MD5: 90f3e188c70145fc49b61e5e1da5223a
SHA1: 553aa0ce59c9ea6f228a6a08916be14e6c68a1dc
SHA256: 0de9a64f9dab9285bb25e8d9c3d828ebd3dbfd921a6b618d34fe98d73971f861
SSDeep: 49152:7Z9FVeltO9GlyrkSSE/W6tUPzjNpk4hTH5YpSTb81SQm7bmSrqUdATZc94W:rmWVr06tIj44hTHsSn4SjXmSrqUd4CP
Size: 2461696 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, ACProtect141
Company: no certificate found
Created at: 2015-04-10 08:39:09
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:1972

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1972 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\qq[1].htm (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tb1.bdstatic[1].js (6383 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bootstrap.min[1].js (6801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\x_button_blue2[1].png (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery[1].js (39245 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAK19TAL.htm (3958 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\chacuo[1].css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ca-pub-8401880217755931[1].js (107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\imgad[1].swf (11022 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\WebResource[1].axd (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\p[2].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ui-bg_gloss-wave_35_f6a828_500x100[1].png (604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ip.navisec[1].htm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery.min[1].js (2178 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAH0KBL9 (3673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ui-bg_highlight-soft_100_eeeeee_1x100[1].png (90 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\zrt_lookup[1].htm (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cmd5[1].htm (1703 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\WebResource[1].gif (64 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\google-logo[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\p[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tableExport[2].js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (15616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\template[1].css (580 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\qq[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f[1].txt (1289 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\adv[1].htm (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ZeroClipboard[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bootstrap[1].css (1326 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\glyphicons-halflings-regular[1].eot (5041 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\chacuo[1].js (10164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tb1.bdstatic[1].css (4674 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\template[1].css (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@chacuo[1].txt (177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\glyphicons-halflings-regular[1].eot (5169 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\icon[1].png (344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mailanonymous[1] (788 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ScriptResource[1].axd (17429 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\web[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\f[1].txt (1505 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\zrt_lookup[1].html (490 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\style[1].css (484 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\administry[1].js (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery.base64[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAH5ILDT.css (2149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bootstrap-table[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bootstrap-table[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\f[2].txt (2285 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bootstrap-table[2].js (1655 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bootstrap-table-export[2].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\f[3].txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ajax[1].htm (958 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cha.hxsec[1] (781 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bootstrap-table[1].js (336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery.bootstrap.wizard.min[1].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\menu[1].png (868 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\WebResource[1].gif (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery[1].base64.js (643 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bootstrap-table-export[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\myip-logo-wide[1].png (3019 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bootstrap[1].min.js (426 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.min[1].js (4998 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (245 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\chacuo[1].css (678 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bootstrap[2].css (4310 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery[1].bootstrap.wizard.min.js (1 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery[1].min.js (1819 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ui-icons_ffffff_256x240[1].png (285 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ZeroClipboard[2].js (10 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\tool.chacuo[1].xml (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hm[1].js (1413 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[2].txt (6665 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\mailanonymous[1].htm (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\core[1].php (754 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\post-jg[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\system[1].js (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bootstrap[1][1].min.css (2143 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (191 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ui-icons_222222_256x240[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\zh_cn[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hm[2].js (2522 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[3].txt (1136 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (390 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\alog.min[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cha.hxsec[1].htm (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (8366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ScriptResource[1].axd (41417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ZeroClipboard[1].swf (1071 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tableExport[1].js (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@lr3800[1].txt (214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f[2].txt (555 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ScriptResource[1].axd (207285 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\WebResource[1].gif (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bootstrap.min[1].js (1190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bootstrap[1].min.css (713 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\md5[1].js (7 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[2].txt (739 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\imgad[2].swf (35205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\s[1] (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\s[1].htm (143 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\web[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pic[1].gif (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\chacuo[2].js (9070 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f[1].txt (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ZeroClipboard[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bootstrap[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bootstrap-table[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\chacuo[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\imgad[1].swf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\chacuo[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bootstrap[1].min.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tableExport[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery[1].base64.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bootstrap-table-export[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bootstrap[1].min.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.min[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\web[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\f[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery[1].bootstrap.wizard.min.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery[1].min.js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hm[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\s[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\p[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\template[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bootstrap-table[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)

Registry activity

The process %original file name%.exe:1972 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015052120150522]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015052120150522]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012015052120150522\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015052120150522]
"CacheLimit" = "8192"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015052120150522]
"CacheRepair" = "0"
"CachePrefix" = ":2015052120150522:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B FE 82 66 03 66 85 49 AE 12 78 D3 19 90 5F 5B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041520140416]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: lr3800
Product Name: ???VIP
Product Version: 3.3.0.0
Legal Copyright: ??:??????????,????????;???????????,???????;??.???????????,?????;????!???????????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3.3.0.0
File Description: ???????
Comments: http://ymhackers.com/
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://cha.hxsec.com.cname.yunjiasu-cdn.net/	122.112.93.207
hxxp://lr3800.com/qq.html	162.159.210.14
hxxp://www.cmd5.com/	58.64.136.42
hxxp://tool.chacuo.net/mailanonymous	219.234.4.191
hxxp://post.n.shifen.com/f/search/adv
hxxp://cha.hxsec.com.cname.yunjiasu-cdn.net/static/css/bootstrap.css	122.112.93.207
hxxp://ip.navisec.it/	121.40.149.119
hxxp://cha.hxsec.com.cname.yunjiasu-cdn.net/static/css/style.css	122.112.93.207
hxxp://tool.chacuo.net/js/public/jquery.min.js	219.234.4.191
hxxp://tool.chacuo.net/??/css/main.css,/css/ui-lightness/jquery-ui-1.8.18.custom.css?v=631	219.234.4.191
hxxp://www.cmd5.com/WebResource.axd?d=S8JCuF17GL8Co4Q1PcRpUhjPtu7GuFZPa2HvxUJ1n-PaDOPrKRpQyub4y_NSxomVWKbZ3Amf7JdiAUfX0&t=635418570520000000	58.64.136.42
hxxp://cha.hxsec.com.cname.yunjiasu-cdn.net/static/js/jquery.js	122.112.93.207
hxxp://eurpo.b9.aicdn.com/html5shiv/3.7.2/html5shiv.min.js
hxxp://cha.hxsec.com.cname.yunjiasu-cdn.net/static/fonts/glyphicons-halflings-regular.eot?	122.112.93.207
hxxp://www.cmd5.com/md5.js	58.64.136.42
hxxp://tool.chacuo.net/css/web.css	219.234.4.191
hxxp://tool.chacuo.net/js/tool/p.js	219.234.4.191
hxxp://p21.tcdn.qq.com/wpa/images/group.png
hxxp://static.n.shifen.com/hunter/alog/alog.min.js
hxxp://www.cmd5.com/ScriptResource.axd?d=8kw2QGXGrGOupEkdkvFNFmbaNcRz_Gz0KsidtKq5WtOmcZl7dEpgbBGY2PYjMK92fK2_8Ht93pa1KFxcdbj__67p5NgbscY5cIqo7s_JNVKp5m57iW0JszGWxOQ1&t=24efffe1	58.64.136.42
hxxp://tool.chacuo.net/js/public/ZeroClipboard.js	219.234.4.191
hxxp://qiniunor.xdwscache.glb0.lxdns.com/css/template.css
hxxp://qiniunor.xdwscache.glb0.lxdns.com/css/bootstrap.min.css
hxxp://cha.hxsec.com.cname.yunjiasu-cdn.net/static/js/system.js	122.112.93.207
hxxp://tool.chacuo.net/images/public/menu.png	219.234.4.191
hxxp://tool.chacuo.net/css/ui-lightness/images/ui-icons_222222_256x240.png	219.234.4.191
hxxp://static.post.n.shifen.com/??/tb/_/card_9dfd566.css,/tb/_/card_5c7387e.css,/tb/_/js_pager_5be1e39.css,/tb/_/wallet_dialog_33a638c.css,/tb/_/flash_lcs_4472537.css,/tb/_/new_message_system_8a580ba.css,/tb/_/base_user_data_80722fd.css,/tb/_/cashier_dialog_b8e8690.css,/tb/_/qianbao_cashier_dialog_c81bb31.css,/tb/_/base_dialog_user_bar_8cb5c99.css,/tb/_/qianbao_purchase_member_e44bb8f.css,/tb/_/pay_member_d41d8cd.css,/tb/_/userbar_cbc8f2a.css,/tb/_/poptip_f0fdc70.css,/tb/_/senior_342da68.css
hxxp://pagead46.l.doubleclick.net/pagead/js/adsbygoogle.js
hxxp://pagead46.l.doubleclick.net/pub-config/ca-pub-8401880217755931.js
hxxp://pagead46.l.doubleclick.net/pagead/js/r20150514/r20150515/show_ads_impl.js
hxxp://cha.hxsec.com.cname.yunjiasu-cdn.net/static/js/administry.js	122.112.93.207
hxxp://pagead46.l.doubleclick.net/pagead/html/r20150514/r20150515/zrt_lookup.html
hxxp://tool.chacuo.net/??/js/public/jquery-ui-1.8.18.custom.min.js,/js/public/json2.js,/js/public/jquery.store.js,/js/public/main.js?v=631	219.234.4.191
hxxp://hm.e.shifen.com/hm.js?ef483ae9c0f4f800aefdf407e35a21b3
hxxp://tool.chacuo.net/images/public/myip-logo-wide.png	219.234.4.191
hxxp://pagead46.l.doubleclick.net/pagead/ads?client=ca-pub-8401880217755931&format=970x90&output=html&h=90&slotname=5995143054&adk=3357607631&w=970&lmt=1432195054&ea=0&flash=11.6.602.168&url=http://tool.chacuo.net/mailanonymous&dt=1432195054304&bpp=16&shv=r20150514&cbv=r20150515&saldr=aa&correlator=8706509929441&frm=20&ga_vid=2113065512.1432195055&ga_sid=1432195055&ga_hid=787210447&ga_fc=0&u_tz=180&u_his=0&u_java=1&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_nplug=0&u_nmime=0&dff=simsun&dfs=12&adx=145&ady=5745&biw=148&bih=36&eid=317150304&oid=3&rx=0&eae=4&brdim=819,202,,,1276,,,,,&osd=1&vis=0&rsz=|||&abl=CS&ppjl=t&srr=1&fu=1024&bc=0&ifi=1&dtd=891
hxxp://pagead46.l.doubleclick.net/pagead/osd.js
hxxp://qiniunor.xdwscache.glb0.lxdns.com/css/bootstrap-table.css
hxxp://qiniunor.xdwscache.glb0.lxdns.com/fonts/glyphicons-halflings-regular.eot?
hxxp://www.cmd5.com/ScriptResource.axd?d=it_DV6yc5evxqvnVI3DF3q0fMwIs7G-op0Hh0z0lvyE_bJoY1I3FP2HmU-369XwIZIV7MO52l3RkbZv9Hew00tOfamG_aj4JdcFdtI2vMnjbSemSUze_OaxSzfE1&t=f2cd5c5	58.64.136.42
hxxp://cha.hxsec.com.cname.yunjiasu-cdn.net/img/nyro/ajaxLoader.gif	122.112.93.207
hxxp://cha.hxsec.com.cname.yunjiasu-cdn.net/undefined	122.112.93.207
hxxp://pagead46.l.doubleclick.net/pagead/imgad?id=CICAgKCTkZfTxQEQ2AUYWjIIpKDrRFXGq4A
hxxp://cha.hxsec.com.cname.yunjiasu-cdn.net/static/js/bootstrap.min.js	122.112.93.207
hxxp://pagead46.l.doubleclick.net/pagead/inject_object_div.js
hxxp://pagead46.l.doubleclick.net/pagead/js/r20150514/r20110914/abg.js
hxxp://eurpo.b9.aicdn.com/respond.js/1.4.2/respond.min.js
hxxp://pagead46.l.doubleclick.net/pagead/images/abg/icon.png
hxxp://pagead46.l.doubleclick.net/pagead/images/abg/zh_cn.png
hxxp://pagead46.l.doubleclick.net/pagead/drt/s?v=r20120211
hxxp://pagead46.l.doubleclick.net/pagead/images/google-logo.png
hxxp://pagead46.l.doubleclick.net/pagead/images/x_button_blue2.png
hxxp://cha.hxsec.com.cname.yunjiasu-cdn.net/ajax.php?act=database	122.112.93.207
hxxp://qiniunor.xdwscache.glb0.lxdns.com/js/jquery.min.js
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=768630&show=pic
hxxp://oz.cnzz.com/stat.htm?id=768630&r=&lg=en-us&ntime=none&cnzz_eid=1338064447-1432190709-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=454109180	198.11.132.200
hxxp://static.post.n.shifen.com/??tb/static-common/style/tb_ui_a818c9c.css,tb/static-common/style/tb_common_0e00789.css
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=768630&show=pic&t=z
hxxp://qiniunor.xdwscache.glb0.lxdns.com/js/bootstrap.min.js
hxxp://qiniunor.xdwscache.glb0.lxdns.com/js/bootstrap-table.js
hxxp://all.cnzz.com.danuoyi.tbcache.com/img/pic.gif
hxxp://qiniunor.xdwscache.glb0.lxdns.com/js/jquery.bootstrap.wizard.min.js
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1555829661	42.120.219.171
hxxp://qiniunor.xdwscache.glb0.lxdns.com//js/extensions/export/bootstrap-table-export.js
hxxp://cnzz.mmstat.com/app.gif?&cna=8H3kDZBxtXICAcGK9Oe2pGU2	42.120.219.171
hxxp://qiniunor.xdwscache.glb0.lxdns.com//js/tableExport.jquery.plugin/tableExport.js
hxxp://qiniunor.xdwscache.glb0.lxdns.com//js/tableExport.jquery.plugin/jquery.base64.js
hxxp://www.cmd5.com/ScriptResource.axd?d=Gg2PHGmx05BaJ5iUyUfueHdJy9OFveRskW4DxHew3cKR-TIFIOUMV8qp5kYaNtAEa0s3tRHwOeAFRvXLtvyOB89-su708SbdvGGKPTkPHKYSPHxmZR4Ref93-W1sQbHCC0Ypmw2&t=f2cd5c5	58.64.136.42
hxxp://www.cmd5.com/WebResource.axd?d=SqndIz8Gv1Pgy1cT8jGtzYwQ6y_bwN73E_OGkbc-Uue2zZLA-z9a1D25wL0tBfY6zI3pzray1wWKWndGhCQzxIJJT6A1&t=635418570520000000	58.64.136.42
hxxp://www.cmd5.com/WebResource.axd?d=_tn8Sw83Ad_JwjaN-u0-3ImnFP5TrTvQIBSf3at4ZDPH-7ob3ElljVrRU7ZbjPJ_RN7o6GroV6tIsCDPYbeAts7lilk1&t=635418570520000000	58.64.136.42
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=3819543&web_id=3819543&show=pic1
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=3819543&show=pic1&t=z
hxxp://all.cnzz.com.danuoyi.tbcache.com/img/pic1.gif
hxxp://www.cmd5.com/WebResource.axd?d=JsbaKI1xyr07iSHvhlKz9NbKZww4CRuVBWdRJwqAMPrwIsGkqabhrh80JeslBYNpRn2inbpa936aVXXiTIgIFkYxaMg1&t=635418570520000000	58.64.136.42
hxxp://www.cmd5.com/images/qq.gif	58.64.136.42
hxxp://oz.cnzz.com/stat.htm?id=3819543&r=&lg=en-us&ntime=none&cnzz_eid=1310392416-1432191979-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1828417946	198.11.132.200
hxxp://static.n.shifen.com/img/post-jg.gif
hxxp://static.post.n.shifen.com/??tb/static-common/lib/tb_lib_9f6dadd.js,tb/static-common/ui/common_logic_v2_0b552d1.js,tb/static-common/js/tb_ui_d95e79d.js,/tb/_/ban_4ce308b.js
hxxp://tool.chacuo.net/js/public/ZeroClipboard.swf	219.234.4.191
hxxp://tool.chacuo.net/css/ui-lightness/images/ui-bg_gloss-wave_35_f6a828_500x100.png	219.234.4.191
hxxp://tool.chacuo.net/css/ui-lightness/images/ui-bg_highlight-soft_100_eeeeee_1x100.png	219.234.4.191
hxxp://tool.chacuo.net/css/ui-lightness/images/ui-icons_ffffff_256x240.png	219.234.4.191
hxxp://cdn.bootcss.com/html5shiv/3.7.2/html5shiv.min.js	112.117.218.120
hxxp://s19.cnzz.com/stat.php?id=768630&show=pic	1.99.192.16
hxxp://s9.cnzz.com/stat.php?id=3819543&web_id=3819543&show=pic1	1.99.192.15
hxxp://7xigiv.com2.z0.glb.qiniucdn.com/js/bootstrap.min.js	115.231.158.70
hxxp://7xigiv.com2.z0.glb.qiniucdn.com/css/bootstrap.min.css	115.231.158.70
hxxp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8401880217755931&format=970x90&output=html&h=90&slotname=5995143054&adk=3357607631&w=970&lmt=1432195054&ea=0&flash=11.6.602.168&url=http://tool.chacuo.net/mailanonymous&dt=1432195054304&bpp=16&shv=r20150514&cbv=r20150515&saldr=aa&correlator=8706509929441&frm=20&ga_vid=2113065512.1432195055&ga_sid=1432195055&ga_hid=787210447&ga_fc=0&u_tz=180&u_his=0&u_java=1&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_nplug=0&u_nmime=0&dff=simsun&dfs=12&adx=145&ady=5745&biw=148&bih=36&eid=317150304&oid=3&rx=0&eae=4&brdim=819,202,,,1276,,,,,&osd=1&vis=0&rsz=|||&abl=CS&ppjl=t&srr=1&fu=1024&bc=0&ifi=1&dtd=891	216.58.209.194
hxxp://cha.hxsec.com/ajax.php?act=database	122.112.93.207
hxxp://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211	216.58.209.194
hxxp://www.chacuo.net/js/tool/p.js	219.234.4.191
hxxp://www.chacuo.net/js/public/ZeroClipboard.js	219.234.4.191
hxxp://pagead2.googlesyndication.com/pagead/inject_object_div.js	216.58.209.162
hxxp://pagead2.googlesyndication.com/pub-config/ca-pub-8401880217755931.js	216.58.209.162
hxxp://www.chacuo.net/css/ui-lightness/images/ui-bg_highlight-soft_100_eeeeee_1x100.png	219.234.4.191
hxxp://7xigiv.com2.z0.glb.qiniucdn.com/css/template.css	115.231.158.70
hxxp://7xigiv.com2.z0.glb.qiniucdn.com/css/bootstrap-table.css	115.231.158.70
hxxp://pcookie.cnzz.com/app.gif?&cna=8H3kDZBxtXICAcGK9Oe2pGU2	42.120.219.171
hxxp://pagead2.googlesyndication.com/pagead/images/x_button_blue2.png	216.58.209.162
hxxp://img.baidu.com/img/post-jg.gif	115.239.211.92
hxxp://cha.hxsec.com/static/js/jquery.js	122.112.93.207
hxxp://tb1.bdstatic.com/??tb/static-common/lib/tb_lib_9f6dadd.js,tb/static-common/ui/common_logic_v2_0b552d1.js,tb/static-common/js/tb_ui_d95e79d.js,/tb/_/ban_4ce308b.js	61.135.185.139
hxxp://cha.hxsec.com/static/js/administry.js	122.112.93.207
hxxp://cha.hxsec.com/static/css/bootstrap.css	122.112.93.207
hxxp://www.chacuo.net/css/ui-lightness/images/ui-icons_ffffff_256x240.png	219.234.4.191
hxxp://tb1.bdstatic.com/??/tb/_/card_9dfd566.css,/tb/_/card_5c7387e.css,/tb/_/js_pager_5be1e39.css,/tb/_/wallet_dialog_33a638c.css,/tb/_/flash_lcs_4472537.css,/tb/_/new_message_system_8a580ba.css,/tb/_/base_user_data_80722fd.css,/tb/_/cashier_dialog_b8e8690.css,/tb/_/qianbao_cashier_dialog_c81bb31.css,/tb/_/base_dialog_user_bar_8cb5c99.css,/tb/_/qianbao_purchase_member_e44bb8f.css,/tb/_/pay_member_d41d8cd.css,/tb/_/userbar_cbc8f2a.css,/tb/_/poptip_f0fdc70.css,/tb/_/senior_342da68.css	61.135.185.139
hxxp://pagead2.googlesyndication.com/pagead/images/google-logo.png	216.58.209.162
hxxp://googleads.g.doubleclick.net/pagead/html/r20150514/r20150515/zrt_lookup.html	216.58.209.194
hxxp://cha.hxsec.com/static/js/system.js	122.112.93.207
hxxp://www.chacuo.net/images/public/menu.png	219.234.4.191
hxxp://hm.baidu.com/hm.js?ef483ae9c0f4f800aefdf407e35a21b3	61.135.185.140
hxxp://www.chacuo.net/images/public/myip-logo-wide.png	219.234.4.191
hxxp://7xigiv.com2.z0.glb.qiniucdn.com//js/tableExport.jquery.plugin/tableExport.js	115.231.158.70
hxxp://www.chacuo.net/js/public/ZeroClipboard.swf	219.234.4.191
hxxp://cha.hxsec.com/	122.112.93.207
hxxp://www.chacuo.net/css/web.css	219.234.4.191
hxxp://7xigiv.com2.z0.glb.qiniucdn.com/js/bootstrap-table.js	115.231.158.70
hxxp://cha.hxsec.com/static/js/bootstrap.min.js	122.112.93.207
hxxp://pagead2.googlesyndication.com/pagead/images/abg/icon.png	216.58.209.162
hxxp://c.cnzz.com/core.php?web_id=768630&show=pic&t=z	195.27.31.248
hxxp://cha.hxsec.com/undefined	122.112.93.207
hxxp://pagead2.googlesyndication.com/pagead/imgad?id=CICAgKCTkZfTxQEQ2AUYWjIIpKDrRFXGq4A	216.58.209.162
hxxp://tieba.baidu.com/f/search/adv	180.76.2.36
hxxp://www.chacuo.net/css/ui-lightness/images/ui-icons_222222_256x240.png	219.234.4.191
hxxp://www.chacuo.net/??/js/public/jquery-ui-1.8.18.custom.min.js,/js/public/json2.js,/js/public/jquery.store.js,/js/public/main.js?v=631	219.234.4.191
hxxp://img.baidu.com/hunter/alog/alog.min.js	115.239.211.92
hxxp://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js	216.58.209.162
hxxp://cdn.bootcss.com/respond.js/1.4.2/respond.min.js	112.117.218.120
hxxp://pagead2.googlesyndication.com/pagead/js/r20150514/r20110914/abg.js	216.58.209.162
hxxp://7xigiv.com2.z0.glb.qiniucdn.com//js/extensions/export/bootstrap-table-export.js	115.231.158.70
hxxp://7xigiv.com2.z0.glb.qiniucdn.com/js/jquery.min.js	115.231.158.70
hxxp://pub.idqqimg.com/wpa/images/group.png	103.7.28.30
hxxp://icon.cnzz.com/img/pic1.gif	195.27.31.246
hxxp://c.cnzz.com/core.php?web_id=3819543&show=pic1&t=z	195.27.31.248
hxxp://icon.cnzz.com/img/pic.gif	195.27.31.246
hxxp://pagead2.googlesyndication.com/pagead/images/abg/zh_cn.png	216.58.209.162
hxxp://7xigiv.com2.z0.glb.qiniucdn.com/js/jquery.bootstrap.wizard.min.js	115.231.158.70
hxxp://pagead2.googlesyndication.com/pagead/osd.js	216.58.209.162
hxxp://www.chacuo.net/css/ui-lightness/images/ui-bg_gloss-wave_35_f6a828_500x100.png	219.234.4.191
hxxp://cha.hxsec.com/static/fonts/glyphicons-halflings-regular.eot?	122.112.93.207
hxxp://www.chacuo.net/??/css/main.css,/css/ui-lightness/jquery-ui-1.8.18.custom.css?v=631	219.234.4.191
hxxp://www.chacuo.net/js/public/jquery.min.js	219.234.4.191
hxxp://cha.hxsec.com/static/css/style.css	122.112.93.207
hxxp://pagead2.googlesyndication.com/pagead/js/r20150514/r20150515/show_ads_impl.js	216.58.209.162
hxxp://tb1.bdstatic.com/??tb/static-common/style/tb_ui_a818c9c.css,tb/static-common/style/tb_common_0e00789.css	61.135.185.139
hxxp://7xigiv.com2.z0.glb.qiniucdn.com//js/tableExport.jquery.plugin/jquery.base64.js	115.231.158.70
hxxp://7xigiv.com2.z0.glb.qiniucdn.com/fonts/glyphicons-halflings-regular.eot?	115.231.158.70
log.hm.baidu.com	61.135.185.178
bdimg.share.baidu.com	211.90.25.48
www.google.com	173.194.113.210

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Outdated Windows Flash Version IE

Traffic

GET /??tb/static-common/style/tb_ui_a818c9c.css,tb/static-common/style/tb_common_0e00789.css HTTP/1.1

Accept: */*

Referer: hXXp://tieba.baidu.com/f/search/adv

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tb1.bdstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 May 2015 07:57:34 GMT

Content-Type: text/css

Last-Modified: Wed, 20 May 2015 07:48:19 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Server: Apache

Expires: Sat, 20 Jun 2015 07:57:34 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip
467f.............}k.#.q....0'....,..`.qa.\[...81........i-^.c....~...z
4.3..dkD.hTWeee........-..i....E...?n..}......Om..b.=e.6?H..|w:.6..0.t
..m....wq*..........:.....@.~..........H.]l.g....qq>.w..~WlO.......
....rYl.[.....`..[...O..~w,N.n;=...T.....q..>M.......w.ww..O.=N..|.
P,O..."............SX..q..........}~8..l.....v.)..u~7S$.v.)..L{.]Xg..c
...3......F...;.........a..S.l.2.k.&.....2..05E.}....b.....O...:_.....
.......8.......v9=...<.N...7.y.=_".....m......o...........o.Mv.....
x6....^.....nlw.C...SM......h..6.).zw....5..C....?.K .l.X...W.]v.b.5..
_...nC...~..)[email protected]\E@...{R.Pn..~...?.R...}..u.. ^..;C!.7._.L.
.:?..aw5^[email protected].:.~..C....1.B.i....1O}.k.>pg.".......,
..rff!%.....4.;..#...p.~..b[..c....X.....v....w.;.p#L=.hm.-|..Z..lY.r.
..5oV...k...-5.>..w..l.o7...|.>0...a....z.<...w.....r..l....V
....t.........{.[?...q.;l..(...q.:..Qg.....>...l.A.N.#F.x:|w....l..
.y8|....~...ri....-....}9F.(4.H...>...L;.V.9..\.t.(..B.,p...N#T..@7
?mg.#.l7-.8.L...D..n..............~Iw.dw.Fk..>o..dW2..w7Lw..}~w.dw0
.n.V.y3.M.%3}A..t.<.T./.s....RF..,...n.T.j......-.....h.t.....C^.].
.2LM.U./Q...}.d....(.<%.U5.6M.l.W....l;@@..;3$V.~.........Yq.... .&
gt;L..B..Oe..E.}...n.S..Qn_(........k.....NV.....y.Mo8l.?m.z........A.
:M.....$..ag.~v.....`4Y...F..&..=z..p.dm...M.ZuW..X...A.......ua.v..2P
.GU..C...........X.0D.H.....JB0....|$.YtX..0...`..N....dW.... .Y<..
b.-.*.h.#...oW9(..b...j...PcF.m.[...ik..C.B...Z.>;@#....v>N...a.
.z....m3...*".....h.... ...a..vW...L.n.P&...#.....W..HC..Z.Wf.N...
<<< skipped >>>

GET /??tb/static-common/lib/tb_lib_9f6dadd.js,tb/static-common/ui/common_logic_v2_0b552d1.js,tb/static-common/js/tb_ui_d95e79d.js,/tb/_/ban_4ce308b.js HTTP/1.1

Accept: */*

Referer: hXXp://tieba.baidu.com/f/search/adv

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tb1.bdstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 May 2015 07:57:55 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 20 May 2015 07:48:19 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Server: Apache

Expires: Sat, 20 Jun 2015 07:57:55 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip
400a...............~#Gr...y..#..f.......b[-.[.n.n.fLR..@.,.Dqp........
.....Y.U.[c....XMTUVVfdd.#r.j5./.r...e.>^.p...;..,.Y6.|.._...N..y7.
....i..../..{.rp...9.g.......d......g.......<_.....C.?....}q.......
'....f.$....|..t&..h..7;..w..8..5...r...,.o.w...h.w{'.Q~p././...r...E/
.,..]w....W;|s9.p?.t..U...|.{..\...xy...V..?.....b...6.....7....8X....
^......_^.......x...t.......?..!..;...a....-...w..N.cF].~g.......W.w..
._....]...{...,.qk...w...w.j..Z.l...8.:..*.w.B.....GV...h.k'..^...&0..
....../..<...=..K.'%O...Mq...e.B..}...Jot_......K..<.=.e...b.Z..
..^=.Q.w.g].].w..L...8......-.....c...V..u...D.g.e9.../.>Z.....:..g
i..1.O \.vw......d.,..-R......e....l.0Nf'.&._.@{6.><gI7FUu...>
;....=..U1].......z'K:.o."z..K.l.|>.}0.s:8...`.W.hp............h..Y
........Z.........n...N..8.Z...]y.J....C..q...a.nt.3..rt9.;...........
..EgyYN>tzgG..u~0...g..7.t....w.|....k.b.....%.f0B.Sc....h.;....I..
.p...4..2 {.bP..o..B8...O.i..wF.5.Ls6.?..~&b.00.!..`q6...,N.'sh. ..`4.
...Lm........'O.......@.{......\.U.%`...=].j<.G.../.<[email protected]
..-..Lr`j...$..Fa..f.... ..z..7.^...)fw..Q<...&..zY..5..l ....(.;.N
y'f..]...2....x..._.;.s....@.:5./....MWb..e.....;....w}L.`%....u..J...
.=.]..[@(<...{..[}.:._....wzj.$.f.Z.;..4.|..y...-.?..............y.
*..7....fL....nd.......i......r.....?.N..}....g.5n.jp..OXZ........OgYZ
KQ/@..uM%y!.(:........5..M$4...7.Dv..<B.|W...da .A...l..I..S......\
..........0.X.Y....).t.....v..5*...E~..~.z...7K.Z...........GF{;..|...
..<.<-N...g=6hw.?0!....-.^.......Q.......Y.i...A...D`....Y.B
<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cha.hxsec.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Thu, 21 May 2015 15:43:03 GMT

Content-Type: text/html; charset=utf-8

Last-Modified: Wed, 20 May 2015 04:28:27 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
95c..............[O.X..~..W..IbB...d.:...V..vV..h....Sc{...]mE.R..B...
B;eE[.3Khi..B.. .c'O....s....3 .....w?....K......|....r.e.....o .K..r.
.....e.de.QqR...h...m.cjR...............Z.g..u\S.([D.fhX.........:....
u5.o.....x...i../.......%.=Of...;...i........&.d.9 GH...$....[.~m.{...
...D.EkK....wI..0...R...N.W.....7....{.`tuvv......7W*o....`gp..e.(N...
.%..n.;.`3..Jt.D.........##..! 1..XFu.[..f.n...,N..".E.x..L.....-x....
......1Y...?.......2./...W^..?.v..-...~..............3.F....d.....M.M.
......pi.=~.......L......V..[..w..........^q...|.(x....P.V..BLt..5ET.G
L.&v.-[1X..V....)]u.... [h.|...>....Cg`.OY.#X...9P..D....~....v..(.
n...w}[email protected]..@...).....i.s.h.H.e.I..<..m....1.B.W......b.....
7D.:.........p..5.e.rp.Y..~Q....N.......wa..i[62B.....~"Z...s..DP.n...
I.t]......u.M)...C"Vm.z...pt.i..0..9.~F...0Ch0...D.D...=BS.PZ..K.j.N..
Ze..$RsH...V.yF.>...x#c..S.gW.w.BN.9...18G...!....b.!.1.B"0v..f..\q
GUb.9&~.N8.....3...%&z...1Z...d...wHn>.Vw...vo.:$O..........I......
?M.om..0.Z.M.._..~..{.sH..Sa'#..b..[=..HMM...QhI....<rl%..G.q...jO.
F! I"...s*.3.`u.....1(..j.......'Y..e.G.....>.....XN.4...P.Pb....Ml
C.c.......e..%\.^.:...Dr......Gq.....0.X4`.....K6.iB3.....f.gX.QuU...4
6.|.NNQTZ~X.........0...?..I& .h\.s...........6....&..6...R..c.c.,.Tf.
%...&cr..3sS.-[..Lq.9HX......$O....*.8.....FP..E.....H..B.l ..R...`s.S
...|.1d..9z..V.s..'..F..f......*.4.6F........5.......VFs,]..7LC...F.r.
.:.0....]V...,....Z.j..I[ur:.......n..S....8....m.:)...W......O08".j..
....m..tM.......l.....U....g$.... 7s5....,..YS..#)44..b....w...w..
<<< skipped >>>

GET /static/css/bootstrap.css HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cha.hxsec.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Thu, 21 May 2015 15:43:04 GMT

Content-Type: text/css

Last-Modified: Mon, 16 Mar 2015 11:51:12 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
58c8................#7.(.y&b..Mwl..g...w.......7.;....Fx."RR.Jc...T...
..~ ....23.m.......L.....A..........F..~.>...a..j2.\..=....o.yj..~7
Y._.....?|<n.....tv5..........q......Y..S....V.qD.}..a....s;.....b.
.7...?......:.O.......7......v..K.....,O....d.....?.....|{..'..7.,.7..
f.m......f....s.....z..l...~._^..............v......|xi6...y....%..^_^
.......h.9......b._~.......u.y]m...lv....{@[email protected]...|.oO..2
...w-44.=.....)7...f.jw.......unmX....e.....x..l...S.;.O.q....?...7...
..<>.W...o.'hv6.../.~./.r...b."....6;.w.h,..........rw:4.vw.D}\.
..',..=;.A...n...$.b..x..K....=...U...{........}....<U\..G..%T.X..;
o........r3^.............`..IP...n....W..(q:..B..3..%..L]..w.......a..
==.........Q......{l~........).B...z........b....h:5/.......n..\._..d.
.."}.........=.....?..b:.........q../.............o...zE.<2........
3...p..6n.?..-.&..T0.np......b.......OP..9..Xl.Z9.....tr...x.p.T...x.y
!YZx..C.......#.5..n......#....(D...P6&..v.:.g|}hV /Y0K............(.0
..P..97$N..f5z..._F`.>..U...q... P......zv\j......L.(H.....f)...A.9
}..7.1TR...L..'..@@....^Sz................w.....7..........dOA>^6..
.\..On......G.?V....6...D....;.....]...R..nb....mP..S........=60.2.Q..
.Qi!.Igyn..O...3W.. .4...(F(Z.."....!LM...G.E..`.,..X.2...........gO..
.N.bP.....9..v...H.o..@=..Ni^.{..T..^c....a3.e.c....R..H..d..>.....
/.j..<."..}..F....F......s...'.h.<7 ....."...(.f.JU ..Q.t....o`.
.S.G.Gd.#..4..F.....]...Y.(...S9.q.woF..||.J}9z....G..VI'.7^Rx.......5
`........a....o.q.......W.*..4.7&.......y...t.. .....5...7...gg.s]
<<< skipped >>>

GET /static/fonts/glyphicons-halflings-regular.eot? HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cha.hxsec.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Thu, 21 May 2015 15:43:06 GMT

Content-Type: application/vnd.ms-fontobject

Content-Length: 20290

Last-Modified: Wed, 21 Jan 2015 02:23:00 GMT

Connection: keep-alive

ETag: "54bf0d84-4f42"

Accept-Ranges: bytes
BO...M............................LP.........................X........
............(.G.L.Y.P.H.I.C.O.N.S. .H.a.l.f.l.i.n.g.s.....R.e.g.u.l.a.
r...x.V.e.r.s.i.o.n. .1...0.0.1.;.P.S. .0.0.1...0.0.1.;.h.o.t.c.o.n.v.
 .1...0...7.0.;.m.a.k.e.o.t.f...l.i.b.2...5...5.8.3.2.9...8.G.L.Y.P.H.
I.C.O.N.S. .H.a.l.f.l.i.n.g.s. .R.e.g.u.l.a.r.....BSGP................
..v..5O.5U.-R.....`.W.hKqJ.x"U:r,/.4\.....li..........E.LFM......V(g.W
..6...V..`.m._.fZ.}..~....H....i%.[Dd..."w....z.,.....bA..i*.... 2....
8...,......B.IP.fI...I..... ....w..3.-.....b..b.....\..f.0...g..-.}..P
1.'...=....n}@[email protected]......... (,..Ug.c..1..w...L..9.....n..`...G
v..!..(..\S..JT.s.3d.&ru.N...].}.Lq...4...5.W..e.o.@7.@....`.m`...6...
P.p\.qf.3h.<@A...U&Q.*...]X.%i.,.g..!R.B.a/2...2!y3...tM....E...zE.
2......p..E...`..2.).;.B....h.P.*...}.].jE.. I.*(L....=..s..Vs..X.N..:
......e..Oo.....[.......P6.R...6<k.[...|..E......I.D.q........_....
.B. VL*..T... ...R...iY.Vn..r ....u...Z`.m....w]=....7.t%.?..|.\.f ...
.....E..../.$....#J..w.0I.'...|.$t.....\.D.a.Q0"[email protected]...$:...&.
c..zT.%.\.......E..%..9.,.als.3C..a...8...J.m...9....#....5.S...&..8..
J..!9...............{8........f....P...g<....2.]&*..!.h-....C\9.Z..
....[...4t;NCtb..F)3*DJ.Q..K.#/. {Z..=6.e......Y.X......!yl`.#.A......
.J..uO.R...O.'.'.. .$.....;.K..u..H.@z:...T...$..\0i....e.a...&......O
 ..I.(..T.Q0aN.CI.MV.s..=g.9.m.}.q...8pN.)....._...oi........D>....
..t../.l.gx(..y.{a.....D".....Z.... .1...(.dWN....r..G...|.M.E.X....q.
...:.."59Q)3e..B.`\.....YG>X.)I '.._\j...X ..o...z...Ty7*au(...
<<< skipped >>>

GET /static/js/administry.js HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cha.hxsec.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Thu, 21 May 2015 15:43:07 GMT

Content-Type: application/javascript; charset=utf-8

Content-Length: 6322

Last-Modified: Wed, 21 Jan 2015 02:23:00 GMT

Connection: keep-alive

ETag: "54bf0d84-18b2"

Accept-Ranges: bytes
/*--------------------------------------------------------------------
-..Template Name: .Administry..Version:. .1.0..Release Date: .July 12,
 2010..File:       .administry.js..Updated:    .2010-07-12..Copyright 
(c) 2010 Zoran Juric - hXXp://themeforest.net/user/zoranjuric..-------
----------------------------------------------------------------..WARN
ING! DO NOT EDIT THIS FILE UNLESS YOU KNOW WHAT YOU ARE DOING!..------
---------------------------------------------------------------*/..// 
Preload images..imageObj = new Image();..imgs = ["img/toggle.gif", "im
g/nyro/ajaxLoader.gif", "img/nyro/prev.gif", "img/nyro/next.gif"];..fo
r (i = 0; i <= imgs.length; i  ) imageObj.src = imgs[i];..// Admini
stry object setup..if (!Administry) var Administry = {}..// scrollToTo
p() - scroll window to the top..Administry.scrollToTop = function (e) 
{..    $(e).hide().removeAttr("href");..    if ($(window).scrollTop() 
!= "0") {..        $(e).fadeIn("slow")..    }..    var scrollDiv = $(e
);..    $(window).scroll(function () {..        if ($(window).scrollTo
p() == "0") {..            $(scrollDiv).fadeOut("slow")..        } els
e {..            $(scrollDiv).fadeIn("slow")..        }..    });..    
$(e).click(function () {..        $("html, body").animate({..         
   scrollTop: 0..        }, "slow")..    })..}..// setup() - Administr
y init and setup..Administry.setup = function () {..    // Open an ext
ernal link in a new window..    $('a[href^="hXXp://"]').filter(functio
n () {..        return this.hostname && this.hostname !== location
<<< skipped >>>

GET /undefined HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cha.hxsec.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx/1.6.2

Date: Thu, 21 May 2015 15:43:08 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 570

Connection: keep-alive
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx/1.6.
2</center>..</body>..</html>..<!-- a padding to d
isable MSIE and Chrome friendly error page -->..<!-- a padding t
o disable MSIE and Chrome friendly error page -->..<!-- a paddin
g to disable MSIE and Chrome friendly error page -->..<!-- a pad
ding to disable MSIE and Chrome friendly error page -->..<!-- a 
padding to disable MSIE and Chrome friendly error page -->..<!--
 a padding to disable MSIE and Chrome friendly error page -->..HTTP
/1.1 404 Not Found..Server: nginx/1.6.2..Date: Thu, 21 May 2015 15:43:
08 GMT..Content-Type: text/html; charset=utf-8..Content-Length: 570..C
onnection: keep-alive..<html>..<head><title>404 Not 
Found</title></head>..<body bgcolor="white">..<ce
nter><h1>404 Not Found</h1></center>..<hr>&
lt;center>nginx/1.6.2</center>..</body>..</html>.
.<!-- a padding to disable MSIE and Chrome friendly error page --&g
t;..<!-- a padding to disable MSIE and Chrome friendly error page -
->..<!-- a padding to disable MSIE and Chrome friendly error pag
e -->..<!-- a padding to disable MSIE and Chrome friendly error 
page -->..<!-- a padding to disable MSIE and Chrome friendly err
or page -->..<!-- a padding to disable MSIE and Chrome frien
<<< skipped >>>

GET /ajax.php?act=database HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cha.hxsec.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Thu, 21 May 2015 15:43:08 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.36

Set-Cookie: PHPSESSID=lop8q902rejind1lis9mbqdva1; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Encoding: gzip
223............mS...0..........r(}..,kI.Rl.:..v.. _....h..hvv.B.....`.
..d....q.v,.........Aq..q,.....6...A'.....r#/..&. :......U..9..P......
...g.fPZ.\[email protected]. ..t.aq....-......wt... ..[!...).E7..$
....ja4up....(o......Ze.-.....d........j.y.......s.O]..yA...3....u.$.D
ah....V#5...4k..6.|Juk....W/N.<..H.>.Z...I..y.$.....%.T.$.[....a
@../......B'.E79*.2..\....>$.;(.2..........O..r.. /F...92...U.k..{.
q....F..$.OC.\.E....ad....v).$z.-g.6C...6...v.i.G.OQ..w...-KiH.......%
.s'..g..M.v.8.e.s.E...I)}l...z.....SZC.}..I.....5~..>..|&..._....;#
......0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Thu, 21 May 2015 
15:43:08 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encodin
g: chunked..Connection: keep-alive..X-Powered-By: PHP/5.4.36..Set-Cook
ie: PHPSESSID=lop8q902rejind1lis9mbqdva1; path=/..Expires: Thu, 19 Nov
 1981 08:52:00 GMT..Cache-Control: no-store, no-cache, must-revalidate
, post-check=0, pre-check=0..Pragma: no-cache..Content-Encoding: gzip.
.223............mS...0..........r(}..,kI.Rl.:..v.. _....h..hvv.B.....`
...d....q.v,.........Aq..q,.....6...A'.....r#/..&. :......U..9..P.....
....g.fPZ.\[email protected]. ..t.aq....-......wt... ..[!...).E7..
$....ja4up....(o......Ze.-.....d........j.y.......s.O]..yA...3....u.$.
Dah....V#5...4k..6.|Juk....W/N.<..H.>.Z...I..y.$.....%.T.$.[....
a@../......B'.E79*.2..\....>$.;(.2..........O..r.. /F...92...U.k..{
.q....F..$.OC.\.E....ad....v).$z.-g.6C...6...v.i.G.OQ..w...-KiH.......
%.s'..g..M.v.8.e.s.E...I)}l...z.....SZC.}..I.....5~..>..|&..._.
<<< skipped >>>

GET /html5shiv/3.7.2/html5shiv.min.js HTTP/1.1

Accept: */*

Referer: hXXp://ip.navisec.it/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.bootcss.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: marco/0.8

Date: Thu, 21 May 2015 07:57:31 GMT

Content-Type: application/x-javascript

Content-Length: 2636

Connection: keep-alive

Vary: Accept-Encoding

X-Request-Id: dcd6f9f3c8c9225d1d83b59aacb8e1ab; 07594b4eb6b6be0fa338dfcbc40b942f

X-Source: U/200

Last-Modified: Thu, 19 Mar 2015 22:14:32 GMT

Expires: Sat, 23 May 2015 03:01:37 GMT

Cache-Control: max-age=687404

Accept-Ranges: bytes

Age: 625884

X-Cache: HIT(R) from ctn-gd-zhs-014; HIT|HIT(R) from ctn-yn-kmg-117
/**.* @preserve HTML5 Shiv 3.7.2 | @afarkas @jdalton @jon_neal @rem | 
MIT/GPL2 Licensed.*/.!function(a,b){function c(a,b){var c=a.createElem
ent("p"),d=a.getElementsByTagName("head")[0]||a.documentElement;return
 c.innerHTML="x<style>" b "</style>",d.insertBefore(c.last
Child,d.firstChild)}function d(){var a=t.elements;return"string"==type
of a?a.split(" "):a}function e(a,b){var c=t.elements;"string"!=typeof 
c&&(c=c.join(" ")),"string"!=typeof a&&(a=a.join(" ")),t.elements=c " 
" a,j(b)}function f(a){var b=s[a[q]];return b||(b={},r  ,a[q]=r,s[r]=b
),b}function g(a,c,d){if(c||(c=b),l)return c.createElement(a);d||(d=f(
c));var e;return e=d.cache[a]?d.cache[a].cloneNode():p.test(a)?(d.cach
e[a]=d.createElem(a)).cloneNode():d.createElem(a),!e.canHaveChildren||
o.test(a)||e.tagUrn?e:d.frag.appendChild(e)}function h(a,c){if(a||(a=b
),l)return a.createDocumentFragment();c=c||f(a);for(var e=c.frag.clone
Node(),g=0,h=d(),i=h.length;i>g;g  )e.createElement(h[g]);return e}
function i(a,b){b.cache||(b.cache={},b.createElem=a.createElement,b.cr
eateFrag=a.createDocumentFragment,b.frag=b.createFrag()),a.createEleme
nt=function(c){return t.shivMethods?g(c,a,b):b.createElem(c)},a.create
DocumentFragment=Function("h,f","return function(){var n=f.cloneNode()
,c=n.createElement;h.shivMethods&&(" d().join().replace(/[\w\-:] /g,fu
nction(a){return b.createElem(a),b.frag.createElement(a),'c("' a '")'}
) ");return n}")(t,b.frag)}function j(a){a||(a=b);var d=f(a);return!t.
shivCSS||k||d.hasCSS||(d.hasCSS=!!c(a,"article,aside,dialog,figcap
<<< skipped >>>

GET /respond.js/1.4.2/respond.min.js HTTP/1.1

Accept: */*

Referer: hXXp://ip.navisec.it/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.bootcss.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: marco/0.8

Date: Thu, 21 May 2015 07:57:33 GMT

Content-Type: application/x-javascript

Content-Length: 4377

Connection: keep-alive

Vary: Accept-Encoding

X-Request-Id: 066fc10566484c7e9c5a1995a4288f92; 19251fc4fd82a2937cd7b00d39485efb

X-Source: U/200

Last-Modified: Fri, 20 Mar 2015 16:03:02 GMT

Expires: Mon, 25 May 2015 23:44:46 GMT

Cache-Control: max-age=641631

Accept-Ranges: bytes

Age: 608797

X-Cache: HIT from ctn-fj-foc-009; MISS(S)|HIT from ctn-yn-kmg-117
/*! Respond.js v1.4.2: min/max-width media query polyfill * Copyright 
2013 Scott Jehl. * Licensed under hXXps://github.com/scottjehl/Respond
/blob/master/LICENSE-MIT. *  */..!function(a){"use strict";a.matchMedi
a=a.matchMedia||function(a){var b,c=a.documentElement,d=c.firstElement
Child||c.firstChild,e=a.createElement("body"),f=a.createElement("div")
;return f.id="mq-test-1",f.style.cssText="position:absolute;top:-100em
",e.style.background="none",e.appendChild(f),function(a){return f.inne
rHTML='­<style media="' a '"> #mq-test-1 { width: 42px; }<
;/style>',c.insertBefore(e,d),b=42===f.offsetWidth,c.removeChild(e)
,{matches:b,media:a}}}(a.document)}(this),function(a){"use strict";fun
ction b(){u(!0)}var c={};a.respond=c,c.update=function(){};var d=[],e=
function(){var b=!1;try{b=new a.XMLHttpRequest}catch(c){b=new a.Active
XObject("Microsoft.XMLHTTP")}return function(){return b}}(),f=function
(a,b){var c=e();c&&(c.open("GET",a,!0),c.onreadystatechange=function()
{4!==c.readyState||200!==c.status&&304!==c.status||b(c.responseText)},
4!==c.readyState&&c.send(null))};if(c.ajax=f,c.queue=d,c.regex={media:
/@media[^\{] \{([^\{\}]*\{[^\}\{]*\}) /gi,keyframes:/@(?:\-(?:o|moz|we
bkit)\-)?keyframes[^\{] \{(?:[^\{\}]*\{[^\}\{]*\}) [^\}]*\}/gi,urls:/(
url\()['"]?([^\/\)'"][^:\)'"] )['"]?(\))/g,findStyles:/@media *([^\{] 
)\{([\S\s] ?)$/,only:/(only\s )?([a-zA-Z] )\s?/,minw:/\([\s]*min\-widt
h\s*:[\s]*([\s]*[0-9\.] )(px|em)[\s]*\)/,maxw:/\([\s]*max\-width\s*:[\
s]*([\s]*[0-9\.] )(px|em)[\s]*\)/},c.mediaQueriesSupported=a.match
<<< skipped >>>

GET /static/js/bootstrap.min.js HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cha.hxsec.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Thu, 21 May 2015 15:43:08 GMT

Content-Type: application/javascript; charset=utf-8

Content-Length: 27822

Last-Modified: Wed, 21 Jan 2015 02:23:00 GMT

Connection: keep-alive

ETag: "54bf0d84-6cae"

Accept-Ranges: bytes
/*!. * Bootstrap v3.0.3 (hXXp://getbootstrap.com). * Copyright 2013 Tw
itter, Inc.. * Licensed under hXXp://VVV.apache.org/licenses/LICENSE-2
.0. */..if("undefined"==typeof jQuery)throw new Error("Bootstrap requi
res jQuery"); function(a){"use strict";function b(){var a=document.cre
ateElement("bootstrap"),b={WebkitTransition:"webkitTransitionEnd",MozT
ransition:"transitionend",OTransition:"oTransitionEnd otransitionend",
transition:"transitionend"};for(var c in b)if(void 0!==a.style[c])retu
rn{end:b[c]}}a.fn.emulateTransitionEnd=function(b){var c=!1,d=this;a(t
his).one(a.support.transition.end,function(){c=!0});var e=function(){c
||a(d).trigger(a.support.transition.end)};return setTimeout(e,b),this}
,a(function(){a.support.transition=b()})}(jQuery), function(a){"use st
rict";var b='[data-dismiss="alert"]',c=function(c){a(c).on("click",b,t
his.close)};c.prototype.close=function(b){function c(){f.trigger("clos
ed.bs.alert").remove()}var d=a(this),e=d.attr("data-target");e||(e=d.a
ttr("href"),e=e&&e.replace(/.*(?=#[^\s]*$)/,""));var f=a(e);b&&b.preve
ntDefault(),f.length||(f=d.hasClass("alert")?d:d.parent()),f.trigger(b
=a.Event("close.bs.alert")),b.isDefaultPrevented()||(f.removeClass("in
"),a.support.transition&&f.hasClass("fade")?f.one(a.support.transition
.end,c).emulateTransitionEnd(150):c())};var d=a.fn.alert;a.fn.alert=fu
nction(b){return this.each(function(){var d=a(this),e=d.data("bs.alert
");e||d.data("bs.alert",e=new c(this)),"string"==typeof b&&e[b].call(d
)})},a.fn.alert.Constructor=c,a.fn.alert.noConflict=function(){ret
<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ip.navisec.it

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 21 May 2015 07:57:28 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.4.24

Set-Cookie: sid=69127d6fe04dfc49116a2abd58d45592; expires=Fri, 20-May-2016 07:57:28 GMT; path=/

Content-Encoding: gzip
a99...............n........M6..,..n.L2!e.U..N."-......c.M;...&.A..F#.E
...E..I...].E..I.~.) O...3...$..-/[email protected]../.t.@.~.....&>..
.qe`..6`.Hc.....F.$%..&......US([email protected].).l...~.... ...|f.'.%.a.z..\.Mo
.i...&g.8J.....r.t.&w.../..r..o....Y9H.e.Ix,y.N.:.GS9...(.K...........
....ol...wwn.K.`v..Gd.......7>wTQ9fY..ER....#ad..YbY.....d..~.@....
....f...j.J........:n...#........B.$a~..r.31`L.....T.( z.......D. ..dO
)LN.P9r.....U..%)D.........J;..R...G.4.#.D....9I.#S..#pD<. 0.H..tL.
.f(....k?]"b..BC...D..n..6.z.FD.c....!3...ABm...).HY.......y.'....~AO.
8%"q.k...-h....\.a6...J.:.....fh...#.L...Ji.h...).;.B../..L.m..\...4..
[o...N..|?.......W8A."..@u#'Es...A.t....M.8....-...o.6.=..T.$.)_f  .ry
ee.... ..r.\.;}V...j.1##.l.4W.......Q.4.......'..)J1M..t.....Kd.A...A.
..Z....k`.h.;...."w..WH7..S!...=.M.Y.....#....s-..:..4\^l.rE!p.lm.b...
O..4...^.../.y\.U..S....g^9....i.4.d..L..l...u....O.........U...D`U...
\............dUr.l...b6^ ..`.F.g...)..T[;.}......{{..[..{w|...[.>.u
o|}..Wma.f[[email protected] (vI.m... .&.6..=......O.~.....0N.
.%Q...PRi..9.H.(.G........8[....P';.="G..<.....**l..AvC..P.qo W....
.>.Y._a...xKk....[>.=h..B. ...6.|.Fh..`....A*.>[email protected]..
.s`..... [email protected]_.p.ZA(......*YU....[6 #.C..(.6!.......q%..).j.!b.f...lK
Z,I.d..{......_.x......=...2el...ha...&i..L...x....e......2......WS2L.
.......K.....H.c...sA...<...........1u]h...x.T...).{..=.DVeY...u"..
....KD.C6.T....G,..yfk...P .cU......0.R.7.....!.......p...*..Re.V..B.\
.4l5..&..?..........._....]=......;........=...)..5k. o..[.. ....*
<<< skipped >>>

GET /js/public/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.chacuo.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 21 May 2015 07:57:30 GMT

Content-Type: application/x-javascript

Last-Modified: Fri, 19 Sep 2014 16:21:58 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Sat, 20 Jun 2015 07:57:30 GMT

Cache-Control: max-age=2592000

X-UA-Compatible: IE=Edge, chrome=1

Content-Encoding: gzip
800a.................F./..<E..).b..(.s.....d.....4..aQ.p#..o"Y*.E..
....m."2...,..;g..*...kdd...i.l..w.....~............g{s.....2.........
..e. WK?VI.`....~.<l...fy6..._.e.....8.{.U......(..0.e.$....Z...}.[
..|../.N.P.z.Z...Ig.x.<..7gI...U.Qe.....n...{A/^..e.f.'.....n......
<..............B..[........<......R..&.w...|A...r.........._.6Y.
.....vS\L......@%.'/..<....N:..;T.Vu..#..W......z.j..q.^..T:..o.]..
...n.^mv4..~..........L.Mw..s/..u.k....=.0..t..b*..7...\.ek..0....LU.J
..y..=.ZE.AC..:k....R...a0..q:..5...;.:......m.{..}.(.z.T.........L3N.
[.y.%...=...7."_...t...O........AI..6..L/......^....S2.i...e.YmW.].o?|
...7?{4.xG.......m....n...v.v..aB.....e.].M9....s?...~...;,....,..mi..
..PSU.....b7U3u.e......Z..Z.&.._D.Aq]..n.w^A.......\R.i....jv...V..)m.
.nS............}.y...h...F.q0.G..z1.....{....|......y......6xXD..w.uo.
2.G.1.........2xXG..`.~...,Z..HKZ.3.7...Km.N.Wh...G.Q.,.su..aEOWc..R..
.2Z.k.....U0Hh..........>?'0.l.y.....w...l..z.....0......v .S...]g.
-.K?...... 8.Z.:.4.L6O...4.U..z.t.....a.o.|.m..Xr...3T.....Q1*.cZ.....
6r.O.."<3-';?P..QB.L....$.F..W.......cB...{v....bV..m<......s...
h..{:PzwKi.4sL%...5.E.d(y..erD..N...J^S....J]#..mT..Y4........@Q,.....
.l4.;.3..XL.......f.....h..T. Q...~.........y....7....Lt.y F/.0..=.T.-
..3.......Z..ox..:03I`....d...*.(cT....... .hAx1...^...m.mo2.w?.Qv...w
Sk.ZJ.t..;..~A.t..l.@[email protected]>.ld~.Ja....[.......!...,`.].Q..U1..
i.0.#x.;.nWj.M.S... .21`...s_....:H....L...GS.@....^.y..u.x1....(.}.;.
L...wU...y.y.......G.....3.4 6w&...9U.....b.q..F.Jx..44~c>"d"..
<<< skipped >>>

GET /js/tool/p.js HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.chacuo.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 21 May 2015 07:57:32 GMT

Content-Type: application/x-javascript

Last-Modified: Thu, 08 Aug 2013 10:17:55 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Sat, 20 Jun 2015 07:57:32 GMT

Cache-Control: max-age=2592000

X-UA-Compatible: IE=Edge, chrome=1

Content-Encoding: gzip
6da.............W.o.V......k2.nS....R*T@cBE.<-...o.S...u?D#.6J.....
.!.[a.&P.......N.....s..W..>.%..9.|...=.....o-....V.~\....~.....{..
.._m..}.}./.).<0c..q...3.g.0....jk....Z.]....j.....EU.M..!>..l..
....&dM..]K.M.6....q.P....,..<.y./....t..vUR..:[email protected]$.|BC......M
Q..*..n.Z.N..$e....*.;r,.Vw~.'Z.)..z..Z|...8]..FJ........a.;q(........
...)E..$yD...N}............&Q.KJI....J.4...'.Mc....` .Xv`L9.RJ..C...P.
2.....=.Oj.#.........q..]U...W..^@U.3..Z...Z..3 C.Z.Q..!n........S....
<q- wA.......s..@^..GU..A.....3.Q.h...;K[o_....v....9.,...Z^..D....
..s.\....l.p.., ".*..;.wO.......5h.$q........^......E..N....u...Q#....
...!w.....Xd..#Y....2.).s.d...O...sD...@.(3h.c..II.....} a...X..D6K)..
.........p...O..o..,..oo..^.Bf.K....I.q.;.I.4...YW.T... .Y...1I*..R.x.
..o...I......R:.....T...v.d2m:.2.Y..X....W.....qb.'>.....nnl......q
v..0hj5.....h.V......?.\N......6h:^@*...."..vO....C....$dJ......'.A..J
R..igs.x...yM.....j.........h.v..f.(.o.A.hup|......1.d.f..l6!..;....tL
:.q.eA.e.zh..J./3....&............[....}.2.k..(...0d....C......q..]2 }
M|o.^.<..tx.^[email protected]?.|5......)[email protected]...
...Ww.`z..C(.6......do&....}r.....d......@RGXEL?Cq.....aA....01tj.....
.w..%....K$S.*......O.XOF.....(.o..e..,.d.`.....a.<...3.........n..
 ..$...r.3<..}}.i.3A..:N..8.'......c.......)..0p......7._....M.,..U
C..h.H.;...%.L.,{... E..lB..h..x.` ..;.....$e.O!....a2.`...7;BHv.4.^2|
-N....7I...."..t_.;#_..YQ.....2R...D..f.o....r...1.?...mF. ..d.J.h\...
.........=N<....90.%...]ux....$<..t.;E...LOd..>f.O.....5.
<<< skipped >>>

GET /js/public/ZeroClipboard.js HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.chacuo.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 21 May 2015 07:57:33 GMT

Content-Type: application/x-javascript

Last-Modified: Sun, 04 Nov 2012 09:01:34 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Sat, 20 Jun 2015 07:57:33 GMT

Cache-Control: max-age=2592000

X-UA-Compatible: IE=Edge, chrome=1

Content-Encoding: gzip
d41..............ks.6..3.....R:...K.....8.........\_."A.1E.$hY......A.
..........}a_.d.N....;...e..)^&.t]i.|.h2a/k.P..}.*Q,..:.....G..]...G..
Yv.>=~....DYI.OYo..7..7..8."...}..1@\...]J.....O..`*g.....y".a~.f2.
.Ku%....S..W....l.M>V...e2....W.4..~..-...j...k}.L.>M..f*e8.....
S..y....^.|...o;..2.{........Vk.I..K.P.....P.Gpx..J........%*....x..q&
....$q....'f`...(.Ue.B..x.'L..l%..q.... ...[.PbR..E.....=...i...^gb...
.8...*....9..W..z......py....(.hB...80.1....l.x.o.p..?X.e...A.%t.a...@
..../.pb.o.er....v(U%...%.....s.r..|..06..-I........qm0_......... ....
.4....<.}D8b..Q..._..G%.>..A.]J..2'........[.v..'......}8m ...._
.../.T..YM..y.8...DUC....7#sV ..5...T.kph....:..7.0D.w0..B...I#...2.1q
.G...1^..f.R.B^....R-Y..X.73.....5......,...J...2.....9a......w.w..Rt.
8..a..9...1K...b....h%...P....i..}....*.)Dx...#HE.. ..`...Je..,V.Ld.5.
[<....z='>.......L.z..F.X.*...L.\`.1=.o.g3.....g....B.....g.....
.......%l...7.O.............#....toa....E..3U.iD.N|[email protected]..#RX...l
..X....X..Q.h.6....7.........9..S...j....J.....D....}8O.2j...........-
.Z/...\H&4...1....t....o...f.p...`.>...jDHk.Y-.;...#c..m...E.....I.
dB.....PWt.y........Z@.....& F..g..".v....u...,..,..O......T.8..L!....
..}.*........... U..|......M&,...aYL.#$-.).3....H.4..T.q..5U.M.~vtz..C
.......=.X..2.....3..V..[[email protected].~.(....3.<..z.$...U......B:...<
;g3."..c].,.m.m.......I...*g.).G.>...NH.,6...'[email protected].
...=.bl.g .....^V....]. Q.....oB}'.nD....v.....k......c...J.P..{l...W.
3>....f*YG....6C..(h..&..{6..K.F,N.3u.......kh..<.Y.H..>.
<<< skipped >>>

GET /css/ui-lightness/images/ui-icons_222222_256x240.png HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.chacuo.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 21 May 2015 07:57:33 GMT

Content-Type: image/png

Content-Length: 4369

Last-Modified: Tue, 16 Oct 2012 15:23:50 GMT

Connection: keep-alive

Expires: Sat, 20 Jun 2015 07:57:33 GMT

Cache-Control: max-age=2592000

X-UA-Compatible: IE=Edge, chrome=1

Accept-Ranges: bytes
.PNG........IHDR..............IJ.....PLTE$"$$"$$"$$"$$"$$"$$"$$"$$"$$"
$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$
$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$
"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$$"$..
.....NtRNS...2..P...."Tp@f`.... <.BHJ.Z&0R,.4...j...8D...|.......(.
.$......b...l..F>n~.hh.H.....IDATx..].b.....H....-{i.ZK:g..lk.n..-.
.tI....q...q?  E.$..dK>.$.>..;.........P.Z.....s..V..h!...Sy..0.
..E.0}H.)-.....t.k..o...Kp....\.R... ......E.7......)..*V;~.Pe...Bx..*
..,=$z...D............ ...J................9.{ ...........Hp.q.W@.."2'
...........B..[.$.. @T..i.H./..b..9.6.!..X.Hq`DE..*R.......H.V!.%.....
..;........"........i...]..dddddddd.......4y....5. ......Rb...@(.8....
Cd........,.@[email protected]!..........p..e.,...=4b.W .{..5.....hu
~.(...Q..^@...3..=...."[email protected]_....5
...@,r......D..).T..|[email protected]..................[[email protected]....(
.....F .@.?..=0....puL..;[email protected]..`....>... @h .....K..V.n.
..."a."....%[email protected].$/..U^....G...:..#`.`.. .u..TtK....~.....Z...5.T.
..%.k..x...........k..]\.*.Q.....,......B..44..OXK.|..y..g.... _.M.(..
.l..E..O.... .V$.T1BX.....b.-.|?@ .f..B.Xr..%'@..A.\.I...J,}..BBc..\.V
...r.....h(.]tI..^.....}....o...o..S3..";...........b}...".......){b$.
.........Gw.w..............a...b"..)[email protected]_er6.Jv........"m....M-..
d7..6..x......6...;..../.......`>Kr.P\...._....^u.1%..O..T.M.....}.
....Q.3........N.....}.....)...>......-.w.`....a....... sy$....
<<< skipped >>>

GET /images/public/myip-logo-wide.png HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.chacuo.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 21 May 2015 07:57:34 GMT

Content-Type: image/png

Content-Length: 15737

Last-Modified: Tue, 16 Oct 2012 15:24:14 GMT

Connection: keep-alive

Expires: Sat, 20 Jun 2015 07:57:34 GMT

Cache-Control: max-age=2592000

X-UA-Compatible: IE=Edge, chrome=1

Accept-Ranges: bytes
.PNG........IHDR..."...S.....;..f....sRGB.........gAMA......a.....pHYs
..........o.d..=.IDATx^.].X.W....[...t;..b7.c.11.....n6.t..5Q..Q.]c..D
D.....{..... R..s..|3....3..D.y..L.....}.=.9...n....$.H.., [email protected]......
.....}..*].}......o.R\.....T..R.;..F..........$.H..,...........h....?.
.y.....(;......Wi2.(V....V?^.Q. Ri.N..~c.^......G....Nt.......l,[email protected].
.,...?n.sV..?.....d}.I..R.R5..*gR)..J5.....0.(..:k.e.](C9.2.#..r.<.
[<...R.;l....d.....L-PV....p.*...J.r!....d>CJ......V.C{.`4.4x...
G....V...E?. ......_U....u..%.H..,`..t:..  ....=6&]..T..`8CI.p...#M.?H
.y.....f$..X.f.ei........<.....I>T._.._.......M..v., Y....A.j.o.
.....<Z..;.D.dF..b.......=Fj......v4..y.(....."...........AJ.k2.sK.
..3...d.f..),...N'.9...s....N.........S.]O..N9.R<.....0u..@y..."...
...~. ........,p.Y.......{.I.f.R.bV3.....0......P>A..0.,..........#
.r$.).5],Y:....d....$=......(..dJ.......c...E..7..|..]H...i.d..D..OT&g
t;.../*7..........I.<.H\....Y.o..J....7...^.1T..h.F..F..#0......g`F
.t..G.F..d.......T.p.0$.xj0(.j...|....Z...3Gb.O.F..3.x...l......b:...{
..b../......]...&.(....."..p........c....|y....1qqq....E..%...-PQq....
....}!43..%....b1x......B...y. ....Fm......9U`Y.jJ......R]}...dA..^...
..f..[L....h.Ml!....A.....>c0:../.......>...1(.1K:.......J.1....
..../}pB..t*.!Y@....../Tty.{[email protected]..*..
.}.........5..8V>................."r..../...... .......\2....".Bl .
X...9.$.X..p..9(.......j..........<.....k.."Y....U.................
..n...Q3....'.i.A.f0j_7b.O.5F]...[l.....}.sK..........wt........D1
<<< skipped >>>

GET /WebResource.axd?d=S8JCuF17GL8Co4Q1PcRpUhjPtu7GuFZPa2HvxUJ1n-PaDOPrKRpQyub4y_NSxomVWKbZ3Amf7JdiAUfX0&t=635418570520000000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cmd5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.cmd5.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=kvojhay3wethdsgkaijl14tm

HTTP/1.1 200 OK

Cache-Control: public

Content-Type: application/x-javascript

Content-Encoding: gzip

Expires: Fri, 20 May 2016 01:45:58 GMT

Last-Modified: Thu, 24 Jul 2014 19:50:52 GMT

Vary: Accept-Encoding

Server: Microsoft-IIS/7.0

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 21 May 2015 07:57:31 GMT

Content-Length: 5770
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"...i[T.....YU/~..U.>..o.\..f
 .........Q...........YY.2........Q.1...r..5.|VM..(.....z=Y.......IJO;
/.1...... .....``.......j...7a..v...........n.....7..N..?../....l<.
.||.h.fN*.i.w........Y.......R..8O.[..-.<h.^...|.ev...'..OJ..N..g..
....7.8.......L.;.&."..k~. .X`[email protected]'.]?K?Z/g.y..g..I../t....j...y
..q.//.yz........s....a.^.....6M....cj..i.[.n......|......~..../O.z...
.....C..%N..5.eb.p....pF.....2?...Q...(xl.`.uNc3.`..D..<..'/.|...P.
...(G:.....J.8..;|5L6..a...&..5.e.........m....O...a.c4.`.."B......?z.
.;.y......2\.k.`....?.Z...xv.2.1NF.QW.?.........X^.de9!h..e~...uv....Y
s....jY..4E.gD.w.|{.Z............4-.4W.6.........&?.....jE.x..........
@....i.?..N..?.r|.{.=........rZ.r.....(._. .<~u......AP.....C}.....
7?y......./_|.};N<v...SS....:..........e..[..._...vdx...}.\..=.....
...v..2.P3.t.....I.....O..1..e.{.9..|.n}.E1...:o........~.h_xb......l.
V..v.......W..wE.B.<...../ny. u...w_4. R.m..XNu*.0H..0o.oE...S...n.
.H.5.......f............}...0\..(.gE....YQf.2.]V.V_..F._..!9....H%...7
...Y.....<...7...4..AE........53..[..w.w.3|..p...Z....i..........0.
G.'.bU...d<....E/.?..w....b..I....1.....IND..?C....8........*k.....
...............|.....L4..&|.w%..2....k.....v:.....x........j...._~....
...n'.6Q..fX.3.... ....W..... ....18.].x....x|......pWx...,g....3.A.N.
2.o..#"....CS..EP....G]...._. . ....^~...G&..\.3{x..]9.....r.n.!'.`|..
Ve!l}.......9q...&_....S....}.n.........m......v].$..*...{..2...$q
<<< skipped >>>

GET /ScriptResource.axd?d=8kw2QGXGrGOupEkdkvFNFmbaNcRz_Gz0KsidtKq5WtOmcZl7dEpgbBGY2PYjMK92fK2_8Ht93pa1KFxcdbj__67p5NgbscY5cIqo7s_JNVKp5m57iW0JszGWxOQ1&t=24efffe1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cmd5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.cmd5.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=kvojhay3wethdsgkaijl14tm

HTTP/1.1 200 OK

Cache-Control: public

Content-Type: application/x-javascript; charset=utf-8

Expires: Fri, 20 May 2016 01:46:30 GMT

Last-Modified: Thu, 21 May 2015 01:46:30 GMT

Server: Microsoft-IIS/7.0

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 21 May 2015 07:57:33 GMT

Content-Length: 33253
var __rootMenuItem;..var __menuInterval;..var __scrollPanel;..var __di
sappearAfter = 500;..function Menu_ClearInterval() {..    if (__menuIn
terval) {..        window.clearInterval(__menuInterval);..    }..}..fu
nction Menu_Collapse(item) {..    Menu_SetRoot(item);..    if (__rootM
enuItem) {..        Menu_ClearInterval();..        if (__disappearAfte
r >= 0) {..            __menuInterval = window.setInterval("Menu_Hi
deItems()", __disappearAfter);..        }..    }..}..function Menu_Exp
and(item, horizontalOffset, verticalOffset, hideScrollers) {..    Menu
_ClearInterval();..    var tr = item.parentNode.parentNode.parentNode.
parentNode.parentNode;..    var horizontal = true;..    if (!tr.id) {.
.        horizontal = false;..        tr = tr.parentNode;..    }..    
var child = Menu_FindSubMenu(item);..    if (child) {..        var dat
a = Menu_GetData(item);..        if (!data) {..            return null
;..        }..        child.rel = tr.id;..        child.x = horizontal
Offset;..        child.y = verticalOffset;..        if (horizontal) ch
ild.pos = "bottom";..        PopOut_Show(child.id, hideScrollers, data
);..    }..    Menu_SetRoot(item);..    if (child) {..        if (!doc
ument.body.__oldOnClick && document.body.onclick) {..            docum
ent.body.__oldOnClick = document.body.onclick;..        }..        if 
(__rootMenuItem) {..            document.body.onclick = Menu_HideItems
;..        }..    }..    Menu_ResetSiblings(tr);..    return child;..}
..function Menu_FindMenu(item) {..    if (item && item.menu) retur
<<< skipped >>>

GET /ScriptResource.axd?d=Gg2PHGmx05BaJ5iUyUfueHdJy9OFveRskW4DxHew3cKR-TIFIOUMV8qp5kYaNtAEa0s3tRHwOeAFRvXLtvyOB89-su708SbdvGGKPTkPHKYSPHxmZR4Ref93-W1sQbHCC0Ypmw2&t=f2cd5c5 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cmd5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.cmd5.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=kvojhay3wethdsgkaijl14tm

HTTP/1.1 200 OK

Cache-Control: public

Content-Type: application/x-javascript; charset=utf-8

Expires: Fri, 20 May 2016 01:46:30 GMT

Last-Modified: Thu, 21 May 2015 01:46:30 GMT

Server: Microsoft-IIS/7.0

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 21 May 2015 07:57:42 GMT

Content-Length: 95651
// Name:        MicrosoftAjaxWebForms.debug.js..// Assembly:    AjaxCo
ntrolToolkit..// Version:     4.1.40412.0..// FileVersion: 4.1.40412.2
..// (c) 2010 CodePlex Foundation..(function() {..function execute() {
..Type._registerScript("MicrosoftAjaxWebForms.js", [..."MicrosoftAjaxC
ore.js",..."MicrosoftAjaxSerialization.js",..."MicrosoftAjaxNetwork.js
",..."MicrosoftAjaxComponentModel.js"]);..var $type, $prototype;..Type
.registerNamespace('Sys.WebForms');..$type = Sys.WebForms.BeginRequest
EventArgs = function BeginRequestEventArgs(request, postBackElement, u
pdatePanelsToUpdate) {..    /// <summary locid="M:J#Sys.WebForms.Be
ginRequestEventArgs.#ctor">The arguments for the PageRequestManager
's beginRequest event. The beginRequest event is raised when a request
 is about to be made.</summary>..    /// <param name="request
" type="Sys.Net.WebRequest">The web request for the EventArgs.</
param>..    /// <param name="postBackElement" domElement="true" 
mayBeNull="true">The postback element that initiated the async post
back.</param>..    /// <param name="updatePanelsToUpdate" typ
e="Array" elementType="String" mayBeNull="true" optional="true">A l
ist of UniqueIDs for UpdatePanel controls that are requested to update
 their rendering by the client. Server-side processing may update addi
tional UpdatePanels.</param>..    var e = Function._validatePara
ms(arguments, [..        {name: "request", type: Sys.Net.WebRequest},.
.        {name: "postBackElement", mayBeNull: true, domElement: tr
<<< skipped >>>

GET /WebResource.axd?d=_tn8Sw83Ad_JwjaN-u0-3ImnFP5TrTvQIBSf3at4ZDPH-7ob3ElljVrRU7ZbjPJ_RN7o6GroV6tIsCDPYbeAts7lilk1&t=635418570520000000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cmd5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.cmd5.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=kvojhay3wethdsgkaijl14tm

HTTP/1.1 200 OK

Cache-Control: public

Content-Type: image/gif

Expires: Fri, 20 May 2016 01:46:10 GMT

Last-Modified: Thu, 24 Jul 2014 19:50:52 GMT

Server: Microsoft-IIS/7.0

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 21 May 2015 07:57:43 GMT

Content-Length: 60
GIF89a.............!.......,...................s........P..;...
.


GET /WebResource.axd?d=JsbaKI1xyr07iSHvhlKz9NbKZww4CRuVBWdRJwqAMPrwIsGkqabhrh80JeslBYNpRn2inbpa936aVXXiTIgIFkYxaMg1&t=635418570520000000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cmd5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.cmd5.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=kvojhay3wethdsgkaijl14tm

HTTP/1.1 200 OK

Cache-Control: public

Content-Type: image/gif

Expires: Fri, 20 May 2016 01:46:10 GMT

Last-Modified: Thu, 24 Jul 2014 19:50:52 GMT

Server: Microsoft-IIS/7.0

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 21 May 2015 07:57:43 GMT

Content-Length: 61
GIF89a.............!.......,.................Q......k....x..;HTTP/1.1 
200 OK..Cache-Control: public..Content-Type: image/gif..Expires: Fri, 
20 May 2016 01:46:10 GMT..Last-Modified: Thu, 24 Jul 2014 19:50:52 GMT
..Server: Microsoft-IIS/7.0..X-AspNet-Version: 4.0.30319..X-Powered-By
: ASP.NET..Date: Thu, 21 May 2015 07:57:43 GMT..Content-Length: 61..GI
F89a.............!.......,.................Q......k....x..;..

GET /img/pic.gif HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: icon.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 719

Connection: keep-alive

Date: Wed, 20 May 2015 08:47:12 GMT

Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT

Expires: Thu, 21 May 2015 08:47:12 GMT

Cache-Control: max-age=86400

Accept-Ranges: bytes

Via: cache1.l2de1[568,304-0,H], cache23.l2de1[574,0], cache1.de1[0,200-0,H], cache9.de1[1,0]

Age: 83423

X-Cache: HIT TCP_MEM_HIT dirn:7:335122827

X-Swift-SaveTime: Wed, 20 May 2015 08:47:12 GMT

X-Swift-CacheTime: 86400
GIF89a2.........f..3...33.............................................
.......................................!..NETSCAPE2.0.....!..Powered b
y AFEI.!.......,....2...... !.di.hjBl..p,....x......`P.(...GR.D6...CH.
...,..@8.... -..EQc.8...........`...."....................~"..H.......
.H......"...$....#.........."..........."Z.......*...%!.!.......,....2
...... !.di.hjBl..p,....x..|....p r..H.C.\&.H.tJu...#b......7..W.h....
...7..l..v..-....."....................~"..I........I......"...$....#.
........."..........."\.......*...%!.!.......,....2...... !.di.hjBl..p
,....x..|....p r..H.C.\&.H.tJu...#b......7..W.h.......7..l..v..-....."
....................~"..I........I......"...$....#..........".........
.."\.......*...%!.;HTTP/1.1 200 OK..Server: Tengine..Content-Type: ima
ge/gif..Content-Length: 719..Connection: keep-alive..Date: Wed, 20 May
 2015 08:47:12 GMT..Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT..Expi
res: Thu, 21 May 2015 08:47:12 GMT..Cache-Control: max-age=86400..Acce
pt-Ranges: bytes..Via: cache1.l2de1[568,304-0,H], cache23.l2de1[574,0]
, cache1.de1[0,200-0,H], cache9.de1[1,0]..Age: 83423..X-Cache: HIT TCP
_MEM_HIT dirn:7:335122827..X-Swift-SaveTime: Wed, 20 May 2015 08:47:12
 GMT..X-Swift-CacheTime: 86400..GIF89a2.........f..3...33.............
......................................................................
.!..NETSCAPE2.0.....!..Powered by AFEI.!.......,....2...... !.di.hjBl.
.p,....x......`P.(...GR.D6...CH....,..@8.... -..EQc.8...........`...."
....................~"..H........H......"...$....#..........".....
<<< skipped >>>

GET /img/pic1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cmd5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: icon.cnzz.com

Connection: Keep-Alive

Cookie: cna=8H3kDZBxtXICAcGK9Oe2pGU2

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 428

Connection: keep-alive

Date: Thu, 21 May 2015 07:39:07 GMT

Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT

Expires: Fri, 22 May 2015 07:39:07 GMT

Cache-Control: max-age=86400

Accept-Ranges: bytes

Via: cache3.l2de1[905,200-0,M], cache42.l2de1[906,0], cache4.de1[0,200-0,H], cache9.de1[1,0]

Age: 1114

X-Cache: HIT TCP_MEM_HIT dirn:1:496165810

X-Swift-SaveTime: Thu, 21 May 2015 07:39:08 GMT

X-Swift-CacheTime: 86399
GIF89a.......f..3...33.......................................!..NETSCA
PE2.0.....!..Powered by AFEI.!.......,.............I........08bX....d.
n...CS.3......_..`..H..H\8....)...S.b.UX.....(...r.L....tb]&"......#..
.o.V.a..D..o.V.a..........D..o.V.a..........D...........!.......,.....
........I........08bX....d.n...CS.3......_..`..H..H\8....).:[email protected]...
x ..........D.| .#.u.a....n~D..[....n..........D..[...n..........D....
.......;HTTP/1.1 200 OK..Server: Tengine..Content-Type: image/gif..Con
tent-Length: 428..Connection: keep-alive..Date: Thu, 21 May 2015 07:39
:07 GMT..Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT..Expires: Fri, 2
2 May 2015 07:39:07 GMT..Cache-Control: max-age=86400..Accept-Ranges: 
bytes..Via: cache3.l2de1[905,200-0,M], cache42.l2de1[906,0], cache4.de
1[0,200-0,H], cache9.de1[1,0]..Age: 1114..X-Cache: HIT TCP_MEM_HIT dir
n:1:496165810..X-Swift-SaveTime: Thu, 21 May 2015 07:39:08 GMT..X-Swif
t-CacheTime: 86399..GIF89a.......f..3...33............................
...........!..NETSCAPE2.0.....!..Powered by AFEI.!.......,............
.I........08bX....d.n...CS.3......_..`..H..H\8....)...S.b.UX.....(...r
.L....tb]&"......#...o.V.a..D..o.V.a..........D..o.V.a..........D.....
......!.......,.............I........08bX....d.n...CS.3......_..`..H..
H\8....).:[email protected] ..........D.| .#.u.a....n~D..[....n..........D..
[...n..........D...........;..
<<< skipped >>>

GET /pagead/js/r20150514/r20150515/show_ads_impl.js HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 14723468457478239456

Date: Thu, 21 May 2015 07:57:31 GMT

Expires: Thu, 21 May 2015 07:57:31 GMT

Cache-Control: private, max-age=1209600

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 66985

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=1
...........}.z.....?.....A...'.v....!.....f....3..Cl..Vij.@....;....\*
.JU.|....p2..Ow.,7...pNl.....4....8w7..\i....qT...W..-.8...E^ j..Z....
.;.n8....[..|.......Y..5.\  .n..Y...i......lm.=,}.......f.b.yG....k9.T
..4d......J[........}........UH.m.x......Xc.>gC.~..l.c-...$..f.....
.w..e9:.....B^[email protected]\......b.u....b...E........kA.k8
.&.]h. j.m37T8........#[email protected]....{~..}O..Rq.].]*.t.....y...g.3........
..............G...IXT. 1........./...1.T..(.k..oarR.d..8c....,........
.......D..l..I^.iV.s.c.....HE.....v..G......eC..q\.0Mz.J..,....1o..@{b
..0....F.G:'L.../...}.>....K.r ...a-.,.F..7GD..Nd!.1...}u.*.n&..cJ.
x.\...l...Y.....6..Y.....i.....C...].\.(.P^/B...............r5...b.s?y
{p.cst.........aw,....u...| .C...P....A.Y.../.'.....-.... .H..c....f..
..k. .LtY.r..Wn.m...as..&""@l......l*..........{....$.....g#.O....N.V.
....9(..~. ..L.....Em..].HI...njw..>.gs.d8...=....."...... ...n....
.e..-.1..H..*.e.'.2...a...;..?..T7K......^.,.@.&...o.ss..-...W...BVz..
....u.z....&.bD(......p..I.o...R... ?m.......FJ:.. ..y.......%...;..5.
.G).".T...(..Hb)5......5.1...#.P.M:.... ....O....`#..(..4.).z....x....
.[...W. ...v.?.f.R.u.uyO[.&.>E....NZ..v*.:..%..5V5.o.V.[....{F sS: 
Z.2..}....Eo......x[......?...]..v.rU.,..q...M..w2..^...t../l..8. .W..
....8_:@..%..=.Z.:..t..w...Y..)y}ed&.....=a........u.....N.h8$v..ly...
.a.;....# .y.x".I..E|.U..pR..j.(.........iJ4.s..e.....8....5*..~,..Q?.
.X..#...N..i\..(.JI..GP8A.l.Y.;...4..fk..'...z#..u#..>Uv..$.K.e.X.z
......AIA.<.J..........s..-@..~..7......_.~....~C..b...|v.{....
<<< skipped >>>

GET /pagead/imgad?id=CICAgKCTkZfTxQEQ2AUYWjIIpKDrRFXGq4A HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: application/x-shockwave-flash

Date: Mon, 18 May 2015 12:08:21 GMT

Expires: Mon, 25 May 2015 12:08:21 GMT

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 71527

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=604800

Age: 244151

Alternate-Protocol: 80:quic,p=1
CWS.B)..x...Stg..=xc..O..c...t...c....m.c........7.5..8.r.]g.:.n...w..
..... ................H?_..g....G.1.....bM..........p.....p.....@..:..
..>....C..R.\.|....T..T.i..LD...ZS.fuD..3 .....>.%......?Lr...S.
N....[.?._....2..DDv5...g.R,.f..X.O.3Q.`.Eg.5.N.CIq.`...../<.......
..$.E.Em..g.fD .....Dc.....D.K.G(i...n..j'"k.#..z....K.DSHV....uQ.T..E
.k ...Sx....}..pUJ\F..X.M.....kyQCH..;.u.U|7.o.I.1.EsAj..N.:..\K.....~
Ab..I.q5...b...&.a.$K.".J.J.x./&.l..(fbK;:...U^.....~sL].h.Nl......V..
.E.\.`W.~..J,H;.\...(,.....{...u....OA..Do...d..o..d.ry.=.....6J.o.:.*
.)b.......5...0..E...qi...&.7."..b.......j..&G......4......].?.U.tD...
V.H...1.&...Q.cX........[..p...Fm...3...5....5.Y N.....O$R.....Eur....
|..TF..]......^%..}.......@...=Y.\....y..3....t..V.......".H. 6.3w4}6.
v...^|`.........&.B.....MY.w.[.......b....W..-.;...s.s..OsX*}j..#.....
.....j..q..N.L... B.3...a...(3.....j .a*{......z.si..XV.&....7...I....
......w#.O3S..u..._P6.G.q!.SW..g?cjl...GiB.F....z#7..N.p.T.......0.W..
.C.xp..?:$.#[email protected].}........WD....).{_vwa......A|.^...=..{. .d.R...
.{p...;.....h.......).L$....v.D..V6.........8..". ..B..y.J..%...3..._.
I1..3H`.X...3u.......m..I.%.X....-...v.x..\fW&h..t..............o..Z=.
:...;(...Mh...AJ.\./..$f.....t.1}...Z(.XKT.1.`.)...\..Tz.q\...m....=v.
E.sQs..;..=.G..a(...<.jp$.j.....Q..........3...3..6..K.W.... .0....
g..b.K H....$..&72..Q.?..St._.7.....I~...8.fU.. ...@.........*Y......h
...........L.\..iF.\..To.5.G!.l...r..".a5.D...F.....#.'...L..#.3...#z.
...bT...2{..T...m.K%.........D........_}.m..z~...}9....F.L..@...}.
<<< skipped >>>

GET /pagead/js/r20150514/r20110914/abg.js HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 11262065338517536562

Date: Tue, 19 May 2015 14:36:52 GMT

Expires: Tue, 02 Jun 2015 14:36:52 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 15108

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=1209600

Age: 148841

Alternate-Protocol: 80:quic,p=1
............i[.8.(.._.<....$...sY{c..^....$dH.t.......d.K..g...<
3Md.T.J.Zd.....o..;..|.z......4.&cNT.L.......Vs.k.f..sk....f...F...<
;....kv.....kX[ ".a.......Z..........Z..f}...m.....l....8^.w.........y
.._ol.jw.gf.........N.Y.n..T......l<6.de......AX/0.Y....'......G...
.f.?`...6{=.h.f4.....9"$......<....A.mZ..t.kv...Z-h.:p.{P..........
...%..;.5.i.a..z. ..Q].v......6.LE.8.^.*.J....7x.....A..-.../.5.L3...z
.'./;..,R.?....;$.^...~P...!....]......p.=LO.....I.....L H........... 
[email protected]........,.X.d....3.C.z...U.1N3cp........P......`..<|.8L..>
..`YY.\0$.Rb........vHF.....5.D..f<....S(26.dh...\.4....-U.'.F.W7,x
....w:l....^..2...Zg..?Dw...s4pv. .:..h..E......FZL.....c7....i.YC..J.
....Us,/.1..z...0(y..f].......S.....`.-g.neX.n..F..UZ.r....U.x..\.W...
.L..........^.]..#..,..q5...t[...../.....|U.E.7..S.`r~$.(..& ...x.....
',f.Y..=....[fj....A...72.-.n....e..............1.sq.ep.....z...C.....
.e.............w.~Ac......j......v...B....L.n.......^..%...V.T.;.V...f
?O...ZeF<..%......hNe....k...Ze...`$\.y.CG...QS.E..~Q.......q...zs.
.....1}yIMk..o*.........fT!.......=....]].....W.F.Z. jWE...[..1B...`.%
$_... ....r.&G;d.ZA.BC%.[[d.&..|..?.h..C....*...2!O\0.....I7..t.9..^h.
...Y.?p......*........:?t.*.Hc..{...o..A'...Y.\.....#...wC....G0.;@oTC
4...h..,$.]h.......<{.0..C.Q... U...5.J.4..0....h.f.T.  ~....."z. .
.....$........S..........u..E....y.i...3....E.. ...7.........^H...ruk.
.q.../.l.....([email protected]&.....=@2.].o..@..|.i...=Z%\:L..k.].......
x.3.S.........r.......6. ..;Y..e..b.>.....ag..7.=..w.6.`.{.Lv'9
<<< skipped >>>

GET /pagead/images/abg/zh_cn.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: image/png

ETag: 12051390396603846657

Date: Wed, 20 May 2015 14:27:30 GMT

Expires: Thu, 21 May 2015 14:27:30 GMT

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 3217

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=86400

Age: 63003

Alternate-Protocol: 80:quic,p=1
.PNG........IHDR.............C......XIDATx..Y.KU[..i.M..4.$...4..0SJ..
....A!-..A)T.....%! .......|...r...?h=.U.t.9.N.{..;?|p..k.....[.>.o
......~-t.&h...O..........A..1.i...-..5Q...|F..<..c...........Z\\..
.-..4.'.d2....I7.w......ohh..].D......$................T:z.(.z.J3..1.V
.....D..I..5k..%..n..xF.....`...g2....DA...X.....?..<....j....x...=
.....Q.........O.<..z.F...Y....[..<yB'N....9..955.{.M.(.7ID...S.
..,.2............u..e........TVVF.v.b...r.x.HHH..7oJ...v:{..]..Bd.~~~.
..}..E....:.|...... >>......yyy.....7.~......a}5<L555d6.O....
...s^.t.<...i.d=n.F...a.;.mY...mE>..........C}}}ve.>|........
5.x6.w.........o .1.E.K..7nPrr...)...|}}...c......7}.....c.p....6._.x.
..e..3g..7...L.. ..L...h.g....|..V..L<.......%#niiQ.......8.{.....o
mzw..~..9566Rss3....4L.._.RWW......G.hii..GFF...7V.tD...Y..]...|......
.d.6{.;y.$.c....`.._......H....711a.y......AAA.H\EOO.b}...c.p......jp.
[email protected]..........&.p. .......
.... ^.|.:.........IA..............I).......kY8.............L<d.{..
U`[email protected]..{.n.g.......:[[[U.WWW.....IJJbGUUU%....p.>.w
jQ.....W.9..D.'....\"^EE.ol\\......]8d....?..............[2...|.:....H
..>}j5..V.!E..Fd.E.. .q.x./@.....q.E..u...;v..322.~.....8p....3".N#
..!.A. Hs..avf......#"".}........<[email protected]>.|...p~..o.........N.
[.&....K{r.j<E......wL<......l.>p||....?00`.Q........EA.b.>
;@?.#.:   %R.#........)..<..Z..w..].;~.8......9..r.;.j.. ..!...x...
t..A^.".H.SRR8..mQ.C.. .3....:u....7`_;::.F<.BVr...e.....#.$...
<<< skipped >>>

GET /pagead/images/x_button_blue2.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: image/png

ETag: 291775052866240956

Date: Wed, 20 May 2015 14:21:09 GMT

Expires: Thu, 21 May 2015 14:21:09 GMT

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 145

X-XSS-Protection: 1; mode=block

Age: 63384

Cache-Control: public, max-age=86400

Alternate-Protocol: 80:quic,p=1
.PNG........IHDR.............b..x...XIDAT(.c.....3g.G........#.*."@q..
..9#..E.4...#[email protected][email protected].%..ap.%.V.2}\.......IEN
D.B`.HTTP/1.1 200 OK..P3P: policyref="hXXp://VVV.googleadservices.com/
pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"..Con
tent-Type: image/png..ETag: 291775052866240956..Date: Wed, 20 May 2015
 14:21:09 GMT..Expires: Thu, 21 May 2015 14:21:09 GMT..X-Content-Type-
Options: nosniff..Server: cafe..Content-Length: 145..X-XSS-Protection:
 1; mode=block..Age: 63384..Cache-Control: public, max-age=86400..Alte
rnate-Protocol: 80:quic,p=1...PNG........IHDR.............b..x...XIDAT
(.c.....3g.G........#.*."@q....9#..E.4...#[email protected].
[email protected].%..ap.%.V.2}\.......IEND.B`...

GET /??/tb/_/card_9dfd566.css,/tb/_/card_5c7387e.css,/tb/_/js_pager_5be1e39.css,/tb/_/wallet_dialog_33a638c.css,/tb/_/flash_lcs_4472537.css,/tb/_/new_message_system_8a580ba.css,/tb/_/base_user_data_80722fd.css,/tb/_/cashier_dialog_b8e8690.css,/tb/_/qianbao_cashier_dialog_c81bb31.css,/tb/_/base_dialog_user_bar_8cb5c99.css,/tb/_/qianbao_purchase_member_e44bb8f.css,/tb/_/pay_member_d41d8cd.css,/tb/_/userbar_cbc8f2a.css,/tb/_/poptip_f0fdc70.css,/tb/_/senior_342da68.css HTTP/1.1

Accept: */*

Referer: hXXp://tieba.baidu.com/f/search/adv

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tb1.bdstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 May 2015 07:57:31 GMT

Content-Type: text/css

Last-Modified: Wed, 20 May 2015 07:48:19 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Server: Apache

Expires: Sat, 20 Jun 2015 07:57:31 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip
149c.............<k.......A..`..$.4.`..g}. .).....GK.."y$.3ca~a....
...~._.Hc{s....Jd?...].=..I.vE.....m.r(.z.f}S........k.u..M.t...z.j..(
..r.>.hq...w.W.ah.wwC6.eE?.C...f..../.}.k........A. w...w..='Y...K.
..lR.Gm...t.e..2......k..........XR4..!k...-..X..0l..1|..r...c..|f..j.
...(X...x......\....`K..[..._s..|.A.D'..o.C..]...A..}...".g.hS.?.'...z
`.p.S...5....G.....),aO. ...n.5~Ll..p.R.9Z..n........ ._N.~.I.\E.(A..F
|..[......8..J.....h..8u.O..9...._....P.C.. ......`....*....3.......Q.
.-.E....#......9nzk=...$.Rh...S(......P....\!.q....#m.(/V...a.....W...
....W....u..:..h..=.aZ..z...X..'.....%.d.V..t?4J.G.(...cZUlH.2..M.K.:H
.[....H... m......a..>.A..M#!.c.{.Lh.X#....p.,CP..d...G..`[........
<....6).u#!\........P..W..2..I.f.:....G...tWV..w....o.C...6...r...}
Z.!`..edn......q.39.N.f...[..v...j....#...y........._..;V.....Lo3...4.
X....I...0.tF..Q.m.K.1..L.AvA..L/.vN..T-.r.$. $`..6....G ee..\B....n..
..*..D.......-..@$G...j....Sa.qx....3E..If..].#..l6{..........U..u.c-.
...y.....)x".y..*..8.e....t.7BN.S.u..t..8..<.M.7mH3..h.k%N.%...Oq..
.S..t.B..-G@.... o...KQC..G.........]Z..~..i.H...4.........6%j6.......
a...L..t...5..!2}"..p.HTTP/1.1 200 OK..Date: Thu, 21 May 2015 07:57:31
 GMT..Content-Type: text/css..Last-Modified: Wed, 20 May 2015 07:48:19
 GMT..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept
-Encoding..Server: Apache..Expires: Sat, 20 Jun 2015 07:57:31 GMT..Cac
he-Control: max-age=2592000..Content-Encoding: gzip..149c.............
<k.......A..`..$.4.`..g}. .).....GK.."y$.3ca~a.......~._.Hc{s..
<<< skipped >>>

GET /stat.php?id=3819543&web_id=3819543&show=pic1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cmd5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s9.cnzz.com

Connection: Keep-Alive

Cookie: cna=8H3kDZBxtXICAcGK9Oe2pGU2

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 10073

Connection: keep-alive

Date: Thu, 21 May 2015 07:06:19 GMT

Last-Modified: Thu, 21 May 2015 07:06:19 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache20.l2de1[0,200-0,H], cache14.l2de1[1,0], cache8.de1[0,200-0,H], cache7.de1[0,0]

Age: 3082

X-Cache: HIT TCP_MEM_HIT dirn:7:153432336

X-Swift-SaveTime: Thu, 21 May 2015 07:09:09 GMT

X-Swift-CacheTime: 5230
(function(){function k(){this.c="3819543";this.R="z";this.N="pic1";thi
s.K="";this.M="";this.r="1432191979";this.P="oz.cnzz.com";this.L="";th
is.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV"
 this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la
()}function g(a,b){try{var c=.[];c.push("siteid=3819543");c.push("name
=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c
.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAg
ent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.rand
om()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}ca
tch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURICompo
nent,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),this.
J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.j(
),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(
),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")
}},oa:function(){try{var a=this;e._czc={push:function(){return a.B.app
ly(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=
e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.le
ngth;b  ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[o
bject String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case 
"_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}
}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typeo
f e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if("
<<< skipped >>>

GET /stat.htm?id=3819543&r=&lg=en-us&ntime=none&cnzz_eid=1310392416-1432191979-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1828417946 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cmd5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive

Cookie: cna=8H3kDZBxtXICAcGK9Oe2pGU2

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Thu, 21 May 2015 07:57:41 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /pagead/html/r20150514/r20150515/zrt_lookup.html HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: googleads.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/html; charset=UTF-8

ETag: 5981031121744383759

Date: Fri, 15 May 2015 23:29:04 GMT

Expires: Fri, 29 May 2015 23:29:04 GMT

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: cafe

Content-Length: 3911

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=1209600

Age: 462507

Alternate-Protocol: 80:quic,p=1
...........Z[w.6.~....Y...Jro.R.N.8.6.];i.J..HB.".TH..k.....R.%.....i"
.....~3H......oW..q>.N......;."8........,..$'...a.,...S.gs..8'.$...
p.._...$.....t..Q7...<?=.F...'Il..;..F<.O26.....<.?.e2..w2.H.
}.~N8.(....]..Y.b.....x....iL...w..R-b.j....\...4.......<.....(....
}.A..$....8....o[d..E.Z.x1.d./...H.a>n4..R.&..H}.5.G._~. 0:.i..&;..
e*..h..?XD/F..lJf_.........?b...0Th..e......@...!......b.o....B.k..bc.
.V.s....3...|...q...-..1_..z.E]../..-.....X9.. .7e..]....[...I.....IkW
....zf.53O.4K.Z.....@!.9.[.........Q..%.Q.....v.T.i-]..?.|...;.R|z<
....|.L,.x.(].."[email protected].....&'N.4....d......a{V1...._...Qp.h
|.s....(..q...&....uGIj!y..:.\.p.p.T.#.*nY.8..Y...l.x...?.-gx.....s.. 
..tp.b.I..` ..q...2...iJ......Yq{...W...|......&,U"U:......4.b..s.c...
.A6...asU>=A&.E.../....{.q....8m...;..$}..5A.".Xd.......m.....4\&..
..L./....X...%....x....f......... .....W _.&<*;.K..(.s.h....C&8....
..A..>...3.n..R.,gf..a...8N.O_.G...f.[".c..[$?c... .6..UY.p.)_. ..!
...M".N9.8.....b...4...w*..U..........G.R7.E..2...W....v.G..|.*......V
g..?.&,c.`v.L.Z.....@._X.~...>w.....Y.:?T..vR.......B.e...zH.q.,k3w
....H.9.x....RT.4^..=.0..Z5!....TkH .*...f..7..].T...4.mv.m..$........
.n..Q><...4b/.......n-.V..cG....i*.}.O.w.. ..M......._.........$
.#...Z...-2"[email protected].....~.H..M.Q~.'Q...d.t....'v.
$a$..8..r?........z......43n'3X.6...2...........$.TDR......H..E&...3d.
.....(b...}...<q(..V` .ZB......!..../.k0...C....y....p...."a.@a../]
b...?.........`.m..(.bzm.f.$..\._.l..O.....Y2.'1.........b....5u..
<<< skipped >>>

GET /pagead/ads?client=ca-pub-8401880217755931&format=970x90&output=html&h=90&slotname=5995143054&adk=3357607631&w=970&lmt=1432195054&ea=0&flash=11.6.602.168&url=http://tool.chacuo.net/mailanonymous&dt=1432195054304&bpp=16&shv=r20150514&cbv=r20150515&saldr=aa&correlator=8706509929441&frm=20&ga_vid=2113065512.1432195055&ga_sid=1432195055&ga_hid=787210447&ga_fc=0&u_tz=180&u_his=0&u_java=1&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_nplug=0&u_nmime=0&dff=simsun&dfs=12&adx=145&ady=5745&biw=148&bih=36&eid=317150304&oid=3&rx=0&eae=4&brdim=819,202,,,1276,,,,,&osd=1&vis=0&rsz=|||&abl=CS&ppjl=t&srr=1&fu=1024&bc=0&ifi=1&dtd=891 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: googleads.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Date: Thu, 21 May 2015 07:57:32 GMT

Server: cafe

Cache-Control: private

Content-Length: 16435

X-XSS-Protection: 1; mode=block

Set-Cookie: test_cookie=CheckForPermission; expires=Thu, 21-May-2015 08:12:32 GMT; path=/; domain=.doubleclick.net

Alternate-Protocol: 80:quic,p=1

Expires: Thu, 21 May 2015 07:57:32 GMT
...........}i.#.u._A..;U..4.s.....==3}.t......:pL.(L...4.! $.f....,...
...-Z....H.?..K.....{yT..>.K1..KN.*...../.....3^.F.....z.O...>.&
gt;}8.....N.._.X...k..=`.....q.p.C<........3.>5....u..a^.....G..
.:..t.3.:V.4...4.b.....X.;&....-t....].[.Cvn.~4..E./E;..EH.P......S..0
......;Q..)...........W.....BK<Y.h[...CP.q.?.9~./.K...oE..>*....
..}.8.......O.....0:_...b?dN.`g.3."GV4..Q.]..........5.Q...#_...._....
[email protected]...].=. .6.k..M..e\.l...>...T.wgB|......0.
..z..3.r.sR....A...1......3V9......ZV.hN.w....g....F.&'..KUhn.8.?..A..
h~....q..Y..Xo`.p...f....Fy..f.].n...*.J.{..n.......#.7n?..>8.T2..T
.B..:.....G@P.~..........E......6......>....=..x.p.:...r.Q|.4J....i
Tk..!.u.*1.X-V?-7.p..........#....,[email protected]]..........7.T..`....z.....?
;k......}...<....Z.....,g...P.U.:q.<.C.1-.*p.:...x..a...Izo....9
e:,EE....L......*....-..wV/....p.F.(#6.:.o..U...%....<QV........-H.
Q8a...*J....u<....4.....N.u?.J.5...042}.yhc1..kbW....%.>0g.<.
.W?.....do9.\`.d}...L...!L7........ [U. .J....`.=7P.Z..;f..I..b@...>
;S.9.>7.J.......F.....c}......m..^.(6.E.c......N....#V......`..0.!s
...N...IL..f5..B.]...N...`[email protected]\L...E..Ku...]A).
>.B ^.t6...z*w......8.....m9...e.w...M....Y_.D iDk.{..p.1x.........
3.;...ND.K..._.nQ.Z..."...).....P.....O.j..o.....i..c.. .g. ....>..
.h$.........>.)....Q.V...s.V8....,..w.t"@~..!.Xk....`... ...X.m.._.
.mb=.KCu]..G.2.p.c........N[[email protected][email protected]...\.....|
..j..v.F.E..E......q.?...$...X.g 2.....T....#....\D].rX2.Y.`Q..cg.
<<< skipped >>>

GET /pagead/drt/s?v=r20120211 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: googleads.g.doubleclick.net

Connection: Keep-Alive

Cookie: test_cookie=CheckForPermission

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Date: Thu, 21 May 2015 07:35:44 GMT

Server: safe

Content-Length: 145

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=3600

Age: 1309

Alternate-Protocol: 80:quic,p=1
..........%....0.Ew...]....h..F....x.$-....o..=..9..t..g{.Kwk.}..k]e.f
k....$...-...<o....RxzyZ...ML..bwX.).g.#..r..2....,U.....Q......M./
6PzR....HTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..X-Con
tent-Type-Options: nosniff..Content-Encoding: gzip..Date: Thu, 21 May 
2015 07:35:44 GMT..Server: safe..Content-Length: 145..X-XSS-Protection
: 1; mode=block..Cache-Control: public, max-age=3600..Age: 1309..Alter
nate-Protocol: 80:quic,p=1............%....0.Ew...]....h..F....x.$-...
.o..=..9..t..g{.Kwk.}..k]e.fk....$...-...<o....RxzyZ...ML..bwX.).g.
#..r..2....,U.....Q......M./6PzR......

GET /stat.htm?id=768630&r=&lg=en-us&ntime=none&cnzz_eid=1338064447-1432190709-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=454109180 HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Thu, 21 May 2015 07:57:34 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /js/public/ZeroClipboard.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://tool.chacuo.net/mailanonymous

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.chacuo.net

Connection: Keep-Alive

Cookie: Hm_lvt_ef483ae9c0f4f800aefdf407e35a21b3=1432195060; Hm_lpvt_ef483ae9c0f4f800aefdf407e35a21b3=1432195060

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 21 May 2015 07:58:00 GMT

Content-Type: application/x-shockwave-flash

Content-Length: 1071

Last-Modified: Tue, 16 Oct 2012 15:30:39 GMT

Connection: keep-alive

Expires: Sat, 20 Jun 2015 07:58:00 GMT

Cache-Control: max-age=2592000

X-UA-Compatible: IE=Edge, chrome=1

Accept-Ranges: bytes
CWS.....x.}U.R.F..]].$..s1` @.$!..$iK/....B....t....Fj...d...(}.>@^
..N_.tu!.M.;....t...........1....P.\__...q.Q..<6.....-9&..Dk....w..
.....KC{.]0/...xC...]F=..w../,.k..i.4..i.....^..N.DLnv....!.^P..u....-
.i..}.....F.8......{.........".x.-.f`..{..X.....4j......q...E]WI.n..u.
....w.0.gl.....e......;..7{.Gjx.eZ.Wa....kuyuWx9....u..:.v.S...^.....4
[email protected](.._Y .....U.R.o....^.ilV7t.I..u...r....q..>m.Rm...z...k.
.. .`.?(...".......d....J.@=...Z..X......*g...N T.........idK...m...@.
.sfG......$....*[email protected]._.a..I...7........7.../....ed.x......rq
N..&m.....IQ..w..t3._..7..Nt\.....-.)S.L....?\.e........)....by."W.U.W
.T. . ..(...ZN..............D.A.I.....)......".% #@.A..R.2.0.d..Y s@..
.....1.. [email protected]...:g6.Mn..y..../.|..  [@.....o.|..6...g.. .....s.%S..f.
"8.....p6H.(.".d>k$......"..8.X>..9.bQ.HC.k!.................."'
.mr4#..d9#...XFJ2......j.O.....9...!sx..1..>.......Q...?q.OU.].....
|"}/![6.%:..)SnO.b.....Z6g....9.......)W1]8Y4ec...K.{.b.'.|..o..6.....
...-.....`...h.S...4...!<.dBTM.....v....o........c...9C.Y..w.}T....
..............tS...h:Yv..tx....}s.ms.oO..$....


GET /css/ui-lightness/images/ui-bg_highlight-soft_100_eeeeee_1x100.png HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.chacuo.net

Connection: Keep-Alive

Cookie: Hm_lvt_ef483ae9c0f4f800aefdf407e35a21b3=1432195060; Hm_lpvt_ef483ae9c0f4f800aefdf407e35a21b3=1432195060

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 21 May 2015 07:58:01 GMT

Content-Type: image/png

Content-Length: 90

Last-Modified: Tue, 16 Oct 2012 15:23:50 GMT

Connection: keep-alive

Expires: Sat, 20 Jun 2015 07:58:01 GMT

Cache-Control: max-age=2592000

X-UA-Compatible: IE=Edge, chrome=1

Accept-Ranges: bytes
.PNG........IHDR.......d.....G,Z`...!IDAT..c.....&....!D....;...~..D..
..".........IEND.B`.HTTP/1.1 200 OK..Server: nginx..Date: Thu, 21 May 
2015 07:58:01 GMT..Content-Type: image/png..Content-Length: 90..Last-M
odified: Tue, 16 Oct 2012 15:23:50 GMT..Connection: keep-alive..Expire
s: Sat, 20 Jun 2015 07:58:01 GMT..Cache-Control: max-age=2592000..X-UA
-Compatible: IE=Edge, chrome=1..Accept-Ranges: bytes...PNG........IHDR
.......d.....G,Z`...!IDAT..c.....&....!D....;...~..D....".........IEND
.B`...

GET /css/bootstrap.min.css HTTP/1.1

Accept: */*

Referer: hXXp://ip.navisec.it/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 7xigiv.com2.z0.glb.qiniucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 May 2015 07:57:31 GMT

Server: nginx/1.4.4

Content-Type: text/css

Transfer-Encoding: chunked

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 2592000

Cache-Control: public, max-age=31536000

Content-Disposition: inline; filename="bootstrap.min.css"

Content-Encoding: gzip

Content-Transfer-Encoding: binary

ETag: "Fu0pMV4P-z8UOCQx8nJCNb9n9E6z.gz"

X-Log: mc.g;IO

X-Reqid: wEEAAFXXQANIaNIT

X-Whom: nb263

X-Qiniu-Zone: 0

X-Via: 1.1 ych68:8109 (Cdn Cache Server V2.0), 1.1 taizhou42:4 (Cdn Cache Server V2.0)

Connection: keep-alive
e4f........n.....k..8.(.}..' **..v.....:;.}o.........Q..![...d.-..(...
/[email protected].|........i....^.f.a.]y|...X..
V......d2b.....9o.....t..9...w.......f......$Zs.ys.l9....m..4.a[.....f
.>..?.......w......TV..........F.x.....1..#=......=4.../O.h......NN
....|..}..?.....4.........YO.....X....L.^.I.....-..|Wd....l.fM...p....
s..'..Re.=.'..!KR.?/Uy9..I~....exJ>..l'j..##......H...`v?..K...]r..
..sU.TY].?.VK.......D.......#&...z....JB.S...i.$S.E...!q*O....!f.....i
v.8l.#.7..wK..d.3..)......l(O.9..SsK....'&...d.\.K.Y.b.n....)...mY1...
e......e...Yz...f...9..%S.(....,...E.......0..2^,.. .H.6..8;........(.
6...w.}t...(m.u..`.....|=.u..g]eL..O..........)zN.)...x..a.....q.K....
..Q..E...b....../..k9$7.W.....Yt.r;TW....m..s..^.|....".../../..Y.....
..]....m.T2.....M.cy*.6.......1}.^[email protected].
..KQ..}..|[d..I.*..P.=['.. ..X..#?5_.......)bs.k..6....x..N..,a.w.Z...
.U..<.9.c.......q.~t.5.WU).....}[...........[HD...zN.....r.O...*.\)
oNov.l.3.h...[0l...037T&.......O..6.>....DoF.9?.\M!....c.. T..56F..
..o.!.D......H..,..`..U...T.4..U..&L..~.......O.j3./b.?K....a...E.._..
...A..lZ...%;..r.....zB. x..\..|]p.qSR$.:[...&.6....;....T.....8..ga..
lP."....\...}`...n..W....~..<.. 6S.....=7..m..........e.$.f#].C...s
Y; ..D....txU.rK.-...3.r)......4.?..l.Qv...s.f... i..-....y....$.. tA.
.............U...~.& ..&...\...M.5P..V..[.^.....g6..G.N>.yzk..d|..&
lt;#.J..~q.9l........|.}... .8G..xx.....:..]XO7....~H.KUtK.U..w#...1..
.I..L.msz...di...*....S...s.F....E...D~..6..U0.\2.s....u..9..)xI..
<<< skipped >>>

GET /fonts/glyphicons-halflings-regular.eot? HTTP/1.1

Accept: */*

Referer: hXXp://ip.navisec.it/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 7xigiv.com2.z0.glb.qiniucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 May 2015 07:57:32 GMT

Server: nginx/1.4.4

Content-Type: application/vnd.ms-fontobject

Content-Length: 20127

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 2592000

Cache-Control: public, max-age=31536000

Content-Disposition: inline; filename="glyphicons-halflings-regular.eot"

Content-Transfer-Encoding: binary

ETag: "Foa29it4U-Z9PmNfZRKlpe_FjqPD"

X-Log: mc.g;IO:1

X-Reqid: xRUAACziUSORmdMT

X-Whom: nb271

X-Qiniu-Zone: 0

X-Via: 1.1 czdx84:8105 (Cdn Cache Server V2.0), 1.1 taizhou40:7 (Cdn Cache Server V2.0)

Connection: keep-alive
.N..AM............................LP........................'..,......
............(.G.L.Y.P.H.I.C.O.N.S. .H.a.l.f.l.i.n.g.s.....R.e.g.u.l.a.
r...x.V.e.r.s.i.o.n. .1...0.0.9.;.P.S. .0.0.1...0.0.9.;.h.o.t.c.o.n.v.
 .1...0...7.0.;.m.a.k.e.o.t.f...l.i.b.2...5...5.8.3.2.9...8.G.L.Y.P.H.
I.C.O.N.S. .H.a.l.f.l.i.n.g.s. .R.e.g.u.l.a.r.....BSGP................
.....M..M..F..........(u...<.0D.B/X..N....CC.^...rmR2sk..PJ"5 .gl.W
*i.W./E.....4#...U.~.f....UD........J.1./!../...s..7...k.....(...h.N..
[email protected]".Fj....6C3..&......W51.....B..a..QaR.U/
..{*[email protected]$..1.T..nc [email protected]>.K....m.' 
....C.HM..fB.X.,.Y....p.e......U....*...z..m...i..O1nE.......hx!aC.XT.
.V...........R....%...|I..H....P.5".b.N....=...r./_.R...._..%...uz....
.5.2.....P.)........F.7S..q.F.{[email protected].;...}9....?.........R{.T
k.;.....U\N.Z..Q-.^.s..7.f.0....S3A..._n..`W.7P..p.....i...!.g./._p...
.Z.-=...~WZ#/.4 KF.`. ...z...0..|.D.........&d..I.......;.M..{'.om..m.
.I...!w.i9|H:..........{..~...q....O.........,. .L]&.J0...9/...9&.Y...
..{;..'.3`[email protected]$...3....Dx28....W. Cx5x..w..B`.$C$'..El..y..
h.......DJ.$(p.....QA.A..A.@'.$.h.p..0.V.0 `..s..e.$.4$"t2=f..4.A.{Tk.
.0|r.H........`.L&..s.h.]...A<.....`R.'...!...1N..;.._.t3.#. ......
.V....*ve.F`E. O$.{).W=p:....F`..2...2..C....^............G..<<?
....~z.........>..p..Ne2....... Y.s..l:.........u5.....t.u.^8..6...
...Tmy.Q.%..u~...%~1r..a.w..^.._.Z..Z.a...0!.......N.`....uq....YB.\..
..............[.e.....:@..J'E...,[email protected](.
<<< skipped >>>

GET /js/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://ip.navisec.it/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 7xigiv.com2.z0.glb.qiniucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 May 2015 07:57:34 GMT

Server: nginx/1.4.4

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 2592000

Cache-Control: public, max-age=31536000

Content-Disposition: inline; filename="jquery.min.js"

Content-Encoding: gzip

Content-Transfer-Encoding: binary

ETag: "FrM-47QrmI7vnU1iSVtuVOI91kL9.gz"

X-Log: mc.g;IO:3

X-Reqid: aHIAABQwzcdIaNIT

X-Whom: nb263

X-Qiniu-Zone: 0

X-Via: 1.1 ych56:8111 (Cdn Cache Server V2.0), 1.1 taizhou39:8 (Cdn Cache Server V2.0)

Connection: keep-alive
9a9........n......v.../..y....w.E...{.P..-...O.....{...IL.@Q4.<....
.. 9..o.....=T..kO.............7..p..vv8.....`......../.w.<....8.j.
....-...........8{z.....*C9?.i.....".{Q.......r..-.n...~.v...wq.6J..:.
[..}.R..A.....r.wl.`?....V......z.{j............\.T.....N....m........
.._.....rU.^GwW~...p?/w.:.7..,....GY.....]e.U.....7w......Q..~*...Q...
._..o..L\..<.}...a.......A.E.....2....../...U^...Q..._.W.../>...
....&.C....L....rw~!6...?.....'...........7.........-G..f...1a....p!h.
v..]._o....../=O,..l?..b..t.M......~.,.>...3 ..(.C.[,:Q.....%.I.?}Y
.$..&a.2...}..T..*.4.e...\.....Db!..[....:b.HQv_....F.GQ$.<l..e...%
!Wm.l.F.U.N...d.W.0..)....#T.P...-s\.8.'...A.h;.}.C..r........Tf......
...-S.....^....i80.].gv.....2.....d..'.~....Y......#...T.......G.6<
ut...D....N.;N];mbH..4..(..6....`[email protected].(..E..n...f...
..^/...;;...r....,8......Z.....I.......r>BE.[....JKA.~.g.....h6.'.R
.~f.(...n.?h..ER..\........otz......i....n..L.8.J...[...!..H...M.L..o.
e~6P..".T......H.&!T.*R...E..d?.o.x..A.[l.IV..W/.Kz^ ....$..;.Q..T..N.
.`..z..#.{..-....h.ipXG.FMM...D..-.$x...'I.N..n7...J../..e..Y.'.w....M
..._,....7.m..>_n..r....!<.$%..u.V.._; ..5S..A.|......W..xM.....
..mi.}........\K....y......K..G..7.O=...H?!w.....{._...!D.4....!..I. ,
...7=...G..O./.l..</l`.L..r.i<....`b.9..i.-.i...M....MK._..Y..m.
.v[.....f.@ ..7..3...(.dY,.S..%1.r-<bW<.C7..7[^|[email protected]
}...Ll.I.......j..@^.w."lz@g...,x.........5..%yM........p`.n...X,...7.
\.?........B.......4,..`...u.s> ....x.<.MQ...&..{<..1....
<<< skipped >>>

GET /js/bootstrap-table.js HTTP/1.1

Accept: */*

Referer: hXXp://ip.navisec.it/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 7xigiv.com2.z0.glb.qiniucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 May 2015 07:57:35 GMT

Server: nginx/1.4.4

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 2592000

Cache-Control: public, max-age=31536000

Content-Disposition: inline; filename="bootstrap-table.js"

Content-Encoding: gzip

Content-Transfer-Encoding: binary

ETag: "FinFVKgbdx4-QL2xpElfJCtWOC6v.gz"

X-Log: mc.g;IO

X-Reqid: mTAAABuwJ8lIaNIT

X-Whom: nb263

X-Qiniu-Zone: 0

X-Via: 1.1 ych57:8111 (Cdn Cache Server V2.0), 1.1 taizhou42:6 (Cdn Cache Server V2.0)

Connection: keep-alive
3f2........n....}kw.6.....F#O..VK.dfv%.Y?.}.c..........-.....m.....[..
..@.%gf.^.N.&.B.P(........&....t.\.U....S.Ln.er...?.?8<....4/....!.
..Uu^....._.....iV....e.\./......Q.M.T.j.I/.l.*.......r...d.....M..h]g
...g....z.......z.<}....../O^......}L.d....,..j.....z.u..y.d....|..
...e6ok...l..|.\A...(Z,.&)...d^fu2.W.&I..'U...e2.%7W@...\_g.....d..g.|
i.P..|.,.z.}..&...`j(c.M.W|.Ez._.j...rx{.P.. ......VE:.............:7^
......@jd......\p...`.tGG><..EZ..q..P.......4........SK?R..../.-
O\f...\eU..yU^[email protected][email protected].>....O.u.k..HE|..M
..........BS.G.(.X.#.N'!.I.~..........nV...e.]..>.rU~.fOE...M4~ ...
L.."\..).Z....QS.^......(.... ......... i~..%q..xt...p.3M..'EZ..."...Y
.........L..........!Q.....$.....Tz..V.r>&$v\JC....3..........G....
.O...........1/a.Z......c>.Z..>.3`7l....{[email protected].*..L..
j......e[H./.xV.p...b..`.;........q...XL.ez.MH.O...)L.......X..>...
[email protected].....;..~..2........"o......l.JN.ly..y..J...p...p. .C.&l
t;q...Y .... y.x..%[email protected].....!.../"(M..`8;...U.Iv:..f......
a4c..z.....?.r...>5.^.O....4..H..=.D.g.....xk...}..K_g..\.......u].
..q.?.....`.y...Ya.=>99}{...7......%O^=z{....V.OQ.;#....\...=..U^O.
{......}; h......{Td.. ?..#..K._g 1_......9..U..["_.L.q...t..z....[...
m..`V..Ik`. .....v.....Q......S.4..gU.A6...%V..'.<..RZ..j0.V.......
R......%.tR..u..<[email protected]..|."?...A..x.R..
l..y.(..K...uV}~.V.5|h.rEo"..?ZsI...)...HB[Dg.........._...b..".....Uz
./...(..<{c}..>.h...l.....l..l.....(s@%.;AK.Y6.....1.^../.'.
<<< skipped >>>

GET //js/extensions/export/bootstrap-table-export.js HTTP/1.1

Accept: */*

Referer: hXXp://ip.navisec.it/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 7xigiv.com2.z0.glb.qiniucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 May 2015 07:57:36 GMT

Server: nginx/1.4.4

Content-Type: application/x-javascript

Content-Length: 1076

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 2592000

Cache-Control: public, max-age=31536000

Content-Disposition: inline; filename="bootstrap-table-export.js"

Content-Encoding: gzip

Content-Transfer-Encoding: binary

ETag: "Fit1s8FcevCr1gH88H8dVVXDmKcc.gz"

X-Log: mc.g/404;mc.g:2;RS:3;mc.s;IO:5

X-Reqid: 4UcAAKPiFNQiaNIT

X-Whom: nb993

X-Qiniu-Zone: 0

X-Via: 1.1 czdx85:8080 (Cdn Cache Server V2.0), 1.1 taizhou38:1 (Cdn Cache Server V2.0)

Connection: keep-alive
......n....V.n.6...S.7.P.oSI/[email protected].`AK..,#jI*....;#.2..IxaY.9|
3.q.........t.6..L.dN.DN...~.....c...b.~...X9.[.s;!.s..DQ*]V.P%...\...
......B.......Y..T..%::..e.;.C.aH...,ZZA.32v..Q%z.....>.~....L.E\.V
..B......V.zP .v..' ..d.._<Yl.A.../O.V.d.osOf.......D. .....M...*..
}a........)..].....J..q..;.D...CV.<..l.....J..9..%b.K.......S]..YB7
..D.....#B.T..........> m|@...u6.....dI..1.|]. .m7H.........p5..7u.
B........ .g0w...6;..e..\k..7..#V......Sk..G.<...z.p...;.S.h.q...xQ
.u.F#......Y%c.hp..."w6.=WrI*[......|L.b..;....6 .-\....h4..5....Hg...
)j....n&vh..1L.#.7..}....%S"O].........E. ....v:h.[...}.wg.(...6.`UY6.
.$F..~..N....B...:..&..F{:.......W.^ET..[@.Z....a.o.dX...7b0;.........
4.;..(|.DQ..u.Rm=.5....b4V...F.R.R.M.....{.G..a.'...\.-.......bp.OC...
l.g..qy.n{2......\.N....Vd:..x./ ..>.o.po..gEp:"....Q(....R..4d.P..
t....gy{..W.>M<...`^.....JU.C)t"...YPY.....nz...C..... D...b..k.
...z......u.n.Zj...:...LIR.......b...y.q.3N2#...=..66.p.G-..$|..\m6...
.=Q#..X...;..:.._}...V.F%..1..G..a..~..P(.]:............g.^i$.j...<
f!....e.f..ac.V..........J....7ap../..._.......U.........
<<< skipped >>>

GET //js/tableExport.jquery.plugin/jquery.base64.js HTTP/1.1

Accept: */*

Referer: hXXp://ip.navisec.it/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 7xigiv.com2.z0.glb.qiniucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 May 2015 07:57:37 GMT

Server: nginx/1.4.4

Content-Type: application/x-javascript

Content-Length: 643

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 2592000

Cache-Control: public, max-age=31536000

Content-Disposition: inline; filename="jquery.base64.js"

Content-Encoding: gzip

Content-Transfer-Encoding: binary

ETag: "FsceRjot2hK5epeDDi-1FqtseiIw.gz"

X-Log: mc.g;IO:1

X-Reqid: eFMAADbbOjdJaNIT

X-Whom: nb993

X-Qiniu-Zone: 0

X-Via: 1.1 czdx84:8107 (Cdn Cache Server V2.0), 1.1 taizhou38:2 (Cdn Cache Server V2.0)

Connection: keep-alive
......n....U]o.<...WX..r..B.....:........I.C....C.6.......j.-.&9...
...|w.S.:.u......~.<.F..g._.....@s..]A.7.S.V..t9......X=...qq....7o
...|.x.ix}....o..[oL.I...Og,...../..W?......I..l....... .#?......6....
!...T*..........[JG..-.P..q:..........^.......M....B...y..,......tS.)e
....4..)...{... .\`.c.O.#...E.E.......j,.G.~.....z..N...0......j5.F.N.
8.O"....~#[email protected].?<.m
Q,.Zh^.....r%j....R Q..8.Y....IQ.)7sZE....S.p...\.x..L.. .......S.${G.
.E..C....LJ^...'.5...."G."Vj ..R..i....X%.4...TJr..[.I./!\.....9..k..r
...N~..~.g'............Uz(.,.......G..37_...ha[C.x.-..y.M..5.5I...Z)..
..Zc}.............K...HTTP/1.1 200 OK..Date: Thu, 21 May 2015 07:57:37
 GMT..Server: nginx/1.4.4..Content-Type: application/x-javascript..Con
tent-Length: 643..Accept-Ranges: bytes..Access-Control-Allow-Origin: *
..Access-Control-Max-Age: 2592000..Cache-Control: public, max-age=3153
6000..Content-Disposition: inline; filename="jquery.base64.js"..Conten
t-Encoding: gzip..Content-Transfer-Encoding: binary..ETag: "FsceRjot2h
K5epeDDi-1FqtseiIw.gz"..X-Log: mc.g;IO:1..X-Reqid: eFMAADbbOjdJaNIT..X
-Whom: nb993..X-Qiniu-Zone: 0..X-Via: 1.1 czdx84:8107 (Cdn Cache Serve
r V2.0), 1.1 taizhou38:2 (Cdn Cache Server V2.0)..Connection: keep-ali
ve........n....U]o.<...WX..r..B.....:........I.C....C.6.......j.-.&
9......|w.S.:.u......~.<.F..g._.....@s..]A.7.S.V..t9......X=...qq..
..7o...|.x.ix}....o..[oL.I...Og,...../..W?......I..l....... .#?......6
....!...T*..........[JG..-.P..q:..........^.......M....B...y..,...
<<< skipped >>>

GET /stat.php?id=768630&show=pic HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s19.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 10070

Connection: keep-alive

Date: Thu, 21 May 2015 06:45:09 GMT

Last-Modified: Thu, 21 May 2015 06:45:09 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache30.l2de1[582,200-0,M], cache22.l2de1[583,0], cache1.de1[0,200-0,H], cache9.de1[14,0]

Age: 4345

X-Cache: HIT TCP_HIT dirn:0:638703541

X-Swift-SaveTime: Thu, 21 May 2015 06:45:09 GMT

X-Swift-CacheTime: 5400
(function(){function k(){this.c="768630";this.R="z";this.N="pic";this.
K="";this.M="";this.r="1432190709";this.P="oz.cnzz.com";this.L="";this
.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" t
his.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()
}function g(a,b){try{var c=.[];c.push("siteid=768630");c.push("name=" 
f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.pu
sh("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent
));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random(
)));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch
(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURIComponen
t,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),this.J()
,this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.j(),t
his.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),e
[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},
oa:function(){try{var a=this;e._czc={push:function(){return a.B.apply(
a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._
czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.lengt
h;b  ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[obje
ct String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_s
etAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}c
atch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typeof e
._cz_account||e._cz_account===this.c){e._cz_account=this.c;if("[ob
<<< skipped >>>

GET /css/ui-lightness/images/ui-bg_gloss-wave_35_f6a828_500x100.png HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.chacuo.net

Connection: Keep-Alive

Cookie: Hm_lvt_ef483ae9c0f4f800aefdf407e35a21b3=1432195060; Hm_lpvt_ef483ae9c0f4f800aefdf407e35a21b3=1432195060

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 21 May 2015 07:58:00 GMT

Content-Type: image/png

Content-Length: 3762

Last-Modified: Tue, 16 Oct 2012 15:23:50 GMT

Connection: keep-alive

Expires: Sat, 20 Jun 2015 07:58:00 GMT

Cache-Control: max-age=2592000

X-UA-Compatible: IE=Edge, chrome=1

Accept-Ranges: bytes
.PNG........IHDR.......d.....p..}...yIDATx...[[email protected]...$YV.b.&3.
..qO..l.XC...#..b.Q..%.....h.....y.......u(.....@A......:....P....6...
.....t.........l.....`.(.....@A......:....P....6........t.........l...
..`.(.....@A......:....P....6...u....p......l.....`.(.......c...]I...1
.)...G.!.....n${.A....x5{.2&.w...]..5.k.V....=k.39......h.....k.xc.d..
gu5.1k~..a.Ik.Yy..L..a... .8........-;........3c.:.3k....%......;.....
):W.\Z.....3.OQ...A...._.........S.G.....@A......:....<Z..:...g.w..
[email protected]....{s....t....|..*....;.v..a&.R...b]9..]..5..9.H6.).se....
{bv.....].....m..6..-.......H......'^..~..=[.V.......k.r..x....<...
e..n.Y....;.V......r>,.U.^N.1et..]..L..>2z .v5'.y....._}..u.E. .
.....z.W...u..6..jK..Q.{km|...".s.?b.|dljv..<Y/.J.<.....~5?2.J..
yO...xn...).Y9.k....r.. Z....../..g4w..f....MS..:Z.&'.e..,.z..X{..qds.
..[].Q_&V...:r~..gd5] .i....6....6......qe#t.7.......3>g}T.v.....GF
......].....u.=..>..f.Kv.f.T.T.g.Lnf.Cf............l.l.....>..gr
......d......?.c..8........................j.x..x.>oL^|.5......=-. 
_Q...Q..Y..lk..lZ1Ey...z..r} ..7o.\.^.>.q._.?.7^<.Z....a....u.._
!ZkQ..qV..5.......j.Y.^.3c..dc.t....Zc..[>..........J....g......6..
..~..8.Y.R&. .26......b....k..l[c....)..e.C.Kf...H..e.[.Bk.~..........
...~<...2.E.5.hoxv.8=......qZ........1...7..f....f/.g..yn.......?.q
E.V..x2......Ck..|Yk.X.....d.....Y...WlEr.X......S.yu....1F.2........k
....../=.....{2.Z......W.Cd..>21U.Z...Gt.T.G5......k......6........
t....8......;.7.m.~MF.Y..k.V..g..............d....y...Q.{.... ....
<<< skipped >>>

GET /css/ui-lightness/images/ui-icons_ffffff_256x240.png HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.chacuo.net

Connection: Keep-Alive

Cookie: Hm_lvt_ef483ae9c0f4f800aefdf407e35a21b3=1432195060; Hm_lpvt_ef483ae9c0f4f800aefdf407e35a21b3=1432195060

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 21 May 2015 07:58:01 GMT

Content-Type: image/png

Content-Length: 4369

Last-Modified: Tue, 16 Oct 2012 15:23:50 GMT

Connection: keep-alive

Expires: Sat, 20 Jun 2015 07:58:01 GMT

Cache-Control: max-age=2592000

X-UA-Compatible: IE=Edge, chrome=1

Accept-Ranges: bytes
.PNG........IHDR..............IJ.....PLTE.............................
......................................................................
......................................................................
......................................................................
.....NtRNS...2..P...."Tp@f`.... <.BHJ.Z&0R,.4...j...8D...|.......(.
.$......b...l..F>n~.hh.H.....IDATx..].b.....H....-{i.ZK:g..lk.n..-.
.tI....q...q?  E.$..dK>.$.>..;.........P.Z.....s..V..h!...Sy..0.
..E.0}H.)-.....t.k..o...Kp....\.R... ......E.7......)..*V;~.Pe...Bx..*
..,=$z...D............ ...J................9.{ ...........Hp.q.W@.."2'
...........B..[.$.. @T..i.H./..b..9.6.!..X.Hq`DE..*R.......H.V!.%.....
..;........"........i...]..dddddddd.......4y....5. ......Rb...@(.8....
Cd........,.@[email protected]!..........p..e.,...=4b.W .{..5.....hu
~.(...Q..^@...3..=...."[email protected]_....5
...@,r......D..).T..|[email protected]..................[[email protected]....(
.....F .@.?..=0....puL..;[email protected]..`....>... @h .....K..V.n.
..."a."....%[email protected].$/..U^....G...:..#`.`.. .u..TtK....~.....Z...5.T.
..%.k..x...........k..]\.*.Q.....,......B..44..OXK.|..y..g.... _.M.(..
.l..E..O.... .V$.T1BX.....b.-.|?@ .f..B.Xr..%'@..A.\.I...J,}..BBc..\.V
...r.....h(.]tI..^.....}....o...o..S3..";...........b}...".......){b$.
.........Gw.w..............a...b"..)[email protected]_er6.Jv........"m....M-..
d7..6..x......6...;..../.......`>Kr.P\...._....^u.1%..O..T.M.....}.
....Q.3........N.....}.....)...>......-.w.`....a....... sy$....
<<< skipped >>>

GET /wpa/images/group.png HTTP/1.1

Accept: */*

Referer: hXXp://lr3800.com/qq.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pub.idqqimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Cache-Control: max-age=259200

Last-Modified: Fri, 12 Apr 2013 09:22:21 GMT

Content-Type: image/png

Content-Length: 1827

Keep-Alive: timeout=60 

X-Cache-Lookup: Hit From MemCache
.PNG........IHDR...Z.........w.{'....PLTEV...dE)r.Ip..........F.......
.F..Kyy...r.....~E ......m..c..........d3.....S.....r...S1...#.....c..
......A..l3....d.............ynvc......"..][email protected]..............&..I
...\BH.....................rHh........z4$...X..0.....R.....s@6...{RL(.
......Xs.y......S........%.........vb...4......bW...[%..........L..t..
s..c>'...2..............wsw..i.............yM...WwaR...?-.fU...~K;.
`H...t..V..:..d...........h/#.......Z74..........pt5(...K...vb=......l
M.........N.kr......I A............pVs..k.....f'.p.....c..%...SG.J;..r
6......fBr..o=5...T..J...jB......5.....|......n^....XLm3#......y.f.}X.
...]6...,y....8..........q.D-Mt....^* z= y>#.dK...^...........>.
.s..J..............B....q...................xy...'..t.....7..M...~Re..
......s: .K(.rP`)..^=.........3......G:V......WE..2.....pHYs..........
.......IDAT8....T.U...lCs..It.....5r,*....I.K.].5p.d....2.4Fw.m}.....e
.v7r.........S.D.IVR.&.....y8G;.................N.r...9.t......p9.....
].......,Ko..i.......Mh.|@..hyw..9...n..qo-....C.....s.fpo..:{..vtQQG.
.......'..zmr.......H...m.u4.;..t...7....C.........a...?....{)...W..4.
..u......(....l..Q.|......R.u.3K.;.!..}vy([.e.~YhG[^. y......C...<.
...~.<-^I3......$..B....z...?$......u...S.7....qF$?.wF..G..lkC#...=
...A...C.......#x...Ea.yvS(..P..e..2..*....yD]]d.\.....{..h.....5.UK.@
J....ux7...>5.H_....}...T]2x,EO7SEmf.6.u:sk(..4...-.,...o6;B...Me. 
.\..._.]SSs..._....?g.,.x.$.tL...)..u.<Mv`4..Q<QiU.1O.X%......q.
.-.w.h... **.....e}..E...'...51t...0...0v....)^1.'.^..U.u`| 3.8l.)
<<< skipped >>>

GET /??/css/main.css,/css/ui-lightness/jquery-ui-1.8.18.custom.css?v=631 HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.chacuo.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 21 May 2015 07:57:30 GMT

Content-Type: text/css

Last-Modified: Thu, 02 Apr 2015 12:07:02 GMT

Transfer-Encoding: chunked

Connection: keep-alive

X-UA-Compatible: IE=Edge, chrome=1

Content-Encoding: gzip
20ba.............=...8rgu...<.QH.f5.U....w53j."fb.#..[......"kH..[.
:..{......}.o...g<^.._p.E....g.....V...H....L.8..e.k...N........./^
.F_..q......r.).;t.." ....dr.6at.-.c....$I...ONV.`U.Y..,..............
.~..;....-....m."...X...........#|..7K....IQ..o...8..x.s.L...|.78;..m.
.8.^.a.Ms..!..4.*\.1.$E^.....|<..*.W.....b.RX3.....wx.......R.W... 
.]..."..R.J...\-...p..8*..N.|...v.[\..W._..........-.o....0..N.0..,...
}......M..X....C.W..."...C}.E8..U. n.........Z.''........a...0..F.2.a.
..$..rI/...H.....S.h..A..?...L."A..Kc.M.V.,.c2dt3..[.t(...L4....*.c-_.
M......A...dB..BF....IV....0./.}......pKi.D...Y.G.V...K...... .H.2.4me
.....@R[`.m..H......_ .k..(.a....p..(..........b.... ....K$......0!.B.
7....z.f.V.&...@AS1./[../..z-..7.i#...Un.`..f.7>.Ao5a...]...uq.....
...&.F.P...E.....'.f.0.{...<..J. ...}.ac..$.OU..`3._..K......Zpr...
..,Sp.q.......}.*[email protected]$^../..._........./....B.y.......#x..(
[email protected].}....>G$n.`~..L|.2a ..q....m.HV....(H..G......
W.O......N.:i{GD.A...G.wKC...I.....?.._..?...~DG.f.\.9......2.}...MB.e
;iz".D..O.u^.......E.r1.\..l.......8=V .../.......sp..p.c[..p...u..QT.
.8..{....x....0.k.Qu."\U....$...e;.............t.Q..|..3...eQ.('A.c...
...sAy.....D9.........Cj..E2..&.b...).eJ..&...cU!....g..cv.....@..=.K.
..@.:o..j..DJ..C\6.[rIcG..c..>.-...M.4.A....G.g.........2......MFy.
......_....F...D3.;.x.P.=.......L.,..AB.t..3...&CQ.......H...n...?.0."
.........q.....c....@..<..|Jm.....S.{[email protected]~ .,.a...=.uE...*.....
7.......q..?Z\...|AT..ir?..R&.dd.O........Ls(...z..........`....dk
<<< skipped >>>

GET /css/web.css HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.chacuo.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 21 May 2015 07:57:32 GMT

Content-Type: text/css

Last-Modified: Sun, 21 Sep 2014 09:05:45 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Sat, 20 Jun 2015 07:57:32 GMT

Cache-Control: max-age=2592000

X-UA-Compatible: IE=Edge, chrome=1

Content-Encoding: gzip
5d1.............X.n.6.>[email protected]..{[email protected]/E{)Z..G6.Z.H:v.....A..
..m_'}..II.lm.]8.......of.....d  3d..IML."..83.../.b...T.x..\..~B.I.4.
.)..Y.....u!.mLx.8....l..tid.....^a*.Td3...B-.............WP.x>.wV.
.NC.....2..'=.k.P.ghh..........i.6T.....M..[.A.7...5.n.G.P.T.t._G.F. .
...F"...U..c...0Lz.Ri......".k.U@.....|.t.|....E..E.c.....P..T...s...I
. B.fSz..F.d. ..N.^...57.W.(..R.....,......,.c.|......?......y.T.E....
G(.d.e.*.....1.y.I?..=EKqJZ..@.&...".m..% ....$=.5.cn....@.\...5......
...g..> .S..3..\.f<;imPP....,....Rs..3v0.E.......V~PS...s..d..3f
....|.F61..yqV3..r.*.!..'.............V.Y.Q{{........~....~.Z..~....t.
._.pxA.Z/.......]CJ..O:...(_L.&.....SI?........c...~SZ6j9..4A.Lx^,....
.....9N.?~.r..l........w..Ien .Y;.........._..H...e.;..".........k...i
...R...\U..1d[[email protected]...`.~..!..04.rF
T...........mq............(.40......y9..W.#...q..qG......S!...;E..bv&w
....p.h4..sMc.[.i%....:.....<Z..#.;.....7(.?'.X.S.."u.I..:.[F]8sl..
{.l=.vHY......rRG..................x<;z.$..=...).Jq....[.7`'6..../.
..D.h.A.,y..I..zP....s.x...v...I.|.I.P.#..I._;..*...JQ..zH,.....!nH.S.
M...`....Q.c....}.m4.H.T..B..k]...&LyJ0..V...7..."...g..>J.>.L..
?..|.......h.9...~...dAM:.....c%.!...."N..f.......v<:98..x6......e.
.../..m{..5*.X.'2.X--.*..'.....Y....=..j...T>>..VXk.*}O.P..v..g.
.e...R....;.w..D.&..q*.|...R..........).%.E6.[....U.^.......}.r{.c.]%.
j.k.}...&D.......u.Q...P.g.9(*&.c......_1.{8...3|../...wZ.Et.....D.Vx.
...H...6..)..}.^I..!.....m..i...qQh].['.0....Lp..YiS.<.....0..<
<<< skipped >>>

GET /images/public/menu.png HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.chacuo.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 21 May 2015 07:57:33 GMT

Content-Type: image/png

Content-Length: 868

Last-Modified: Tue, 16 Oct 2012 15:24:14 GMT

Connection: keep-alive

Expires: Sat, 20 Jun 2015 07:57:33 GMT

Cache-Control: max-age=2592000

X-UA-Compatible: IE=Edge, chrome=1

Accept-Ranges: bytes
.PNG........IHDR.......#......gf.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE)a.(d.(g. U. T............tRNS..............IDATx....n.0...
... .m........}..6...t.?.]:.,......`l..[.`l....p...q.,6..b..ZM.z......
.nk...T....h...)$S/.`.e...Kpr....?.....".P.A...D..JA........]w...A....
..N.....>6..>.(.........m......L...|v...i.Nj...j0.C....k[...&...
.-.zc..=K..].?.H.j.......>g.>.......=..L._...z....m.m..........}
r}s.F.1....'.n{U ......}.{L.;I...C./..bMU......*.....TJ..   6k....L..W
.V..<H..q........Y.y....h.jP)....I.......X.1.......S.`..5......`l..
[.`l. .....}....vW....W..VmOGa.D.5............G.x..r....k...h0._7.. U.
....N....-*..u<..g.>...:WS....Lj.............8}.h4...b.....v....
..l...L..2.Z..B..b..!..... L..V%......n.Tys.Z'..E.A}h.[.8..~.?.j......
.d.......Q..CH..{P.Gz$\u..F......=....rT...........`l...........W.-s..
..v........Y.Xjj{.\.$.`..!.~..`...6K........IEND.B`.....


GET /??/js/public/jquery-ui-1.8.18.custom.min.js,/js/public/json2.js,/js/public/jquery.store.js,/js/public/main.js?v=631 HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.chacuo.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 21 May 2015 07:57:33 GMT

Content-Type: application/x-javascript

Last-Modified: Sat, 11 Apr 2015 13:45:47 GMT

Transfer-Encoding: chunked

Connection: keep-alive

X-UA-Compatible: IE=Edge, chrome=1

Content-Encoding: gzip
600a...............w...0..{.....A.....6...%y.3^.,y.......I.`........R{
W...d&.....}.u..]..8..O.8........._........i..by.iUOg..'..P.<......
.....9..6.......X.......,_.ob...>.....Z....~QV....:..........|s...j
]/.'OT.u.k:.............X.e!.....y.../.....D.?....._.js.Z.f.......f...
..|[.'.kR.7..4.j.d..~.....fV.E.S...z^o>Eq......j.m.Y..x......N..]..
W..f..c*:.(.....I........n..f...C.z...N<.'....E.S..'P.......t._@E1.
..y...&...t....z......X..p4K.NT.N/.......u...*./.W#Y.tvvVvf...;....~.]
W...l7....t..o6..v._C.y.S.7.*....z....L".N5VC-."...x.......n.v#.....d.
...n.E..t. 3...6.7...0....7......._...7._.J. ^<[email protected].
?...^&......y..;......5$<.......7......o^.{[email protected].....{.C
2|*^..._%O~/....W.......}....7.......o_}.#6.....y...../...........}...
.:....~..R.*E.7..J...o..~.._ .w*..._.....X.........=...o...7.......^..
[email protected].;.....x......k.A...w..[X....Y..P..p.Z.=.lV........A.x?
Y..k.........!....]..........ZEc<Q.* f.Y..Q..5ZW.w.m.....u......8; 
.E6.C..P..N.U.Z?............ ...X-..7t......5_-?..U.v]Wgg...&...vU...O
U,O..T....n....(..[@....~S. 6.i...kC[....V5.....R..Ck..1.c.}v.Yny.-U.p
.'.....m..}.......X..3..G...`[email protected].~4....h......
.u.\8.......U...%...E%&...z^uJY.p*[email protected].... .....MF..|.7.:.[5..YW..
.N..3...5wZ.....L..&..@Ml. ....N.....`'......D..[.f...^`...ww.........
f.Y.Q..... ..`.......G$......T....e5...8>8....a./h`.nbF.....?..f...
..).......E.....RLphT..V.E.w...2..?.s..e..F][email protected]..:.r...W..!....
..{...^......rR...).....e.M5.."..k.\F..w....h.[\....d.2..^,..5.w..
<<< skipped >>>

GET /hm.js?ef483ae9c0f4f800aefdf407e35a21b3 HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=17DBFF3A4FDDC51F7959C2F44C233B48:FG=1

HTTP/1.1 200 OK

Cache-Control: max-age=0, must-revalidate

Content-Encoding: gzip

Content-Length: 7769

Content-Type: application/javascript

Date: Thu, 21 May 2015 07:57:32 GMT

Etag: bc74c2df0065ed6f4b73ee23fef2115e

P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Server: apache

Set-Cookie: HMACCOUNT=B4C1C753B5BB615B; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
...............(function(){var h={},mt={},c={id:"ef483ae9c0f4f800aefdf
407e35a21b3",dm:["chacuo.net"],js:"tongji.baidu.com/hm-web/js/",etrk:[
],icon:'',ctrk:false,align:-1,nv:-1,vdur:1800000,age:31536000000,rec:0
,rp:[],trust:0,vcard:0,qiao:0,lxb:0,conv:0,comm:0,apps:''};.;kw..... h
4...LI......4.6.M.6i...J.HB.#>....Z..;..$.H...9."....=.f..k....#..I
B.v<......F>.....2..}.u.].qz.[...3......wY...Td....y>.......X
;o._M..W|...k.=..M.|*.Yu.z...E~...t`..  ...Yn. DA.8.o.,.o.2,....8.f.u.
..[.....x:.p.&B...........L...,H....-E.&.,..<.9..p.W.....w.....7.3^
.....q*.......i..Gy.L.35..%.t..-.(Oy...o......!.NY.j...)....#......%.E
n.................R..B.....F\.#:.......ob..va....rH.q.G....c....q\q B{
.l.3.....Q.Xh.^.O..(V...x..l~w.2..z.w|....$/...p....Q<.%...t9....?.
.p:......o...w.....O...`,p4|....{dK..........69.n....[....C..T..MD6.f~
p%...u.Q0.....".-....9t..'..7a.'.M.1..M!....9.Z..ee.t.h.7...1.........
5.E.W..)...D1...j..".Wbk.M..~.4.*..y$"B..p|.......3..4akw...".. .1....
.T.,.9..D..M.LN*qR8.c ..C...... ....*..HTTP/1.1 200 OK..Cache-Control:
 max-age=0, must-revalidate..Content-Encoding: gzip..Content-Length: 7
769..Content-Type: application/javascript..Date: Thu, 21 May 2015 07:5
7:32 GMT..Etag: bc74c2df0065ed6f4b73ee23fef2115e..P3p: CP="CURa ADMa D
EVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
..Server: apache..Set-Cookie: HMACCOUNT=B4C1C753B5BB615B; Path=/; Doma
in=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT................
.(function(){var h={},mt={},c={id:"ef483ae9c0f4f800aefdf407e35a21b
<<< skipped >>>

GET /mailanonymous HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tool.chacuo.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 May 2015 07:57:29 GMT

Content-Type: text/html;charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

X-UA-Compatible: IE=Edge, chrome=1

X-Cache: HIT

Content-Encoding: gzip
1147.............;ks.G.......I.2....~I...[.nR.....J.Z..5x4.......6....
I..a^.M..d..c...D=.>.......h4..!Q.<.s..9.O.W.z>.B...,..zF.../
=./'!.?._H..2...|z..%.g...:.Qz6.....1.sE......:..X ..xX.S....F...XNO.;
x..F'....b).'e-.Uq..B..............rJH.:....L(..d.$(.C....r..YE.......
....-..,..U..(........x........).>..-..%/.<0.N..N...Q...........
.0....2....w<2..I..r...|.......Y]Td.M..\a...^.Fr.q...LOf.)/......{d
b...^.........[#?L........7..WJk.?lO..Wdv...R.......h.. ..9......c..Bw
....M.5.n...v.O..0.....<.4[91(..i]..8.}..#A...:B.....t%C.O...[.<
.NM......e........h..^..T..m..p6..D..!..".k|.'.F......A.r.H.}.R.:....C
......?..7..w...TN...4...V..Q.3. ....(SHP1.....V.o.~..v,X.....X..8....
....;.H.5... .J.Z#.pK.j.&Z.n.r475.X.H.zG....a.T..6....-.E*..ZI..(kX.{q
JQqS:s....\:....,XO.2......TA.p"d..j..qGS9]Q.p....V4.)uX9..x.....U.sI.
&..&....P.#.|.. '&.#...`.$.i1......z...c&.....IJ...@2V..#5%..n..,..SC.
...g{n..\.m.I..1jkl....U.9sYb..H...i*.b.k..S..q.*..N.......U........kd
b........0.d.>./...T......u... ..(o.u z..8.D.]...*Ba.$E....9..`.|o.
.7F.-........... sW......Js ..d5..{2{......o.qg/....P.k7...F.S.. ..1..
........h)......L...27t-M.M.......]......$.1F..=..u...0.a..;v.."2../.t
.oVTw.......M2}.\`.4.l..Y.q(........a.i..`k.\..../m.Dn.&.....\%/....p.
..4.?...#B......ro-..^.......Ll.X.[[email protected]..`....C.C.F..3.E...
....<:N........nRI.Qq~....,....E..x.......|1..x{..v..4..87YK...h.yV
........zM.....g..;..J;/...Z..ok.;....}@.%...... ~..A...@.(.%.....#..n
...Ep....K..C.6.4.....R.>^z;K}..Gd..O>....,...I...i.....0...
<<< skipped >>>

GET /f/search/adv HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tieba.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Connection: keep-alive

Content-Encoding: gzip

Content-Type: text/html; charset=GBK

Date: Thu, 21 May 2015 07:57:28 GMT

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Server: Apache

Set-Cookie: TIEBAUID=cb23caae14130a0d384a57f1; expires=Thu, 31-Dec-2020 15:59:59 GMT; path=/; domain=tieba.baidu.com

Set-Cookie: TIEBA_USERTYPE=c85ddd0f39005c646910981b; expires=Thu, 31-Dec-2020 15:59:59 GMT; path=/; domain=tieba.baidu.com

Set-Cookie: BAIDUID=17DBFF3A4FDDC51F7959C2F44C233B48:FG=1; expires=Fri, 20-May-16 07:57:28 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1

Tracecode: 34488798310529083914052115

Tracecode: 34488798310913715210052115

Vary: Accept-Encoding

Transfer-Encoding: chunked
800.............\[...u~....5...N.......J.rd..h....."Y....l.....L....1.
.Qb].H..KN...], N....b.)...Il..N.V.f..(oYA.U..NU.:u.\.xx.......S7k.x.M
....?}...g..=.....a..sfO..<f5k......3.}NIa.8^...V..D...g..?.,.,vM. 
5 .c....7'..q.....Ot............._......z........ZRp.Y...k...O........
%Pez..v.Y.V..~=V...L.UW...q.y..I.6..'.....(<......U..N..s.......q..
\E.:.g..F.5.E........|~Z..b.....B..M.S...P.&..|kr..d.Z....7.qZ)z......
P..u...%......M..x.?.. .u..e.....T..K.IUR....~.i.b.4.k..V... .<....
Os......*.S.j.t.......8.Lzk>u......w.2......DK..&XAQAz.&.Ut..!....u
.0)..........,iI1...O\~jD1..q.....K6...n.......|.....k|rE?.....0.'.$..
$.\..A..U._.ww.gS..m4...(.....:.....X[X.dju.....-H...p.P..E4.hoGc_..1S
........~).$7.|4.Xl....jF.................*6.<..N.....8.....R.j....
.".T"....6Y..u.W.z.poo.H..O.i...G.x..'n*X.x..[`.1oF 3..zK..@:.....,._.
[email protected][W&H.b.I...=u.2..'o|A.2a$.\....&...=.5..E
.......a...0..T..f............N...SU..7...=T.ccv)...i.....'......|:i..
...t.#~LC..~.l$.X.%Ta..........q... . .kP...8..i...8...$7.....3q.....z
eq...H.C.N....u...H..;..b....R.z......?..I....Y4..........d(.....y..i.
.BF.#...S..|{...z.p...r]...eG.8...d..q.M..e.r'cF].I.w.M.?..........#..
[email protected].|.s.;.X|...&...'.....NI.....F'...8.P...jB$B....%..;J.....
..O6...'..3..~9...p.R..<.p...5.$.T6.nh.#. .X.|...H9..#.F.}.f......p
... ..kD.%..q....'..TG.........|`#A....lg.q..q!.R..A... [email protected].
=u.D.3.7........#&v-q~...\Dt.jQ....I...[l..|...M.:?R@.}.].....%.;...qP
 _......oh....N......*.../.y..V.$....*D.:...s7j.BT........pj....VM
<<< skipped >>>

GET /core.php?web_id=768630&show=pic&t=z HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 752

Connection: keep-alive

Date: Thu, 21 May 2015 07:57:35 GMT

Last-Modified: Thu, 21 May 2015 07:57:35 GMT

Expires: Thu, 21 May 2015 08:12:35 GMT

Via: cache62.l2de1[615,200-0,M], cache11.l2de1[616,0], cache2.de1[616,200-0,M], cache4.de1[617,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:2:408338492

X-Swift-SaveTime: Thu, 21 May 2015 07:57:35 GMT

X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="768630",c="pic",d="",e="
online_v3.php",f="hzs12.cnzz.com",g="1",h="pic",i="z",j="站ž
71;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="
0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" 
f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.
callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createSc
riptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?we
b_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/im
g/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><
img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a hr
ef='" q "' target=_blank title='" j "'>" j "</a>",k.createIco
n([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: applicatio
n/javascript..Content-Length: 752..Connection: keep-alive..Date: Thu, 
21 May 2015 07:57:35 GMT..Last-Modified: Thu, 21 May 2015 07:57:35 GMT
..Expires: Thu, 21 May 2015 08:12:35 GMT..Via: cache62.l2de1[615,200-0
,M], cache11.l2de1[616,0], cache2.de1[616,200-0,M], cache4.de1[617,0].
.X-Cache: MISS TCP_REFRESH_MISS dirn:2:408338492..X-Swift-SaveTime: Th
u, 21 May 2015 07:57:35 GMT..X-Swift-CacheTime: 900..!function(){var p
,q,r,a=encodeURIComponent,b="768630",c="pic",d="",e="online_v3.php",f=
"hzs12.cnzz.com",g="1",h="pic",i="z",j="站长统෶
5;",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.
cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on
<<< skipped >>>

GET /core.php?web_id=3819543&show=pic1&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cmd5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

Cookie: cna=8H3kDZBxtXICAcGK9Oe2pGU2

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 754

Connection: keep-alive

Date: Thu, 21 May 2015 07:53:31 GMT

Last-Modified: Thu, 21 May 2015 07:53:31 GMT

Expires: Thu, 21 May 2015 08:08:31 GMT

Via: cache31.l2de1[0,200-0,H], cache35.l2de1[0,0], cache7.de1[0,200-0,H], cache4.de1[0,0]

Age: 250

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Thu, 21 May 2015 07:53:33 GMT

X-Swift-CacheTime: 898
!function(){var p,q,r,a=encodeURIComponent,b="3819543",c="pic1",d="",e
="online_v3.php",f="hzs10.cnzz.com",g="1",h="pic",i="z",j="站
8271;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m
="1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=
" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&
k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.create
ScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?
web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/
img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'>&l
t;img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a 
href='" q "' target=_blank title='" j "'>" j "</a>",k.createI
con([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: applicat
ion/javascript..Content-Length: 754..Connection: keep-alive..Date: Thu
, 21 May 2015 07:53:31 GMT..Last-Modified: Thu, 21 May 2015 07:53:31 G
MT..Expires: Thu, 21 May 2015 08:08:31 GMT..Via: cache31.l2de1[0,200-0
,H], cache35.l2de1[0,0], cache7.de1[0,200-0,H], cache4.de1[0,0]..Age: 
250..X-Cache: HIT TCP_MEM_HIT dirn:-2:-2..X-Swift-SaveTime: Thu, 21 Ma
y 2015 07:53:33 GMT..X-Swift-CacheTime: 898..!function(){var p,q,r,a=e
ncodeURIComponent,b="3819543",c="pic1",d="",e="online_v3.php",f="hzs10
.cnzz.com",g="1",h="pic",i="z",j="站长统计",k=
window["_CNZZDbridge_" b].bobject,l="http:",m="1",n=l "//online.cnzz.c
om/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d
<<< skipped >>>

GET /9.gif?abc=1&rnd=1555829661 HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Thu, 21 May 2015 07:57:36 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=8H3kDZBxtXICAcGK9Oe2pGU2; expires=Sun, 18-May-25 07:57:36 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=cbcf88f2; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=8b010655c5949f0c58c4418e_1432195056; expires=Sun, 18-May-25 07:57:36 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=8H3kDZBxtXICAcGK9Oe2pGU2

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Thu, 21 May 2015 07:57:36 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=8H3kDZBxtX
ICAcGK9Oe2pGU2; expires=Sun, 18-May-25 07:57:36 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=cbcf88f2; path=/; domain=.cnzz.mmstat.com..
Set-Cookie: atpsida=8b010655c5949f0c58c4418e_1432195056; expires=Sun, 
18-May-25 07:57:36 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt
p://pcookie.cnzz.com/app.gif?&cna=8H3kDZBxtXICAcGK9Oe2pGU2..Expires: T
hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach
e..GIF89a.............!.......,...........L..;..

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.cmd5.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Vary: Accept-Encoding

Server: Microsoft-IIS/7.0

Set-Cookie: ASP.NET_SessionId=kvojhay3wethdsgkaijl14tm; path=/; HttpOnly

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 21 May 2015 07:57:30 GMT

Content-Length: 10894
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"~...=.].~y...yy...E............
w.{.....o......|.<....o.l..mQ-...........v..........qU_.}...;......
v..9......s|..[.............Rj.x.g.......o.y.r..'.:...>.V.6_....*.(
..>.....w..a:.gu...}.....G....m..9..........U........._._........m.
._....S...........E./.}..A.7.u...N{.6....w......_d..7N~1..d...u.^...UY
..~.t........o....8.T.._....b.h...P.n.........y.-....O..,[f.........2o
.i6j...M^....3....;.%)u4.............K.q.R.....)..=..U.a..-.e~.m:....o
.1....,.....5...(]..V......k4.(...u...v.]Z..m.V .mV4.2.~.N.j...(.....t
......X^<.....hZ.....M{|....IU......t..5UY....d.....Y;...=...7.8 ..
..,.Y.C..f.2.a.G BC....K..4.9N..%[email protected]].......>.Bmd
D.hN.O....L..^....[...aw.p...h.......GU.yM.........lV....)MC.c4%......
.x.^.b.......U^\..G....'.R...II.......S.....;...........L...vy.....?..
...;).whH.).s.wO.G.4>j.|....6...G#.C<|.\.0............O..<.CS
....R..."....J...?.......]..~F..7....:{.&..n.b..3.....Il.......,..>
\I.B.........|..B.t.>8(M.~ .}.u...jE......K..}o..8....^..<_..j..
iE.J/....=.&.........I..rb....n..UU..M.'..&.L..$..g)A..wF*.2.?..S..Kd.
'{d...A.G..2[.ezB.G..{.Zs.U...F....C.....m...>b..>..%}.N<..M1
a..0..-.F..m.^.k..4[.%.9...q....A.-..{.Y..a.....o.K..0v........tRo$W,.
.ESL..h...I!..C...p.*q..e....^.P="...P..1.....>~......?...j........
....6Tw..70._.~s.L.G.y.z..........)..Dz...?#0.S..........Z......<..
..H..j...!}..r...'..F...a".cb....,..H...o..o.T.]L.4.w#M0.~.[....A.
<<< skipped >>>

GET /md5.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cmd5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.cmd5.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=kvojhay3wethdsgkaijl14tm

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Encoding: gzip

Last-Modified: Tue, 05 Jun 2012 17:53:31 GMT

Accept-Ranges: bytes

ETag: "1dd4771e4443cd1:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 21 May 2015 07:57:33 GMT

Content-Length: 2993
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:....Y....;...z9m.j.O.....Vv'
..i...z..M[...[.....{...=?..w...$.1_dSn.... ,......R...d....../....7..
...3......;..z^].....Z}.Y.......;...Mg{.......?.w.`.w..>8......w.p&
gt;1&..d..........5........<.Vz.".vn..Qz........(.;.iq.n...Q..)...Z
...(.....z......uv.E.....'.sU.[h6..i.'.c.M??...d..|......K..<.....@
.....b......?=.;.N/.;.X6.V.i.zt9.C....K?I.}..7Puf.\.ww.".en........O..
_....yJ.{......|N..O.......{..?}p.......g.......f..G..*.....yD....3"..
..KIK.M..yV.T.......'.'..E.)}...GGG...........W.~.K,..WK.P...YaZ...M..
. ..H.....(.t..O|t.j.SPnF..z..la;|...F4..........g....B..~........~...
'9...........>[email protected].~....D.t....=..&.........Z.(.$
..:/i...{iog..[.....a\0A$..0..KlI........5..1.....I..........T[...wJ..
.7t......}..M..........?~a..A7.3:.M..M...b..6...V....[T..0.u.Gsk.kJM..
..|F.._*X..B5A.c.-L.7...Ac.......?.YJ={|<M.../L.......'.{z.Ha....vL
..._8&.......G.%......E..7.X...bM...o......>...1m...}.....-....SRA.
.!... ..................>.'.-..............>.O...|X........l.Q..
(.R../".Y...m~..T.fN...Wh....5U.2.4....|....Q......H........t.......&g
t;.......jg...v...=z........?.....A..K.....>>..tw....Cz......}G^
.G/........{.....W6.c.^.........<|@/l..}z.......9....q.....c.&.....
]ze.@.. <....v...E/l....@].>x..s..>....xH/`.....V......q.b.y 
.{;..n...&.........!...8.]L9..K..t...F...q.b.y .;D....v.00.<..ai...
..K6......'.)..{{.E3....P.........~z.L....@..;....!^......].......
<<< skipped >>>

GET /ScriptResource.axd?d=it_DV6yc5evxqvnVI3DF3q0fMwIs7G-op0Hh0z0lvyE_bJoY1I3FP2HmU-369XwIZIV7MO52l3RkbZv9Hew00tOfamG_aj4JdcFdtI2vMnjbSemSUze_OaxSzfE1&t=f2cd5c5 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cmd5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.cmd5.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=kvojhay3wethdsgkaijl14tm

HTTP/1.1 200 OK

Cache-Control: public

Content-Type: application/x-javascript; charset=utf-8

Expires: Fri, 20 May 2016 01:46:30 GMT

Last-Modified: Thu, 21 May 2015 01:46:30 GMT

Server: Microsoft-IIS/7.0

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 21 May 2015 07:57:35 GMT

Content-Length: 357751
// Name:        MicrosoftAjax.debug.js..// Assembly:    AjaxControlToo
lkit..// Version:     4.1.40412.0..// FileVersion: 4.1.40412.2..// (c)
 2010 CodePlex Foundation..(function(window, Sys) {..var merge = funct
ion _merge(target) {..    target = target || {};..    foreach(argument
s, function(o) {..        if (o) {..            forIn(o, function(v, n
) {..                target[n] = v;..            });..        }..    }
, 1);..    return target;..}..var forIn = function _forIn(obj, callbac
k) {..    for (var x in obj) {..        callback(obj[x], x);..    }..}
..var foreach = function _foreach(arr, callback, start) {..    var can
celled;..    if (arr) {..        arr = arr instanceof Array || ..     
       (typeof(arr.length) === 'number' && (typeof(arr.callee) === "fu
nction" || (arr.item && typeof(arr.nodeType) === "undefined") && !arr.
addEventListener && !arr.attachEvent))..            ? arr : [arr];..  
      for (var i = start||0, l = arr.length; i < l; i  ) {..       
     if (callback(arr[i], i)) {..                cancelled = true;..  
              break;..            }..        }..    }..    return !can
celled;..}..var callIf = function _callIf(obj, name, args) {..    var 
fn = obj[name],..        exists = typeof(fn) === "function";..    if (
exists) fn.call(obj, args);..    return exists;..}..if (!Sys || !Sys.l
oader) {..    function append(target) {..        target = target || {}
;..        foreach(arguments, function(o) {..            if (o) {..   
             forIn(o, function(v, n) {..                    if (ty
<<< skipped >>>

GET /WebResource.axd?d=SqndIz8Gv1Pgy1cT8jGtzYwQ6y_bwN73E_OGkbc-Uue2zZLA-z9a1D25wL0tBfY6zI3pzray1wWKWndGhCQzxIJJT6A1&t=635418570520000000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cmd5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.cmd5.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=kvojhay3wethdsgkaijl14tm

HTTP/1.1 200 OK

Cache-Control: public

Content-Type: image/gif

Expires: Fri, 20 May 2016 01:46:10 GMT

Last-Modified: Thu, 24 Jul 2014 19:50:52 GMT

Server: Microsoft-IIS/7.0

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 21 May 2015 07:57:43 GMT

Content-Length: 64
GIF89a.............!.......,[email protected]...`G..;>....


GET /images/qq.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cmd5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.cmd5.com

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=kvojhay3wethdsgkaijl14tm

HTTP/1.1 200 OK

Content-Type: image/gif

Last-Modified: Wed, 03 Aug 2011 19:56:19 GMT

Accept-Ranges: bytes

ETag: "16447f691752cc1:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 21 May 2015 07:57:43 GMT

Content-Length: 1243
GIF89aJ..........................$...{.q.N4............x.)......,*5...
.vL......j.'c..kZ3EGT..=|.6.......h"w..y..89F`......... .k..........u.
.V...z.......di.4.....7......# ).......s........,.}...3$.....J\..y....
.Y.....?...........-l.......9{.P..K..(e.E..3s.U..?|.\..$_............H
..............Z...o.......(...bgw..6jv.A?H...A.#....0.......r.<wUZw
h^........Q...........................Y...........!.......,....J......
..[8{...........8[.b8\}...........\8l6~...........6Z.y..(f4.!($z......
....ZZz..c!....5..........Z.x...!.V.W.V. 5u...........u..f......W. ..*
\.0..)..<..p.B.^.h....:v4"D..f.F!(Q...R%..0].q...L.^.p.........=p@A
...x...E.S.J.:....T.M..X.4...].fY1... <F.P@T...<.P.0;...<f..-
k.oY.L... ....}..].....nJ.(.A....,8.....&M.;.=:[email protected].*[email protected]}b.. .A
D..BM..a..X.....Fp?y...r....y...t=../..L:..G.g.afA...blP.^......9B.H..
....O.~....._.x.W..........F......R`...R..B.J.......!.#..!..~........*
.h.._.a#..L..o..@[email protected].`#.J....PJ....@.$.U....I....1..C.
........&.0.9..t.9G.r.i'.I....|....u.i..J$z..d.P..p.`..).....4.C.J....
.p...........D......&\@...x ....a...l...D. [email protected].[,...K...BK....@..
...-..x.....1..?.{[email protected]... ....{....qG.=t...................7...
[email protected]..(....,.........|.l..8....<..s...PC .
;..

GET /qq.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: lr3800.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 May 2015 07:57:29 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=dd2ffcbc7a8a016feb27855ae27ad4f861432195047; expires=Fri, 20-May-16 07:57:27 GMT; path=/; domain=.lr3800.com; HttpOnly

Last-Modified: Fri, 01 May 2015 01:18:43 GMT

ETag: W/"1140388-f4-514fafe3de4b9"

Vary: Accept-Encoding,User-Agent

Server: yunjiasu-nginx

CF-RAY: 1e9ebb0986d20a4e-ARN

Content-Encoding: gzip
c9............d.KN.0....Xs.....T....=v..l.Q..u..X!..Bb....ygd.K......N
..B^.Xkz.|.q.M....~M...^..F7.M[.(..S.F`;t...}.$uN...K).aK.%u"...eU..*.
I..9....8*.........D.s\......y(.....`8W...........De.Vc..._........a..
[email protected]~......0..HTTP/1.1 200 OK..Date: Thu, 21 May 2015 
07:57:29 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Con
nection: keep-alive..Set-Cookie: __cfduid=dd2ffcbc7a8a016feb27855ae27a
d4f861432195047; expires=Fri, 20-May-16 07:57:27 GMT; path=/; domain=.
lr3800.com; HttpOnly..Last-Modified: Fri, 01 May 2015 01:18:43 GMT..ET
ag: W/"1140388-f4-514fafe3de4b9"..Vary: Accept-Encoding,User-Agent..Se
rver: yunjiasu-nginx..CF-RAY: 1e9ebb0986d20a4e-ARN..Content-Encoding: 
gzip..c9............d.KN.0....Xs.....T....=v..l.Q..u..X!..Bb....ygd.K.
.....N..B^.Xkz.|.q.M....~M...^..F7.M[.(..S.F`;t...}.$uN...K).aK.%u"...
eU..*.I..9....8*.........D.s\......y(.....`8W...........De.Vc..._.....
[email protected]~......0..

GET /app.gif?&cna=8H3kDZBxtXICAcGK9Oe2pGU2 HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pcookie.cnzz.com

HTTP/1.1 200 OK

Server: Tengine

Date: Thu, 21 May 2015 07:57:36 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=8H3kDZBxtXICAcGK9Oe2pGU2; expires=Sun, 18-May-25 07:57:36 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Thu, 21 May 2015 07:57:36 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=8H3kDZBxtXICA
cGK9Oe2pGU2; expires=Sun, 18-May-25 07:57:36 GMT; path=/; domain=.cnzz
.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache.
.Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /static/css/style.css HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cha.hxsec.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Thu, 21 May 2015 15:43:04 GMT

Content-Type: text/css

Last-Modified: Wed, 21 Jan 2015 02:23:00 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Content-Encoding: gzip
1e4...............n.0...g.;[email protected]._
....bm....;.......Z..'.g.x...DQs...S.E.@hG{...S.5.....cUq......\.*%...
R.R!0Y?....O".....\0.`.0.L...M.&eY./..3..wdd.u......m4.. Rk..8.c<..
L....h.,:_...T.)h ;...@[......./D{.k....@......=...!.y%Pi.c.V......~..
.SyD...`.."x..........y.....D'.b...f..E..B....A.V....{0.5..X0#=....I}`
...!M.l...>.Y...".7A{..b..Yx.../.....k....v...D`....h.3.....,:..=..
.L..........x#.E.LR.k...._`.......U.....q...@]..")<.*..(..T.3..D..'
..9^......0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Thu, 21 May 2
015 15:43:04 GMT..Content-Type: text/css..Last-Modified: Wed, 21 Jan 2
015 02:23:00 GMT..Transfer-Encoding: chunked..Connection: keep-alive..
Content-Encoding: gzip..1e4...............n.0...g.;41K4.........hi.FlI
[email protected]._....bm....;.......Z..'.g.x...DQs...S.E.@hG{...
S.5.....cUq......\.*%...R.R!0Y?....O".....\0.`.0.L...M.&eY./..3..wdd.u
......m4.. Rk..8.c<..L....h.,:_...T.)h ;...@[......./D{.k....@.....
.=...!.y%Pi.c.V......~...SyD...`.."x..........y.....D'.b...f..E..B....
A.V....{0.5..X0#=....I}`...!M.l...>.Y...".7A{..b..Yx.../.....k....v
...D`....h.3.....,:..=...L..........x#.E.LR.k...._`.......U.....q...@]
..")<.*..(..T.3..D..'..9^......0......


GET /static/js/jquery.js HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cha.hxsec.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Thu, 21 May 2015 15:43:05 GMT

Content-Type: application/javascript; charset=utf-8

Content-Length: 93106

Last-Modified: Wed, 21 Jan 2015 02:23:00 GMT

Connection: keep-alive

ETag: "54bf0d84-16bb2"

Accept-Ranges: bytes
/*! jQuery v1.10.2 | (c) 2005, 2013 jQuery Foundation, Inc. | jquery.o
rg/license.//@ sourceMappingURL=jquery-1.10.2.min.map.*/.(function(e,t
){var n,r,i=typeof t,o=e.location,a=e.document,s=a.documentElement,l=e
.jQuery,u=e.$,c={},p=[],f="1.10.2",d=p.concat,h=p.push,g=p.slice,m=p.i
ndexOf,y=c.toString,v=c.hasOwnProperty,b=f.trim,x=function(e,t){return
 new x.fn.init(e,t,r)},w=/[ -]?(?:\d*\.|)\d (?:[eE][ -]?\d |)/.source,
T=/\S /g,C=/^[\s\uFEFF\xA0] |[\s\uFEFF\xA0] $/g,N=/^(?:\s*(<[\w\W] 
>)[^>]*|#([\w-]*))$/,k=/^<(\w )\s*\/?>(?:<\/\1>|)$/,
E=/^[\],:{}\s]*$/,S=/(?:^|:|,)(?:\s*\[) /g,A=/\\(?:["\\\/bfnrt]|u[\da-
fA-F]{4})/g,j=/"[^"\\\r\n]*"|true|false|null|-?(?:\d \.|)\d (?:[eE][ -
]?\d |)/g,D=/^-ms-/,L=/-([\da-z])/gi,H=function(e,t){return t.toUpperC
ase()},q=function(e){(a.addEventListener||"load"===e.type||"complete"=
==a.readyState)&&(_(),x.ready())},_=function(){a.addEventListener?(a.r
emoveEventListener("DOMContentLoaded",q,!1),e.removeEventListener("loa
d",q,!1)):(a.detachEvent("onreadystatechange",q),e.detachEvent("onload
",q))};x.fn=x.prototype={jquery:f,constructor:x,init:function(e,n,r){v
ar i,o;if(!e)return this;if("string"==typeof e){if(i="<"===e.charAt
(0)&&">"===e.charAt(e.length-1)&&e.length>=3?[null,e,null]:N.exe
c(e),!i||!i[1]&&n)return!n||n.jquery?(n||r).find(e):this.constructor(n
).find(e);if(i[1]){if(n=n instanceof x?n[0]:n,x.merge(this,x.parseHTML
(i[1],n&&n.nodeType?n.ownerDocument||n:a,!0)),k.test(i[1])&&x.isPlainO
bject(n))for(i in n)x.isFunction(this[i])?this[i](n[i]):this.attr(
<<< skipped >>>

GET /static/js/system.js HTTP/1.1

Accept: */*

Referer: hXXp://cha.hxsec.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cha.hxsec.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Thu, 21 May 2015 15:43:06 GMT

Content-Type: application/javascript; charset=utf-8

Content-Length: 5139

Last-Modified: Wed, 21 Jan 2015 02:23:00 GMT

Connection: keep-alive

ETag: "54bf0d84-1413"

Accept-Ranges: bytes
...//jb 5/24........eval(function(p,a,c,k,e,d){e=function(c){return(c&
lt;a?"":e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 29):c.t
oString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c)
;k=[function(e){return d[e]}];e=function(){return'\\w '};c=1;};while(c
--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p
;}('3o 2Y$=["",\'\',\'\\\\w \',\'\\\\b\',\'\\\\b\',\'g\',\'d c$=["1W",
"#n","1T","1R","#n","\\\\2h\\\\2g\\\\k\\\\p"," \\\\2i\\\\2k\\\\1N","%"
,"H","H","#n","\\\\k\\\\p\\\\T\\\\O!\\\\1q\\\\1t\\\\1j\\\\1k\\\\1g\\\\
G\\\\D\\\\E\\\\U\\\\W \\\\z\\\\A:.","\\\\C\\\\B","#n","\\\\k\\\\p\\\\T
\\\\O! \\\\U\\\\W\\\\1v:","\\\\1u \\\\z\\\\A:","\\\\C\\\\B","#n","\\\\
k\\\\p\\\\T\\\\O! \\\\U\\\\W\\\\1v:","\\\\1u \\\\z\\\\A:","\\\\C\\\\B"
,\\\'2j\\\',"1D","1p=","&1o=","&I=","&2c=",\\\'1O.2b?2d=2f\\\',"#H","1
T","1R","#I",\\\'\\\',"#I","\\\\Z\\\\2e\\\\2l\\\\k\\\\p\\\\1r\\\\1n/\\
\\G\\\\D\\\\E/\\\\2s\\\\2r","\\\\G\\\\D\\\\E\\\\2t\\\\1N\\\\Z\\\\2v\\\
\2u!!","#1p","#1o","1C","\\\\1q\\\\1t\\\\2n\\\\1g\\\\2m\\\\1j\\\\1k\\\
\2o\\\\1r\\\\1n\\\\2q","2p|2a~!1X~!1Z|a|1Y|a|b|a|b|a|b|a|b|a|b|a|b|a|b
|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a
|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b
|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a
|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b|a|b"];d o;d N;e 1D(1y,1
U,1J,Y){d l=1C["2V"]();d 1A=l["q"](0);d 1I=l["q"](1);d 1V=l["q"](2);d 
1M=l["q"](3);1A["w"]=1y;1I["w"]=1U;1V["w"]=1J;1M["w"]=Y};e 1x(){$(
<<< skipped >>>

GET /pagead/js/adsbygoogle.js HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 6970532526306670548

Date: Thu, 21 May 2015 07:20:43 GMT

Expires: Thu, 21 May 2015 08:20:43 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 13954

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=3600

Age: 2208

Alternate-Protocol: 80:quic,p=1
...........}iW.H..w~..'[email protected].........~.z.f....w..K..{u
m]]........n<...2..`...h..D.M...7. ....6..{N.Qj...0..2.D1.8.v......
x.N4./.U... [email protected].*R..p.O..F<....I... ..x.....o..;..AO....[..w.C-.
.d>...^....7...ZM.O\..N<W....,.:.c.......'.1T......Z..k.2.X.....
.....6.....%.*..Zym...W...9.Xk<[email protected].],..Z.%..D.|1..v.J.LH..%q.
...8..lEt..f..^g..p....#....$.jI.[... ..V..p.....{I9.,..........W..*B.
..xa.9...a....h0.c94..I.L..h...VW.2..$....S....q&k...V...d..F.^....4..
.o..3ua.t.f.j. s..\.l.8Q...'.m......{..p...`.].....0.^.S.#.......=./..
=@..>.4M.$~....l.....l..{.V..6.._>...&.L..>.......F.~.0....m.
[email protected]:N....8...;]k6Z;.A~..f.^F.......|k...:.
t....j. .,([email protected]..}V7Tt;......v...-....1..j...F.....t..y4
.....d.{.m...Ki....D)_..N..M..v>;.S....IuLX!.E..P....{..I.`KJa..](.
.E.l.j..h...\.......0.8w]...B..hI...e...)... ../0.vc........C....Q...H
J<....A........e.....y...b..#...0wI..H..f. 6.$U.2.M....v..h..;,.A7.
>.k......N4.k...!.&....K.?....G..'.q..!...1..1>.5_..y....%...{9.
.?..5...i...B....]...........Y.{..`..[...........z..9.~.H..I).r.....e=
K0H`i.....=..&....f.v..._...K3.;..fn7_. ,2O......~.N.uk.X.I...........
j.....li...E.......^p{d.6.VY.....a...B.7........t......6h....H...[.D..
.."...$.Jh..:...?c...2."..a(..K.~:{v.s."7.2...]..u...\.m8..,.".:....`.
E............].I..J.-5....~0.....DT...t.2..g?..d4..C.l5..p.....2...^..
......HUqH..L^3_..e2...v.5&l..d..T2..".....p.....{Q..íF..J..C...3B./
.%..-\...%.9b.N..B.....X....RF."..7u}....c^n6..]n.._..f./.........
<<< skipped >>>

GET /pub-config/ca-pub-8401880217755931.js HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: text/javascript

Last-Modified: Wed, 20 May 2015 23:26:08 GMT

Date: Thu, 21 May 2015 07:57:31 GMT

Expires: Thu, 21 May 2015 19:57:31 GMT

Cache-Control: public, max-age=43200

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: sffe

Content-Length: 108

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=1
...........H..O.I.O,..K.O..K.LW.U(..K./..&YS.P]......[P..kab`haa`dhnnj
jil....^.T\..........dURT.Zk..fB].k...HTTP/1.1 200 OK..Vary: Accept-En
coding..Content-Type: text/javascript..Last-Modified: Wed, 20 May 2015
 23:26:08 GMT..Date: Thu, 21 May 2015 07:57:31 GMT..Expires: Thu, 21 M
ay 2015 19:57:31 GMT..Cache-Control: public, max-age=43200..X-Content-
Type-Options: nosniff..Content-Encoding: gzip..Server: sffe..Content-L
ength: 108..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:qu
ic,p=1.............H..O.I.O,..K.O..K.LW.U(..K./..&YS.P]......[P..kab`h
aa`dhnnjjil....^.T\..........dURT.Zk..fB].k.......


GET /pagead/osd.js HTTP/1.1

Accept: */*

Referer: hXXp://tool.chacuo.net/mailanonymous

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 13512961741681812288

Date: Thu, 21 May 2015 07:56:33 GMT

Expires: Thu, 21 May 2015 08:56:33 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 19779

X-XSS-Protection: 1; mode=block

Age: 59

Cache-Control: public, max-age=3600

Alternate-Protocol: 80:quic,p=1
...........}iW....w~...0Rh...E....$$.. d.ON......6[b.....^$."3..g2XR.k
u....=9n.{~..F..;|.j.X..p........x.o'..%.....K.b.YrQ..:...U..%....j..[
L&......<...`<...|.s{ .8.....o..JG..........Z.t..A.,e1]?....j.8L
8..WHA..S..B_D.....w......(h.~...Y...l.1="...E3.....x.d."]..~......4..
.Pr.q.c........X.$&....}....~x.l.c*$..Fz.uhe0...Xge.?....fE.N....\..,~
n...m.Z"mm.m.B>....M&^....!|.>.9..{.J.=.xKY,..T..BK.j8.?..A.j(..
.]*..=].....k...|...jq4....Ee..S.MsK..%..E.Mu.`..Z..-...l.%[email protected]
........).......h...O...,..;e.e.r...OY...S.......z...)k.....f......s..
J....a.f.7.A...9a..D0n....{.!...<.....8......m...U..l..n'hq.....?.f
S]..R..I.......L....%[..........{ [email protected]........
v...L{p..s.....W.^{h.c<P0..n\.\.Zn8r.>3Tt6.0H.u.g......~./..v\l.
....=...a.V_.z5... ..}.V..a...j....]...?.6f.>..c......s..l..pX.X...
..k.h.2V#8.R.0.f`....(..........%.v.^......iX.9T....^...rty'....{{..d.
......p....Ja. @.\h"[G.^.X.....;..e..D..gSo......qY..s..a.fY....f..`..
...... {...g.yY...ju..K.P..vt`.../....s.......;...........X,....../o..
.j......f.#.......lh..<..rQq1*.Gb..t............Q......v.5WV..l...l
.....W...OTs.n.{..e.8..W...yM.....Q..b..GH....x.%...v.ot.U!..>4n.H.
.t..6.....W.5....fc`..48..}.f.j.(si.[....E..t:...I0.ah0.m....Q.,..S.7;
.v.l...Z(^..ZX..."w...:i.....m..U.B..j..pJ.........R...Nag.);.aA....s.
OV..................',.....%U.]^>.yA.]w.g:.^. .........]t..oo....L.
J..5V..........U8.U...5.S........o.k.N...&..F\g~[.<.....5...%.p.J./
.....J..R..@.*i..g._.F...BH)[>..S..M......)...w. .!._.[.|A[x(.f
<<< skipped >>>

GET /pagead/imgad?id=CICAgKCTkZfTxQEQ2AUYWjIIpKDrRFXGq4A HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: application/x-shockwave-flash

Date: Mon, 18 May 2015 12:08:21 GMT

Expires: Mon, 25 May 2015 12:08:21 GMT

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 71527

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=604800

Age: 244151

Alternate-Protocol: 80:quic,p=1
CWS.B)..x...Stg..=xc..O..c...t...c....m.c........7.5..8.r.]g.:.n...w..
..... ................H?_..g....G.1.....bM..........p.....p.....@..:..
..>....C..R.\.|....T..T.i..LD...ZS.fuD..3 .....>.%......?Lr...S.
N....[.?._....2..DDv5...g.R,.f..X.O.3Q.`.Eg.5.N.CIq.`...../<.......
..$.E.Em..g.fD .....Dc.....D.K.G(i...n..j'"k.#..z....K.DSHV....uQ.T..E
.k ...Sx....}..pUJ\F..X.M.....kyQCH..;.u.U|7.o.I.1.EsAj..N.:..\K.....~
Ab..I.q5...b...&.a.$K.".J.J.x./&.l..(fbK;:...U^.....~sL].h.Nl......V..
.E.\.`W.~..J,H;.\...(,.....{...u....OA..Do...d..o..d.ry.=.....6J.o.:.*
.)b.......5...0..E...qi...&.7."..b.......j..&G......4......].?.U.tD...
V.H...1.&...Q.cX........[..p...Fm...3...5....5.Y N.....O$R.....Eur....
|..TF..]......^%..}.......@...=Y.\....y..3....t..V.......".H. 6.3w4}6.
v...^|`.........&.B.....MY.w.[.......b....W..-.;...s.s..OsX*}j..#.....
.....j..q..N.L... B.3...a...(3.....j .a*{......z.si..XV.&....7...I....
......w#.O3S..u..._P6.G.q!.SW..g?cjl...GiB.F....z#7..N.p.T.......0.W..
.C.xp..?:$.#[email protected].}........WD....).{_vwa......A|.^...=..{. .d.R...
.{p...;.....h.......).L$....v.D..V6.........8..". ..B..y.J..%...3..._.
I1..3H`.X...3u.......m..I.%.X....-...v.x..\fW&h..t..............o..Z=.
:...;(...Mh...AJ.\./..$f.....t.1}...Z(.XKT.1.`.)...\..Tz.q\...m....=v.
E.sQs..;..=.G..a(...<.jp$.j.....Q..........3...3..6..K.W.... .0....
g..b.K H....$..&72..Q.?..St._.7.....I~...8.fU.. ...@.........*Y......h
...........L.\..iF.\..To.5.G!.l...r..".a5.D...F.....#.'...L..#.3...#z.
...bT...2{..T...m.K%.........D........_}.m..z~...}9....F.L..@...}.
<<< skipped >>>

GET /pagead/inject_object_div.js HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 14995889589159710514

Date: Wed, 20 May 2015 14:56:42 GMT

Expires: Thu, 21 May 2015 14:56:42 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 729

X-XSS-Protection: 1; mode=block

Age: 61251

Cache-Control: public, max-age=86400

Alternate-Protocol: 80:quic,p=1
...........UKO.@... ...Q..z.!..*.".=.zA(Z......v.v.....].1.PT.9$......
.(U..V.k..8...S7...G.y&.XfC.u.0..V..2.n)-,...s....JT2.N...hNsT..*....q
tusq....g0.X..][email protected].@.....'..uZ..:Gw^ ?.m.2.8m.|..wpHG..
....up..48.7.tp r....1...._...Q..u....@..%....jn...B..waH..`. .I.o#.1.
.4<.z....*Ej....$;....z-)Z/Q...H.r$....r%.$_)..p.5|......F...Z.B.3(
.X.b.&...2.......::.....H.....ZRm...h......{.=qp..[.V1.C.C-.].k..2e...
0D.#..*..(JbN..Dn..-...d.)i...m.=...i?t.k......{....~..y..l4j....4.7yw
..{..g.i.1..$.)@uDrK../...}..0q.R.h>.....q.`..j....S..G.[(..i...XX|
.....D..o....~Wx..Rh..^]6...O9...._.|...t...U.J...M..9.&.wo!.&.......Y
T.7.|f..i.E'c...d16.m)D.......O..kz..."...n.....U_....(.j.K........ _.
{..;.......0(T...F.&.7.O..7n..(....HTTP/1.1 200 OK..P3P: policyref="ht
tp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA
 IVD OTP OUR OTR IND OTC"..Content-Type: text/javascript; charset=UTF-
8..ETag: 14995889589159710514..Date: Wed, 20 May 2015 14:56:42 GMT..Ex
pires: Thu, 21 May 2015 14:56:42 GMT..X-Content-Type-Options: nosniff.
.Content-Disposition: attachment; filename="f.txt"..Content-Encoding: 
gzip..Server: cafe..Content-Length: 729..X-XSS-Protection: 1; mode=blo
ck..Age: 61251..Cache-Control: public, max-age=86400..Alternate-Protoc
ol: 80:quic,p=1.............UKO.@... ...Q..z.!..*.".=.zA(Z......v.v...
..].1.PT.9$.......(U..V.k..8...S7...G.y&.XfC.u.0..V..2.n)-,...s....JT2
.N...hNsT..*....qtusq....g0.X..][email protected].@.....'..uZ..:Gw^ ?
.m.2.8m.|..wpHG......up..48.7.tp r....1...._...Q..u....@..%....jn.
<<< skipped >>>

GET /pagead/images/abg/icon.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: image/png

ETag: 6766994032117382215

Date: Wed, 20 May 2015 14:21:18 GMT

Expires: Thu, 21 May 2015 14:21:18 GMT

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 344

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=86400

Age: 63375

Alternate-Protocol: 80:quic,p=1
.PNG........IHDR.............;..J....gAMA......a.....IDAT([email protected]..
......,l..;.....A....hPDD...`r..A....M..-.......UI...O.%.QB.[D......;.
nA....:..^S..].....].B0..mH]..I..f.F./.4H... .g...*....C...Q..T..]..B.
..8..0.....#....(...N.80\.t../.SA...i..O.N~2.B.t.....6..#.6.(.......w.
.... ....`..3.Q......md.A._.O.mC.L........}O"...........IEND.B`.>....


GET /pagead/images/google-logo.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: image/png

ETag: 13513653691308934734

Date: Wed, 20 May 2015 14:56:33 GMT

Expires: Thu, 21 May 2015 14:56:33 GMT

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 4114

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=86400

Age: 61260

Alternate-Protocol: 80:quic,p=1
.PNG........IHDR...j...$......t......IDATh..[.\SG.......Q ...*`D.r..E.
C.'...D..x"...Q.z..(...R.bD.r..T....e..6.Z/ /.w....~;.......Zw..g>$
/.f.w}.........cI.'.....58...X..}Yq....t..Z.....<(5....u..F......./
..g...........O.oHqL.a.E.6c..,......Z..M.U..>........".SE.I..H..n..
.)...w..O`...r...5..".H..u.$.:.P........\.8.L.Q..._....._..."fk..`?...
........~|J [email protected],.?.0. RX.Q;SS%.....s....n. ..{.'p.....< 
.z"..g`xr..Qw..5s.~s[...........4.... .Z{....(b_u..._..9o.b..M.li!bya.
.-.p.L..m 7..j1..o.y..g6.J.......B7\Fs..zM..}B.H(...j.4-.<i......Bc
n/....z..........x5C...@$......A..Xt...f`Z[.....g.......{`t.e...5_....
=.D....J..{X*7.PG;.m.`..K..KW......$.x...- .?\[.....}.....#.{..p......
\.E..g(!.I.wD........%.... x.~.-.Zj..\...r.%V.~.5......?q.. f...0[..o.
[email protected].......%o.0...2kyc.Z.u..#.H[..j.t...c.....<C...N..........
..G....xh*.%|~....... [email protected].>.....W.......`GG.*X.1..d.#..
...'[email protected];..q.NY.r.5....r..=.=f..@...')6H..&..
..##.o:..@{A3-.;.#.......F..e......u.|.k.F.2.....V# ..Q....C.@.....'..
.....x....I.^o......p..g.W.>.......C.ps......XU....._b.........f.p.
?Tk3l.4^...../.6q..l...VZ..<8...[...Q...,.f-..8r.7#..<7n_E<7.
O.a..0...=Q*!B.."...s.......SJLI... ..v...X.^'b.E..........Q......PZ..
..s..&....M...ve....7...5.,...x.^.F$....T...e.........%.....Q.........
.j.%N."...sX.....=....0......7.Q....fK.[O..?....~..!..........V.......
.LI.......2.P.... I.n..ymw_.. ..Q..zM.q...B%l.;..u..y..ta.L7..^h.e..{K
%x...r}....#.A.l.'.`...xP..d..},.(.\]..B[M....p...&.....).L...i"..
<<< skipped >>>

GET /hunter/alog/alog.min.js HTTP/1.1