MD5: 3c34522f475788746abdc79c8289ed79
SHA1: f860e908fb54ae7fa73e39d4f941189dde6bab61
SHA256: 53a7a2661c634c968a26e854e564a345dc1d20b062951f169bf12f991e61e23d
SSDeep: 98304:mra2 6lYqdwkLcHH6jjyb05LAtGig2hJBAUZLg:mg4jAN05LVigWJVs
Size: 3784704 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2015-03-17 17:47:25
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:1092

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1092 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\1GQ340U13[1].gif (527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\scbg[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\qmv16[1].swf (420546 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\jquery-1.2.1.pack[2].js (1740 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\ico[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\MagicWeaponv1240[1].swf (41613 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\bdsstyle[1].css (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\zb_nav_20131205[1].png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\c[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\jquery-1.2.1.pack[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\lazy_iframe[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\A4399dv_base[1].swf (8065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\flash_ctrl_version[1].xml (530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\tjrm_img011[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\pic[1].gif (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20141010[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\tjrm_img09[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\unilogin_package[2].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\crossdomain[1].xml (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\CASYO8RM.htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zrsp_1[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\4399_13510057915[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\t_3[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\t_2[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\googlevideoadslibrarylocalconnection[1].swf (34703 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\sy_ico[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20150115[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\play_hs1202[2].js (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (3504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\trace_news[1].js (559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\t_lm[1].png (1631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\crossdomain[2].xml (407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\n_zm1[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\jcsp_1[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\zwsf2-3[1].gif (1800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\zm_add[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\021615139200[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\tjrm_img07[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\yt_blacklist_domains[1].txt (254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\t_8[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\logo[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\icon_keys[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\crossdomain[1].xml (842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\b_3[1].gif (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\hottop[1].gif (857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\faspbtn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\qmv16[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\bg_9[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\CAW1MFCT.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\4399_14511864345[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\CA63EB6D (1917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\crossdomain[2].xml (331 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\02104939B23[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\libg_2[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\tjrm_img08[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\more_zb[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\bg_7[1].png (6 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (435 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\game_bg[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\bg_3[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\b_1[1].gif (610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\ico_ann[1].gif (1 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s8.4399.com\settings.sxx (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\bg[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\061109192641[1].jpg (3204 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\yt_blacklist_domains[1].txt (478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\test_domain[1].txt (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\bdshare[1].js (182 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\shell_v2[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\78072[2].htm (4190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\t_4[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\c_5[1].gif (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\unilogin_package[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\bg_4[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\core[1].php (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\c_2[1].gif (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\headerBg[1].gif (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\t_1[1].gif (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\chkDomain[1].js (554 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\topbg_20140506[1].jpg (4662 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (924 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\right[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\bds_s_v2[1].js (2515 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\sp_line_1[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\FuYun[1].swf (18169 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (1517 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\4399[1].js (902 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\more_boss[1].gif (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20150115[2].css (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\is[1].png (3796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\ico_1[1].gif (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\lmbtn[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\n_mg_bg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\lb_ico_v1[1].png (652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\121055423955[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\tjrm_img06[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\more_boss_s[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\libg_1[1].gif (899 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\logger[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\1016395W521[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\101634512c8[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\4399_17485812405[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\style[1].css (337 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\b_2[1].gif (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\tgbtn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\crossdomain[1].xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\ucenter[1].js (16593 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\libg_3[1].gif (542 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\031G3106195[1].jpg (10308 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\4399_18380750073[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\zj_btn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\CAQRWXMB.htm (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\ftbtn[1].gif (477 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\play_hs1202[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\b_4[1].gif (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\go_bbs[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\nav_bg[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\bg_8[1].png (1947 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\c_3[1].gif (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\4399[2].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\stat[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\xml[1].xml (574 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\c_1[1].gif (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\ecom[1].xml (233 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\s8.4399.com\seed4399Value.sxx (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\011K053B24[1].jpg (6296 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\new_icon_1[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\bg_1[1].gif (791 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\CAC5MZ41 (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\10163ZO2N[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\test_domain[1].txt (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\78072[1].htm (4926 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\left[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\bg_6[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\t_5[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\news_footer[1].js (961 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\googlevideoadslibraryas3[1].swf (1387 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\sszn[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\1Q62S330N[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\core[1].php (751 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@4399[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\31151042OF[1].jpg (2296 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\sc[1].gif (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[2].txt (435 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\0913524M015[1].gif (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\t_6[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\4399_17152503697[1].jpg (125 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\b_5[1].gif (317 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20141010[2].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\bg_5_20130716[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\t_9[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\qmv16[1].htm (1738 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\ctrl_mo_v5[1].swf (47840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\c_4[1].gif (81 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\click[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\base[1].css (10225 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\78072[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\CAC5MZ41 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\CA63EB6D (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\4399[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20150115[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\test_domain[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\qmv16[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\jquery-1.2.1.pack[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\play_hs1202[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\yt_blacklist_domains[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\crossdomain[2].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\unilogin_package[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[2].txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20141010[1].js (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s8.4399.com\settings.sol (0 bytes)

Registry activity

The process %original file name%.exe:1092 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040320150404]
"CachePrefix" = ":2015040320150404:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040320150404]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012015040320150404\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040320150404]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040320150404]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D 64 FB 4D 28 38 17 2A 22 A9 68 18 31 BD A6 22"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040320150404]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://4399hw.xdwscache.glb0.lxdns.com/flash/78072.htm
hxxp://4399hw.xdwscache.glb0.lxdns.com/css/zmxy3_20150115.css
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/jquery-1.2.1.pack.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/trace_news.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/logo.gif
hxxp://e.xdwscache.glb0.lxdns.com/moeryongshi/images/headerBg.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1309/121055423955.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1504/021615139200.gif
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2014/12/13/4399_14511864345.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2015/3/9/4399_18380750073.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2015/3/6/4399_13510057915.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/imageyx/seer2012/hottop.gif
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img011.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img09.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/101634512c8.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/10163ZO2N.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2015/3/12/4399_17485812405.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img06.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1502/02104939B23.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/1016395W521.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/go_bbs.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/sc.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1504/011K053B24.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1503/31151042OF.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/topbg_20140506.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/game_bg.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1503/061109192641.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1404/0913524M015.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/lb_ico_v1.png
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2015/1/26/4399_17152503697.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img08.jpg
hxxp://other.all.4399yyy.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/zj_btn.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/zm_add.png
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1504/031G3106195.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_1.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_1.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1302/1Q62S330N.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1209/1GQ340U13.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_5_20130716.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_6.gif
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img07.jpg
hxxp://other.all.4399yyy.com/4399swf/js/chkDomain.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/libg_1.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/sszn.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/nav_bg.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/scbg.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/bg_7.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/n_mg_bg.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_2.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/ico_1.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/lmbtn.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/tgbtn.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_3.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_8.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/ftbtn.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/faspbtn.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/more_boss.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/libg_2.gif
hxxp://e.xdwscache.glb0.lxdns.com/resource/ucenter.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/more_boss_s.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashUniLogin/css/style.css?v=20121016
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/more_zb.gif
hxxp://e.xdwscache.glb0.lxdns.com/resource/css/base.css
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_9.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/ico_ann.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_4.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_lm.png
hxxp://other.all.4399yyy.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_5.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_6.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/jcsp_1.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/sp_line_1.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_5.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_9.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/zb_nav_20131205.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/libg_3.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/lazy_iframe.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy2/icon_keys.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_1.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/n_zm1.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/bg_3.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_4.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_1.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/left.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/right.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_2.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_2.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_3.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_3.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_4.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_4.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/new_icon_1.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/zrsp_1.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_5.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_8.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/unilogin_package.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/news_footer.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/newaobidao/ico.gif
hxxp://e.xdwscache.glb0.lxdns.com/js/bdshare.js?t=3313
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/zmxy3_20141010.js
hxxp://stat.d.4399api.net/crossdomain.xml
hxxp://bae.jomodns.com/static/js/shell_v2.js?t=13
hxxp://bae.jomodns.com/static/js/logger.js?cdnversion=396683
hxxp://stat.d.4399api.net/flash_ctrl_version.xml?ran=33756.68819062412
hxxp://e.xdwscache.glb0.lxdns.com/crossdomain.xml
hxxp://e.xdwscache.glb0.lxdns.com/control/zwsf2-3.gif?20120719
hxxp://e.xdwscache.glb0.lxdns.com/control/A4399dv_base.swf?20150324
hxxp://bae.jomodns.com/static/js/bds_s_v2.js?cdnversion=396683
hxxp://stat.d.4399api.net/flash_flow/log.js?g=100015389&u=774c0f21700953182032bf6a9cddba0a&r=65945896
hxxp://stat.d.4399api.net/xml.php?ran=48787.24794834852&gameid=100015389&url=http://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm
hxxp://bae.jomodns.com/static/css/bdsstyle.css?cdnversion=20131219
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/sy_ico.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/play_hs1202.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/4399.js
hxxp://bae.jomodns.com/static/images/is.png?cdnversion=20131219
hxxp://cb.e.shifen.com/crossdomain.xml
hxxp://4399stat.5054399.com/js/click.js	115.182.52.78
hxxp://cb.e.shifen.com/ecom?di=62872&tm=BAIDU_CLB_XML&asp_url=4399.com&return_type=1&ran=9822.47437350452
hxxp://all.cnzz.com.danuoyi.tbcache.com/c.php?id=30039538
hxxp://gprp.4399api.net/s?uid=&vid=14280573350542688&m=&f=&c=&t=1428057335054&v=1	42.62.52.249
hxxp://pagead46.l.doubleclick.net/pagead/scache/googlevideoadslibraryas3.swf
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=30039538&t=q
hxxp://oq.cnzz.com/stat.htm?id=30039538&r=&lg=en-us&ntime=none&cnzz_eid=2007449240-1428052356-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1581191383	198.11.132.200
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=4073713&web_id=4073713&show=pic
hxxp://pagead46.l.doubleclick.net/pagead/scache/googlevideoadslibrarylocalconnection.swf?googleConnection=_google_video_ads5383778685454967769
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=4073713&show=pic&t=z
hxxp://oq.cnzz.com/stat.htm?id=4073713&r=&lg=en-us&ntime=none&cnzz_eid=1424361423-1428055768-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=435416256	198.11.132.200
hxxp://all.cnzz.com.danuoyi.tbcache.com/img/pic.gif
hxxp://pagead46.l.doubleclick.net/pagead/yt_blacklist_domains.txt
hxxp://static.n.shifen.com/v.gif?pid=307&type=3071&sc=996,4797,1276,818&desturl=&apitype=1&linkid=i81ggq5vtls&velo_load=5734&velo_cssload=1125&velo_jsLoad=4672&cite_uid=480925&cite_type=1&cite_mini=1
hxxp://pagead46.l.doubleclick.net/crossdomain.xml
hxxp://pagead46.l.doubleclick.net/pagead/test_domain.txt
hxxp://pagead46.l.doubleclick.net/pagead/ads?video_url_to_fetch=http://my.4399.com/100015389_game.html&unviewed_position_start=1&image_size=336x280,300x250,250x250,200x200&videoad_start_delay=-1&video_doc_id=zmxy3&flash=11.6.602&frm=0&u_tz=180&dt=1428057337851&u_h=846&u_w=1276&u_java=true&u_his=0&u_ah=818&u_aw=1276&u_cd=32&u_nplug=0&u_nmime=0&u_asa=1&output=xml&ad_type=text_staticimage_flash&channel=0000000398 game398 Fullscreen&num_ads=3&url=http://www.4399.com/flash/78072.htm&client=ca-games-pub-9606551472994074&correlator=829002686208195183&video_product_type=4&sdkv=1
hxxp://pagead46.l.doubleclick.net/pagead/adview?ai=CR6B-82weVbOKGsXB7QauhID4CP7hye8Fltz0x5MBnMWi3jIQASDTqPoVYKWepIaYI6AB8uOg0QPIAQGpAom0oqnv5GY-qAMByAMTmAQEqgSiAU_QO7YcnHV800ZeADXz2RopFtMtmbTxzvmCDe78PrGNRJ79Ir5ODcbBOPk_EW_EDQEEw-V1G9pfGrMs2uEYbhgOQTwjTbtnS-kOMWmNJREeHsJLm-9Wt0gtHAwiV1P6MWmw0FuNQzCZ565fLM0KqmKrae3yZw4qILhHb_H7rrL1CahhlKAHCknRyXahsgADo6-tKKEGxuKJw3ioceq6KRT-RJIFBAgEGAGAB_ab3y7YBwHCEwA&sigh=Dr_XFq_1CpU&ve=1
hxxp://stat.d.4399api.net/flash_flow/view.js?g=100015389&u=774c0f21700953182032bf6a9cddba0a&s=35b04bfb5551774272942c9d98036044&a=13&r=52209393
hxxp://e.xdwscache.glb0.lxdns.com/control/ctrl_mo_v5.swf?20140327
hxxp://imga2.4399.cn/upload_pic/2012/tjyx/tjrm_img07.jpg	203.130.61.92
hxxp://nsclick.baidu.com/v.gif?pid=307&type=3071&sc=996,4797,1276,818&desturl=&apitype=1&linkid=i81ggq5vtls&velo_load=5734&velo_cssload=1125&velo_jsLoad=4672&cite_uid=480925&cite_type=1&cite_mini=1	115.239.211.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/libg_2.gif	8.37.235.27
hxxp://googleads.g.doubleclick.net/pagead/test_domain.txt	216.58.209.162
hxxp://www.4399.com/flashzt/img/zmxy3/zm_add.png	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_5.gif	8.37.235.27
hxxp://pagead2.googlesyndication.com/pagead/scache/googlevideoadslibraryas3.swf	216.58.209.162
hxxp://newsimg.5054399.com/uploads/userup/1503/061109192641.jpg	203.130.61.92
hxxp://oz.cnzz.com/stat.htm?id=4073713&r=&lg=en-us&ntime=none&cnzz_eid=1424361423-1428055768-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=435416256	198.11.132.200
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/sc.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3/new_icon_1.png	8.37.235.27
hxxp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm	218.95.101.8
hxxp://bdimg.share.baidu.com/static/js/bds_s_v2.js?cdnversion=396683	211.90.25.48
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/right.gif	8.37.235.27
hxxp://cb.baidu.com/ecom?di=62872&tm=BAIDU_CLB_XML&asp_url=4399.com&return_type=1&ran=9822.47437350452	115.239.210.141
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_8.png	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3/jcsp_1.jpg	8.37.235.27
hxxp://s25.cnzz.com/stat.php?id=4073713&web_id=4073713&show=pic	1.99.192.16
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/sszn.gif	8.37.235.27
hxxp://stat.api.4399.com/xml.php?ran=48787.24794834852&gameid=100015389&url=http://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm	115.182.52.104
hxxp://bdimg.share.baidu.com/static/js/shell_v2.js?t=13	211.90.25.48
hxxp://imga3.4399.cn/upload_pic/2012/tjyx/tjrm_img09.jpg	203.130.61.92
hxxp://www.4399.com/flashzt/img/newaobidao/ico.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3/bg_7.png	8.37.235.27
hxxp://stat.api.4399.com/flash_flow/view.js?g=100015389&u=774c0f21700953182032bf6a9cddba0a&s=35b04bfb5551774272942c9d98036044&a=13&r=52209393	115.182.52.104
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_lm.png	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/more_zb.gif	8.37.235.27
hxxp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf	218.95.101.8
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_2.gif	8.37.235.27
hxxp://bdimg.share.baidu.com/static/js/logger.js?cdnversion=396683	211.90.25.48
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_8.png	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1504/031G3106195.jpg	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/left.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/go_bbs.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/lb_ico_v1.png	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1405/10163ZO2N.jpg	203.130.61.92
hxxp://newsimg.5054399.com/uploads/userup/1503/31151042OF.jpg	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/libg_1.gif	8.37.235.27
hxxp://imga4.4399.cn/upload_pic/2012/tjyx/tjrm_img011.jpg	203.130.61.92
hxxp://c.cnzz.com/core.php?web_id=30039538&t=q	195.27.31.248
hxxp://www.4399.com/jss/zmxy3_20141010.js	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/nav_bg.gif	8.37.235.27
hxxp://imga1.4399.cn/upload_pic/2014/12/13/4399_14511864345.jpg	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3/n_zm1.png	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/ico_1.gif	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1209/1GQ340U13.gif	203.130.61.92
hxxp://s8.4399.com/4399swf/js/chkDomain.js	218.95.101.8
hxxp://stat.api.4399.com/flash_flow/log.js?g=100015389&u=774c0f21700953182032bf6a9cddba0a&r=65945896	115.182.52.104
hxxp://www.4399.com/css/zmxy3_20150115.css	8.37.235.27
hxxp://googleads.g.doubleclick.net/crossdomain.xml	216.58.209.162
hxxp://bdimg.share.baidu.com/static/css/bdsstyle.css?cdnversion=20131219	211.90.25.48
hxxp://newsimg.5054399.com/uploads/userup/1504/021615139200.gif	203.130.61.92
hxxp://googleads.g.doubleclick.net/pagead/adview?ai=CR6B-82weVbOKGsXB7QauhID4CP7hye8Fltz0x5MBnMWi3jIQASDTqPoVYKWepIaYI6AB8uOg0QPIAQGpAom0oqnv5GY-qAMByAMTmAQEqgSiAU_QO7YcnHV800ZeADXz2RopFtMtmbTxzvmCDe78PrGNRJ79Ir5ODcbBOPk_EW_EDQEEw-V1G9pfGrMs2uEYbhgOQTwjTbtnS-kOMWmNJREeHsJLm-9Wt0gtHAwiV1P6MWmw0FuNQzCZ565fLM0KqmKrae3yZw4qILhHb_H7rrL1CahhlKAHCknRyXahsgADo6-tKKEGxuKJw3ioceq6KRT-RJIFBAgEGAGAB_ab3y7YBwHCEwA&sigh=Dr_XFq_1CpU&ve=1	216.58.209.162
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/tgbtn.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_1.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3/sp_line_1.jpg	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_6.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg.gif	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1309/121055423955.gif	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_2.gif	8.37.235.27
hxxp://pagead2.googlesyndication.com/pagead/yt_blacklist_domains.txt	216.58.209.162
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_1.gif	8.37.235.27
hxxp://www.4399.com/flash/78072.htm	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_3.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/topbg_20140506.jpg	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1404/0913524M015.gif	203.130.61.92
hxxp://googleads.g.doubleclick.net/pagead/ads?video_url_to_fetch=http://my.4399.com/100015389_game.html&unviewed_position_start=1&image_size=336x280,300x250,250x250,200x200&videoad_start_delay=-1&video_doc_id=zmxy3&flash=11.6.602&frm=0&u_tz=180&dt=1428057337851&u_h=846&u_w=1276&u_java=true&u_his=0&u_ah=818&u_aw=1276&u_cd=32&u_nplug=0&u_nmime=0&u_asa=1&output=xml&ad_type=text_staticimage_flash&channel=0000000398 game398 Fullscreen&num_ads=3&url=http://www.4399.com/flash/78072.htm&client=ca-games-pub-9606551472994074&correlator=829002686208195183&video_product_type=4&sdkv=1	216.58.209.162
hxxp://www.4399.com/jss/4399.js	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/lmbtn.png	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1405/101634512c8.jpg	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_4.png	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_4.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/sy_ico.gif	8.37.235.27
hxxp://imga.4399.cn/upload_pic/2012/tjyx/tjrm_img08.jpg	203.130.61.92
hxxp://www.4399.com/jss/play_hs1202.js	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_1.gif	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1405/1016395W521.jpg	203.130.61.92
hxxp://cdn.comment.4399pk.com/crossdomain.xml	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_5.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_5_20130716.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/faspbtn.gif	8.37.235.27
hxxp://www.4399.com/jss/news_footer.js	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3/n_mg_bg.png	8.37.235.27
hxxp://c.cnzz.com/core.php?web_id=4073713&show=pic&t=z	195.27.31.248
hxxp://imga1.4399.cn/upload_pic/2015/3/9/4399_18380750073.jpg	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/game_bg.gif	8.37.235.27
hxxp://pagead2.googlesyndication.com/pagead/scache/googlevideoadslibrarylocalconnection.swf?googleConnection=_google_video_ads5383778685454967769	216.58.209.162
hxxp://newsimg.5054399.com/uploads/userup/1504/011K053B24.jpg	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/scbg.gif	8.37.235.27
hxxp://www.4399.com/jss/unilogin_package.js	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/libg_3.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_4.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/ftbtn.gif	8.37.235.27
hxxp://stat.api.4399.com/crossdomain.xml	115.182.52.104
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_9.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3/zrsp_1.jpg	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/more_boss.gif	8.37.235.27
hxxp://imga1.4399.cn/upload_pic/2012/tjyx/tjrm_img06.jpg	203.130.61.92
hxxp://s4.img4399.com/flashUniLogin/css/style.css?v=20121016	203.130.61.92
hxxp://cdn.comment.4399pk.com/control/ctrl_mo_v5.swf?20140327	203.130.61.92
hxxp://news.4399.com/js/bdshare.js?t=3313	203.130.61.92
hxxp://www.4399.com/jss/jquery-1.2.1.pack.js	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_1.gif	8.37.235.27
hxxp://imga4.4399.cn/upload_pic/2015/3/6/4399_13510057915.jpg	203.130.61.92
hxxp://imga.4399.cn/upload_pic/2015/1/26/4399_17152503697.jpg	203.130.61.92
hxxp://www.4399.com/jss/lazy_iframe.js	8.37.235.27
hxxp://bdimg.share.baidu.com/static/images/is.png?cdnversion=20131219	211.90.25.48
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/logo.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_9.gif	8.37.235.27
hxxp://imga1.4399.cn/upload_pic/2015/3/12/4399_17485812405.jpg	203.130.61.92
hxxp://ptlogin.3304399.net/resource/ucenter.js	203.130.61.92
hxxp://cb.baidu.com/crossdomain.xml	115.239.210.141
hxxp://w.cnzz.com/c.php?id=30039538	1.99.192.14
hxxp://newsimg.5054399.com/uploads/userup/1502/02104939B23.jpg	203.130.61.92
hxxp://www.4399.com/jss/trace_news.js	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/more_boss_s.gif	8.37.235.27
hxxp://cdn.comment.4399pk.com/control/zwsf2-3.gif?20120719	203.130.61.92
hxxp://stat.api.4399.com/flash_ctrl_version.xml?ran=33756.68819062412	115.182.52.104
hxxp://www.4399.com/imageyx/seer2012/hottop.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_4.gif	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1302/1Q62S330N.gif	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3/bg_3.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3/zb_nav_20131205.png	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/zj_btn.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_2.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy2/icon_keys.gif	8.37.235.27
hxxp://icon.cnzz.com/img/pic.gif	195.27.31.246
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_6.gif	8.37.235.27
hxxp://news.4399.com/moeryongshi/images/headerBg.gif	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_5.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_3.gif	8.37.235.27
hxxp://ptlogin.3304399.net/resource/css/base.css	203.130.61.92
hxxp://cdn.comment.4399pk.com/control/A4399dv_base.swf?20150324	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_3.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/ico_ann.gif	8.37.235.27

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Outdated Windows Flash Version IE

Traffic

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: googleads.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/x-cross-domain-policy; charset=UTF-8

ETag: 13264204777643215726

Date: Thu, 02 Apr 2015 19:38:07 GMT

Expires: Fri, 03 Apr 2015 19:38:07 GMT

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: cafe

Content-Length: 407

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=86400

Age: 53844

Alternate-Protocol: 80:quic,p=0.5
.............R.0.E{..p.Ld.d......$MJYR...F.;...L((R.R....^=.]..&..Q9..
..S.^UU.......m.....p.)..N >..~..|.....m.q..aEh.P.rg....I...N.B...;
K....2...`...~(a.M......1...5OM...3.&F.D.LE...D.....Q..l.6.L..K....K..
.$*g.R'D.A.9..GH=..?-.J.......)....@>............].".D...a....P=..9
..........W..U.=.=J$..4.D.....;.rO@>.....RC.W./.1...-..X..=..C..P%.
:Uq...\N..?.LI.~....K.....r.%/..._.6.1...... ..........U....r,....nt>....


GET /pagead/test_domain.txt HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://pagead2.googlesyndication.com/pagead/scache/googlevideoadslibrarylocalconnection.swf?googleConnection=_google_video_ads53837786854549

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: googleads.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/plain; charset=UTF-8

ETag: 3643785376238531823

Date: Thu, 02 Apr 2015 19:38:42 GMT

Expires: Fri, 03 Apr 2015 19:38:42 GMT

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: cafe

Content-Length: 29

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=86400

Age: 53809

Alternate-Protocol: 80:quic,p=0.5
............OLIM.5...........HTTP/1.1 200 OK..P3P: policyref="hXXp://g
oogleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TA
Io PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR".
.Content-Type: text/plain; charset=UTF-8..ETag: 3643785376238531823..D
ate: Thu, 02 Apr 2015 19:38:42 GMT..Expires: Fri, 03 Apr 2015 19:38:42
 GMT..X-Content-Type-Options: nosniff..Content-Encoding: gzip..Server:
 cafe..Content-Length: 29..X-XSS-Protection: 1; mode=block..Cache-Cont
rol: public, max-age=86400..Age: 53809..Alternate-Protocol: 80:quic,p=
0.5..............OLIM.5...............


GET /pagead/ads?video_url_to_fetch=http://my.4399.com/100015389_game.html&unviewed_position_start=1&image_size=336x280,300x250,250x250,200x200&videoad_start_delay=-1&video_doc_id=zmxy3&flash=11.6.602&frm=0&u_tz=180&dt=1428057337851&u_h=846&u_w=1276&u_java=true&u_his=0&u_ah=818&u_aw=1276&u_cd=32&u_nplug=0&u_nmime=0&u_asa=1&output=xml&ad_type=text_staticimage_flash&channel=0000000398 game398 Fullscreen&num_ads=3&url=http://www.4399.com/flash/78072.htm&client=ca-games-pub-9606551472994074&correlator=829002686208195183&video_product_type=4&sdkv=1 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://pagead2.googlesyndication.com/pagead/scache/googlevideoadslibrarylocalconnection.swf?googleConnection=_google_video_ads53837786854549

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: googleads.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/xml; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Date: Fri, 03 Apr 2015 10:35:31 GMT

Server: cafe

Cache-Control: private

Content-Length: 1170

X-XSS-Protection: 1; mode=block

Set-Cookie: test_cookie=CheckForPermission; expires=Fri, 03-Apr-2015 10:50:31 GMT; path=/; domain=.doubleclick.net

Alternate-Protocol: 80:quic,p=0.5

Expires: Fri, 03 Apr 2015 10:35:31 GMT
...........V...F.........S...ZB...``....F...R......"NU.]*I..?pU2..l..A
.C..FZb&e{.T*;o.....n.s.m.g;...........KS.^8K...............c.*m;.Y-..
[email protected]")U:..%..>:.T......%...0cC.sB.F..Y
.u....Fs..Dp.g.....&Z..b...f..\...j~.-.shTEa..r.D.y.../.n..]......Q.a.
.. v..;5............S..p&..P...;..`.t.c.........t.=..-0.6.........vkRf
. ...........|.;l-.....k..s."{.~}1....*MU.>..0=.6 ...u.\ ..........
......Z.sEB-..c. S.j..Bc....-d.Aox.......e....A.._.....[s..y^' B]7..%.
me..u_.u..........0o8..)..qZ.A..nW....0I..X.l2......RA...Pa...V.j. 3..
..5.Y\..W...Cu......v.y.RbK.b...*....N.-c......hNB..0 ..|FC..|U7|.x...
4....o.5..X....D7.....E...0zu|....G.........1M...{R...............FE?E
....y..gNn..?W.~.^F.........>. w..............w*.........O._.3?;a.c
.A..EW.."......,M/.N.......0p.5Px...R.....?......&5A..*....L.[.......u
O.ll...^..=e)^T$0.'...M......5n..c...Z_B."..B.....<.>e)....3....
...vV.V#.....;L-!.Uz.V001.$6.z...).C.=c.`[email protected].._.?z....'_...
."...&V.Od..a.$....H.........x...6..M.|.q.g.A......W[uk8&...L...c.B.RI
PW&.u. .\..c......D......>..Q$.64}. .t.r. ..d..}zy.d;. ..B...q.-.j.
.:._..e.....p.L...-...1..... ..<..&.2.-.YQ.5A....<..........Z...
 .......
<<< skipped >>>

GET /pagead/adview?ai=CR6B-82weVbOKGsXB7QauhID4CP7hye8Fltz0x5MBnMWi3jIQASDTqPoVYKWepIaYI6AB8uOg0QPIAQGpAom0oqnv5GY-qAMByAMTmAQEqgSiAU_QO7YcnHV800ZeADXz2RopFtMtmbTxzvmCDe78PrGNRJ79Ir5ODcbBOPk_EW_EDQEEw-V1G9pfGrMs2uEYbhgOQTwjTbtnS-kOMWmNJREeHsJLm-9Wt0gtHAwiV1P6MWmw0FuNQzCZ565fLM0KqmKrae3yZw4qILhHb_H7rrL1CahhlKAHCknRyXahsgADo6-tKKEGxuKJw3ioceq6KRT-RJIFBAgEGAGAB_ab3y7YBwHCEwA&sigh=Dr_XFq_1CpU&ve=1 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://pagead2.googlesyndication.com/pagead/scache/googlevideoadslibrarylocalconnection.swf?googleConnection=_google_video_ads53837786854549

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: googleads.g.doubleclick.net

Connection: Keep-Alive

Cookie: test_cookie=CheckForPermission

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Date: Fri, 03 Apr 2015 10:35:35 GMT

Server: cafe

Cache-Control: private

Content-Length: 58

X-XSS-Protection: 1; mode=block

Set-Cookie: id=220102a30602002b||t=1428057335|et=730|cs=002213fd48f6502419f07f7554; expires=Sun, 02-Apr-2017 10:35:35 GMT; path=/; domain=.doubleclick.net

Set-Cookie: test_cookie=; expires=Mon, 21-Jul-2008 23:59:00 GMT; path=/; domain=.doubleclick.net

Alternate-Protocol: 80:quic,p=0.5

Expires: Fri, 03 Apr 2015 10:35:35 GMT
..........3...(M..*.sI... (..N...p..s4sIr.0..pt,...Ba.&...HTTP/1.1 200
 OK..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p
_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA 
PRE COM NAV OTC NOI DSP COR"..Content-Type: text/html; charset=UTF-8..
X-Content-Type-Options: nosniff..Content-Encoding: gzip..Date: Fri, 03
 Apr 2015 10:35:35 GMT..Server: cafe..Cache-Control: private..Content-
Length: 58..X-XSS-Protection: 1; mode=block..Set-Cookie: id=220102a306
02002b||t=1428057335|et=730|cs=002213fd48f6502419f07f7554; expires=Sun
, 02-Apr-2017 10:35:35 GMT; path=/; domain=.doubleclick.net..Set-Cooki
e: test_cookie=; expires=Mon, 21-Jul-2008 23:59:00 GMT; path=/; domain
=.doubleclick.net..Alternate-Protocol: 80:quic,p=0.5..Expires: Fri, 03
 Apr 2015 10:35:35 GMT............3...(M..*.sI... (..N...p..s4sIr.0..p
t,...Ba.&.....
<<< skipped >>>

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.comment.4399pk.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 03 Apr 2015 00:46:33 GMT

Server: nginx/1.0.4

Content-Type: application/xml

Last-Modified: Wed, 17 Mar 2010 03:06:58 GMT

ETag: "5288176-14b-481f66842f880"

Accept-Ranges: bytes

Content-Length: 331

Age: 1

X-Via: 1.1 ami3:0 (Cdn Cache Server V2.0)

Connection: keep-alive
<?xml version="1.0"?>..<!DOCTYPE cross-domain-policy SYSTEM '
hXXp://VVV.macromedia.com/xml/dtds/cross-domain-policy.dtd'>..<c
ross-domain-policy>..    <site-control permitted-cross-domain-po
licies="all" />..    <allow-access-from domain="*" />..    &l
t;allow-http-request-headers-from domain="*" headers="*"/>..</cr
oss-domain-policy>......


GET /control/zwsf2-3.gif?20120719 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.comment.4399pk.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 28 Jun 2015 18:27:53 GMT

Date: Mon, 30 Mar 2015 18:27:53 GMT

Server: nginx/1.0.4

Content-Type: image/gif

Last-Modified: Wed, 07 Sep 2011 08:07:32 GMT

ETag: "5383f2e-2bc8-4ac556fa31900"

Accept-Ranges: bytes

Content-Length: 11208

Cache-Control: max-age=7776000

Age: 1

X-Via: 1.1 jswx84:8101 (Cdn Cache Server V2.0), 1.1 fjqzwt234:8106 (Cdn Cache Server V2.0), 1.1 ami4:1 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a..P...........[#.Z".Z#AAC.......wH..........ee.........   ...kkl
......aab.........ZZ[.zz...............noq..X@@@....66qqq.JJ..........
..PPQ............$$$...............   ......===................l:.....
.....  ...000......xxy...............................$$...EEF....["...
............HHI.DD...............uvx..{..b...555....]&...}}~.b-TTU...u
uu.....lrrtCCC999LLM.]]...eefnor...........r}~.BBD.f1.==.........zz{..
...........UU.PPFFH......KKL..v.mm...NNP....h5.............|P._(...stv
............BAC.....~...WWX.......  ..................................
..wwz......ggh.\$AAA......__`...{|~...................................
...................ccc~.....RRS....uu............................\#.Z"
.........GGI.........................["...SSU.Z"[email protected].
.v....]$...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." i
d="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta
/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00    
    "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-synt
ax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adob
e.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:st
Ref="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="
Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:CFA3FEFBD85011E
0A753A3E3D59E8251" xmpMM:DocumentID="xmp.did:CFA3FEFCD85011E0A753A3E3D
59E8251"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CFA3FEF9D
85011E0A753A3E3D59E8251" stRef:documentID="xmp.did:CFA3FEFAD85011E
<<< skipped >>>

GET /flashUniLogin/css/style.css?v=20121016 HTTP/1.1

Accept: */*

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s4.img4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 05 Apr 2015 18:22:30 GMT

Date: Fri, 06 Mar 2015 18:22:30 GMT

Server: nginx/1.6.1

Content-Type: text/css

Content-Length: 4097

Last-Modified: Thu, 24 Oct 2013 07:49:35 GMT

ETag: "5268d10f-1001"

Cache-Control: max-age=2592000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 zhj192:8108 (Cdn Cache Server V2.0), 1.1 kf48:2 (Cdn Cache Server V2.0)

Connection: keep-alive
@charset "utf-8";..body{background-color:#37383c;}../*login*/..#regbot
 {display:block;}...loginDiv{border:none;width:538px;background:none;}
...login_hd{background:url(../images1/tbg.gif) no-repeat;padding:37px 
25px 0; }..#login_tagnum{background:url(../images1/ptlogin.gif) repeat
-y 0 0;padding:0 5px;}...login_fd{background:url(../images1/ptlogin.gi
f) no-repeat -538px 0;height:23px;}...login_close{background:url(../im
ages1/closed.gif) no-repeat;width:15px;height:15px;top:8px;}...login_c
lose:hover{background-position:0 -15px;}...login_horizon .ptlogin_btn,
 .login_vertical .ptlogin_btn{background:url(../images1/spriteV4.png) 
no-repeat;width:73px; height:28px; overflow:hidden;}...login_horizon a
, .login_vertical a{color:#ffaa00;}...login_vertical .login_hor .q_tip
{color:#899999;}...login_vertical .login_hor label{color:#899999;}..#l
ogin_tag{height:28px;}..#login_tag li, #login_tag li a, #login_tag li.
selectTag, #login_tag li.selectTag a{background:url(../images1/ptlogin
_tab.gif) no-repeat;}..#login_tag li{width:84px;height:28px;padding:0;
text-align:center;}..#login_tag li a{width:84px;height:28px;padding:0;
text-align:center;line-height:28px;}..#login_tag li.selectTag a{backgr
ound-position:0 0;color:#fff;}..#login_tag li a{background-position:-8
4px 0;color:#464646;}..#login_tag li{top:1px;}...login_vertical #login
_simple_toregister{background:url(../images1/spriteV4.png) no-repeat -
74px 0;width:73px;height:28px;overflow:hidden;}...login_vertical .ptlo
gin_register{background:url(../images1/spriteV4.png) no-repeat 0 -
<<< skipped >>>

GET /flash/78072.htm HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 03 Apr 2015 10:10:57 GMT

Date: Fri, 03 Apr 2015 09:40:57 GMT

Server: nginx

Content-Type: text/html

Last-Modified: Fri, 03 Apr 2015 09:24:33 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=1800

Content-Encoding: gzip

Age: 3250

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive
400a...............sT../.......:.b.gQ{..6...0....::.........t....ox.1.
...@HB*IhB.,$....p....>`|p......RV!..u.{..w.......r...kx..<...}.
..S...#.E..?....E.%.....X..}....m........}.........tu,..?....jl.{*.;z.
.........}{bo..t.c.Y..............ao|.HuM...s.T*.....2]A.t..1.Z..J*.h.
zsC.........}o.U.........o5...O...J.7T6n8Xf..Q\..>....tIy...tcUY..Q
U......HmYUueI. [email protected]}5.......<...2S..xY.....6c.r.6...U
.....j..kjy..[....... 7^.105uo~.|R....\..1yr....R..9s|~j.....;..5.#...
 *.....h.}o...S..._......]......?..;v........_.=......'..\.....X.....C
Ov..=5vn.........?A..|..M......5.x.x.M'..e..zNO.h...h..|z...q.xp._.|.h
m}E..b....&.v.....C...VW..^t......XyC...RC.mM.........zCqC......* 1..`
=.....h..,.N..l.{l(>.~3.?$.>.TSN....,......O.......t......U.....
...*.7..=......~..............?.....:]^.x.$v.....'........*....E../...
...=........?.v.........X..O.{um9...f=..h..2..>.......?-.....F...m.
....\.l}.Q..?.....<.}&.....3..........o4U..]..7........?.......$O..
e..|H...R6.....'.xWEmy.......#.....B>.?..H....1].........No...o..##
.j ..*..9R....=...i.W..|..M.....L..z...bC1(n...........* k............
o..f......c....A.c.....k...o6.ZJ7c...k...:P\...".{..h2>.K.?P......t
...j.....TW=.......p..3p...{.....3.....X.......|}S...[.<....e...I..
...*...z.)......GxH.?e..\....X..gY........"&.7....h<.TB.{..F.IO....
i...'.&.PDKxI...`.S......*.....m..x.K..2..:.Y..[....zHm#v....M\.D.i..U
D.a....L7..\.\q.([. jk..jJc..>.|8tv..gb......$.1...6...WP.8.7U7U::.
...U1#........>..TqW........W'..}.p..#...;.k...w.m.v'gS]um..!F.
<<< skipped >>>

GET /css/zmxy3_20150115.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 10:14:40 GMT

Date: Fri, 03 Apr 2015 10:14:40 GMT

Server: nginx

Content-Type: text/css

Last-Modified: Tue, 13 Jan 2015 07:48:19 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=7776000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive
1671.............].n#Ir>{.y.r7.x.-...'R.{g.._....E.HQM.8di..}..|...
`.W...=._dFfdVQ$[.................m...u.a1.;Y......>%..............
....T...y..GY.}...............i..v...N.fRL..v..f6...............ng8..V
......>.W....y.....i....s5Y\...?$.r[.._~..x......g7u.X_..i. .e..m.M
..F..o.Nn..z.4m.LD....W|zY...r3Jo..l..,F)..V...U.y.|Y-....~Z....~.T;."
.\NWeAh.{4..[..i4'.......2.....Xn ......./..Y};....nn.....uH..DHk.^...
.=U...vIr,.....,[email protected].].f....../.K.*.o.K......%k..J...j
...gi...Y....r.X...).-.H........K...\.....?Z...L.......G.r^. .n..r.1.D
.0b...(.L.".9..h..^.....$.E.%.C.!......b..d,.l......z.....g..vU<.&.
j...P......`....%.)E.r...rS.6.6.?.....=.e".yB8X......3d.YmL..T.&...H..
..Y... .....\....yu.; ......m..(~..5X8KF.....bLl....._.-.....o.a._...d
..h=r7..{...v.7u..Td.dcu.... .....O....|....4...].....6.{....d!...'.. 
....,..u.^.......x.7n..M.J..=.a..o-r...6R..|.eQ0.G.N.V.c.c.......'..p.
..B..b.!.*r...E...........G...kX......b3^N...&.9......D...'..2.$._.}..
.....O.K\[email protected]...|8.......S...Q...-*$}[email protected]..._..
...\n..}}..W.H..[.).........0#Q.QB..:...."...%..c.V:7.1DD...`.....]...
x.2.~3..,..8.K.=..O./[email protected]#....R.r..v..2|[email protected]...'.
DN.}..,.~..2b[-m.qy...s..N.$=.i.....(^....!..].n....V.....1..ErSD...}X
w....y=....I(.%.j..%.g.l^.7.e.8.!...:@..n..9Z9...T..... .e.......-....
8.0...`...."?.7.....6N\[n...........6..Z}....a.J...j.........../..b...
[email protected]..|..\..t....%..~C5R...V........
....X..... Te*..z.a....Vnf.3.......u......z..?V;....}(...b....t..P
<<< skipped >>>

GET /jss/jquery-1.2.1.pack.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:48:05 GMT

Date: Fri, 03 Apr 2015 08:48:05 GMT

Server: nginx

Content-Type: application/x-javascript

Last-Modified: Sun, 10 Nov 2013 09:24:37 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=7776000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive
39f2..............y_.J......h.$R,.......B....d;@..E6f..m..b^...U.@..{.
.9cI.^..k.j....JOJ'....g)..(....gW....Y.m.Gk......R......A.xZ.;A)Y\\*.
...K...._.O....3:.T..e..t6.d.I.-]....4=.J[..%......k..................
o/g.L...?^..Y. ._l...RRiV..b.4.X]\,.{...D.^va..........f.R.U.y.....3.w
9.L.......Nx.f.8.....Np3......y.Z}.......$..N..B ....w..?[..Jmuo:...Qo
<:.y....u3.SN.A..MG.._........=~.....V'...-..}..\...h8?.....G..A.(.
u.r....... Q...h....W......oW:i|.r.3...."...b..|..k..>......l..... 
.. .#..[.....n.~|^Z.K..^.^.J.V.Kki...........F.^Z.,.....{ j.<....u.
...W.. 4....L...|{z....G...$(?...=;z.G.............t-.<Ooj..o.N..nX
.<..z....oy..z.<...=....?z.....v..d&z.:tU}......V....~.*{T...e;.
.Q...V..d.(..n........J=z.. ...m.....r.(....)[email protected].^..4.#
uLOQ....b...x....T.....8...=...O..b...n(..=Z..c:.s..mX.4=c~/\...l..w..
..b......R M?.Z.z.....n.d.^.-.b...._.:..o....R._\._.,Q...._.2..P.TP.Z.
^/ . ...w>..............n...........X..=..g..|ai...>..Y.dy... Q.
[email protected].........{[email protected]....
]... ..g.xm.=z...AW.B5...1...Z..LS......]..(...rb.`...K..i9u.1.....f..
A.....iz.....a...k.'$D.. ._j..a.z.b...z.W..> v..R]..uk....[V....7..
.....k...b...[..}E.qX......n.3I.EL,...O....]-.o.`...........D3....-...
......Q..j'..jW........X,3..I..=..........E.G.._8.V~vT...(..0..Q...(..
g.1.V..J5...K.6..i......K. .K."6.Q....a.K.....{O. .n..nY..........u.~.
[email protected].%;^."vh9v.......$.{~.`... [email protected]}.F..i.
...:...o.....,J[..O.uAM$`...p..][email protected][s..V....:
<<< skipped >>>

GET /jss/trace_news.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:33:47 GMT

Date: Fri, 03 Apr 2015 09:33:47 GMT

Server: nginx

Content-Type: application/x-javascript

Content-Length: 559

Last-Modified: Wed, 26 Feb 2014 01:36:00 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive
function tracking(e){...e = e ? e : window.event;...var s = e.srcEleme
nt ? e.srcElement : e.target;...var a = s.tagName;..//.var u = s.href;
..        var u = s.href ? s.href : s.src;...var t = s.innerText ? s.i
nnerText : s.textContent;..    if (a == "B"||a == "STRONG"){..        
a = "A";....u = s.parentNode.href;..    }...if (a == "IMG"){....t = u;
....u = s.parentNode.href;...}...if(a == "A" || a == "IMG"){....try{..
...new Image().src = "hXXp://tracenews.5054399.com/trace.js?addd=" a "
&uddd=" escape(u) "&tddd=" t;....}catch(ex){}...}...return true;..}..<
/font>....


GET /flashzt/img/zmxy3_20120913/bg.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:03 GMT

Date: Fri, 03 Apr 2015 09:48:03 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 5892

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000
GIF89aP.Q.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................!.......,....P.Q......;
.?C.BA:7A.84..C...C..54C=.&.:.@......=..A?.".46.<:.@4$=.?>;;...:
@B.?@.:[email protected]..<...;[email protected].<..9....6;.C6:B .@p.
..... A|..1.HA..|...p...:t........6.......A.....X..... .#... |0."/....
.....G........U.hBt....`..Bx.H& ....j...u..b..d..!.....an......6|T.2dH
[email protected].... ...9.T..C.........X..#...&d..^..... ....#.A.b... 1.I 
[email protected] ...5...@@[email protected]*.. AB.......C.J.Cj`
4.`....x.....%D..Q0..78 ...|[email protected]|0..Al..k.T.@
.......P..": .......;7`5.F.. ...><..T.....<`c...$I..6..C.F...
y?`...A,[email protected]#.Ce.D.`.
..H.....B.....A....'[email protected]\9...ahh.;0r..B.FL&..`...l..
..l`[email protected]=0.........ER.s........kV:.....X`....`..5...Q...C....,
....A.C......P..@|.........&V`.dC..C....`... ..E..@...`C.{......q.....
.......XA.....`[email protected]...?7&..<. ....!.BIb ...!`. ...U.
=.....\.......]:.q..@l`8.=\uu.6.|A.>$.....paR..@.`.....I.p.X6 ..k..
..YI...$4X.. >...S%#........%[email protected]@..\...or..
.............;...E9.@[email protected]..;.[....q9..5.@."..
<<< skipped >>>

GET /imageyx/seer2012/hottop.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:49:17 GMT

Date: Fri, 03 Apr 2015 08:49:17 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 857

Last-Modified: Sat, 20 Apr 2013 02:58:00 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!.......,..........6....H.........p.......H..... ^,.......j
.).c.....T......;....


GET /flashzt/img/zmxy3_20120913/sc.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:02 GMT

Date: Fri, 03 Apr 2015 09:48:02 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2967

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89aw............P...f..[..q-..y............... v....,[..c."m......2
....x....aq...xZ'.3.....o5...4..t..R....{m.Hu2Gb*!.OLH......hR2.X..d..
...{h..#.9v.....{WR^....B.>HT...^..Fx.xM.............~pj..Y....:.c.
.5p..4l...........,..L...K..'h...:....G.........[. W...........4..V=Sd
......Q...c.......S*F..=G...<g...)d.e.1......E:0..7...........t.$J.
}%..Y........YT.............-.I...........dQ.Q.Ujc....B.rhd......"R..N
...C.P1.\C........3..C:'Bs[H...K.......$...:>[email protected]._..O1Qs..."Mz
....'1 `.=}..7b.2^........2........5.........5n../`..........*I[....."
8TX..D..6..;..?..2~.H..L..q........QczS............. ...v..~ -!..!..?.
....v..<...M..U.u.....T...}........./........Y.>~Ibj....."..P..,
..v..w....% ......... q.L..0H]/Rc..R..U.k...........N.......AUnf...P.d
...R.a...V.........=..=...!.......,....w.........................H..H.
....3j...cGW<d..PH.....&I.!....c..I.&...~.L....._..X.2C.S..*].....P
.J....=..,bq..a..=....AB...........p...K....x...........H..C....X;bH..
8.!g.....K..i.......C..M...(..,H.....7$.b.&E..7643.yD.o~...N...... _.&
lt;..F.....'...o...#.]...:...S...NW...S.....B...*.(.....O.......^,`..E
.[ha........F.F,.6........rt .;G....P`b..f.....l.....(....c..6:0......
[email protected].[.8.%[l.@}F...'3V9#.W,...>.`....b....Y&.lx....PP@z.."...
0..?....?....|>.......K.6...,.X../6n.L.?.B....c.'tv:.4.5.A.L.I..t..
. ..2.)......v...zF...4..j......?.D..?.&.......>.$..?.L......K .h.K
.."..?..j....... `..0....#.p..;.....O$.E.&.....^!...;.O ..{i...2...T.q
... ...N.l..P.K....O.....>....>.....4..../`PD.k..M1....(....
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/game_bg.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:03 GMT

Date: Fri, 03 Apr 2015 09:48:03 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 17568

Last-Modified: Fri, 21 Sep 2012 09:31:28 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a..........z...........utu....................................g..
........................u..w..DEE.....................................
............................................u.........................
.......Y...vz.............................................o...........
....................................[~.{..............................
...z..............................{...................................
....n.....................................................b...........
............j.....|..............^........~...........................
......................................................................
......................................................................
.............................................aaa......................
...........!.......,.............8.ac ....*$x.....#Jt..`......x..F..1V
...$H.%.nTy..J..?..ic#..7q...o..r.r......a...M..fR...]...*....M.$.A..`
.....,..h..e.d...I.6..`K..w.........}`.A..a....m0...$H.C.L.N.$.3O.l...
.3.....4..p..^.....s... .....o......$....p...*.$T."......K.N}z....k...
.w.H.S....2d...._.........O..}..X..?......8....h...2....2...I@.`... ..
.e.a.>.F....v....6.-%....o........*..hc.5..#*...J @..K ...I<.$..
.G..d<P:[email protected]%..i..A..)...Md.D.Q...l....?...*..b'.v..'.w..g..
[email protected]........*(......p.B(.qZJ.....'...Zh..n.)..b:*..F.j$.....'.....
.........!......D..!...k...Z........V....FR.1.$......ZX.}..ma........n
......]....A..x..w..F.`.....Y....D.`U8..B\(..28.`..~ ..#...W.R,q.....e
.0...,.Q..0...r4..\.8....<[email protected]...@^ .B...L7.4}[email protected]..#..
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/lb_ico_v1.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:03 GMT

Date: Fri, 03 Apr 2015 09:48:03 GMT

Server: nginx

Content-Type: image/png

Content-Length: 652

Last-Modified: Fri, 01 Aug 2014 07:21:22 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive
.PNG........IHDR..............Fg.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE......................................7........G.....=..V..
...1..=.....b..c..L..E.....^../..l.....n...!%...-..4..K.....]..>..w
.....*..f.................2../..M..D..\..J.....W.....0.....j..c.....,.
....Y.................J..6...../..a..X..Y..R..f........s..6..k........
k..........ZtRNS......................................................
.......................................o....IDATx.b....0..S....L.!..".
.@4;B..../7L."f.`....d.C..8.CM...."..v...I. ...Fr2..\5Uy..=.X#m.#.t.@b
^...!.*.L...0uZ,.>.<"f...p..6.....p..#H.\..f.F.....B..vdD...0\..
PB..Hy.pA......BZdJ.......IEND.B`.....


GET /flashzt/img/zmxy3/zm_add.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 10:14:41 GMT

Date: Fri, 03 Apr 2015 10:14:41 GMT

Server: nginx

Content-Type: image/png

Content-Length: 6369

Last-Modified: Tue, 13 Jan 2015 07:48:19 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive
.PNG........IHDR.......G.............tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:70D8E8579AF711E49A46A9E9
9F340B05" xmpMM:DocumentID="xmp.did:70D8E8589AF711E49A46A9E99F340B05"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:70D8E8559AF711E49A
46A9E99F340B05" stRef:documentID="xmp.did:70D8E8569AF711E49A46A9E99F34
0B05"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>H.......PLTEW.K..................R......"..
.......-..j.......k...WV]e....w..e.W..m.........V.....-......z.#.....X
P....e. .......n3.....X.....................z.......\..............k..
y,C..t4RdF}.......w..h....\y. e4.........i.R.7...v...g...d..A..S......
....v.............R.x.....0t.............2s..........=...8zOe..1......
.....p.....m..)..............g.Y...?..Y.....$..a.X\...S...O..jM...P...
jh.....i.....Wn.......a...^.,-.E....x......T.ey..............(O..~....
..?.....v..NN...Q.............1n..&......S......].......=|.......?....
.......^..%R......l...{..%`..(M.3|jwxu..i..#.....2..............C.
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/c_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:28:06 GMT

Date: Fri, 03 Apr 2015 07:28:06 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 160

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a................s..............!.......,..........e......I..8...
.`(.di.h..l..p,.tm.x..............r.l:...tJ.Z.._p.h<...xL.....z.ng|
.-.......~.....np.r...;....


GET /flashzt/img/zmxy3_20120913/bg_6.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:28:05 GMT

Date: Fri, 03 Apr 2015 07:28:05 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 13918

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a.............%''................................................
..g..Veff..............I...............kmmbaJ.........TUU......u{{! .}
....z..gmrr.....f............y|}............333......X\\.........ejjBD
D...^cc........\...qo7JLLBB5VVV.....>.....................:==...NQQ
...VYY......EJJ..lpuu.........>@A..[.....O...WbZ79:B@#..M....005A9.
....V........WIMPQO$..............................21'......qqq........
..........;>M...........................a_-SWW.........!"".........
......agf.........sxxjoo.$.477...ISQ... --10.s..RQ>[__...DFG.......
......................................................................
....z..............D..........................fpl...qwv......ghi......
.............................................186...FHI', .............
..sts........i.........!.......,...............H......*\......#J.H....
.3j...... C..I....(S.\.....0c..I....8s........V..J....H.*].....P.J.J..
..X.j......`...K....h..] ...U....;Bn..x............L...... ^......#K.L
.....3k....g.w.........?.^......c..M.....s...zo..p...M...... _........
.m0x^...k..........g.}....E.X.........O...............(....h...&....6.
...F(....h.iveH.?.v... .(..$.h..(....,....0.(..4.h..8..J.<....@.)..
D.i....v.A.%y..PF)..TVi.......\v...`.)c...7..b....l..f.Z.)..t.i..d...@
..w....*.. .I...&.....)P.v-*...V..%[email protected]..........).tE...
...*f......P...|.. ..8.J...&k.|.6....F.!8.Vk..J.*...v.*... ....)......
....n..Vw.....&........7....<%...l0.e.{n.Z..J(Dx(.3.W.-.B6.p..Nl...
....D&..:..L..^|..:..,..S.i2.*..2.3....|..c..px................?..
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/sszn.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:04 GMT

Date: Fri, 03 Apr 2015 09:48:04 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2150

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89aS......1.....)..N.....B..=..m..J..$..2..>..........."..R..E..
.m....6..J..*...........t..f..<.....6..8..>......\s.}.2..S......
..I..T..A..A..,........5.....E.....D..<...Vk...].....P.....O..b..$.
.a.."..Y..Z.....-..H..%..*.....i.....(..6..6...........^...........T..
!..@..:.....=../..&.....#.. ..&.."...d|...U.....$..9..4..?........a..[
[email protected]*........%........g..e..]..Y..U..W..Q..B..?..F..?..9.
.;..:..(..........................?..L..>.......s...Z.....<..F..
[email protected]........@
.....c..&..1........F....z<.....E.....Q..I..:..7..:..7...........W.
.;...u.;[email protected]....."..D..D..!.....-..
...q..D..L...u.M..=..G...........!..<..b..e..9..R..8..8..D..9..H..I
..K..:[email protected]..(..Y.....8...a....!.......,....S.......'..% F....*\..
.......UK.@\.8D.&...P a...`...W.......Z..u3bdV.....:....$@.(R....(QbIZ
....M.Vi.. . J.d...K..h.D.z.(....r..f...3gH.|....#J....c...:..h....!b.
\.`......I.<..)IP..Je...Qe4L*...(P.<]Z....K...2c......h. ...-{.x
.;G0....(...1...)_...T.J.H...,H9L.R_.:v..'.i....,.K.......o.4t..F.....
.Q& ?.(..-.lF.%...N.h.SJ(....Yd..V.....0....?k.5".y..E.^.....!'...PAc.
..3......eKA..'.Q..-...O..F..k.>..(#.d..W|..2.....]....`...1...e._.
.c.^.Y.-C.b....p.$..u.YS.P.G..T.I.|..?.2....2..1.V....F..TD...&z..J ..
..H....(.vT..o..b...Z.'.e*Zk.f.Z.;.$X$)..4./.|..G..!B)..Z..V..G..BJk..
.. .....u..".?.A.@ ...*.".......K.......>...a&...a...?Sm..g....A).P
A ..r.... ..#H B&.....H\.-.'...?.....l../'[email protected]... .
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/scbg.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:28:06 GMT

Date: Fri, 03 Apr 2015 07:28:06 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 5156

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a..M.....;*K..T....jn./...[...pD.G6....G4s. ...........l.te..G.}l
......qOJk&........J6.YM.gX..e.*1yc/1pj.gi{.E:~y...sV*..U..qp)......g.
........%(-Dy.....VS.....Z....ZLg..t ...K......e...zn0RVLTW.....p.....
......Hx14j=B...SL0.yw..pI~...6.....[P......k\..Q.eZ..f.?,Q<*X.....
..I_........f*.weWx.7........s..vu.'...Cx.@^&8F8..s..{.....ND\jf......
fah7...k.......fd.u....Z......2...t..@[email protected]:Zd3B.......r..f.....
...F..C....S....9W`TvFlD.t%...q........v..P.......~k........xY/#..\.oZ
|4..cP..~..............i..^.....L..\e ...U.{h...........m.ve..........
xa..V.aR..p........IO|.G|.b.......c.....s..`...Y...........Iz.Y..z.'..
u..p...\.6..G......m.$....xpq..[e].....^..\[email protected]...>"$...J.Jb. ..y
.~~{.(;fN..g'..|.)..}......A=G..r....o^..........xe..!.g$*Y......r..p.
.h..c..m`.......s!.......,......M........H......*\......#J.H.....3j...
... C..I....(S.\[email protected].*].....P.J.J....X.j.
.....Mc......}h..]..m......K....x............L...... ^......#K.L..e.S.
..!p....B..M.t.='NxHa.....c..M.....s...........N...... _......y?.<.
...I.i....w.om..........._.........O...............(....h...&. }I.3]u.
...?I.c...f.....a!"..f..7hh..(....,....0.(..4.h..8....<....@.)..D.i
..H&.......@....>.Ti..Xb............#6<.Z.h....l....p.)..t.i..x.
...|......*....j...&......O>.8...S....6.gA..T...<lr.!.4j........
.......*....*...>.!.T.......Z. ....=<.H..6....F ...Vk...R....J. 
.%[email protected]. ,.o...2.|..*.$.....k........j.).QV..!.e....yj,. ..........Wl.
..g....n.k......$.y.......U<.....,..4.l..8...........,.#..P,..|
<<< skipped >>>

GET /flashzt/img/zmxy3/n_mg_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:32:07 GMT

Date: Fri, 03 Apr 2015 07:32:07 GMT

Server: nginx

Content-Type: image/png

Content-Length: 1920

Last-Modified: Fri, 14 Jun 2013 09:48:10 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000
.PNG........IHDR.......f.......|7....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:1D872F76D4D111E292D2D069A2
92083F" xmpMM:DocumentID="xmp.did:1D872F77D4D111E292D2D069A292083F">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1D872F74D4D111E292D2
D069A292083F" stRef:documentID="xmp.did:1D872F75D4D111E292D2D069A29208
3F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>_t.8....PLTE......y..G..<..;.....`..b.....
t.....}..g..d..c..{..a........~..u..e..p..j..l..k..o..i..r..n..m..w...
..x..>..?.....s..v..|[email protected]..=..[..F..V..Z..C.
.U..R..K..N..L..M.....C..D..?..B........E..Y..S..A..X.._..T..Q..P..^..
W..A..:..J..M..f..\..=..a..]..}..:..9.................f..2..q..d......
..c..j.....*..{..e..<..v..z..^..E..`.....^.....K..x.....d.....a....
....-..h..|..`..l.....1..k.....................LIDATx....VZQ.E.#I.`.D.
 *M.4..$.w......^.y..u_c~o0....X.q...A..`.h....9.;_.2.;..g..[.@[e...[.
.Z.........OS..B.,...3}.b*U...........C.n|HF.I$7..I..5H.J......R.M
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/ico_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:04 GMT

Date: Fri, 03 Apr 2015 09:48:04 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 44

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000
GIF89a........@m...!.......,...............;....


GET /flashzt/img/zmxy3_20120913/tgbtn.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:08 GMT

Date: Fri, 03 Apr 2015 09:48:08 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 1672

Last-Modified: Fri, 13 Sep 2013 02:12:53 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive
[email protected]. -. .........".'&.)%.($.*...............
.......................................!..XMP DataXMP<?xpacket begi
n="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adob
e:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:
56:27        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22
-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights=
"hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com
/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceR
ef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False"
 xmpMM:OriginalDocumentID="uuid:4184B9D9CCF8E111BB4D96CAE4A07F0E" xmpM
M:DocumentID="xmp.did:4FCD00351C1411E3913B8A3F3EE50EB9" xmpMM:Instance
ID="xmp.iid:4FCD00341C1411E3913B8A3F3EE50EB9" xmp:CreatorTool="Adobe P
hotoshop CS2 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.
iid:2A653C2E141CE31180E9A4FB6B745738" stRef:documentID="uuid:4184B9D9C
CF8E111BB4D96CAE4A07F0E"/> </rdf:Description> </rdf:RDF>
; </x:xmpmeta> <?xpacket end="r"?>........................
......................................................................
....................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]
\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! ...
..............................!.......,[email protected]..%.tm.x.
......pH,....r.l:..([email protected][email protected].`....z..4`.f...x[....x.....!........}_
..............`.........._...............................^......a.
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/bg_8.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:32:08 GMT

Date: Fri, 03 Apr 2015 07:32:08 GMT

Server: nginx

Content-Type: image/png

Content-Length: 9570

Last-Modified: Fri, 27 Sep 2013 02:27:37 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive
.PNG........IHDR..............P......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:61621FFF271B11E3B6A0AAB9
5D0E2A6B" xmpMM:DocumentID="xmp.did:61622000271B11E3B6A0AAB95D0E2A6B"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:61621FFD271B11E3B6
A0AAB95D0E2A6B" stRef:documentID="xmp.did:61621FFE271B11E3B6A0AAB95D0E
2A6B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.l......PLTE.b..................oq G.......
.V......l.6......445..........sr....FG......uvw..HCEF........."##Z./..
.........i.....R.......`..4,Q)<.wvf..\aaqKI.Y..n-cee...Q?1......x68
...............UWW.1ondX.............:@.,{..o....RM.......O&....F$..*.
4..Nh.....2|...Ta........O...nrr.!...l.....Q.......W..12tzz.[8...{}~P.
....knn........{.EbNRR...........]....|............Reij.$#.......P...b
..n....-^...._fyoc...D.*...q!#.......f9...d_T5...Cx:OF",1JLL...YUM....
.....> '....... %..z...~....F...............<>=............82
 .............kwL_\...............;'2..........l....Zkg..B.E3.....
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/faspbtn.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:08 GMT

Date: Fri, 03 Apr 2015 09:48:08 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 1723

Last-Modified: Fri, 13 Sep 2013 02:12:53 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89aM...........................-. ,. &.)(. %.(%.(..................
.......................................!..XMP DataXMP<?xpacket begi
n="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adob
e:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:
56:27        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22
-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights=
"hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com
/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceR
ef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False"
 xmpMM:OriginalDocumentID="uuid:4184B9D9CCF8E111BB4D96CAE4A07F0E" xmpM
M:DocumentID="xmp.did:4FCD00391C1411E3913B8A3F3EE50EB9" xmpMM:Instance
ID="xmp.iid:4FCD00381C1411E3913B8A3F3EE50EB9" xmp:CreatorTool="Adobe P
hotoshop CS2 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.
iid:2A653C2E141CE31180E9A4FB6B745738" stRef:documentID="uuid:4184B9D9C
CF8E111BB4D96CAE4A07F0E"/> </rdf:Description> </rdf:RDF>
; </x:xmpmeta> <?xpacket end="r"?>........................
......................................................................
....................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]
\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! ...
..............................!.......,....M......`qPdi.h..l...R.tm.x.
...d..pH,...dR.l:...tJ.V...6..t.X.xL.s.[s9.]o...\N.s.s.=..G.x.t...yq..
.......ed.....c.............e........c............................
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/libg_2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:42:44 GMT

Date: Fri, 03 Apr 2015 08:42:44 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2223

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89aK.^.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!.......,....K.^........H......*\.._.....`....5I2fD..#.. =.
.)....'I.D.1......C.oI.-M.8i.._..>w....h.'...t....'N..L.....T.6..e.
?$JfF....)[email protected]$.c....)[email protected][email protected]{[email protected] h."
.. i_h.B.`[email protected].%A.L......". ..6h..@^.@..... ...
.... .0.U..S.....Bi0....$a..................`..jI.s.&.%....br.?......0
h....2....#....(".f..a|OX...,......U....h#[email protected].....*.......
.D.H<AC.KV._.4...?p.a.......I8...`Zi..O....|.i%.`4A`..( g..l...M.b.
.KZ...2:....*.B.mn..$..9I.;"..(.T.... ...h0......E.e....6..BK.4....-..
.W2>.%.,.........#[email protected]..."zb....B..!R.J.O\1...Np..e.1.......Mp.#.
......../..,Kl.2.....0....*.B...!G..'...K..E'......:1.#......NqA..]0E.
Z|@2..h..-.h.r~.,`K.b.<s~..A.?u..s~.......;.}^.....,}..c...$.Hm
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/more_boss_s.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:09 GMT

Date: Fri, 03 Apr 2015 09:48:09 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 3201

Last-Modified: Tue, 18 Sep 2012 02:20:38 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a..*....D..^..D..B..J..Y..X..K..L..W..P..M..U..T..Q..M..O..N..U..
V..R..S......................................{..............}..|......
..............e.....~..........................|..`........Y..........
.k...........].....m..b........z.....|........a.....^.....V..w.....Z..
W........\..n...........h...........r..l........o..g..d.....z..u......
.....y.......................u..w........_.....v..x..D.....o..X..l....
....o.....d..b...........j....._..s..T..f.......................^..f..
..................t..[.................h........`..i..y.....c........q
.....p.....N..i.....b..O..G..[..]..F..\..I..F..\..^..E..`..C.._..Z..H.
......................................................................
......................................................................
...........!.......,......*......9...Q....*\......#J.H......%.$..!. C.
.I...C.n-[.....0c..I....8s..I.. [email protected].....$.X.....P.J.J....X.j.JU...`
...K....h..].....j...K....x............;...... ^......#K.L.2dc.3k.....
..C..M.....G.[......c..M.....s..m........N...... _.......K.N......k..}
;.8.....>........_..".m.o..........C.;/8....&..7...&....Z....&..3.D
.... ....Z.....`..$.hb.%8....X..........P..8...(8.x....)..D....5$Y..E.
..354.@/H..d..8...H8#F..X ...8....$.eG...$.^.(.._.........w..g.58....|
...A.X'..6*e..D*...N.`.......l...e.$..^L.d..tIC....A.Hh..(...*...Fq)..
X: ....&..jZj..N....n ..)D...4.!m.eF.*..t....~.`......V.I...z..3.H.n.C
8....h ......3W8..... .3..!......... .... .34t[...Z....l.....|...jP...
..q..\.m..X...6..3.<....>....=g./..2... 4.i..(... l...?.I...
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/more_zb.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:09 GMT

Date: Fri, 03 Apr 2015 09:48:09 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2770

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a.. .... @....,`.Ei....i..O{..ggw.............x.......jR.......xg
....[P.m)........j..*......Qq]..*[email protected].&.....k...N....>h......r..
.............;..8&.........,. Q.....................p...........6...!.
......,...... ......pH,.....Bj.L..tJ.Z...v..^".pd..D...z...<!.|N...
.BX.9....x..........!.#G".%>......>.`|................%."E"...-.
..%.{b... .........B#......:...!.{}...........?............{~.~......%
.BX......j:.....E.o>@..c...~.3j..B..K'j....D..|"HP..B.. ...!qb.?.f.
[email protected]....>H.x..;..e..0Q.M{F...K....H...H.-....,.aB
...,[email protected]...... ^......#K^[email protected]..
M....4l..a...../@........=..K... ...N].....k.......f.....x.7...^..y.4,
.............4......=..g.t.. .y.%[email protected].....\.... ~8@..!......
@u.......(C...8#.8...|.}..........v.i.I..t0..C.:.p  .M.....`...nH@.`.)
&......c.).....!.p.i.t...b.m.."w1d.g.;zdA}.l....-......_5.....c.s..2.0
C.b.0]...*j.......d....6`!....$u8..gu.\...p.Qj.)n.......u..0j...y.wji@
[email protected]..@`..VUp....k...|....".....:.j..B.l....l..:0....K@...)....k....
...8.J..'....3.. ...k... ...jU....^ .i.....z.6....0........g......'./.
...?..3.3h.....[/.7..)..#.........||.....C..|..RK.x...ApU.VE..D.YPp.R.
....J<C.......v8.......n.....>.....-.....i.0\....l.0.\ ......w..
.nv.J]P..l.....p'g.......0t..zQ.....PNq...`..........,[email protected].
{.=:.3t.u....).=.~....`m..e.{K<@.C.....n..2.`.........e.j....h..M..
Y. V.f.<.ZH{f....4..),|[email protected]......`..lmf.*....-.@`.A.....-j@..
....b..J...LL...`..rjf~......&z..2....H.22.Y#$..!6,.0.......e.1...
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/bg_9.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:42:41 GMT

Date: Fri, 03 Apr 2015 08:42:41 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 9202

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a.......022/Q\..J..c......uxx.......T!...j._...egh......u......e.
UXX....A#.....b.............y]......]aaLuz..........,..4..............
.....G.|oO)...K......w..........c../[email protected].........
...........L"c.......q.....8..........g...-.Y............)............
..K............z~.........%.I"....d>..\........z...i...Z.....X2...2
......S3.....6.....z..9.gN.....{'...Y...........<$.....|......>x
.lpp.E0......PTT...........f#...mN.Y"....n?...-d....,/..`........E"...
.^.......^......O3.r..sN.......C ........'9L.......m[@...s...f(..S....
.........\@.f..#.....`...3.J/xsB:......wM....g.,G..D(..-.......s_QVH..
.....y..........s..$%%.......P"................V!.....................
........F......................J0HKKTJ:3b...o.x..........[....._y^\.}.
n..t..Vu.j?.........!.......,[email protected]......*\......#J.H.....3j
...... C..I....(S.\[email protected][email protected].*].....P.J.J....X
.j....O........X.h..].....p...K....xo..I6.......L...... ^l./..8.3.L...
..3k....d.....M.....S.^......c..M.....s...........N...... _.\7hh2...G.
.....k...........O......._.........O..y?..........=.]M5.g...&....6....
F..~.Vh...v.`L.I... .(..$.h.......,..!L.....4.h..8.._.:..#..uX..D.i..H
&._0J6.d{..9..TVi..X..d.\r.%t.N...d.i...m...?~...p.)..H.I..'..!.|.....
.i.:.(.D..(.. .6..X{:*...V........;.".....D .Zj.w..).....*.....C.;|*..
..*..............kl........z...F...O.z....y...v{c.......2`...nrL.}\s.1
..0.............. ^ ...@#.*.........l....?..1...]..g....S... .,2.}Tw.6
..l.1(kc1....V...2..0..3...w...B.....p.......h .....,5..\.2u'...uu
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/c_4.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:04 GMT

Date: Fri, 03 Apr 2015 09:48:04 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 81

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000
GIF89aB......j.....!.......,....B.....(D.............g`x.H....j......L
Gm.....@..;....


GET /flashzt/img/zmxy3_20120913/t_5.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:06 GMT

Date: Fri, 03 Apr 2015 09:48:06 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 5473

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89aB.6.....{.N...r...........................................y.....
j..........................\..........................................
........1.....T.....@...........|J:.........e.........................
.I...........................................................$p.......
......q..........................2y.................d/.[...........Y..
...................s.n...............k.....[.g...........}3.......}L..
............................................o\........................
.................#....................................................
....;.......u .YH....................%................................
...............z....Y.....x.........2................uJ...........&...
..........w.....9#...........................j........................
...........!.......,....B.6.....I....E.z..*\......#J.H.....3j....G.9^.
. p.. ...[[email protected]........`
..../HA$c..]...Z$....K....2........U...L...... ^..n...#K..x....yV...2.
.`[email protected]:. ..................N...... _..8....w.....y.x.k..
{.......O.....u.....'0.f....>p..V........=.H.~.qI*.&....6....F(...V
...#....3P`..c.(..!.P...T.".)...~*.rK&..Q.!.....<[email protected]
'$6..-..)../....Xf.....B.1~..J#~.B...l...l....p.)..t.i....c..|.!.{. ..
..Z...\$p....Y....BG"[email protected]...*..................".........@..
k.U........&.$BG6v.1..:... k.!...Vk...f....v.........,2......-{.P...(P
....k......<~d..([email protected],.....kl.,.L.3.....FR....!.$
`. ..,.Ze=0.,..0.bH"....!. .@=....!..cG.4'.t=.....J_`..P....1C.A..
<<< skipped >>>

GET /flashzt/img/zmxy3/jcsp_1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:05 GMT

Date: Fri, 03 Apr 2015 09:48:05 GMT

Server: nginx

Content-Type: image/jpeg

Content-Length: 20782

Last-Modified: Thu, 07 Nov 2013 07:12:52 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......d..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp
MM:InstanceID="xmp.iid:44F48F38475111E3BBCCCE2D9E5A3778" xmpMM:Documen
tID="xmp.did:44F48F39475111E3BBCCCE2D9E5A3778"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:44F48F36475111E3BBCCCE2D9E5A3778" stRef:d
ocumentID="xmp.did:44F48F37475111E3BBCCCE2D9E5A3778"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
....................4.................................................
.................................................Q...$..&6....RC4_W.
!1A"..a#23d.E..q.bcD.V.Gw.........................#3.aC..4.U..!."B..1A
c.Qb$.q.2.....S.euE&..R...D6............?......2..trGz<..nn...i.3._
s;.......z...FVg.&.VFv&f.Q......8G..o{..Wy...J.Zj..<6..$.p.DT ...JR
.*Q.I3.6.0..&~M..~.z[...aN.T5..e......a.Z...b..D%%)I(.....E..........t
Ir.]s...w.. [email protected].*1..1..WD..
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/c_5.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:05 GMT

Date: Fri, 03 Apr 2015 09:48:05 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 180

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a.......j.....!.......,...........D.................H............
...............fL*......J...df.j............N....{X~....... ......(8..
Gx......Hb..)9IYi..y......Y..:JZjz:.P..;....


GET /flashzt/img/zmxy3/zb_nav_20131205.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:42:44 GMT

Date: Fri, 03 Apr 2015 08:42:44 GMT

Server: nginx

Content-Type: image/png

Content-Length: 5455

Last-Modified: Tue, 03 Dec 2013 06:48:22 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive
.PNG........IHDR...X...4.....a.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:5A84F4695B4311E3B1C990F5
C16B460B" xmpMM:DocumentID="xmp.did:5A84F46A5B4311E3B1C990F5C16B460B"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5A84F4675B4311E3B1
C990F5C16B460B" stRef:documentID="xmp.did:5A84F4685B4311E3B1C990F5C16B
460B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..$....pPLTE.......I.?V..G.........:..=....
....I........G...........J.....7..|..{..1..o..q.W..[..l&..!..[.U......
A.`.....f......f..G..>..&..,..A..c.x8..7.s0..P..W........K.z9......
.....~.v4...........6..............E.q-..^..r.}=._...6..i..u..n..]..-.
[email protected]!.Y.._.....t9..#..I..R..V....{<..%..&..
...x.....y.Q......D..u..E.....L.T...K..U.x7.l/..{...._...e..f..n.Z..W.
..l..u....i*.U...j..g..(..B..J.t2.o*..7..;...........Q..P..W..'.].....
.}....|<..v..Y........j..j.....r..........P...<..)..$..N.d..{;..
C.....F.c...i.....p.....6..t..p..T.....O..H..d.N...x.\...h.R.....e
<<< skipped >>>

GET /jss/lazy_iframe.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:49:40 GMT

Date: Fri, 03 Apr 2015 08:49:40 GMT

Server: nginx

Content-Type: application/x-javascript

Content-Length: 1268

Last-Modified: Sun, 10 Nov 2013 09:24:37 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive
function F_Resize(h){..document.getElementById(F_FRAME_ID).height = h;
..//window.scrollTo(0,$("#" F_FRAME_ID).offset().top);..}..var get_scr
een_height = function(){..  if(window.self&&self.innerHeight) return s
elf.innerHeight;..  if(document.documentElement&&document.documentElem
ent.clientHeight) return document.documentElement.clientHeight;..  ret
urn document.body.clientHeight;..},..get_scroll_top = function(){..  i
f(typeof(window.pageYOffset) != "undefined") return window.pageYOffset
;..  if(document.documentElement && document.documentElement.scrollTop
) return document.documentElement.scrollTop;..  if(document.body) retu
rn document.body.scrollTop;..},..get_offset_top = function(o){..  var 
offset_t = o.offsetTop;..  while(o=o.offsetParent){..    offset_t  = o
.offsetTop;..  }..  return offset_t;..};..function chg_src(){..  var s
creenH = get_screen_height(), scrollT = get_scroll_top();..  var ifram
eH = get_offset_top(document.getElementById('CommFrame'));..  if (pars
eInt(screenH) parseInt(scrollT) > parseInt(iframeH) - 200){..    do
cument.getElementById('CommFrame').src = F_URL;..    $(window).unbind(
"scroll", chg_src);..    $(window).unbind("resize", chg_src);..  }..}.
.$(window).bind("scroll", chg_src);$(window).bind("resize", chg_src);c
hg_src();......
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/t_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:31:35 GMT

Date: Fri, 03 Apr 2015 07:31:35 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 599

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a.......D..s....................!.......,...........H...0.I..8...
.`(.di.h..l..p,.tm.x..|....pH,....r.l:...tJ.Z...v..z.`. @.....z.n....|
N.....~...............................................................
......................................................................
...H...J...#&.....#J.H.....3j....... C..I....(S.\.....0c..I..M...a.i..
[email protected].*].....P.J.J....X.j......`...K....D..K.`.Z.p...K....x....
........)...... ^......#K..x0%...`.......C..M..d.....d.....c..M.6_}...
.i........N.0n..X._........>.......k....V...z.O.......EN,........w}
a.............c....h......B.&....F(.b.&..;....


GET /flashzt/img/zmxy3/bg_3.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:31:35 GMT

Date: Fri, 03 Apr 2015 07:31:35 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 19606

Last-Modified: Sat, 09 Mar 2013 01:57:08 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a1.......<..sN...csS...............t.&0M......y..4.........mY.
.....U..H.........Fh..."..&..9............P.......Z........un.)..*....
.).................Ua.........t"V.......X..A.........F.......e........
m..s.....*.I.z.i..3H^1.j.........C..q..............K.f................
......5d...-.....q[....p...m6....R%.............,..#)..x.K....jTx.....
..............)q.zh3H.......5..gs.............[hM0.....U........ayb...
;....P...M..<....."..M.G.........5..p..0......~.1..............H...
[email protected]; ........E..=.....x.........?I3.
.0.................?..R.................8.....`Y.....1:.........Y.....
*`....X.............................P..W............j. ..?.......=5...
.........>|[email protected].....![[email protected]....._..\....
.......O........B..?!..XMP DataXMP<?xpacket begin="..." id="W5M0MpC
ehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk
="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> 
<rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
; <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/
1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:
//ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Phot
oshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:C049D57D87B311E2B164820
45EDE6CCD" xmpMM:DocumentID="xmp.did:C049D57E87B311E2B16482045EDE6CCD"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C049D57B87B311E2B
16482045EDE6CCD" stRef:documentID="xmp.did:C049D57C87B311E2B164820
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/b_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:28:08 GMT

Date: Fri, 03 Apr 2015 07:28:08 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 610

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a.......D..s....................!.......,...........HJ1>..I..8
....`(.di.h..l..p,.tm.x..............r.l:...tJ.Z.._p.h<...xL.....z.
ng|.-.......~.....np.rCt...........Q.@\].............O...B..v........|
.Z.D__........&.q..............................u...........]E.u.......
.........H..A%... ......#J.H.....3j....... C..I....(S.\.....0....C^..8
[email protected].*].....P.J.J....X.j....Pi5........h..].....p...K...
.e............L........[i!.y.#K.L.....3k>.X,...C..M.....S.^......c.
.M.....s...........N...............K.N......k..........O......._......
...O.............'..(....h...&....6....F(...Vh...f....B...;....


GET /flashzt/img/zmxy3_20120913/right.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:32:06 GMT

Date: Fri, 03 Apr 2015 07:32:06 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 1037

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a.......G.....O..B....................c.......................k..
..................\..@..>...........t..............................
..h..b........w.....a..e...........m..............z.................R.
..........p...........g...........q..~.......................t........
...i..a...........................................................x...
..............m..............}........................................
.......}..{.....l..l.....<.........................................
......................................................................
......................................................................
......................................................................
......................................................................
.................!.......,.............<.H...;..*L.&...2...# .B....
1b... .2......*i.0`.....$!..`.....00......`^,X....;=.4.a.L.6=.4.9.Q.?.
.....AL...X.c!..#....4 P.:C..Y..$...~T."GHZ..`L.....D]I..Ab..3,.h.z...
.o"DX.G...3.qx......Hv."bG.9O.Tyy1c.C&.. CC$I..&L.r....$...8.K...;nt>....


GET /flashzt/img/zmxy3_20120913/b_2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:06 GMT

Date: Fri, 03 Apr 2015 09:48:06 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 250

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000
GIF89am..................J.....H..R.....c..............3.....g..W.....
...4.....f.....V..j....................!.......,....m.....w.uidi.h..l.
.p,.tm.x..<;A.IoH,....r.\=0.A.I.Z....W.8...vL...h....4...#M...x.c  
4.....................................m.!.;....


GET /flashzt/img/zmxy3_20120913/b_3.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:07 GMT

Date: Fri, 03 Apr 2015 09:48:07 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 248

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a\..................J.....H..R.....c..............3.....g..W.....
...4.....f.....V..j....................!.......,....\.....u.uidi.h..l.
.p,.tm.x....E..pH,....rYz`(..sJ.Z..,.Pq....xL...(...h....zN... .@@h...
.................................l.!.;....


GET /flashzt/img/zmxy3_20120913/b_4.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:42:42 GMT

Date: Fri, 03 Apr 2015 08:42:42 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 244

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89aB..................J.....H..R.....c..............3.....g..W.....
...4.....f.....V..j....................!.......,....B.....q.uidi.h..l.
.p,.tm.x....I..pH,...d.......tJ.Z..B..0(...xL.*..@. .0...|N.0..B#.....
.............................i.!.;....


GET /flashzt/img/zmxy3/zrsp_1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:07 GMT

Date: Fri, 03 Apr 2015 09:48:07 GMT

Server: nginx

Content-Type: image/jpeg

Content-Length: 11256

Last-Modified: Thu, 07 Nov 2013 07:12:52 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000
......Exif..II*.................Ducky.......d..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:AF608084475911E3A7AFC49BE
0AFFEEA" xmpMM:InstanceID="xmp.iid:AF608083475911E3A7AFC49BE0AFFEEA" x
mp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:4C2A5E3F475111E39230A2E5FDEDE007" stRef:d
ocumentID="xmp.did:4C2A5E40475111E39230A2E5FDEDE007"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
....................4."...............................................
...................................................Q....6..bC$45.&F..W
!1.%A"#.a.q2.9...R..cd.UV8I..........................#3.!Qa..4..1"BCU.
..A..c.q2$.b...7....rT...S6.............?..U........U.......3..u...}..
...n..T.D...t..R.d..\..8..Q.g.^.x...Sj.........U..y...g...5........*mS
=..>...!J...=s....]F...z}.X7.M.g.tg.:c.)W.Q..w..W...3..O......L.N..
GL|.*.J<...3..u..{u...`..6.....h....^.G....q^..X.n.>.,....3.
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/t_8.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:26:34 GMT

Date: Fri, 03 Apr 2015 08:26:34 GMT

Server: nginx

Content-Type: image/png

Content-Length: 4901

Last-Modified: Fri, 27 Sep 2013 02:27:37 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive
.PNG........IHDR.......4.......K.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:54C77830271B11E381D8EC9B
4F192540" xmpMM:DocumentID="xmp.did:54C77831271B11E381D8EC9B4F192540"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:54C7782E271B11E381
D8EC9B4F192540" stRef:documentID="xmp.did:54C7782F271B11E381D8EC9B4F19
2540"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>&..'....PLTE...w}~...n....g...........73...
......wSN........a............(.l....?..H.............................
H.e.|....-............y....L...e.h.f.../.v..u/-.......&....7...k../ ..
.......q5..........l..W.k....n......X.xG...T(.....N,[email protected]
.....s.W.y......)).C.....E.z.nwM............w.eP....%.....x..R..{Pwn..
.pvv..............$..o...$..2..............H.....v.......... lO,|ue.r.
............8tv ..........<]q].^.................~...g..6..........
.....k...u!....j.:..O.................................................
.j.............................$p.q..N.................2y.......].
<<< skipped >>>

GET /jss/news_footer.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 10:33:26 GMT

Date: Fri, 03 Apr 2015 10:33:26 GMT

Server: nginx

Content-Type: application/x-javascript

Content-Length: 961

Last-Modified: Sun, 04 Jan 2015 02:52:24 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive
var cyl_footer_str = '<a href="hXXp://my.4399.com/joinus/index.html
" rel="external nofollow" >........</a> | ';..cyl_footer_str 
 = '<a href="hXXp://my.4399.com/joinus/contact.html" rel="external 
nofollow" >........</a> | ';..cyl_footer_str  = '<a href="
hXXp://my.4399.com/joinus/zhaopin.html" rel="external nofollow" >..
......</a> | ';..cyl_footer_str  = '<a href="hXXp://VVV.4399.
com/zs/wenwangwen.html" rel="external nofollow" >......[2012]0810-0
15..</a> | '..cyl_footer_str  = '<a href="hXXp://VVV.4399.com
/zs/chuban.html" rel="external nofollow" >........(..)..06..</a&
gt; <br/> ';..cyl_footer_str  = '...................... ........
.... ............ ............ ............ ............ ............ 
............<br>';..cyl_footer_str  = 'Copyright © 2004 - 2
015 4399.com All Rights Reserved. ........................  ........  
<a href="hXXp://VVV.miitbeian.gov.cn/" rel="external nofollow" >
ICP....B2-20040099</a>';..document.write(cyl_footer_str);..t>....


GET /jss/zmxy3_20141010.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 10:14:40 GMT

Date: Fri, 03 Apr 2015 10:14:40 GMT

Server: nginx

Content-Type: application/x-javascript

Last-Modified: Sat, 11 Oct 2014 02:18:28 GMT

Transfer-Encoding: chunked

Content-Encoding: gzip

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000
8b8.............Y.o....,...8..)..H9..6=tK..X.....i P..te..HJ.b..).aE..
y..2....X..A....a.P.../[.b...w.."%..S......}~......K!..f*...;8....../.
.s........[.....e.....dJ./...b...m..s7..Z..cS.w...,......X..)..5huy...
H]...C.Q.;.K.!`...n.>w;..x-.dW.u.......%.r.f7~..T.;r.d....)......D 
.m.5.37.&k.......D:.,.`[email protected]....`..%.v^f,.D .%~'.c)..e.mk..Dh '.
K...B.n.....R~....X.s&...P$J...0.T...xOx......T_......y.T......t..huU.
)-Y..........W.|..W..........?.......=x....w*.....g......Q"......q....
.<qJ.Z.......9.UO......<g......T9Y.......Fi..x.Ve".{>... .;.j
s...#%.......s..0)Q...)M e.. .....nh..../.n([email protected].
..6...3....y~.W..B.I...\..,....s.N2.........3.#..HJ.M...R....V..-...G8
..r..l..HW*[B......H.D9w].........PW}.L..Zsn6..U.h2.Dy......e..c..)b,.
>r>R..Z...O......t....][u.}./.. .^.lf.gi.H....\..`-..q.~...i....
o.H..U..:...kj..Du.H.,[email protected]|
.#9xM..d=....[0t,Qq....A...m.._O...!@.$Q.#)k...7B..X...zM.!.&..."L.K..
c..C3b.\......7f0.}.EmR..`.....SGuV....8....4.s..aJX..C6..Xj[.......U7
."T..@..[.~....*.hg,.....`.....p...".95p.{..g.......'O>....7......O
....T.._.............p...@.)..(...9|"..K$.4J........z.|...o....M9i.g..
q]..c6.......05.B..O.=p._e.F..Ho..L.4!..Y.v.X.:._..f.w..f*.e4aE..{PQU.
....H....]bJ.......ZM....x..z.B}.&W@C&V....E*.P'...$/c/\\22...'E Y_O..
.$k....VR/.2... ..'_.....@.&j....8...UB.7.U.6I.*..xq......w(t.E....s..
....H.!./.b(M9&q.m.q.K/./.LrC...k...<|H...B..v..<.(..P...e......
.z.^....x.H...."TyW.....i2./L.%#.0...].uz-.:L/...k.5........Zp.N.8
<<< skipped >>>

GET /jss/play_hs1202.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

Cookie: bdshare_firstime=1428057332914

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:47:10 GMT

Date: Fri, 03 Apr 2015 08:47:10 GMT

Server: nginx

Content-Type: application/x-javascript

Last-Modified: Sun, 10 Nov 2013 09:24:36 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=7776000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive
5f9.............W.n.6..n... ..X)..'......t...b.v...%Q..Y4D*...........
s...d.u]...S...?~.Gt.T.*D.~.n.3.JE..y......\._-.N...R-K...\.lI........
....'.... _.q[p.bsNVw.FR.vN"..=.c.i.;...`.q.C.u... .........m..#X.....
%(..?.....$*2...):..Ts..........n_N....2...b.u...J^.......&..Eu3`.mH..
.wnI..m*.....F.B .. ...5A -5.o.4..&...s...r.{.%c..L.`..6A3tB..q|yr..;1
k...E.....{g<....x....L........;.vNp:}."H.....IS.t.....g.>c...3S
.V.....K....8..b.]..9k...a......y.>..a. ^r._.....\W-6b.e....h.#.p..
{D...N.v...:Q......bJ....7.!....j.....T..vR$9On-....Tmy>.e.U...2U7&
lt;. cW%V.q......T....d.<H....GZ..h....MHdp..;.{V....c[p...1.R.2..V
.&....5.......v k-\....sr...u..n.....M....fK.5...I.].P....'.X....).N..
..*.y.)p..d,=.).T..-AF..,E.to..eA^.,.9......d.cL.S..:.O.......p....N.h
r....hre.....}.-.ZlL/U.J.... .. .Nym..wB.E.D...F....Z.mN.....e.M`...u.
.h/j.v.'..1Y.k1..#...dL..C.m.{eGj.Qb..}..:...Q..5}aMi.M...][email protected].....
.r......Z#..y..B;......$..m\sv.^..\.`...uB0....y.z68..q....0H.,..%..t.
...).-.6.....N......a.....3.bj......}....Q....n.f...9./_i.|.C.....`|..
1..-^G..h..Euk.y9..p..9..G.K.t.Q.8..........$<9u......._.c..<.J.
*....:3l.C......^.5........J.%..PT......=.H.;T....aB;f.%.gXw......e.{.
.|[email protected]....[./...k....yH<g..Dp..Eb.O.>.J.RTs.H..xM..@V...
.?$....s........B..p..@x*..1.....C]4...L%..P.. ...C....:..4...W...}...
/.q.]9D3x.......3}....tD3_.....{.)x.C...P.R..B..>..ey.t..B.#..r....
.[U.....o.=.6..6...w....g.[.....C.i....2.....c..\_.....C...B:F......).
^./.:us....A.."@s.[.Evq4.......4..to.t...O.6Lq..j.......<.N.?..
<<< skipped >>>

GET /upload_pic/2015/1/26/4399_17152503697.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 27 Jan 2015 07:39:34 GMT

Cache-Control: max-age=31536000

Content-Length: 2170

Content-Type: image/jpeg

Last-Modified: Mon, 26 Jan 2015 09:15:25 GMT

Accept-Ranges: bytes

ETag: "80b44c9e4839d01:388"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 kf49:2 (Cdn Cache Server V2.0)

Connection: keep-alive
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......*.D.........................................6.
.........................!.1"AQ..23Ba.Rq.#Cbr.$4......................
.............3........................!1A.Q."#2Raq..3.....r...........
.....?......)..y%[email protected]..`...iXY...>/......nD.9..
.......4Fy...U4.O.5..#.R\.T..........fd!..dm...X=.j.t^e..f.2%L........
.K...\_.KT.2..o...VQL.~....d.mN..]...T.eq.r7.=kz.....0E5..33c@.}4...42
..d.......ZB..1.M.TI$.O...[.$}@z..x..S.h....>..........V..m[].TM$.$
.S....xE...,N...Cy*...u..\../.....4...$.1.b...ab.wX......[!KIL..p?..F.
|Us..].$=...N,..oe.Z.M3.K2Cr.y&G......Wn..M...........)..3...d..W...@N
...7..7....Y.......Z..Of...5A..g#.5.fwSi(..g.....!.Amk.c......uu..*...
.......S...tp.1S..H,.U..o..,4..K.F5:.5......=.e|..54r...T2$.o-eG..G;..
.....'v..xN..@. $yoby....\.....#....|_..|L..z5KG..6...B.....7.|.... ..
.M]..Qs.......lU,[email protected]...,....O......i&.........T.....$.....
..<.[...'..S.......p.$D.S..k.)....$.2.e.....%...S.6.]..T.....LU:.D.
Ogu/]...Y.HXr...G.........#je..1........E.....r....?./G.,.*]._....h..&
lt;..E.n-...%>O.T....Y..YQ......rC. ....%.2TL.c?){...... s......0..
..<...Sug..'..w.o=.....L.Mu....fD\....L..f........l4.....p(...f..N'
..2.z.[*JTYeG>... p.Hb.@%.yyzrS.'.R.|>.,t.c.w[O.2.C...sdR[....e.
...5D...AA..............ND~"..Lp......r.=c.P{[email protected].... 
......urS..Mna!.......#..X\9.U5N.......4..N..=z...I..r..ak.s.K..#8
<<< skipped >>>

GET /core.php?web_id=30039538&t=q HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 751

Connection: keep-alive

Date: Fri, 03 Apr 2015 10:24:51 GMT

Last-Modified: Fri, 03 Apr 2015 10:24:51 GMT

Expires: Fri, 03 Apr 2015 10:39:51 GMT

Via: cache2.l2de1[611,200-0,H], cache21.l2de1[571,0], cache9.de1[0,200-0,H], cache10.de1[0,0]

Age: 637

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Fri, 03 Apr 2015 10:24:51 GMT

X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="30039538",c="",d="",e="o
nline_v3.php",f="hqs10.cnzz.com",g="",h="text",i="q",j="全ਾ
3;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="1
",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f
),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.c
allRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScr
iptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web
_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img
/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><i
mg border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a hre
f='" q "' target=_blank title='" j "'>" j "</a>",k.createIcon
([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: application
/javascript..Content-Length: 751..Connection: keep-alive..Date: Fri, 0
3 Apr 2015 10:24:51 GMT..Last-Modified: Fri, 03 Apr 2015 10:24:51 GMT.
.Expires: Fri, 03 Apr 2015 10:39:51 GMT..Via: cache2.l2de1[611,200-0,H
], cache21.l2de1[571,0], cache9.de1[0,200-0,H], cache10.de1[0,0]..Age:
 637..X-Cache: HIT TCP_MEM_HIT dirn:-2:-2..X-Swift-SaveTime: Fri, 03 A
pr 2015 10:24:51 GMT..X-Swift-CacheTime: 900..!function(){var p,q,r,a=
encodeURIComponent,b="30039538",c="",d="",e="online_v3.php",f="hqs10.c
nzz.com",g="",h="text",i="q",j="全景统计",k=wi
ndow["_CNZZDbridge_" b].bobject,l="http:",m="1",n=l "//online.cnzz.com
/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d))
<<< skipped >>>

GET /core.php?web_id=4073713&show=pic&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 752

Connection: keep-alive

Date: Fri, 03 Apr 2015 10:24:39 GMT

Last-Modified: Fri, 03 Apr 2015 10:24:39 GMT

Expires: Fri, 03 Apr 2015 10:39:39 GMT

Via: cache23.l2de1[873,200-0,M], cache60.l2de1[874,0], cache8.de1[0,200-0,H], cache10.de1[0,0]

Age: 649

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Fri, 03 Apr 2015 10:24:39 GMT

X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="4073713",c="pic",d="",e=
"online_v3.php",f="zs25.cnzz.com",g="1",h="pic",i="z",j="站ž
71;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="
1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" 
f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.
callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createSc
riptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?we
b_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/im
g/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><
img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a hr
ef='" q "' target=_blank title='" j "'>" j "</a>",k.createIco
n([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: applicatio
n/javascript..Content-Length: 752..Connection: keep-alive..Date: Fri, 
03 Apr 2015 10:24:39 GMT..Last-Modified: Fri, 03 Apr 2015 10:24:39 GMT
..Expires: Fri, 03 Apr 2015 10:39:39 GMT..Via: cache23.l2de1[873,200-0
,M], cache60.l2de1[874,0], cache8.de1[0,200-0,H], cache10.de1[0,0]..Ag
e: 649..X-Cache: HIT TCP_MEM_HIT dirn:-2:-2..X-Swift-SaveTime: Fri, 03
 Apr 2015 10:24:39 GMT..X-Swift-CacheTime: 900..!function(){var p,q,r,
a=encodeURIComponent,b="4073713",c="pic",d="",e="online_v3.php",f="zs2
5.cnzz.com",g="1",h="pic",i="z",j="站长统计",k
=window["_CNZZDbridge_" b].bobject,l="http:",m="1",n=l "//online.cnzz.
com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(
<<< skipped >>>

GET /upload_pic/2015/3/9/4399_18380750073.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga1.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 10 Mar 2015 08:39:38 GMT

Cache-Control: max-age=31536000

Content-Length: 2717

Content-Type: image/jpeg

Last-Modified: Mon, 09 Mar 2015 10:38:07 GMT

Accept-Ranges: bytes

ETag: "80513b21555ad01:388"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx38:80 (Cdn Cache Server V2.0), 1.1 kf49:7 (Cdn Cache Server V2.0)

Connection: keep-alive
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......*.D.........................................3.
..........................!.."12AQa.#3B...qRbr........................
..........7.......................!.1AQ.."2q...Ra....B....#$s.........
......?.....j<.\LQ.3a..4.q.....h....|.Vz=.hY-.'..y.b .."3`..$....}.
jMZ.......s.u....%o....r.(i=..r.....'.'.#^Rr...Kg..E....5...}uE9....yy
.V.O.R.....9iV!.D.^.f..9.&?/..;..=N.y.[&......?.b}..:.F.......UsI8r...
.=......".v=...........T[...&I.~.-N.......1.......W.y0...A..m{B.?..r..
..[h..........CF.k..!...O.. ...K............."....S...q.j)c1.rZ)*.=-!Y
..GS.3.B....R..48....[9....r....2.....(...0S.:.L........VF.....]kd..!u
R...N..../R..HB..'....~...Tk..O$r._.....J.....-\EXG.]x..1..R....Sm..FF
v[kK".t.i{Z...J.Z*-.#KU'[email protected]'.p.....5r.u6..?...U.U..s....P
U..........-K/9.,A.%A.M..o.....F...MF........8...5......\...V@%I..OQ.I
.......8...5.u9.....EJ..)...Ii.y.?..z..Q..V.Ou.|.=d.=E\@..N:r.>.s..
..wQ..c.C....^U.....j.k......d.....H..1.I.j .f.v.z...NT..Z..G.q.^.[..-
..A..9...Y.. ..)........gDV'.2<..W{i.....Yo.R./...N.*).q..6...&.X.F
`T.]..=..(....*.d6.rRPSD..F....q...rI=..U...r...x....6Z..O44Mv.f....."
....../ ....#.....!n.>...m..v.q...y........b^.T.m.*RB.......=K.....
u$gen.K4..?.:.\ z}VJz.....\i.6....:X..)~......w...dO...S.i..h.H....x..
.k......;..#..W:.8.......F....&...Z..k.*7........P=.s..7.I...-|\MsVG..
....s.?OWlh......}......n..s. .|N..@z....*#....z`...Q.m.....\..Y\.
<<< skipped >>>

GET /upload_pic/2012/tjyx/tjrm_img06.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga1.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 27 Oct 2014 07:12:35 GMT

Cache-Control: max-age=31536000

Content-Length: 3160

Content-Type: image/jpeg

Last-Modified: Thu, 01 Mar 2012 06:03:41 GMT

Accept-Ranges: bytes

ETag: "48eab0d71f7cc1:34b"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx37:8080 (Cdn Cache Server V2.0), 1.1 kf50:8 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......<......hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c060 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xm
lns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.ado
be.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/
1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="xmp.did:7C3C9
0818062E1119A50B0F09DBE5343" xmpMM:DocumentID="xmp.did:48F37DF662B611E
1987FB533819DF614" xmpMM:InstanceID="xmp.iid:48F37DF562B611E1987FB5338
19DF614" xmp:CreatorTool="Adobe Photoshop 7.0"> <xmpMM:DerivedFr
om stRef:instanceID="uuid:02cd31e0-62b0-11e1-a9f2-89007db68855" stRef:
documentID="adobe:docid:photoshop:3e3cd8bb-62a6-11e1-b37d-c0893894c906
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>....Adobe.d....................................
......................................................................
.......................................*.D............................
.............................................................!1Q2..Aa3
."4.qR.....Bb#C....s5E6........................1.AQ.2.!a...".#.q..Br.3
.4.................?....6.....2.m...I.;.F.O.&O6..m-4....k>..WM....9
...P. ......ex.y6...wh...M.K.X#).-RE.}....b..S..6.*...t.qS.=......
<<< skipped >>>

GET /stat.htm?id=4073713&r=&lg=en-us&ntime=none&cnzz_eid=1424361423-1428055768-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=435416256 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Fri, 03 Apr 2015 10:35:28 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /upload_pic/2015/3/6/4399_13510057915.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga4.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 06 Mar 2015 09:23:58 GMT

Cache-Control: max-age=31536000

Content-Length: 2427

Content-Type: image/jpeg

Last-Modified: Fri, 06 Mar 2015 05:51:00 GMT

Accept-Ranges: bytes

ETag: "07ae685d157d01:388"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx36:8104 (Cdn Cache Server V2.0), 1.1 kf50:10 (Cdn Cache Server V2.0)

Connection: keep-alive
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......*.D...........................................
5..........................!.."1AQa..q#$23BR...Cb.....................
.............3........................!1."AQq.2a...B.....r...#R.......
.....?..eF.xI....Q.$mE.X..._.......E1H...v`..........{.}..V.m.{.0.t..d
.]..bz...5....Y.?&e..)rR.K...$..k.i...SU.l`..d./...`...b.<r.D...|..
G.2....N..1.YJ.g....#/.b.9b.>?.3..Zkv....sq..j]..b,.v..t>.{.m.(.
k .62..1.!.7j......T.f.92...T~...{...:..;n[.:...g.$(..w.......>eq..
|..Y.L.-Fk-.L.*...l.$...\.s.Wd..t..S*...s.T......."u5.....(.x.y..~...V
..`......e........4u.d6*..sR...k.lH.p..~./}K.(.n .............1.kD.*..
...V..;S...v3u.`....U.V_..E.q.M.A!........D...9G9 ....oe?...0g.r.K...h
[email protected]....).[GP.W.6
d........t..V..........|.S.Mz.B.>.. .......eu4....T.s..E....YI.Kqw.
....y.....6...9..?1...:.j7Ze..<.....'m.cT.....~~h.p...d.MLr.J....&.
...%|J.ezIs.ybV...u..>'.....F.2-..........U........5.Qk...._....v..
.,..`.h{y...%........x%.r....Y..*..F.._.-.t_N.L#U......i.;....T...:.M.
.#..hz.T..DDO|..l...o?.$&R<~...j.2]e..-.|."......6.E..M^..('-._....
.;..I............I.=uR..j.h..d...7.X.hK.~.o..........W....#.>>u&
gt;:....67R.c}B.jU]......bF..#..}.eJE:$..Ghb.p.....).....SU.Up..<f.
...,.EJ..%.jo-.M ..j..n...p.\[email protected]:.T.$_E..{...2.r../4.. !8...... .. 
'.a..O.:~x...s...-.Z...m..K...n.........%.. .l;.....vz'c'.LQ.....;
<<< skipped >>>

GET /moeryongshi/images/headerBg.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: news.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 05 Sep 2015 07:20:48 GMT

Date: Mon, 09 Mar 2015 07:20:48 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 228

Last-Modified: Mon, 24 Jan 2011 07:46:00 GMT

ETag: "4d3d2e38-e4"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 zjjhdx32:80 (Cdn Cache Server V2.0), 1.1 kf50:4 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a.. .............................................................
.......................................!.......,...... ...a.$.dY.h.Vl.
./%.t]3x..|....0B,......l:%...B.Z...v..z...X@.....:.n.....A...........
.|.............!.;HTTP/1.1 200 OK..Expires: Sat, 05 Sep 2015 07:20:48 
GMT..Date: Mon, 09 Mar 2015 07:20:48 GMT..Server: nginx/1.4.2..Content
-Type: image/gif..Content-Length: 228..Last-Modified: Mon, 24 Jan 2011
 07:46:00 GMT..ETag: "4d3d2e38-e4"..Cache-Control: max-age=15552000..A
ccept-Ranges: bytes..Age: 1..X-Via: 1.1 zjjhdx32:80 (Cdn Cache Server 
V2.0), 1.1 kf50:4 (Cdn Cache Server V2.0)..Connection: keep-alive..GIF
89a.. ................................................................
....................................!.......,...... ...a.$.dY.h.Vl../%
.t]3x..|....0B,......l:%...B.Z...v..z...X@.....:.n.....A............|.
............!.;....


GET /js/bdshare.js?t=3313 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: news.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Wed, 30 Sep 2015 03:38:19 GMT

Date: Fri, 03 Apr 2015 03:38:19 GMT

Server: nginx/1.4.2

Content-Type: application/x-javascript

Content-Length: 182

Last-Modified: Fri, 12 Oct 2012 05:57:24 GMT

ETag: "5077b144-b6"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 zjjhdx40:88 (Cdn Cache Server V2.0), 1.1 kf49:6 (Cdn Cache Server V2.0)

Connection: keep-alive
document.getElementById("bdshare").style.display = '';..document.getEl
ementById("bdshell_js").src = "hXXp://bdimg.share.baidu.com/static/js/
shell_v2.js?t="   new Date().getHours();..HTTP/1.1 200 OK..Expires: We
d, 30 Sep 2015 03:38:19 GMT..Date: Fri, 03 Apr 2015 03:38:19 GMT..Serv
er: nginx/1.4.2..Content-Type: application/x-javascript..Content-Lengt
h: 182..Last-Modified: Fri, 12 Oct 2012 05:57:24 GMT..ETag: "5077b144-
b6"..Cache-Control: max-age=15552000..Accept-Ranges: bytes..Age: 1..X-
Via: 1.1 zjjhdx40:88 (Cdn Cache Server V2.0), 1.1 kf49:6 (Cdn Cache Se
rver V2.0)..Connection: keep-alive..document.getElementById("bdshare")
.style.display = '';..document.getElementById("bdshell_js").src = "htt
p://bdimg.share.baidu.com/static/js/shell_v2.js?t="   new Date().getHo
urs();....

GET /c.php?id=30039538 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: w.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 10055

Connection: keep-alive

Date: Fri, 03 Apr 2015 09:12:36 GMT

Last-Modified: Fri, 03 Apr 2015 09:12:36 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache43.l2de1[788,200-0,M], cache64.l2de1[789,0], cache2.de1[0,200-0,H], cache6.de1[0,0]

Age: 4971

X-Cache: HIT TCP_MEM_HIT dirn:2:275617642

X-Swift-SaveTime: Fri, 03 Apr 2015 09:12:36 GMT

X-Swift-CacheTime: 5400
(function(){function l(){this.c="30039538";this.R="q";this.N="";this.K
="";this.M="";this.r="1428052356";this.P="oq.cnzz.com";this.L="";this.
u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" th
is.c;this.G="CZ_UUID" this.c;this.v="1";this.A={};this.a={};this.la()}
function g(a,b){try{var c=.[];c.push("siteid=30039538");c.push("name="
 f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.p
ush("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgen
t));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random
()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catc
h(d){}}var h=document,e=window,f=encodeURIComponent,k=decodeURICompone
nt,p=unescape,q=escape;l.prototype={la:function(){try{this.U(),this.J(
),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.j(),
this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),
e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}}
,oa:function(){try{var a=this;e._czc={push:function(){return a.B.apply
(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e.
_czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.leng
th;b  ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[obj
ect String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_
setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}
catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typeof 
e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if("[o
<<< skipped >>>

GET /stat.htm?id=30039538&r=&lg=en-us&ntime=none&cnzz_eid=2007449240-1428052356-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1581191383 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oq.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Fri, 03 Apr 2015 10:35:28 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /stat.php?id=4073713&web_id=4073713&show=pic HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s25.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 10072

Connection: keep-alive

Date: Fri, 03 Apr 2015 10:09:28 GMT

Last-Modified: Fri, 03 Apr 2015 10:09:28 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache16.l2de1[0,200-0,H], cache25.l2de1[1,0], cache8.de1[0,200-0,H], cache8.de1[0,0]

Age: 1560

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Fri, 03 Apr 2015 10:19:50 GMT

X-Swift-CacheTime: 4778
(function(){function k(){this.c="4073713";this.R="z";this.N="pic";this
.K="";this.M="";this.r="1428055768";this.P="oz.cnzz.com";this.L="";thi
s.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" 
this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la(
)}function g(a,b){try{var c=.[];c.push("siteid=4073713");c.push("name=
" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.
push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAge
nt));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.rando
m()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}cat
ch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURICompon
ent,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),this.J
(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.j()
,this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa()
,e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}
},oa:function(){try{var a=this;e._czc={push:function(){return a.B.appl
y(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e
._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.len
gth;b  ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[ob
ject String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "
_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}
}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typeof
 e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if("[
<<< skipped >>>

GET /js/click.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 4399stat.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 03 Apr 2015 10:35:28 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 15 Jan 2014 06:56:45 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Fri, 03 Apr 2015 10:35:29 GMT

Cache-Control: max-age=1

Content-Encoding: gzip
41b............}U.o.6..v.....DT.*...K<-.)6....uOA`0.%3.(....I....EY
...A......}p'.3..d..V....Zj..L.#M.<? {.[.hV...~........)......<.
[email protected]..[. .A=#mo4..1..u.?t.(]..Dv.:[email protected].
*.q.........4=.Fq.....**....Fm%W....!.....5j`.....U..e. .2P..I~$.f....
.......Je.<b.F./(.V<.oQ.....b.I.E.^1..)z..0&...T0OU2n...)..} ...
..a.%...E.......F...-..%ka0>.v.VY.>..I..`.....-g..?....IB^.3.^\.
.....XU...t.....JN......tr.-.t.J..`...H..V.fX.Z.".c.)./ 6......>..M
....=.^....igrp.l.m.//.m..vV....=.Y...$A... ... ...7\F....zr?....Ts..G
.v.....<\.0>.K..*.g:..0.[...g....Y....o.B.M!..ku..m.am.<=..&l
t;a....4r<.x2...&l.."av...............Ya.n([email protected].._2.
.U.vQ.z`f.?>~.....9.[n;...l.....=..^`..S..nvH.D.%...d.K...P:K)<V
..S....P..=........v.....E.Oi'bKuX.'.Ejk.{pknyH.n.g.t..9......n.y...d.
.a$...-..z.........,.Z.....Yb..Ov...@^j..TC..a.i].........i.....v..."O
.#.C..G...ln..D.........&.C......W.r *.o.......%1U..]..:X.jtD:.......R
5"[email protected]@|{<...}...j.;....M.
.}...H...?k.yH...Unc..(Q..Fi.^..t.6..U ..^"...z.F{......0..HTTP/1.1 20
0 OK..Server: nginx..Date: Fri, 03 Apr 2015 10:35:28 GMT..Content-Type
: application/x-javascript..Last-Modified: Wed, 15 Jan 2014 06:56:45 G
MT..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-E
ncoding..Expires: Fri, 03 Apr 2015 10:35:29 GMT..Cache-Control: max-ag
e=1..Content-Encoding: gzip..41b............}U.o.6..v.....DT.*...K<
-.)6....uOA`0.%3.(....I....EY...A......}p'.3..d..V....Zj..L.#M.<
<<< skipped >>>

GET /upload_pic/2012/tjyx/tjrm_img07.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga2.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 02 Mar 2015 10:13:09 GMT

Cache-Control: max-age=31536000

Content-Length: 3257

Content-Type: image/jpeg

Last-Modified: Wed, 29 Feb 2012 09:18:04 GMT

Accept-Ranges: bytes

ETag: "0ae5fac3f6cc1:388"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx39:8106 (Cdn Cache Server V2.0), 1.1 kf48:7 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......<......hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c060 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xm
lns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.ado
be.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/
1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="xmp.did:7C3C9
0818062E1119A50B0F09DBE5343" xmpMM:DocumentID="xmp.did:48F37DFA62B611E
1987FB533819DF614" xmpMM:InstanceID="xmp.iid:48F37DF962B611E1987FB5338
19DF614" xmp:CreatorTool="Adobe Photoshop 7.0"> <xmpMM:DerivedFr
om stRef:instanceID="uuid:02cd31e0-62b0-11e1-a9f2-89007db68855" stRef:
documentID="adobe:docid:photoshop:3e3cd8bb-62a6-11e1-b37d-c0893894c906
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>....Adobe.d....................................
......................................................................
.......................................*.D............................
...............................................................!1AQ2.4
.a"3..q...BRb.#C...r.c67.......................!1...Q.Aq2..a3...."#.r.
Cc$4............?..........rxY7..H.".-.L...4j,f.QW1.U}.).......5......
.j....e!/~Ko-.s..E...m..8M.q.SH3.......*..gu- R5....m......H.p....
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/logo.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:31:37 GMT

Date: Fri, 03 Apr 2015 07:31:37 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2503

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89az....................,...M.............Y......R..2..:..I........
.R.....f......wC..Z...R ............................r(.....<..0..2.
...c.z........=...n%Z..A....n.O...|.......R...k..Mv...s2.`..q=..j....i
"n...u'........5^.......b...........D.c,........M........d............
.l;.f#..3..B........c^.......w.......~-..W....K...b.z-....uC..K..D.K..
....]....m'.....].......e6.|;......y.....e...w*.....C.e1.E..^......k..
..z0.....z..{..\.[.....E..j$.e&....o.....M...5..9.v....n....1..6._..Y.
<...K.,....s.J.6.....$..0..8..(..4..&..2..:..*.........M.b.....g...
.h.......P....t.....j..b..>...........F..v..I..w.....6...x...q._-.G
..\..B..N..[..p?.p,.t)k....~.h:...L..P............o"..a..ia...k,.{H.f9
..e..f.I..e(.C......N........r.g...p.}*..V.}S..D.|*.},.x .............
yH....p..l...t......!.......,....z..............8..}P......#J.H1b.*...
..q.G......1cG.....F.[<M0c..I....5.. qR...'M...S.O.........'..]....
..'6i... ..E.rE.E,W....4. .Q.p.....`......A(..*..,B./Z..=..Y|......iY\
...[=...6.2.v7.5....i-.......P..p.....l......../..... .A.D.. .Wd^"..P.
 p....r.o....?C.........C..4.'.....\e..*#/....... k^...K}..a.-u.......
....c.......^ A..&T.!......X1!..'....&!.......P..A.V8.....y..?.xR..B..
K.H"Id....d.Vx.GA.x".O.....&..%...(.?Jx.C-h.)@Fu...I..........L.t.._~.
...E.J..... n...I.H#. .8...cT:.l&...  ."M...1RAb.c.!..A..~..MAv..H....
J....A.AP.c.....DFa.qH...S ..x.....QP#.......Z.]v..CA ... ......x..)..
.......%$.[o...4....a/.3.<..#.Z.=...hA8 .W..........3.-0.(....(..3.
(..d.(....(.4.@#..\W....A..$...'..H$..(PA.<...G....xH\..H#...-.
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/go_bbs.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:02 GMT

Date: Fri, 03 Apr 2015 09:48:02 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 4339

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000
GIF89a...........l......[......[Y.S/...8...z.u.6.-Z)..M..-7b2`......e$
..a..................pL...........V......*..ri.d..G..l....D."s...K...M
i..J...............}.z).....U........j.s..r)..H.....E...o3.........8..
Y.wm..R7X.UzR.....3.....|.....D...KrF...nP4o."..<.q.5#.7J.....*....
...........0...zd...)... ....E"H...A........Q.....6..M.. .......|..:..
...F.YH/QvKQ<..Q&...g{......"..!.......)...........>...<.d.$S
....ia...=FnCAi:..#.....Ec._..0.yAs.o...yi'.v.G...m.j\L........]}s..&l
t;.........^..I.E...2....."...ybQ...].Y........ ..5.|a.....%.y...%....
V.......QLG..$... Q......,..&.....B..2.sB..S..[.P .....3.c.n.j........
T..K..I..5.....P.................R.. ...>_..{.:h=..C..[..i...<=B
..."E.....................S..............g..n..w.....E..K........?..L.
...|......]..`@'...c..QA0...i...!.......,............S.p.'B.~..M.r....
..J.H.....3j......sHe.$P .88<[email protected].;.=.
B...9;..3......`.<0I_$L....K....h..].......E.....~..y..'VV.1{L...L.
d..)^......#K.L........p&..|.vh.........B!. a0O.%../....s............[
..8.:..0I..0..Q......`..C1.........O......._.>|>`...0.z..<..4
......S... ..a`.......L0...ur`..M......O>.".a'.f....,8@'(j8..,.. ..
.....j.`....#..n....N0G?#...&`4G./a....$xBB......`L!O"x..e..(3.......;
x...3..f-h.0.._6...At2.........p...x......E.(v2...F*.......(D.C....&..
(..|m..F/r.Y..3....E..A'....M.....0........H;6..K.4..F$.p9..ADa.-*Da.-
.,..-V....;.a...X....*c..D.....Xa..3.....X....X...vx.....l...C..-DD...
..A..Q(.....2.......C...5..a..v..2...`k2..CC".4`.68...6...E*.... \
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/topbg_20140506.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:03 GMT

Date: Fri, 03 Apr 2015 09:48:03 GMT

Server: nginx

Content-Type: image/jpeg

Content-Length: 53115

Last-Modified: Wed, 30 Apr 2014 03:01:28 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000
......Exif..II*.................Ducky..............Adobe.d............
...................".....""......""(),)("559955AAAAAAAAAAAAAAA........
..............*.....*6'""""'603,,,30;;66;;AAAAAAAAAAAAAAA...........".
......................................................................
........!1A.Qaq.........."2..BRr..b#3..S...C4..cs..$..................
....!1.QaqA"2........B.#3.Rbr.............?..e.. ..$.:..r..)...$]R....
H.=.*.32.C.=8.uS.......NpG.i....:g,"_"..uZ<.r.y.c..qo4.M(%IR.W.3[..
-..)...E-..1..|..Qn.....9.E.s.H..9.K....39.Q.bR..3.Rg>a.Z-..s3.b...
....rR*.(.U .r..B.vRe.g.b......B.8.2...n....N*ER....U#.1y.SV..r...n.3&
gt;..wJ.Z..B........Jf..U.......&j..R.7V*.T6JWD.*.2.Y..$.2.c/C..[O?..*
....7......=H.9z[......=^.(..>kV.n=....1\|.........................
......................................................................
...........................U6.%..^...s....W..cD..u%Y.$."t..î....J..E
..%Alj...d...sI ..b...F..Y**..-.e..h......fj*R...3QP5QVf......Y.......
ITZKj....#b..rdrfy..R[\.y. .7b..l.............&..^..fdi...Y.....i.e. #
 ,..bT#I*F..P. .P...........N|..E6y)....T.&.9..;A..=.j..MT.....ff.%...
s.*.......?M...........n....E.....9G.......I.ih.<.}.o;...9ts..,...L
.2.0..3QQH.K.b.....LTTR..9.....t.#fjn.r..fti..oM.)$..Rih.CJ1....>. 
.o...W?.G.....n>..q..y.......|....:.Gc.OF8.....y.......p....xy.1..V
z.-......9....9.\...[..T.JE.%....y.*ER'....uN.R.4..U.,j.]K`..?(......1
.3.....Y.,..$6.........**d..D..-Z...#.E.Ji.u.4..ir.3.zC1....W...X.....
.F..H....b.........~i.)..Rc..../....<.../[email protected].
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/zj_btn.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 10:14:43 GMT

Date: Fri, 03 Apr 2015 10:14:43 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 1226

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89ag...............................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................!.......,....g........&
gt;)P.............)>..6(....G...............(6.#;....M.............
..;#P.M7O.............7M...2O.%N............%.O2..M8. ..I........H....
.Vt.....'....8 ..(./b.8q#G. ;~...b...I.<YRc..I.8yRHB...B...3...=w.$
...E.H....4...J}.e.3D..5$..8....`.F.K.l..b..%.Vm..c.[.. .m]..L..Y.G.".
4..L8......Q\.0c... N<y.d...g......=.. r......hT].u...]...;....s.d=
[....S.`P.....H,(R......D."}....._..}:u...{..={.....(..D...\PP....(...
........g_.r.._.........`..P.........,....^[email protected].!. ....%.xb.)...\#..b
. .....P.^!....... .......D&....J".$.L.iQ.NVY..Q.)..CB.@..\PH..,!..B..
f.Q....B..'.k.I'...i..s....t.)(......E..B.<.p...FjQ..\.i..b:...b.).
.V...rqz...Fz..<4.B!.4....0a..............{...4...4. ........F ...V
[email protected].............. o..*...............,....l...'..._.
[email protected].....'..g....w... ..2......A..C......0..C."...;....
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/bg_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:03 GMT

Date: Fri, 03 Apr 2015 09:48:03 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 791

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000
GIF89a..9.............................................................
......................................................................
.................................................................!....
...,[email protected]:...tJ.Z...v..z...xL.....z.n..G.gC.(...~...
.....................................{................................
............. ............F....................................H......
.L......#n[(.....3j.Dq... C.t.q...(S..Wr...0c.\7m...8s.l.r....@...)...
.H..M.......B.J...aR.j...k..^...Kv...h...zv...p...K..].s....7b.......w
......N...cj..K.LYW...3k.uy....#[email protected].^.95......M.v...s...{...c{..
N.......=.......K..2:...?Z...........}......_........{/..}k.....,?....
._.......&..'.........0.Vh!/[email protected]...`p..p.(..4.h..8
....<[email protected]..;....


GET /flashzt/img/zmxy3_20120913/bg_5_20130716.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:04 GMT

Date: Fri, 03 Apr 2015 09:48:04 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2042

Last-Modified: Tue, 16 Jul 2013 01:47:34 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000
GIF89a..C.............................................................
................................................\\\...................
.................................................................!..XM
P DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &
lt;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011
 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="ht
tp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf
:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:/
/ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sT
ype/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpM
M:InstanceID="xmp.iid:74504210EDB611E2B540ACB23FF9BCD2" xmpMM:Document
ID="xmp.did:74504211EDB611E2B540ACB23FF9BCD2"> <xmpMM:DerivedFro
m stRef:instanceID="xmp.iid:7450420EEDB611E2B540ACB23FF9BCD2" stRef:do
cumentID="xmp.did:7450420FEDB611E2B540ACB23FF9BCD2"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;...................................................................
...............................................................~}|{zyx
wvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:98
76543210/.-, *)('&%$#"! .................................!.......,....
[email protected]}:......^.h..*J..m......uR.:...{O}$#..
ay...V.W.W.}..X.X.........r.....v.......|......r!..#......v.....N.....
. ......m.#... .$... #.......... ...................&..8o..y..v...
<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/libg_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:28:08 GMT

Date: Fri, 03 Apr 2015 07:28:08 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 899

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89aS.:.............................................................
......k.....................................................t.........
....................q.....m.................m.................~.....{.
....q..............x..n....................~.................j........
......................................................................
...............................................!.......,....S.:.......
..7V...........AM,"...@.. W........... ..U!...9.........R... .......?#
..H......I5>.V....V.......V......V.............V.....V.....d%A....8
8..........N"?r.-...Qc...=f..R$4..Mnd.R.G.-].\.S.I..l> XR'..9}..*.$
..E..M:N_M..8>.Z.(UaV.F.8U.).H....V...f.M..v...m.A)d.....m1..K....s
...)....|..M<.-..8..sz..dPKf.D.....P...P..,..pp..!..M..kX.#....".0.
$F............^..`a...J0.(@......0.n.A.........y....H. =...0....A.....
....u...G^{*p..."`B...XpD..F(...Vh...f(..4.....L...$.h..(....,.8.%....
;....


GET /flashzt/img/zmxy3_20120913/nav_bg.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:04 GMT

Date: Fri, 03 Apr 2015 09:48:04 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 18944

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000
GIF89a..6.......7..`..\...........Y..J..Q..a..[........S..j..t........
y..`.....Iu.............\..h..m..t..q.....[..|..{.....e.....f.....C..d
..u.....~.....#.#j..d..x..............N......}${........u..U..q.......
.3..............n.....]..]..t..Z..b.....g..:...........V..:.......${..
}.....f..m.....h.. ..m..]..<...z%......C.....^.."...q ..3.l/f..R..}
.....P.....d..n..l..Q..h..R..e..p..i..t.....v.."}..u)............l..a.
.^..[.....Y...t&k..z../..,......y)D..y..j.....a..Z..I..s.....I.....K..
*.....q..h..n.....o.....?...z.W..j..=..Z.....&. .w#P.....m..H.........
..U..c..U...........R~.V........X........g..g..p..C........'..l..o..&.
.........#.."F.a...................u<...&.Hg.y.........6.T......W.m
......h..\........f..c.....M........o..k....._....................e...
.....i..w...k0...!.......,......6........B......*\......#J.H.....3j...
... C..I....(S.\..%.5.j.p.AC..7m....g..<...Jt.Q.H.&=..)..K.:..u...X
.j..5 ..^.v......h..5.6m..n......\.t.....l..Ah.....5...'F..1...#;..y..
..)k..93...Cw.......O.6.:u...c.....l..o........{....x.....O.|.s..c.j..
..z..M..];....w..........7.>}.........|....................."h`....
...6....VH...fh...n.a. B....YW.4...".*.... ....0.hc.8....;....>....
@.)d.H....L&...NF...OV)..T^.e.\b..._v...b....d.if.l....jz...|.2.5.XcM6
.H......g....g6..I(...*(....'...*.....i..*....BZ(..~.i....i....(..^...
..vJ....*....:k...j)........J,....l.......&.....k....[.....,..N.m..R{-
..r.m...k....................n...[n....o... ....Kp..4....0.B5.l.1.....
...,..$..r.,..../....2....4.ls.<[email protected]'m..H/.t.P3-..SG
<<< skipped >>>

GET /flashzt/img/zmxy3/bg_7.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm