

Last-Modified: Mon, 28 Jul 2014 09:59:57 GMT

Connection: close

ETag: "53d61f1d-23a"

Accept-Ranges: bytes
<?xml version="1.0"?>..<!DOCTYPE cross-domain-policy SYSTEM '
hXXp://VVV.macromedia.com/xml/dtds/cross-domain-policy.dtd'>..<c
ross-domain-policy>...<allow-access-from domain="*.4399pk.com"/&
gt;...<allow-access-from domain="*.4399.com"/>...<allow-acces
s-from domain="*.4399.cn"/>...<allow-access-from domain="*.my439
9.com"/>...<allow-access-from domain="*.4399.net"/>...<all
ow-access-from domain="4399pk.com"/>...<allow-access-from domain
="*.4399api.com"/>...<allow-access-from domain="imga.4399.com"/&
gt;...<allow-access-from domain="imga1.4399.com"/>..</cross-d
omain-policy>....

GET /4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.htm

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s8.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 03 Sep 2014 12:04:24 GMT

Server: Microsoft-IIS

Last-Modified: Wed, 03 Sep 2014 11:11:50 GMT

Accept-Ranges: bytes

Content-Length: 3023897

Cache-Control: max-age=31536000

Expires: Thu, 03 Sep 2015 12:04:24 GMT

Content-Type: application/x-shockwave-flash

Powered-By-ChinaCache: HIT from CHN-ZJ-2-355

Age: 48218

Powered-By-ChinaCache: HIT from CNC-TY-E-3ON

Connection: close
CWS...1.x....<...?>...53.A......Q......i..d.hf..B.o.......B..])J
.mh.J....z.-....}...y..........s....%.....H...*..$?.@ $.........._'...
..Oh.....D.H.c......s#. .............8..q<.3..'..`.......8."......A
.(.....Ge...42J...d......6O$4652..X.6!|A.Sd....r...p....0~px.3.m..e...
..f...8"......b..p..:.:.....b....{...,...6..G.G....`.S...w...6DdT..#.c
.l.x.<~......O.........a.\&/4....u...~..92El[?v.........x..q....{..
.gKp.{M.Np$..... ...%..........`.[h..6....'..#,...=.<x..0.d?.@@pv.y
~.%P....?._..N.....y%?......8....(.~...(....[.}8..............>.;Q.
.Ls.<...J|...=&....~...Y.............$.y....$z.z.>...C/.^..T{i..
.......<.e.i..9s...p ......WNS...._-~=.ih..j.....k..o.9...3..I.....
.h..r..AE{...C.7.^8.J..g..I.3.W5(..K0%.ddz.g.H.d......I%..;e..dG.IMV.y
[.>......C(.S.........?t9p....~I....<...5.u^...9...Y$.1.;.&.....
\.[.?.i...C.?...._.R.<wJZm...5.x...FH.<.k....`.dZ...c.K....}..].
.......k.. ..:.X..!..Lh....#X.4h../....4AN...5..0.X...!.b.$..K...-...;
%......K......L.'p..',oE......r.r>...u........9....Y....Z.G...<\
.r.....y.j........M.....k{.|...\.sv..a...j...s..?T...o.u.a.U.....O....
)..y..-.|;..=,..(.(s..%.j..N8mZI......Wo8...e....bk-..<].S^......W)
..?..M.:'. ..e.....l..^.......6...:)..u.}.`i.......J....Kr. y..V{...%.
...P..5.W....i.lv.v...j......[,mt.!...5..m..m.U.............6>.....
l..I..u..N...9z.7e.}{...<..IJ...8.vk.[.G2.....2...Q..;>...d.5i..
..f7..Y......._.....o.-.y.....>3o....k.v=V3.l..L.....S...t..W_R.v.y
....NL..y\'..x...A7[.....>.....".|..e...#.;.>~.;..JE.......2
<<< skipped >>>

GET /media/v1/0f0000I41e4oSte6MNwG4s.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ubmcmm.baidustatic.com/media/v1/0f000KfF7ujTofNDHryXj6.swf?url_type=1&id_404622239=media/v1/0f000Q1BFJ3x-cEB3jw0M0.jpg&id_4046222

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ubmcmm.baidustatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.0-b

Date: Thu, 04 Sep 2014 01:28:17 GMT

Content-Type: image/jpeg

Content-Length: 10984

Connection: close

Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT

Expires: Thu, 30 Jul 2015 02:21:23 GMT

Age: 2991186

Cache-Control: max-age=31536000

media: media
......JFIF.....`.`.....C.....................................%...#... 
, #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((
((((((((((((((((((..........."........................................
C.........................!1AQ.."aq........2B..#R.br...$3cs..Í......
......................... ......................!..Q1A2a............?.
...MsJ..u....4.k.@*.&...4.S\.\.....\.3........I......3Q.om..~...1.p...
%.k\.B]...............,..9/....KT.E..X..5M.....=U........4=...E..k../.
X...;.......x. .{.X...7j...Ce^..*.."..0.(....#.>..H.4;..M..M'3....R
..=.V,.!}xA...u'M]$.....H .......\t..fK................A./].0:.e......
y.....;.......dh.../....Nd..-$m.........B...[I...:...<......^..%$.{
.*..Jx.$k.Y....$....;p.\w..R.4..H.H....^.\.=....V......1.M]....uA..O.@
/q...yL..}....9%N....NKT.u.Go*.q|...J.....#h.8P.n......:.......u...%hV
]%..f.^.P.i..[.....%.Ll.2[[email protected].~.i]bcY?.&.{ mg............
..Q..^..>.6.X..q.6....... .R..{2y.O...R.R.I;..ig-.}7.M...k..H."....
k..7}p.........<....J)H*I..:.}7..bVL.[[email protected]........<B..%....
.}~i.......#.W.m..NV.HA$...?....k..q_J.D.$.v.)..9.#CP.......n.W..'..ei
Ne%@...*..R..s.,.sT.m.KO. ....ra.s..QA.z.}[email protected]}....] #..>uI.J.."u
..<..S9.<...H...X..h.....d..&<...W.<.....J..........P..:.R
V...:-VBns.\%.... R..Tt.z..iH......>.)js*@O.mK\N.iia..M).."3B....I.
:HP'...QV.XQ.w.s.............'` ....FQ.f...%D...Q.:.....)%..BN.j.n.Sd.
*...Ze)9..'.....V....iF...]<.."9E(..5.S...*...I....jp8.7..g...^.:z.
4.B..:..!......<5.?.$! O...7.....^.uZ.....W.I...I.3..4.yP.C....
<<< skipped >>>

GET /static/js/logger.js?cdnversion=391610 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bdimg.share.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.0-b

Date: Thu, 04 Sep 2014 01:28:02 GMT

Content-Type: text/javascript

Content-Length: 2404

Connection: close

ETag: "3038463500"

Last-Modified: Wed, 03 Sep 2014 08:40:41 GMT

Expires: Thu, 04 Sep 2014 01:36:50 GMT

Age: 1272

Cache-Control: max-age=1800

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip
...........X.o.8.. .Q.....d.......{..E.6...1.E.l52..('...~....;mq(....
9.o..zjp.|^{J...(v...;..'..I....E.X.v.e.}.7. .."....DZ.... ...t..u./..
0Q...A$..!..!.I8....Eg...d84.....5&.Y{......T(.`):.J'...%l....&... Z*.
s%....D."CB.N..........he.\8.. ..Mg.....hT. ..r...B9........#y......r.
....1.r..-..-.zC;.n{........mwd.....1v.u3.V..-K:k.q._...*.....b...~1.;
.a.>..4lB.......|1a......g.\.b...../Y.P..R...,..n8."._`.......eMH.V
uJ}..3..2[G..H.!bGfw..}.o..z*....BG.....M ...)e...,Z.....1?.0.....^.`u
.Aw..W.F$........%...Z...F3.5..L#...d....;...6........^.yF...g...Ar...
.GS...../vwe...w...?&...Jn.t3.&..-....A...".{Z.......(.j.?kO....;.....
...yV......W...(.. m.. .../..d..~~1...N...V.N../...r..YF..?...;.M.8...
3r......{.Y.p....[&}.oj..._bq .^V0E..-......"...M|.|[email protected]
I....kY..1d..O.wh..C.^.ca$2....J`...X2....U...z8.c....kj..`..<....D
..J%..Y.......9...fs.?.p..mN..tU.....Qs....k$.U.F@...^QT...........%..
.P.....c!....QA..q .F.ub..|sE.../)...g .P..5b..X..c.kk.......,eA.p..jE
.E.$..Y. _G..D0. .k....5dV..#. ...0......p.iq..ZdN(........A.*^.rd....
..L.....2!..y..>%...H.TH.c.e,a9u. .N.SI....x..H...kt{[.."...... .-.
.......i.!\............r.J.'......C.>..)=ys...%..&n..E.c...........
.$J.c8....(.aH#.....1.\l......~%0.{..;D*.FU....!Tz.h...... .p..8..z*.c
.:........[..3..^..-...1z....0.....J6b.6..Ob..>u.M....S7Gh...Ai...N
d,.?.M..........y....#..|.....n...............j.......s........k}R....
?.3.@....'........`UW.3X,.dv...!...U.|b.......L.k..g._."..&G.|..f...$.
...P. I/.#6..0$...............~...O6.....}.Zx... x...}.h.B.').y}..
<<< skipped >>>

GET /resource/css/base.css HTTP/1.1

Accept: */*

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin.3304399.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 04 Sep 2014 01:59:28 GMT

Date: Thu, 04 Sep 2014 00:59:28 GMT

Server: nginx/1.4.1

Content-Type: text/css

Content-Length: 29379

Last-Modified: Wed, 02 Apr 2014 07:29:04 GMT

ETag: "533bbc40-72c3"

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 zjjhdx35:8106 (Cdn Cache Server V2.0), 1.1 fra77:6 (Cdn Cache Server V2.0)

Connection: keep-alive
@charset "utf-8";../* CSS Document ..Use for:...Version:.1.0..Date:..2
011/08/10..Author:..f2er..Update:     2012/05/03..*/...login_embed_ifr
ame{border:none; width:100%;}...login_embed_iframe_hor{border:none; wi
dth:100%; height:100%}...login_horizon{height:31px; line-height:31px; 
/*padding:9px 0;height:12px;*/}...login_vertical{width:600px;} /*modif
y by qf 05-03*/../*............*/...mt5{ margin-top:5px;}...mt10{ marg
in-top:10px;}...mt20{ margin-top:20px;}...w256{ width:256px;}..#popup_
login_div{ width:400px; margin:0 auto; padding: 16px 0; }..#popup_reg_
div{ padding: 0 0 16px 0; }../*............*/...login_horizon legend,.
login_vertical legend,.login_module legend{ display:none}../*login_hor
izon*/...iptw1{ width:73px;}...iptw2{ width:154px}...wtc{ width:352px;
}...wframe{ /*width:620px;*/ width:530px;}...wframepwd{width:280px;}..
.login_horizon a,.login_vertical a{ color:#1278c0;vertical-align:middl
e;}../*......chrome..@media screen and (-webkit-min-device-pixel-ratio
:0){..  .login_horizon a,.login_vertical a{...vertical-align:top;..  }
 ..}*/...login_horizon a:hover,.login_vertical a:hover{color:#ff5712}.
./*login_horizon*/...login_horizon .login_hor,.login_horizon .login_bt
n{ float:left; margin-right:10px; display:inline;}...login_horizon lab
el{ color:#333}...login_horizon .login_ipt,.login_vertical .login_ipt{
 border:1px solid #ccc;/* width:144px;*/ padding:2px 3px; background:u
rl(../images/spriteV2.png?v=131127) repeat-x 0 -31px; height:22px; lin
e-height:22px;}...login_horizon .ptlogin_btn,.login_vertical .ptlo
<<< skipped >>>

GET /flashflowstatis/submitflowstatis.php?gameid=100015389&seedvalue=b6e3a26a862ef6f78463cfaaaec0c7ed&adid=999&gamekey=asdf&nocache=1409794164497&os=Windows XP&lng=en&hosturl=hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.htm&scres=1276x846&playurl=hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.swf&fp=WIN 11,6,602,168&adLoadTime=0&adPlayTime=0&browser=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)&ctrVer=5 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.swf/[[DYNAMIC]]/3

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.api.4399.com

Connection: Keep-Alive

Cookie: _4399stats_vid=14097941234975701

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Thu, 04 Sep 2014 01:28:47 GMT

Content-Type: text/html

Last-Modified: Mon, 25 Jun 2012 13:33:36 GMT

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

Content-Encoding: gzip
15..................2......0..HTTP/1.1 200 OK..Server: nginx/1.4.1..Da
te: Thu, 04 Sep 2014 01:28:47 GMT..Content-Type: text/html..Last-Modif
ied: Mon, 25 Jun 2012 13:33:36 GMT..Transfer-Encoding: chunked..Connec
tion: close..Vary: Accept-Encoding..Content-Encoding: gzip..15........
..........2......0..

GET /upload_pic/2014/2/12/4399_14504425052.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 15 Aug 2014 19:44:15 GMT

Cache-Control: max-age=31536000

Content-Length: 5371

Content-Type: image/jpeg

Last-Modified: Wed, 12 Feb 2014 06:53:41 GMT

Accept-Ranges: bytes

ETag: "32365b2abf27cf1:34d"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zhenjiang82:8111 (Cdn Cache Server V2.0), 1.1 fra77:5 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......Z.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:A9695A8293AF11E39C96F6C74704F3EB" xmpMM:DocumentI
D="xmp.did:A9695A8393AF11E39C96F6C74704F3EB"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:A9695A8093AF11E39C96F6C74704F3EB" stRef:doc
umentID="xmp.did:A9695A8193AF11E39C96F6C74704F3EB"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................*.D.................................................
..............................................!134.AQa"2b.5.6S.B#.7.q.
Rr.cTdt.E..J....................!...1...AQa.q."2.......BR#345..r..C...
.b....$DT%G.H............?..)ko1_.o.........F.)..T9.E!..>..a.......
...~m..Re....H........W..[v..$2......~....,.~ (%..F.3.Azp....:..*..Q@.
#j... ...n&.._.....Y.'[email protected]!^.....~. #[email protected]&8.....5$..,.
...v.....eU.:.._.r.)...z..k.eO.].-6jH.e.....bB...r..@./Hc.X.....^q
<<< skipped >>>

GET /cpro/ui/uijs.php?at=6&fv=11&ch=417&ie=1&q=www4399com_tp_cpr&n=1&k=鲜花&f=过滤词1 过滤词2 过滤词3&u=4399.com&s=2&t=baiduxml_tiepian_400_300&w=940&h=590 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://cpro.baidu.com/cpro/ui/baiduLoader_as3.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=6D2C9CDF0A0DCF8B2D787BD25222C33D:FG=1

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 04 Sep 2014 01:28:13 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Set-Cookie: sequery=ÏÊ»¨:4399.com;path=/;domain=.cpro.baidu.com;HttpOnly

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Thu Sep  4 09:28:13 2014

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Content-Encoding: gzip
414.............U]s.H.}...3..yC..R..)$*.$.. LMQ....J.!..m0.d...}..t.s.
.........U...........M.d.........a.u...l...h..%..Q.: 3i...`..b..Ihc...
........G...m...w._.(@...wa..u..zA..h......A..P...L.,....Y%|...C....9n
...]....i.f.....=. yu.%....3.L'LR...%.....|.........@,.......4.B~ p.#&
..p.f..._.....A,....@n.?....%W'....?.......R:D..s.am:bnF....<.~.*. 
.e....8...;P...gL...._..g..I7.. ...#.f.......~.{].b.6.......N.q..c..^.
.%u.......Eu...j{#z...AR.J.u....B:N....$.......>g.......;,.."....g.
..Y.j.M.......}./...........y9..%;dk0ytX`]VN$..\`.......I.......8YkZ3.
y&O<fs*.?.e./<R..R./.By=E=%.y\#8....K...g.[cj.....)..Y#.*.W.Ev0p
...S.*...PS4.....3.j.W.6yU(E.C..99.."[email protected];....X.....e..`....u..>
8...L..H9...Z..s2...^...U..."....1h.MqO...Z...J&q..e.;q.3......s.f^l..
_.NjG....L..JW%.2....k...8N*......O....aV.g..%.4>.....*.jPq...i:T..
v]..K..)S.<.H.Yq)\v..^.o5d.F....Hx`...F.PY.S.fp.....E.;{ .ssa8.F...
.e;lN.$.l.b.w....fB0].......'....u0.zT3.>..1...h$..Pqg.|_.F....sQ..
..=....l...}...ns..MO...A<..[p.o..,.c....?.0.......%v. a(.T..C*.}HM
[email protected];...........0..
<<< skipped >>>

GET /media/v1/0f000Q1BFoCx-cEB3jw0C0.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ubmcmm.baidustatic.com/media/v1/0f000KfF7ujTofNDHryXj6.swf?url_type=1&id_404622239=media/v1/0f000Q1BFJ3x-cEB3jw0M0.jpg&id_4046222

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ubmcmm.baidustatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.0-b

Date: Thu, 04 Sep 2014 01:28:20 GMT

Content-Type: application/x-shockwave-flash

Content-Length: 1654

Connection: close

Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT

Expires: Wed, 29 Jul 2015 12:39:39 GMT

Age: 2996747

Cache-Control: max-age=31536000

media: media
CWS.....x.m..P.W.....$...D..(.H.....B.. ..@C Q..1ADE..bT....."....Q.w.
 .......Z.....E.T..f.{:.;..{.....}........p..<....0..J...........S(
.d.A~.J....:77....#..S.C.2*F.R(..25.W.....<.(7_..d)U ].......eQ.W.]
eY.L.......e;..$..Q.d..&......8L....!H...ZY..Au...|3.......zk....}K...
3.H.S.g..E.B.(.%u...[f.c.....o.....p.J..$=C%....l..B.._o...m?.b...../.
.?....~...l..................|.dj...p.z..JKa.......N.O........S..]]..M
,.5L..N35.........=uXN...:q....=.........qZQ..y.L..}........u. .....D'
...u..Kc^.Q6....&ho.;y..k.ml...qG.o...9.>.........p.9..l.......D..n
7...d.k.,....P... .L6(.u*.%.....-.....q..... ...[.R7..r(.dC.UQ......-.
JYV.\.h0,t.d..G [email protected]@X4..U.X.B ..HJE.......G.5B.u...m..,....._z..
.9...)...s...nb0...s..dF@ @...q.>.G......mU....Q..;|.>.&..U..(-.
..z..bx.)..7zl;..V.EyM..OD/LLC.g.A...)qU.xm..^.......^....."\ ...$A\Vx
9.n..o:........../,..F.i......y......j.........-........|f1.m...e{Uuu$
...]....[S...F.xZ5."...(}.......K......T...jT........._t....kZM.9.....
....B.7.5v...d.-.B..{. .w..0..b.....!....o.t^.l..sC.3^{...I..`..zu.i.I
'l..f.W..s...h.P..._..K?...fJ.n..k...0%.a..elh...K.ab.....L.}$.=$VV...
.c..#2Ct..oq.{./~-.;.......t.y..l.....2...l.-.p./.x.m7{......a.u.i.M9.
...4.....T.Op. 7...SK{p....]..e..m...0].....y..V\P|.m.c...z...w.N6.nIH
..V..m......jna..qqF.?~`......e...z...9._.$}....<.. P....8/ER..^..-
._L.GH../.....z..Y....w1.87t..;.&VD.....e"06-|87|.........$b.sO.<..
.]............]...p .....>...F... >.......Qe...n>.X.....T9u,{
.].q#Q.|G..D.F..M....^..H.LD..:.h.9"G.v^.. rtVg...X..D..&X...N....
<<< skipped >>>

GET /media/v1/0f000Q1BFocx-cEB3jw0J0.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ubmcmm.baidustatic.com/media/v1/0f000KfF7ujTofNDHryXj6.swf?url_type=1&id_404622239=media/v1/0f000Q1BFJ3x-cEB3jw0M0.jpg&id_4046222

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ubmcmm.baidustatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.0-b

Date: Thu, 04 Sep 2014 01:28:16 GMT

Content-Type: application/x-shockwave-flash

Content-Length: 26335

Connection: close

Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT

Expires: Wed, 29 Jul 2015 12:39:39 GMT

Age: 2996746

Cache-Control: max-age=31536000

media: media
CWS..f..x..weP\M.."...5...,.....n.%..\....$....w............s..LUw....
....r..H...2.@...!....."....C.X..P....m...............@...............
.......P...>4.dttdbrr",ddD$DdT,........c........<<:9><.
!......A......... ....OP.P50P..h.(....~.1......_..G>TX .......:....
......5"........b~f.b...Q.;s.%bS~..W3......r.........W7uK*(.v..4......
a.....:.....p..&.......a.`.?..."..gvXL1Ug...z ..Kb.....;..T..I..&.....
.d...........U...U./.......L..U.Ei.:q....)>>..l.j......P...l..rF
:......Gtp...AVr...v2 ...Z..J....9.Rft..f~.|...t.)....V..j8L...<ZQ.
.F.Q]..s...%x^.r..W.b.*[email protected]...{.....#...m.3....&
gt;.<.&......HJ.pG..a.ur.........B%u.e.eA..]..fSf....h%S.(....9_Z..
..]...-Nb... ...S..E...Y...."B......D.2.Q..U....g.%.B.....9...(3......
Q.t?...E....%.....fB..$..:>. Pc..gX...t.|.dE..|Bk....  !=:.l..).M.f
..?.Ez.....!.....j.{.tu`....ss.%.B..Y.4.......l.. ..$..BZ.."....5a{...
i.....pk.._f-dg......L-. @R.5...2...Yb^...p....t..U...#E..B..L.V].8F..
u....1.Jvao.. ...U.X$as.H....<...y.J...b..^5*....>...... .N]...L
...m{.o.Y1 xQ&..N..ah.('..qFl.sadF~L.....?..8.....>...;..^.(xI...'j
.^IH..m....o..b.R.o...dW.S....hE..XL-.VoQ.(.v......x.. .....!.J)../..N
w...*..f$@.(.tT6 .r ..K..lNPI...5LScV/......U...P......U%..J....5Tq.p.
..R.v........K>......`.I..1? .-.N.a.%....:FO...a\.o0\.qF..%...?6F5.
.txS...~X.....Ag..4h............7..%..Rd..(.....N:^e.X9............5.:
...=.!.......G.Y..LIq....5y.......,.M`....o$tfA....6!#AR.dj.$>6.QL.
~....&<<..8..b.jV....."pE...T..U$....jnL....}.4.z..^..ep....
<<< skipped >>>

GET /v.gif?pid=307&type=3071&sc=1980,4739,1276,818&desturl=&apitype=1&linkid=hznf0pbl823&velo_load=1735&velo_cssload=1016&velo_jsLoad=1000&cite_uid=480925&cite_type=1&cite_mini=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: nsclick.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Cache-Control: max-age=0

Content-Type: image/gif

ETag: "4280832337"

Accept-Ranges: bytes

Last-Modified: Fri, 23 Oct 2009 08:06:04 GMT

Expires: Thu, 04 Sep 2014 01:28:09 GMT

Content-Length: 0

Date: Thu, 04 Sep 2014 01:28:09 GMT

Server: BWS/1.0

Connection: Keep-Alive
HTTP/1.1 200 OK..Pragma: no-cache..Cache-Control: max-age=0..Content-T
ype: image/gif..ETag: "4280832337"..Accept-Ranges: bytes..Last-Modifie
d: Fri, 23 Oct 2009 08:06:04 GMT..Expires: Thu, 04 Sep 2014 01:28:09 G
MT..Content-Length: 0..Date: Thu, 04 Sep 2014 01:28:09 GMT..Server: BW
S/1.0..Connection: Keep-Alive..

GET /4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.htm HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s8.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 03 Sep 2014 11:18:06 GMT

Server: Microsoft-IIS

Last-Modified: Wed, 03 Sep 2014 11:11:44 GMT

Accept-Ranges: bytes

Content-Length: 8602

Cache-Control: max-age=31536000

Expires: Thu, 03 Sep 2015 11:18:06 GMT

Content-Type: text/html

Powered-By-ChinaCache: HIT from CHN-ZJ-2-355

Age: 50991

Powered-By-ChinaCache: HIT from CNC-TY-E-3ON

Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">..
<html>..<head>..<title>..........</title>..<
;meta content="text/html; charset=GB2312" http-equiv="Content-Type">
;..<SCRIPT LANGUAGE="JavaScript" src="/4399swf/js/chkDomain.js">
</SCRIPT>..<meta name="DESCRIPTION" content="......,......439
9.com..........,flash......,..........,..........,..........,.........
.,flash....,..........,..........,S_GAMESORT......,qq......,..........
..,..........">..<meta name="keywords" content="......,......439
9.com..........,flash......,..........,..........,..........,.........
.,flash....,..........,..........,S_GAMESORT......,qq......,..........
..,..........">..<meta name="Author" content="4399.com..........
">..<link type="text/css" href="hXXp://ptlogin.3304399.net/resou
rce/css/base.css" rel="stylesheet">..<link type="text/css" href=
"hXXp://s4.img4399.com/flashUniLogin/css/style.css?v=20121016" rel="st
ylesheet">..</head>..<body bottommargin="0" leftmargin="0"
 topmargin="0" rightmargin="0" scroll="no" oncontextmenu="return false
" ondragstart="return false" onselectstart="return false" onselect="do
cument.selection.empty()">..<p align="center" style="padding:0px
;margin:0px;">..<!--........................................--&g
t;..<div id="left_box" style="width:940px; height:590px; overflow:h
idden">..<div id="pusher" style="background-color:#F6F6F6">&l
t;/div>..<object id="flashgame" classid="clsid:D27CDB6E-AE6D
<<< skipped >>>

GET /core.php?web_id=5815340&show=line&online=1&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.wh0512.com/rq.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Thu, 04 Sep 2014 01:27:53 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Thu, 04 Sep 2014 01:27:53 GMT

Expires: Thu, 04 Sep 2014 01:42:53 GMT
2f0..!function(){var p,q,r,a=encodeURIComponent,b="5815340",c="line",d
="1",e="online_v3.php",f="z5.cnzz.com",g="1",h="pic",i="z",j="站
长统计",k=window["_CNZZDbridge_" b].bobject,l="http:
",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push(
"h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===
m&&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.cre
ateScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.p
hp?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.c
om/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'>
;<img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<
;a href='" q "' target=_blank title='" j "'>" j "</a>",k.crea
teIcon([p])))}();..0..HTTP/1.1 200 OK..Server: Tengine..Date: Thu, 04 
Sep 2014 01:27:53 GMT..Content-Type: application/javascript..Transfer-
Encoding: chunked..Connection: keep-alive..Last-Modified: Thu, 04 Sep 
2014 01:27:53 GMT..Expires: Thu, 04 Sep 2014 01:42:53 GMT..2f0..!funct
ion(){var p,q,r,a=encodeURIComponent,b="5815340",c="line",d="1",e="onl
ine_v3.php",f="z5.cnzz.com",g="1",h="pic",i="z",j="站长
2479;计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l
 "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.p
ush("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.callRe
quest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScriptIc
on(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_
<<< skipped >>>

GET /core.php?web_id=30039538&t=q HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

Cookie: cna=Gq6ODEoRhRUCASU5EL0s8UhE

HTTP/1.1 200 OK

Server: Tengine

Date: Thu, 04 Sep 2014 01:28:06 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Thu, 04 Sep 2014 01:28:06 GMT

Expires: Thu, 04 Sep 2014 01:43:06 GMT
2ef..!function(){var p,q,r,a=encodeURIComponent,b="30039538",c="",d=""
,e="online_v3.php",f="hqs10.cnzz.com",g="",h="text",i="q",j="全&
#26223;统计",k=window["_CNZZDbridge_" b].bobject,l="http:"
,m="1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("
h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m
&&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.crea
teScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.ph
p?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.co
m/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'>
<img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<
a href='" q "' target=_blank title='" j "'>" j "</a>",k.creat
eIcon([p])))}();..0..HTTP/1.1 200 OK..Server: Tengine..Date: Thu, 04 S
ep 2014 01:28:06 GMT..Content-Type: application/javascript..Transfer-E
ncoding: chunked..Connection: keep-alive..Last-Modified: Thu, 04 Sep 2
014 01:28:06 GMT..Expires: Thu, 04 Sep 2014 01:43:06 GMT..2ef..!functi
on(){var p,q,r,a=encodeURIComponent,b="30039538",c="",d="",e="online_v
3.php",f="hqs10.cnzz.com",g="",h="text",i="q",j="全景ń
79;计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="1",n=l "
//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.pus
h("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.callRequ
est([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScriptIcon
(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id
<<< skipped >>>

GET /core.php?web_id=4073713&show=pic&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

Cookie: cna=Gq6ODEoRhRUCASU5EL0s8UhE

HTTP/1.1 200 OK

Server: Tengine

Date: Thu, 04 Sep 2014 01:28:07 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Thu, 04 Sep 2014 01:28:07 GMT

Expires: Thu, 04 Sep 2014 01:43:07 GMT
2f0..!function(){var p,q,r,a=encodeURIComponent,b="4073713",c="pic",d=
"",e="online_v3.php",f="zs25.cnzz.com",g="1",h="pic",i="z",j="站
长统计",k=window["_CNZZDbridge_" b].bobject,l="http:
",m="1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push(
"h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===
m&&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.cre
ateScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.p
hp?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.c
om/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'>
;<img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<
;a href='" q "' target=_blank title='" j "'>" j "</a>",k.crea
teIcon([p])))}();..0..HTTP/1.1 200 OK..Server: Tengine..Date: Thu, 04 
Sep 2014 01:28:07 GMT..Content-Type: application/javascript..Transfer-
Encoding: chunked..Connection: keep-alive..Last-Modified: Thu, 04 Sep 
2014 01:28:07 GMT..Expires: Thu, 04 Sep 2014 01:43:07 GMT..2f0..!funct
ion(){var p,q,r,a=encodeURIComponent,b="4073713",c="pic",d="",e="onlin
e_v3.php",f="zs25.cnzz.com",g="1",h="pic",i="z",j="站长
2479;计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="1",n=l
 "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.p
ush("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.callRe
quest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScriptIc
on(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_
<<< skipped >>>

GET /stat.php?id=4073713&web_id=4073713&show=pic HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s25.cnzz.com

Connection: Keep-Alive

Cookie: cna=Gq6ODEoRhRUCASU5EL0s8UhE

HTTP/1.1 200 OK

Server: Tengine

Date: Thu, 04 Sep 2014 01:28:06 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Thu, 04 Sep 2014 01:28:06 GMT

Expires: Thu, 04 Sep 2014 02:58:06 GMT
1f7a..(function(){function l(){this.c="4073713";this.O="z";this.K="pic
";this.H="";this.J="";this.o="1409794086";this.M="zs25.cnzz.com";this.
I="";this.q="CNZZDATA" this.c;this.p="_CNZZDbridge_" this.c;this.C="_c
nzz_CV" this.c;this.s="0";this.v={};this.a={};this.ia()}function g(a,c
){try{var b=[];b.push("siteid=4073713");.b.push("name=" f(a.name));b.p
ush("msg=" f(a.message));b.push("r=" f(h.referrer));b.push("page=" f(d
.location.href));b.push("agent=" f(d.navigator.userAgent));b.push("ex=
" f(c));b.push("rnd=" Math.floor(2147483648*Math.random()));(new Image
).src="hXXp://jserr.cnzz.com/log.php?" b.join("&")}catch(e){}}var h=do
cument,d=window,f=encodeURIComponent,k=decodeURIComponent,p=unescape,q
=escape;l.prototype={ia:function(){try{this.R(),this.G(),this.fa(),thi
s.D(),this.l(),this.da(),this.ca(),this.ga(),this.i(),.this.ba(),this.
ea(),this.ha(),this.$(),this.Y(),this.aa(),this.na(),d[this.p]=d[this.
p]||{},this.Z("_cnzz_CV")}catch(a){g(a,"i failed")}},la:function(){try
{var a=this;d._czc={push:function(){return a.w.apply(a,arguments)}}}ca
tch(c){g(c,"oP failed")}},Y:function(){try{var a=d._czc;if("[object Ar
ray]"==={}.toString.call(a))for(var c=0;c<a.length;c  ){var b=a[c];
switch(b[0]){case "_setAccount":d._cz_account="[object String]"==={}.t
oString.call(b[1])?b[1]:String(b[1]);break;case "_setAutoPageview":"bo
olean"===.typeof b[1]&&(d._cz_autoPageview=b[1])}}}catch(e){g(e,"cS fa
iled")}},na:function(){try{if("undefined"===typeof d._cz_account||d._c
z_account===this.c){d._cz_account=this.c;if("[object Array]"==={}.
<<< skipped >>>

GET /blog/static/215741063201301204752584/ HTTP/1.1

Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: hXXp://xiaoyaoqq124311609.blog.163.com/blog/static/215741063201301204752584/

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: xiaoyaoqq124311609.blog.163.com

Cache-Control: no-cache

Cookie: NTESBLOGSI=7AC45CD3BEB676345F10B7B89A237F60.blog112-8010; usertrack=ezq0d1QHwA 043t4Dhj2Ag==

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 04 Sep 2014 01:27:53 GMT

Content-Type: text/html;charset=GBK

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding
b21..  <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "ht
tp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..  <html xmlns
="hXXp://VVV.w3.org/1999/xhtml" xml:lang="zh" lang="zh">..  <hea
d>..    <meta http-equiv="X-UA-Compatible" content="IE=7" />.
.    <meta http-equiv="content-type" content="text/html;charset=gbk
"/>..    <meta http-equiv="content-style-type" content="text/css
"/>..    <meta http-equiv="content-script-type" content="text/ja
vascript"/>..    <meta name="version" content="neblog-1.0"/>.
.    <script type="text/javascript">..      ..      ..      docu
ment.uniqueID!=document.uniqueID&&!!location.hash&&(location.hash=loca
tion.hash); ..      document.domain = location.hostname.replace(/^.*\.
([\w] \.[\w] )$/,'$1');..      window.focus();..      window.getMusicT
imeStamp=function(){return 'aedd3ce4015f4819306338856d82e1dc';};..    
</script>..<title>............ - wangzihongz...... - .....
...</title>..<meta name="author" content="xiaoyaoqq124311609,
wangzihongz"/>..<meta name="keywords" content="............,....
,wangzihongz,..........,........,....,blog"/>..<meta name="descr
iption" content="............,wangzihongz..........,........,"/>..&
lt;meta name="robots" content="noindex">..  <script type="text/j
avascript">..    (function(){..     var R=24,C=11,a=[];..     for(v
ar i=0;i<C;i  )for(var j=0;j<R;a.push('.icn0-' i j '{background-
position:' (i>0?('-' i*40 'px'):'0') ' ' (j>0?('-' j*20 'px'
<<< skipped >>>

GET /xml.php?ran=3799.88020285964&gameid=100015389&url=http://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.htm HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/v134main.swf/[[DYNAMIC]]/2

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.api.4399.com

Connection: Keep-Alive

Cookie: _4399stats_vid=14097941234975701

HTTP/1.1 200 OK

Date: Thu, 04 Sep 2014 01:28:08 GMT

Server: Apache/2.4.7 (Unix)

Content-Length: 664

Connection: close

Content-Type: text/xml; charset=utf-8
<?xml version="1.0" encoding="UTF-8" ?>.<config><entry 
id="62872" category="brand" time2skip="12"><item src="hXXp://cb.
baidu.com/ecom?di=62872&tm=BAIDU_CLB_XML&asp_url=4399.com&
return_type=1" click_base="hXXp://stat.api.flashgame163.com/brand.php?
url=" /></entry><entry id="999" category="baidu" time2skip
="12" channel="417" pubid="www4399com_tp_cpr" /><entry id="999" 
category="google" time2skip="12" channel="0000000398,game398" pubid="c
a-games-pub-9606551472994074" /><entry id="999" category="combra
nd" time2skip="12" width="640" height="640"><item src="hXXp://cd
n.comment.4399pk.com/control/4399.swf" link="" bgcolor="0xb5e9f9" />
;</entry></config>..

GET /upload_pic/2014/6/6/4399_16460972266.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga2.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 18 Jun 2014 14:27:49 GMT

Cache-Control: max-age=31536000

Content-Length: 3282

Content-Type: image/jpeg

Last-Modified: Fri, 06 Jun 2014 08:51:11 GMT

Accept-Ranges: bytes

ETag: "e82712776481cf1:34b"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 jszjsx58:8080 (Cdn Cache Server V2.0), 1.1 zjjhdx39:8107 (Cdn Cache Server V2.0), 1.1 fra73:6 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......<.....)hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c060 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xm
pMM:InstanceID="xmp.iid:4E4F51D9ED5511E393B0E4EAB452DFBD" xmpMM:Docume
ntID="xmp.did:4E4F51DAED5511E393B0E4EAB452DFBD"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:4E4F51D7ED5511E393B0E4EAB452DFBD" stRef:
documentID="xmp.did:4E4F51D8ED5511E393B0E4EAB452DFBD"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.....................*.D..............................................
..........................................!12..Qa"3..A45.Bb#6.R..q..r.
.ScsDt.....................1.!A...q2Qa..."........Br34.............?.-
...x...8.1......tL.....~?.U..yi.$....q....:...=.MMj:=.U..l!$..<g.5.
....E^.....s.:...z.H^.J.6...WhWh.#[email protected]......{....$
31\o.p...Z........Y.$..!G.$......E..1Kg`..E...X....v{E.m.y...K,$Fl.r*8
.v..U.r.........~..1G............d.k..[}. ...;.....>.(..9.=.R..
<<< skipped >>>

GET /9.gif?abc=1&rnd=851777303 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.wh0512.com/rq.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Thu, 04 Sep 2014 01:27:54 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=Gq6ODEoRhRUCASU5EL0s8UhE; expires=Sun, 01-Sep-24 01:27:54 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=ae2ab125; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=1df193ed24097c2e2d101fbb_1409794074; expires=Sun, 01-Sep-24 01:27:54 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=Gq6ODEoRhRUCASU5EL0s8UhE

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Thu, 04 Sep 2014 01:27:54 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=Gq6ODEoRhR
UCASU5EL0s8UhE; expires=Sun, 01-Sep-24 01:27:54 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=ae2ab125; path=/; domain=.cnzz.mmstat.com..
Set-Cookie: atpsida=1df193ed24097c2e2d101fbb_1409794074; expires=Sun, 
01-Sep-24 01:27:54 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt
p://pcookie.cnzz.com/app.gif?&cna=Gq6ODEoRhRUCASU5EL0s8UhE..Expires: T
hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach
e..GIF89a.............!.......,...........L..;..

GET /online/online_v3.php?id=5815340&h=z5.cnzz.com&on=1&s=line HTTP/1.1

Accept: */*

Referer: hXXp://VVV.wh0512.com/rq.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: online.cnzz.com

Connection: Keep-Alive

HTTP/1.0 200 OK

Server: Tengine

Date: Thu, 04 Sep 2014 01:22:18 GMT

Content-Type: text/html

Last-Modified: Thu, 04 Sep 2014 01:22:18 GMT

Expires: Thu, 04 Sep 2014 01:37:18 GMT

Age: 336

Content-Length: 821

X-Cache: HIT from online.cnzz.com

Via: 1.0 online.cnzz.com:80 (squid/2.6.STABLE23)

Connection: keep-alive
var node=document.getElementById('cnzz_stat_icon_' 5815340);..if(node)
{..    node.innerHTML="<a href=hXXp://VVV.cnzz.com/stat/website.php
?web_id=5815340 target=_blank>............</a><a href=http
://VVV.cnzz.com/stat/website.php?web_id=5815340 target=_blank> |  .
.....IP[493] | ......PV[1316] | ......IP[5630] |  ......PV[17311] | &l
t;a href=hXXp://VVV.cnzz.com/stat/website.php?web_id=5815340&method=on
line target=_blank>............[42]</a>";..}else{..    docume
nt.write("<a href=hXXp://VVV.cnzz.com/stat/website.php?web_id=58153
40 target=_blank>............</a><a href=hXXp://VVV.cnzz.c
om/stat/website.php?web_id=5815340 target=_blank> |  ......IP[493] 
| ......PV[1316] | ......IP[5630] |  ......PV[17311] | <a href=http
://VVV.cnzz.com/stat/website.php?web_id=5815340&method=online target=_
blank>............[42]</a>");..}HTTP/1.0 200 OK..Server: Teng
ine..Date: Thu, 04 Sep 2014 01:22:18 GMT..Content-Type: text/html..Las
t-Modified: Thu, 04 Sep 2014 01:22:18 GMT..Expires: Thu, 04 Sep 2014 0
1:37:18 GMT..Age: 336..Content-Length: 821..X-Cache: HIT from online.c
nzz.com..Via: 1.0 online.cnzz.com:80 (squid/2.6.STABLE23)..Connection:
 keep-alive..var node=document.getElementById('cnzz_stat_icon_' 581534
0);..if(node){..    node.innerHTML="<a href=hXXp://VVV.cnzz.com/sta
t/website.php?web_id=5815340 target=_blank>............</a>&l
t;a href=hXXp://VVV.cnzz.com/stat/website.php?web_id=5815340 target=_b
lank> |  ......IP[493] | ......PV[1316] | ......IP[5630] |  ...
<<< skipped >>>

GET /static/images/is.png?cdnversion=20131219 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bdimg.share.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.0-b

Date: Thu, 04 Sep 2014 01:28:04 GMT

Content-Type: image/png

Content-Length: 12294

Connection: close

ETag: "992998015"

Last-Modified: Thu, 14 Aug 2014 04:19:55 GMT

Expires: Wed, 10 Sep 2014 07:38:58 GMT

Age: 64146

Cache-Control: max-age=604800

Accept-Ranges: bytes
.PNG........IHDR.......<.......5*....tEXtSoftware.Adobe ImageReadyq
.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xa
p/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="htt
p://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Ph
otoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:FB2478DF60B711E38EB
0C15A38F52D2D" xmpMM:DocumentID="xmp.did:FB2478E060B711E38EB0C15A38F52
D2D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FB2478DD60B71
1E38EB0C15A38F52D2D" stRef:documentID="xmp.did:FB2478DE60B711E38EB0C15
A38F52D2D"/> </rdf:Description> </rdf:RDF> </x:xmpme
ta> <?xpacket end="r"?>.Yl.....PLTE......."..j0..o...........
.hm.. ..N......k.1...P.dW.G/....D2....e..xV..0..........{..u.%y.......
.......LlG...-0\....!v............C.....q.f.....667...#..6y.Kl.....p.X
...............OM.30..........Y............oo."......q..........T5....
......Ug..... .....4d.......Z.?.WW-..4.L7..B........Y..J.1.....ii.....
....87...c...Z.....ts2..E..T..n.i .....N._.../1.H......OM.9T.wv..&..".
..v..!..K....J.........U........B...U..................*B....E........
..........]__K........A..........Q#Y...G.......n.R..Y......R..........
.....t..W..5[.........j...........}.r..U....}......y....3r...h2p.5
<<< skipped >>>

GET /stat.htm?id=4073713&r=&lg=en-us&ntime=none&cnzz_eid=916211647-1409794086-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=485620972 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: zs25.cnzz.com

Connection: Keep-Alive

Cookie: cna=Gq6ODEoRhRUCASU5EL0s8UhE

HTTP/1.1 200 OK

Server: Tengine/1.4.1

Date: Thu, 04 Sep 2014 01:28:08 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Tue, 28 May 2013 02:57:17 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /media/v1/0f000QumSmNHL3kKP0qi86.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ubmcmm.baidustatic.com/media/v1/0f000KfF7ujTofNDHryXj6.swf?url_type=1&id_404622239=media/v1/0f000Q1BFJ3x-cEB3jw0M0.jpg&id_4046222

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ubmcmm.baidustatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.0-b

Date: Thu, 04 Sep 2014 01:28:19 GMT

Content-Type: application/x-shockwave-flash

Content-Length: 2880

Connection: close

Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT

Expires: Thu, 30 Jul 2015 02:21:23 GMT

Age: 2991188

Cache-Control: max-age=31536000

media: media
CWS.....x..W{T.W..w2..AH.#`...D1O.W....."..R...dB.y.....[j.b..>..n.
...,-km=>[......Z....k{D[....{...w.....c....3..~..~...n\`Z>.]..B
`QL..<.{....8....U..z|......X....777...t~.^o.?........".6..c....HI.
. ...;.n`.~........MO...a.......U:.z.C{i....uF..a79...d......Nr..Am...
.n&.h..C.\9.;@N...$.g.H..\M3a.-..oh.<.....q..aX7....I..Qg.{.%>.N
]f..Tg..a....;..7/.......#c..RY:.F...q7...C....z:..i.V...Ia.$K.e...Z.j
....&C6j.{.3G......t....2/.......b....=8(......o./B..Hl.bE/.3.0..G....
...^.v.t.},..8..Y`........w.w?....W....fN.]...X........j.|....1.....Q&
lt;@.eS..........".{v..od.i..|q...&gZ.x.y`NG...c..%..w.1...xZ>"..n.
..^z..c....wH. .. u.............(.:`..;Q...e.OW..=.....o7.J..T_f.....,
ab.4?.......{F..i...U?.......y..\..K..O.q.......3......J._}p......q;{N
.t..K.Kr.V.}......9g=s<89.....k.m{<ITg.KI.........f-.X..Yu...../
\<...........?Y.Q...\....U/((-..\.....L.P.e.}fY.q.........U].^G]..z
..v^5]=..;.k.96.w.|..<.{...*[email protected].....]X=....
.f..UR..o...<}..$... .Nm3M..T.J.....Co{2I2....._......|qyl....`fBOA
.....r..d.i..\...%(.z............. ...D...m.%..3O_.x\.^<.....M....?
5.ypYq.?o.g.....H........1.7....?ln .T.R..U.k.2hX{..;!yMY.~sr........R
.`.s..L....M.N.2fs.q_...|[...s.U..?..>..LK.....W...._M......B..[...
dQ...=).ksW..=...1a.i.n.7.x...;.~WS(k.-i6ynY..*.V....3..{..m}.;......U
;.w>V......%4._/....D.............o,....s.....z.Z.a..7...l_3.^nY5EW
_x#xv|.....j.~v.....Y.......b.tSPW0.R.......B....<...kI...X........
.^(y{p.d...'.MI{S/..>{~M.<.......ZF.N.8.Z{.|tK.x....../.G...
<<< skipped >>>

GET /media/v1/0f0000I41e4oSte6MNwG4s.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ubmcmm.baidustatic.com/media/v1/0f000KfF7ujTofNDHryXj6.swf?url_type=1&id_404622239=media/v1/0f000Q1BFJ3x-cEB3jw0M0.jpg&id_4046222

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ubmcmm.baidustatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.0-b

Date: Thu, 04 Sep 2014 01:28:18 GMT

Content-Type: image/jpeg

Content-Length: 10984

Connection: close

Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT

Expires: Thu, 30 Jul 2015 02:21:23 GMT

Age: 2991187

Cache-Control: max-age=31536000

media: media
......JFIF.....`.`.....C.....................................%...#... 
, #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((
((((((((((((((((((..........."........................................
C.........................!1AQ.."aq........2B..#R.br...$3cs..Í......
......................... ......................!..Q1A2a............?.
...MsJ..u....4.k.@*.&...4.S\.\.....\.3........I......3Q.om..~...1.p...
%.k\.B]...............,..9/....KT.E..X..5M.....=U........4=...E..k../.
X...;.......x. .{.X...7j...Ce^..*.."..0.(....#.>..H.4;..M..M'3....R
..=.V,.!}xA...u'M]$.....H .......\t..fK................A./].0:.e......
y.....;.......dh.../....Nd..-$m.........B...[I...:...<......^..%$.{
.*..Jx.$k.Y....$....;p.\w..R.4..H.H....^.\.=....V......1.M]....uA..O.@
/q...yL..}....9%N....NKT.u.Go*.q|...J.....#h.8P.n......:.......u...%hV
]%..f.^.P.i..[.....%.Ll.2[[email protected].~.i]bcY?.&.{ mg............
..Q..^..>.6.X..q.6....... .R..{2y.O...R.R.I;..ig-.}7.M...k..H."....
k..7}p.........<....J)H*I..:.}7..bVL.[[email protected]........<B..%....
.}~i.......#.W.m..NV.HA$...?....k..q_J.D.$.v.)..9.#CP.......n.W..'..ei
Ne%@...*..R..s.,.sT.m.KO. ....ra.s..QA.z.}[email protected]}....] #..>uI.J.."u
..<..S9.<...H...X..h.....d..&<...W.<.....J..........P..:.R
V...:-VBns.\%.... R..Tt.z..iH......>.)js*@O.mK\N.iia..M).."3B....I.
:HP'...QV.XQ.w.s.............'` ....FQ.f...%D...Q.:.....)%..BN.j.n.Sd.
*...Ze)9..'.....V....iF...]<.."9E(..5.S...*...I....jp8.7..g...^.:z.
4.B..:..!......<5.?.$! O...7.....^.uZ.....W.I...I.3..4.yP.C....
<<< skipped >>>

GET /static/js/shell_v2.js?t=4 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bdimg.share.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.0-b

Date: Thu, 04 Sep 2014 01:28:00 GMT

Content-Type: text/javascript

Content-Length: 571

Connection: close

ETag: "119228190"

Last-Modified: Wed, 03 Sep 2014 08:40:41 GMT

Expires: Thu, 17 Jul 2014 19:37:19 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip
...........SQk.0.. ...D..n...3...A..Z.RJQ..."[F.x...}..7i;..........s 
.d..J. ;..].........I...........n..%.d......|.SVn*.1.k.H[5.......{....
..%e=..]H..P....k..jpl..]#[email protected].#.=....7.....B."..l-B6...6L..^&`.".
....!.....j59.A...VVm..w.Yc(1.F.z)P...u.p.........R..(..R..0;..~..P...
.B..?%..#.aDY...2;!@...[9...`...........}[email protected].. ,]p.d.|...
..K........(nE..B..G...5.Z.\4..*/.Qt1.1l..c]O..w.k..{..7a..`..... ....
...0R..aL[4...k[..........H...U.}.^..6<....i.<.........>[email protected].
.Xr....=e.....a...V..7E.J.VO...(.....'..~.?&}....|.._._.1._...H....i&l
t;N.uP......`.o...;o.....

GET /css/zmxy3_20140808.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Wed, 03 Dec 2014 00:33:31 GMT

Date: Thu, 04 Sep 2014 00:33:31 GMT

Server: nginx

Content-Type: text/css

Last-Modified: Fri, 08 Aug 2014 09:46:42 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=7776000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 shjc71:88 (Cdn Cache Server V2.0), 1.1 fra73:2 (Cdn Cache Server V2.0)

Connection: keep-alive
161a.............]...Hr>{.y......V.I....../.....(.R.Z"5.k....R.|...
`.W...=._dF22I.uW...0#....... .......W...,.&...........?G.*........?.4
 ......&I..r..v_.w............O.w...Y6......b.....}U.&..OOO7..x|3/...M
v...n.......sw..I.....lu.Z/....].Uw.......O.^<X.U.......>..e1)."
.m....|/7...q.7n&...f]....u..W.b.....b]....^n>F....f..Y....z....W..
.Y.'8....&..5.=...=C.,Ix...|....}.a.....}.?U...i...'I....}.^.W.....$i.
.......e.:..I..*?......GO../Q..w.B.k.).&..."/....a...r....r...S...)S(.
...D..,.^C.n.a...".B..c.\..e.U..dW....}.!..f0[.7.Dd..../.&.|Yy0....zU.
k.|.3I......p8..#p..{..P...%>,24!.........#6.!..$...("....^'e....&{
..6......;&x..`........A.o..e7E...,>.?L....6.H....."k^>.2g...,LT
(.....%....>.V..r...N.Ym..,.......R-....E......uB...&0.ce{.*'.8\h..
.;..I...fUNg...........>kW[{'....$.1..}...Cy.~.]n*..:.-.~.......r_e
.oG7D.t...p......G.f l.....n.v.?D...g..&...*..5...N`.r.N.m.X....QI..z.
.R..m],E..n...c...Z...jZ..:.y~..c!.m.}.....`G."...r8.r.........).@..&g
t;d. #..C..%0iMal%e.>..`..u.;....5vH/W!.`...vkX...Q...e...q._....V.
.6...h.n[#Pkm)......w7...AFZS.....cv. ...A=...@Cn;..............F...*.
.....OgU!~>..:.i/.%.J.........bMa0..W...g.V...(.....@9..\c{f.x....0
..&M/.Z.1$...E,..&...(C......8#..S...x ..9........t.Pmf.....o...L...QM
......~.u...%.........=Z..r. [.$.........L..h~A.....P...A.~]......py.g
;q....m\ ....v....../.........i..q=v...9......t[>.r....2.rC...kKA..
..g .%...9.uW..R.....Ye3w[^,.g......2u..w...|*....}|..>e..K...O..._
(}.g....|..o.S...6Y..}[=..U-.G...}*[email protected].....
<<< skipped >>>

GET /jss/jquery-1.2.1.pack.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 22:58:10 GMT

Date: Wed, 03 Sep 2014 22:58:10 GMT

Server: nginx

Content-Type: application/x-javascript

Last-Modified: Sun, 10 Nov 2013 09:24:37 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=7776000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 shjc71:8080 (Cdn Cache Server V2.0), 1.1 fra77:5 (Cdn Cache Server V2.0)

Connection: keep-alive
39f2..............y_.J......h.$R,.......B....d;@..E6f..m..b^...U.@..{.
.9cI.^..k.j....JOJ'....g)..(....gW....Y.m.Gk......R......A.xZ.;A)Y\\*.
...K...._.O....3:.T..e..t6.d.I.-]....4=.J[..%......k..................
o/g.L...?^..Y. ._l...RRiV..b.4.X]\,.{...D.^va..........f.R.U.y.....3.w
9.L.......Nx.f.8.....Np3......y.Z}.......$..N..B ....w..?[..Jmuo:...Qo
<:.y....u3.SN.A..MG.._........=~.....V'...-..}..\...h8?.....G..A.(.
u.r....... Q...h....W......oW:i|.r.3...."...b..|..k..>......l..... 
.. .#..[.....n.~|^Z.K..^.^.J.V.Kki...........F.^Z.,.....{ j.<....u.
...W.. 4....L...|{z....G...$(?...=;z.G.............t-.<Ooj..o.N..nX
.<..z....oy..z.<...=....?z.....v..d&z.:tU}......V....~.*{T...e;.
.Q...V..d.(..n........J=z.. ...m.....r.(....)[email protected].^..4.#
uLOQ....b...x....T.....8...=...O..b...n(..=Z..c:.s..mX.4=c~/\...l..w..
..b......R M?.Z.z.....n.d.^.-.b...._.:..o....R._\._.,Q...._.2..P.TP.Z.
^/ . ...w>..............n...........X..=..g..|ai...>..Y.dy... Q.
[email protected].........{[email protected]....
]... ..g.xm.=z...AW.B5...1...Z..LS......]..(...rb.`...K..i9u.1.....f..
A.....iz.....a...k.'$D.. ._j..a.z.b...z.W..> v..R]..uk....[V....7..
.....k...b...[..}E.qX......n.3I.EL,...O....]-.o.`...........D3....-...
......Q..j'..jW........X,3..I..=..........E.G.._8.V~vT...(..0..Q...(..
g.1.V..J5...K.6..i......K. .K."6.Q....a.K.....{O. .n..nY..........u.~.
[email protected].%;^."vh9v.......$.{~.`... [email protected]}.F..i.
...:...o.....,J[..O.uAM$`...p..][email protected][s..V....:
<<< skipped >>>

GET /jss/trace_news.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 22:59:50 GMT

Date: Wed, 03 Sep 2014 22:59:50 GMT

Server: nginx

Content-Type: application/x-javascript

Content-Length: 559

Last-Modified: Wed, 26 Feb 2014 01:36:00 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 hzsx166:8080 (Cdn Cache Server V2.0), 1.1 fra73:3 (Cdn Cache Server V2.0)

Connection: keep-alive
function tracking(e){...e = e ? e : window.event;...var s = e.srcEleme
nt ? e.srcElement : e.target;...var a = s.tagName;..//.var u = s.href;
..        var u = s.href ? s.href : s.src;...var t = s.innerText ? s.i
nnerText : s.textContent;..    if (a == "B"||a == "STRONG"){..        
a = "A";....u = s.parentNode.href;..    }...if (a == "IMG"){....t = u;
....u = s.parentNode.href;...}...if(a == "A" || a == "IMG"){....try{..
...new Image().src = "hXXp://tracenews.5054399.com/trace.js?addd=" a "
&uddd=" escape(u) "&tddd=" t;....}catch(ex){}...}...return true;..}..H
TTP/1.1 200 OK..Expires: Tue, 02 Dec 2014 22:59:50 GMT..Date: Wed, 03 
Sep 2014 22:59:50 GMT..Server: nginx..Content-Type: application/x-java
script..Content-Length: 559..Last-Modified: Wed, 26 Feb 2014 01:36:00 
GMT..Cache-Control: max-age=7776000..Accept-Ranges: bytes..Age: 1..X-V
ia: 1.1 hzsx166:8080 (Cdn Cache Server V2.0), 1.1 fra73:3 (Cdn Cache S
erver V2.0)..Connection: keep-alive..function tracking(e){...e = e ? e
 : window.event;...var s = e.srcElement ? e.srcElement : e.target;...v
ar a = s.tagName;..//.var u = s.href;..        var u = s.href ? s.href
 : s.src;...var t = s.innerText ? s.innerText : s.textContent;..    if
 (a == "B"||a == "STRONG"){..        a = "A";....u = s.parentNode.href
;..    }...if (a == "IMG"){....t = u;....u = s.parentNode.href;...}...
if(a == "A" || a == "IMG"){....try{.....new Image().src = "hXXp://trac
enews.5054399.com/trace.js?addd=" a "&uddd=" escape(u) "&tddd=" t;....
}catch(ex){}...}...return true;..}......
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/logo.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:47 GMT

Date: Wed, 03 Sep 2014 23:27:47 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2503

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 hzsx166:88 (Cdn Cache Server V2.0), 1.1 fra73:6 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89az....................,...M.............Y......R..2..:..I........
.R.....f......wC..Z...R ............................r(.....<..0..2.
...c.z........=...n%Z..A....n.O...|.......R...k..Mv...s2.`..q=..j....i
"n...u'........5^.......b...........D.c,........M........d............
.l;.f#..3..B........c^.......w.......~-..W....K...b.z-....uC..K..D.K..
....]....m'.....].......e6.|;......y.....e...w*.....C.e1.E..^......k..
..z0.....z..{..\.[.....E..j$.e&....o.....M...5..9.v....n....1..6._..Y.
<...K.,....s.J.6.....$..0..8..(..4..&..2..:..*.........M.b.....g...
.h.......P....t.....j..b..>...........F..v..I..w.....6...x...q._-.G
..\..B..N..[..p?.p,.t)k....~.h:...L..P............o"..a..ia...k,.{H.f9
..e..f.I..e(.C......N........r.g...p.}*..V.}S..D.|*.},.x .............
yH....p..l...t......!.......,....z..............8..}P......#J.H1b.*...
..q.G......1cG.....F.[<M0c..I....5.. qR...'M...S.O.........'..]....
..'6i... ..E.rE.E,W....4. .Q.p.....`......A(..*..,B./Z..=..Y|......iY\
...[=...6.2.v7.5....i-.......P..p.....l......../..... .A.D.. .Wd^"..P.
 p....r.o....?C.........C..4.'.....\e..*#/....... k^...K}..a.-u.......
....c.......^ A..&T.!......X1!..'....&!.......P..A.V8.....y..?.xR..B..
K.H"Id....d.Vx.GA.x".O.....&..%...(.?Jx.C-h.)@Fu...I..........L.t.._~.
...E.J..... n...I.H#. .8...cT:.l&...  ."M...1RAb.c.!..A..~..MAv..H....
J....A.AP.c.....DFa.qH...S ..x.....QP#.......Z.]v..CA ... ......x..)..
.......%$.[o...4....a/.3.<..#.Z.=...hA8 .W..........3.-0.(....(..3.
(..d.(....(.4.@#..\W....A..$...'..H$..(PA.<...G....xH\..H#...-.
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/go_bbs.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:47 GMT

Date: Wed, 03 Sep 2014 23:27:47 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 4339

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shjc71:88 (Cdn Cache Server V2.0), 1.1 fra73:0 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a...........l......[......[Y.S/...8...z.u.6.-Z)..M..-7b2`......e$
..a..................pL...........V......*..ri.d..G..l....D."s...K...M
i..J...............}.z).....U........j.s..r)..H.....E...o3.........8..
Y.wm..R7X.UzR.....3.....|.....D...KrF...nP4o."..<.q.5#.7J.....*....
...........0...zd...)... ....E"H...A........Q.....6..M.. .......|..:..
...F.YH/QvKQ<..Q&...g{......"..!.......)...........>...<.d.$S
....ia...=FnCAi:..#.....Ec._..0.yAs.o...yi'.v.G...m.j\L........]}s..&l
t;.........^..I.E...2....."...ybQ...].Y........ ..5.|a.....%.y...%....
V.......QLG..$... Q......,..&.....B..2.sB..S..[.P .....3.c.n.j........
T..K..I..5.....P.................R.. ...>_..{.:h=..C..[..i...<=B
..."E.....................S..............g..n..w.....E..K........?..L.
...|......]..`@'...c..QA0...i...!.......,............S.p.'B.~..M.r....
..J.H.....3j......sHe.$P .88<[email protected].;.=.
B...9;..3......`.<0I_$L....K....h..].......E.....~..y..'VV.1{L...L.
d..)^......#K.L........p&..|.vh.........B!. a0O.%../....s............[
..8.:..0I..0..Q......`..C1.........O......._.>|>`...0.z..<..4
......S... ..a`.......L0...ur`..M......O>.".a'.f....,8@'(j8..,.. ..
.....j.`....#..n....N0G?#...&`4G./a....$xBB......`L!O"x..e..(3.......;
x...3..f-h.0.._6...At2.........p...x......E.(v2...F*.......(D.C....&..
(..|m..F/r.Y..3....E..A'....M.....0........H;6..K.4..F$.p9..ADa.-*Da.-
.,..-V....;.a...X....*c..D.....Xa..3.....X....X...vx.....l...C..-DD...
..A..Q(.....2.......C...5..a..v..2...`k2..CC".4`.68...6...E*.... \
<<< skipped >>>

GET /imageyx/seer2012/hottop.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 22:58:16 GMT

Date: Wed, 03 Sep 2014 22:58:16 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 857

Last-Modified: Sat, 20 Apr 2013 02:58:00 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shjcl69:80 (Cdn Cache Server V2.0), 1.1 fra73:5 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!.......,..........6....H.........p.......H..... ^,.......j
.).c.....T......;....


GET /flashzt/img/zmxy3_20120913/zj_btn.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:48 GMT

Date: Wed, 03 Sep 2014 23:27:48 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 1226

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 hzsx166:88 (Cdn Cache Server V2.0), 1.1 fra73:2 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89ag...............................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................!.......,....g........&
gt;)P.............)>..6(....G...............(6.#;....M.............
..;#P.M7O.............7M...2O.%N............%.O2..M8. ..I........H....
.Vt.....'....8 ..(./b.8q#G. ;~...b...I.<YRc..I.8yRHB...B...3...=w.$
...E.H....4...J}.e.3D..5$..8....`.F.K.l..b..%.Vm..c.[.. .m]..L..Y.G.".
4..L8......Q\.0c... N<y.d...g......=.. r......hT].u...]...;....s.d=
[....S.`P.....H,(R......D."}....._..}:u...{..={.....(..D...\PP....(...
........g_.r.._.........`..P.........,....^[email protected].!. ....%.xb.)...\#..b
. .....P.^!....... .......D&....J".$.L.iQ.NVY..Q.)..CB.@..\PH..,!..B..
f.Q....B..'.k.I'...i..s....t.)(......E..B.<.p...FjQ..\.i..b:...b.).
.V...rqz...Fz..<4.B!.4....0a..............{...4...4. ........F ...V
[email protected].............. o..*...............,....l...'..._.
[email protected].....'..g....w... ..2......A..C......0..C."...;....
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/bg_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:48 GMT

Date: Wed, 03 Sep 2014 23:27:48 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 791

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shjc71:88 (Cdn Cache Server V2.0), 1.1 fra77:1 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a..9.............................................................
......................................................................
.................................................................!....
...,[email protected]:...tJ.Z...v..z...xL.....z.n..G.gC.(...~...
.....................................{................................
............. ............F....................................H......
.L......#n[(.....3j.Dq... C.t.q...(S..Wr...0c.\7m...8s.l.r....@...)...
.H..M.......B.J...aR.j...k..^...Kv...h...zv...p...K..].s....7b.......w
......N...cj..K.LYW...3k.uy....#[email protected].^.95......M.v...s...{...c{..
N.......=.......K..2:...?Z...........}......_........{/..}k.....,?....
._.......&..'.........0.Vh!/[email protected]...`p..p.(..4.h..8
....<[email protected]..;....


GET /flashzt/img/zmxy3_20120913/bg_5_20130716.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:49 GMT

Date: Wed, 03 Sep 2014 23:27:49 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2042

Last-Modified: Tue, 16 Jul 2013 01:47:34 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shjc71:88 (Cdn Cache Server V2.0), 1.1 fra73:5 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a..C.............................................................
................................................\\\...................
.................................................................!..XM
P DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &
lt;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011
 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="ht
tp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf
:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:/
/ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sT
ype/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpM
M:InstanceID="xmp.iid:74504210EDB611E2B540ACB23FF9BCD2" xmpMM:Document
ID="xmp.did:74504211EDB611E2B540ACB23FF9BCD2"> <xmpMM:DerivedFro
m stRef:instanceID="xmp.iid:7450420EEDB611E2B540ACB23FF9BCD2" stRef:do
cumentID="xmp.did:7450420FEDB611E2B540ACB23FF9BCD2"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;...................................................................
...............................................................~}|{zyx
wvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:98
76543210/.-, *)('&%$#"! .................................!.......,....
[email protected]}:......^.h..*J..m......uR.:...{O}$#..
ay...V.W.W.}..X.X.........r.....v.......|......r!..#......v.....N.....
. ......m.#... .$... #.......... ...................&..8o..y..v...
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/libg_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:49 GMT

Date: Wed, 03 Sep 2014 23:27:49 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 899

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shjc71:88 (Cdn Cache Server V2.0), 1.1 fra73:1 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89aS.:.............................................................
......k.....................................................t.........
....................q.....m.................m.................~.....{.
....q..............x..n....................~.................j........
......................................................................
...............................................!.......,....S.:.......
..7V...........AM,"...@.. W........... ..U!...9.........R... .......?#
..H......I5>.V....V.......V......V.............V.....V.....d%A....8
8..........N"?r.-...Qc...=f..R$4..Mnd.R.G.-].\.S.I..l> XR'..9}..*.$
..E..M:N_M..8>.Z.(UaV.F.8U.).H....V...f.M..v...m.A)d.....m1..K....s
...)....|..M<.-..8..sz..dPKf.D.....P...P..,..pp..!..M..kX.#....".0.
$F............^..`a...J0.(@......0.n.A.........y....H. =...0....A.....
....u...G^{*p..."`B...XpD..F(...Vh...f(..4.....L...$.h..(....,.8.%....
;....


GET /flashzt/img/zmxy3_20120913/t_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:58 GMT

Date: Wed, 03 Sep 2014 23:27:58 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 599

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 hzsx166:88 (Cdn Cache Server V2.0), 1.1 fra73:3 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a.......D..s....................!.......,...........H...0.I..8...
.`(.di.h..l..p,.tm.x..|....pH,....r.l:...tJ.Z...v..z.`. @.....z.n....|
N.....~...............................................................
......................................................................
...H...J...#&.....#J.H.....3j....... C..I....(S.\.....0c..I..M...a.i..
[email protected].*].....P.J.J....X.j......`...K....D..K.`.Z.p...K....x....
........)...... ^......#K..x0%...`.......C..M..d.....d.....c..M.6_}...
.i........N.0n..X._........>.......k....V...z.O.......EN,........w}
a.............c....h......B.&....F(.b.&..;....


GET /flashzt/img/zmxy3/bg_3.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:58 GMT

Date: Wed, 03 Sep 2014 23:27:58 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 19606

Last-Modified: Sat, 09 Mar 2013 01:57:08 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 hzsx166:88 (Cdn Cache Server V2.0), 1.1 fra73:6 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a1.......<..sN...csS...............t.&0M......y..4.........mY.
.....U..H.........Fh..."..&..9............P.......Z........un.)..*....
.).................Ua.........t"V.......X..A.........F.......e........
m..s.....*.I.z.i..3H^1.j.........C..q..............K.f................
......5d...-.....q[....p...m6....R%.............,..#)..x.K....jTx.....
..............)q.zh3H.......5..gs.............[hM0.....U........ayb...
;....P...M..<....."..M.G.........5..p..0......~.1..............H...
[email protected]; ........E..=.....x.........?I3.
.0.................?..R.................8.....`Y.....1:.........Y.....
*`....X.............................P..W............j. ..?.......=5...
.........>|[email protected].....![[email protected]....._..\....
.......O........B..?!..XMP DataXMP<?xpacket begin="..." id="W5M0MpC
ehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk
="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> 
<rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
; <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/
1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:
//ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Phot
oshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:C049D57D87B311E2B164820
45EDE6CCD" xmpMM:DocumentID="xmp.did:C049D57E87B311E2B16482045EDE6CCD"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C049D57B87B311E2B
16482045EDE6CCD" stRef:documentID="xmp.did:C049D57C87B311E2B164820
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/b_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:59 GMT

Date: Wed, 03 Sep 2014 23:27:59 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 610

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 hzsx166:80 (Cdn Cache Server V2.0), 1.1 fra77:6 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a.......D..s....................!.......,...........HJ1>..I..8
....`(.di.h..l..p,.tm.x..............r.l:...tJ.Z.._p.h<...xL.....z.
ng|.-.......~.....np.rCt...........Q.@\].............O...B..v........|
.Z.D__........&.q..............................u...........]E.u.......
.........H..A%... ......#J.H.....3j....... C..I....(S.\.....0....C^..8
[email protected].*].....P.J.J....X.j....Pi5........h..].....p...K...
.e............L........[i!.y.#K.L.....3k>.X,...C..M.....S.^......c.
.M.....s...........N...............K.N......k..........O......._......
...O.............'..(....h...&....6....F(...Vh...f....B...;....


GET /flashzt/img/zmxy3_20120913/nav_bg.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:52 GMT

Date: Wed, 03 Sep 2014 23:27:52 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 18944

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shjc71:88 (Cdn Cache Server V2.0), 1.1 fra73:5 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a..6.......7..`..\...........Y..J..Q..a..[........S..j..t........
y..`.....Iu.............\..h..m..t..q.....[..|..{.....e.....f.....C..d
..u.....~.....#.#j..d..x..............N......}${........u..U..q.......
.3..............n.....]..]..t..Z..b.....g..:...........V..:.......${..
}.....f..m.....h.. ..m..]..<...z%......C.....^.."...q ..3.l/f..R..}
.....P.....d..n..l..Q..h..R..e..p..i..t.....v.."}..u)............l..a.
.^..[.....Y...t&k..z../..,......y)D..y..j.....a..Z..I..s.....I.....K..
*.....q..h..n.....o.....?...z.W..j..=..Z.....&. .w#P.....m..H.........
..U..c..U...........R~.V........X........g..g..p..C........'..l..o..&.
.........#.."F.a...................u<...&.Hg.y.........6.T......W.m
......h..\........f..c.....M........o..k....._....................e...
.....i..w...k0...!.......,......6........B......*\......#J.H.....3j...
... C..I....(S.\..%.5.j.p.AC..7m....g..<...Jt.Q.H.&=..)..K.:..u...X
.j..5 ..^.v......h..5.6m..n......\.t.....l..Ah.....5...'F..1...#;..y..
..)k..93...Cw.......O.6.:u...c.....l..o........{....x.....O.|.s..c.j..
..z..M..];....w..........7.>}.........|....................."h`....
...6....VH...fh...n.a. B....YW.4...".*.... ....0.hc.8....;....>....
@.)d.H....L&...NF...OV)..T^.e.\b..._v...b....d.if.l....jz...|.2.5.XcM6
.H......g....g6..I(...*(....'...*.....i..*....BZ(..~.i....i....(..^...
..vJ....*....:k...j)........J,....l.......&.....k....[.....,..N.m..R{-
..r.m...k....................n...[n....o... ....Kp..4....0.B5.l.1.....
...,..$..r.,..../....2....4.ls.<[email protected]'m..H/.t.P3-..SG
<<< skipped >>>

GET /flashzt/img/zmxy3/bg_7.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:52 GMT

Date: Wed, 03 Sep 2014 23:27:52 GMT

Server: nginx

Content-Type: image/png

Content-Length: 6652

Last-Modified: Fri, 14 Jun 2013 09:48:10 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 hzsx166:80 (Cdn Cache Server V2.0), 1.1 fra77:1 (Cdn Cache Server V2.0)

Connection: keep-alive
.PNG........IHDR.......I.....g.......tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:5A051F80D4D211E29B0DCD53E3
B7DEE5" xmpMM:DocumentID="xmp.did:5A051F81D4D211E29B0DCD53E3B7DEE5">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5A051F7ED4D211E29B0D
CD53E3B7DEE5" stRef:documentID="xmp.did:5A051F7FD4D211E29B0DCD53E3B7DE
E5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.^q....;PLTE............j...N..$#.Z..a4V.....
.........d'.:y........b/.D?...........pZ....{.z1...........T..l.cS...l
.S...........KZ.....1...f...s..,...Q.......n..5yE.......6.<u..L.G..
.{.cg...K.Y.H.......qV..l.....R.....Ro...................n............
...........P..3.....,..C.........x.................o.....@...~s.......
......[.....itRNS.....................................................
.....................................................7f.....IDATx....[
.F..%.m'....o..`cl.}ih......6I&.........;...`..;3....y..\....WI..?Q.K.
.^..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^.
<<< skipped >>>

GET /flashzt/img/zmxy3/n_mg_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:53 GMT

Date: Wed, 03 Sep 2014 23:27:53 GMT

Server: nginx

Content-Type: image/png

Content-Length: 1920

Last-Modified: Fri, 14 Jun 2013 09:48:10 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 hzsx166:88 (Cdn Cache Server V2.0), 1.1 fra73:5 (Cdn Cache Server V2.0)

Connection: keep-alive
.PNG........IHDR.......f.......|7....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:1D872F76D4D111E292D2D069A2
92083F" xmpMM:DocumentID="xmp.did:1D872F77D4D111E292D2D069A292083F">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1D872F74D4D111E292D2
D069A292083F" stRef:documentID="xmp.did:1D872F75D4D111E292D2D069A29208
3F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>_t.8....PLTE......y..G..<..;.....`..b.....
t.....}..g..d..c..{..a........~..u..e..p..j..l..k..o..i..r..n..m..w...
..x..>..?.....s..v..|[email protected]..=..[..F..V..Z..C.
.U..R..K..N..L..M.....C..D..?..B........E..Y..S..A..X.._..T..Q..P..^..
W..A..:..J..M..f..\..=..a..]..}..:..9.................f..2..q..d......
..c..j.....*..{..e..<..v..z..^..E..`.....^.....K..x.....d.....a....
....-..h..|..`..l.....1..k.....................LIDATx....VZQ.E.#I.`.D.
 *M.4..$.w......^.y..u_c~o0....X.q...A..`.h....9.;_.2.;..g..[.@[e...[.
.Z.........OS..B.,...3}.b*U...........C.n|HF.I$7..I..5H.J......R.M
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/c_2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:53 GMT

Date: Wed, 03 Sep 2014 23:27:53 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 70

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shjc71:88 (Cdn Cache Server V2.0), 1.1 fra77:4 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89am......j.....!.......,....m......D.................H........P..;
....


GET /flashzt/img/zmxy3_20120913/ico_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:53 GMT

Date: Wed, 03 Sep 2014 23:27:53 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 44

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shjcl68:8080 (Cdn Cache Server V2.0), 1.1 fra77:2 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a........@m...!.......,...............;....


GET /flashzt/img/zmxy3_20120913/c_3.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:53 GMT

Date: Wed, 03 Sep 2014 23:27:53 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 84

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shjcl68:80 (Cdn Cache Server V2.0), 1.1 fra73:6 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a\......j.....!.......,....\..... D.............{...H......&a...L
.............;....


GET /flashzt/img/zmxy3_20120913/more_boss.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:51 GMT

Date: Wed, 03 Sep 2014 23:27:51 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 3077

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 hzsx166:88 (Cdn Cache Server V2.0), 1.1 fra77:6 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a..*....^..D..D..B..J..Y..X..K..L..T..U..P..M..W..Q..O..U..N..M..
S..V..R...................................{....................}......
...........|..e....................Y..............~...........`..W....
..........V.....z..]..|..w.....a.....d..h..^.....k..g.....r........Y..
......u..Z..........................|..............m..b.....l........y
........o.....j........g...........l.....p..a.....s..q...........\..v.
....T........c....._........|..w...........z...........f........^..d..
r........o..X...........`........q.....f.....u..M..x........p..O......
..i.....t..G..[..]..F..\..I..F..\..^..E..`..C.._..Z..H................
......................................................................
......................................................................
...........!.......,......*......%.4H.....*\......#J.H........$0... C.
.I..I;.J.1.....0c..I....8s...s..L.z..J....HY.......P.J.J....X.j....U&l
t;....K....h..].....p...E....x............L...... ^......#K.L......i..
.....C..M.....S........c..M.....s....7.c....N...... _.......K.N.......
......h....N~..Jb.._.......[....-4..{.T).w...(...Z......E2.$h...E(a2&8
. #.f.........\........8.h..,..C2..."..4`..8....a....'...... .. $s..L6
.$.E.........T..d.a.(..f.xB...`..c.y&...iF2.4`../....x.)$.|....~.8..-t
....$s(....D2...g.'....8.....&*.....'.xR.'..J.i..FX)..v..*...A...P`...
l...-....2.!l.P2!...4....>k`..R...J8i...:....:....B`[email protected]...?4.
.@[email protected].. P.Tl...#@........T8...J<.p..F... .,r.P.l2.
.$.... ...Pn.../.a.......!..n.#...... 2..( [email protected]
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/bg_8.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:53 GMT

Date: Wed, 03 Sep 2014 23:27:53 GMT

Server: nginx

Content-Type: image/png

Content-Length: 9570

Last-Modified: Fri, 27 Sep 2013 02:27:37 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shjcl69:80 (Cdn Cache Server V2.0), 1.1 fra77:3 (Cdn Cache Server V2.0)

Connection: keep-alive
.PNG........IHDR..............P......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:61621FFF271B11E3B6A0AAB9
5D0E2A6B" xmpMM:DocumentID="xmp.did:61622000271B11E3B6A0AAB95D0E2A6B"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:61621FFD271B11E3B6
A0AAB95D0E2A6B" stRef:documentID="xmp.did:61621FFE271B11E3B6A0AAB95D0E
2A6B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.l......PLTE.b..................oq G.......
.V......l.6......445..........sr....FG......uvw..HCEF........."##Z./..
.........i.....R.......`..4,Q)<.wvf..\aaqKI.Y..n-cee...Q?1......x68
...............UWW.1ondX.............:@.,{..o....RM.......O&....F$..*.
4..Nh.....2|...Ta........O...nrr.!...l.....Q.......W..12tzz.[8...{}~P.
....knn........{.EbNRR...........]....|............Reij.$#.......P...b
..n....-^...._fyoc...D.*...q!#.......f9...d_T5...Cx:OF",1JLL...YUM....
.....> '....... %..z...~....F...............<>=............82
 .............kwL_\...............;'2..........l....Zkg..B.E3.....
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/libg_2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 02 Dec 2014 23:27:54 GMT

Date: Wed, 03 Sep 2014 23:27:54 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2223

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 hzsx166:88 (Cdn Cache Server V2.0), 1.1 fra73:6 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89aK.^.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!.......,....K.^........H......*\.._.....`....5I2fD..#.. =.
.)....'I.D.1......C.oI.-M.8i.._..>w....h.'...t....'N..L.....T.6..e.
?$JfF....)[email protected]$.c....)[email protected][email protected]{[email protected] h."
.. i_h.B.`[email protected].%A.L......". ..6h..@^.@..... ...
.... .0.U..S.....Bi0....$a..................`..jI.s.&.%....br.?......0
h....2....#....(".f..a|OX...,......U....h#[email protected].....*.......
.D.H<AC.KV._.4...?p.a.......I8...`Zi..O....|.i%.`4A`..( g..l...M.b.
.KZ...2:....*.B.mn..$..9I.;"..(.T.... ...h0......E.e....6..BK.4....-..
.W2>.%.,.........#[email protected]..."zb....B..!R.J.O\1...Np..e.1.......Mp.#.
......../..,Kl.2.....0....*.B...!G..'...K..E'......:1.#......NqA..]0E.
Z|@2..h..-.h.r~.,`K.b.<s~..A.?u..s~.......;.}^.....,}..c...$.Hm
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/ico_ann.gif HTTP/1.1