Trojan.Win32.Delphi_7705d253d8

by malwarelabrobot on March 1st, 2016 in Malware Descriptions.

not-a-virus:AdWare.Win32.Agent.jkde (Kaspersky), Gen:Variant.Strictor.97737 (B) (Emsisoft), Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan, VirTool, Adware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 7705d253d8fe25432eebfa472e167ee3
SHA1: b7c87a571995ea5aab53794814a33fc1109a5a95
SHA256: 01154f5a765acff58326b7f9887007bf98a963362eba6f932cbe3fffa5ba45ac
SSDeep: 49152:KDWrFS/4lmaBW0qPDAJkVgndTXFk6OgDU8aDNw7Op2BpZ1SSEzmUgG:mGFJmaBybAmedTXu6T2xwSI7v pgG
Size: 2133392 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-09-14 10:10:15
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1332

The Trojan injects its code into the following process(es):

OKS.exe:916
picbus.exe:928
picview.exe:1064

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process picbus.exe:928 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xanimate[2].js (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\u=1875430050,2580979778&fm=76[1].jpg (8719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tongji5[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\details[1].css (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\web_avatar[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAAZOHCX.2281 (667 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mask[2].css (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\a[1].js (477 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAOD4PGZ.2172 (667 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\base[1].js (359 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\web_close[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\u=990497764,1232924695&fm=76[1].jpg (5851 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ie6_png[1].js (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\base[2].css (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gac[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VGX1.tmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\u=1315327375,467324658&fm=76[1].jpg (12718 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[2].js (414 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery-1.11.2.min[2].js (3251 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2988 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\17323[1].htm (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\640x107[1].png (1826 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\t00aa2[2].js (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mask[1].css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAMRQPAH.htm (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\640x107[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\autoscroll[2].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAZIQH3F.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\web_title[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\imgload[2].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hongbao[1].js (338 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CABIQ7VT.htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hongb[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\content[1].js (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yigao[1].txt (181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[1].js (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\u=3059151468,3543266969&fm=76[1].jpg (479 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VGX2.tmp (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\u=1516739037,2004201896&fm=76[1].jpg (10060 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\share_icons[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\content[2].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\m[1].js (9301 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\u=1856364587,2693382950&fm=76[1].jpg (13084 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CALRZP48.1891 (656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\u=1568043101,2080188669&fm=76[1].jpg (11912 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\details[1].css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qr_code[1].jpg (2476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\a[2].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\c[1].js (3559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VGX4.tmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAIDYDQH.htm (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\go[1].htm (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAMB0BF0.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&sz=300x250 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAVQ0FB1.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737392 (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\m[2].js (10413 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\autoscroll[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ewm[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\head[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gac[2].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ac_placeholder[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\share_icons[1].png (915 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\web_title[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\t00aa2[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery-1.11.2.min[1].js (2688 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\li_bg[1].png (2066 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\base[2].js (957 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\base[1].css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA0TQRST.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\c[2].js (3960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hongbao[2].js (329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\web_bg[1].gif (3890 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VGX3.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAAJO1UJ.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&sz=300x250 (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\DD_belatedPNG[2].js (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\li_bg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\imgload[1].js (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA9GAD1N.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737391 (863 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\DD_belatedPNG[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\u=728057772,766315808&fm=76[1].jpg (13117 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[2].txt (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\emar[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xanimate[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\g[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\btn_hidden[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\17323[1].html (1426 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\to_top_v2[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\excanvas[2].js (1276 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\excanvas[1].js (1322 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA0PUZCT.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&sz=300x250 (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mask[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\640x107[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAAJO1UJ.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&sz=300x250 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\autoscroll[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hongbao[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\li_bg[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\content[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\a[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\imgload[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\base[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\DD_belatedPNG[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CALRZP48.1891 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\share_icons[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\t00aa2[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery-1.11.2.min[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xanimate[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gac[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAOD4PGZ.2172 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\details[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\base[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\m[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\excanvas[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\c[1].js (0 bytes)

The process %original file name%.exe:1332 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\picview_201602291116\201602291116\data\WinFileMenu.xml (862 bytes)
%Program Files%\picview_201602291116\201602291116\data\WinOperMenu.xml (1 bytes)
%Program Files%\picview_201602291116\201602291116\data\6.ico (784 bytes)
%Program Files%\picview_201602291116\201602291116\data\0.ico (9 bytes)
%Program Files%\picview_201602291116\201602291116\data\1.ico (784 bytes)
%Program Files%\picview_201602291116\201602291116\data\window_btn_close.png (2 bytes)
%Program Files%\picview_201602291116\201602291116\data\window_popup.png (1 bytes)
%Program Files%\picview_201602291116\201602291116\data\9.ico (784 bytes)
%Program Files%\picview_201602291116\201602291116\DuiLib_u.dll (14184 bytes)
%Program Files%\picview_201602291116\201602291116\data\img.ico (9 bytes)
%Program Files%\picview_201602291116\201602291116\data\4.ico (784 bytes)
%Program Files%\picview_201602291116\201602291116\data\logo.png (2 bytes)
%Program Files%\picview_201602291116\201602291116\data\3.ico (784 bytes)
%Program Files%\picview_201602291116\201602291116\data\7.ico (784 bytes)
%Program Files%\picview_201602291116\201602291116\data\bar_btn.png (1 bytes)
%Program Files%\picview_201602291116\201602291116\data\btn_close1.png (2 bytes)
%Program Files%\picview_201602291116\201602291116\data\8.ico (784 bytes)
%Program Files%\picview_201602291116\201602291116\data\2.ico (784 bytes)
%Program Files%\picview_201602291116\201602291116\msvcr100.dll (25824 bytes)
%Program Files%\picview_201602291116\201602291116\data\popup_s.png (1 bytes)
%Program Files%\picview_201602291116\201602291116\data\WinMainFrame.xml (2 bytes)
%Program Files%\picview_201602291116\201602291116\data\window_btn_max.png (1 bytes)
%Program Files%\picview_201602291116\201602291116\OKS.exe (13368 bytes)
%Program Files%\picview_201602291116\201602291116\picview.exe (20416 bytes)
%Program Files%\picview_201602291116\201602291116\data\tongjiData.ini (168 bytes)
%Program Files%\picview_201602291116\201602291116\data\10.ico (784 bytes)
%Program Files%\picview_201602291116\201602291116\SysConfig.ini (59 bytes)
%Program Files%\picview_201602291116\201602291116\data\user2.ini (24 bytes)
%Program Files%\picview_201602291116\201602291116\data\bar_bg.png (1 bytes)
%Program Files%\picview_201602291116\201602291116\data\window_popup_pass.png (1 bytes)
%Program Files%\picview_201602291116\201602291116\data\11.ico (784 bytes)
%Program Files%\picview_201602291116\201602291116\data\FrmTrayMenu.xml (484 bytes)
%Program Files%\picview_201602291116\201602291116\TPSC.dll (6360 bytes)
%Program Files%\picview_201602291116\201602291116\data\window_btn_mini.png (1 bytes)
%Program Files%\picview_201602291116\201602291116\data\FrmAdvert.xml (185 bytes)
%Program Files%\picview_201602291116\201602291116\Unins.exe (16288 bytes)
%Program Files%\picview_201602291116\201602291116\msvcp100.dll (14184 bytes)
%Program Files%\picview_201602291116\201602291116\data\FrmTrayWebAD.xml (682 bytes)
%Program Files%\picview_201602291116\201602291116\picbus.exe (6360 bytes)
%Program Files%\picview_201602291116\201602291116\data\5.ico (784 bytes)
%Program Files%\picview_201602291116\201602291116\data\window_btn_default.png (1 bytes)

The process picview.exe:1064 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\c[2].swf (547 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index[1].html (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\blank_5307b88[1].png (949 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\oXMLStore[1].xml (106 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ac[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\head_0511e83[1].css (3821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (763 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\c[1].swf (547 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\oojs[1].js (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\room2014_z_4dae78b[1].png (43498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAMJWHAJ.html?s&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416 (902 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\roomFunction2014_dd2507b[1].js (2553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wh[4].js (4683 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\head_061c6e7[1].js (3445 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\o[1].htm (1394 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\room2014_72f51c4[1].css (6370 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\yellow_warn_0473de0[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\oojs[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fp[2].htm (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\roomInit_f54bbdd[1].js (22 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wh[1].js (5629 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\icon_original_95e3302[1].png (450 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\yellow_warn2_b8d73e7[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAS1YFKH.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\socket_48ba6f2[1].js (1649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tj4[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (6168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bd-logo5[1].png (1545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\loading[1].gif (875 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\room2014_z_4dae78b[1].png (29281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wh[3].js (2916 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\anticheat[2].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\o[1].swf (157 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAEJOXYR.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\20140827184515870962[1].jpg (21919 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\kg_6abcd20[1].js (2779 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\oojs[2].js (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\fp[2].htm (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\roomActivity_059de9b[1].js (1118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tj7[1].htm (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (763 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tongji3[1].htm (704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bd-logo5[1].png (1545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lab.min_c0c155c[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wh[2].js (4782 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fp[1].htm (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\roomFunction_a35552b[1].js (6437 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\video_6f4f75f[1].gif (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tongji2[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20151130161134_14413[1].flv (312425 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\oXMLStore[1].xml (106 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\footer_logo_16e645b[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA5OWN9L.html&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416 (902 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\o[1].htm (1394 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\kguser[1].js (2569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fla7.tmp (276056 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\DD_belatedPNG_79c3052[1].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ac[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\KgAck[1].js (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20151130161134_14413[2].flv (244346 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\CPROID[1].xml (310 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAI7G1AB.htm (1264 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tongji4[1].htm (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\blank[1].png (949 bytes)
%Documents and Settings%\%current user%\Desktop\图片查看器.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VGX5.tmp (137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\footer2_fd36cbe[1].png (3040 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tj2[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAGTURWD.htm (1264 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bg2013_2015_f530136[1].png (31813 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1028630[1].htm (55643 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\roombg_3eb04e4[1].png (30481 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (814 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fla6.tmp (215120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\o[1].swf (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\successIcon_754795c[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\template.min[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tj1[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\T1vgAyBXJb1RCvBVdK.jpg_85x85[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\template.min[2].css (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ac[2].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\roomBase_f6883f0[1].js (504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\fp[1].htm (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20150807142332126222[1].gif (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\18[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swfobject_dc734ee[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fx_loading_c785dd3[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\footer1_369dc54[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\0f000nTH6UlUciFfpq-CKs[1].swf (1803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bigScrollBg_8972341[1].jpg (2386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ac[1].js (1 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (406 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\template.min[3].css (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\0f000jioG2SODfD3KlS1j6[1].swf (1803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fxtpl_loading_c785dd3[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery.min_21c00b7[1].js (7330 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\template.min[2].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\anticheat[1].js (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ac[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wh[3].js (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\oXMLStore[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\template.min[2].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ac[2].js (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\c[1].swf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\oojs[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wh[2].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\oojs[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wh[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ac[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\o[1].swf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\template.min[2].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bd-logo5[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\anticheat[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\template.min[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20151130161134_14413[1].flv (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\room2014_z_4dae78b[1].png (0 bytes)

Registry activity

The process OKS.exe:916 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A9 46 77 BD C2 25 5D FB 36 D4 CB B5 CE 43 68 C6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process picbus.exe:928 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "picbus.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1442047107"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 4B F3 A9 B9 57 16 E4 BF 32 37 DC EC 63 18 D5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1332 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 C0 9C B2 BF 05 11 D3 D8 8C 77 3B 30 EC C3 13"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process picview.exe:1064 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\.bmp]
"(Default)" = "PicView.bmp"

[HKCU\Software\Classes\PicView.jpg]
"(Default)" = "PicView.jpg"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png]
"Progid" = "PicVi䱥聛"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Classes\PicView.jpeg]
"(Default)" = "PicView.jpeg"

[HKCU\Software\Classes\PicView.png\DefaultIcon]
"(Default)" = "%Program Files%\picview_201602291116\201602291116\Data\img.ico"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Classes\PicView.png]
"(Default)" = "PicView.png"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp]
"Progid" = "PicVie"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\.jpg]
"(Default)" = "PicView.jpg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Classes\PicView.jpg\DefaultIcon]
"(Default)" = "%Program Files%\picview_201602291116\201602291116\Data\img.ico"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
"Progid" = "PicVie"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
"Progid" = "PicVi聥"

[HKCU\Software\Classes\PicView.jpeg\Shell]
"(Default)" = "Open"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\PicView.jpg\Shell\Open\Command]
"(Default)" = "%Program Files%\picview_201602291116\201602291116\picview.exe %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Classes\PicView.png\Shell\Open]
"(Default)" = "使用图片查看器打开"

[HKCU\Software\Classes\PicView.jpeg\DefaultIcon]
"(Default)" = "%Program Files%\picview_201602291116\201602291116\Data\img.ico"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016022920160301]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Classes\.jpeg]
"(Default)" = "PicView.jpeg"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "picview.exe"

[HKCU\Software\Classes\PicView.jpeg\Shell\Open]
"(Default)" = "使用图片查看器打开"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\picview_201602291116\201602291116]
"picbus.exe" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Classes\PicView.bmp]
"(Default)" = "PicView.bmp"

[HKCU\Software\Classes\.png]
"(Default)" = "PicView.png"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg]
"Progid" = "PicVie"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\picview_201602291116\201602291116]
"OKS.exe" = "TPCKQ-1"

[HKCU\Software\Classes\PicView.jpeg\Shell\Open\Command]
"(Default)" = "%Program Files%\picview_201602291116\201602291116\picview.exe %1"

[HKCU\Software\Classes\PicView.jpg\Shell\Open]
"(Default)" = "使用图片查看器打开"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1442214472"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
"Progid" = "PicVie"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016022920160301]
"CachePrefix" = ":2016022920160301:"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F D7 96 B9 BC DA A5 5D 6E E5 D2 32 66 DB 82 44"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg]
"Progid" = "PicVie"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016022920160301]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016022920160301\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Classes\PicView.bmp\Shell]
"(Default)" = "Open"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Classes\PicView.jpg\Shell]
"(Default)" = "Open"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
"Progid" = "PicVie"

[HKCU\Software\Classes\PicView.png\Shell\Open\Command]
"(Default)" = "%Program Files%\picview_201602291116\201602291116\picview.exe %1"

[HKCU\Software\Classes\PicView.bmp\DefaultIcon]
"(Default)" = "%Program Files%\picview_201602291116\201602291116\Data\img.ico"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016022920160301]
"CacheRepair" = "0"

[HKCU\Software\Classes\PicView.bmp\Shell\Open\Command]
"(Default)" = "%Program Files%\picview_201602291116\201602291116\picview.exe %1"

[HKCU\Software\Classes\PicView.png\Shell]
"(Default)" = "Open"

[HKCU\Software\Classes\PicView.bmp\Shell\Open]
"(Default)" = "使用图片查看器打开"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016022920160301]
"CacheLimit" = "8192"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithProgids]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithProgids]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041520140416]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithProgids]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithProgids]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5 File path
38752b25c7704e54a3f311fd4a7071dd c:\Program Files\picview_201602291116\201602291116\DuiLib_u.dll
08a1ec669437b08272b181f0c11b986e c:\Program Files\picview_201602291116\201602291116\OKS.exe
682e6361651fe16d1b2a56ccf2e2e3b3 c:\Program Files\picview_201602291116\201602291116\TPSC.dll
c1343749f65d8c8d5aef532a21e0259c c:\Program Files\picview_201602291116\201602291116\Unins.exe
17b8f8501fbaecc8cb1451a7d066191b c:\Program Files\picview_201602291116\201602291116\msvcp100.dll
69069ca4029767927409eaf669778d07 c:\Program Files\picview_201602291116\201602291116\msvcr100.dll
9d23ec46fd72d180b7dfc2dcd2f86652 c:\Program Files\picview_201602291116\201602291116\picbus.exe
99110c8fc740befa3fae0951967a820a c:\Program Files\picview_201602291116\201602291116\picview.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: mspic
Product Version: 1.15.914.2
Legal Copyright: Copyright (C) 2015
Legal Trademarks:
Original Filename: mspic.exe
Internal Name: mspic.exe
File Version: 1.15.914.2
File Description: mspic ins
Comments:
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 76526 76800 4.58509 9bccf691b359e11f4ecbecdc8c97ed5d
.rdata 81920 22688 23040 3.35423 2e6426a1838c51792768d0608258b864
.data 106496 21380 5120 2.6724 c2474d593db577799383c3b357d06910
.rsrc 131072 2009784 2010112 5.46818 314691ff750e2df1a71c7136ae53f17c
.reloc 2142208 13342 13824 1.69757 d17705cfc4ff389bb009660ca1743e3e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://tongji.hiv-hiv.com/default/index.html?v=03AD446F3A574AFE0281630A166E51D7FAB141130AE0C8AAD6E453962939C4CD189605251DC32B837AF9D107201FD8A478B90BD175458A857845A26B90C627E59C5E41535A47A5C2E41FF1EA05222EDE 106.75.130.196
hxxp://update.163vv.com/tj2.ashx?v=1.15.914.2
hxxp://update.163vv.com/tj4.ashx?v=1.15.914.2
hxxp://update.163vv.com/tj1.ashx?v=1.15.914.2
hxxp://update.163vv.com/tj7.ashx?v=1.15.914.2
hxxp://tongji.hiv-hiv.com/api/tongji3 106.75.130.196
hxxp://tongji.hiv-hiv.com/api/tongji4?param=v1 106.75.130.196
hxxp://tongji.hiv-hiv.com/api/tongji5 106.75.130.196
hxxp://eurpo.b9.aicdn.com/article/kankan/go.html
hxxp://eurpo.b9.aicdn.com/article/a/201511/17323.html
hxxp://eurpo.b9.aicdn.com/css/base.css
hxxp://eurpo.b9.aicdn.com/css/details.css
hxxp://eurpo.b9.aicdn.com/css/mask.css
hxxp://eurpo.b9.aicdn.com/js/excanvas.js
hxxp://tongji.hiv-hiv.com/api/tongji2 106.75.130.196
hxxp://ecomcbjs.wshifen.com//js/m.js
hxxp://tongji.hiv-hiv.com/API/GetAdvConfig?param=v1 106.75.130.196
hxxp://eurpo.b9.aicdn.com/sc/gac.js
hxxp://eurpo.b9.aicdn.com/js/DD_belatedPNG.js
hxxp://eurpo.b9.aicdn.com/js/ie6_png.js
hxxp://eurpo.b9.aicdn.com/js/a.js?v=13
hxxp://eurpo.b9.aicdn.com/js/t00aa2.js
hxxp://eurpo.b9.aicdn.com/images/logo.jpg
hxxp://wmjs.wshifen.com/cpro/ui/c.js
hxxp://eurpo.b9.aicdn.com/images/ac_placeholder.jpg
hxxp://eurpo.b9.aicdn.com/images/640x107.png
hxxp://eurpo.b9.aicdn.com/images/share_icons.png
hxxp://cb.e.shifen.com/acom?di=1172330&dri=0&dis=0&dai=1&ps=794x288&dcb=BAIDU_SSP_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x896&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://www.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737392
hxxp://cb.e.shifen.com/acom?di=u2480739&dri=0&dis=0&dai=1&ps=74x308&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x896&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://www.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737391
hxxp://js.union001.com/PClick.aspx?AID=19948&KEY=AF54BBD2867C2DE15DDD9A452A155309CABFB4C7433B7CCA3F16B8C72F291D02
hxxp://cb.e.shifen.com/acom?di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://www.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&sz=300x250
hxxp://eurpo.b9.aicdn.com/images/li_bg.png
hxxp://cb.e.shifen.com/acom?di=u2355460&dri=0&dis=0&dai=3&ps=1233x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://www.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&sz=300x250
hxxp://eurpo.b9.aicdn.com/images/btn_hidden.jpg
hxxp://eurpo.b9.aicdn.com/images/qr_code.jpg
hxxp://eurpo.b9.aicdn.com/images/ewm.jpg
hxxp://eurpo.b9.aicdn.com/images/hongb.gif
hxxp://eurpo.b9.aicdn.com/js/b.js
hxxp://eurpo.b9.aicdn.com/images/g.png
hxxp://eurpo.b9.aicdn.com/images/web_title.png
hxxp://eurpo.b9.aicdn.com/images/to_top_v2.jpg
hxxp://eurpo.b9.aicdn.com/images/web_title.gif
hxxp://eurpo.b9.aicdn.com/images/head.jpg
hxxp://eurpo.b9.aicdn.com/images/web_avatar.jpg
hxxp://cb.e.shifen.com/acom?rdid=2480739&dc=2&di=u2480739&dri=0&dis=0&dai=1&ps=74x308&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x896&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://www.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737391&qn=bc8e12d50064a9a9&tt=1456737391050.438.1891.1891
hxxp://eurpo.b9.aicdn.com/images/web_close.jpg
hxxp://eurpo.b9.aicdn.com/js/jquery-1.11.2.min.js
hxxp://eurpo.b9.aicdn.com/images/web_bg.gif
hxxp://cb.e.shifen.com/acom?sz=300x250&rdid=2355443&dc=2&di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://www.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=02ff9997d2308bbb&tt=1456737391050.1781.2172.2172
hxxp://eurpo.b9.aicdn.com/js/imgload.js
hxxp://kgnop1.kugou.com/room/qidiancpm?sUnionId=17614
hxxp://eurpo.b9.aicdn.com/js/base.js
hxxp://eurpo.b9.aicdn.com/js/autoscroll.js
hxxp://eurpo.b9.aicdn.com/js/xanimate.js
hxxp://cbjslog.e.shifen.com/log?type=ssplog&id=-1&error=responseEmpty&status=renderFail&async=-1&from=ssp&tm=1456737392722&.stamp=0.5117792924746438
hxxp://eurpo.b9.aicdn.com/js/content.js
hxxp://cb.e.shifen.com/acom?sz=300x250&rdid=2355460&dc=2&di=u2355460&dri=0&dis=0&dai=3&ps=1233x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://www.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=3a3da2ebe2e4ff2e&tt=1456737391050.1875.2281.2281
hxxp://eurpo.b9.aicdn.com/js/hongbao.js
hxxp://eurpo.b9.aicdn.com/js/jquery.pin.min.js
hxxp://gpla1.wac.v2cdn.net/1028630
hxxp://wmjs.wshifen.com/cpro/ui/noexpire/css/2.0.1/template.min.css
hxxp://wmjs.wshifen.com/cpro/ui/noexpire/js/2.0.1/oojs.js
hxxp://wn.pos.e.shifen.com/adx.php?c=d25pZD05ZWY5YzM2OGY2ODVmYjM2AHM9OWVmOWMzNjhmNjg1ZmIzNgB0PTE0NTY3Mzc1MDQAc2U9MQBidT00AHByaWNlPVZ0UU00QUFBMFNwN2pFcGdXNUlBOHFzVHlnTWZuTTdtb0JoMWRBAGNoYXJnZV9wcmljZT0xAHNoYXJpbmdfcHJpY2U9MTAwMAB3aW5fZHNwPTQAY2htZD0xAGJkaWQ9NzUyMjQzMzE5NEUxNDgzQkU0MEFBMTlCQzMxQ0ZBQ0YAY3Byb2lkPQBiY2htZD0wAHY9MQBpPTAyNWFlZjY1
hxxp://wn.pos.e.shifen.com/adx.php?c=d25pZD00ZmM0YzU2NzA0NmIwODdjAHM9NGZjNGM1NjcwNDZiMDg3YwB0PTE0NTY3Mzc1MDMAc2U9MQBidT01AHByaWNlPVZ0UU0zd0FPUDlON2pFcGdXNUlBOHVETGcyMlhzaG01MmpFWmJRAGNoYXJnZV9wcmljZT0xAHNoYXJpbmdfcHJpY2U9MTAwMAB3aW5fZHNwPTUAY2htZD0xAGJkaWQ9NzUyMjQzMzE5NEUxNDgzQkU0MEFBMTlCQzMxQ0ZBQ0YAY3Byb2lkPQBiY2htZD0wAHY9MQBpPTJmMGNiODFj
hxxp://cm.yigao.com/sspcm/cm?dsp_id=100692&dsp_uid=0 118.26.150.149
hxxp://t1.n.shifen.com/it/u=1516739037,2004201896&fm=76
hxxp://t1.n.shifen.com/it/u=3059151468,3543266969&fm=76
hxxp://t1.n.shifen.com/it/u=1568043101,2080188669&fm=76
hxxp://t1.n.shifen.com/it/u=1315327375,467324658&fm=76
hxxp://t1.n.shifen.com/it/u=1856364587,2693382950&fm=76
hxxp://t1.n.shifen.com/it/u=990497764,1232924695&fm=76
hxxp://kgnop-ssl.kugou.com/v1/kguser.js
hxxp://cm.pos.e.shifen.com/emar?yguid=61b5dd9346a5421099a85a5027961cfc&ver=1
hxxp://t1.n.shifen.com/it/u=728057772,766315808&fm=76
hxxp://t1.n.shifen.com/it/u=1875430050,2580979778&fm=76
hxxp://serveraddr.serviceweb.kugou.com/KgAck.js 42.62.68.44
hxxp://kgnop1.kugou.com/staticPub/css/common/head_0511e83.css
hxxp://kgnop1.kugou.com/fxstatic/images/yellow_warn_0473de0.png
hxxp://kgnop1.kugou.com/fxstatic/images/yellow_warn2_b8d73e7.png
hxxp://kgnop1.kugou.com/staticPub/css/room/room2014_72f51c4.css
hxxp://kgnop1.kugou.com/fxstatic/images/starLevel/pc/18.png
hxxp://kgnop1.kugou.com/fxstatic/images/sprite/css/room/room2014_z_4dae78b.png
hxxp://kgnop1.kugou.com/fxroombg/20140827184515870962.jpg
hxxp://kgnop1.kugou.com/fxstatic/images/userfile/successIcon_754795c.png
hxxp://kgnop1.kugou.com/fxstatic/images/room/2014/bigScrollBg_8972341.jpg
hxxp://kgnop1.kugou.com/v2/fxuserlogo/T1vgAyBXJb1RCvBVdK.jpg_85x85.jpg
hxxp://kgnop1.kugou.com/staticPub/js/lab.min_c0c155c.js
hxxp://kgnop1.kugou.com/fxstatic/images/blank_5307b88.png
hxxp://kgnop1.kugou.com/clanBadge/20150807/20150807142332126222.gif
hxxp://kgnop1.kugou.com/fxstatic/images/blank.png
hxxp://kgnop1.kugou.com/fxstatic/images/footer1_369dc54.png
hxxp://kgnop1.kugou.com/fxstatic/images/fx_loading_c785dd3.gif
hxxp://kgnop1.kugou.com/staticPub/js/lib/kg_6abcd20.js
hxxp://kgnop1.kugou.com/staticPub/js/DD_belatedPNG_79c3052.js
hxxp://kgnop1.kugou.com/fxstatic/images/room/2014/icon_original_95e3302.png
hxxp://kgnop1.kugou.com/fxstatic/images/footer2_fd36cbe.png
hxxp://kgnop1.kugou.com/fxstatic/images/footer_logo_16e645b.gif
hxxp://kgnop1.kugou.com/fxstatic/images/bg2013_2015_f530136.png
hxxp://kgnop1.kugou.com/staticPub/js/room/swfobject_dc734ee.js
hxxp://kgnop1.kugou.com/staticPub/js/lib/jquery.min_21c00b7.js
hxxp://kgnop1.kugou.com/fxstatic/images/loading.gif
hxxp://kgnop1.kugou.com/staticPub/js/room/roomBase_f6883f0.js
hxxp://kgnop1.kugou.com/staticPub/js/room/socket_48ba6f2.js
hxxp://kgnop1.kugou.com/staticPub/js/head_061c6e7.js
hxxp://kgnop1.kugou.com/staticPub/js/room/roomFunction_a35552b.js
hxxp://kgnop1.kugou.com/staticPub/js/room/roomFunction2014_dd2507b.js
hxxp://kgnop1.kugou.com/fxstatic/images/roombg_3eb04e4.png
hxxp://kgnop1.kugou.com/staticPub/js/room/roomActivity_059de9b.js
hxxp://kgnop1.kugou.com/staticPub/js/room/roomInit_f54bbdd.js
hxxp://kgnop1.kugou.com/fxstatic/images/room/video_6f4f75f.gif?333
hxxp://kgnop1.kugou.com/fxstatic/images/fxtpl_loading_c785dd3.gif
hxxp://eurpo.b9.aicdn.com/gg/huyan.html
hxxp://eurpo.b9.aicdn.com/gg/huyan.html?s
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=1254817266
hxxp://oz.cnzz.com/stat.htm?id=1254817266&r=&lg=en-us&ntime=1456732646&cnzz_eid=223312916-1456732646-&showp=1276x846&t=&h=1&rnd=411469173 198.11.132.200
hxxp://oz.cnzz.com/stat.htm?id=1254817266&r=&lg=en-us&ntime=none&cnzz_eid=223312916-1456732646-&showp=1276x846&t=&h=1&rnd=289534767 198.11.132.200
hxxp://cb.e.shifen.com/acom?di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415659&ari=1&dbv=0&drs=3&pcs=296x249&pss=300x253&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983&ltu=http://show.bianya.cc/gg/huyan.html&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=1254817266&t=z
hxxp://cb.e.shifen.com/acom?di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415691&ari=1&dbv=0&drs=3&pcs=300x250&pss=300x250&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983&ltu=http://show.bianya.cc/gg/huyan.html?s&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416
hxxp://cb.e.shifen.com/wh/o.htm?ltr=
hxxp://cb.e.shifen.com/acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415659&ari=1&dbv=0&drs=3&pcs=296x249&pss=300x253&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983&ltu=http://show.bianya.cc/gg/huyan.html&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416&qn=2f8bbc640f2a4043&tt=1456737415628.141.1360.1360
hxxp://cb.e.shifen.com/acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415691&ari=1&dbv=0&drs=3&pcs=300x250&pss=300x250&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983&ltu=http://show.bianya.cc/gg/huyan.html?s&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416&qn=ee6118cd6aef5aef&tt=1456737415675.94.1344.1344
hxxp://ecomcbjs.wshifen.com/tpl/wh.js
hxxp://wn.pos.e.shifen.com/adx.php?c=d25pZD1jY2Y4YjJiYmYyYzQxYTVhAHM9Y2NmOGIyYmJmMmM0MWE1YQB0PTE0NTY3Mzc1MjgAc2U9MQBidT01AHByaWNlPVZ0UU0tQUFFYkNCN2pFcGdXNUlBOGh0MWtkekdpb2V5enR4UGV3AGNoYXJnZV9wcmljZT0yMjkAc2hhcmluZ19wcmljZT0yMjkwMDAAd2luX2RzcD01AGNobWQ9MQBiZGlkPTc1MjI0MzMxOTRFMTQ4M0JFNDBBQTE5QkMzMUNGQUNGAGNwcm9pZD0AYmNobWQ9MAB2PTEAaT1mNmNlMTgzMQ
hxxp://wn.pos.e.shifen.com/adx.php?c=d25pZD1lNzg3ZTEyNWUwMWE4YzZiAHM9ZTc4N2UxMjVlMDFhOGM2YgB0PTE0NTY3Mzc1MjgAc2U9MQBidT01AHByaWNlPVZ0UU0tQUFFVHI1N2pFcGdXNUlBOHA4OVNDM2JCVHc1c2l3TkxBAGNoYXJnZV9wcmljZT0xNDIAc2hhcmluZ19wcmljZT0xNDIwMDAAd2luX2RzcD01AGNobWQ9MQBiZGlkPTc1MjI0MzMxOTRFMTQ4M0JFNDBBQTE5QkMzMUNGQUNGAGNwcm9pZD0AYmNobWQ9MAB2PTEAaT1jOTJjMDliOQ
hxxp://cb.e.shifen.com/wh/c.swf?v=3
hxxp://cb.e.shifen.com/wh/o.swf?v=1
hxxp://ecomcbjs.wshifen.com/tpl/ac.js
hxxp://wmjs.wshifen.com/cpro/ui/noexpire/img/2.0.0/bd-logo5.png
hxxp://wmpic.wshifen.com/media/v1/0f000jioG2SODfD3KlS1j6.swf
hxxp://wmpic.wshifen.com/media/v1/0f000nTH6UlUciFfpq-CKs.swf
hxxp://eclick.e.shifen.com/fp.htm?br=6&fp=DA5E4CCCE874547210C07EDF3C9427B9&fp2=DA5E4CCCE874547210C07EDF3C9427B9&ci=&bi=7522433194E1483BE40AA19BC31CFACF:FG=1&im=0&wf=1&ct=1000&bp=&m=&t=0&ft=&_=1456737420394
hxxp://wmjs.wshifen.com/cpro/ui/noexpire/js/rs/business/anticheat.js?v=1.0.0
hxxp://eclick.e.shifen.com/fp.htm?br=6&fp=DA5E4CCCE874547210C07EDF3C9427B9&fp2=DA5E4CCCE874547210C07EDF3C9427B9&ci=&bi=7522433194E1483BE40AA19BC31CFACF:FG=1&im=0&wf=1&ct=1797&bp=&m=&t=0&ft=&_=1456737421128
hxxp://eclick.e.shifen.com/fp.htm?ci=7522433194E1483BE40AA19BC31CFACF:FG=1&cn=7522433194E1483BE40AA19BC31CFACF:FG=1&cu=&cl=&cf=&ce=&ff=c&cuid=&cuid2=&de=&bp=&nip=&_=1456737421206
hxxp://eclick.e.shifen.com/fp.htm?ci=7522433194E1483BE40AA19BC31CFACF:FG=1&cn=7522433194E1483BE40AA19BC31CFACF:FG=1&cu=7522433194E1483BE40AA19BC31CFACF:FG=1&cl=&cf=&ce=&ff=c&cuid=&cuid2=&de=&bp=&nip=&_=1456737421894
hxxp://youzu.xdwscache.ourglb0.net/usr/uploads/201511/20151130161134_14413.flv
hxxp://t10.baidu.com/it/u=1516739037,2004201896&fm=76 180.97.33.30
hxxp://t12.baidu.com/it/u=1568043101,2080188669&fm=76 180.97.33.30
hxxp://r221.fafala123.com/js/a.js?v=13 193.240.182.34
hxxp://r221.fafala123.com/css/base.css 193.240.182.34
hxxp://r221.fafala123.com/images/web_title.gif 193.240.182.34
hxxp://s4.fx.kgimg.com/staticPub/js/DD_belatedPNG_79c3052.js 112.90.229.29
hxxp://s3.fx.kgimg.com/clanBadge/20150807/20150807142332126222.gif 112.90.228.6
hxxp://r221.fafala123.com/js/content.js 193.240.182.34
hxxp://r221.fafala123.com/js/imgload.js 193.240.182.34
hxxp://r221.fafala123.com/images/web_avatar.jpg 193.240.182.34
hxxp://s4.fx.kgimg.com/staticPub/js/lab.min_c0c155c.js 112.90.229.29
hxxp://r221.fafala123.com/js/excanvas.js 193.240.182.34
hxxp://cpro.baidustatic.com/cpro/ui/c.js
hxxp://updatever.hiv-hiv.com/tj1.ashx?v=1.15.914.2 114.119.41.118
hxxp://t12.baidu.com/it/u=1856364587,2693382950&fm=76 180.97.33.30
hxxp://dup.baidustatic.com/tpl/wh.js
hxxp://r221.fafala123.com/images/to_top_v2.jpg 193.240.182.34
hxxp://s4.fx.kgimg.com/staticPub/js/room/roomInit_f54bbdd.js 112.90.229.29
hxxp://s2.fx.kgimg.com/fxstatic/images/userfile/successIcon_754795c.png 112.90.229.29
hxxp://s4.fx.kgimg.com/staticPub/js/room/roomActivity_059de9b.js 112.90.229.29
hxxp://pos.baidu.com/acom?di=1172330&dri=0&dis=0&dai=1&ps=794x288&dcb=BAIDU_SSP_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x896&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://www.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737392 115.239.210.141
hxxp://dup.baidustatic.com/tpl/ac.js
hxxp://r221.fafala123.com/images/hongb.gif 193.240.182.34
hxxp://360.rbc.cn/PClick.aspx?AID=19948&KEY=AF54BBD2867C2DE15DDD9A452A155309CABFB4C7433B7CCA3F16B8C72F291D02 115.238.73.171
hxxp://updatever.hiv-hiv.com/tj7.ashx?v=1.15.914.2 114.119.41.118
hxxp://t10.baidu.com/it/u=728057772,766315808&fm=76 180.97.33.30
hxxp://pos.baidu.com/acom?di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415659&ari=1&dbv=0&drs=3&pcs=296x249&pss=300x253&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983&ltu=http://show.bianya.cc/gg/huyan.html&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416 115.239.210.141
hxxp://s1.fx.kgimg.com/fxstatic/images/fxtpl_loading_c785dd3.gif 112.90.228.7
hxxp://r221.fafala123.com/css/mask.css 193.240.182.34
hxxp://r221.fafala123.com/js/hongbao.js 193.240.182.34
hxxp://t10.baidu.com/it/u=1875430050,2580979778&fm=76 180.97.33.30
hxxp://s2.fx.kgimg.com/fxstatic/images/yellow_warn2_b8d73e7.png 112.90.229.29
hxxp://s5.fx.kgimg.com/staticPub/css/common/head_0511e83.css 112.90.228.6
hxxp://s2.fx.kgimg.com/fxstatic/images/footer_logo_16e645b.gif 112.90.229.29
hxxp://r221.fafala123.com/js/jquery-1.11.2.min.js 193.240.182.34
hxxp://s4.fx.kgimg.com/staticPub/js/room/roomFunction2014_dd2507b.js 112.90.229.29
hxxp://pos.baidu.com/acom?di=u2480739&dri=0&dis=0&dai=1&ps=74x308&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x896&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://www.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737391 115.239.210.141
hxxp://ubmcmm.baidustatic.com/media/v1/0f000nTH6UlUciFfpq-CKs.swf
hxxp://r221.fafala123.com/images/qr_code.jpg 193.240.182.34
hxxp://eclick.baidu.com/fp.htm?ci=7522433194E1483BE40AA19BC31CFACF:FG=1&cn=7522433194E1483BE40AA19BC31CFACF:FG=1&cu=&cl=&cf=&ce=&ff=c&cuid=&cuid2=&de=&bp=&nip=&_=1456737421206 123.125.115.164
hxxp://www.fafala123.com/article/a/201511/17323.html 193.240.182.34
hxxp://r221.fafala123.com/js/DD_belatedPNG.js 193.240.182.34
hxxp://r221.fafala123.com/js/xanimate.js 193.240.182.34
hxxp://s3.fx.kgimg.com/fxstatic/images/room/2014/icon_original_95e3302.png 112.90.228.6
hxxp://cm.pos.baidu.com/emar?yguid=61b5dd9346a5421099a85a5027961cfc&ver=1 61.135.185.179
hxxp://r221.fafala123.com/js/b.js 193.240.182.34
hxxp://updatever.hiv-hiv.com/tj2.ashx?v=1.15.914.2 114.119.41.118
hxxp://eclick.baidu.com/fp.htm?ci=7522433194E1483BE40AA19BC31CFACF:FG=1&cn=7522433194E1483BE40AA19BC31CFACF:FG=1&cu=7522433194E1483BE40AA19BC31CFACF:FG=1&cl=&cf=&ce=&ff=c&cuid=&cuid2=&de=&bp=&nip=&_=1456737421894 123.125.115.164
hxxp://r221.fafala123.com/images/ac_placeholder.jpg 193.240.182.34
hxxp://t10.baidu.com/it/u=3059151468,3543266969&fm=76 180.97.33.30
hxxp://r221.fafala123.com/images/btn_hidden.jpg 193.240.182.34
hxxp://r221.fafala123.com/images/web_title.png 193.240.182.34
hxxp://s4.fx.kgimg.com/staticPub/js/room/socket_48ba6f2.js 112.90.229.29
hxxp://wn.pos.baidu.com/adx.php?c=d25pZD1jY2Y4YjJiYmYyYzQxYTVhAHM9Y2NmOGIyYmJmMmM0MWE1YQB0PTE0NTY3Mzc1MjgAc2U9MQBidT01AHByaWNlPVZ0UU0tQUFFYkNCN2pFcGdXNUlBOGh0MWtkekdpb2V5enR4UGV3AGNoYXJnZV9wcmljZT0yMjkAc2hhcmluZ19wcmljZT0yMjkwMDAAd2luX2RzcD01AGNobWQ9MQBiZGlkPTc1MjI0MzMxOTRFMTQ4M0JFNDBBQTE5QkMzMUNGQUNGAGNwcm9pZD0AYmNobWQ9MAB2PTEAaT1mNmNlMTgzMQ 180.149.131.90
hxxp://pos.baidu.com/acom?rdid=2480739&dc=2&di=u2480739&dri=0&dis=0&dai=1&ps=74x308&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x896&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://www.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737391&qn=bc8e12d50064a9a9&tt=1456737391050.438.1891.1891 115.239.210.141
hxxp://static.flv.uuzuonline.com/usr/uploads/201511/20151130161134_14413.flv 87.245.198.83
hxxp://wn.pos.baidu.com/adx.php?c=d25pZD05ZWY5YzM2OGY2ODVmYjM2AHM9OWVmOWMzNjhmNjg1ZmIzNgB0PTE0NTY3Mzc1MDQAc2U9MQBidT00AHByaWNlPVZ0UU00QUFBMFNwN2pFcGdXNUlBOHFzVHlnTWZuTTdtb0JoMWRBAGNoYXJnZV9wcmljZT0xAHNoYXJpbmdfcHJpY2U9MTAwMAB3aW5fZHNwPTQAY2htZD0xAGJkaWQ9NzUyMjQzMzE5NEUxNDgzQkU0MEFBMTlCQzMxQ0ZBQ0YAY3Byb2lkPQBiY2htZD0wAHY9MQBpPTAyNWFlZjY1 180.149.131.90
hxxp://r221.fafala123.com/js/jquery.pin.min.js 193.240.182.34
hxxp://pos.baidu.com/acom?di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415691&ari=1&dbv=0&drs=3&pcs=300x250&pss=300x250&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983&ltu=http://show.bianya.cc/gg/huyan.html?s&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416 115.239.210.141
hxxp://s5.fx.kgimg.com/staticPub/css/room/room2014_72f51c4.css 112.90.228.6
hxxp://wn.pos.baidu.com/adx.php?c=d25pZD1lNzg3ZTEyNWUwMWE4YzZiAHM9ZTc4N2UxMjVlMDFhOGM2YgB0PTE0NTY3Mzc1MjgAc2U9MQBidT01AHByaWNlPVZ0UU0tQUFFVHI1N2pFcGdXNUlBOHA4OVNDM2JCVHc1c2l3TkxBAGNoYXJnZV9wcmljZT0xNDIAc2hhcmluZ19wcmljZT0xNDIwMDAAd2luX2RzcD01AGNobWQ9MQBiZGlkPTc1MjI0MzMxOTRFMTQ4M0JFNDBBQTE5QkMzMUNGQUNGAGNwcm9pZD0AYmNobWQ9MAB2PTEAaT1jOTJjMDliOQ 180.149.131.90
hxxp://eclick.baidu.com/fp.htm?br=6&fp=DA5E4CCCE874547210C07EDF3C9427B9&fp2=DA5E4CCCE874547210C07EDF3C9427B9&ci=&bi=7522433194E1483BE40AA19BC31CFACF:FG=1&im=0&wf=1&ct=1000&bp=&m=&t=0&ft=&_=1456737420394 123.125.115.164
hxxp://www.fafala123.com/article/kankan/go.html 193.240.182.34
hxxp://r221.fafala123.com/css/details.css 193.240.182.34
hxxp://show.bianya.cc/gg/huyan.html?s 193.240.182.34
hxxp://ubmcmm.baidustatic.com/media/v1/0f000jioG2SODfD3KlS1j6.swf
hxxp://cbjs.baidu.com//js/m.js
hxxp://t11.baidu.com/it/u=1315327375,467324658&fm=76 180.97.33.30
hxxp://s2.fx.kgimg.com/fxstatic/images/blank_5307b88.png 112.90.229.29
hxxp://tc.hiv-hiv.com/api/tongji4?param=v1 106.75.130.196
hxxp://s2.fx.kgimg.com/fxstatic/images/fx_loading_c785dd3.gif 112.90.229.29
hxxp://pos.baidu.com/wh/o.swf?v=1 115.239.210.141
hxxp://as.hiv-hiv.com/API/GetAdvConfig?param=v1 106.75.130.196
hxxp://s4.fx.kgimg.com/staticPub/js/room/swfobject_dc734ee.js 112.90.229.29
hxxp://r221.fafala123.com/images/head.jpg 193.240.182.34
hxxp://cpro.baidustatic.com/cpro/ui/noexpire/js/2.0.1/oojs.js
hxxp://s3.fx.kgimg.com/fxstatic/images/footer2_fd36cbe.png 112.90.228.6
hxxp://load.hiv-hiv.com/api/tongji2 106.75.130.196
hxxp://pos.baidu.com/wh/o.htm?ltr= 115.239.210.141
hxxp://s1.fx.kgimg.com/fxstatic/images/room/video_6f4f75f.gif?333 112.90.228.7
hxxp://r221.fafala123.com/js/base.js 193.240.182.34
hxxp://s4.fx.kgimg.com/staticPub/js/head_061c6e7.js 112.90.229.29
hxxp://cbjslog.baidu.com/log?type=ssplog&id=-1&error=responseEmpty&status=renderFail&async=-1&from=ssp&tm=1456737392722&.stamp=0.5117792924746438 123.125.112.62
hxxp://r221.fafala123.com/images/share_icons.png 193.240.182.34
hxxp://c.cnzz.com/core.php?web_id=1254817266&t=z 188.254.86.249
hxxp://pos.baidu.com/acom?di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://www.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&sz=300x250 115.239.210.141
hxxp://asad.lczchina.com/api/tongji5 106.75.130.196
hxxp://s1.fx.kgimg.com/fxstatic/images/yellow_warn_0473de0.png 112.90.228.7
hxxp://s1.fx.kgimg.com/fxstatic/images/bg2013_2015_f530136.png 112.90.228.7
hxxp://s3.fx.kgimg.com/fxstatic/images/blank.png 112.90.228.6
hxxp://cpro.baidustatic.com/cpro/ui/noexpire/js/rs/business/anticheat.js?v=1.0.0
hxxp://pos.baidu.com/acom?di=u2355460&dri=0&dis=0&dai=3&ps=1233x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://www.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&sz=300x250 115.239.210.141
hxxp://r221.fafala123.com/js/autoscroll.js 193.240.182.34
hxxp://s4.fx.kgimg.com/staticPub/js/lib/kg_6abcd20.js 112.90.229.29
hxxp://t11.baidu.com/it/u=990497764,1232924695&fm=76 180.97.33.30
hxxp://s3.fx.kgimg.com/fxroombg/20140827184515870962.jpg 112.90.228.6
hxxp://eclick.baidu.com/fp.htm?br=6&fp=DA5E4CCCE874547210C07EDF3C9427B9&fp2=DA5E4CCCE874547210C07EDF3C9427B9&ci=&bi=7522433194E1483BE40AA19BC31CFACF:FG=1&im=0&wf=1&ct=1797&bp=&m=&t=0&ft=&_=1456737421128 123.125.115.164
hxxp://r221.fafala123.com/js/t00aa2.js 193.240.182.34
hxxp://s95.cnzz.com/stat.php?id=1254817266 1.99.192.16
hxxp://wn.pos.baidu.com/adx.php?c=d25pZD00ZmM0YzU2NzA0NmIwODdjAHM9NGZjNGM1NjcwNDZiMDg3YwB0PTE0NTY3Mzc1MDMAc2U9MQBidT01AHByaWNlPVZ0UU0zd0FPUDlON2pFcGdXNUlBOHVETGcyMlhzaG01MmpFWmJRAGNoYXJnZV9wcmljZT0xAHNoYXJpbmdfcHJpY2U9MTAwMAB3aW5fZHNwPTUAY2htZD0xAGJkaWQ9NzUyMjQzMzE5NEUxNDgzQkU0MEFBMTlCQzMxQ0ZBQ0YAY3Byb2lkPQBiY2htZD0wAHY9MQBpPTJmMGNiODFj 180.149.131.90
hxxp://pos.baidu.com/acom?sz=300x250&rdid=2355460&dc=2&di=u2355460&dri=0&dis=0&dai=3&ps=1233x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://www.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=3a3da2ebe2e4ff2e&tt=1456737391050.1875.2281.2281 115.239.210.141
hxxp://pos.baidu.com/acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415659&ari=1&dbv=0&drs=3&pcs=296x249&pss=300x253&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983&ltu=http://show.bianya.cc/gg/huyan.html&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416&qn=2f8bbc640f2a4043&tt=1456737415628.141.1360.1360 115.239.210.141
hxxp://channel.fanxing.kugou.com/room/qidiancpm?sUnionId=17614 112.90.228.7
hxxp://pos.baidu.com/wh/c.swf?v=3 115.239.210.141
hxxp://s4.fx.kgimg.com/staticPub/js/lib/jquery.min_21c00b7.js 112.90.229.29
hxxp://s1.fx.kgimg.com/fxstatic/images/roombg_3eb04e4.png 112.90.228.7
hxxp://p3.fx.kgimg.com/v2/fxuserlogo/T1vgAyBXJb1RCvBVdK.jpg_85x85.jpg 112.90.229.29
hxxp://login-user.kugou.com/v1/kguser.js 42.62.59.194
hxxp://r221.fafala123.com/images/web_bg.gif 193.240.182.34
hxxp://r221.fafala123.com/sc/gac.js 193.240.182.34
hxxp://s1.fx.kgimg.com/fxstatic/images/room/2014/bigScrollBg_8972341.jpg 112.90.228.7
hxxp://r221.fafala123.com/images/logo.jpg 193.240.182.34
hxxp://s4.fx.kgimg.com/staticPub/js/room/roomFunction_a35552b.js 112.90.229.29
hxxp://s1.fx.kgimg.com/fxstatic/images/sprite/css/room/room2014_z_4dae78b.png 112.90.228.7
hxxp://pos.baidu.com/acom?sz=300x250&rdid=2355443&dc=2&di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://www.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=02ff9997d2308bbb&tt=1456737391050.1781.2172.2172 115.239.210.141
hxxp://s2.fx.kgimg.com/fxstatic/images/footer1_369dc54.png 112.90.229.29
hxxp://show.bianya.cc/gg/huyan.html 193.240.182.34
hxxp://r221.fafala123.com/js/ie6_png.js 193.240.182.34
hxxp://r221.fafala123.com/images/g.png 193.240.182.34
hxxp://sd.hiv-hiv.com/api/tongji3 106.75.130.196
hxxp://cpro.baidustatic.com/cpro/ui/noexpire/css/2.0.1/template.min.css
hxxp://r221.fafala123.com/images/web_close.jpg 193.240.182.34
hxxp://pos.baidu.com/acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415691&ari=1&dbv=0&drs=3&pcs=300x250&pss=300x250&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983&ltu=http://show.bianya.cc/gg/huyan.html?s&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416&qn=ee6118cd6aef5aef&tt=1456737415675.94.1344.1344 115.239.210.141
hxxp://r221.fafala123.com/images/ewm.jpg 193.240.182.34
hxxp://r221.fafala123.com/images/640x107.png 193.240.182.34
hxxp://updatever.hiv-hiv.com/tj4.ashx?v=1.15.914.2 114.119.41.118
hxxp://s3.fx.kgimg.com/fxstatic/images/starLevel/pc/18.png 112.90.228.6
hxxp://fanxing.kugou.com/1028630 93.184.220.20
hxxp://s4.fx.kgimg.com/staticPub/js/room/roomBase_f6883f0.js 112.90.229.29
hxxp://s3.fx.kgimg.com/fxstatic/images/loading.gif 112.90.228.6
hxxp://r221.fafala123.com/images/li_bg.png 193.240.182.34
hxxp://cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5.png


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Outdated Windows Flash Version IE

Traffic

GET /fxstatic/images/bg2013_2015_f530136.png HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:33 GMT
Content-Type: image/png
Content-Length: 104196
Keep-Alive: timeout=20
Last-Modified: Sat, 30 Jan 2016 15:11:52 GMT
Expires: Mon, 14 Mar 2016 13:16:22 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-40
Kugou-Memory: HIT
Accept-Ranges: bytes
Connection: close
.PNG........IHDR............. .......tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:B6888B7301A9E311A0FEE2C23E717AE6" xmpMM:DocumentID="xmp.did:D98F
4461D91711E481E3EB943F2EDF59" xmpMM:InstanceID="xmp.iid:D98F4460D91711
E481E3EB943F2EDF59" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:90B068DDCBAA11E4908E
E92F91D782AD" stRef:documentID="xmp.did:90B068DECBAA11E4908EE92F91D782
AD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.Mw6...4IDATx....|S.........l.l..L.@..!M.B...
.2.f...I.....M3.AvH.......Mh!L3.4.`c<.....;.U.d..xO..|.!..'.......s
..7(33.......A..........;v..........F.g... ...:{"11..L.../H..^}.wJ#?^U
.A . .......RjP.z..&..t........t..>.3n$E...x4....3........F.D....Z.
}a.B....j.}Z...)..*.J)!2.&g.E..\F.z.5...ey.d..|...B.n..s..p%.$...P..A.
....A....l...J.%{......~A. ...6..............=N.J.Y...P......W_...Vz..
gm...P^K[3..o!...).._6.V....)$$...'....&zg.Bzm.}N..*.A.7.&...tJ.T.H...
......O..*.F...<..H..]I...PU.&.$....F&R.e...%<6...z.....3...
<<< skipped >>>


GET /cpro/ui/noexpire/css/2.0.1/template.min.css HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?rdid=2480739&dc=2&di=u2480739&dri=0&dis=0&dai=1&ps=74x308&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x896&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737391&qn=bc8e12d50064a9a9&tt=1456737391050.438.1891.1891
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: cpro.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:25 GMT
Content-Type: text/css
Content-Length: 1089
Connection: close
ETag: "5667c7a9-441"
Last-Modified: Wed, 09 Dec 2015 06:18:17 GMT
Expires: Mon, 08 Dec 2025 02:46:53 GMT
Age: 6935492
Cache-Control: max-age=315360000
Content-Encoding: gzip
Ohc-Content-Crc: 3267541799
Server: hkg01-sys-jorcol03.hkg01.baidu.com
.....O8V..template.min.css..W.n.6.........h4c;..E_.........%R.a..)./A.
.K.1O.I;E';...s.=.....h3%..o.(JR...F5....5D...&m.....7.2.*..2E...Q...@
...3Ak..e*T.Q..r..5*/Qy....E..LR$8R.i..C."..,.C.-Q#....K.%.P.e....T.6U
.2....k..A2,....~B..b..fa;...eD[.$.8.........(Y8......6...`X.)".?..xQZ
....H.^...w.u...l....^H,Xn..].C....(z{p.=&.e......."&-D._\t$M.".@~.&..
..........n...<#b...Y.a-=..*kU..q..`......I..3..d..d.dgf 3.}.%....2
b..v..aJ.....A<.V.h=..{.)..!..>8I...N....&....<co.D...P....2.
hUs. Ik%....T.\......K..p.\_.?........./?....S[...M....Jk5^,2mT..N....
,.T.'.._H..47l.~^.a...i.jY..I.....3....t.*O..Y...\.i....._..."....swk.
...T...?.]...I...;&...7.4..j....!n.L0\X..q4..'..8.f.T.f.@..}r......t.j
....#.t.T)1w_`:q.'..b`.{6....#..?#.1h|F.K......O.vuy.l..Q...C...}.;..;
..W ...~U...qB..Tq.N..hd...[K...|=r.a...m.."@.....B.......N..h.y......
pB1..peM....._.I.Wu(.(.I#.F............V...C}.Px$...p/Gi.n..K(....O'..
.........BH.W.... ......J..C_.F{....8.O...k.C..F...V......T..B....|n.K
..|;.Z.GC.Ai=......}.=$I...l...\..n..x...........g.<."...p..."[).).
.V`..c6.....{.O..aH.6*.y.&....O.../.Y$....]....|~.......



GET /gg/huyan.html?s HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: show.bianya.cc
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:46 GMT
Content-Type: text/html
Content-Length: 909
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
Cache-Control: max-age=1800
ETag: "568cc0d7-38d"
Last-Modified: Wed, 06 Jan 2016 07:23:03 GMT
Expires: Mon, 29 Feb 2016 08:42:53 GMT
Accept-Ranges: bytes
Age: 377
X-Cache: HIT(R) from bgp-ha-lya-133; MISS(S)|HIT(R) from gtt-de-fra-100
X-Request-Id: de5eef00237e81f26bff9df85fc8778a; b83aea374f15ab5bdfdaef3885e51e18
Via: T.51102.S.2, T.12814.R.1, V.ntt-cn-hkg-012, T.51102.R.1, M.gtt-de-fra-100
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xml
ns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv="
Content-Type" content="text/html; charset=utf-8" />.<title>&l
t;/title></head>.<body scroll="no" style="overflow: hidden
;padding:0px;margin:0px;">..<script type="text/javascript">. 
   /*......-......300x250_6.........*/.    var cpro_id = "u2229533";.&
lt;/script>.<script src="hXXp://cpro.baidustatic.com/cpro/ui/c.j
s" type="text/javascript"></script>.<div style="display:no
ne;"><script type="text/javascript">var cnzz_protocol = (("ht
tps:" == document.location.protocol) ? " hXXps://" : " hXXp://");docum
ent.write(unescape("3E"));</script>.<
;/div>.</body></html>...
<<< skipped >>>


GET /room/qidiancpm?sUnionId=17614 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: channel.fanxing.kugou.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:24 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Keep-Alive: timeout=20
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Set-Cookie: __fx_union_access__=1-1-1; path=/; domain=.kugou.com
Set-Cookie: __fx_union_page__=3-3:5-2-2; path=/; domain=.kugou.com
Set-Cookie: __fx_unionId__=111-17614; path=/; domain=.kugou.com
Set-Cookie: _m_u_union_=php_56d40ce03bd0e0.98052838; expires=Wed, 30-Mar-2016 09:18:24 GMT; Max-Age=2592000; path=/
location: hXXp://fanxing.kugou.com/1028630
KG-Via: SW-U-52-7
Kugou-Memory: EXPIRED
Connection: close
0..



GET /fxstatic/images/yellow_warn_0473de0.png HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:28 GMT
Content-Type: image/png
Content-Length: 1126
Keep-Alive: timeout=20
Last-Modified: Sat, 30 Jan 2016 15:11:52 GMT
Expires: Sun, 13 Mar 2016 13:38:38 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-7
Kugou-Memory: HIT
Accept-Ranges: bytes
Connection: close
.PNG........IHDR..............sO/....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:C22784AFA5E211E480CAFCDF35
114CA2" xmpMM:DocumentID="xmp.did:C22784B0A5E211E480CAFCDF35114CA2">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C22784ADA5E211E480CA
FCDF35114CA2" stRef:documentID="xmp.did:C22784AEA5E211E480CAFCDF35114C
A2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>...c....IDATx.b..L...p.q.....1..q ^..S....i6.
.u@,...,.8.....>H..M......=...b-d.x.6s2....x..3..H.e3g..0..t.8.f@,.
y [email protected].)...85...8.@.|...dz.5,...i.Y....4`...... ..`D...@|..%..
.J...a.,x...}@l...-3=.Jz.q...C..5 ........@...~/,Jr.......IEND.B`...



GET /staticPub/js/lib/jquery.min_21c00b7.js HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:34 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Keep-Alive: timeout=20
Vary: Accept-Encoding
Last-Modified: Sat, 30 Jan 2016 15:11:52 GMT
Vary: Accept-Encoding
Expires: Mon, 14 Mar 2016 14:48:36 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-7
Kugou-Memory: HIT
Content-Encoding: gzip
Connection: close
99b4...............v.G....?.Y..PB.$e{[email protected]..{l.m....)..P...M.H.Mp..&l
t;.y..}.y.BA...{.==.Q.......|.1...6.b~.&.<...w..f.....lu4H{W..j{7Z.
.<Q.....5.6Yl.MR=. .Z.b.In.....Ik....I...t..qi.t....zu.....z=i.to|.
....`.......|........ .$.'.|.S~.aG....v.|.}@...zR...nw|.Y......|K:.F..
f.>=.....8.G..t..oo6......c..F...;......i.*...'.d7k.9M1x..0..].]...
..E.y..Z.l..7.D..............]..z../..d.......5..(ne.e>..]4.q....`.
nD.b..f.(..[.|....q....y..S9.........n...w..*.6..i>C..Q1Ze.<....
%?.]...*...b....$/..Mz.'.....b:D{q..?|.[J..U.y....b.q_...3/..kv n../..
..*6y.1j.....j.....#;.FO.q..#|4....Q.......S....M...5.!..........K.1..
.dL...U|.....8..J.{C.r.gt.d.E6I..-m.Zy........_>.6zW.N... o...8q...
Mz.I..J..8..7.4...<..3}.1.Y....,_\o.7.&.7.@......;2...<..V....&.
...[>.I.X.V..b.i......... C.3>....m][|. ....u...>...i..).yUL7
...jY..hL...E.....8.&7.4.%.d.,1...5...>).6.)%.t.;.......Nq1.>..w
.U1.~.U^.y..Wx.:...U1.c......-..........|.<#yab..z....v.i_^;.J..\z.
..N;.t...2.......)...'.t....f?..yov.....1O\%...n......g....t.../0OG...
.>.o.b.. y...D{7.. m.*...8..J.....;O.......t.w.X ...........jW .:.i
q.....3Z-fhq......E.It.Y.7q2..I..t..7&q{.X.O...5.P.s.B2..3N...\..lc..J
S...*_/..u........lh.X....^....&.................qn...hw..CZ..&.q.....
.<.7lD.G'$.|(g[)H.*3..u..........AZ.s}[a..w...k....@d{.O.].W..x...2
....b..f.n.oo."............b:x;g.vd..H.m.,...._....t>.Gls.V.l.E.!..
6..j.`k..v....b ...<n..f....h!.....;P.}.%...>v..m........f..s..V
...G...).....J.u...e4..!.8F..o.-......5.f..K.N.........$...W....1.
<<< skipped >>>


GET /stat.php?id=1254817266 HTTP/1.1
Accept: */*
Referer: hXXp://show.bianya.cc/gg/huyan.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s95.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 9941
Connection: keep-alive
Date: Mon, 29 Feb 2016 07:57:26 GMT
Last-Modified: Mon, 29 Feb 2016 07:57:26 GMT
Cache-Control: max-age=5400,s-maxage=5400
Via: cache16.l2de1[0,200-0,H], cache54.l2de1[1,0], cache2.ru1[0,200-0,H], cache4.ru1[0,0]
Age: 4880
X-Cache: HIT TCP_MEM_HIT dirn:4:460058701
X-Swift-SaveTime: Mon, 29 Feb 2016 07:57:29 GMT
X-Swift-CacheTime: 5397
Timing-Allow-Origin: *
EagleId: bcfe56cc14567375266435393e
(function(){function k(){this.c="1254817266";this.R="z";this.N="";this
.K="";this.M="";this.r="1456732646";this.P="oz.cnzz.com";this.L="";thi
s.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" 
this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la(
)}function g(a,b){try{var c=.[];c.push("siteid=1254817266");c.push("na
me=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer))
;c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.user
Agent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.ra
ndom()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}
catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURICom
ponent,n=unescape;k.prototype={la:function(){try{this.U(),this.J(),thi
s.ia(),this.H(),this.o(),this.ga(),.this.fa(),this.ja(),this.j(),this.
ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.pa(),e[thi
s.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},na:f
unction(){try{var a=this;e._czc={push:function(){return a.B.apply(a,ar
guments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;
if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b 
 ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object S
tring]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAu
toPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch
(d){g(d,"cS failed")}},pa:function(){try{if("undefined"===typeof e._cz
_account||e._cz_account===this.c){e._cz_account=this.c;if("[object
<<< skipped >>>


GET /fxstatic/images/footer1_369dc54.png HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:33 GMT
Content-Type: image/png
Content-Length: 3747
Keep-Alive: timeout=20
Last-Modified: Thu, 18 Feb 2016 10:19:49 GMT
Expires: Sat, 19 Mar 2016 10:25:43 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-40
Kugou-Memory: HIT
Accept-Ranges: bytes
Connection: close
.PNG........IHDR...p..........}......tEXtSoftware.Adobe ImageReadyq.e&
lt;...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:3F
AA2EADBE9611E580FEB7D4FE9BF93C" xmpMM:InstanceID="xmp.iid:3FAA2EACBE96
11E580FEB7D4FE9BF93C" xmp:CreatorTool="Adobe Photoshop CC (Windows)"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:323A006A292A11E5B3A
085D34BC264D9" stRef:documentID="xmp.did:323A006B292A11E5B3A085D34BC26
4D9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>........IDATx..]}.\U.?.][Z..V>.i; .....A.
..Y.....jb4&...Q[B.....(Ud...;....L....q...M..........Rl.-.vk.....{...
....{g.3...........9..u../744...\.8..y..kAh.Pg..;.c......!......F.l..|
..!RW.p.?..!......\m ....[..G.#....mT...K...( ...>..G.........r|3U.
...<9L....u..Z.$..`.........x.S.&..V}10.h%[email protected].#.qyR.. ..A..$.
....2...s)...*.@.).%[email protected]*-..5Cfm,F.*.`.^.h..*....t..?..i..0?M-
.hV..X.u>.2(#..4.>VG...71j$..[.X..b ...f{.....2pi4.....R.S.'...Q
.Tu%.Zye...{%n..........X..H.I..r.nA=...,h.,)....P!F..b....S.E...E#.R.
I..)Z...^..ql...sw....uI..S|.|,.[...R|....7Hg...r...$.q...V.b...M(
<<< skipped >>>


GET /media/v1/0f000nTH6UlUciFfpq-CKs.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://pos.baidu.com/acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ubmcmm.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:51 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 13002
Connection: close
Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT
Expires: Fri, 06 Jan 2017 17:55:36 GMT
Age: 4548195
Cache-Control: max-age=31536000
media: media
Ohc-Content-Crc: 3688519439
Server: hkg01-sys-jorcol04.hkg01.baidu.com
CWS.GE..x..{.X.K.no^..9KVP`......EE......v." bF....$.QPAA.b....d..(9.0
pg.L...|.....;.LOUW.]U].3.;..X...m..a.......B........31......jC.../...
[email protected]$( * [email protected]>.*)./.@0!Q=C.A42%P.N.=(.4=.......
...T.......I.P. .)*)...8...q..H..8P(...t)13.".W.&..M.R!x............'.
@....%.y........6AU[[email protected]#z.i...j.JJ.*..%um..m5._...]Q.x..#
.%...b.......O [email protected]*......T.. ....J...$A.. =be.m.H...=I.&..C.L..6
V3TU..4S1..0USR2"...*.* .)....k0..].;...34..H[A..7.~Q...9..C.r./P..4U.
......*.*.......:...ih...../ ~.J.!....B(..^.".PI.H.I|..=L..j...&3.5u.5
c.......T..y..!-.......?C....e.....?....1?.............gL;^..$...5*..J
[email protected]:.b.<.....N.#.{.g.]....i...../....t.....a.Mv.p.%
1%[email protected].......`.^....c..6....-}Q....F..].`?...t
A...$.............%..iy(.1..1.mc.n.M. .a.X...."..\.A.eR..(...h3....5..
!....k.Jg5...........t.#{.(....>t).....i..W...y.%)....z..../G\P.>
;...... .W.............y.ki..,....=H.P..^`.Q..A..o1`K7....@..&..x...[.
.D ;...>]>...D..([email protected].%... m.(!).j....nD
.s".......g.......fv^....;C3.. [email protected]...
.=y...R.vWZ.....=R.Sg.z. ...#.`=.8pem...}.'........2EdJ......l.U..w...
lw....!...J..g........F.wJ..N4..Q..........a?.w_{NX.....a..E...i3XrK..
.q...r}.U(.`..`..R.a&E.|....u.....XU.....M2...P.Vv..1.yq.E...f...f....
........O_B|v&la:'...7.....!.6.......w..E....I.WVP{...........Z./.K..o
^8,.1*.................'..Oo.Qt.............wr.e.Re....S..#.8.c.......
./. ...a.m'........X.nIs9...s.Zf.../ev/..3.9!....-.].....:.. .....
<<< skipped >>>


GET /core.php?web_id=1254817266&t=z HTTP/1.1
Accept: */*
Referer: hXXp://show.bianya.cc/gg/huyan.html?s
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 763
Connection: keep-alive
Date: Mon, 29 Feb 2016 09:05:42 GMT
Last-Modified: Mon, 29 Feb 2016 09:05:42 GMT
Expires: Mon, 29 Feb 2016 09:20:42 GMT
Via: cache7.l2de1[0,200-0,H], cache41.l2de1[0,0], cache1.ru1[0,200-0,H], cache3.ru1[16,0]
Age: 785
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Mon, 29 Feb 2016 09:05:49 GMT
X-Swift-CacheTime: 893
Timing-Allow-Origin: *
EagleId: bcfe56cb14567375270665120e
!function(){var p,q,r,a=encodeURIComponent,b="1254817266",c="",d="",e=
"online_v3.php",f="z4.cnzz.com",g="1",h="text",i="z",j="站໳
1;统计",k=window["_CNZZDbridge_" b]["bobject"],l="http:",m
="1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=
" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&
k["callRequest"]([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k["cr
eateScriptIcon"](n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/websit
e.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnz
z.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'
><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="
<a href='" q "' target=_blank title='" j "'>" j "</a>",k["
createIcon"]([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type:
 application/javascript..Content-Length: 763..Connection: keep-alive..
Date: Mon, 29 Feb 2016 09:05:42 GMT..Last-Modified: Mon, 29 Feb 2016 0
9:05:42 GMT..Expires: Mon, 29 Feb 2016 09:20:42 GMT..Via: cache7.l2de1
[0,200-0,H], cache41.l2de1[0,0], cache1.ru1[0,200-0,H], cache3.ru1[16,
0]..Age: 785..X-Cache: HIT TCP_MEM_HIT dirn:-2:-2..X-Swift-SaveTime: M
on, 29 Feb 2016 09:05:49 GMT..X-Swift-CacheTime: 893..Timing-Allow-Ori
gin: *..EagleId: bcfe56cb14567375270665120e..!function(){var p,q,r,a=e
ncodeURIComponent,b="1254817266",c="",d="",e="online_v3.php",f="z4.cnz
z.com",g="1",h="text",i="z",j="站长统计",k=win
dow["_CNZZDbridge_" b]["bobject"],l="http:",m="1",n=l "//online.cn
<<< skipped >>>


GET /api/tongji3 HTTP/1.1
Host: sd.hiv-hiv.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.1
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Mon, 29 Feb 2016 09:18:13 GMT
Content-Length: 704
26FF1B2147769946D5D7F99BAD45D0CBF67DCFD907CC057BE20C23E2F7EEBB2C40A6F5
6BCE00B5637221C2490FA292C693F42B7A856AB11442E51CC746CC7AC9C414893E3A7D
6F936FBBA70DE452AFFDEC4C24863B927E97CFCA271FEF45A4A95E284E5E727E4E170C
1AEE1FDA60C3AC256F0BF4260E3A00BBEB41A2FBC72B043709CD92A0780154EAD840D1
1CF37F22F778431C7D32948967AFEE8C2885D7EE4DAAAF4DC293DC181ADF8FE74A0DA9
8B7618851DF66AE0C785564EEB6ADDECE38DBA6CF36FB2DD47810BCC6CB6A92B8FEF3D
D3010C487587BDFB56A6F5FB70E6A60C5D9A78744401EAD06105CA2A6F8BC55BF240C5
BA02F92E986374196DD98AF049555F2E4D4C886BEB3975561EC0CF7618851DF66AE0C7
85564EEB6ADDECE38DBA6CF36FB2DD47810BCC6CB6A92B8FA55E7FDD115B726E5B6C92
97625D97336637E302D9B157957D5542A8735FCA5BC31C44DC71459DE021B82F405A5C
7EF1HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/html; 
charset=utf-8..Server: Microsoft-IIS/8.5..X-AspNetMvc-Version: 5.1..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Mon, 29 Feb 20
16 09:18:13 GMT..Content-Length: 704..26FF1B2147769946D5D7F99BAD45D0CB
F67DCFD907CC057BE20C23E2F7EEBB2C40A6F56BCE00B5637221C2490FA292C693F42B
7A856AB11442E51CC746CC7AC9C414893E3A7D6F936FBBA70DE452AFFDEC4C24863B92
7E97CFCA271FEF45A4A95E284E5E727E4E170C1AEE1FDA60C3AC256F0BF4260E3A00BB
EB41A2FBC72B043709CD92A0780154EAD840D11CF37F22F778431C7D32948967AFEE8C
2885D7EE4DAAAF4DC293DC181ADF8FE74A0DA98B7618851DF66AE0C785564EEB6ADDEC
E38DBA6CF36FB2DD47810BCC6CB6A92B8FEF3DD3010C487587BDFB56A6F5FB70E6A60C
5D9A78744401EAD06105CA2A6F8BC55BF240C5BA02F92E986374196DD98AF049555F2E
4D4C886BEB3975561EC0CF7618851DF66AE0C785564EEB6ADDECE38DBA6CF36FB2
<<< skipped >>>


GET /staticPub/js/head_061c6e7.js HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:36 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Keep-Alive: timeout=20
Vary: Accept-Encoding
Last-Modified: Tue, 23 Feb 2016 08:33:06 GMT
Vary: Accept-Encoding
Expires: Thu, 24 Mar 2016 10:18:48 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-40
Kugou-Memory: HIT
Content-Encoding: gzip
Connection: close
49a2.............}k{.......P.C.!...I..re.&.............,\h.$..|.;.l9.c
'..N...I|I.H.$.e..... .O...=.TUWu7HJ....w'2.]].S.N..{..[.^..J5.e..x.}.
_Ig....._.Os.N..-..K{..R._.2.c..z..s....X..t{i?3_.-.[..j..=/.. .....M{
..N'h.Ya..&..NP...jp.U...7......_... ....N{)...2..wk...j/7..c..:....o7
....=L.......rn,.............n.U=^.[...4..}..i...L)&6..\hc1\G..T7.<
...['Z.m....b.Vn...x.:.A.....g..)..<...P..^'...{Yo.[...WKG5.. Eo..Z
OT2j.......){Y)...3.xc..l..\...Z...S~3...N..<[email protected]..
F<.`.'.Mgr ..tR.....K.]oef.F7P.}._l.*.r-t1,h:}..LSh...\.:a.z...c)x.
w?...nT"}.......K...n.LT..e]OZ3%[email protected]{.^#..z.\D
.....b..4[[email protected],X..s...QL_....-./......)...0...<..9Qn.F...w..T
[email protected]\W...x...'.~..3O.xc..Q.W/...~5..-..]..[.o;../.....
w..7.................W..z...on.x....^.Z........I...........|.f........
tT...F..7.._..*S...*.9.rc.j1.....x..0F. ... .C..t....h.......L..j....{
.fK.V...?&.YLE....S/.xa...c...../W./.K..~.H..V$......X... .eD..et*....
.2..2......I...q.kh.7j.k..pe.5l.S..!h......VjQ..).H}.....F'.-wZ...<
.......|..:q.....|.O4_.R...J.*...\.`.....K...p.H#.....Pi..: A......Y..
...b.M.......\..2..v.......`..@;.t:.N.].....nn.|{...._..??....On......
..g.y..e:WYP!!E5Z..f........>V..z.r...p:..I..p...,. M.P.....MlK....
...\.o4.......rY..X.:iUk5......f...a.<@~..[...!.....`|R.B.{.{..o.3.
.....J`"%L.q.:.cB\.X..V".C..I.....r..pS...z....g...f....S.J...r/{P*.j.
.P.J.....]Bo.C.V*..K.J.x..a:?=3~(.M^.8...Y......|.`y.:.e.2...H.......4
......N.. -&..-^..E... v.........-i...c4..`..w.r../{N&'....Q1.$Srd
<<< skipped >>>


GET /fxstatic/images/sprite/css/room/room2014_z_4dae78b.png HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:32 GMT
Content-Type: image/png
Content-Length: 137807
Keep-Alive: timeout=20
Last-Modified: Thu, 14 Jan 2016 08:56:40 GMT
Expires: Sat, 13 Feb 2016 13:16:21 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-42
Kugou-Memory: HIT
Accept-Ranges: bytes
Connection: close
.PNG........IHDR.............C..... .IDATx...y..u...OUu.t..L&.N6..@ ..
@....z....8xq_.z..^..#.....(G.(." . ..D. @2!.>..,=.kU.?~=K.Y3.353..
.U...~....Lg.....Y'.9...........i....w...Z?.i...........1.1A.)h1A.)h1.
i..... .....4|s.ZL.s..........';.'......9...;@.....#""""CA.0......./a.
`...Z`..e$""""CB.0...........w..l..lDDDDdH..&"""#.w._cF|..^.~p........
...DDDD.$.........W./.........DDDd$....,.!.....IGDDD..*....U..-4.RDDD.
.......u;p..d#""".g.j.9|.P.!.H.N............3...B&bUT.|.YY..... .... .
....4|s.ZL.s.Z.r..N.....)...t.....RL.s.k.........G............l......]
L.s.ZL.s.Z.r..9.-&.9.-F9.1.H.gjk.........G.8..Ih.;..dW..{q1dB..$......
o,...c.7&......B.0....nN.~.L.!.qL..vP2.........O....8..........3/Wu[..
..MbU4Ck....g.M.Sk.B..<B..'.v..V......m............R.0....N..<I.
..o.g.......~m....p...p.U.....<5..._.e.....B.?..{.y..)....F.~I..=.c
W7`W7..a.E6.4.LDDD..)./..=.........DDDd...H?8..{j...o.).j..........8.6
c.eqJ.x.6..VA&D..EX.q..$.....r(k.Lx..........4.LDDD..r`5=..^..A./....L
-1......B....8%...$~....\|)~C).^m%.g.C..l.?...&....Y....&"""AU...\.K..
0 =.....H_...?r....x..=...0..-b..>....1&azW.miabs3Gn....<0...O..
M.or..l#..M.=...1d.?..........`.,...X%I,......6s ..:.....l.8....=.....
...1..O....d~2E...................).=..........DD....].(........x-.'..
..j.3.adGE..^}[email protected]|]...b.f.H?...pS...\B..]X.Y..A.H2!X?...:
..[...&YSE...q....c9>..7.....z...$~..TQ{.|g..B...< .d.L6..F....3
...Z...H.....R.........8...D$`B.<IxaM..3.......E...?".X9e....s....}
...X.m. g5B.2$.?.oKY.M..R.......N.m.....-^...O.Z..gr=x.V(I..]...Dg
<<< skipped >>>


GET /api/tongji5 HTTP/1.1
Host: asad.lczchina.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.1
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Mon, 29 Feb 2016 09:18:14 GMT
Content-Length: 2720
7EB27EEC4938695F79DA63F8E6695FCAC65448DE8F1EC921BA95FEF8C74765CFEDE767
5907CFF6D0818CD29AD5FCC628CBB99ADB9D3990FDE44AE16A5729206CDA9404444A01
FF4B8EF0DF3E09A24B5676FFA887BAB0E90261FE1EFCE49D574E073E04AB3044BF18F9
EBFF6F59E91F39B65C3B9D9920D63CBDFECB13C25F09A24DD7E2C44193258014F7F72D
F8BEBDC909BE15F11CFC3A4D271527DEAC96933675F43FBE47E25E216D9BC536E8DBB2
5652419A3286C63A33C4CE977808317CA6F3B605A152D502C3E1C9B386A2E6AA95AC89
51541926B58061F32A33C37900C49423A55776CB7F36169007C6D92E1AB63310F46F05
1BB242189ECF32A7D2F8912A615E93B5112775202050EA198A7AD2BD521402D2B0199E
61017D5130EE0B68332B991C405698BEB49657D2D81D1D4F8E92329FF0B64D87D14049
3AA16BDBB85C41C2C3DF07E1A4D9899E498E74B7ED35840CCC22A561FEF0045587FBB9
06F9496709F24323C989F903F45B4185843C65AF8845A7AAF432A7CA0C0D9BA958CDFE
C4F3AA213E5FE0499E6D146AEFE4AB252C27763620917ACD316CBFBE40C4BA9C10F8CD
C499E7A12F17DC8A6E42B6801645E36BE2EAB652B8B0BAAD1E79A1F302108471BB7AA8
96B29FB3F4057AA9F79A166D8F3FAF666FCBC0B44598189077EF4319C3891EF88AE9BF
D521969CE282D7110E046769F2AB73E665582DE2D884220BFB72F9BA51643289EE0CE8
CEFF9852419A3286C63A33C4CE977808317CA63F4BB4969D80633C839A40B5558FEA4E
1E3808B17C491FEA4A3DED58CA1AE54906D7AD753CAD591B9B7C575441D379B6135E2A
406251B1F0D0E091C88FA7BE9F27D72132CB730F11F9844CCC1BCB59582C686C9106EA
42BE7DD18076D4AA855353CC51C1B53A26B3296ED4CD2181B3DD38AA929017341751D5
E5677B426301E0703FA79A2E8E544B39EBD9A0F03E67DCFC6AF92A50813126E0788AA0
E0C7229FE6602F19FAC74FFEA040A2D2282F9035F141586B0B7C7BB222FBAF5E4F02F5
4461258BC08019A193A4F700FF40A2C8712658680C7E3808F9BD15941C427AA861
<<< skipped >>>


GET /PClick.aspx?AID=19948&KEY=AF54BBD2867C2DE15DDD9A452A155309CABFB4C7433B7CCA3F16B8C72F291D02 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 360.rbc.cn
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: hXXp://channel.fanxing.kugou.com/room/qidiancpm?sUnionId=17614
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShowTG=2412; expires=Mon, 29-Feb-2016 12:18:22 GMT; path=/
X-Powered-By: ASP.NET
Date: Mon, 29 Feb 2016 09:18:21 GMT
Content-Length: 179
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://chann
el.fanxing.kugou.com/room/qidiancpm?sUnionId=17614">here</a>.
</h2>..</body></html>..HTTP/1.1 302 Found..Cache-Con
trol: no-cache..Pragma: no-cache..Content-Type: text/html; charset=utf
-8..Expires: -1..Location: hXXp://channel.fanxing.kugou.com/room/qidia
ncpm?sUnionId=17614..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.
50727..Set-Cookie: UnionADShowTG=2412; expires=Mon, 29-Feb-2016 12:18:
22 GMT; path=/..X-Powered-By: ASP.NET..Date: Mon, 29 Feb 2016 09:18:21
 GMT..Content-Length: 179..<html><head><title>Object
 moved</title></head><body>..<h2>Object moved 
to <a href="hXXp://channel.fanxing.kugou.com/room/qidiancpm?sUnionI
d=17614">here</a>.</h2>..</body></html>....



GET /it/u=3059151468,3543266969&fm=76 HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?sz=300x250&rdid=2355443&dc=2&di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=02ff9997d2308bbb&tt=1456737391050.1781.2172.2172
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: t10.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: image/jpeg
Expires: Wed, 30 Mar 2016 19:18:25 GMT
Cache-Control: max-age=2628000
Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT
ETag: 202755688207a35af39a1e716349070f
Content-Length: 15765
Date: Mon, 29 Feb 2016 09:18:25 GMT
Server: lighttpd
......JFIF.............C..............................................
......................C...............................................
............................."........................................
.C.........................!.1.A."Qaq....2....#B.Rb.$3CS....r..4c.....
.............................1........................!1.AQ."a.q2.....
#B..R..............?.....$.sM.N.....D..Y...b.$9.qH.v: J...1.....S.P:..
....~6...'.<..p.......G;..c.....rA.........N...b....|..Q).........5
..}OkxT.[....q....#q.6.%KR:(h....O.p.$.....h..ODsu^...#...e.....Q....|
.S.V}..Z5..D..Q.U..lp~.a......b..|'..3...)V..jk.k.[..M........cM.....u
......Ke.#<... 7..T.`pF|...Ik._.....i......s]N. F.dhP...1..M...u.._
.^..Z..y..F.\.>.k..B.q..-.&>...l...MT...?.....%..r.Z0..*6;`...1.
......XE...1.{(R..V-...:.I}.P..I..x....Z6... g........|I.q..S[....4kK.
!V[.%%......yg=...W........9..;e...J...m....f......5..n....I......\>
;......l.-r.z......#....$...G......F...`r.w..-W..R[...{..H..,....q..P.
K.]....Y...G...<.Q.f..)q,...6... K.O.,...s$..1.$d.n............5.X.
....!..H7....#.~98..j.......<6.$?........O.c.U.N.,..WDu......)9^@$.
y..U.e.....5'Qc..z.DvuM#J.-.Y.,. .lM.d.a..}...R..k.X.....K...y.c.~=.;.
.&.~.......1.......[.-.v.....:."..f#....b....c.D\..DZ...dz...>...3L
.....i..W.#y....{..1`02q......o.-.....G.K..7..R...._.... ...S.?...Z...
....Y2.. ....s............~4L*A<.[...{a.?j...n....t..1Acm...J..Q.q.
......X...b.'.n|Kf.=.e.H...y.....{Q.K.z;.^...].$.2...\<M..A|/.# ...
...~../.i....hpRB..622......e.U.....qK.rt.^.....%.........k.F.H../
<<< skipped >>>

GET /it/u=728057772,766315808&fm=76 HTTP/1.1


Accept: */*
Referer: hXXp://pos.baidu.com/acom?sz=300x250&rdid=2355443&dc=2&di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=02ff9997d2308bbb&tt=1456737391050.1781.2172.2172
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: t10.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: image/jpeg
Expires: Wed, 30 Mar 2016 19:18:27 GMT
Cache-Control: max-age=2628000
Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT
ETag: 7eef7b7842b6d3c284b2a626fe21d072
Content-Length: 64430
Date: Mon, 29 Feb 2016 09:18:27 GMT
Server: lighttpd
......JFIF.............C..............................................
......................C...............................................
............................."........................................
.....................................#!"$..#R.......................
..........=...........................!1."A.Q.#2aq..$B....3R..C..[..
............?....o.A....:.)....&d....?q..?....`P....5....lq.*..s....E:
....q...<....y...X..e<.....b..f....W6..........t.OS..%.Act:x...X
.......]Fm...5..u..^....9.s...x..bHW..X.t.....~..........>..i...fW.
.6...Lq....m.51XEz _!r...m..M...S.a).......]U..%.a..z.Vx...(.h..}:1..M
....3.:a..#];.B.6.6..Tl<.CZ...I.B........r.O!F.......o...|.......y.
........0...R..|.^NaT...{n.YI..`.!............?..J.E.o$a\A..O...-^Ol&.
..Dv...6[.%E....].&......S.3.CS|..).........f..6..2J.J.ke..J5Q..9J....
....._"{a)..Y..z..6......i....@.>[email protected]
K8..R0Z.,y...f9....5gS..*..|....".....V.e;...y......z3.Yt9.9j..S...o..
...Y.i...Ad........[. _4-....V...a......r!.E..wV<g k..S.../..>!^
C..R.........>:[email protected] ..vbl....wV.Z.S.
.w....2.....]...;.#w..h1.G.....G....jU.....f9 ..O.GnZ...IG..F..o.... $
[email protected].....'o....>. j/,|L.'....F)>..........[
R..c.'..c.].p.%VU.. ....$1xVY..RdnZ...~Q...~G............Q........yW%l
l..J... (.5..M|......._?N...k.L7...G.....w.#..*.k.9>.....a_..E.....
W5i.;.W..............t..:..5.}.D....F.K{k"WV.oi.f#?.....4a...FP.e"....
..I..R-K..Z\..t.l..<&.j.. .!9...>..,V.....x...T...v&..c...T.
<<< skipped >>>


GET /it/u=1516739037,2004201896&fm=76 HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?sz=300x250&rdid=2355443&dc=2&di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=02ff9997d2308bbb&tt=1456737391050.1781.2172.2172
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: t10.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: image/jpeg
Expires: Wed, 30 Mar 2016 19:18:25 GMT
Cache-Control: max-age=2628000
Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT
ETag: 7f2b4934c4c456a0de6a7b4df9e69799
Content-Length: 47676
Date: Mon, 29 Feb 2016 09:18:25 GMT
Server: lighttpd
......JFIF.............C..............................................
......................C...............................................
............................."........................................
..1...............................!"#..12$A.3QB%ET....................
.............8.....................!...1A"Q..aq.2.....B....#R..$3.....
..........?.F0...fu....UTTy..2s9.U].......T...........].Qy..]u.Z......
.....e5s....N....Jhq.......M:..y. .....2..O&.mc!.W .....|z......P.....
...-....$....xx..mR..s.8y.xh...9.9....fr..q.....M.J.6.h.>s.....N5 Z
..6#...=..*.P>/)..r.r.E[.....!R.S....M..4..R..../L>.*..\@.3\..#I
....X....3`....i7V....}.9fG ..;....i-Z9...s. ......v.....\cR.p.p|..!Z.
U..]....k....^E...j...U...9;6 2.s%....E.....jn..{....m<.....c.r...b
gj7.........h.r......jf.o.*..7R..#.....V:.C. .9|K...cb... ......". g.W
.1~D......M..o....]....jC..fC....3S..N.R..e.......:.j.......J.S.....`I
.G.X........[...........".5........D.m. ...B....m.y.U.&..... [email protected]...
)..z.9=. ....\...f.{[email protected].\.{....Mmb.;V/..U..f....Y.Qb......
k....0&.Zk.KSe.,..Y..ow.j..".....a]]...M....N..u...Wd.UVQ...{[.a.a...T
...O5.......QB.:.c.Z..".....d5!P..d.......Z....s.......@T..:N....c81.{
5..h.../u..[9Xy.mU.........8M...pm....W..r.........9G)...T...Q...i....
.....-..8.sly.:...f.VW.......r........ .f&h...rP.................k..K.
......k..Z.h.;..?.hdh.X.E.E..`k.7..C...._J...].....u.J...z..Z/B..-To08
Rf.....CH..A%L..*.4.a..8;i3.L..y...=oG.R..I....C..z..].m.....)Wc.[.J..
R.!..8..D..Sd.c....v....V...Fn..6X...>.H..........g.x..Z.......
<<< skipped >>>

GET /it/u=1875430050,2580979778&fm=76 HTTP/1.1


Accept: */*
Referer: hXXp://pos.baidu.com/acom?sz=300x250&rdid=2355443&dc=2&di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=02ff9997d2308bbb&tt=1456737391050.1781.2172.2172
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: t10.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: image/jpeg
Expires: Wed, 30 Mar 2016 19:18:27 GMT
Cache-Control: max-age=2628000
Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT
ETag: bb1d766348ec6c7715cbbed19131e11e
Content-Length: 44823
Date: Mon, 29 Feb 2016 09:18:27 GMT
Server: lighttpd
......JFIF.............C..............................................
......................C...............................................
............................."........................................
..C...........................!1.A.."Q.aq..2...#B......$R3b..&...S....
.................................?.........................!.1..AQ."aq
...#2B........3R..$4.%..S............?.....I.....U....../ .J.*D.;)....
.:..[.!M.T8.~....6..R...h..KZ.i}/4..p0.H(Q.RP....P........j3*..nOg...9
.e....T .O...1..y.T.e...[{n..........._08........o...[c....3_<.....
.......]L.Qa...kkkn{..!AD.:....A......v....Li..H.....F..<..b....c3(
..#.*T...v...{*\nv.E..j...EK;.D..V..[.4i[...C..0z..*.*,2..(..nd.`X....
P.u...v.....``F.vWS.....#W.m....q.9_..z.wK.b...n5.Z....}.j*e.0`.[=)q1.
.$.R.o).W....Z3..L...Z..X.......K.......-..A....*R.w.X..#.....u.0..)-)
h.X..[....N...V..."L...-....a.75.\...X..|... E.....(P.>...i....M.C.
T.(R.|[email protected]..''....\..~%..Y..0.j..H. I~ 3....<6-.hc..nw...m...M
u.[.gYGEks.j.s........./mY.M...szL.!.......;...'#.....Y".p....U.>Q.
.!.wT.V_.>a..\.e....y..k.v.U.2.5.\...$3.Jz..D.....C.,kr/.A.Y`.r.U4w
.W<..4Xs\.....Z..Uv..........n.W3e..Vp&b........a.oZ..f..2.s..7...-
..4 ..N....l.^-......a.\...um...Z<....J......IGQ*..P.MQ..<.YQ...
$.3:e...#.d|;s'....3.0......S...Tc..:..L.U.....0.&..:..dX...ng...d..|.
...^j[H.z...J\Z..............}}.M6..AP...).......U.ax..... ..b.T.9.'..
.d59.Vy.vD..UUc.....:;f...-d.\O.../....2..b.....q{...nC.....u.b0.....C
..\q.)J.[.Ht.lo.?...g....l..4.....i..o........F]......1.ni..7..._.
<<< skipped >>>


GET /cpro/ui/noexpire/js/2.0.1/oojs.js HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415691&ari=1&dbv=0&drs=3&pcs=300x250&pss=300x250&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983<u=http://show.bianya.cc/gg/huyan.html?s&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416&qn=ee6118cd6aef5aef&tt=1456737415675.94.1344.1344
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cpro.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:52 GMT
Content-Type: application/x-javascript
Content-Length: 2176
Connection: close
ETag: "5667c7a9-880"
Last-Modified: Wed, 09 Dec 2015 06:18:17 GMT
Expires: Mon, 08 Dec 2025 04:16:59 GMT
Age: 6930113
Cache-Control: max-age=315360000
Content-Encoding: gzip
Ohc-Content-Crc: 1071315068
Server: hkg01-sys-jorcol09.hkg01.baidu.com
...........Xmo.6.. ..0..!;_.c...^[email protected]..*[email protected]#j8/.
.q..T..V9y...F.w...}..7.Q\..W@.....'..]...T.F;..Z...o...;HK..........D
...y...w.B9K.b....s9).p.Q73...Y...o..E.U.]...{.u..;.D.-.2...W.j.JP.b..
'[email protected]:...`....V.,.....rw`....~..@8.....;Y..Z}....E......X..H...hj&&.
 ..c\.S.H!.h.......F....N..g-...r*. ...y...c-.z.fE....T...V..X...A.Z ^
.....(.b........t...Z..W..2.. %[email protected]/i...p........
\....Y/$`b...W...O..&Mp....?&.*J....v.....][email protected]...
..F.6j......K#5...I.Bi...^..1R.....V.q5.:..c,..r...)x].z.}.'..J..W.9Dc
.y......I......9....t.<...V...R...QMP.P......m..KQ.....~5......,..~
.&*.:.$..s._..G....J..,$...J.................cb.......O.,Y..!&G...^)C.
L. l.H.M...c.... (8.~.....R.l...w......u......%..M....i4..;..8./.b;x..
../..(.r.....F..$F......KWT...w...%...j......bw.zG:.l...xI.v..w.......
}.u...b..f...h@..[...#...d....yy.U,.....m.-l....!..$?......!.).br8y..N
R.Fm....6....*:...... .....p..n..M.......=p..A>...J....B\..@..!p..w
.,.j....O.5.T....0....{./..I..Mj.........d.,..N.....wX...7.1})b../.U(7
....O...s...r...]..d6i.B_&...X.............|.&.?x..$s...J#{.KF1.0R...7
=}...S[.h....=.`.G.....'^..]..>.7[[email protected]`[.Y...Qa..~.C1..2.fz.U.0
......!..9E..G.|..Sxr8.0...8"...4.B...............i....N.G.4.|...N.$..
1.vN..KE......k.,..A..|b..f....{......).I.B.A..3./V...mi...,....`.?...
.....C.......-.b.uP..5Q...Dn).F.......C.byb/.bX.A8.OJ...k...H.......s.
6Q.^.5..{H.^9......../[email protected] .eW.$... .. .T.T.2.........v...`..
..Na I@.<...,[email protected]
<<< skipped >>>


GET /stat.htm?id=1254817266&r=&lg=en-us&ntime=1456732646&cnzz_eid=223312916-1456732646-&showp=1276x846&t=&h=1&rnd=411469173 HTTP/1.1
Accept: */*
Referer: hXXp://show.bianya.cc/gg/huyan.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: oz.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine/1.4.6
Date: Mon, 29 Feb 2016 09:18:47 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..



GET /staticPub/js/lab.min_c0c155c.js HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:32 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Keep-Alive: timeout=20
Vary: Accept-Encoding
Last-Modified: Sat, 30 Jan 2016 15:11:53 GMT
Vary: Accept-Encoding
Expires: Mon, 14 Mar 2016 13:38:43 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-7
Kugou-Memory: HIT
Content-Encoding: gzip
Connection: close
89b.............Xms.... .\Q.e,p*...9b{...l..}....k..H.!aI`.@......../.
.6..........j....B.....#....Nwqh...7...?...K...r.q.Fi..N.......%....Z.
zE.E......1..}....../w......n0..z.....d..:I..D. R..Wh.../G^5~<Z..E:
...E......`.....6..N..=.<...0.9iRh..bf...aG...d2{....V.i.<..cj.-
..?.T...A.....D..{b8.>J'Q..M.'..:..^...e'.9..n.....'.....Z.........
....wA...06W...}.N...ta.(4.$.L5,[email protected]....
Ha.2..........k..~.i.V.7&....]...~..P....1....Z0{\Jo....f}9...b... ...
Q..[...].ZF3..._...).Ob5.W..S...7.>......].Eg..n.%N...F............
.%.'.H.QGA~...M-f...l.r(..#..>...P?E..1C.7F./..I<a...(<~=..m.
.V.H.~...F..>z...Bx'h...!.f.k{.z...k..].4[.)"...,&,..~...y.c.n.....
.g.l..!....{ r.f.O.Y.l.0..h...p0.{'.v..?}........C.V.......k..D...Qeq.
$..T.> ..S..9.......c.M..W......%'b3&.>l....5..!..J.$5...7r.L...
P.K.c....c....8..VB..V..(.....0.}W...kH..qt;..q..."..u<...w.&/..M..
....x|7:T..n..E..oE.[GG.k.....jL."...........t..........W .Xa.\.'U..s.
...7.....s.l?5..O..X...mV7...^-.j..p...r.<]P..Y.....Gx..r9.\.. ....
...f.......]....=.z.....#....;....Y.........[......-...Qi2.aW......L..
03..A.......&.y.Z..O0.V.%..>uB....N...".....j..h]....$.....x..$....
..L...2......ip7..N7\..*.L...5....]..e.8W..-K.*..z.][email protected]....|)
a.N.E..X.,.(M..T:U.*.&P.*.N..r.<..>.T............._.>L...U..}
.u.h..iV..ue.J......x.'.'..|&D.....xx..-..C.}....y<.8..{q(O~..!....
=.1a.?..7T......UU. .mPTu...]}l...*].o..C..).b6V,....e.{ )....!]....p7
s.e..........-#).6..N..J.W...3g.&..".=.9.o......0......e 1....D...
<<< skipped >>>


GET /fxstatic/images/room/2014/bigScrollBg_8972341.jpg HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:32 GMT
Content-Type: image/jpeg
Content-Length: 13287
Keep-Alive: timeout=20
Last-Modified: Fri, 19 Feb 2016 08:25:29 GMT
Expires: Mon, 21 Mar 2016 07:48:52 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-42
Kugou-Memory: HIT
Accept-Ranges: bytes
Connection: close
......Exif..II*.................Ducky.......P.....*hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c01
4 79.151481, 2013/03/13-12:09:15        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpM
M:InstanceID="xmp.iid:B1975E4FBDC711E5A5258C4479B76BBE" xmpMM:Document
ID="xmp.did:B1975E50BDC711E5A5258C4479B76BBE"> <xmpMM:DerivedFro
m stRef:instanceID="xmp.iid:B1975E4DBDC711E5A5258C4479B76BBE" stRef:do
cumentID="xmp.did:B1975E4EBDC711E5A5258C4479B76BBE"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;....Adobe.d........................................................
......................................................................
...................P.^................................................
.........................................!..1AQa"..q..2#...BR...b3C$r.
..s4......................!..1AQ."..aq.2.......$.............?..Im....
W...l.} ..T._....sUl$P.. ..>.|(M.<.D...6.i..."~Bk...z.D..c'I$.v.
h........p6.{..,[email protected]/amj.Y,...ei...^.....o%G.....[@
m.h3y....a.S @.n..6c...@|..P.>. ..y..7 *...Tm.F.(...P..3x9./...P]..
(....i.DN.1...m.U..........7c.k.......#..c.m.Ueb..................
<<< skipped >>>


GET /css/details.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:17 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: W/"00f2cc963bd11:0"
Last-Modified: Mon, 21 Dec 2015 02:25:04 GMT
Expires: Mon, 29 Feb 2016 07:51:04 GMT
Age: 10119
X-Cache: HIT from ntt-cn-hkg-004; MISS(S)|HIT from gtt-de-fra-099
X-Request-Id: 2d2fa607a98b9ca0d889ae0c7e5f0479; 676af75d54ed8e65d0cdf976b7021b3e
Via: T.51101.S.2, T.1288.H.1, V.ntt-cn-hkg-005, T.51101.H.1, M.gtt-de-fra-099
Content-Encoding: gzip
b58.............Z.n...={........I..%....A.d......D.ErH..X..`.|..9..K.{
.....d...HUuW.[.do2......U..^W..g.:....w.6............E......m.;_D..x/
.2[.....z.....t=#....Nk...)k).,)...h.j.:rd.jls....u.~^......* <Z.tj
tSD.Y.M.Sw.^..e...A..[...\...h.&{.3..*A.;e.X..r.....'.......z&.o.g..x.
..........Z..R.z..z.M.gKq......[....l..l.r3.Q.B..D5zc/.GY.y.....R..c..
.q.Z...k.e.|.F..u..4t-U#.Z!.P..O...0..~Q..9d.'.5....F.-%M....D...8y...
m...C)%<A.7qV..3..L.="....!r.D9[ho..!T..h[u.<...#.'....#..A...YS
....(..V;Jd...gU.dmV.3Q.<n.G.wJQ.%....!........i.*n`...Z0..$.{....!
i.o$.., _...3-K0_../[email protected]./.LM&b4R.p....p....N..IE...*..._H....h.c..X
.u..j_.(.......R......u0$=..D<$.zn2.. ..$X.3a..77W...............m)
.8.#.. ..O.............&.J#.[z...G4.......m.m.P.0....y....LVw.y......W
]ex.2X%fg.y<...h..!.u.)|`....J4U\pFx.Qp..R.L.....>..7.M..g.^c.CD
Z.....*.....C..!.r..N.Y....L..lu.).L.k...r*.....gR.x..g!.......'..&[..
...,....:..-Vh....*.....`Hph...X 8..=n.....B.5.R...\......}....|.....J
...G..k.)m..G....7..^.....6.Z....4..p.0.F?de..(P..1X.q.n...d.......@].
e.~.;M.....Rxwr.ES..V.......R(..8.FE......j..Jkq;Ewr.F...hj..(..S.....
.C......!....T..Y.-...gqR.3(k].o..|.".9.d=Tl..SG...@.&..\...i.j.......
m{xx......2..X.>.>....P..X.n.N.....c.t.....?..N;..U..*.\. Mt..m.
....X$.9.NR.,..."..........EA.....n......_M.3gs..%.*-.$......{....}...
i........./.*M..........UC7..7..9^..P,.r..=j..i.W.5.#...Tsd...$...}A3.
......n.$...@[email protected]!....R>...z.B..M2)} E.S.u(..}. ...p o.pu.X@j...[.
a.jLG.........;.t!..UJ.6KQN.]^..`.m....o.KsCVFp./..*V.sk~- .....#.
<<< skipped >>>

GET /js/excanvas.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:17 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: W/"0c4787172cd11:0"
Last-Modified: Thu, 22 Oct 2015 02:36:24 GMT
Expires: Mon, 29 Feb 2016 09:16:09 GMT
Age: 9769
X-Cache: HIT from ntt-cn-hkg-003; MISS(S)|HIT from gtt-de-fra-099
X-Request-Id: f62e2f57524a2adfc8a335d8c5205259; 5f8d091a491e8cefeaf934a56b1430e7
Via: T.5199.S.2, T.1284.H.1, V.ntt-cn-hkg-004, T.5199.H.1, M.gtt-de-fra-099
Content-Encoding: gzip
383f.............}mw.7.......LH..E..,.qv(....KVR.8.^......l.MYb....y.P
ht.%'..s......P(..U.B.......|.._\..v...}....$:..._mm.....0.e.(....E..L
..<...W....,.q:...fT'.=Wu..S.X.W.4^E.t.]e.p...|.~..a2_F.Y4L...8....
z...~..R..u8..e......(=...x......r...u}}....F.....`.........&HvM~.M.,.
..oW...{...9H..g t._G."./....)I.^.....F.....x....8[..gW....H".;....Yt.
s......:....D.......O.7........q..(..~.;<9|.............mD....In...
.d...d$.;N.p?[.9..{6O.....C.]\..It.~L.3.(.'..8..f pD.&..x./.(..?C_...f
..,:...$.G...D?..%....d.eW.y.X...$^.....x4.'....&.e.^..p...%.Kt...z.".
."m:...I.~`...E`..y. ..E:........$...d<..H..%.X....M..(...h....d.,.
..Q..Mg;..?&.%.1...8.p..9...V..Zg..d.c<.........2.-!..E24......E.t.
8..5.T..t.........bw...0./g......>J........!.J..C.?d...x2.F..>%.
qQ1../....Q_.p..B....E5J......F.O^....z.......BT...m]'g.P.lkx.....t.a.
o.~.a..X .4%.....w.. ....:.o..........F.'.Y...]...-...E.... .... h..l.
..F.0...Q...)s.D.F.4j.H?$.....%T.....s.O...LL....b......4.b..$.5.%....
P.e.....]K..d......,.N........Q.k.....C.X&}..zM...7..e.2q...}......lH%
...Q.j0j.N.N..j3N.4..Du.mX..}........A...4z....=...(.6.),./.....K.R2L3
 .....ZQ........_...*..a._..Wg.||.L..0w...._...4l..../.V..T.....S.....
U.g...x.....E..<....e}..1...............Z..........,wWPaH.....b....
.[....D....s0A........'......b.,....SW$.(....u3...*...m*.\.d.A1l..a7..
.7...........a..h.\G..)....D.g....q!._;.E.j@..)-EC...;..F.HN0D.F5=...R
V...S.......S7.8.R. ....90...X....v.rd.......s.....([email protected]...(.....
..p#.B@ ....y..bR......H.1...4.4pC.......0lv).X..%....k..g.$m..F6r
<<< skipped >>>

GET /js/DD_belatedPNG.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:19 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
Cache-Control: max-age=10800
ETag: W/"09f29a669fad01:0"
Last-Modified: Tue, 29 Sep 2015 03:48:06 GMT
Expires: Mon, 29 Feb 2016 07:27:23 GMT
Age: 7448
X-Cache: HIT from ntt-cn-hkg-004; MISS(S)|HIT from gtt-de-fra-099
X-Request-Id: 7bee943f30ec3fa4c18ed25346b169a9; 3c7441e49b549e6b52385d001769e0d4
Via: T.51100.S.2, T.1285.H.1, V.ntt-cn-hkg-005, T.51100.H.1, M.gtt-de-fra-099
Content-Encoding: gzip
1306.............Z{s.......w8'mAY.(.u.....#.:r.J...........X..E.......
...".x..X.=v...{7|........_.:.J.....#.:..uv.GU,..,/G..*..S].I....K5...
i.-.hOfT.F................e9...:..J..I.s....8....~$...r...9...8..YY.F.
.j..D...)....B..\...E........t...}.O....P.......*gZ.9.r...C....61....O
...".jY.G#....'.}.........y..C...%...B...B':,3....w....l..."...H.....$
..."..._.5....O^_............e....w:[email protected]..<;?..W.L...Jf.
.. T..Hn.&*.y.`."[email protected].)d..y.i..z...^Z...b.7
.p<.^...H=<.g..]...>...[|.b"....\C........\.!.M.iXBMT.G=..s..
`.......^/..~.."%?...;.....g[...=?-n...{[..A.......y:*......<....&.
..|t7O.'.......!..u./gZ.07NQp.......,.......>......9UaPh.deAIfFB..$
....[...:.M.u.. !.4..P...[S*..!fq).....$...<.o.*.%.*.J..X.`B.wD...;
Y.B....Oe.."J..s.5.{.b...<...y.......C......;~P,...H.:.u.:.).......
D..UP..Y...=...^w._..uY.......:....`..M.`.aA...Ey4....aUyy...u..eP....
54.hT..$_.#.........5v..z...Q..D;SP......s.....h.'.o#=..I.-4z..2.K...`
..s..1m}.X...W!yp0......._.x..cz>B..M.T.T.,.......>.q..h...*....
....Ku...8N.r=.......%%....s..1....].,......i...... ...$...[Fi...mx...
..!^.....f..w..:.4C-L/....C?.....}.......;.....F.b.8.2..91.=Qz%.%.c ..
r8...y....i..p,.<..b..8.\.e.....0Y...9....Q..W8.m......c....]..G...
2......<s.:...6..l{..e..;g....5.. ..L.K*N...a....Yn........,.3y...e
e.OA..k{.U.U.d.x.3...#..R.v..Z....|4D.....N..QE..C ....|.....,.;a...b.
K.rYF*[email protected]... .g}.........;P.....}.....ameE~.X$k.N_'u...%.. ......
Eh.. .j............n.l....o../.$m.d..'L....w4V.1...#L.gA.v.:A..v.E
<<< skipped >>>

GET /js/a.js?v=13 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:19 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
Cache-Control: max-age=10800
ETag: W/"0ae424664fd11:0"
Last-Modified: Fri, 15 Jan 2016 07:27:08 GMT
Expires: Mon, 29 Feb 2016 02:25:37 GMT
Age: 4551
X-Cache: MISS|MISS from cun-hz-fdi-149; MISS|HIT from ntt-cn-hkg-014; HIT|HIT(R) from gtt-de-fra-099
X-Request-Id: 480a3e4064ed38a83d541d9391ea564e; 3097355395776777bcfd856f26a08b83; 237538fc6af524255325e9264030e98d
Via: T.51103.H.2, T.51103.R.1, M.gtt-de-fra-099
Content-Encoding: gzip
1dd.............S...0.....`.4v.l..mW... p...!.w&.qb.v.Eh...../.N2.."- 
.Sl.....?..P5..T"(....:U....5...........<).U..o..$~.T}.......R.f...
...gd....<........../...k.u..jQ...kBi..../.......D..!..e.P......w..
'j..lwI.[...#.].1.6.....W.a.;.w...fj.......Je......s.,bM..&.d,HkQ.-...
q.m..g>.h?..y.6....E.....n.>...>.D.....&}...H5...0OWz.~..9.l,
C...4...|...!..G.SB....5`^9..S60.......w.fx..{p.d.......2|..y......zj.
_~}/6oD..5 $.2#..N.j..|..|.....pd.."...t|b.........Nn..;nf.&..D.o.....
._^-.....0......


GET /images/logo.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:19 GMT
Content-Type: image/jpeg
Content-Length: 4599
Connection: keep-alive
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: "0643169925d11:0"
Last-Modified: Mon, 23 Nov 2015 02:46:00 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 10:15:00 GMT
Age: 7280
X-Cache: HIT from ntt-cn-hkg-004; MISS(S)|HIT from gtt-de-fra-099
X-Request-Id: ff83b49d1e756d2f2c7228616322d4d2; ba6a21241b756f98bbd94f71792cc91b
Via: T.51102.S.2, T.12812.H.1, V.ntt-cn-hkg-005, T.51102.H.1, M.gtt-de-fra-099
......JFIF.....d.d......Ducky.......<.....whXXp://ns.adobe.com/xap/
1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x
:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.
157747, 2015/03/30-23:40:42        "> <rdf:RDF xmlns:rdf="http:/
/VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:abo
ut="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:
//ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.
com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:29d323d0-2756-744c-abf
4-fd81ad1f32a3" xmpMM:DocumentID="xmp.did:3F64B101918C11E58D46F891F00A
D123" xmpMM:InstanceID="xmp.iid:3F64B100918C11E58D46F891F00AD123" xmp:
CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:D92DC788918A11E5885987E299F0083A" stRef:
documentID="xmp.did:D92DC789918A11E5885987E299F0083A"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.....................&.r..............................................
............................................!1A"..Qaq.2B.....3.....Rb#
C.4dU.'......................!...1AQa.."2.q........BRb.#3$............
?....-.....K71...H..#cCB>-A....4.....)M.4i.lx..@=..^.r {e.....sDMA$
..O.>:.l..I.....Z..L..ky..li$o.c..J..4#.4....xV,.8.<y\d.og../v..
n...;.A.MD...e.3t.5#A \.N^.............J6..z2......Ovw];.....R#N..
<<< skipped >>>

GET /images/640x107.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:22 GMT
Content-Type: image/png
Content-Length: 13156
Connection: keep-alive
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: "05d43672b27d11:0"
Last-Modified: Wed, 25 Nov 2015 02:45:54 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 07:53:38 GMT
Age: 7607
X-Cache: HIT from ntt-cn-hkg-004; MISS(S)|HIT from gtt-de-fra-099
X-Request-Id: b6bf162f787f09766f4b40ace1d373bf; df1e7a2b2311f82843cbc404fc63388d
Via: T.51101.S.2, T.1288.H.1, V.ntt-cn-hkg-012, T.51101.H.1, M.gtt-de-fra-099
.PNG........IHDR.......k.....h.......tEXtSoftware.Adobe ImageReadyq.e&
lt;...niTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:c96f66e7-e152-8941-89f1-0383de7c7266" xmpMM:DocumentID="xmp.did:
908F0A49931B11E5B0F8B409F06779EA" xmpMM:InstanceID="xmp.iid:908F0A4893
1B11E5B0F8B409F06779EA" xmp:CreatorTool="Adobe Photoshop CC 2015 (Wind
ows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:56F26C908DCF
11E5828AFDFF36F2DA25" stRef:documentID="xmp.did:56F26C918DCF11E5828AFD
FF36F2DA25"/> </rdf:Description> </rdf:RDF> </x:xmpm
eta> <?xpacket end="r"?>....../.IDATx..}..\U..9....t..9.$6.".
D.....E..W#.p......{...{...pE...*.".Oxy.p.."..l.. d.:=wWw.U.......k...
.k...V'...9..........boo..@ .......?.....@ ..D....$.....@ J.$`...@ ...
[email protected] .......@ ....0..@ ..$`...@ .......@ .#.......@ .......@ ..$`..
.@ N.X -CJ4.|{Sh......G.&...x...Z...'Os.q....mc.c.!...bDC..........v?.
H.....>.,..3..Y..s.b..M.@ ....@ [email protected]"....
.x.......W..~..~.;..... ...D ....p&d9.~"........6..m6.e..w...=./0.7...
..7.... .....}.Q.-........g..........V....W..|.....*.XZ.Z......;..
<<< skipped >>>

GET /images/640x107.png HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:22 GMT
Content-Type: image/png
Content-Length: 13156
Connection: keep-alive
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: "05d43672b27d11:0"
Last-Modified: Wed, 25 Nov 2015 02:45:54 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 07:53:38 GMT
Age: 7607
X-Cache: HIT from ntt-cn-hkg-004; MISS(S)|HIT from gtt-de-fra-099
X-Request-Id: b6bf162f787f09766f4b40ace1d373bf; a6e38969919f31f27a48155dc95a6962
Via: T.51101.S.2, T.1288.H.1, V.ntt-cn-hkg-012, T.51101.H.1, M.gtt-de-fra-099
.PNG........IHDR.......k.....h.......tEXtSoftware.Adobe ImageReadyq.e&
lt;...niTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:c96f66e7-e152-8941-89f1-0383de7c7266" xmpMM:DocumentID="xmp.did:
908F0A49931B11E5B0F8B409F06779EA" xmpMM:InstanceID="xmp.iid:908F0A4893
1B11E5B0F8B409F06779EA" xmp:CreatorTool="Adobe Photoshop CC 2015 (Wind
ows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:56F26C908DCF
11E5828AFDFF36F2DA25" stRef:documentID="xmp.did:56F26C918DCF11E5828AFD
FF36F2DA25"/> </rdf:Description> </rdf:RDF> </x:xmpm
eta> <?xpacket end="r"?>....../.IDATx..}..\U..9....t..9.$6.".
D.....E..W#.p......{...{...pE...*.".Oxy.p.."..l.. d.:=wWw.U.......k...
.k...V'...9..........boo..@ .......?.....@ ..D....$.....@ J.$`...@ ...
[email protected] .......@ ....0..@ ..$`...@ .......@ .#.......@ .......@ ..$`..
.@ N.X -CJ4.|{Sh......G.&...x...Z...'Os.q....mc.c.!...bDC..........v?.
H.....>.,..3..Y..s.b..M.@ ....@ [email protected]"....
.x.......W..~..~.;..... ...D ....p&d9.~"........6..m6.e..w...=./0.7...
..7.... .....}.Q.-........g..........V....W..|.....*.XZ.Z......;..
<<< skipped >>>

GET /images/li_bg.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: image/png
Content-Length: 1213
Connection: keep-alive
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: "07460c69010d11:0"
Last-Modified: Tue, 27 Oct 2015 08:23:36 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 08:54:42 GMT
Age: 3576
X-Cache: MISS|MISS from cun-hz-fdi-149; MISS|HIT from ntt-cn-hkg-012; MISS(S)|HIT(R) from gtt-de-fra-099
X-Request-Id: 92401a839c30c480168f2226941a2dda; 9bf0d85a920916b5782639384ab68988; 607c4a351dd534c7b4819543b9fb675f
Via: T.51100.S.2, T.1286.R.1, V.ntt-cn-hkg-012, T.51100.R.1, M.gtt-de-fra-099
.PNG........IHDR... .........jfk.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:15386AEA7C7911E5B975
A8C2336F1C1B" xmpMM:DocumentID="xmp.did:15386AEB7C7911E5B975A8C2336F1C
1B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:15386AE87C7911
E5B975A8C2336F1C1B" stRef:documentID="xmp.did:15386AE97C7911E5B975A8C2
336F1C1B"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>...L...-IDATx...;[email protected]....].K.
......<.G.30..\R~L.:....<.g.s..3.}..............................
........................x...x...x...x...x...x...x...x.................
......xwvC|......p.w.n..|......|......|......|..........^...n.>....
..>......>......>..l.....Ust...x...#>......>......>.
.....>..l..x?..`.k...m.e.....IEND.B`.....
<<< skipped >>>

GET /images/btn_hidden.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: image/jpeg
Content-Length: 1259
Connection: keep-alive
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: "01b23d45c27d11:0"
Last-Modified: Wed, 25 Nov 2015 08:39:42 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 07:47:09 GMT
Age: 9357
X-Cache: MISS(S)|HIT(R) from cun-hz-fdi-150, MISS(S)|MISS(S) from ntt-cn-hkg-012; MISS(S)|HIT(R) from gtt-de-fra-099
X-Request-Id: 9c68fcfb98dd2ab936e69b99f3d5ca7f; 8857abf8eecfa7bdc41bd281d706abe1
Via: T.51102.S.2, T.12814.R.1, V.ntt-cn-hkg-017, T.51102.R.1, M.gtt-de-fra-099
......Exif..II*.................Ducky.......<...../hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-
c067 79.157747, 2015/03/30-23:40:42        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:477C79CF934811E59E75A1
BA537C607F" xmpMM:InstanceID="xmp.iid:477C79CE934811E59E75A1BA537C607F
" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:De
rivedFrom stRef:instanceID="xmp.iid:ECEEFAB18DC111E58232B4B47E18EA3D" 
stRef:documentID="xmp.did:ECEEFAB28DC111E58232B4B47E18EA3D"/> </
rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket e
nd="r"?>....Adobe.d................................................
......................................................................
...........................................j..........................
......................................"......AQq..B#3Cc..5E'..........
....................?...,..y}z...D.F,..I.X.o..!...V......nQh).w.J.....
.v........w.EZ....U{..z..........g..4...iG..)..i.z..........
<<< skipped >>>

GET /images/ewm.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: image/jpeg
Content-Length: 2006
Connection: keep-alive
X-Source: C/200
Cache-Control: max-age=10800
ETag: "06f2999a622d11:0"
Last-Modified: Thu, 19 Nov 2015 08:45:10 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 07:30:16 GMT
Age: 7643
X-Cache: MISS(S)|HIT(R) from ctn-hz-fdi-019, MISS|MISS from ntt-cn-hkg-014; MISS(S)|HIT(R) from gtt-de-fra-099
X-Request-Id: 803f801aae2bf1be5d4426f3af8395c3; 72aafc1daa274f95c5b2db2da1c8c80e
Via: T.51102.S.2, T.12812.R.1, V.ntt-cn-hkg-004, T.51102.R.1, M.gtt-de-fra-099
......Exif..II*.................Ducky.......<...../hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-
c067 79.157747, 2015/03/30-23:40:42        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Window
s)" xmpMM:InstanceID="xmp.iid:834EDACB8DC611E5A3528DF1F9D0330F" xmpMM:
DocumentID="xmp.did:834EDACC8DC611E5A3528DF1F9D0330F"> <xmpMM:De
rivedFrom stRef:instanceID="xmp.iid:834EDAC98DC611E5A3528DF1F9D0330F" 
stRef:documentID="xmp.did:834EDACA8DC611E5A3528DF1F9D0330F"/> </
rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket e
nd="r"?>....Adobe.d................................................
......................................................................
...........................2.2.............u..........................
.............................................!1AQ"2....aB..3S..t6.qRb.
#..............................?..^.......]Z..<. "..Q..J.vp.?.....}
H..3.e7.........<...(.f.!.o...~...%j.U.;J.$.%R..G9e....S..sU.#...;.
.._*...9.H.2..T...~Vn^....;.?....?.L..w;=..j.[TUMU..B  .)$..<.`..jj
X7%.......#P....y...f..9=..G".FH.#.A.~pp.x........N.3.=?g............W
..B". TP.........K..j...1...8.BV5,r......)......~.....%%.........\
<<< skipped >>>

GET /js/b.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: W/"077171be66ad11:0"
Last-Modified: Fri, 19 Feb 2016 07:21:10 GMT
Expires: Mon, 29 Feb 2016 06:04:28 GMT
Age: 8346
X-Cache: HIT from ntt-cn-hkg-014; MISS(S)|HIT from gtt-de-fra-099
X-Request-Id: 0ea38be63ab64dcfa5c5e1e7e700f1a6; 169dbbd328cdf1b6d460627ff953030c
Via: T.5199.S.2, T.1283.H.1, V.ntt-cn-hkg-014, T.5199.H.1, M.gtt-de-fra-099
Content-Encoding: gzip
e71...............n\.......p...\......W...............Zx.2V..A.'.E....
!)..|...-lfx.9$.........?.\.. ..t9..m..y.<y..Oo..W...vz...}}...../.
...Wg......I..........w.....W8_o.W..rs..}1.\.<........~... .h......
..{q.Ym..o.../j5ZW............vE.J...}.....W....v.n...m?........z.....
.z.....k.. ..y...._?.8.....Yk.y.0..rr.Ai..?5...u...k.M....f.8>..V.r
z8..*.....w~.Y.y.....-..y.nuv.<y>...i.._=M.S_..y.G.........D.w..
...j....v....f.>I..cS.............WkZ....o.v.Y...x.^._......._....V
...T.......P.N..f...7...o.2....2\......V.9&...O.....-.H....v..>..*;
\t............. ....n........%|\.......5=.....~..v.m.o..|....H.....y)w
.b:{=}>.|~2}6.<..%.. .O......g../O._.......P.F...48.|......r.eg.
~.rE...QN(G...........q.......l.w.......OY.....W......W.h..... ......)
..O)v|JF...2........'......Kh/...."./......1....._.......F.3......g.?.
......./.?..../.^......T...=........o^....W..2....\.~E.._..2.....\..e.
-.;?.......\.z...f;.9.......}g.;'..._B...%.......}g.;C.....w......1_..
C....e./..o......1C..z....1.......?..x........f...x../............&...
x........T....^....>.........r..QF.........(.....x..q.G.8...x<..
.4.h_.{.........(.....].u.......=..a.x*.w...(.=......x.......=.S...Wz.
e^..Tz.....^.].u.1.*_.v.'..a.....n.3*.6{Tz.e......{}..Q..1*^......F.?.
.*..e;^Q.|..xE..a.....b..B.Q.....>.....ag.v=G............].....F...
..0....)..q.......g..Q..3 .......sV<..m.3....9 ...._z..a.z....|..^f
......l......Y.{....F....2c..X/...z{*..e..Y.{.....Y.{.>..<.....W
..QF.j.6.X?.....^_..F...Y...n.....a.zT.c...q...x2C.3.1C.3.1C.3.1..
<<< skipped >>>

GET /images/web_title.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: image/png
Content-Length: 3803
Connection: keep-alive
X-Source: C/200
Cache-Control: max-age=10800
ETag: "0f1a97272cd11:0"
Last-Modified: Thu, 22 Oct 2015 02:36:26 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 07:34:24 GMT
Age: 581
X-Cache: MISS|HIT from cun-hz-fdi-147; MISS|HIT(R) from ntt-cn-hkg-008; MISS(S)|HIT(R) from gtt-de-fra-099
X-Request-Id: 270bbc650f86b938cb0179dbd3535f36; c626164f03f2889b77e073fc13a38771; 27023f83c268b11f50e5261e4696c533
Via: T.51101.S.2, T.1287.R.1, V.ntt-cn-hkg-003, T.51101.R.1, M.gtt-de-fra-099
.PNG........IHDR.......J......_.3....tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:0DB541A4764511E59BDB
F6B2C709994D" xmpMM:DocumentID="xmp.did:0DB541A5764511E59BDBF6B2C70999
4D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0DB541A2764511
E59BDBF6B2C709994D" stRef:documentID="xmp.did:0DB541A3764511E59BDBF6B2
C709994D"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>.......KIDATx...M..G..k, .=.g..`_zc.).2
.A.0=....0....$f.@"!.....DvAHX.@....,.....i.p.i./Y...\.\"..@.$.0...b..
.....{z.?.iw....?...UUW......,.;.=...i?...... ..)........I.V...G..n.V.
.....'s.....x.Y..U=.....b...s.Y......L.(.o.I..S..|.b....]iO..<54...
...L..........1.......b...... &...Ba=`.^<..n....K.p...3..T.31......
......b...V.Z.. .....x&...{/...MkM*.<.....>YY.......O.Hk1.7..{./
~.......e.&.&....F.m...7k.J.n....p42.3....f.d.. &....-...........{....
i.v....Z$&[.....5.t.C........*...)}2.._'......Qh....xZ]............n.\
..<.....V...2 .#<....px.1.mm..L......(r.bRY..B.............6
<<< skipped >>>

GET /images/web_title.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: image/gif
Content-Length: 2228
Connection: keep-alive
X-Source: C/200
Cache-Control: max-age=10800
ETag: "07460c69010d11:0"
Last-Modified: Tue, 27 Oct 2015 08:23:36 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 10:37:59 GMT
Age: 6358
X-Cache: MISS|MISS from cun-hz-fdi-151; MISS|HIT(R) from ntt-cn-hkg-008; MISS(S)|HIT(R) from gtt-de-fra-099
X-Request-Id: adbe7da5e85cef8210dc8e2a238f20ed; 59f8d301e80f791cf7d8a2bc0f3914e2; 48443ac89896408d28f0bd858e33d867
Via: T.51103.S.2, T.13437.R.1, V.ctn-gd-zhs2-009, T.51103.R.1, M.gtt-de-fra-099
GIF89a..J........@Br....)$.[.w.(y............................!..XMP Da
taXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x
:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.
157747, 2015/03/30-23:40:42        "> <rdf:RDF xmlns:rdf="http:/
/VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:abo
ut="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:
//ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.
com/xap/1.0/" xmpMM:DocumentID="xmp.did:8BE2C01A7C5711E58BBEBA624125FE
F4" xmpMM:InstanceID="xmp.iid:8BE2C0197C5711E58BBEBA624125FEF4" xmp:Cr
eatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFro
m stRef:instanceID="xmp.iid:0DB541A4764511E59BDBF6B2C709994D" stRef:do
cumentID="xmp.did:0DB541A5764511E59BDBF6B2C709994D"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;...................................................................
...............................................................~}|{zyx
wvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:98
76543210/.-, *)('&%$#"! .................................!.......,....
..J....0.I..8....`(..W.E..l..p,.(:.x...\...pH,.~).r.l....tJ.....v..z..
.xL.....z.n....|N.....~.......Y.....d.....i....f.~.C...N.....K.|.A....
...........M.z.<.................E.............B.x.:..........J.v.7
..........F.t.2.......E/..^Dt.Xh`.3"..U.wp`:Z.z!...!.9...a..o./......R
b. .=6..2...7WP../`E{ ..t..%...A>.....d....ft$..P... sf.~M.....
<<< skipped >>>

GET /images/web_avatar.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: image/jpeg
Content-Length: 1603
Connection: keep-alive
X-Source: C/200
Cache-Control: max-age=10800
ETag: "02b375180dd11:0"
Last-Modified: Fri, 23 Oct 2015 10:48:14 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 05:21:42 GMT
Age: 10468
X-Cache: MISS|MISS from ctn-hz-fdi-022; MISS|HIT(R) from ntt-cn-hkg-014; MISS(S)|HIT(R) from gtt-de-fra-099
X-Request-Id: 9c4cd61961e1de89a7d60cb1759e87b0; 788e119aa1da891b109e4ab1eac78469; 009db14637f90548e317e517a3562609
Via: T.51103.S.2, T.12816.R.1, V.ntt-cn-hkg-017, T.51103.R.1, M.gtt-de-fra-099
......Exif..II*.................Ducky.......<...../hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-
c067 79.157747, 2015/03/30-23:40:42        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Window
s)" xmpMM:InstanceID="xmp.iid:74306633795711E5A605AEBD4286860B" xmpMM:
DocumentID="xmp.did:74306634795711E5A605AEBD4286860B"> <xmpMM:De
rivedFrom stRef:instanceID="xmp.iid:74306631795711E5A605AEBD4286860B" 
stRef:documentID="xmp.did:74306632795711E5A605AEBD4286860B"/> </
rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket e
nd="r"?>....Adobe.d................................................
......................................................................
...........................<.<.............n....................
..............................................!1..AQ.a..2b.q..RS.."B#.
..............................?..R.U.!O.......?......'4.F.....(.zF....
 .2.....P..q[[email protected].....}../A.s=u..`;.).E.V.J.......3(5iLT
....8.....>.}R.....7...~.;.....2..q:d......o...y}..JK.@ ...[..."bO.
.. .1.....`.".....fH1/.....mi.R....I...A..-....#.r."...=yu{J..=..$X?..
.@../~..(../~..(5z-[...:[email protected]%A..N.t..EQ..1...
<<< skipped >>>

GET /images/web_title.png HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
If-Modified-Since: Thu, 22 Oct 2015 02:36:26 GMT
If-None-Match: "0f1a97272cd11:0"
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 304 Not Modified
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Connection: keep-alive
Etag: "0f1a97272cd11:0"
Expires: Mon, 29 Feb 2016 07:34:24 GMT
Cache-Control: max-age=10800
Via: T.51101.R.1, M.gtt-de-fra-099
X-Cache: HIT(R) from gtt-de-fra-099
X-Request-Id: 6abca64b74fd1f0ad737971da21781c1
....


GET /js/jquery-1.11.2.min.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
Cache-Control: max-age=10800
ETag: W/"09f29a669fad01:0"
Last-Modified: Tue, 29 Sep 2015 03:48:06 GMT
Expires: Mon, 29 Feb 2016 08:46:24 GMT
Age: 4046
X-Cache: HIT from ntt-cn-hkg-005; MISS(S)|HIT from gtt-de-fra-099
X-Request-Id: 241b00293926ef58acd7135870e94c36; a47ae996f25bbb87ff7a356baaedae30
Via: T.5199.S.2, T.1284.H.1, V.ntt-cn-hkg-017, T.5199.H.1, M.gtt-de-fra-099
Content-Encoding: gzip
600a..............iw#....~>...R@..&[...T.Gj.,...n..%).,....6.."....
....U...=3.9s..M...kd........_n....7......v.;.~k....'...?.........d>
;.v....)x.Z_......I..-..'O....v.W.f7......e._5.|.....w....i.........|.
Zv.\.....y.....:=j.=j...Zw.as.,.Z....;......b.h6.(......X.tw.Nf.......
.....E..].vh.u.....c/..Y1h..q....i...eVvH#..].....l.........?....l....
r.... .....8...&..p5..ZLf....qw.......M.X...Th.7|...u^o7._..>...|..
...f........_.....w..]..7.?x:...;.^.<.n......A.......${....=....{.]
.....Z...o...\...9......\-n....}.-.)..e..M..h5n.e..g.E.}....0..a.;.65.
..lT..2.Thv;......i...g.}..z...Xg..v.2...U..U.R..c$..bTX.Z.8.f ....p.7
......=.]..Vv.o..}Vt..J;..0..C...2.....{S)....R..t.{..%x.e.T..3.#U..^.
...Tr...a..f.>.h1.M.T...bYY.z.....e.._-rpL..u..V....bY?...7....Q...
~.O.....i.s.7g.............,.l....k 0.sMq{.-.Jm62?..F.Ywv....V......uZ
........"....q"....kv.8?f....XA...'C...|>-...........V.8T.....`..z}
}8Y~.....^7G........F........t|2."p...fQ..l|.j._...l.hu......*.3......
.......;.......v.di....V.......... _v[..V...W.......F...%.L..7..`.(...
.4..Q.p.;.N............]...z|.l......./.O...K6..l.......w..B...3.x..AO
..|^..-........4"....N.Td...A..8..u,M..N.]!.._......w.......\.nj.;..b.
...nu......X._N.].Nk..m..^\......*..n...$u[>r.>\.......Q..:.<
...j........S...c.keK..{q........^:..f...F....AI.....)...F..=........=
.^......Q...M.N.C.U.......Go......*....E...v...F;NXb..Lb....t;..I....&
~.V#.t]v.t..N_..N.F.i=.c8..f.ic..wE.e.1.YU......8."P|q.....T<EYk...
n.......(w.M..6.....*.W........#....f.622....-.[DVP.j...."........
<<< skipped >>>

GET /js/imgload.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: W/"089b7c7515ad11:0"
Last-Modified: Fri, 29 Jan 2016 04:59:06 GMT
Expires: Mon, 29 Feb 2016 08:20:24 GMT
Age: 10170
X-Cache: MISS(S)|HIT(R) from ctn-gd-zhs2-003; MISS(S)|HIT(R) from gtt-de-fra-099
X-Request-Id: 1cd10b4bd9697a311ce04f76e95bb1cf; 0e2e811bae758c1571867f6187f6f3c8
Via: T.51102.S.2, T.12814.R.1, V.ntt-cn-hkg-014, T.51102.R.1, M.gtt-de-fra-099
Content-Encoding: gzip
[email protected].]."%..EC.....u.#...!).T
.&E.......8C........|.dN.u.....f...s.Zr/.[.M.. .jq....|...........Z...
.~&.6]([email protected]. ..!...C..p ...YZa.m...c..]E#R..v.....G....jY^...k.8.z
:z.h.js#j...NI....[/T.....Rq1%.j..........j..J.\.cR...........(E.f,...
z\.....HF.2-.Z.KZ..X....k.(......:]F.H#..`.....Mc..|,M.$5...9..p...P..
.....i.b.o..............3*X^..)..1:b8v)......A........`$.'...6Mt.'....
l{...K.Qt.h d......T..nCs[c.G .V.^#\<....R.=.C.=...Z...%.*. ...Vha.
.b...=N..!^....;.S= ..V,........=.]..b.0.q.-^...h.4.D.........9..e.Q77
f...X.Q.....|S [:LU..3..V.5.....x.Z4.R.....x..# l.U. (T`..G....S......
P.# p....;#.XS.....a.74Gw.\.P....6d...'...kr\H..X..r.O...^s..<.;..)
...;S.2.....Ho.MG!.0D./`..T.....X#.6...F......s.C.|.h[.R6!k.....%.*gx.
.....}.6_.7Y....}6..QN.=..:.......][email protected]....>6&.'b.5...-.A...].
.f{.s.7...i-...IX}........j..GsO7|a.........0P6....K...g(..&.....0..font>....
<<< skipped >>>

GET /js/base.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: W/"07460c69010d11:0"
Last-Modified: Tue, 27 Oct 2015 08:23:36 GMT
Expires: Mon, 29 Feb 2016 07:56:25 GMT
Age: 10318
X-Cache: MISS(S)|MISS(S) from ctn-hz-fdi-021; MISS|HIT(R) from ntt-cn-hkg-017; MISS(S)|HIT(R) from gtt-de-fra-099
X-Request-Id: ede7b001315e23b623aff0188398720a; 2e0a66537ca04b0da3e1e4785f380166; 8ff6cda5686a7ad7abd866079dbf3474
Via: T.5199.S.2, T.1283.R.1, V.ntt-cn-hkg-008, T.5199.R.1, M.gtt-de-fra-099
Content-Encoding: gzip
[email protected](...&.g...>.......L.*..q... .....j..E..
....N.m.iK.p{...w...:...(gH.W ;.._......evq/.5.4xD|.b.T..v(..D.....t..
.....u...>....s..C`.....C...Q.V.._U..g....V.u...=.M?....$.=......=.
6d0..P....C........M.Btx.eO.<...!VD6q.P...%....j.]..(....Y..:%.,.ll
[email protected]..!....4-.j.....v......<.V..].;-R./.?.}.....x4....epk.-...n
.wPF[....j6........=........0......


GET /js/xanimate.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:24 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: W/"0c4787172cd11:0"
Last-Modified: Thu, 22 Oct 2015 02:36:24 GMT
Expires: Mon, 29 Feb 2016 07:20:03 GMT
Age: 8192
X-Cache: HIT from ntt-cn-hkg-005; HIT|HIT from gtt-de-fra-099
X-Request-Id: 0040e7425e445442ab8a9362897e8585; f770a0edafacf8570b433490fc66b736
Via: T.5199.H.2, T.5199.H.1, M.gtt-de-fra-099
Content-Encoding: gzip
13d9.............[m...q..*..x.r.Q{....R...SN..8q.J9u..8,..&.X..;.(V.Ll
..e*..WR...R..KD.E...gn......O...`f..X^.{X......g...G....W........_xgr
....;O?..<.pk...........j.{.O..x.g........~....L.rw..?'..l.....o.&g
t;...O.?.z.....'..I..#?.....7.....;...._N..........w?..........~.b0..Q
fM?.>}.......~..6c;n57F...Vs.:..,.$~6J"....."`..O........12?c. ~...
K^=7..]...,...9'.2...e..n..XK..g...........a.......TlT........o..>.
...G...~..'.7.|K.6x...$..l<..Q.C...$.4G..0ts.$..uN.-.....*....FQ...
".o}...N...T.*Z...2,W.9..S..#-..(...9...[...........<.i..]_.....?.*
..`...L/~.....&yor......S4..v.4=..4.~....e.,j.......m5.n..D.Y<l.[..
........j..6..49..a.4.%~.T/8p...'.N/.b..M........qe..7......>}K....
........{...........w'.?..y{...{..M.?D...... ....8y..{.&%..{.)......1}
.6....o.k>../%..{..`..{.....z.....3-.o....H...2Z.\...Mo_.....~.....
.. ..ioDU.U...nY...U...$.V..C6....n..9.? LG..V......'E?.....n.%.Fq...@
\.O..j8.......h.n.>.QFZ..f[....:.D! ,...4r.*...A. M...2..(wi ..7)-.
..4=.....}^`..W7...R.uri.&<E. %...*..:\~...(..7l..*."IU..L .)P.Q .E
..j.......%..[.......Y..x.ONP..,F.n.^..!.."....P.l..3UR..U.|1.V.%A.,x0
?.3.1.0.....R3K.WJ...f7*.>.:}....]........ J.j...?m4."..Y.[.....k..
H...g'.4.w..UOR..J..b.P.n..L................\*..MR..a.fM.lb...Z....I.6
W....]...E...1-m`mP>..q...X...e.?.P.=?.4.q8"..!.......a.6t...D...&g
t;.&....:`..fMl.O.Hb.Q..,........>..*..5.C..{.u]2....)..JH..'.31<
;.....]..Y..p..'..oN8O....]...^.Y^......~..cc....n..x.Y ..........f.E.
.yF.......4._.^2xteL....^.B&bA.<....L..C....).....FY3.a\H...)$.
<<< skipped >>>

GET /js/hongbao.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:24 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
Cache-Control: max-age=10800
ETag: W/"0a53890d4dd11:0"
Last-Modified: Tue, 12 Jan 2016 07:48:02 GMT
Expires: Mon, 29 Feb 2016 07:02:10 GMT
Age: 6472
X-Cache: HIT from ntt-cn-hkg-004; HIT|HIT from gtt-de-fra-099
X-Request-Id: 8ef796819f0ee3c0ca84a491120b9643; c443e32a9dc0b92f18fe320982ae6b32
Via: T.51101.H.2, T.51101.H.1, M.gtt-de-fra-099
Content-Encoding: gzip
bb5..............i....3H..J...efz.]...).......)........=]...=.."V.D ..
`..H."q....#k....]...!.Uw.]..3...h.s..w_........,.u?..z3.G...!.W..9.L.
.{.......C..g.....O&.....x........x6.}/.....%....'.b.AL.sl..Z-........
....:...wV...........".?..0...i..hs.49.j.W....j...Xt.. 7'..(SR$...& .j
.XR...r.D..WX...............:1.....\.@l...$.....E%..Hr.i.6.%..y.....y.
.Z.Z]]/..n....n....s-m...[...Un.....*....T..~......V..z....c....[5..B.
......l`%...........e....8.'>.I....o...h.^..Y..zfWxO.TW....n$.....u
.~......[E..$.-..,..DZ.>%...O...[....=...h.4Wh.z@.....<......{..
4D<.A....T0.C...@{..`m..v.57~.....5......IE3."@F.|?.U.n[..`xdP.U..p
..!.'....8).f?.......z....O.i..GW..]7...h.....s..*.0!.......&.JF.4.>
;.......*.!sa.B.....C.F....P.(..&) *.....7..L..e.!...v&...S .~...l...y
.. ....V......8.._.....-...z..Y....3i....e0...... ...mr.X.....#..AB6]p
x.`.R..d:.a.r[......o.4\..dA#U....s.R....'.....Io...].LF...u......K(C8
......yu....'.].Dw.j...kqiN}u_X_..H_.....[.W.D_.j}e.u.LEzW.y.,..(.....
_.i......Y.l..['.......L>.f./.v.x..H....}.g.......~.]..?.}..g.~.{. 
.....\.|v..<.8.=)..o........;...........}.......?.t}....O....%.m@B.
..dn=....m..c........o...-.8..Dn..nBm........F..y......;...}....;.....
p.....k......~......0....  ..*k...r=.X.9#.......Yj.b.).......7......$.
bOC ..s.EP....t...(a.Lz.)....TG.h..(u.e.-.Z.(....8bU........1.sm^..0F.
.N6k..>........&f"...h..J/.P^.......p.......&...uKk................
p.cA.......:.Z....R!...)....".U..0..`..A.s....q..R.)......;.b...:...-.
...x..h.....8..m..J.4..W8#Z..U..5..........UJ..=...?.u.J.>.F9.J
<<< skipped >>>


GET /tj2.ashx?v=1.15.914.2 HTTP/1.1
Host: updatever.hiv-hiv.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Mon, 29 Feb 2016 09:18:11 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
3..0A0..0..HTTP/1.1 200 OK..Server: nginx/1.8.0..Date: Mon, 29 Feb 201
6 09:18:11 GMT..Content-Type: text/html..Transfer-Encoding: chunked..C
onnection: keep-alive..3..0A0..0......


GET /tj4.ashx?v=1.15.914.2 HTTP/1.1


Host: updatever.hiv-hiv.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Mon, 29 Feb 2016 09:18:11 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
3..0A0..0..HTTP/1.1 200 OK..Server: nginx/1.8.0..Date: Mon, 29 Feb 201
6 09:18:11 GMT..Content-Type: text/html..Transfer-Encoding: chunked..C
onnection: keep-alive..3..0A0..0......


GET /tj1.ashx?v=1.15.914.2 HTTP/1.1


Host: updatever.hiv-hiv.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Mon, 29 Feb 2016 09:18:12 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
3..0A0..0..HTTP/1.1 200 OK..Server: nginx/1.8.0..Date: Mon, 29 Feb 201
6 09:18:12 GMT..Content-Type: text/html..Transfer-Encoding: chunked..C
onnection: keep-alive..3..0A0..0......


GET /tj7.ashx?v=1.15.914.2 HTTP/1.1


Host: updatever.hiv-hiv.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Mon, 29 Feb 2016 09:18:13 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
9..not found..0..HTTP/1.1 200 OK..Server: nginx/1.8.0..Date: Mon, 29 F
eb 2016 09:18:13 GMT..Content-Type: text/html..Transfer-Encoding: chun
ked..Connection: keep-alive..9..not found..0..



GET /core.php?web_id=1254817266&t=z HTTP/1.1
Accept: */*
Referer: hXXp://show.bianya.cc/gg/huyan.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 763
Connection: keep-alive
Date: Mon, 29 Feb 2016 09:05:42 GMT
Last-Modified: Mon, 29 Feb 2016 09:05:42 GMT
Expires: Mon, 29 Feb 2016 09:20:42 GMT
Via: cache7.l2de1[0,200-0,H], cache41.l2de1[0,0], cache1.ru1[0,200-0,H], cache2.ru1[1,0]
Age: 785
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Mon, 29 Feb 2016 09:05:49 GMT
X-Swift-CacheTime: 893
Timing-Allow-Origin: *
EagleId: bcfe56ca14567375270718746e
!function(){var p,q,r,a=encodeURIComponent,b="1254817266",c="",d="",e=
"online_v3.php",f="z4.cnzz.com",g="1",h="text",i="z",j="站໳
1;统计",k=window["_CNZZDbridge_" b]["bobject"],l="http:",m
="1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=
" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&
k["callRequest"]([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k["cr
eateScriptIcon"](n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/websit
e.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnz
z.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'
><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="
<a href='" q "' target=_blank title='" j "'>" j "</a>",k["
createIcon"]([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type:
 application/javascript..Content-Length: 763..Connection: keep-alive..
Date: Mon, 29 Feb 2016 09:05:42 GMT..Last-Modified: Mon, 29 Feb 2016 0
9:05:42 GMT..Expires: Mon, 29 Feb 2016 09:20:42 GMT..Via: cache7.l2de1
[0,200-0,H], cache41.l2de1[0,0], cache1.ru1[0,200-0,H], cache2.ru1[1,0
]..Age: 785..X-Cache: HIT TCP_MEM_HIT dirn:-2:-2..X-Swift-SaveTime: Mo
n, 29 Feb 2016 09:05:49 GMT..X-Swift-CacheTime: 893..Timing-Allow-Orig
in: *..EagleId: bcfe56ca14567375270718746e..!function(){var p,q,r,a=en
codeURIComponent,b="1254817266",c="",d="",e="online_v3.php",f="z4.cnzz
.com",g="1",h="text",i="z",j="站长统计",k=wind
ow["_CNZZDbridge_" b]["bobject"],l="http:",m="1",n=l "//online.cnz
<<< skipped >>>


GET /cpro/ui/noexpire/css/2.0.1/template.min.css HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415691&ari=1&dbv=0&drs=3&pcs=300x250&pss=300x250&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983<u=http://show.bianya.cc/gg/huyan.html?s&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416&qn=ee6118cd6aef5aef&tt=1456737415675.94.1344.1344
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cpro.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:49 GMT
Content-Type: text/css
Content-Length: 1089
Connection: close
ETag: "5667c7a9-441"
Last-Modified: Wed, 09 Dec 2015 06:18:17 GMT
Expires: Mon, 08 Dec 2025 03:26:08 GMT
Age: 6933161
Cache-Control: max-age=315360000
Content-Encoding: gzip
Ohc-Content-Crc: 3267541799
Server: hkg01-sys-jorcol06.hkg01.baidu.com
.....O8V..template.min.css..W.n.6.........h4c;..E_.........%R.a..)./A.
.K.1O.I;E';...s.=.....h3%..o.(JR...F5....5D...&m.....7.2.*..2E...Q...@
...3Ak..e*T.Q..r..5*/Qy....E..LR$8R.i..C."..,.C.-Q#....K.%.P.e....T.6U
.2....k..A2,....~B..b..fa;...eD[.$.8.........(Y8......6...`X.)".?..xQZ
....H.^...w.u...l....^H,Xn..].C....(z{p.=&.e......."&-D._\t$M.".@~.&..
..........n...<#b...Y.a-=..*kU..q..`......I..3..d..d.dgf 3.}.%....2
b..v..aJ.....A<.V.h=..{.)..!..>8I...N....&....<co.D...P....2.
hUs. Ik%....T.\......K..p.\_.?........./?....S[...M....Jk5^,2mT..N....
,.T.'.._H..47l.~^.a...i.jY..I.....3....t.*O..Y...\.i....._..."....swk.
...T...?.]...I...;&...7.4..j....!n.L0\X..q4..'..8.f.T.f.@..}r......t.j
....#.t.T)1w_`:q.'..b`.{6....#..?#.1h|F.K......O.vuy.l..Q...C...}.;..;
..W ...~U...qB..Tq.N..hd...[K...|=r.a...m.."@.....B.......N..h.y......
pB1..peM....._.I.Wu(.(.I#.F............V...C}.Px$...p/Gi.n..K(....O'..
.........BH.W.... ......J..C_.F{....8.O...k.C..F...V......T..B....|n.K
..|;.Z.GC.Ai=......}.=$I...l...\..n..x...........g.<."...p..."[).).
.V`..c6.....{.O..aH.6*.y.&....O.../.Y$....]....|~.......



GET /cpro/ui/noexpire/img/2.0.0/bd-logo5.png HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cpro.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:50 GMT
Content-Type: image/png
Content-Length: 1545
Connection: close
ETag: "5667c7a9-609"
Last-Modified: Wed, 09 Dec 2015 06:18:17 GMT
Expires: Mon, 08 Dec 2025 04:17:01 GMT
Age: 6930109
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Ohc-Content-Crc: 1974033671
Server: hkg01-sys-jorcol07.hkg01.baidu.com
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;...siTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:1cd07f07-f14f-4d1b-83a0-43c485539d9c" xmpMM:DocumentID="xmp.did:
52D26256CAB511E3B696F0231D9BB8CB" xmpMM:InstanceID="xmp.iid:52D26255CA
B511E3B696F0231D9BB8CB" xmp:CreatorTool="Adobe Photoshop CC (Macintosh
)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f6314ed7-87ee-4
c03-a7bf-62894da43749" stRef:documentID="xmp.did:1cd07f07-f14f-4d1b-83
a0-43c485539d9c"/> </rdf:Description> </rdf:RDF> </x
:xmpmeta> <?xpacket end="r"?>.......,IDATx.ba``..bc .`..`..w@
|...........hi.........#>...../_..................T...i.......by\..
..Uzzz.@.. V.;;;{...j|......`.6=,h|.>PQQ.........L...._.....\....._
.]..K.jBBB.DDD>..w.<0..FFFn...e..\`...K........w..../..........o
........P!.........-[...o..]...........e..d......0..o..y...&....).7o..
.[%%%....$A......"..|..=<<.....'O.|.hp....6L..$..A.U__........XB
... fE.466...uk.........Ww....;x......."d....#........^`P([email protected]...
.p&....u|.C..}BB.41.............EL$3B.*'......LMM=.I..0......g`...
<<< skipped >>>


GET /staticPub/js/room/roomFunction_a35552b.js HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:36 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Keep-Alive: timeout=20
Vary: Accept-Encoding
Last-Modified: Tue, 23 Feb 2016 03:29:31 GMT
Vary: Accept-Encoding
Expires: Thu, 24 Mar 2016 03:36:55 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-7
Kugou-Memory: HIT
Content-Encoding: gzip
Connection: close
700a..............y{...>..=.B.p.n.jM6C.-=.........q|...K..Z]M.....1
I.c.C !!.a.S..$.........[...W..Zk...kh.l........]{.k..]..F.S..C..3.. 5
/.=.i..)....._.N%/..-.-g....Ov.^.....#..W,{%..}...y...7.F'....Zi..;Y.T
W.......n..e...]r.^&.@6{..vJ...=s....q...V.. ..#...n..N....,.km~>.g
..g2...n......-g.D....)o.)......_...v.|..v...jV5....TM.=.3......w....N
..w..5...\.o..U_......g"..>x. U.V.V.m....CH...m...Z...S..7=.y..5...
..B....~rG..V.Y?......~.N.7.:..r...Z.. ..8.......SqG.S.....w..=.=>q
"_.c.d.3^.......[......m.Nx.S.Zzq..... ...z}F-hb.s...jn..[..... [..7..
.a].........L6;C.s...p..Nm.kM..^g..9^s..4...%L"..KM.=..I.L.,. ...*.\..
.<...<.}.h....7.-.XQb.Si......qq.D..O9...>...`c4...h......Z..
%_.?x......fiJ.D.......Y.K ..3.<l.k?0U ..O........u.............n..
x.|...Q a1Yn.FE?..c.>R U....z.bPlL..n..e..t..}'.t@..}K.6...s......N
....J.....2.....i..B9.K~ .e..fsnX...UrV...J..NGX.m6ke\(tj.gh....#.....
.0n(..I..b............a...H..Eg..oo...3.....v..........Q.GhC.....g.Z-`
..|......g5....5....'..h....Go;..o..h.].....]..Dn.....2.2.. nw.x......
.E.a<.2.....b6.....<.._.......3.B.....M.e..-0..[.........;..N...
.v...pi.`V..n.v.k...E.....y..8.......,f.|...Z9..j._.~=.H..8 P.....C..P
vt...d..wd.......<.....V.o.(q.........\...#`..1.t..vv...P..f.2.QQ.^
\.I*=y.kT:U<..m..5...8.[.k.......m......D=.....[.....{....v.w......
_}w....w~.}....>....c..C...0..Z.U[..nY.$<...?.p.FO.d.<.......
...o..T.m.s.xj9;..Y../S.2...]T..W*.!.n.\.... .{...n.*.3.......D.kwp...
.Pmy. ......za.w.,p.=;..=u.).x'0..gXi:K.xM..yx...S....'..n..)e..*.
<<< skipped >>>


GET /v1/kguser.js HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: login-user.kugou.com
Connection: Keep-Alive
Cookie: __fx_union_access__=1-1-1; __fx_union_page__=3-3:5-2-2; __fx_unionId__=111-17614


HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 29 Feb 2016 09:18:26 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Last-Modified: Fri, 08 Jan 2016 02:17:00 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
a42.............}.s.XV....5.T).S.~X..r...LM7S..l.C))3.|(KR.Q.$.6......
.b.>..|.]..[...?..=|._.w..zf.........t_..{^..sn]Z......n`.....qw...
...T....l...7...^.fE.L ....,[email protected]..?.qLS........1
...^.C7z1q.......h ..L..n.7Z...ge...pDe......Na.....2.h......-...Zf...
.kk.Ck....Ry.h=..h.L.4t.,.<.:......v.....s.....>q..X-tw.v..#}(..
........=....{<.....'(.7.:.......tZ4.pww.. .y...j.V<......DT.dpV
.............U5.4../..n_L.Zi..;....i..x.....P.i..qg...............S._]
...#7..dv....r5. }.[. ;..Qf1.>.f...D..a.....i..S...kG.&*.L.....x..&
gt;.W2.....X............q...$F..mE.Y)...kE..yU..B..U&N1.......KK...=2g
....O....]R.*%uHS.VV9...}.3.6V..a..&.0.=.fC...6Q.S.WzE..K.;..`........
rY..B..u.M....JS.0j.....I?.Uo3.........T...|.....7q.7...'?...xV;.u....
.Qy.T...;[}........a..u..FV.@.}.......] P..... ..Y...?.0......R5...4.E
...\.-v... ..e.\..9..7.U.Hij.*........#.....g.8...=...(.....;=U....?.g
.K.(..7....,\.j.E...#){tO...=0.N..u...zm.N.[.<t.g.C...^y.=...{..Bt.
.. [email protected].......#....w.g..P...E.....F........&..
[email protected].......(.....n....=.(.a..'...... .$.H....K
L*.'..]...JU L.482F.D.......Al .T{. ..I.....>..#...At.q..en`.'.....
......H..$.G..p..J...v,.t..e(...'..O.D)Y......e....?C..3yI.........L{L
sM..K...8.....0..`.K..............P..m.Q e%...dR..I.[A..r...>.&...^
.H...5..c.3'...3...nL.Y..V..3.nQ..V...;..O.f.Jb".>....* ...cy.%..03
X .........|7g..p\.L;.....^...¹....L...N..'......&b......A.0....1...
.....r.9..N..'.2...r`..Y......:%.i..|.<.....}qvR:.?...).w...U&g
<<< skipped >>>


GET /fxstatic/images/footer_logo_16e645b.gif HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:33 GMT
Content-Type: image/gif
Content-Length: 1968
Keep-Alive: timeout=20
Last-Modified: Tue, 27 Oct 2015 12:28:36 GMT
Expires: Sat, 13 Feb 2016 13:58:31 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-42
Kugou-Memory: HIT
Accept-Ranges: bytes
Connection: close
GIF89an.a....N.................ZZZ.....T.........y.`...vvv............
........|....... .))*l.*|........ccc............h............_......%}
..........}..............P..I..U..)....................K...........u..
.....................k..b...mmm..C...........V........................
...e.......c..7..............................N....h|.C..d...........M.
.....[[email protected]..(..Hu....r........
..u....KKKj.M.........m.Q......L.*AAA..m.....tG.%......S.3.....wELN...
......z.I..z..G....`...CSSS......^[email protected]....~....~.Xu.\..:..a.
:8.~...............y.....\.......\Z.......Q.[..................{......
.c.E8.8..0FEH..(W.W.......g.............g.K......GLR...............abo
..........gH.........q.G........ce.I..S..2...V..7ED.....N...b.$.....Ep
.<<........,....n.a........H......*\......#J.H.....3j...... C..I
....(S.\.....0c..I....8........2... ..."3...b....1.xiZ....%.P5Z"(.([.*
m9....a.N..RG..Q..,[R...xuX...)R.....L.0..r.....)..:..........>.(yk
.......e.........%].....W.s.(Sf....do.Zo....ie.m5...Wj..^....PAl...?..
Ezr.D.j..7u{X1..TVI.......] ..c...V.H$m......[^..R{..`...Q..\D4..f....
..1%.@..%.Y..U..QX..H.>[email protected]..%..!..P.....A;.(.N.......F^Z8
...m..5.HHF$....hT\..5R...VT...X...z..HW..Xg\......iY}L&..V....t.ud.B.
.TcSd.afS.i....A...}.......S.....V]Y..}....?Z=....uH.m...f.c.v.jG.E.c.
....i.m..N..J.N..Z........6u.k.QE.?..zUF..;Pd.2.......m>nu.......[.
X...Y......Q.i.%.^D..hf.]...t.T....{..$.W.i:..n..e|..B.....$........o.
.oKY=7..-=.V....V...."w$.'.sC.US. [T4d`][pNl1...BC....R....c]5B...
<<< skipped >>>


GET /usr/uploads/201511/20151130161134_14413.flv HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ubmcmm.baidustatic.com/media/v1/0f000jioG2SODfD3KlS1j6.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.flv.uuzuonline.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 08 Jan 2016 03:53:19 GMT
Server: nginx/0.0.1
Content-Type: video/x-flv
Content-Length: 1885491
Last-Modified: Mon, 30 Nov 2015 08:04:34 GMT
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 fuzhou190:8104 (Cdn Cache Server V2.0), 1.1 db77:10 (Cdn Cache Server V2.0)
Connection: keep-alive
FLV........................onMetaData.......duration.@#G..z.H..width.@
.........height.@[email protected].@9........
videocodecid.@.........canSeekToEnd.......................onXMPData...
....liveXML...<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&
gt;.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5
-c014 79.151805, 2013/04/09-12:08:21        ">. <rdf:RDF xmlns:r
df="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">.  <rdf:Descrip
tion rdf:about="".    xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/".    xml
ns:creatorAtom="hXXp://ns.adobe.com/creatorAtom/1.0/".    xmlns:xmpDM=
"hXXp://ns.adobe.com/xmp/1.0/DynamicMedia/".    xmlns:stDim="hXXp://ns
.adobe.com/xap/1.0/sType/Dimensions#".    xmlns:xmpMM="hXXp://ns.adobe
.com/xap/1.0/mm/".    xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/R
esourceRef#".    xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/Resour
ceEvent#".    xmlns:dc="hXXp://purl.org/dc/elements/1.1/".   xmp:Creat
orTool="Adobe Premiere Pro CC (Windows)".   xmp:CreateDate="2015-11-30
T15:45:33 08:00".   xmp:MetadataDate="2015-11-30T16:03:46 08:00".   xm
p:ModifyDate="2015-11-30T16:03:46 08:00".   xmpDM:videoFrameRate="25.0
00000".   xmpDM:videoFieldOrder="Progressive".   xmpDM:videoPixelAspec
tRatio="1/1".   xmpDM:startTimeScale="25".   xmpDM:startTimeSampleSize
="1".   xmpMM:OriginalDocumentID="xmp.did:e424f941-95aa-ba47-8b48-bb0e
19cc6270".   xmpMM:InstanceID="xmp.iid:fb6f993b-e47b-154d-965d-2e27f79
ce8e6".   xmpMM:DocumentID="xmp.did:60f4f14d-8020-314e-9b3f-737f0a
<<< skipped >>>


GET /cpro/ui/noexpire/js/2.0.1/oojs.js HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?rdid=2480739&dc=2&di=u2480739&dri=0&dis=0&dai=1&ps=74x308&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x896&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737391&qn=bc8e12d50064a9a9&tt=1456737391050.438.1891.1891
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: cpro.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:25 GMT
Content-Type: application/x-javascript
Content-Length: 2176
Connection: close
ETag: "5667c7a9-880"
Last-Modified: Wed, 09 Dec 2015 06:18:17 GMT
Expires: Mon, 08 Dec 2025 04:16:59 GMT
Age: 6930086
Cache-Control: max-age=315360000
Content-Encoding: gzip
Ohc-Content-Crc: 1071315068
Server: hkg01-sys-jorcol07.hkg01.baidu.com
...........Xmo.6.. ..0..!;_.c...^[email protected]..*[email protected]#j8/.
.q..T..V9y...F.w...}..7.Q\..W@.....'..]...T.F;..Z...o...;HK..........D
...y...w.B9K.b....s9).p.Q73...Y...o..E.U.]...{.u..;.D.-.2...W.j.JP.b..
'[email protected]:...`....V.,.....rw`....~..@8.....;Y..Z}....E......X..H...hj&&.
 ..c\.S.H!.h.......F....N..g-...r*. ...y...c-.z.fE....T...V..X...A.Z ^
.....(.b........t...Z..W..2.. %[email protected]/i...p........
\....Y/$`b...W...O..&Mp....?&.*J....v.....][email protected]...
..F.6j......K#5...I.Bi...^..1R.....V.q5.:..c,..r...)x].z.}.'..J..W.9Dc
.y......I......9....t.<...V...R...QMP.P......m..KQ.....~5......,..~
.&*.:.$..s._..G....J..,$...J.................cb.......O.,Y..!&G...^)C.
L. l.H.M...c.... (8.~.....R.l...w......u......%..M....i4..;..8./.b;x..
../..(.r.....F..$F......KWT...w...%...j......bw.zG:.l...xI.v..w.......
}.u...b..f...h@..[...#...d....yy.U,.....m.-l....!..$?......!.).br8y..N
R.Fm....6....*:...... .....p..n..M.......=p..A>...J....B\..@..!p..w
.,.j....O.5.T....0....{./..I..Mj.........d.,..N.....wX...7.1})b../.U(7
....O...s...r...]..d6i.B_&...X.............|.&.?x..$s...J#{.KF1.0R...7
=}...S[.h....=.`.G.....'^..]..>.7[[email protected]`[.Y...Qa..~.C1..2.fz.U.0
......!..9E..G.|..Sxr8.0...8"...4.B...............i....N.G.4.|...N.$..
1.vN..KE......k.,..A..|b..f....{......).I.B.A..3./V...mi...,....`.?...
.....C.......-.b.uP..5Q...Dn).F.......C.byb/.bX.A8.OJ...k...H.......s.
6Q.^.5..{H.^9......../[email protected] .eW.$... .. .T.T.2.........v...`..
..Na I@.<...,[email protected]
<<< skipped >>>


GET /api/tongji2 HTTP/1.1
Host: load.hiv-hiv.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.1
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Mon, 29 Feb 2016 09:18:16 GMT
Content-Length: 2240
A828208807FDDAA61A35E4193E63348976067F09C46C0F9B602AE54A59660DEA6C4CCE
6D2D49256AB58D08B1BAC1EA090AD8188B2B108A1F143A663157CDBB8803F2B532DB5E
256C6535FA69F2AA1E5A5996EA8AAE3A2A9EA3206E6E8BC8A00C4EC07DC5779BAC7B08
B4FBD8AB0814F5D1BE79F147EE8D3D659F9F72441B0CC9448BF8D58C54B5EF8F80BCC4
6A16241DBF1D87A4D33F06C479D4DC8FB8B78E3A291455A46CD35133FBE21AA1787E5D
B82BCA50A5CACE6B1A33ED8F2853DD4F438910559C0141E269D7B950F039C2DD20C9E0
B57E599C77EDC62577E3125A6444568E7F04C04F1145F0D2A46306AE62E599CBE6607C
5806860BFD63A76CE0917B6629BAFD9E87E2CE452D3EADE64C58DE0E0DE403F930468E
01CA461A85C72CEA3AA32B0BD1325ABD2A34D7AF45B037154AB479E8CE89EE0CB74232
E9CBD2E0B1473190975B70B2014405CF36FBEEC4A024A584DFBA961D04B6ACB9F0EDC1
7F2B622B8906D086EA055E8769DE920FC002FD279846ED0E67303216683AE6369E9547
2757DF72257B93E84DD70AFC3A5A55922CA598025A906DC0625589B66B65370F05CAA7
44520E06D58AD3398A1681ACE30AE5EE6DDC964B47FF1C294A670A3E45205D866B1183
B0820F6AF90ACFD89CF34246CE43919D6C1AA8740C05B265901DA084A1427E8D5394D0
1E6DAB743B2113840C4C8F4A9DEF635D92B85D1B75794DDE245B945CA50D2AFB64AD78
FA761F3C5B6298D593DEE51DF6486FCCAF6FA81F2194D606E98F890F7EAC49C603B802
89F4E73BF941E42461F8A2E33A40FA3DD3AD8F6CF176B0FF56A2CC850141914347E313
99E8B29C44B79B3D736B9CA14D0B8861DC32598CCAED8B2A35208BE3DE7261B59A458C
3A20C3461076C0717B73EA216B2B8FE1C43BB46B6AE9F7A318C112D5B1D6534B470294
4914757F338C53912BBACC0F5DFE0CFA4CC08FD2BDB986C187B436835B2676510AB459
57C1063C45205D866B1183B0820F6AF90ACFD89C04831B431DC870E5A9E34A4041CA48
0FCE1402EFD57B17130ECCA9BE245BF41E187BD0051ED6002A6DF9CA30B22DD318
<<< skipped >>>


GET /API/GetAdvConfig?param=v1 HTTP/1.1
Host: as.hiv-hiv.com


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.1
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Mon, 29 Feb 2016 09:18:18 GMT
Content-Length: 1088
11451DEE59847C66D6ECE7845E5A64CC28E022E34D1A789239F04BA87023155827D872
AB2DA8EDB42F0CEE91E674D9EF185520DC0DFFA202E0BF506510A4AF9234633B23C8E7
EC992E1ED7A77D36405BDBAEE0D4C8079495E7DF7D394FD464ED96261C8E967DA753E9
0BC53FB53F3D12102C585B25D76B18F1F1AE645D585DD9E6E71F3695377E348FC3C297
37AEA237C1BAFB8B5A3B3280F22375AED7276E56260D47110DB4AB00AD96B3E2EC4EF4
BEB80A63ED293B83A4263DA23310B1046AE59B9831A13D0CE00CAE48A66B2D3DA841B6
5AC2CBEB02853C0EA6FA9D8B7787710FD9152AD1ECE8FC5396DBD0015B1AB1F27E7AA6
8E10BC3C1E9601E18E4C5AB3CDBD32ECA4225B8BD40E12C5A0AD25ABE74D98AE4D965D
4D8EBDC26C4D8A282C686C9106EA42BE7DD18076D4AA855353CC51C1B53A26B3296ED4
CD2181B3DDE88160D1187A79C3B44B387C8B0B3C9A85B0CAADC5883D45817D0A37A85D
D4536631A853E2B845DAF208A5CA672A9F4FD09D3FCBD46DBE4925F31109DC24B74AD4
DAD6F2D9571B30CD517F9DF119B0D4E6B2712111B934FEBD468BC51B1BB0B8D01EB679
884F65A1770AB939E55FF453D53D4A035FA3957D25F9CC3FD34858DEC6552564481470
358655050B45E15174EE66E7510BA35974254A39EC197D1F1E178A5026CD58FD518924
F805FC532766CD76B536AECFCBCCD10D3BCDF37F03648F63ECFC29B397143BB2293AB8
B70B69E8F57E2B7BA7A080946C8EDD10812C8BHTTP/1.1 200 OK..Cache-Control: 
private..Content-Type: text/html; charset=utf-8..Server: Microsoft-IIS
/8.5..X-AspNetMvc-Version: 5.1..X-AspNet-Version: 4.0.30319..X-Powered
-By: ASP.NET..Date: Mon, 29 Feb 2016 09:18:18 GMT..Content-Length: 108
8..11451DEE59847C66D6ECE7845E5A64CC28E022E34D1A789239F04BA87023155827D
872AB2DA8EDB42F0CEE91E674D9EF185520DC0DFFA202E0BF506510A4AF9234633B23C
8E7EC992E1ED7A77D36405BDBAEE0D4C8079495E7DF7D394FD464ED96261C8E967
<<< skipped >>>


GET /staticPub/css/common/head_0511e83.css HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s5.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:28 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Last-Modified: Fri, 19 Feb 2016 03:50:44 GMT
Vary: Accept-Encoding
Expires: Tue, 22 Mar 2016 03:11:45 GMT
Cache-Control: max-age=2592000
Kugou-Memory: HIT
Content-Encoding: gzip
3409.............}k..G.._.sc.IGR,>.l...l.x...7..,..Q$..ub.4.Zj.....
..Y.E.d{N.n8...|D.;"#..mu....J.z.6...n......x.Yo;...^w......-:wi.n...v
.F..q.n.9...f...l.|..a:...Pu.....y.9t...../..*.Tw.j.t..o....s...bw;...
l......:?vW..6;..\..H..<d n.g.....S..Jo..F=.e.Ye....:...^..yg..u..N
Y...[..}v.....f...e.q..w..l{C.|....j>..O......(}.]~.)..'\q7.....6.T
...d...|...........~._.L.M&..Qc.PU..Fm.o...0............/..*....y.....
z._..x...Xd.....u..x..`...O..~.1...`.....}&=..o..U..:.......C.........
f.p,a..}.....G.w.M.$=<&.~[...U...e.zw{.?.....fs..XWw.t4><..tH
....o.]..?8VJ...%h......(...Ov.Q... .;...L'0...*[email protected]=..y..!
...a_.....1.fU.>....9...Vp.f.....%...<...........p`V..ph......k.
..3..`.o..mu...o.]G...b6......?V...u..N=XL....a.?.w.....}.^o.So.X.....
~...A~t..Y.{z_...............U..3...,.u._.-.%..C.......... ....."...-v
..q....Y.~8n_.U.a..u....w...z.....cY..W....6/.oX.B.[[email protected][l^...}...&
[email protected].\.$j(..'|.2B.wn.u..'".*0...E..[m.....n.os.j..pd..&Q..W..)..
........U..z_9. ..N A8!O.!4=.......x.r.!.m.NV.h@@..o...5;v......1...u.
.e....>.m..w.nB....i....N..04..GyzDu.xLc.GDNw.1.3{G...J..6C....9...
f.........B...._.M.&p...G`a.\d.....e...O7....]Qu.c..}GO...L.;.c./o..._
/.)/4..2 .{...q.?..R......({..w..C.g.c.}8.x......... .4.k..H..>0..2
I.P...P.}.-..%O.N.....!c....<.....*......m_g.)..R%..c~...7.......j`
..ix^?!h? d.....E:.N...w......{..yV.,........[......-..o..=j.......97.
[email protected]~6p_u.`nP.?...~....m:|...:..Q....u.0.|....{....rT_
...W..i...G.......3P=..Q=\l.4..._"...........b...h9..Q....T.......
<<< skipped >>>

GET /staticPub/css/room/room2014_72f51c4.css HTTP/1.1


Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s5.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:30 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Last-Modified: Fri, 26 Feb 2016 14:41:06 GMT
Vary: Accept-Encoding
Expires: Tue, 29 Mar 2016 09:43:39 GMT
Cache-Control: max-age=2592000
Kugou-Memory: HIT
Content-Encoding: gzip
700a...............rc....*[email protected] ......"^>..
...7...y.......q...V...]I..Dxx.....4..o........}.....a.~\..6....%.....
./o..Y.z....9..._^..U.7.]{;.....x..m..7..E5..'...f.......zsy2....^..7.
j...g...e..a*...n1..^.......7...s.5.~0......i.n..&....b:^>.X.}.5.z.
~.-....k....9!.>.e].......b..u......,..:..z..q.../.......j...g.....
8_.h.........O.}.I.P.t;.......z.k...z3.-..K.v..{zz.4..E.....2V......:.
m.(.oZ..U.n.WP..g...!.....-..rsY...T.-....v...W.....o....a.......V>
M......`0..>l.D..j>~X... 0.|3....^.)........xs.X]v[.X.k]..Z...VO
....z.^/[.)m.G.L...o...6...O.9!...............V....%......_t.....:..[.
....z...n.....x{.r.^.>...d#...H"....V$...]..m......?...}..X_~k....L
....a.......s.0..R..?V.=..g.....O.......e.~X-l=#........#ZL......aW]..
].O/..e5.]........Y......W".......$"..c..\.H... .<.O..a>........
....Q.....&.......~.2Z...W. ..n..X...U..x(@...... &k....fuyGZeI._..5..
8.$....h Q{...I..w... .T2.......N..$[.y.;..6.........2.O.....L.W...t..
p.9../....xy.;.F?..i....0.6.y......?...' ....`rvn2.~....|CS...%...2.t.
mDm...[...Zz.D4Uxv... ;SF.Y...w..=....!L.2...].@'.."..I......{.....YM.
..U`......^.=......`...$qzum.`-,_#;....?..l:.M........dIkK....tx..^.e3
]..?o....uo W.C/.....GF`. J..n.$...*X.f...^..... ..W:\.. &..v......n..
l..........m.....-.O........o...&k.aqw.....].9.......~.....@P$....T.LL
...Ow.l1n.;PU..x5k}s.X.u..9...~<~o..a.|...,).n..._.,!. ..N.4C..QB&l
t;.Ys..9..T0~.`...wFb.m.l.^....*{....i2...3.....L5K.g<.W.....].|./k
...h.)g..2.?nSF.M.u{.w.T.S.......lW.5P....P..^.i*...1I.D...z..U
<<< skipped >>>


GET /cpro/ui/noexpire/css/2.0.1/template.min.css HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415659&ari=1&dbv=0&drs=3&pcs=296x249&pss=300x253&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983<u=http://show.bianya.cc/gg/huyan.html&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416&qn=2f8bbc640f2a4043&tt=1456737415628.141.1360.1360
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cpro.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:49 GMT
Content-Type: text/css
Content-Length: 1089
Connection: close
ETag: "5667c7a9-441"
Last-Modified: Wed, 09 Dec 2015 06:18:17 GMT
Expires: Mon, 08 Dec 2025 04:16:59 GMT
Age: 6930110
Cache-Control: max-age=315360000
Content-Encoding: gzip
Ohc-Content-Crc: 3267541799
Server: hkg01-sys-jorcol07.hkg01.baidu.com
.....O8V..template.min.css..W.n.6.........h4c;..E_.........%R.a..)./A.
.K.1O.I;E';...s.=.....h3%..o.(JR...F5....5D...&m.....7.2.*..2E...Q...@
...3Ak..e*T.Q..r..5*/Qy....E..LR$8R.i..C."..,.C.-Q#....K.%.P.e....T.6U
.2....k..A2,....~B..b..fa;...eD[.$.8.........(Y8......6...`X.)".?..xQZ
....H.^...w.u...l....^H,Xn..].C....(z{p.=&.e......."&-D._\t$M.".@~.&..
..........n...<#b...Y.a-=..*kU..q..`......I..3..d..d.dgf 3.}.%....2
b..v..aJ.....A<.V.h=..{.)..!..>8I...N....&....<co.D...P....2.
hUs. Ik%....T.\......K..p.\_.?........./?....S[...M....Jk5^,2mT..N....
,.T.'.._H..47l.~^.a...i.jY..I.....3....t.*O..Y...\.i....._..."....swk.
...T...?.]...I...;&...7.4..j....!n.L0\X..q4..'..8.f.T.f.@..}r......t.j
....#.t.T)1w_`:q.'..b`.{6....#..?#.1h|F.K......O.vuy.l..Q...C...}.;..;
..W ...~U...qB..Tq.N..hd...[K...|=r.a...m.."@.....B.......N..h.y......
pB1..peM....._.I.Wu(.(.I#.F............V...C}.Px$...p/Gi.n..K(....O'..
.........BH.W.... ......J..C_.F{....8.O...k.C..F...V......T..B....|n.K
..|;.Z.GC.Ai=......}.=$I...l...\..n..x...........g.<."...p..."[).).
.V`..c6.....{.O..aH.6*.y.&....O.../.Y$....]....|~.......



GET /stat.php?id=1254817266 HTTP/1.1
Accept: */*
Referer: hXXp://show.bianya.cc/gg/huyan.html?s
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s95.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 9941
Connection: keep-alive
Date: Mon, 29 Feb 2016 07:57:26 GMT
Last-Modified: Mon, 29 Feb 2016 07:57:26 GMT
Cache-Control: max-age=5400,s-maxage=5400
Via: cache16.l2de1[0,200-0,H], cache54.l2de1[1,0], cache2.ru1[0,200-0,H], cache5.ru1[0,0]
Age: 4880
X-Cache: HIT TCP_MEM_HIT dirn:4:460058701
X-Swift-SaveTime: Mon, 29 Feb 2016 07:57:29 GMT
X-Swift-CacheTime: 5397
Timing-Allow-Origin: *
EagleId: bcfe56cd14567375266431306e
(function(){function k(){this.c="1254817266";this.R="z";this.N="";this
.K="";this.M="";this.r="1456732646";this.P="oz.cnzz.com";this.L="";thi
s.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" 
this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la(
)}function g(a,b){try{var c=.[];c.push("siteid=1254817266");c.push("na
me=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer))
;c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.user
Agent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.ra
ndom()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}
catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURICom
ponent,n=unescape;k.prototype={la:function(){try{this.U(),this.J(),thi
s.ia(),this.H(),this.o(),this.ga(),.this.fa(),this.ja(),this.j(),this.
ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.pa(),e[thi
s.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},na:f
unction(){try{var a=this;e._czc={push:function(){return a.B.apply(a,ar
guments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;
if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b 
 ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object S
tring]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAu
toPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch
(d){g(d,"cS failed")}},pa:function(){try{if("undefined"===typeof e._cz
_account||e._cz_account===this.c){e._cz_account=this.c;if("[object
<<< skipped >>>


GET /it/u=1568043101,2080188669&fm=76 HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?sz=300x250&rdid=2355443&dc=2&di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=02ff9997d2308bbb&tt=1456737391050.1781.2172.2172
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: t12.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: image/jpeg
Expires: Wed, 30 Mar 2016 19:18:26 GMT
Cache-Control: max-age=2628000
Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT
ETag: 84348b1d18dfd491f586ac6b02eaa10d
Content-Length: 53221
Date: Mon, 29 Feb 2016 09:18:26 GMT
Server: lighttpd
......JFIF.............C..............................................
......................C...............................................
............................."........................................
...4...............................!"..#12.A$3B.CQa%5q................
.................A.........................!1AQ.."a.q..2....#B...Rb...
$4r.35Cs...............?..Fk....~...l..m?]6.E$o.zL..).SPt..'C...h..z..
.....H..........7.e.j9.y.....eYY....i..QB.....F../....h.z....^.Q.G....
..6............T........I..%#.4."........~./$....b......)..E.Q<s*v6
vw.wB.i.4..4.U4.Ud...:. [email protected].^{.....D.UC.
....(O...;.'!j...uZ....E\..e..U.X..b.]....G.:d.9.....f..b.L.N.b.,...)v
Zw,m!%.sm.YJ..h'R.c[*.,.k.gX.5|vg5d..6.A. ..........g.:6.....2S_....6L
.PIN{...8...>...".^K..=@.<)....yBsO,...Q.I..`.eYmd...bd.7..q.<
;i...B  4*-E..C.TUEs.. ..2.|HN..X.D....1.}.H........9o2.....W...\?....
3d.v.._..m..m................Ax.[@..2..?a..E[rP/...p.....s.x...O.|.*..
..EDE.^| ..".T...)Q.mT..\.f.C...Fh.....UG.......$J.z.....ye/*.....iY`.
Y....9.uu.\.VdV....,......=....a.k./.......4..J-...8..<:*..........
"..0"..2V.4.(*@...pI.q..G.U........."Pl.#Z...G..'.6....E4.....h*.,..m.
.(...>?.Q;m..R.\u....../d.U...l.H..1O...Y.q|..F{...... ....:.I.~'."
...............z.?..yp.~.O....'I........c..45..Z..........69zI......l!
K...w.z.l..0.P|..X........u..Q......_...)...|~>...K..r..*s.-...}FC.
RV;"l...{-....l[l..m.......)..dB^[tVHH{..$......Q.7.`.... ......f-'."N
. a.....$H.C....Tgz.h...*...... o.1.....E.AB..A.!.l.L.....m.nt=...
<<< skipped >>>


GET /staticPub/js/room/swfobject_dc734ee.js HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:33 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Keep-Alive: timeout=20
Vary: Accept-Encoding
Last-Modified: Sat, 30 Jan 2016 15:11:53 GMT
Vary: Accept-Encoding
Expires: Mon, 14 Mar 2016 14:08:31 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-7
Kugou-Memory: HIT
Content-Encoding: gzip
Connection: close
907.............X.o.<.. ..R{q.tw{wa]...[.....V..d...@...^......M...
.k......g....<.E..`.*l.^V.-....-{.q..^p....p.....z.T..\,./....O..B`
4..."........ ..;x.Q..>".#.%.a.}..3.. ...$;.K.....B.B......K.b.'gw.
\.S.R..:...x....ycLv.\\.s.......Q.d.xA. ..Hn."x.=..q.1.t.ER."....~..y.
.D9..IG.#Q ...2y?._...Rr...(!.....O.-6E....\...h....L.;.K..6&..h..Z...
3.....s1.6...!..).I...4.3.P./...$.[-TS.R..7=......-&....^...W.!....y~.
.........2.d...A`...9...2...".....k..R.`j.."...{......`.5=..qC-h..c..!
.A.}..-.A5.....5..J.~Y....&.hvH......|[email protected].. .......1.l.`%E.m
xw....M..#.........wy.?....N.m....g..8.......?.j...u...5......9G...G._
.,`%......^.....>"......2.& .F.*.^..~..~.C./..*.Y.Yq.......cR6..:..
[.H.....U.C.. .......2......... cT`l9.v.c...8.`..C.F.r.-.,.6>"....*
w@.&t.B...P....KRl.f.P._.....v../77......k.\&.K.C..C..H._-....)......\
.....O.4.....B.Gs.....Z.=...G.n.C.apL...%V_.."4.. .m=...`..2s...<..
\.....b.N........5. .A&l.q...=[.X.....h...,.$9W.l...1.n.6.........IN..
.~.............Wa.v.?.ng .....HM*.*.u......#.S.Z$......=..4NC0..r.z...
.....:[$l"..:Z.*...GR.!.6.(.....x......V|6....H3Y....\!d.Y.0*#.C......
.!.....f.]).t..n........#....%.U.e.0.EU.....R..O.y...P.n..T>.R.r.. 
#.K.8fv..^.M..-.z....d.*........<.....!F.C.N..z.B..\..B"OB...0f...-
..3"p|:.n....F}?...l.zAo.Z..x.|[email protected]....$..d..1z.[..9.
&..<...)......`M{.....>.w..0.......6c......z@..._.......\.%.e.yE
Q. R...\Q.V)* .St....H..S...N... mH.o....Y..l.RD./.Kk....`......d..txE
..)....x....K..o.CB....N.?..$]b~8jRt.... ..:.5..([email protected]......
<<< skipped >>>


GET /acom?di=u2480739&dri=0&dis=0&dai=1&ps=74x308&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x896&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737391 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: pos.baidu.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 863
Content-Type: text/javascript;charset=UTF-8
Date: Mon, 29 Feb 2016 09:18:23 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon Feb 29 17:18:23 2016
P3p: CP=" OTI DSP COR IVA OUR IND COM "
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Pragma: no-cache
Server: nginx
Set-Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1; expires=Tue, 28-Feb-47 09:18:23 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1
X-Xss-Protection: 0
BAIDU_UNION_define({"tuid" : "u2480739_0","queryid" : "bc8e12d50064a9a
9","placement" : {"basic" : {"cname":"54010049_cpr","flowType":1,"rspF
ormat":1,"sellType":2,"sspId":1,"tuId":9223372032562289251,"userId":58
93023}.,"container" : {"anchoredType":1,"floated":{},"height":90,"size
Type":1,"slide":{},"width":960}.,"fillstyle" : {"backgroundColor":"#FF
FFFF","cloudTheme":{},"elements":[2,1],"flush":0,"layout":[1],"lu":{},
"search":{},"txt":{"cbackground":"#FFFFFF","cborder":"#FFFFFF","cdesc"
:"#444444","cflush":"#e10900","ctitle":"#0000ff","curl":"#008000","num
ber":4},"video":{}}.,"userdefine" : "cpro_template=text_default_960_90
|cpro_version=2.0","complement_type" : 2},"extends" : "","pdb_deliv" :
 {"deliv_id" : "0","deliv_des" : {},"brandad" : 0},"order_deliv" : {"d
eliv_id" : "0","demand_id" : "0"},"rtb_deliv" : {"deliv_id" : "0","dem
and_id" : "2480739"}});HTTP/1.1 200 OK..Cache-Control: post-check=0, p
re-check=0..Connection: keep-alive..Content-Length: 863..Content-Type:
 text/javascript;charset=UTF-8..Date: Mon, 29 Feb 2016 09:18:23 GMT..E
xpires: Mon, 26 Jul 1997 05:00:00 GMT..Last-Modified: Mon Feb 29 17:18
:23 2016..P3p: CP=" OTI DSP COR IVA OUR IND COM "..P3p: CP=" OTI DSP C
OR IVA OUR IND COM "..Pragma: no-cache..Server: nginx..Set-Cookie: BAI
DUID=7522433194E1483BE40AA19BC31CFACF:FG=1; expires=Tue, 28-Feb-47 09:
18:23 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1..X-X
ss-Protection: 0..BAIDU_UNION_define({"tuid" : "u2480739_0","queryid" 
: "bc8e12d50064a9a9","placement" : {"basic" : {"cname":"54010049_c
<<< skipped >>>

GET /acom?di=u2355460&dri=0&dis=0&dai=3&ps=1233x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&sz=300x250 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Cache-Control: post-check=0, pre-check=0
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 599
Content-Type: text/javascript;charset=UTF-8
Date: Mon, 29 Feb 2016 09:18:23 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon Feb 29 17:18:23 2016
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Pragma: no-cache
Server: nginx
X-Xss-Protection: 0
...........SKn.0......i...(..]x...x.......hrd..D..'...d.{...M{..I7nV.B
.............j.qUKhT./...%.....VM&.).))...vwtT..............t....'k...
W.....L...t<..`1....j7..,.u..............K..>.....:g.b.) .......
....YEYuxQ.az....(x/ZcA>.........iAmZl>..P}..(....s..o..........
..|.......F..tG.. S.M.W-.)...U=...^E.X.t..#..Z..,...KD..6DH..L@x7%.u.e
..J..3&..C.F.s......;$@#..V.....1.k...?q...s...&..h...-G.d.%..(....q.#
..i.)X...4.4..U........8.>....;.....7`".8...,.$D...=t.>....>.
...k.S=..SD...(..lP..".....9*O...z.....d...S._.....via..2A.,...C/]....
\#...Y..Z..O...8........) .0.....f.,.d.sM.O9.nr8.z.............
.


GET /acom?sz=300x250&rdid=2355443&dc=2&di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=02ff9997d2308bbb&tt=1456737391050.1781.2172.2172 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Cache-Control: post-check=0, pre-check=0
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 7172
Content-Type: text/html
Date: Mon, 29 Feb 2016 09:18:24 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon Feb 29 17:18:24 2016
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Pragma: no-cache
Server: nginx
X-Xss-Protection: 0
...........=k...q.. .... v...{q{,...GZw|.I.E.j......B..{..R\NlG....;qb
[..UI...T(....R>.G..#.).!=3....;F.#AG..L.tOwOw.L.i........M........
....4x.....w.....].]...>p.....2*}RXW.w..g.Q{.vtW.......gx...m.2r.M.
..zc.R.u..}.%.<...k.K/1.y....<|.....|..R.....:...3.`.....Hrm.7..
%.q%...e.*k ...^WG.c...2.^.....D.r............{......r........z.m.....
.mt{..>.......X....r.2aB......Y`..>#.?...IO.8........6Rw..5.h..6
...r>..m GX..0.5.Z}R.........[...n^..91o..H.[.~.e.u;7.t3...m}.#.1..
.......&.@....&..BEa.....~n.Pm..:n.a.{...l!M.....M]S\{.s..*..L0.9..1.n
.n....(...z .&a..Y.a...z..0mK;...>[email protected]..<vP.0.dd.......0
.....w......;.....yG....#`.?.. .(....j..`..}d.......96.'.....X0n[60.$C
jr..x...L......[.|(D^5....T.......k..Vt....XM...c_F.P.1y.a..........s.
B..6 :H.o.m.....B...].1..i......'..D\..D.)Y..._o...>.?.>.....Zy.
n..R.[k..,..zV.q........z".....F........F..|0..D=.9|..=....i.&...v...U
2..)..M..Y.x.[...V~d9.b^...Blk-<j.R-K.N.....D..Q..Z........n<&..
..X.h.A..K.<fF|E ....... ..5&-..;..^.JB.z.$=~..Y.M.~......JY...O...
..Z ...Ny.J...`b^........=4Q...|.......gmD}.Ez..,..=.....][Z..]..(..h.
6vi.Hg.........d.H...{....I...U.t..vi.pC.rq[..z..}oCj.o......r{.p.^..y
. .._:....W.....va.P.7V.5T.fm....m.Bc}....4...#..)..n.-o.m.mJ.5.....Ms
......us.u..hkKs..ek......Mk....;.j{j..wgK.o...a..u....m.k....X.......
...[...R....7.^.A...6.o.l..v.q.,[email protected]...;.....va..-.;Wa
..8{..m<........5...m.e..*...Y.!.. #.jY&.....x..b2@9<y.^u."O..x!
.j.C...".A..(..c.mh...o.EkBi&8..e#..C$.4.D...........2......H.....
<<< skipped >>>


GET /staticPub/js/room/roomBase_f6883f0.js HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:34 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Keep-Alive: timeout=20
Vary: Accept-Encoding
Last-Modified: Fri, 26 Feb 2016 03:53:52 GMT
Vary: Accept-Encoding
Expires: Mon, 28 Mar 2016 08:13:51 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-42
Kugou-Memory: HIT
Content-Encoding: gzip
Connection: close
3638.............}{w.E....S8M.-...~%...J.._....cN..jI-....Q.a....f....
.0...a......u ...f,....p..........9.3g1.....k..].....J.nZ..V.........n
.#zt..G.(..>.7.Y...L.4*.hS..d5.X.W...Y..F<.W..J!..(X.x.*'..^7.s.
L.n...4{nbl.....8^L.4%vJ...5.......Q..=..L.t.meM-j vV/.i.b........:.(.
.l.0*i.^k8...5.Z?.....V.RK_...U.rh..(..^...5......Bc. ..FMQ z...7k....
y....F9c...=.......IV..U......'.I. 0..e,Uk.c..,.J.0E-.E..]..O.|...w...
3..........a>k...0{.....{.m7 ...8w.H>....Zy ..]...{...#..... .c.
.|]...k7..y..r....h.A".6*.o?..o.&...Q4.d6...Y.D...jI...Zy...q.ub7.....
.^.B....4.....O4rn<u(;>6. 'P..v..E..0:2.7..#{.....ZnO.c-<f.r3
.Y9.I.9rH.=P$...%.K...N:..8W3.i.....z.^[email protected]."[email protected].
.?.}....*...r....F2z*.2.$..v..........).Q.)D..f.._..F..X~.p..!W..T....
##./....l.V....AJ.eB.......$.X....Y4P..........\.........K.Mp.zl...L..
[e.>.)v7B!o.1.L~\......=Efe.....e..K...!.T..,I..q.^/y[`/...s.....[y
mj... %...I?.Q.......Xrtb...#..x...\`..4.M..c.5...|=...O...f.%.Lr"..._
..`..r.j..3..L..{...r..q....fmj.>m{.rNa;[..T.G.^..M....CB-11...=.Yq
d..0......u.0?..l8..m...4..K.......c...4v..a....j....>s...JV.G..jjI
..e.%.R..'[email protected]..."../bDW..X]m.....T.q.....
g"J..*j.h..3..jA3.Uhi.[].Y.F......%...F.*.N..z..g...9.Py._l[q....~1..'
n...I..B.I.K=.....Q.U...F=d......:.I=n.....L.Z.e.....5-..?k.*.<.s..
=gz.9.w5g*.. ..D...3..*f.}...s.TR..TJ...J....kI!r..O...O....u..u......
j6.b...:...O_AKN.4..l......f.-... h.6[.[..C..vP..e-.F.f.9..Q........Y.
;D.v-.5-37.<.e...D.&,....h....^,...D..2..:...d.t.S...0.....V.S.
<<< skipped >>>


GET /css/base.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:17 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: W/"00f2cc963bd11:0"
Last-Modified: Mon, 21 Dec 2015 02:25:04 GMT
Expires: Mon, 29 Feb 2016 06:49:42 GMT
Age: 2456
X-Cache: HIT from ntt-cn-hkg-008; MISS(S)|HIT from gtt-de-fra-103
X-Request-Id: 3174e5c8fc6cbb0eb59cfdf8c0f21852; 0ceb1418a82af105a137930ff73c90e9
Via: T.51101.S.2, T.1287.H.1, V.ntt-cn-hkg-014, T.51101.H.1, M.gtt-de-fra-103
Content-Encoding: gzip
868.............X...H.>3..Cj[h...]...*..XF......R).N...r.;..gj....N
.......=.......a..-....]...QI.v:#2~.."..O.^7..Ov&...,.?.|.>}...H...
(.{y.....l.~...M.we..-..dW.s..;.../o.........!....._<..Z..U<.d.I
FK...F....]..... .m..5......9.A-..^.......o...........OeZ.F.....B..>
;.......l.4.l.F.2_....,.a!.J...d2Y.;]g....&..!W.Vef....F;3y.d*.L.e.N.Z
.J.E.......4(fAq.T..r]o.\..A..YV;..qo8....No~..F...DP._ ..,0u`.=."l.[A
.X20...g..1zy'....hE!..v.s%..3o.HJ].tC..jh.T. [email protected].....&k.
n.4Y..j.<0..Hp..C.k.4A*..Tg".[.-.V.s...:.....A.0.a&R]s#ui]d.K%.. ..
..b{..<........;)[I.u....1..>4B..`Mo|6..~pj.Dn 7Js.......$.Uz...
*......3.P..W......ba#FP.%t.T.%..2Q.6...Zmv..l.~TUO.._..I<s'.W_...Z
[email protected]/._..^p..5c...,...nhs...1..tF....k....m.W...Jf
.L..G.u{..y.......fd.N...s..6....E...M...l...-.M...D...........a`.m...
....-_fqE.:.a..K..'. ...&........F........G.6/,.5.&............}.}.Z&g
t;..,..R.......;...C..tb..5x[.ho..........}.".j..h.]UQ.zX..V1_..wF.w.t
'..8B`.B.<hq......us.G....~Qm. .a-*...{...2ba.e...Eb.5.u0`..U.Bh..C
;-3X;..wg.>.6.e&....^.V3.T%.1.m.....r..a.P4..aW.............Q..@o..
.pP709..!.0.x4g....>|......._}IsV.k.....cK>......:%x.@\LA.'j{p";
.O.GB=.c=F|5y5{5..]d.....y.?..ec.t.....q.?....!.SK.S...c..1..&.)..P.F.
u$\..d.2..5...l.p.9F......W.c........./.......h....\..Yd.QP.^p....L.u.
. .....|[email protected]..&..a..G.y....vvL*...Z?l..D #l.y..ek.k..
.C#O...oG.D.....GI.CG.d.0...]..,....cb.J.'.LN..P<..!.>..HF......
Zr...{.....}..J.=8)...............S.....5...A6m.............o".!..
<<< skipped >>>

GET /css/mask.css HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:17 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: W/"0941105f5ad11:0"
Last-Modified: Fri, 29 Jan 2016 06:33:44 GMT
Expires: Mon, 29 Feb 2016 04:51:54 GMT
Age: 10228
X-Cache: MISS(S)|HIT from ctn-gd-zhs2-010; HIT|HIT from gtt-de-fra-103
X-Request-Id: a83828e7924f89b711f95059f38e109d; c34661373c96d7c7453821b92c33048b
Via: T.5199.H.2, T.5199.H.1, M.gtt-de-fra-103
Content-Encoding: gzip
c95...............n..um...BB`[email protected].@...^.0..S..g...(.....hw
Yu.,.....?......s..\>f.V....d.>.=......?.&3?/X.l/...m...:.w.{..y
?.,.,-...>..........8.....~q....r`DqR.|..Y.......7.?..t:..8s?..)...
.o..y.q.,.R.Og,......v.9...."..r.....z...i..I......._..............$..
,*._...A...`.|4.....O..`y..8.?9...2..;Q...,....`08q..<t...gc.....f.
....e....oY..e....E..ZdE\.Y:.v]...!..l1v....E.......!..;...x8......0..
.......UN>...n...F{...."..q8~.W...).0..DY>.4..i..1H...~.....2_..
NQ.y..U....;...|lwX.6...O..~Pd..D=A.O..,......sB.\.7..7v..YQ..w.....RO
=...'... @....l..8p..";.d..;).Q...........S.....\...`!).x.Z,....iw.3.e
.,...b...0d.<.e....sB=.......!..$Y..U.&);:....R...d....."...x..h\..
..I8..CV*.S....­...#.I~..h....y\.....C...#f...S...............-.d...
b4........[..=....4ss.`[email protected].>..IV...Q.........R.C8.
.....j:f.`.%.O......5&.*.d..B....<....-.k.!...WeX..ahL..V.3..-.....
...K.\..bf..U..K..lrF !4..6....qT_J... ..`.p..V....c5....A.b ...%...Py
.,[email protected]!..N..B.....@.."j..U^...%.v.P|...K..(..n.H.....uL.*....
`...F..,....,..*.1...Dc..1.......$....#..'.y.........l..w.{.2n..A.A*%.
0..&.....R...".........d^]$..C.JkJP...L........../{.Q. ..V....}...Em..
.P...0.1Nq.&Y...U....Shb.......B..#..[.........:..<.\..F...V...J.P)
%....cc.k.5.......B.(...)[email protected]..=...7.RH.3E....T.....B=GM..
.N."C1.C...:S="i......J.^-.o..U........O.,]~.KJ.....E...rfw.%..P..50..
.?.......U(.:...'.t........u.T...Z./[email protected]...._~.......?n.|.../
.{............?.n]..,......:.J.;<2........V.u*.(...,..qn..6....
<<< skipped >>>

GET /sc/gac.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:19 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
Cache-Control: max-age=10800
ETag: W/"052b55a56bd11:0"
Last-Modified: Sat, 20 Feb 2016 06:07:48 GMT
Expires: Mon, 29 Feb 2016 07:25:46 GMT
Age: 10602
X-Cache: MISS|MISS from cun-hz-fdi-148; MISS(S)|HIT(R) from ntt-cn-hkg-004; MISS(S)|HIT(R) from gtt-de-fra-103
X-Request-Id: 668bc78e4c73fc099fc3575c480766ac; 8b9b2a1b982eca7b669bbd2433b312fd; f4dcac205697c54edb067d53ea410118
Via: T.51103.S.2, T.12817.R.1, V.ntt-cn-hkg-014, T.51103.R.1, M.gtt-de-fra-103
Content-Encoding: gzip
40b.............V.n"7..~.....cia.......Dw.....zR.!.5....]{CP.'..>R_
......:NQz.`-....of<........Irg;l.:..d.. ..=*.-...h..Do......>..
2....3!.._...t.....Lj".V...]A.._!.AB....>..d...u..D........6.]n.&q.
.<.6.b.%..'[email protected]."....6.......&I.1....uY.
&.......b.X).S......{zR...8.:.....C..j.S..D#"D.?...!H.E.:8."....q.cV.E
..i.y '>`[email protected].^.k...k:0.V.Q..^....jX.x0.
....=2..d....?.F...=..D._V........\.pK...1%.d....x.i..y.....n...6B...K
.....^..........\...;.D....Lp.&.YL-.....*...U..xDx.......}.zgJU..w...U
....a... -......\....4pK.A.7(.Z..Y.w^.x%._j.j...<.../|\...o..X.....
h..C...9....C]N/...L.EX.E#..U......-.....X...o.1r.hm.a.8... 2..E{<.
0q.%.....n..;...Q.cO.&.........W..q..GF./G.....Ky.....].B..F3A........
..}......y.]@I..e5..... ...CI.....AI.f..Ta...].......Z..|...M_5J.E.eL.
Y......Kr..,,./.S.E.U.kV.k..'^=.....Qx.%.DL.l.^...}LW......W....P.A..&
lt;.s..!I....V....-.j9.k5<.....U......E.....h.y-.u.3vF.z.......K...
e...I.4.f[J'<.2.....4..s....*.bm]..p..>&....v...-.^b.........W_.
sY.vX.$..f.......?.8........0......
<<< skipped >>>

GET /js/ie6_png.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:19 GMT
Content-Type: application/x-javascript
Content-Length: 198
Connection: keep-alive
X-Source: C/200
Cache-Control: max-age=10800
ETag: "0a3e832f627d11:0"
Last-Modified: Thu, 26 Nov 2015 02:57:34 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 07:21:08 GMT
Age: 6405
X-Cache: MISS(S)|HIT(R) from ctn-hz-fdi-019; MISS|HIT(R) from ntt-cn-hkg-014; MISS(S)|HIT(R) from gtt-de-fra-103
X-Request-Id: f4b28fde56c3bbc4f57278ad056479dd; d026b984879fc3cda9b17ac1e7046e6b; bcbc55b8c352410932e01976c8c9ac1e
Via: T.51100.S.2, T.1285.R.1, V.ntt-cn-hkg-014, T.51100.R.1, M.gtt-de-fra-103
// JavaScript Document..DD_belatedPNG.fix("img,.main_right .con .li_ri
ght span,.share a,.mask_hb .hb,.mask_lq,.withdraw-time li .head span,.
withdraw-time li .time,.mask_hb .bg,.mask_hb.xmin .bg");......


GET /js/t00aa2.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:19 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
Cache-Control: max-age=10800
ETag: W/"0abd0a3a2bd11:0"
Last-Modified: Mon, 30 Nov 2015 06:40:46 GMT
Expires: Mon, 29 Feb 2016 07:55:18 GMT
Age: 8249
X-Cache: HIT from ntt-cn-hkg-004; MISS(S)|HIT from gtt-de-fra-103
X-Request-Id: 2d32c6e6e8a6e61c6df226a8e6a4c4c3; 7d2e14272c075530bbc3ce45557c1581
Via: T.51103.S.2, T.12816.H.1, V.ntt-cn-hkg-014, T.51103.H.1, M.gtt-de-fra-103
Content-Encoding: gzip
1147.............Z.s..r.Wl......I..P.=.....I..$..Mu..&!...P@..........
........"......~.....6...W.]?>.ZU.Z.8y..'."..C..m....F.....hd......
.z....H....v... ..Z5V...|g..........".E.)&S..f .n.rj..D...\L..4..(...3
3O.n..9....O.....*,....{tZ..gj>..G&W....e.<I...Z.h.;m...M.;..E..
63r......._._..'.oR...9.F.7P..ki....Y.......Z.....q.Y.J0.. ......9.f.2
.=ZU.E.d..x.....}.n.F.(..){.. [email protected].=.n...?-....UIj..o...]._>
;..{..h%..|J.....,M3.$....|.j....jY......!*..JZ..EQ.8.Q....z4:2f....B'
.....~'...........t..a....`)........{...i?c.nm,.I.....-.lW.....N.vU...
..qdu[...ia~t......g....k...9E....T..b.....'...F.<.=....;...D.....0
".5U..y!g.y*.^.........j.r^L.....0 q.r4. s?..s.....CPxw.......Z6......
.1..F.! 5.....&Sb-...>~x...a.."[email protected]
.B.....O.5......T...||...k.OQ.......X^xJ<[email protected].:]....
E..,...Q..5P.~#[email protected]$f..&.....Q2.R.......n..F....T..CR.S.ndk..).
*Z...Ll6.......<M...v..\.N.f...y.gal.j..Ys....t..JA.....k2b..i' .FD
.. ......==5.R..B9{...b!I...0.....V.wC....A_".SS...0u...g..n..z.N.>
...#....6H....._....!....\y.He..m.......M.i....n.gyg.n.....th)....&`..
N]g.fKg9.N...p...t.98.3..$...?.&....7_...Z.in.....z}........i.?.....SB
@....FX .J.....|....}......O.......yw.AXD....)r.m..goA.`.Z.;.<I...u
|.Q...aiq.8.q3...}[email protected].......;S`t<.........n%.[...'.O.....
..)!...[4.l.9...z.^..i.$"4.T.6'...-d.e....3.....h~........6._e.z..I.Q.
...T.....G..B...t.P...h$....Iz.....Q.C....A..aX..'..D...)......W..f>
;...S.T..."==....C..a..$......*..#....../....$......V.w_..o7..9O..
<<< skipped >>>

GET /images/ac_placeholder.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:22 GMT
Content-Type: image/jpeg
Content-Length: 6908
Connection: keep-alive
X-Source: C/200
Cache-Control: max-age=10800
ETag: "0b9ecc26c39d11:0"
Last-Modified: Fri, 18 Dec 2015 08:19:06 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 07:57:29 GMT
Age: 9615
X-Cache: HIT from ntt-cn-hkg-004; MISS(S)|HIT from gtt-de-fra-103
X-Request-Id: f250bdb4a371151fa31bd12ec85f1be9; 446a69b9d43b2745ae0a656c48a5fdc0
Via: T.51102.S.2, T.12812.H.1, V.ntt-cn-hkg-007, T.51102.H.1, M.gtt-de-fra-103
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c06
7 79.157747, 2015/03/30-23:40:42        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9dff2845-54a3-ae4
a-859e-606945b29d32" xmpMM:DocumentID="xmp.did:FA94B1CEA55F11E5AB82F97
82FA2CC0A" xmpMM:InstanceID="xmp.iid:FA94B1CDA55F11E5AB82F9782FA2CC0A"
 xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:Der
ivedFrom stRef:instanceID="xmp.iid:9dff2845-54a3-ae4a-859e-606945b29d3
2" stRef:documentID="xmp.did:9dff2845-54a3-ae4a-859e-606945b29d32"/>
; </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xp
acket end="r"?>....Adobe.d.........................................
......................................................................
..................................................z...................
.................................................!.1A.Qaq"....2....B#r
.3$.%.Rb.C..S..............................?..........................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /images/share_icons.png HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:22 GMT
Content-Type: image/png
Content-Length: 8253
Connection: keep-alive
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: "02b375180dd11:0"
Last-Modified: Fri, 23 Oct 2015 10:48:14 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 08:46:32 GMT
Age: 9079
X-Cache: HIT from ctn-gd-zhs2-008; MISS(S)|HIT from gtt-de-fra-103
X-Request-Id: d4287179eb78667ca6b2428888b2c08d; dc16c4723ab7a9c63c594e601ebcead7
Via: T.51101.S.2, T.1288.H.1, V.ntt-cn-hkg-007, T.51101.H.1, M.gtt-de-fra-103
.PNG........IHDR.......l.......r.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...niTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:95ed5cdf-9368-f54c-ba2d-97bb70885007" xmpMM:DocumentID="xmp.did:
995120D378B711E5AEB19095F9BC2369" xmpMM:InstanceID="xmp.iid:995120D278
B711E5AEB19095F9BC2369" xmp:CreatorTool="Adobe Photoshop CC 2015 (Wind
ows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:94D0F8F56333
11E59A45906A56E0BE90" stRef:documentID="xmp.did:94D0F8F6633311E59A4590
6A56E0BE90"/> </rdf:Description> </rdf:RDF> </x:xmpm
eta> <?xpacket end="r"?>O5.3...eIDATx..]..US._...Q..F..TT.]..
.T2...>......odTC.E4..q.0M1.n#.......7I($...P.......zO...Z....u....
.y.^.y.z.s[.zV....U.PK.\.3.O../x.`e.......\.S...........Tv.._....g...U
>a...y.....=......'x........|Gp..:..$\...d........Rp......p...ghx..
....C"f..,.&.N.{~.G).Z....(....W...|Q.^...L...g.x..\[E...%....^C....r.
......a...Y..C.O..P..W(..~$XW...H...|?.k....g...<..O.i..I C;.~.r...
...^.e.....[..!9....)[email protected].%8.....K...P.)...S...,.c)
^%.-J.}.mN.iJ..E..<9.E|v...-. ."..........i*....I..G_|.F..A...)
<<< skipped >>>

GET /images/share_icons.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:22 GMT
Content-Type: image/png
Content-Length: 8253
Connection: keep-alive
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: "02b375180dd11:0"
Last-Modified: Fri, 23 Oct 2015 10:48:14 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 08:46:32 GMT
Age: 9079
X-Cache: HIT from ctn-gd-zhs2-008; MISS(S)|HIT from gtt-de-fra-103
X-Request-Id: d4287179eb78667ca6b2428888b2c08d; 786d2e2cee81bd1cee5384b2bf7f8bd0
Via: T.51101.S.2, T.1288.H.1, V.ntt-cn-hkg-007, T.51101.H.1, M.gtt-de-fra-103
.PNG........IHDR.......l.......r.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...niTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:95ed5cdf-9368-f54c-ba2d-97bb70885007" xmpMM:DocumentID="xmp.did:
995120D378B711E5AEB19095F9BC2369" xmpMM:InstanceID="xmp.iid:995120D278
B711E5AEB19095F9BC2369" xmp:CreatorTool="Adobe Photoshop CC 2015 (Wind
ows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:94D0F8F56333
11E59A45906A56E0BE90" stRef:documentID="xmp.did:94D0F8F6633311E59A4590
6A56E0BE90"/> </rdf:Description> </rdf:RDF> </x:xmpm
eta> <?xpacket end="r"?>O5.3...eIDATx..]..US._...Q..F..TT.]..
.T2...>......odTC.E4..q.0M1.n#.......7I($...P.......zO...Z....u....
.y.^.y.z.s[.zV....U.PK.\.3.O../x.`e.......\.S...........Tv.._....g...U
>a...y.....=......'x........|Gp..:..$\...d........Rp......p...ghx..
....C"f..,.&.N.{~.G).Z....(....W...|Q.^...L...g.x..\[E...%....^C....r.
......a...Y..C.O..P..W(..~$XW...H...|?.k....g...<..O.i..I C;.~.r...
...^.e.....[..!9....)[email protected].%8.....K...P.)...S...,.c)
^%.-J.}.mN.iJ..E..<9.E|v...-. ."..........i*....I..G_|.F..A...)
<<< skipped >>>

GET /images/li_bg.png HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: image/png
Content-Length: 1213
Connection: keep-alive
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: "07460c69010d11:0"
Last-Modified: Tue, 27 Oct 2015 08:23:36 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 08:54:42 GMT
Age: 3576
X-Cache: MISS|MISS from cun-hz-fdi-149; MISS|HIT from ntt-cn-hkg-012; MISS(S)|HIT(R) from gtt-de-fra-103
X-Request-Id: 92401a839c30c480168f2226941a2dda; 9bf0d85a920916b5782639384ab68988; 0ee73cea1b879bdc95a91da66310164e
Via: T.51100.S.2, T.1286.R.1, V.ntt-cn-hkg-012, T.51100.R.1, M.gtt-de-fra-103
.PNG........IHDR... .........jfk.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:15386AEA7C7911E5B975
A8C2336F1C1B" xmpMM:DocumentID="xmp.did:15386AEB7C7911E5B975A8C2336F1C
1B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:15386AE87C7911
E5B975A8C2336F1C1B" stRef:documentID="xmp.did:15386AE97C7911E5B975A8C2
336F1C1B"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>...L...-IDATx...;[email protected]....].K.
......<.G.30..\R~L.:....<.g.s..3.}..............................
........................x...x...x...x...x...x...x...x.................
......xwvC|......p.w.n..|......|......|......|..........^...n.>....
..>......>......>..l.....Ust...x...#>......>......>.
.....>..l..x?..`.k...m.e.....IEND.B`.....
<<< skipped >>>

GET /images/qr_code.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: image/jpeg
Content-Length: 27772
Connection: keep-alive
X-Source: C/200
Cache-Control: max-age=10800
ETag: "09eba4d6e18d11:0"
Last-Modified: Fri, 06 Nov 2015 08:37:00 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 04:00:22 GMT
Age: 9188
X-Cache: HIT from ntt-cn-hkg-017; HIT|HIT from gtt-de-fra-103
X-Request-Id: 2426be6c77def41b2d6d841de864a4e5; 79f14328f0aa13f7fed5dad905acd145
Via: T.51101.H.2, T.51101.H.1, M.gtt-de-fra-103
......JFIF.....H.H.....C..............................................
..............................................................G.......
...........................8W.....!"#%2..34Gh..$'AEb)5d(9BFcg.........
?..0..................................................................
..................I.LF-1%6.....m..1....,.S...f......L7.i\...!JN....z..
.c.......... gG....fX..:=....2.....'[email protected]=y.....tz...ve..3..O^{.,p
....Q..J_|.O.G.!.>.\S......H.V.K.{......5&.1.....cK.ni.#X....X..Lb.
}...Hs.%0...s.W..)8.tz...ve..UB.jT..s..r.3imZ...5.j..),YZ.12>.....z
4...8.{....'...Q..J_|.O.G.!.>.\S......H.V.K.{.....U.*.G....fX..:=..
..2.....'.=..8A.L...Nm3.Lfl.._3.Y..R..%{[$'.I.&W1..F......q.R.....*n..
a4k.9k.8s.......o.em...U.n.....{...e...si.rc3f.Z........) ..!=2N.2...r
4G..8.s....-...jT..s..r.3imZ...5.j..),YZ.12>.....z4...8.{....'...Q.
.J_|.O.G.!.>.\S......H.V.K.{.....U.*.G....fX...e.Jb6..&4.i..3nY..].
L.kd..);4....$Dy.cH.<.!HR.X.F...#....Lir..6.k...T..V..B..Ba..zD...4
.{....'...A=y......O.J..Nb..Sfm-.\..F..R..%. T&&G.!W=..F......q\R...\.
....... gG....fX..:=....2.....'[email protected]=y.....tz...ve..3..O^{.,p....z
...c..P....r..&.v/.).........~6yo.B.....M....0.z.....N...}.HUY.~6yo.CU
.yW..VK.;....u....*..|..'.D...N.e...to......cM....*..?.<..!..<..
..q..2.^..*.*.G.M.._XR..=T.....cM....%P............A6..}aH`..P....r...
.v/....!...-.HUYQ..i............q..2.^..*.*.G.M.._XR..=T.....cM....*..
?.<..!UeG.M.._XR..=T...*...\h&......W.w.?2}4eX.U..r....v/....!...-.
Hj....r..&.v/.)...........A6..}aH`..P2..........fl..\.nF. ..)5b..M
<<< skipped >>>

GET /images/hongb.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: image/gif
Content-Length: 11374
Connection: keep-alive
X-Source: C/200
Cache-Control: max-age=10800
ETag: "048edae2041d11:0"
Last-Modified: Mon, 28 Dec 2015 03:34:40 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 08:03:07 GMT
Age: 4538
X-Cache: HIT from ntt-cn-hkg-017; HIT|HIT from gtt-de-fra-103
X-Request-Id: 0dc537712ed0b31c2629e881f0d456a5; f6f3280d660634187400afa937afb7f9
Via: T.51102.H.2, T.51102.H.1, M.gtt-de-fra-103
GIF89aZ.d........./....P*.w..bZ.IJ...............v03hId..v......[2O.4(
..............D.dy......y.........(&.&8l.......C.#..0&.......il.... ..
[S.w|...}v..\r.Sg..%....3L..........t..1".......M'.....C.IW.v$....Ul..
..m3........ .2 .&..:T.*D....Kc....3.........8rN;O.,.l.......|j.......
....."...........p.SD.s..vBMP.................a7.....^..$...X)3.U^....
[email protected].#[email protected]\[email protected].....
.......-.?........"s&!..;.p{.....|.&U.......(...C...W......Zi....1$...
.{...Q. ?.......t]....gd....GN......8B..|v.`X.9!(.f....4..e".uf...m[~.
......-"..'..._e..i\.....'.5.....*..6...h.D(.VO.9B.......F .......?g@5
q....<!.0..........OC..2(....Lp....3....G.T.1'...sf.....6'.DP.3.bZ.
..........0M....?'....6 .4!.6..:'.|8.`I.....$....4!.3&.2%.]{........K.
.D.^Vg........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="...
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:m
eta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 
       "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-s
yntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns
:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorToo
l="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:0332A7
76AD0711E5BDB990933981401E" xmpMM:DocumentID="xmp.did:0332A777AD0711E5
BDB990933981401E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:
0332A774AD0711E5BDB990933981401E" stRef:documentID="xmp.did:0332A7
<<< skipped >>>

GET /images/g.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: image/png
Content-Length: 3793
Connection: keep-alive
X-Source: C/200
Cache-Control: max-age=10800
ETag: "044d13a613d11:0"
Last-Modified: Sat, 31 Oct 2015 06:33:12 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 07:07:41 GMT
Age: 10755
X-Cache: MISS(S)|HIT from ctn-hz-fdi-019; MISS|HIT(R) from ntt-cn-hkg-017; MISS(S)|HIT(R) from gtt-de-fra-103
X-Request-Id: da00767c33af74e9c040b7769e6ab1a5; 8f3c5900e0757fed941bbbc2c2dc7f65; 6e4fa1243dd4031e45e17ecb65ccdf83
Via: T.51103.S.2, T.12816.R.1, V.ntt-cn-hkg-005, T.51103.R.1, M.gtt-de-fra-103
.PNG........IHDR...<...<.....:..r....tEXtSoftware.Adobe ImageRea
dyq.e<...viTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5
M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:
xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42        "
> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns
#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.c
om/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/Resourc
eRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocument
ID="xmp.did:e85a7874-595c-a04a-98d3-b7ddd885edc1" xmpMM:DocumentID="xm
p.did:574C47867F9811E58B43EC41AC22FC87" xmpMM:InstanceID="xmp.iid:574C
47857F9811E58B43EC41AC22FC87" xmp:CreatorTool="Adobe Photoshop CC 2015
 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ee4d85
33-d47c-864d-99fe-1b62711404d5" stRef:documentID="xmp.did:e85a7874-595
c-a04a-98d3-b7ddd885edc1"/> </rdf:Description> </rdf:RDF&g
t; </x:xmpmeta> <?xpacket end="r"?>h.......IDATx..[Y..G...
z.....3k..;..X..8Y.........@..'....Jx..`^..pB...^ ....D. .)...C. ..C.h
.6...zwvw.............1ry?.x............h.........b^7.....N..t..o...c.
......<.l..=?.......Y.........W.#.L.9...=.Mt.T.......V.3%.lF$...5.M
Hb.t.G75............M...........`-.q.w.....4..@.`R.'%...50n.....C..M.f
...@D{.x.v.v.{&.....&....K..O....}qOu........G..7...Oj.BUEY..\..AM.[=C
=...9..?......i..r.g1...GT{&.e iW..~.....]...V..P.!.. ..6.*..y..{..)Y@
F...R'G.*..E..y...........n.........R..s.`.#.n..m..<.=.."......
<<< skipped >>>

GET /images/to_top_v2.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: image/jpeg
Content-Length: 8247
Connection: keep-alive
X-Source: C/200
Cache-Control: max-age=10800
ETag: "013b98b4611d11:0"
Last-Modified: Wed, 28 Oct 2015 06:04:46 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 09:29:18 GMT
Age: 6493
X-Cache: HIT from ntt-cn-hkg-004; MISS(S)|HIT from gtt-de-fra-103
X-Request-Id: 3861c47e12647c064d8afef676b04d18; 970f1a073d352f3657ea1ba80b67490b
Via: T.51103.S.2, T.12816.H.1, V.ntt-cn-hkg-012, T.51103.H.1, M.gtt-de-fra-103
......Exif..II*.................Ducky.......F.....*hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c06
7 79.157747, 2015/03/30-23:40:42        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A6BC80067D3711E5815DB1230
D595DE6" xmpMM:InstanceID="xmp.iid:A6BC80057D3711E5815DB1230D595DE6" x
mp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFro
m stRef:instanceID="xmp.iid:73093390668811E58E4B85DCAA36BFED" stRef:do
cumentID="xmp.did:73093391668811E58E4B85DCAA36BFED"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;....Adobe.d........................................................
......................................................................
......................................................................
..............................................!1Q"R.s..TA.2B..3.4.u.67
.a.b#S...U....$....Vfr.C......t^.&Fv..........................q."BR.
.3.!1AQ2....Ss.4.5.bra...c.#....Ddt............?...p.. .S.......;...(|
... ..>n.`....7k.H.e....$.,.C6...(BI.*s6.&..GFsYu..v]..)..s`.......
Nt8D.%PR..Ju.. ...3%.G...mW.......2.........3(|...= ...7k.OH.2........
..v....3(|...= ...7k.OH.2..........v....3(|...= ...7k.OH.2........
<<< skipped >>>

GET /images/head.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: image/jpeg
Content-Length: 2888
Connection: keep-alive
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: "06566d847ad11:0"
Last-Modified: Mon, 19 Oct 2015 08:26:26 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 08:43:34 GMT
Age: 423
X-Cache: MISS|MISS from ctn-hz-fdi-021; MISS|HIT(R) from ntt-cn-hkg-014; MISS(S)|HIT(R) from gtt-de-fra-103
X-Request-Id: 7138102a70ed755ec3516cd6d102f43c; 1d0afbe37a6f89b316c71c7cf27de19b; cbcaf70349041c45f0bbe02ad5bf30bd
Via: T.5199.S.2, T.1284.R.1, V.ntt-cn-hkg-014, T.5199.R.1, M.gtt-de-fra-103
......Exif..II*.................Ducky.......<......hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-
c067 79.157747, 2015/03/30-23:40:42        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:279348265E7F11E585CC9E
DEB5B2651C" xmpMM:InstanceID="xmp.iid:279348255E7F11E585CC9EDEB5B2651C
" xmp:CreatorTool="Adobe Photoshop CC 2015 Windows"> <xmpMM:Deri
vedFrom stRef:instanceID="4DDF7D9F416D4AA149884F910868A410" stRef:docu
mentID="4DDF7D9F416D4AA149884F910868A410"/> </rdf:Description>
; </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Ado
be.d..................................................................
......................................................................
.........H.H..........................................................
..............................!..1AQ.a"2.q..B..R#.r...................
.........!1..AQa.".............?...n.H.!..*.........}....h..|..!.0y`.7
[.....D.........*[nf.K2.Z..!..xp>....Y. .........|0.[...J.... _..p.
 .Y....H.3.'.z~.}-..Xn.\*...........8`.&..=.7...].v.$.S"...IZ.-...e<
;5G&..p.'t~].v...t. K.y.sZ)..q..ki.....'......4r3;.{.\...VA.H.........
.dr....UI.....~...... U...Z..$:E.D..|1.....M.....  clM.. ......f.{
<<< skipped >>>

GET /images/web_close.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: image/jpeg
Content-Length: 2239
Connection: keep-alive
X-Source: C/200
Cache-Control: max-age=10800
ETag: "0f1a97272cd11:0"
Last-Modified: Thu, 22 Oct 2015 02:36:26 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 01:42:50 GMT
Age: 3539
X-Cache: MISS|MISS from cun-hz-fdi-151, MISS|MISS from ntt-cn-hkg-007; MISS(S)|HIT(R) from gtt-de-fra-103
X-Request-Id: 59d7d82d8b7b4a63027224700e92ce4f; 2be4f7d0dafb6de15cd20bd1ea80811e
Via: T.51102.S.2, T.12814.R.1, V.ntt-cn-hkg-004, T.51102.R.1, M.gtt-de-fra-103
......Exif..II*.................Ducky.......F...../hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c06
7 79.157747, 2015/03/30-23:40:42        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"
 xmpMM:InstanceID="xmp.iid:52B26072764111E5B687DB56858E966D" xmpMM:Doc
umentID="xmp.did:52B26073764111E5B687DB56858E966D"> <xmpMM:Deriv
edFrom stRef:instanceID="xmp.iid:52B26070764111E5B687DB56858E966D" stR
ef:documentID="xmp.did:52B26071764111E5B687DB56858E966D"/> </rdf
:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end=
"r"?>....Adobe.d...................................................
......................................................................
........................B.B...........................................
............................................!..1."..A2br#C.a...RS..$..
....................!1.Q.Aaq..."BR...2b..c.....................?......
`....`...0......`...0.......u...wN.p.85>aS2I^..../.%..^..vc.".l....
.n7cE......z.U.%.....*U..ok......R..Hdx.F.X....*..t .. .F.]&....d.....
BZ.w..$.:eI.h.... K..j...~.k.t.&..M.....E..[55b....h/...y.....b.....kK
#.5U.A.3....f.6...#6........]3..y`.0...6.Y!.&..9.`.... )..F...L...
<<< skipped >>>

GET /images/web_bg.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: image/gif
Content-Length: 48460
Connection: keep-alive
X-Source: C/200
Cache-Control: max-age=10800
ETag: "0941105f5ad11:0"
Last-Modified: Fri, 29 Jan 2016 06:33:44 GMT
Accept-Ranges: bytes
Expires: Mon, 29 Feb 2016 09:34:11 GMT
Age: 8149
X-Cache: HIT from ntt-cn-hkg-004; MISS(S)|HIT from gtt-de-fra-103
X-Request-Id: 2c60e3e21c38b447c7b176abc43e80ac; cf0c341bfbf1d5c33c6a7ac2768a15ae
Via: T.51100.S.2, T.1286.H.1, V.ntt-cn-hkg-014, T.51100.H.1, M.gtt-de-fra-103
[email protected]./2_ O.ZY........B..R...eL$".......,............r..
..#]TP....jf..(.xv.....d.dY..!.he..H..).........."$..........O..!1....
n......V..8..L.....T.DD.M .......t$.x...%.!&.....e.jB.k-..j.!#..3..d.9
=.....3..W..z.CC.i..P)..S.(....l.1..$..BR5%)s..3E.23/!7.....&.GQ..4...
.....#.TW.EF........5.......$$.s*..G....x...&.q,.....%....7:.M,.N'....
.H....T.....!#.sk...<,B...p.).....7.....V..w.sA........3. ..34..u..
C.....F........7..p..U...k9...?.U...f........x..C....JO.uk....{s....df
..C.U`dR...).....F..~.....Y..V.......z@...{......Z_........|..7....)3.
...*..7#.RP..%.4%.Y..) .QG.)*..d....yv.SI..........x^.km.5$..%G.*....6
 .............c...Y..d..............S.JM..u..1.53.....................
..\.Ye..............................!...............kt................
..1s.. 6F:%...!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzr
eSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adob
e XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42        "> <rd
f:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <
rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/
mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmln
s:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did
:c629ff76-1d7c-9743-bcb5-192e35271035" xmpMM:DocumentID="xmp.did:24E06
07CB8DE11E5AC9990B0C67AF333" xmpMM:InstanceID="xmp.iid:24E0607BB8DE11E
5AC9990B0C67AF333" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:cdead167-b287
<<< skipped >>>

GET /js/autoscroll.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:23 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: W/"03835d747ad11:0"
Last-Modified: Mon, 19 Oct 2015 08:26:24 GMT
Expires: Mon, 29 Feb 2016 07:43:12 GMT
Age: 6012
X-Cache: HIT from ntt-cn-hkg-005; MISS(S)|HIT from gtt-de-fra-103
X-Request-Id: b06328c395c5f14860a466afb4a67844; d710d3ac251cc83ffd929a940595181e
Via: T.51102.S.2, T.12814.H.1, V.ntt-cn-hkg-005, T.51102.H.1, M.gtt-de-fra-103
Content-Encoding: gzip
6df.............X]S.W..^g....f......tb.i{c.:v...919!..n..A....E"......
....2c)$..&g7.._.{>.#..fl......}..=K<z.......w.d.po......;\.t.=w
f...=xH..GK..DR..p-.*W-C.....(.S.H..B...%g.uR........$...{I.*..y....2.
.{...YZN...._.'...|.......7.;o.....K/...<r..........[p..=..\1F..B..
H..7..f..3..?...'..5....r..xm....O..V9..,.).......<3..............6
..i.m;s[....>....7.......QR..)..S.bs.....u4j..........k.e.c.63....n
.i....6qi.....g.3HK....#[email protected]...^s.-.^|.k.*....wc.)[y.2..k2/..2
.......U...6.,..p..=.'L.:...........q.|a.Dw.4X.N...V..P...}.T.6.@RD%..
,... ;.....e....4.1....k8......w...T....!.MC.....E.H.H....e........{{.
.Cg.#..]...#0.......X........r...m..E.'r...(Y=.LqP.D.<....0.2..vN.@
[email protected]..,.rB.dP6U.lb.x._].U.... t.XA.$..B.....q.n.F..i.....
./....OD. ..|[email protected].......}......=Ol.."....x.....H..L. 
2. Y.<............*^^.H......F..e.0.;.9...1.,..`!r...`p.k{....gy..B
I.T....B..X.k.:"..I...dG|~u.tN.2&....~....(...j2a8...2.).Wx....;..E.a.
.$...Kj.,...)..H..9....V.O.r.....M.........x.V.1|..,.b.J.C.M6o..u2..bb
.l2..S.....9h..UH..]d....<w.F'[email protected]*...,%S.:..QF..2.'..4.I
#9..GzDIk....*....h.\.. F.....M..p.X.. ..]_o~.....3.cH.^.I~.<.._6.4
.2.T._CY[.../...!~.>)?*y..c1.......#...k....,Z.b.ac...W!P.,.7.UoL.M
.T=.t}[email protected].......@}...4.........
A.`...wZ..>?..p...w..hR7.....$...g@.'...R....(....i.....O>YJEx..
og.O|8K....oL..yz....w..gxj.....Sy.[.)np.z!.S..l`.pW%......d.rj&.t.k^.
w...g....H.U...V78..M..js..X.k......`(.w.!...5g~...;...."x../.=&..
<<< skipped >>>

GET /js/content.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:24 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
X-Proxy-Route: ctn, ctn
Cache-Control: max-age=10800
ETag: W/"0fe7fd3e2cd11:0"
Last-Modified: Tue, 01 Dec 2015 08:03:56 GMT
Expires: Mon, 29 Feb 2016 02:28:01 GMT
Age: 10530
X-Cache: MISS(S)|MISS(S) from cun-hz-fdi-149; MISS(S)|HIT(R) from ntt-cn-hkg-014; HIT|HIT(R) from gtt-de-fra-103
X-Request-Id: 177a9bd706a6630981e9a5757d8e6261; e7011980fe07c8e34a5b8ebb35c2d989; eeb494fbca5a45967418692ffe8867e7
Via: T.51103.H.2, T.51103.R.1, M.gtt-de-fra-103
Content-Encoding: gzip
50c.............VmO.V..l$...1....udZZ*U..n..j..~C..I....}CX $6..Ntt..F
?lL..nE..n#-....O..;....IaSQD......<'.N>4f....<N.s.Z.:|p`D ..
.3..2....].,..l......2...*[email protected]....
...Hoj.... ,...c.9-3.f.fPq....,..}j.....F.(....p..c...x:.s......"....8
......c8...S?U....t..w.:.k.......#.p..x...z..*..tj....P._.o.._t.^$.7.C
X.f..........v....._a:.....Y...H..H......S.h>.....'...m|q....B.....
..P...\....._....G..X.L....Y.)l<.s....*d.,.....mu..=.,......kU..0..
..v....5.^.....5..........x.*.~}'...l=........;.St4k..j.... d..&..0,.E
...i..j..N...s.hl.P.V3D....0A<.v.)-C..v. ..DD^%......t.....N....m.x
..h...G...p0.....=m.6d#r.).............Yz......1..S.B..h.....K.{...5.H
( i.!.......>.5.9.)(p:$.o0G.=...N.W..T../[email protected]..`..2tG.<
;.hQy..q z(.u... S.....1..P.............a.Q.=qQ<7`..E....H.8.JQf\.]
 .....t.......j.e.\..........S;............G....oI.i.....>.z..K.|.&
gt;..T\.<c.01...........r|....K.9j,.^<k..%<6].".D...Z....hY..
.,...F:.... .%..5..(:a... ~.=<[email protected],..m..P..2........Y..
[email protected]............\. !.]......H....(...H..Y.......U.
.TT....lS%[email protected].. (V.u.......$N-......t.j.v....{.......).&..0/X..=.
..7....{...d.;[email protected]..._Y..](..\%.}i'....n
#...K.<O.N.....8....,.....nA.....'XI...C.V.........pe...F ....E....
[email protected]......
<<< skipped >>>

GET /js/jquery.pin.min.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: r221.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:24 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
Cache-Control: max-age=10800
ETag: W/"06f2999a622d11:0"
Last-Modified: Thu, 19 Nov 2015 08:45:10 GMT
Expires: Mon, 29 Feb 2016 06:11:01 GMT
Age: 489
X-Cache: MISS(S)|HIT from cun-hz-fdi-149; MISS|HIT(R) from ntt-cn-hkg-012; MISS(S)|HIT(R) from gtt-de-fra-103
X-Request-Id: 276f82a36f45d2ca6dea48d4cfc55e30; f7a21fbb0de79d10728f2ed8cec57ba6; 56bccbcf839e0207f12eee864726e9f1
Via: T.51100.S.2, T.1286.R.1, V.ntt-cn-hkg-007, T.51100.R.1, M.gtt-de-fra-103
Content-Encoding: gzip
320.............UKs. .. .......e.C/=.......H`.....'U....$GyLz.`Y...}k.
.k...*....*.`.Dj...G...#..Q....U.w...Z...(.=......H...C....*...t..E.V.
}.j....l..Y.;w_.M.?.....[.#?....x1...2?..\...H.V{u..xT.0.g..n).2ob.}..
%..J'.&....G. .z`c~..<./V....:.i..-..#R..n.K.e5(......e.u..4N....&.
p.%Y.UL...).*..&..;...gV.."[email protected]/o. -u
Bq...ki..^W.>%..^.U.Wi[..H.Vg..$).0...h.U:..G}.Z..4....?.F.b.H.)...
. .!'[email protected]............%.y.ndLK.7Y.0.</y. ....rp....&x
k!..d..S.j..%.....u...AV...............8..9vT..h.............d.....F..
..r...Z.BfY....Bp..s.uw.X.A.:3!.6O.%l.....7H6q...S..Xcy.w9. ..Qs`X..[1
....Bw#...1.$..`.c..d.Y~.....A.......OK. .g...f.=........ .H9....fe n.
:....Pa...`M@%<d..WKB........#....&...[....s....@.;.[/[RyV......a.z
[email protected]..]....9....c. .8.....Uxf.....S......0..



GET /staticPub/js/lib/kg_6abcd20.js HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:33 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Keep-Alive: timeout=20
Vary: Accept-Encoding
Last-Modified: Tue, 23 Feb 2016 08:33:06 GMT
Vary: Accept-Encoding
Expires: Thu, 24 Mar 2016 10:18:48 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-42
Kugou-Memory: HIT
Content-Encoding: gzip
Connection: close
6569..............{s#Yv....)X.5$PH..>.JB.U].TWu........D".d......CP
.p..Z{7f....W.Z....Xy..]{...?.M...._...;...y.....#..j.E....y...}....$.
.......97.3.'W...{{._M......G.~.....v.....}.R....u*.. .......z........
X.?z.N....`0..O.5F......k..A..5....$..9...n.&..]....d...{.`8.....Z_...
..h...x..y......_.P.........l.L.........|..h..K..`2.....w.t...........
1....x...J~2.....qp...&9.v......y...L..r.....:...7.,...E.....A...n.Z..
....\v^.:9/.kW...;..9.:.s.....uF.v.a..X......,{......Kc...A."S.v.j..=.
.7..]|V...$... h.U..-.N/...........Y....~.....?......~..V......Q..X...
~p.......-..K.}=.5........M~Y.~Y..[./..............?......d..n0^_..KCw
..'......`&Y.F.........-.UX.....yn.......:8...8.P..!P|rF....W.n....a..
[email protected].)........"6....*.hs.G......G......ao....
~....;...b..Wi<q'....`<..q9.Y.N.{M..-}9..9k..E..k[...Z..:.e.....
....|.].K...SA.s.]..%....t...y.....;.tJ..s...Bo2.;...wp...W..|[email protected]~
.3.J..8~.p=..m...H..wX...q!..F...q........K...P.._...hJ...T.$8..t{..F.
..Qt.....5...`s.....K[...Wc...ts.5....j..m.........m.-[...Oo4..../.3/.
.B.R...2...q.c......>....v........rV.........n=.....~..N..T /...t..
...G...|[email protected]#..h.........jp..9....`...8.h.A.j.[.y...9I..4....
..Sw...gN.HV.`...{.P..&P...p'....w5.............^..(V.A.,......9..-/..
..E7.[v...)G..);.....c.\.%.I.........>hU!-.f..(..^ZW../...Za...(...
....;......Xk..._..dR................x...P..D..Bz...g....2Os.2-}.Cz..m
.I-.S*...o.yx.f.....&:al..E7o.:-.ECN9......B.(...... Q.aA.L.cb...:>
..A....83:.}...d..:?N..mG..8.../.G....;...0...x'.....F.jV..}....n@
<<< skipped >>>


GET /cpro/ui/noexpire/img/2.0.0/bd-logo5.png HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cpro.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:51 GMT
Content-Type: image/png
Content-Length: 1545
Connection: close
ETag: "5667c7a9-609"
Last-Modified: Wed, 09 Dec 2015 06:18:17 GMT
Expires: Mon, 08 Dec 2025 03:23:12 GMT
Age: 6933339
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Ohc-Content-Crc: 1974033671
Server: hkg01-sys-jorcol04.hkg01.baidu.com
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;...siTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:1cd07f07-f14f-4d1b-83a0-43c485539d9c" xmpMM:DocumentID="xmp.did:
52D26256CAB511E3B696F0231D9BB8CB" xmpMM:InstanceID="xmp.iid:52D26255CA
B511E3B696F0231D9BB8CB" xmp:CreatorTool="Adobe Photoshop CC (Macintosh
)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f6314ed7-87ee-4
c03-a7bf-62894da43749" stRef:documentID="xmp.did:1cd07f07-f14f-4d1b-83
a0-43c485539d9c"/> </rdf:Description> </rdf:RDF> </x
:xmpmeta> <?xpacket end="r"?>.......,IDATx.ba``..bc .`..`..w@
|...........hi.........#>...../_..................T...i.......by\..
..Uzzz.@.. V.;;;{...j|......`.6=,h|.>PQQ.........L...._.....\....._
.]..K.jBBB.DDD>..w.<0..FFFn...e..\`...K........w..../..........o
........P!.........-[...o..]...........e..d......0..o..y...&....).7o..
.[%%%....$A......"..|..=<<.....'O.|.hp....6L..$..A.U__........XB
... fE.466...uk.........Ww....;x......."d....#........^`P([email protected]...
.p&....u|.C..}BB.41.............EL$3B.*'......LMM=.I..0......g`...
<<< skipped >>>


GET /it/u=1315327375,467324658&fm=76 HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?sz=300x250&rdid=2355443&dc=2&di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=02ff9997d2308bbb&tt=1456737391050.1781.2172.2172
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: t11.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: image/jpeg
Expires: Wed, 30 Mar 2016 19:18:26 GMT
Cache-Control: max-age=2628000
Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT
ETag: 17e662f57a37f62f58f496e0d460031c
Content-Length: 65012
Date: Mon, 29 Feb 2016 09:18:26 GMT
Server: lighttpd
......JFIF.............C..............................................
......................C...............................................
............................."........................................
...<...............................!.."1#A.$2Q..a.48q.(B.R.......
..............................;...........................!.."1..#2AQa
.B$%3qR.....Sb................?..,.. V(...q..).&vC.i.2.9^.G#..=.tQ...R
.ViY.*.IM7../.T.....3.i.? .....Z.-O..Ma. P.....#T.,...P....d...,...#..
.I..$?........t...et_.....j,i.....#....:z.:.3..H/i....$.B..}...\74.%Tj
%y......Rd...s......l.a$.....uo...l..n...D..,.fx.d..,c........m.*..[P.
..RJ.s..Z.; .....:.J..v...x......Y*./....R-..OSw./b6.wS.......1......L
.3...S...Q...I."....@a......\[email protected]...].......g83...y
.6.S...Ak.0.Z..V.9..Y.Qh2.3.d...v..........d..H..h.....4.. ....GO?....
W.Y96..t..O..Fw^.t..6.O....ClI....i[.....,.*&.z....:(l".....l._.Jk.r.k
W..... .r....P!`..C ...........8.Mz.X.,...^....e.....GP.VB..U.bW..t...
i..\.........9..8....PVj-q....P.....K.......................<.o.U..
y-.5N.K(...t....<.:J...h...U...u.r.z.....W>..VB.-......k..Z....-
..-F......4.,.UZK.....V.......&.iQ5%k..GWI...u.6..^.de..z.X......Qo.[.
E..qAb.V.e.....'..g..3.qv..A..n*.[.....p...(O2.........cp...||...7$..,
...Y.v.=.^....|.J.H.l!T.^/r.r^[..lGC5....W.......H.\....._l.mb~.......
.......w6;...,.....a...0.X.k...:......d....g%...9F.%{.M}.z..Sp&.o..l..
.......=......|...p.|IX ........)....y&..kxW.6.B.M..OL.O..m...B,V.S}C.
.gj.....a.@:..d....A]..Cn...V.i.. .n..j.k9rwYq.R.....3.3........X0
<<< skipped >>>


GET /acom?di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415691&ari=1&dbv=0&drs=3&pcs=300x250&pss=300x250&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983<u=http://show.bianya.cc/gg/huyan.html?s&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416 HTTP/1.1
Accept: */*
Referer: hXXp://show.bianya.cc/gg/huyan.html?s
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Cache-Control: post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 902
Content-Type: text/javascript;charset=UTF-8
Date: Mon, 29 Feb 2016 09:18:47 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon Feb 29 17:18:47 2016
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Pragma: no-cache
Server: nginx
X-Xss-Protection: 0
BAIDU_UNION_define({"tuid" : "u2229533_0","queryid" : "ee6118cd6aef5ae
f","placement" : {"basic" : {"cname":"54010049_6_cpr","flowType":1,"rs
pFormat":1,"sellType":2,"sspId":1,"tuId":9223372032562038045,"userId":
5893023}.,"container" : {"anchoredType":1,"floated":{},"height":250,"s
izeType":1,"slide":{},"width":300}.,"fillstyle" : {"backgroundColor":"
#FFFFFF","cloudTheme":{},"elements":[5,2,1],"flush":0,"layout":[1],"lu
":{},"search":{},"txt":{"cbackground":"#FFFFFF","cborder":"#FFFFFF","c
desc":"#444444","cflush":"#e10900","ctitle":"#0000ff","curl":"#008000"
,"number":3},"video":{}}.,"userdefine" : "cpro_template=text_default_3
00_250|cpro_version=2.0|cpro_layout_filter=rank,tabcloud","complement_
type" : 2},"extends" : "","pdb_deliv" : {"deliv_id" : "0","deliv_des" 
: {},"brandad" : 0},"order_deliv" : {"deliv_id" : "0","demand_id" : "0
"},"rtb_deliv" : {"deliv_id" : "0","demand_id" : "2229533"}});.
...


GET /wh/o.htm?ltr= HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://show.bianya.cc/gg/huyan.html?s
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Accept-Ranges: bytes
Connection: keep-alive
Content-Length: 1394
Content-Type: text/html
Date: Mon, 29 Feb 2016 09:18:47 GMT
Etag: "56d3f2c0-572"
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Server: nginx
<!DOCTYPE html>.<html>.    <head>.    </head>.
    <body>.        <style>.            .userData {behavior
:url(#default#userdata);}.            .client {behavior:url(#default#c
lientCaps);}.        </style>.        <div id="oPersistDiv" c
lass="userData"></div>.        <div id="clientDiv" class="
client"></div>.        <div id="oFlashDiv"></div>
.        <script src="hXXp://dup.baidustatic.com/tpl/wh.js"><
/script>.        <div id="cFlashDiv">.            <object 
classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="hXXp://
download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7
,0,19,0" width="1" height="1" id="BAIDU_CLB_ac_o_flash" title="BAIDU_C
LB_ac_o_flash" align="middle">.                <param name="allo
wScriptAccess" value="samedomain" />.                <param name
="movie" value="c.swf?v=3">.                <param name="quality
" value="high">.                <param name="wmode" value="trans
parent" />.                <embed wmode="transparent" name="BAID
U_CLB_ac_o_flash_embed" id="BAIDU_CLB_ac_o_flash" src="c.swf?v=3" swli
veconnect="true" quality="high" width="1" height="1" align="middle" al
lowscriptaccess="samedomain" type="application/x-shockwave-flash" plug
inspage="hXXp://VVV.macromedia.com/go/getflashplayer">.            
</object>            .        </div>.        <script sr
c="hXXp://dup.baidustatic.com/tpl/ac.js"></script>.    &l
<<< skipped >>>

GET /acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415691&ari=1&dbv=0&drs=3&pcs=300x250&pss=300x250&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983&ltu=http://show.bianya.cc/gg/huyan.html?s&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416&qn=ee6118cd6aef5aef&tt=1456737415675.94.1344.1344 HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://show.bianya.cc/gg/huyan.html?s
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Cache-Control: post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 3662
Content-Type: text/html
Date: Mon, 29 Feb 2016 09:18:48 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon Feb 29 17:18:48 2016
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Pragma: no-cache
Server: nginx
X-Xss-Protection: 0
<!DOCTYPE html>.<html>.    .    <head>.        <m
eta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
.        <title>..................</title>...<link rel=
"stylesheet" href="hXXp://cpro.baidustatic.com/cpro/ui/noexpire/css/2.
0.1/template.min.css" />...<style type="text/css">.container{
padding-left:0px;padding-right:0px;padding-top:0px;padding-bottom:0px;
margin-top:0px;border-style:solid;border-top-width:0px;border-right-wi
dth:0px;border-bottom-width:0px;border-left-width:0px;border-color:#ff
ffff;width:300px;height:250px;background-color:#ffffff;position:relati
ve;overflow:hidden;float:none;}.item{width:300px;height:250px;}.item a
{width:300px;height:250px;position:absolute;opacity:0;top:0;left:0;dis
play:block;z-index:9;background-color:#ffffff;filter:alpha(opacity=0);
;}.item a:hover{}.item div{width:300px;height:250px;}.column-space{wid
th:20px;height:0px;}.row-space{width:100%;height:0px;}</style>. 
   </head>.    .    <body><div style="display:none;">
;<img src="hXXp://wn.pos.baidu.com/adx.php?c=d25pZD1jY2Y4YjJiYmYyYz
QxYTVhAHM9Y2NmOGIyYmJmMmM0MWE1YQB0PTE0NTY3Mzc1MjgAc2U9MQBidT01AHByaWNl
PVZ0UU0tQUFFYkNCN2pFcGdXNUlBOGh0MWtkekdpb2V5enR4UGV3AGNoYXJnZV9wcmljZT
0yMjkAc2hhcmluZ19wcmljZT0yMjkwMDAAd2luX2RzcD01AGNobWQ9MQBiZGlkPTc1MjI0
MzMxOTRFMTQ4M0JFNDBBQTE5QkMzMUNGQUNGAGNwcm9pZD0AYmNobWQ9MAB2PTEAaT1mNm
NlMTgzMQ"  height="1px" width="1px" alt="" /></div>.    .    
    <div  class="container"  id="container" ><div  class=
<<< skipped >>>

GET /wh/o.swf?v=1 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://pos.baidu.com/wh/o.htm?ltr=
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Accept-Ranges: bytes
Connection: keep-alive
Content-Length: 157
Content-Type: application/x-shockwave-flash
Date: Mon, 29 Feb 2016 09:18:50 GMT
Etag: "56d3f2c0-9d"
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
Server: nginx
CWS.....x.3.bX..........{.^....?............b..............7..Ofq.Cq~Q
.CVbYbqrQfA.U.TBC.!.89. .AI.!.85'.a./.@6.(.`.......d3......Af.;.;#H...
.$..&.g......?.' ....


GET /wh/o.swf?v=1 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://pos.baidu.com/wh/o.htm?ltr=
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Accept-Ranges: bytes
Connection: keep-alive
Content-Length: 157
Content-Type: application/x-shockwave-flash
Date: Mon, 29 Feb 2016 09:18:50 GMT
Etag: "56d3f2c0-9d"
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
Server: nginx
CWS.....x.3.bX..........{.^....?............b..............7..Ofq.Cq~Q
.CVbYbqrQfA.U.TBC.!.89. .AI.!.85'.a./.@6.(.`.......d3......Af.;.;#H...
.$..&.g......?.' HTTP/1.1 200 OK..Accept-Ranges: bytes..Connection: ke
ep-alive..Content-Length: 157..Content-Type: application/x-shockwave-f
lash..Date: Mon, 29 Feb 2016 09:18:50 GMT..Etag: "56d3f2c0-9d"..Last-M
odified: Mon, 29 Feb 2016 07:26:56 GMT..Server: nginx..CWS.....x.3.bX.
.........{.^....?............b..............7..Ofq.Cq~Q.CVbYbqrQfA.U.T
BC.!.89. .AI.!.85'.a./.@6.(.`.......d3......Af.;.;#H....$..&.g......?.
' ..



GET /staticPub/js/room/socket_48ba6f2.js HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:35 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Keep-Alive: timeout=20
Vary: Accept-Encoding
Last-Modified: Fri, 26 Feb 2016 03:53:52 GMT
Vary: Accept-Encoding
Expires: Tue, 29 Mar 2016 09:43:39 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-42
Kugou-Memory: HIT
Content-Encoding: gzip
Connection: close
2774.............}{w.......0.w... [6&.....l ..k....b...5...#.0.x-h..pM
.{.....F....!...l......93.3..6.!....hf........J.#.g.U#qR-...Z)khz)..O.
y..2*...ZQs....()E5....LU..T ....K.B;.rE7tc..FO.-Dzd..)......9v.z.xz.K
...j..Z.....r.=....Y..8..i...m.s...Z.3..ZWWP.t~;...).ra1.=s.>.J0...
.S .ct.~..{..F....ZP....qii....y\))...i.....U#....Ss... [email protected].?&.
..]......Tl.......~8;..;...........=.....#.J...d..Z.-..e..is..#L....h.
...zQ9.T...l.N.....Z.3.|...a..5....Yg...W.l......-...s8..k.Y...lEU..u~
*.Q.......p..\.c.&u9;...)x..............C...F...%....2f....^@_6R...=..
..[.x.}.......5Z...]..sZu..b!...YU;...a$.;JV.l.....JE......jiz...w.].G
...J.J.......Qu>[.>..;u<8.>jQ.....0..E...x......W[...^1|..
1.......K.vF:.Pd..0.Z.9...B7...vA.f.bs7."..4.-.Uj..r.......6E...9..KF.
.J...L.z.O5^.E..\h,5..8...%'.r.3...VRs....m....D......G.8 -.'...Z..C..
....*.^........$.Y.Q...J-X..U].............Lb|<.N.F..pO...dR..x"5..
.e.!.^....H/...t2./....Tf:6f......Tf,y8..C.t&5i>.....t.|. O%.q.z..'
.bG....H_8...O....D....gU4....c*6..B.~9.....1......M..c.s.<=I..K.N.
E...x.J.G..^y$..O...c.=.L......%..."...J...X.D.....c.{1.D&>...w/..I
.g.c....>9v....?.l?F7:.L[.X...x*.@..(:....;:..G.....t,.OLf.s/.../&.
.s.<.L.S.....h.O......SSC..#}...'.h%"{.G...7..8..J....c..,M#.......
Tl(.K..^yx.h:>.HL...;...-N.L'...z......D.......#..a.../.G..c..CG.R.
....H.\.}aL7.I.Nf..c.}<.H...[5...).......wx,..=.z...1><......
...W.:.a:|Q..^........I.q....8&.....a.S....Q. ..v.y,..X........M.R....
.H'G&...&..NG^.e..J"/.}r|,6.............,.$=:....lA...~V....@....|
<<< skipped >>>


GET /staticPub/js/room/roomActivity_059de9b.js HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:38 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Keep-Alive: timeout=20
Vary: Accept-Encoding
Last-Modified: Fri, 26 Feb 2016 03:53:52 GMT
Vary: Accept-Encoding
Expires: Tue, 29 Mar 2016 09:43:40 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-42
Kugou-Memory: HIT
Content-Encoding: gzip
Connection: close
26b2.............}{w.G....S..\[...d..2...@|...;.X...n...%.F.~..kA2$..@
B.r...$$...$...].X..k........VK6..X..........k.~..S3U...j.).s..]s..$..
...O%.Y...j....w.l.g-.......W..eSY...(Y...BW.g.zB..KKsV.`...Y....?s...
...Uu.z.n.u.,......-.i.~.lV0.:.C.S.I......S,`....R..*f=...8..g.......{
.6....R..^....v...@\..........v.W.....e.-.nOO..tI...&.T..;S.n..9s.k...
B.....6...ECw.D6...Z..a.b.-I....`..c.1..m..Wv95..0....{.......D.,...2 
...Z....?...J......Rv.....* ..4O^i.w)[email protected].......
..Q.jnn.7aW.....^.CF./`.....N.;h9n.-Y..(U.P{..|.|....)............kx..
.....w.0..'.~.j..{........)e.....?i.:.Q.O.5..a'.B....C...E3i.C.uS..b.1
.......Q..i....[.e&C..s..>.l.}..o\.z....o_yx....[...X.u.v.....?6...
y....;...G......|......K.4._...r..p......!...C..t..h!..YNi.n.G...:D.L.
...G\...`?.9....h..:.,S]\..qGn...L~....Y'..X.G~.....o.w0.:,05.}2_.W...
g....o....ua....b-..(..MC.[......Z..7.~.v...[WZo.l..b...T......).oab.U
)&...[...dz.%.*.\..S7H...:...c.............8q.]b<..x:7e......:....j
.......<..J.r..W.lV.nI......5d.R....x.:...3(.M.;<../...8<S.=.
....zz.x..%.u....-m}U...$Jv.?....l....:v.lm6........%[email protected]..
x.&m.=.....~..P.......S.J..pMXI...H...OVo.QR8......:...4.bNJY....>.
2.%-;;.)B.$..j..N\j^:..wg.....3ko......d..}x.Z..k..p\.G.q...s\......=C
j.Z~v.&Y<Id...e~.|..dY.NC.3;....s>] .F......w.f..../.-.-..;..\.h
\.[...k...~..........z..H).$>...........D.V.l*.;;....6`....vN`Cp.&l
t;..j....?.M...ek...Z.>.......5G.....-.M.....q*.C5W.Z......V.}.{...
....}.. ....u......a.GB...`....4*..r...D..~ .8........|......[..s.
<<< skipped >>>


GET /fp.htm?br=6&fp=DA5E4CCCE874547210C07EDF3C9427B9&fp2=DA5E4CCCE874547210C07EDF3C9427B9&ci=&bi=7522433194E1483BE40AA19BC31CFACF:FG=1&im=0&wf=1&ct=1000&bp=&m=&t=0&ft=&_=1456737420394 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://pos.baidu.com/wh/o.htm?ltr=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: eclick.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:51 GMT
Content-Type: text/html
Content-Length: 114
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
Connection: keep-alive
ETag: "56d3f2c0-72"
Expires: Mon, 29 Feb 2016 09:18:51 GMT
Cache-Control: max-age=0
Accept-Ranges: bytes
<!DOCTYPE html>.<html>.    <head>.        <meta c
harset="UTF-8" />    .    </head>.    <body>.    </b
ody>.</html>.....


GET /fp.htm?ci=7522433194E1483BE40AA19BC31CFACF:FG=1&cn=7522433194E1483BE40AA19BC31CFACF:FG=1&cu=&cl=&cf=&ce=&ff=c&cuid=&cuid2=&de=&bp=&nip=&_=1456737421206 HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://pos.baidu.com/wh/o.htm?ltr=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: eclick.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:52 GMT
Content-Type: text/html
Content-Length: 114
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
Connection: keep-alive
ETag: "56d3f2c0-72"
Expires: Mon, 29 Feb 2016 09:18:52 GMT
Cache-Control: max-age=0
Accept-Ranges: bytes
HTTP/1.1 200 OK..Server: nginx..Date: Mon, 29 Feb 2016 09:18:52 GMT..C
ontent-Type: text/html..Content-Length: 114..Last-Modified: Mon, 29 Fe
b 2016 07:26:56 GMT..Connection: keep-alive..ETag: "56d3f2c0-72"..Expi
res: Mon, 29 Feb 2016 09:18:52 GMT..Cache-Control: max-age=0..Accept-R
anges: bytes..<!DOCTYPE html>.<html>.    <head>.    
    <meta charset="UTF-8" />    .    </head>.    <body&
gt;.    </body>.</html>.<!DOCTYPE html>.<html>
.    <head>.        <meta charset="UTF-8" />    .    </
head>.    <body>.    </body>.</html>...



GET /cpro/ui/c.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: cpro.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:20 GMT
Content-Type: application/x-javascript
Content-Length: 33405
Connection: close
ETag: "56d3f2c0-827d"
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
Expires: Mon, 29 Feb 2016 09:23:14 GMT
Age: 3306
Cache-Control: max-age=3600
Content-Encoding: gzip
Ohc-Content-Crc: 1075843295
Server: hkg01-sys-jorcol04.hkg01.baidu.com
.....8.V..c.js..;iw.8..E.K d.S..8.a..q...........G....E.A..X...U8xH.st
[email protected]..(.......X<,..<.K.....n.Qa.A.v$.....,.
..V....}....L..u..1t.....T....q2U..9..Lug....k..>...I..S..{:.....q.
.)K;@T.$.Na..<...ul...r.y.. ......~....f.Z...&..........b.K>e...
.6e.!./......I..P...LX.Q..?.y.hJi..!..Y......jN=....1.d....J..|....g\.
2............n.U........u...LK..{.`......e......M....zO.Dcp5..Q..QUt.a
...%ApT1.......k...n..P..,..u|.C;....G...B.$...X|.}.A..k5.H(q.2y..2q..
.z8z.......|.r..K..\........-I.F.a..K.8..w6......"....."hli..I7.4.4.'k
4.....(1#.S"...%.R...24.X[..l......t.-..j...Q_.pY.b3).E...W........h..
..U.j..Xj..."...S.p..`.$.j.s.%..]k3.hpK.&}.f....~...9Anj..~.#k..$J....
. J..q.t....0. .S..3.F..................5.3U6.J.......\.<)..|...q..
A;....y.y..D..E..$t...-.X04.q..(.3....n5..gP!c.:....q ...`.E .......7.
:@.....9.....t..R3{r.>....... >.#.5.bg.\.<ba.....7..X.....fiW
o.....8Jb....CK..N.V.. .....,I..l..Z....#......B..O#..`.M%......S.p...
.M ..'[email protected]....=."...B.....7....g6...u.{K..:.Zt\.^-.T.d$c..SO
.5..L..E.L..\f2tI.%........4...F|..`6....k..S.$.... ..[u,..G@.!>:..
..%...8......H.R....\s...!....LK..?}.o.r...........<...j.l.tL1,...e
K.R...........c3. [email protected])...4`[email protected].
.......P....|#........2..<... .x......q......^.t...c.:.Q..!.Q..&IK.
b..[|.#.M.......H6M..$.4.J6.a..(3....9]..0p......cGfj..C........p..U..
.,.# 2...P....H.......N..2%..... @[email protected]*a;..........).%s..BN
.r.7.....tF..^EA.]P..<..=..i.......... ..c= .........}>..%.1
<<< skipped >>>


GET /staticPub/js/room/roomInit_f54bbdd.js HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:38 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Keep-Alive: timeout=20
Vary: Accept-Encoding
Last-Modified: Tue, 23 Feb 2016 04:02:25 GMT
Vary: Accept-Encoding
Expires: Thu, 24 Mar 2016 04:07:14 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-7
Kugou-Memory: HIT
Content-Encoding: gzip
Connection: close
1dde.............\{s.Yu.*..k4.Z=.=l.4v.....l..wI6....;3-.t..=z ..B...e
........!.B...]....... .w..=.=/.^CQ)......}.=..9..].....8..=..v.....L&
lt;..A..^.i.........hyC|:W.....s......u./s%g...../.s...D...........N..
\.r.k/.....tl....y.....4..V.b..R..9.6#s&:..-.#..a.."....a...Z.-r4/..~.
.x.....@\.@'".EN'...i.....T^.zc.....Z....E{Q.ds'.m..3h8.....czq.~q....
......\@/.....yk.[...5......i^.T:.i...^..;....D..^*...X.....7...w#...E
.....).....g...z./..._.#....3.N30.....6]MOPO....[T.............wQ.uC.l
....96-y`.a............oF.m.?._..`.}0.....x..7..j....4t..6.U......D\u.
i.r.j.:9....l.O.N-..V....j.X.C5..3xM......b.Z>....u..M:....5...Zd..
|.....f.v...Nt.......&.E......A...wE>...g...K5.A.-l.k...kAd......^.
X.....G".h.....3n.K.A.w...Y...sW.h7Mk........hw..\>.j........'...0.
.{ .......VV}..!N`...uAF.b_`.z....&...'...s.N7"..%..l.`.}.....Q... ...
#*...8...N.[h..>)..v...4...%..:........d1.m'.#A=,..7......ju.......
...X.6\.9.C...y"....Y..[..O........_.hP.....;.W\. ..........z.lfZ.hT.Z
Q...... )........_.D.......e.....U...7.n....3.........N...R..7..vF.iLe
L7.N..Qf.F...2..L......u..8..f.3....*.".\~.T2J...wp/r.........3x...>
;..O.~....~......_...'..}.KO........}...?._.....'..;m..o....j;0Tb;,...
...y..$5B$.....a-.%....O.g.....:.....%.....R.......e.*.&....,..FW..KJA
]....cP..U4........WI.`.^.Pb~.n..Pf_P........`[email protected]%..Gj.L..z|
.n9.h.3......Y...J..z....s%.r:{;......wLwo..E.....I6..(.......*...v0.l
v|E\i..4..w.6......Oh.jNe..Ygx.e..rh.b..s/A...8.Ki.?=./.".. 5$.R.T]'..
.^*....._......A...x....d....-.......mN..KE<(..F..]i..9x zW(V..
<<< skipped >>>


GET /fp.htm?br=6&fp=DA5E4CCCE874547210C07EDF3C9427B9&fp2=DA5E4CCCE874547210C07EDF3C9427B9&ci=&bi=7522433194E1483BE40AA19BC31CFACF:FG=1&im=0&wf=1&ct=1797&bp=&m=&t=0&ft=&_=1456737421128 HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/wh/o.htm?ltr=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: eclick.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:52 GMT
Content-Type: text/html
Content-Length: 114
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
Connection: keep-alive
ETag: "56d3f2c0-72"
Expires: Mon, 29 Feb 2016 09:18:52 GMT
Cache-Control: max-age=0
Accept-Ranges: bytes
<!DOCTYPE html>.<html>.    <head>.        <meta c
harset="UTF-8" />    .    </head>.    <body>.    </b
ody>.</html>.....


GET /fp.htm?ci=7522433194E1483BE40AA19BC31CFACF:FG=1&cn=7522433194E1483BE40AA19BC31CFACF:FG=1&cu=7522433194E1483BE40AA19BC31CFACF:FG=1&cl=&cf=&ce=&ff=c&cuid=&cuid2=&de=&bp=&nip=&_=1456737421894 HTTP/1.1


Accept: */*
Referer: hXXp://pos.baidu.com/wh/o.htm?ltr=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: eclick.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:52 GMT
Content-Type: text/html
Content-Length: 114
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
Connection: keep-alive
ETag: "56d3f2c0-72"
Expires: Mon, 29 Feb 2016 09:18:52 GMT
Cache-Control: max-age=0
Accept-Ranges: bytes
<!DOCTYPE html>.<html>.    <head>.        <meta c
harset="UTF-8" />    .    </head>.    <body>.    </b
ody>.</html>.HTTP/1.1 200 OK..Server: nginx..Date: Mon, 29 Fe
b 2016 09:18:52 GMT..Content-Type: text/html..Content-Length: 114..Las
t-Modified: Mon, 29 Feb 2016 07:26:56 GMT..Connection: keep-alive..ETa
g: "56d3f2c0-72"..Expires: Mon, 29 Feb 2016 09:18:52 GMT..Cache-Contro
l: max-age=0..Accept-Ranges: bytes..<!DOCTYPE html>.<html>
.    <head>.        <meta charset="UTF-8" />    .    </
head>.    <body>.    </body>.</html>...



GET /acom?di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415659&ari=1&dbv=0&drs=3&pcs=296x249&pss=300x253&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983<u=http://show.bianya.cc/gg/huyan.html&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416 HTTP/1.1
Accept: */*
Referer: hXXp://show.bianya.cc/gg/huyan.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Cache-Control: post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 902
Content-Type: text/javascript;charset=UTF-8
Date: Mon, 29 Feb 2016 09:18:47 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon Feb 29 17:18:47 2016
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Pragma: no-cache
Server: nginx
X-Xss-Protection: 0
BAIDU_UNION_define({"tuid" : "u2229533_0","queryid" : "2f8bbc640f2a404
3","placement" : {"basic" : {"cname":"54010049_6_cpr","flowType":1,"rs
pFormat":1,"sellType":2,"sspId":1,"tuId":9223372032562038045,"userId":
5893023}.,"container" : {"anchoredType":1,"floated":{},"height":250,"s
izeType":1,"slide":{},"width":300}.,"fillstyle" : {"backgroundColor":"
#FFFFFF","cloudTheme":{},"elements":[5,2,1],"flush":0,"layout":[1],"lu
":{},"search":{},"txt":{"cbackground":"#FFFFFF","cborder":"#FFFFFF","c
desc":"#444444","cflush":"#e10900","ctitle":"#0000ff","curl":"#008000"
,"number":3},"video":{}}.,"userdefine" : "cpro_template=text_default_3
00_250|cpro_version=2.0|cpro_layout_filter=rank,tabcloud","complement_
type" : 2},"extends" : "","pdb_deliv" : {"deliv_id" : "0","deliv_des" 
: {},"brandad" : 0},"order_deliv" : {"deliv_id" : "0","demand_id" : "0
"},"rtb_deliv" : {"deliv_id" : "0","demand_id" : "2229533"}});.
...


GET /wh/o.htm?ltr= HTTP/1.1


Accept: */*
Referer: hXXp://show.bianya.cc/gg/huyan.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Accept-Ranges: bytes
Connection: keep-alive
Content-Length: 1394
Content-Type: text/html
Date: Mon, 29 Feb 2016 09:18:47 GMT
Etag: "56d3f2c0-572"
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Server: nginx
<!DOCTYPE html>.<html>.    <head>.    </head>.
    <body>.        <style>.            .userData {behavior
:url(#default#userdata);}.            .client {behavior:url(#default#c
lientCaps);}.        </style>.        <div id="oPersistDiv" c
lass="userData"></div>.        <div id="clientDiv" class="
client"></div>.        <div id="oFlashDiv"></div>
.        <script src="hXXp://dup.baidustatic.com/tpl/wh.js"><
/script>.        <div id="cFlashDiv">.            <object 
classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="hXXp://
download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7
,0,19,0" width="1" height="1" id="BAIDU_CLB_ac_o_flash" title="BAIDU_C
LB_ac_o_flash" align="middle">.                <param name="allo
wScriptAccess" value="samedomain" />.                <param name
="movie" value="c.swf?v=3">.                <param name="quality
" value="high">.                <param name="wmode" value="trans
parent" />.                <embed wmode="transparent" name="BAID
U_CLB_ac_o_flash_embed" id="BAIDU_CLB_ac_o_flash" src="c.swf?v=3" swli
veconnect="true" quality="high" width="1" height="1" align="middle" al
lowscriptaccess="samedomain" type="application/x-shockwave-flash" plug
inspage="hXXp://VVV.macromedia.com/go/getflashplayer">.            
</object>            .        </div>.        <script sr
c="hXXp://dup.baidustatic.com/tpl/ac.js"></script>.    &l
<<< skipped >>>

GET /acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415659&ari=1&dbv=0&drs=3&pcs=296x249&pss=300x253&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983&ltu=http://show.bianya.cc/gg/huyan.html&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416&qn=2f8bbc640f2a4043&tt=1456737415628.141.1360.1360 HTTP/1.1


Accept: */*
Referer: hXXp://show.bianya.cc/gg/huyan.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Cache-Control: post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 3659
Content-Type: text/html
Date: Mon, 29 Feb 2016 09:18:48 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon Feb 29 17:18:48 2016
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Pragma: no-cache
Server: nginx
X-Xss-Protection: 0
<!DOCTYPE html>.<html>.    .    <head>.        <m
eta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
.        <title>..................</title>...<link rel=
"stylesheet" href="hXXp://cpro.baidustatic.com/cpro/ui/noexpire/css/2.
0.1/template.min.css" />...<style type="text/css">.container{
padding-left:0px;padding-right:0px;padding-top:0px;padding-bottom:0px;
margin-top:0px;border-style:solid;border-top-width:0px;border-right-wi
dth:0px;border-bottom-width:0px;border-left-width:0px;border-color:#ff
ffff;width:300px;height:250px;background-color:#ffffff;position:relati
ve;overflow:hidden;float:none;}.item{width:300px;height:250px;}.item a
{width:300px;height:250px;position:absolute;opacity:0;top:0;left:0;dis
play:block;z-index:9;background-color:#ffffff;filter:alpha(opacity=0);
;}.item a:hover{}.item div{width:300px;height:250px;}.column-space{wid
th:20px;height:0px;}.row-space{width:100%;height:0px;}</style>. 
   </head>.    .    <body><div style="display:none;">
;<img src="hXXp://wn.pos.baidu.com/adx.php?c=d25pZD1lNzg3ZTEyNWUwMW
E4YzZiAHM9ZTc4N2UxMjVlMDFhOGM2YgB0PTE0NTY3Mzc1MjgAc2U9MQBidT01AHByaWNl
PVZ0UU0tQUFFVHI1N2pFcGdXNUlBOHA4OVNDM2JCVHc1c2l3TkxBAGNoYXJnZV9wcmljZT
0xNDIAc2hhcmluZ19wcmljZT0xNDIwMDAAd2luX2RzcD01AGNobWQ9MQBiZGlkPTc1MjI0
MzMxOTRFMTQ4M0JFNDBBQTE5QkMzMUNGQUNGAGNwcm9pZD0AYmNobWQ9MAB2PTEAaT1jOT
JjMDliOQ"  height="1px" width="1px" alt="" /></div>.    .    
    <div  class="container"  id="container" ><div  class=
<<< skipped >>>

GET /wh/c.swf?v=3 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://pos.baidu.com/wh/o.htm?ltr=
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Accept-Ranges: bytes
Connection: keep-alive
Content-Length: 547
Content-Type: application/x-shockwave-flash
Date: Mon, 29 Feb 2016 09:18:50 GMT
Etag: "56d3f2c0-223"
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
Server: nginx
CWS.....x..Q.r.A.};.a'$...D..8y.KrM..*....)..aw...k..*7oz..[..*....g..
~...=..RQ.0........Y|....M.w.&..#......}t.D5..D. b.4;...p%.y....P.].4_
..........0....D.4.....%gIK.@.... %..1......K.K.o.?...B..!..Q.e2.U....
....q= .)b.......6$...T.&D...[G.}$.b...|.J..mg...J.....P.D.....y;.S...
.l..%.....{......^.....-O'X....H.co}d( u.X.n..9v..C...=L..F.NK.s.<Q
..b...f..WZ..LK..XU">0.\...........I...sy....xDY..:...j....7.....M.
..Fu:.MF...Yr.W....?.X.....g..kFs.lk.....<.s...N.....&.r..~o....ZSk
[z.....b...6..xi...].f...w~w.../.........s.^.....P.8b:.;..1.?....2nt>....


GET /wh/c.swf?v=3 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://pos.baidu.com/wh/o.htm?ltr=
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Accept-Ranges: bytes
Connection: keep-alive
Content-Length: 547
Content-Type: application/x-shockwave-flash
Date: Mon, 29 Feb 2016 09:18:50 GMT
Etag: "56d3f2c0-223"
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
Server: nginx
CWS.....x..Q.r.A.};.a'$...D..8y.KrM..*....)..aw...k..*7oz..[..*....g..
~...=..RQ.0........Y|....M.w.&..#......}t.D5..D. b.4;...p%.y....P.].4_
..........0....D.4.....%gIK.@.... %..1......K.K.o.?...B..!..Q.e2.U....
....q= .)b.......6$...T.&D...[G.}$.b...|.J..mg...J.....P.D.....y;.S...
.l..%.....{......^.....-O'X....H.co}d( u.X.n..9v..C...=L..F.NK.s.<Q
..b...f..WZ..LK..XU">0.\...........I...sy....xDY..:...j....7.....M.
..Fu:.MF...Yr.W....?.X.....g..kFs.lk.....<.s...N.....&.r..~o....ZSk
[z.....b...6..xi...].f...w~w.../.........s.^.....P.8b:.;..1.?....2HTTP
/1.1 200 OK..Accept-Ranges: bytes..Connection: keep-alive..Content-Len
gth: 547..Content-Type: application/x-shockwave-flash..Date: Mon, 29 F
eb 2016 09:18:50 GMT..Etag: "56d3f2c0-223"..Last-Modified: Mon, 29 Feb
 2016 07:26:56 GMT..Server: nginx..CWS.....x..Q.r.A.};.a'$...D..8y.KrM
..*....)..aw...k..*7oz..[..*....g..~...=..RQ.0........Y|....M.w.&..#..
....}t.D5..D. b.4;...p%.y....P.].4_..........0....D.4.....%gIK.@.... %
..1......K.K.o.?...B..!..Q.e2.U........q= .)b.......6$...T.&D...[G.}$.
b...|.J..mg...J.....P.D.....y;.S....l..%.....{......^.....-O'X....H.co
}d( u.X.n..9v..C...=L..F.NK.s.<Q..b...f..WZ..LK..XU">0.\........
...I...sy....xDY..:...j....7.....M...Fu:.MF...Yr.W....?.X.....g..kFs.l
k.....<.s...N.....&.r..~o....ZSk[z.....b...6..xi...].f...w~w.../...
......s.^.....P.8b:.;..1.?....2..
<<< skipped >>>


GET /fxroombg/20140827184515870962.jpg HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:32 GMT
Content-Type: image/jpeg
Content-Length: 91017
Connection: keep-alive
Keep-Alive: timeout=20
Last-Modified: Wed, 27 Aug 2014 10:45:15 GMT
Expires: Mon, 14 Mar 2016 15:47:07 GMT
Cache-Control: max-age=2592000
Kugou-Memory: HIT
Accept-Ranges: bytes
......Exif..II*.................Ducky.......P.....zhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c01
4 79.151481, 2013/03/13-12:09:15        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:ab6d73e4-de12-9f4
1-bd72-a2d6b7981fed" xmpMM:DocumentID="xmp.did:F5F4F97C28D911E4A836C4B
1911007EF" xmpMM:InstanceID="xmp.iid:F5F4F97B28D911E4A836C4B1911007EF"
 xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:662355ae-debd-d043-b5f0-1de44e13a7b2" st
Ref:documentID="xmp.did:ab6d73e4-de12-9f41-bd72-a2d6b7981fed"/> <
;/rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket
 end="r"?>....Adobe.d..............................................
......................................................................
.............................................y........................
..............................................!1Q.Aa.q......."2.BbR...
......................1!A............?..d..[....*.....>......b.....
..........g.99Ax.|...EI..W..ZT.......}e............_XMX.8J..}2....\..Q
...dT.. .C..US. .ub.W.......#4W....:.....Ab._.*.Vh..TJ...JE..eqR%./..r
z..\...i...m1.^.......cK....r.\i:.....!...Z......L\.F.k..Z..t.&...
<<< skipped >>>


GET /fxstatic/images/roombg_3eb04e4.png HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:37 GMT
Content-Type: image/png
Content-Length: 131107
Keep-Alive: timeout=20
Last-Modified: Sat, 30 Jan 2016 15:11:52 GMT
Expires: Mon, 14 Mar 2016 14:48:36 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-40
Kugou-Memory: HIT
Accept-Ranges: bytes
Connection: close
.PNG........IHDR...............].....tEXtSoftware.Adobe ImageReadyq.e&
lt;...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:D3
69F27923B611E58F24DD0B365CBD36" xmpMM:InstanceID="xmp.iid:D369F27823B6
11E58F24DD0B365CBD36" xmp:CreatorTool="Adobe Photoshop CC (Windows)"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8EEB4751FAEB11E49A6
EAD8D1BD27543" stRef:documentID="xmp.did:8EEB4752FAEB11E49A6EAD8D1BD27
543"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>.`......IDATx..].`T....&.d%....@..$.."....."
.jEq...Skk]Zm.Z.[..W-*j...D..76E [email protected]..'....;..IB.p>..d.v.
[email protected]]........^AAAAAA.<.Eu.Bsb..u.1"..X...e...Q..?..
..C(:$...... .(..(?..}..a>.;...W}.....M[[email protected];O.HA
.V....j...>.z...oU..M....].....Q....TX......?..........4...s2.(.^.Y
.3...<.>....\... .P..^.5..%..u"y.....j3.....C.....|..k....0XT...
es......R..B..g.....b.Z..m.o...........q.......F.../.eb.|>.=.......
y{|.F....D!..oc..<[...^.PK....).f.te.\.t.r..].?...}.ii.....g......V
.kZM.b..`Q\U..D...**W.Q.i...A...`.E. .`.M._.....Z9.(......t..Iq..;
<<< skipped >>>


GET /gg/huyan.html HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: show.bianya.cc
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:46 GMT
Content-Type: text/html
Content-Length: 909
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
Cache-Control: max-age=1800
ETag: "568cc0d7-38d"
Last-Modified: Wed, 06 Jan 2016 07:23:03 GMT
Expires: Mon, 29 Feb 2016 08:42:53 GMT
Accept-Ranges: bytes
Age: 377
X-Cache: HIT(R) from bgp-ha-lya-133; MISS(S)|HIT(R) from gtt-de-fra-099
X-Request-Id: de5eef00237e81f26bff9df85fc8778a; 3cac6d802750431fa0562b831cbfa84d
Via: T.51102.S.2, T.12814.R.1, V.ntt-cn-hkg-012, T.51102.R.1, M.gtt-de-fra-099
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xml
ns="hXXp://VVV.w3.org/1999/xhtml"><head><meta http-equiv="
Content-Type" content="text/html; charset=utf-8" />.<title>&l
t;/title></head>.<body scroll="no" style="overflow: hidden
;padding:0px;margin:0px;">..<script type="text/javascript">. 
   /*......-......300x250_6.........*/.    var cpro_id = "u2229533";.&
lt;/script>.<script src="hXXp://cpro.baidustatic.com/cpro/ui/c.j
s" type="text/javascript"></script>.<div style="display:no
ne;"><script type="text/javascript">var cnzz_protocol = (("ht
tps:" == document.location.protocol) ? " hXXps://" : " hXXp://");docum
ent.write(unescape("3E"));</script>.<
;/div>.</body></html>...
<<< skipped >>>


GET /api/tongji4?param=v1 HTTP/1.1
Host: tc.hiv-hiv.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.1
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Mon, 29 Feb 2016 09:18:13 GMT
Content-Length: 128
803205E80E6D2BD3E6D55CBDD54DA21E748B5A5135ED5C5C3619F5EB07AF6349094A7B
B4C9A39C6E1746A89D2D8722EF916B43FBAE0308BF7DF03F4B208031CCHTTP/1.1 200
 OK..Cache-Control: private..Content-Type: text/html; charset=utf-8..S
erver: Microsoft-IIS/8.5..X-AspNetMvc-Version: 5.1..X-AspNet-Version: 
4.0.30319..X-Powered-By: ASP.NET..Date: Mon, 29 Feb 2016 09:18:13 GMT.
.Content-Length: 128..803205E80E6D2BD3E6D55CBDD54DA21E748B5A5135ED5C5C
3619F5EB07AF6349094A7BB4C9A39C6E1746A89D2D8722EF916B43FBAE0308BF7DF03F
4B208031CC..



GET /adx.php?c=d25pZD00ZmM0YzU2NzA0NmIwODdjAHM9NGZjNGM1NjcwNDZiMDg3YwB0PTE0NTY3Mzc1MDMAc2U9MQBidT01AHByaWNlPVZ0UU0zd0FPUDlON2pFcGdXNUlBOHVETGcyMlhzaG01MmpFWmJRAGNoYXJnZV9wcmljZT0xAHNoYXJpbmdfcHJpY2U9MTAwMAB3aW5fZHNwPTUAY2htZD0xAGJkaWQ9NzUyMjQzMzE5NEUxNDgzQkU0MEFBMTlCQzMxQ0ZBQ0YAY3Byb2lkPQBiY2htZD0wAHY9MQBpPTJmMGNiODFj HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?rdid=2480739&dc=2&di=u2480739&dri=0&dis=0&dai=1&ps=74x308&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x896&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737391&qn=bc8e12d50064a9a9&tt=1456737391050.438.1891.1891
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: wn.pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:25 GMT
Content-Type: image/gif
Content-Length: 49
Connection: keep-alive
Expires: Mon, 26 Jul 1997 05:00:00 GMT
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Serv
er: nginx..Date: Mon, 29 Feb 2016 09:18:25 GMT..Content-Type: image/gi
f..Content-Length: 49..Connection: keep-alive..Expires: Mon, 26 Jul 19
97 05:00:00 GMT..GIF89a...................!.......,...........T..;..



GET /adx.php?c=d25pZD05ZWY5YzM2OGY2ODVmYjM2AHM9OWVmOWMzNjhmNjg1ZmIzNgB0PTE0NTY3Mzc1MDQAc2U9MQBidT00AHByaWNlPVZ0UU00QUFBMFNwN2pFcGdXNUlBOHFzVHlnTWZuTTdtb0JoMWRBAGNoYXJnZV9wcmljZT0xAHNoYXJpbmdfcHJpY2U9MTAwMAB3aW5fZHNwPTQAY2htZD0xAGJkaWQ9NzUyMjQzMzE5NEUxNDgzQkU0MEFBMTlCQzMxQ0ZBQ0YAY3Byb2lkPQBiY2htZD0wAHY9MQBpPTAyNWFlZjY1 HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?sz=300x250&rdid=2355443&dc=2&di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=02ff9997d2308bbb&tt=1456737391050.1781.2172.2172
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: wn.pos.baidu.com
Connection: Ke
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:25 GMT
Content-Type: image/gif
Content-Length: 49
Connection: keep-alive
Expires: Mon, 26 Jul 1997 05:00:00 GMT
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Serv
er: nginx..Date: Mon, 29 Feb 2016 09:18:25 GMT..Content-Type: image/gi
f..Content-Length: 49..Connection: keep-alive..Expires: Mon, 26 Jul 19
97 05:00:00 GMT..GIF89a...................!.......,...........T..;..



GET /tpl/wh.js HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/wh/o.htm?ltr=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dup.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:49 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: close
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
Expires: Mon, 29 Feb 2016 10:07:51 GMT
Age: 658
Cache-Control: max-age=3600
Ohc-Content-Crc: 204290763
Server: hkg01-sys-jorcol07.hkg01.baidu.com
Content-Encoding: gzip
400a..............k{.8....."..N.... ..q.....]..Kw.....%.V.....8.{~.y..
R.,_.]s..3=.P."............h9..w...G..?.^.O...r2Zv?..O.'...'../.^67..F
....t.?.<..v....r~.....t.....b..b2;z2.......hz>...........{...[/
<..E.r5......b.d8..O>>.ir\^]tF.ns.?e.f........p4..94...8.....
........M.&.......v..........ao...F...|.._....`..r>=?~.?:x9.;..;...
....O'.......n....|.az<...3..b..?>8.A9|...?9...N......`.........
...?.,F............M.c;.~......qo..l.c.s.././...g..N..:.....`p4.<..
....w......fd.K..........^0..G.._X^.v..1N....q:.8....r.Xv......x}..B..
....[.y...^~D.g..):.a.....cb{.[.......0.;1.#.......#.C ....m4.XMnF....
.a.YI....D..ON!LO.j.F............VK.;........./\.....hvv1.O.....N\O..b
.7......0...........j.1.t........O..g.Q....t.5.......8..;.|{..I.'M...?
|..py.}..z)..........@$...=....(..f...Q..E..z...b6?.n..G.-......[.M...
...4...nAR:........!.......;l....v..sM..v...iY. a.o%.#.<"a..4...~..
Q..}^... :...L.....n.l.~..WN|...yz<9_...9.....V.p...0....g.^|......
....7.._w_L..n.....X..0:u.8.....A....~^!.q....U.b>;.....w...S...w..
.._~D/..........O....|...-...p..........d.8....._.<_...?.~rz.....&.
..9.p...._L. ...p...$..d......;.W...W....]......R.]....v..o......d...W
....g....NR;......._....J.Y.7;..v.j6.B|.....f2.}6xZO..f...gc..Ac. ...L
...[....R.......-....tS.U.....A......6w^.?P /I.H.{....-m6..2`}.a.....G
..t......9......l2x..}.....Z...l8..;......P.I....=.F....{.};.8.......0
X;.X..8.....!..:.k...........m.><.rxJ.....d`..>.Eb.z...X.S.?Y
..b..w...O.._..o.......x....~...n.J.^t<?..~?.0.;%j .1.....yk...
<<< skipped >>>


GET /cpro/ui/noexpire/js/2.0.1/oojs.js HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415659&ari=1&dbv=0&drs=3&pcs=296x249&pss=300x253&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983<u=http://show.bianya.cc/gg/huyan.html&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416&qn=2f8bbc640f2a4043&tt=1456737415628.141.1360.1360
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cpro.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:50 GMT
Content-Type: application/x-javascript
Content-Length: 2176
Connection: close
ETag: "5667c7a9-880"
Last-Modified: Wed, 09 Dec 2015 06:18:17 GMT
Expires: Mon, 08 Dec 2025 04:16:59 GMT
Age: 6930111
Cache-Control: max-age=315360000
Content-Encoding: gzip
Ohc-Content-Crc: 1071315068
Server: hkg01-sys-jorcol09.hkg01.baidu.com
...........Xmo.6.. ..0..!;_.c...^[email protected]..*[email protected]#j8/.
.q..T..V9y...F.w...}..7.Q\..W@.....'..]...T.F;..Z...o...;HK..........D
...y...w.B9K.b....s9).p.Q73...Y...o..E.U.]...{.u..;.D.-.2...W.j.JP.b..
'[email protected]:...`....V.,.....rw`....~..@8.....;Y..Z}....E......X..H...hj&&.
 ..c\.S.H!.h.......F....N..g-...r*. ...y...c-.z.fE....T...V..X...A.Z ^
.....(.b........t...Z..W..2.. %[email protected]/i...p........
\....Y/$`b...W...O..&Mp....?&.*J....v.....][email protected]...
..F.6j......K#5...I.Bi...^..1R.....V.q5.:..c,..r...)x].z.}.'..J..W.9Dc
.y......I......9....t.<...V...R...QMP.P......m..KQ.....~5......,..~
.&*.:.$..s._..G....J..,$...J.................cb.......O.,Y..!&G...^)C.
L. l.H.M...c.... (8.~.....R.l...w......u......%..M....i4..;..8./.b;x..
../..(.r.....F..$F......KWT...w...%...j......bw.zG:.l...xI.v..w.......
}.u...b..f...h@..[...#...d....yy.U,.....m.-l....!..$?......!.).br8y..N
R.Fm....6....*:...... .....p..n..M.......=p..A>...J....B\..@..!p..w
.,.j....O.5.T....0....{./..I..Mj.........d.,..N.....wX...7.1})b../.U(7
....O...s...r...]..d6i.B_&...X.............|.&.?x..$s...J#{.KF1.0R...7
=}...S[.h....=.`.G.....'^..]..>.7[[email protected]`[.Y...Qa..~.C1..2.fz.U.0
......!..9E..G.|..Sxr8.0...8"...4.B...............i....N.G.4.|...N.$..
1.vN..KE......k.,..A..|b..f....{......).I.B.A..3./V...mi...,....`.?...
.....C.......-.b.uP..5Q...Dn).F.......C.byb/.bX.A8.OJ...k...H.......s.
6Q.^.5..{H.^9......../[email protected] .eW.$... .. .T.T.2.........v...`..
..Na I@.<...,[email protected]
<<< skipped >>>


GET /1028630 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: fanxing.kugou.com
Connection: Keep-Alive
Cookie: __fx_union_access__=1-1-1; __fx_union_page__=3-3:5-2-2; __fx_unionId__=111-17614


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=120
Content-Type: text/html; charset=utf-8
Date: Mon, 29 Feb 2016 09:18:25 GMT
Expires: Mon, 29 Feb 2016 09:19:25 GMT
Last-Modified: Mon, 29 Feb 2016 09:16:50  0000
Server: ECS (ams/D1F9)
X-Cache: HIT
Content-Length: 273960
<!DOCTYPE HTML>..<!--kugoubegin-->..<html>...<hea
d>....<script type="text/javascript">var timeStartLoad = new 
Date().getTime();</script>....<meta http-equiv='Content-Type'
 content='text/html;charset=utf-8'></meta>....<meta http-e
quiv="X-UA-Compatible" content="IE=edge" />....<meta name="rende
rer" content="webkit|ie-comp|ie-stand">..        <title>.....
.---...... | ......... | ......... | .................................
...</title>....<meta name='keywords' content='......---......
_........._..............._......_............_............_..........
..' />....<meta name='description' itemprop="description" conten
t='......---..........................................................
...............................................K......................
........................................................' />....<
;meta itemprop="name" content='......---...... | ...............' />
;....<meta itemprop="image" content='hXXp://p3.fx.kgimg.com/v2/fxus
erlogo/T1vgAyBXJb1RCvBVdK.jpg_85x85.jpg' />......<script type="t
ext/javascript" src="hXXp://login-user.kugou.com/v1/kguser.js"><
/script>....<script type="text/javascript" src="hXXp://serveradd
r.serviceweb.kugou.com/KgAck.js"></script>....<script type
="text/javascript">....var userRegName = "";....var userNickName = 
"";..        var staticVersion = "5.47.0";....var vServiceUrl = "http:
//visitor.fanxing.kugou.com/VServices.php";....var vCDNServiceUrl=
<<< skipped >>>


GET /fxstatic/images/userfile/successIcon_754795c.png HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:32 GMT
Content-Type: image/png
Content-Length: 1295
Keep-Alive: timeout=20
Last-Modified: Sat, 30 Jan 2016 15:11:52 GMT
Expires: Mon, 14 Mar 2016 13:16:22 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-7
Kugou-Memory: HIT
Accept-Ranges: bytes
Connection: close
.PNG........IHDR...1...1.....DB......gAMA......a.... cHRM..z&.........
.....u0...`..:....p..Q<...ePLTE...o.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.O
o.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo
.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.
Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.O
o.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo
.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.Oo.O..........utRNS..;y....z?..D..].
^=.>........ [email protected]#.....!...qp_Cwv.d..e..E.H.....:...B.L..
.U.............FMut.on$.2G......{..?.....bKGD....H....pHYs..........o.
d....IDATH....C.0...R`.mN..1...7..)....1..._..S|. .j..sI..m..}.r....]r
...h.....agxhP.....1...#J2.7B...)'(.....4..etL.o.O.......'3i.01e....&g
t;;....f>7..3.~`n..,,z.j,....9/p.@..%....t.pE4^.F..u......q.oZ^A..-
e.o....r......d.B..u.*[email protected].....::.,..h...D..nk4....A........h=..
..l....6UnZ.....Mt..h.y(........s.l.6..0.)p...6../..8...Ge.p..w.....M&
lt;/..bb\.G....S/.....g.w.[....B...._BZ.!......;..h...7N....E...om....
.I.:..G.._..*.>..../.,V.7....;,.......r... .....}......t...e......A
.....4...~...."...s.jI.......  ...z.k..P. ..qW..............wZ....v...
.|..#.?.E....dA..$=J...'....Oy..{...kO...Lw...>#...........S..~....
Ul.......1..........Pi..U......j....3.N.. 0/....IEND.B`...
<<< skipped >>>


GET /tpl/wh.js HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/wh/o.htm?ltr=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dup.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:49 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: close
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
Expires: Mon, 29 Feb 2016 10:08:53 GMT
Age: 596
Cache-Control: max-age=3600
Ohc-Content-Crc: 204290763
Server: hkg01-sys-jorcol08.hkg01.baidu.com
Content-Encoding: gzip
400a..............k{.8....."..N.... ..q.....]..Kw.....%.V.....8.{~.y..
R.,_.]s..3=.P."............h9..w...G..?.^.O...r2Zv?..O.'...'../.^67..F
....t.?.<..v....r~.....t.....b..b2;z2.......hz>...........{...[/
<..E.r5......b.d8..O>>.ir\^]tF.ns.?e.f........p4..94...8.....
........M.&.......v..........ao...F...|.._....`..r>=?~.?:x9.;..;...
....O'.......n....|.az<...3..b..?>8.A9|...?9...N......`.........
...?.,F............M.c;.~......qo..l.c.s.././...g..N..:.....`p4.<..
....w......fd.K..........^0..G.._X^.v..1N....q:.8....r.Xv......x}..B..
....[.y...^~D.g..):.a.....cb{.[.......0.;1.#.......#.C ....m4.XMnF....
.a.YI....D..ON!LO.j.F............VK.;........./\.....hvv1.O.....N\O..b
.7......0...........j.1.t........O..g.Q....t.5.......8..;.|{..I.'M...?
|..py.}..z)..........@$...=....(..f...Q..E..z...b6?.n..G.-......[.M...
...4...nAR:........!.......;l....v..sM..v...iY. a.o%.#.<"a..4...~..
Q..}^... :...L.....n.l.~..WN|...yz<9_...9.....V.p...0....g.^|......
....7.._w_L..n.....X..0:u.8.....A....~^!.q....U.b>;.....w...S...w..
.._~D/..........O....|...-...p..........d.8....._.<_...?.~rz.....&.
..9.p...._L. ...p...$..d......;.W...W....]......R.]....v..o......d...W
....g....NR;......._....J.Y.7;..v.j6.B|.....f2.}6xZO..f...gc..Ac. ...L
...[....R.......-....tS.U.....A......6w^.?P /I.H.{....-m6..2`}.a.....G
..t......9......l2x..}.....Z...l8..;......P.I....=.F....{.};.8.......0
X;.X..8.....!..:.k...........m.><.rxJ.....d`..>.Eb.z...X.S.?Y
..b..w...O.._..o.......x....~...n.J.^t<?..~?.0.;%j .1.....yk...
<<< skipped >>>


GET /v2/fxuserlogo/T1vgAyBXJb1RCvBVdK.jpg_85x85.jpg HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p3.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:32 GMT
Content-Type: image/jpeg
Content-Length: 4819
Keep-Alive: timeout=20
Last-Modified: Thu, 25 Feb 2016 12:50:42 GMT
Expires: Wed, 30 Mar 2016 09:15:24 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-40
Kugou-Memory: HIT
Connection: close
......JFIF.............C..............................................
......................C...............................................
........................U.U.."........................................
....................}........!1A..Qa."q.2....#B...R..$3br........%&'()
*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................
......................................................................
..........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.
....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................
.............................................................?..w.....
..... ...>......]>.^u......9...d...3|U.........v...u."V.U..!....
}x......(h.k.....sq.(...L...N........^(..w?(,y.'?.{..RT..U...pY.7..M..
....oW.../......:..?..|B......e.9...>....-........5K....$..)..l....
....Z..F.a.|Pn..../1..^C7....1.g.|?..... [email protected] E.A.p_.........
......b.j.SI.._.^"..H..Y.b1...s...I...*G.m.{.4.?.^$..i...V.x8 b.. ~u.|
...o<m.Yi..... .....y...............V........h.$r.......)bi.m...e9.
K.o.N2.W..m.........1..Z..v.7.....#...e.3...\..B"...^....T.J....7U.`..
......x}E.D.........W.|G.&{..c.L....N.g.......19.N<..g..oV.&..A(...
..I....So. W.-.S..%...xG....xsO[V.. KGHwD..Z"...Oz.g....z|r....^A._.Z.
.4.-^O&{{dP.......~Z|}.E......?.....=..-..|.......R......OZ.e....>.
K..?W....E.vj...9.....}5.T....V....d...?..J..Yot..V.....y.M{P.Y..p...r
..h.|?dm.|...~tW.b.]G.....Y`............-..........;..dv..1.... ......
...1............Z8......L[I.q..#.x...~....<=.../2d..pI....p...?
<<< skipped >>>


GET /fxstatic/images/sprite/css/room/room2014_z_4dae78b.png HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:35 GMT
Content-Type: image/png
Content-Length: 137807
Keep-Alive: timeout=20
Last-Modified: Thu, 14 Jan 2016 08:56:40 GMT
Expires: Sat, 13 Feb 2016 13:16:21 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-42
Kugou-Memory: HIT
Accept-Ranges: bytes
Connection: close
.PNG........IHDR.............C..... .IDATx...y..u...OUu.t..L&.N6..@ ..
@....z....8xq_.z..^..#.....(G.(." . ..D. @2!.>..,=.kU.?~=K.Y3.353..
.U...~....Lg.....Y'.9...........i....w...Z?.i...........1.1A.)h1A.)h1.
i..... .....4|s.ZL.s..........';.'......9...;@.....#""""CA.0......./a.
`...Z`..e$""""CB.0...........w..l..lDDDDdH..&"""#.w._cF|..^.~p........
...DDDD.$.........W./.........DDDd$....,.!.....IGDDD..*....U..-4.RDDD.
.......u;p..d#""".g.j.9|.P.!.H.N............3...B&bUT.|.YY..... .... .
....4|s.ZL.s.Z.r..N.....)...t.....RL.s.k.........G............l......]
L.s.ZL.s.Z.r..9.-&.9.-F9.1.H.gjk.........G.8..Ih.;..dW..{q1dB..$......
o,...c.7&......B.0....nN.~.L.!.qL..vP2.........O....8..........3/Wu[..
..MbU4Ck....g.M.Sk.B..<B..'.v..V......m............R.0....N..<I.
..o.g.......~m....p...p.U.....<5..._.e.....B.?..{.y..)....F.~I..=.c
W7`W7..a.E6.4.LDDD..)./..=.........DDDd...H?8..{j...o.).j..........8.6
c.eqJ.x.6..VA&D..EX.q..$.....r(k.Lx..........4.LDDD..r`5=..^..A./....L
-1......B....8%...$~....\|)~C).^m%.g.C..l.?...&....Y....&"""AU...\.K..
0 =.....H_...?r....x..=...0..-b..>....1&azW.miabs3Gn....<0...O..
M.or..l#..M.=...1d.?..........`.,...X%I,......6s ..:.....l.8....=.....
...1..O....d~2E...................).=..........DD....].(........x-.'..
..j.3.adGE..^}[email protected]|]...b.f.H?...pS...\B..]X.Y..A.H2!X?...:
..[...&YSE...q....c9>..7.....z...$~..TQ{.|g..B...< .d.L6..F....3
...Z...H.....R.........8...D$`B.<IxaM..3.......E...?".X9e....s....}
...X.m. g5B.2$.?.oKY.M..R.......N.m.....-^...O.Z..gr=x.V(I..]...Dg
<<< skipped >>>


GET /article/kankan/go.html HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: VVV.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:16 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
Cache-Control: max-age=10800
ETag: W/"082ff541f37d11:0"
Last-Modified: Tue, 15 Dec 2015 09:59:48 GMT
Expires: Mon, 29 Feb 2016 05:35:47 GMT
Age: 6711
X-Cache: MISS(S)|MISS(S) from ctn-gd-zhs2-008; HIT|HIT from gtt-de-fra-100
X-Request-Id: 1bf44f4c6c7140d71873b96f3f2fe556; 5a1f6ac861d83f1e2d6dac9758c8e803
Via: T.5199.H.2, T.5199.H.1, M.gtt-de-fra-100
Content-Encoding: gzip
c9b............m..n%G...}...1.I..Wu.G;..!.C.....8.x..g<8g>"...`.
..$r3H...@....?...).}......>............._......gG/...............=
o.9j.;{u...K.o.^..........._..?...7..G..u~....?9t..........._.....1...
..O...........onn...._=..<.~.......8>:..v......?..............I.
...|{q{.f..o..e....]..}r.;}..=.>:?....b..I.....d..4....f.Ylf...d.4.
i.....L#.Fp.03n0.....[..tUO....U=....=/....b.....F..F..F-^\..8P....PL#
.s..lW...]%.J.Q.....&g2y....Y%...wv..qg...wv..q'...hr....l..I.[.B.v.4.
..J...J..S.`9...J)*....R.b..=.....:*.O.,.QQ8...Je.J.q.....$....{...B..
-*.d.....(;P..ThQ.E...ZThQ.E...Zf...C.Y.e.buT.Q....g4...UQVEY...G.9:..
4.iD....u.X..u.(....b..,.|.-d._..e...sV.Y.f.....r....!..|...|X.k.>.
dozq..Q....`{.!..|...|x....|..(....Tz...B{...B{.a....;..F..z.$GY.Q..e.
G..!.5:*]o...s.........7.9:uCt..Ct....N..]...2D.F..z..:.g..T..{..F..Q.
.....i..7.].-.QC....{.e.F..Q.*..4..z.......QR{..I...(...s....M...]....
....=..g.hR.i....*4...F.....uo....w...K%.o./...7;D.....)...=.S.]u.@}..
qgW...........M.......,.g..<<......&.w....P...C..N..av1...y....a
.z....P.....y..~.7(....Y/.{..t....Q......Z/....d=....(...7.Q...fktx...
 Q? .Y..*t.....e.<........4....I.N..R.......].....:..&.?........v.G
..B0.......i..z..1..U.:.....d!.,...j.=[....Z..a.......4..kW..ilj...h..
...LL.j.2M.j.....3.p...Y/.nM..I.5.MM.,.dRt..jR.........G...(.4..q..8D.
....*...............*.........C.......i..(.%*..p....'Za....W.kVnL.u0Z.
.x..~.}J...z.....;..h...}......6*..`[email protected]...*4.....*4Z
.......4..=h..6/h.......j...`M...`M.J#(......`..*%...R.J.....).kJ.
<<< skipped >>>

GET /article/a/201511/17323.html HTTP/1.1


Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: VVV.fafala123.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: marco/0.9
Date: Mon, 29 Feb 2016 09:18:16 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
Cache-Control: max-age=10800
ETag: W/"0781d54615ad11:0"
Last-Modified: Fri, 29 Jan 2016 06:50:24 GMT
Expires: Mon, 29 Feb 2016 07:57:10 GMT
Age: 9350
X-Cache: HIT from ntt-cn-hkg-017; MISS(S)|HIT from gtt-de-fra-100
X-Request-Id: a467610ac2e3eb6dc40a7e7175f79a47; a2bce4cca08f6062e04307a17059116e
Via: T.51102.S.2, T.12814.H.1, V.ntt-cn-hkg-003, T.51102.H.1, M.gtt-de-fra-100
Content-Encoding: gzip
3db4.............}iS.Y...... k:...../[email protected]!..'......
.1....fc.......L}..p.7SK..R.B....2B..d....v..=.....r.......K..n.W.....
{.....j..k.T.OO T..7.x....o......{0,.\.............p.....jU....u..4\E.
~..k...........B..'J^R_p-.i.>P..}.$.R...']....Z|.a_0.....~P5.x.>
P..Z..K=P..<.....>..Z.... ..|../..V..........W...(?....d.f..56..
..pS;..t............~.4:.*....B...p]kX$=Uz%.......N[......hu...`S.....
...t.%.I..lI......j=!o%>$...?.{C.^o8..qS...../.....zl...*....~.&O..
........|.U.s..............#}.V.Z.../...P..i.'.......U..........=.cEE.
S..P]..Pe..W.*no....9}..9.L<...n...?k....4........p..Z.5..:...*....
.7j..o......OL./..P.^....Sw~a..S[.2..p.^@$...YS..{...o.._.?Wd,9....<
;..5.4....[[email protected].<~.....DS.5..Gw~-...%.~.6X.,.5....9.z7Ti...=
V..=...u..8.8D@g^...>._>..?...v..Cd.U........w....}I.G...Qs.Z...
....*.....]d.">../{[email protected].$...M.H.. i{h....u.M.Vz...
.I..=...~.rqS...l.c..M^_.1....9......5...G>.Y.Z.........^.h4k.g."FH
W..<53?...g..r0.....W..(nv...{....?......L...&..Oc.3Y....[E.....[._
..#Ys.y|...xq....g....V..../.....T E........8...<P?.....YM..._..<
;[email protected]|......i.54..*.l...QI..g..?P7..B..tR.}=l.B.z..6..7...L.IR%k.M
...$..r..j..`...W.....uJ{..H.".[.4.<>Q.M.).r....&........|y.K.G.
....:h........6........yVS........^.......Y..7..;..L......Y.....^.....
..r.B........OJ.....S...~U.....:.;%..*..........5.0.~Hq/if....?.......
?.H...:.....'./x......Z..M.r.6..6...L*....|.O>/.......[....${.F.. .
.4.1a.-..f.y.`kK.A;...T.4Zc.V[.3...{:.=..L..H..2....x....'y...(...
<<< skipped >>>


GET /adx.php?c=d25pZD1jY2Y4YjJiYmYyYzQxYTVhAHM9Y2NmOGIyYmJmMmM0MWE1YQB0PTE0NTY3Mzc1MjgAc2U9MQBidT01AHByaWNlPVZ0UU0tQUFFYkNCN2pFcGdXNUlBOGh0MWtkekdpb2V5enR4UGV3AGNoYXJnZV9wcmljZT0yMjkAc2hhcmluZ19wcmljZT0yMjkwMDAAd2luX2RzcD01AGNobWQ9MQBiZGlkPTc1MjI0MzMxOTRFMTQ4M0JFNDBBQTE5QkMzMUNGQUNGAGNwcm9pZD0AYmNobWQ9MAB2PTEAaT1mNmNlMTgzMQ HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415691&ari=1&dbv=0&drs=3&pcs=300x250&pss=300x250&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983<u=http://show.bianya.cc/gg/huyan.html?s&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416&qn=ee6118cd6aef5aef&tt=1456737415675.94.1344.1344
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wn.pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:49 GMT
Content-Type: image/gif
Content-Length: 49
Connection: keep-alive
Expires: Mon, 26 Jul 1997 05:00:00 GMT
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Serv
er: nginx..Date: Mon, 29 Feb 2016 09:18:49 GMT..Content-Type: image/gi
f..Content-Length: 49..Connection: keep-alive..Expires: Mon, 26 Jul 19
97 05:00:00 GMT..GIF89a...................!.......,...........T..;..



GET //js/m.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: cbjs.baidu.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:18 GMT
Content-Type: application/x-javascript
Content-Length: 33406
Connection: close
ETag: "56d3f2c0-827e"
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
Expires: Mon, 29 Feb 2016 09:44:20 GMT
Age: 2038
Cache-Control: max-age=3600
Content-Encoding: gzip
Ohc-Content-Crc: 1526179793
Server: hkg01-sys-jorcol04.hkg01.baidu.com
....O..V..m.js..;iw.8..E.K d.S..8.a..q...........G....E.A..X...U8xH.st
[email protected].$v..p.......#.L$w...).l5.(H.y 
'.g"..S......<..2.|....j..y=..........9}....$.....t....!.(HS.v..8If
...%y..:...]~.:.8dW<f..E...%W..n.../L..)... '<..<.|..3..m..C.
_...Y.............^....2...".C...4.......z*.u.c~.&..w..... <...Ze.$
H.n.s.....n.U........u...LK..{.`......e......M....zO.Dcp5..Q..QUt.a...
%ApT1.......k...n..P..,..u|.C;....G...B.$...X|.}.A..k5.H(q.2y..2q...z8
z.......|.r..K..\........-I.F.a..K.8..w6......"....."hli..I7.4.4.'k4..
...(1#.S"...%.R...24.X[..l......t.-..j...Q_.pY.b3).E...W........h....U
.j..Xj..."...S.p..`.$.j.s.%..]k3.hpK.&}.f....~...9Anj..~.#k..$J..... J
..q.t....0. .S..3.F..................5.3U6.J.......\.<)..|...q..A;.
...y.y..D..E..$t...-.X04.q..(.3....n5..gP!c.:....q ...`.E .......7.:@.
....9.....t..R3{r.>....... >.#.5.bg.\.<ba.....7..X.....fiWo..
...8Jb....CK..N.V.. .....,I..l..Z....#......B..O#..`.M%......S.p....M 
..'[email protected]....=."...B.....7....g6...u.{K..:.Zt\.^-.T.d$c..SO.5.
.L..E.L..\f2tI.%........4...F|..`6....k..S.$.... ..[u,..G@.!>:....%
...8......H.R....\s...!....LK..?}.o.r...........<...j.l.tL1,...eK.R
...........c3. [email protected])...4`[email protected]....
....P....|#........2..<... .x......q......^.t...c.:.Q..!.Q..&IK.b..
[|.#.M.......H6M..$.4.J6.a..(3....9]..0p......cGfj..C........p..U...,.
# 2...P....H.......N..2%..... @[email protected]*a;..........).%s..BN.r.
7.....tF..^EA.]P..<..=..i.......... ..c= .........}>..%.1.FT
<<< skipped >>>


GET /staticPub/js/room/roomFunction2014_dd2507b.js HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:37 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Keep-Alive: timeout=20
Vary: Accept-Encoding
Last-Modified: Tue, 16 Feb 2016 10:39:52 GMT
Vary: Accept-Encoding
Expires: Thu, 17 Mar 2016 10:43:34 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-7
Kugou-Memory: HIT
Content-Encoding: gzip
Connection: close
449f.............}{w......)..#u.K-....\....._..$..h..K.....~HV,..dx...
I ..\....8....MXk...%..|......:U].j....,......s..g.....^.....X..6k...r
....u..J;h4rn.b......{rV.Si{^.h...../......%.q.*..|....W..A{E..m.....X
.......n........o....kh....k.......^..T.[.|yz......6o.....V......N.1D.
; ..xx... ]Z.O.1....#o...1....A..C...C..._......[[_.....K.,b....^..Q..
Z.h....b..>.n.,...n.%{f...hr3..s...?...&.......k...0F...m...z....F)
.#Gy..c..*.. .I...A1..iE.!yI..I2m.Y..G1.g@VD2kn{.b...6Z.z.U..... ...tP
....:...../z]..../..U.k/.]......{..Q...<...zw...../......|.*,......
v.X..6r...X..........I7_.Z..5{~K.G'.N......14..J.Sm..X..J.f.....(~....
.A.o..y.`.J.<.N._...>6D.-..`u.....b........*.....yX.yU.....5^...
<..... /.._l..hya....'|...{1...[....-]`...`bZO ...6..^...J=../^..a.
jjb..](...:.......g.l............/w..>...'...*.....Jq....r...X#p.9.
E.t'{..#.....e..,.Q_2..:..aK..?....^.........v}.....olnR..)..Z}:......
].7..S1-B..U<g.q,.k.k...........O.^r.^.[.z.....zk.g....=N..........
....;...e.....@qg.~.;..K..$........T.*..E......9q<.(.[.n....f...v.~
..........9.q......R....[........~.9.....k.3[.;^.!...0...A.kw7...s..Ak
...-..c.....e.a6..9.....ui.s.Y.'...b..kz.c..^....WI.q ...{.[-/.n..){.J
P..x|.h....8m.F.l-....:|f.Ut..N.".X..?0..........4-........K3.{......A
.G.Tu...8.Iw.XH...........6.....:[email protected]{n...
p<.R......]..Q.b..8]x:.^7..S..Y.....q.w/v>....9...V.^.N.......Xv
 ..N. .17.e..F&..J..z..".%.:8.....n..sf|....`.E..r....e./3y.T...ui....
..U.7f.......[._....`.A.k..6QR...%..;[......~..[.y/........6......
<<< skipped >>>


GET /usr/uploads/201511/20151130161134_14413.flv HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ubmcmm.baidustatic.com/media/v1/0f000nTH6UlUciFfpq-CKs.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.flv.uuzuonline.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 08 Jan 2016 03:53:19 GMT
Server: nginx/0.0.1
Content-Type: video/x-flv
Content-Length: 1885491
Last-Modified: Mon, 30 Nov 2015 08:04:34 GMT
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 fuzhou190:8104 (Cdn Cache Server V2.0), 1.1 db77:10 (Cdn Cache Server V2.0)
Connection: keep-alive
FLV........................onMetaData.......duration.@#G..z.H..width.@
.........height.@[email protected].@9........
videocodecid.@.........canSeekToEnd.......................onXMPData...
....liveXML...<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&
gt;.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5
-c014 79.151805, 2013/04/09-12:08:21        ">. <rdf:RDF xmlns:r
df="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">.  <rdf:Descrip
tion rdf:about="".    xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/".    xml
ns:creatorAtom="hXXp://ns.adobe.com/creatorAtom/1.0/".    xmlns:xmpDM=
"hXXp://ns.adobe.com/xmp/1.0/DynamicMedia/".    xmlns:stDim="hXXp://ns
.adobe.com/xap/1.0/sType/Dimensions#".    xmlns:xmpMM="hXXp://ns.adobe
.com/xap/1.0/mm/".    xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/R
esourceRef#".    xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/Resour
ceEvent#".    xmlns:dc="hXXp://purl.org/dc/elements/1.1/".   xmp:Creat
orTool="Adobe Premiere Pro CC (Windows)".   xmp:CreateDate="2015-11-30
T15:45:33 08:00".   xmp:MetadataDate="2015-11-30T16:03:46 08:00".   xm
p:ModifyDate="2015-11-30T16:03:46 08:00".   xmpDM:videoFrameRate="25.0
00000".   xmpDM:videoFieldOrder="Progressive".   xmpDM:videoPixelAspec
tRatio="1/1".   xmpDM:startTimeScale="25".   xmpDM:startTimeSampleSize
="1".   xmpMM:OriginalDocumentID="xmp.did:e424f941-95aa-ba47-8b48-bb0e
19cc6270".   xmpMM:InstanceID="xmp.iid:fb6f993b-e47b-154d-965d-2e27f79
ce8e6".   xmpMM:DocumentID="xmp.did:60f4f14d-8020-314e-9b3f-737f0a
<<< skipped >>>


GET /adx.php?c=d25pZD1lNzg3ZTEyNWUwMWE4YzZiAHM9ZTc4N2UxMjVlMDFhOGM2YgB0PTE0NTY3Mzc1MjgAc2U9MQBidT01AHByaWNlPVZ0UU0tQUFFVHI1N2pFcGdXNUlBOHA4OVNDM2JCVHc1c2l3TkxBAGNoYXJnZV9wcmljZT0xNDIAc2hhcmluZ19wcmljZT0xNDIwMDAAd2luX2RzcD01AGNobWQ9MQBiZGlkPTc1MjI0MzMxOTRFMTQ4M0JFNDBBQTE5QkMzMUNGQUNGAGNwcm9pZD0AYmNobWQ9MAB2PTEAaT1jOTJjMDliOQ HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415659&ari=1&dbv=0&drs=3&pcs=296x249&pss=300x253&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983<u=http://show.bianya.cc/gg/huyan.html&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416&qn=2f8bbc640f2a4043&tt=1456737415628.141.1360.1360
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wn.pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:49 GMT
Content-Type: image/gif
Content-Length: 49
Connection: keep-alive
Expires: Mon, 26 Jul 1997 05:00:00 GMT
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Serv
er: nginx..Date: Mon, 29 Feb 2016 09:18:49 GMT..Content-Type: image/gi
f..Content-Length: 49..Connection: keep-alive..Expires: Mon, 26 Jul 19
97 05:00:00 GMT..GIF89a...................!.......,...........T..;..



GET /cpro/ui/noexpire/js/rs/business/anticheat.js?v=1.0.0 HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737415659&ari=1&dbv=0&drs=3&pcs=296x249&pss=300x253&cfv=11&cpl=0&chi=0&cce=true&cec=utf-8&tlm=1452064983<u=http://show.bianya.cc/gg/huyan.html&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416&qn=2f8bbc640f2a4043&tt=1456737415628.141.1360.1360
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cpro.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:52 GMT
Content-Type: application/x-javascript
Content-Length: 1112
Connection: close
ETag: "5667c7a9-458"
Last-Modified: Wed, 09 Dec 2015 06:18:17 GMT
Expires: Mon, 08 Dec 2025 05:18:33 GMT
Age: 6926419
Cache-Control: max-age=315360000
Content-Encoding: gzip
Ohc-Content-Crc: 2985892639
Server: hkg01-sys-jorcol13.hkg01.baidu.com
....8.\U..anticheat.js..Vms.6.. ......._:...\z3..4....Q`:B.....l.P....
m..@/./ .>.... [email protected]*.J.-&......m...q......`Qd..*..K$..%.N..m...
.1.k...t .....B._Ba........1.}..8.. "../.....g.m.7...2....J"q o....../
..q........k& .o..k.@._.U......p..*....Fad(s..-bs....6....:..(......h.
dl......_..c....,%..Q....^.8.?....e8e..v.....Fb.!Gt.....4/s.h.'Z..l...
L......J..fF(...2.-.#.8eGE.'E...8...|[email protected].
u.B..vm..r8dFZu. .S6...~|..t.......q..\.YY.p^.>.iX.....P ...{.!$Vwj
#.......Gfu:... w....'k...{..Z..]...E.... ..i..........y...y......k...
...h8..:.."..a4........d....4...!k..".....?..T.X'.^N....}.....)D. 8...
..7j.V.49t.........t...R<B...%[email protected]...|..,?2: ]4u{...
n.r)36....ys.N...U..`.AZ^!Tk.j.uW...%.]bg......s..^w.?>.P.E...F.>
;..`.."r.#Y.....H.._...;..._Z.h.....F...w,R.U.....-z.:O..-V5.O....Id.'
z*.g.6.....T....u..%.0..e...V.. ..~. ...Z8....=~..H..Sj.F(X-.!|. ..:..
P!...,>...&....U......<;..^f....=....5L.j.6.es..t....Y..}.>..
..p .........^.'M=.e..Z..m.<~.`mt5..-..%...o'.o=A....8dQdl5."p*hk..
t....P-.........(.G......?.....85_p.L`..9c..k..>.F..GME.....i..x}..
..v:j......;..`pF.c.....



GET /media/v1/0f000jioG2SODfD3KlS1j6.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://pos.baidu.com/acom?rdid=2229533&dc=2&di=u2229533&dri=0&dis=0&dai=1&ps=-2x-2&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ubmcmm.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:51 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 13002
Connection: close
Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT
Expires: Thu, 05 Jan 2017 18:50:45 GMT
Age: 4631286
Cache-Control: max-age=31536000
media: media
Ohc-Content-Crc: 3688519439
Server: hkg01-sys-jorcol14.hkg01.baidu.com
CWS.GE..x..{.X.K.no^..9KVP`......EE......v." bF....$.QPAA.b....d..(9.0
pg.L...|.....;.LOUW.]U].3.;..X...m..a.......B........31......jC.../...
[email protected]$( * [email protected]>.*)./.@0!Q=C.A42%P.N.=(.4=.......
...T.......I.P. .)*)...8...q..H..8P(...t)13.".W.&..M.R!x............'.
@....%.y........6AU[[email protected]#z.i...j.JJ.*..%um..m5._...]Q.x..#
.%...b.......O [email protected]*......T.. ....J...$A.. =be.m.H...=I.&..C.L..6
V3TU..4S1..0USR2"...*.* .)....k0..].;...34..H[A..7.~Q...9..C.r./P..4U.
......*.*.......:...ih...../ ~.J.!....B(..^.".PI.H.I|..=L..j...&3.5u.5
c.......T..y..!-.......?C....e.....?....1?.............gL;^..$...5*..J
[email protected]:.b.<.....N.#.{.g.]....i...../....t.....a.Mv.p.%
1%[email protected].......`.^....c..6....-}Q....F..].`?...t
A...$.............%..iy(.1..1.mc.n.M. .a.X...."..\.A.eR..(...h3....5..
!....k.Jg5...........t.#{.(....>t).....i..W...y.%)....z..../G\P.>
;...... .W.............y.ki..,....=H.P..^`.Q..A..o1`K7....@..&..x...[.
.D ;...>]>...D..([email protected].%... m.(!).j....nD
.s".......g.......fv^....;C3.. [email protected]...
.=y...R.vWZ.....=R.Sg.z. ...#.`=.8pem...}.'........2EdJ......l.U..w...
lw....!...J..g........F.wJ..N4..Q..........a?.w_{NX.....a..E...i3XrK..
.q...r}.U(.`..`..R.a&E.|....u.....XU.....M2...P.Vv..1.yq.E...f...f....
........O_B|v&la:'...7.....!.6.......w..E....I.WVP{...........Z./.K..o
^8,.1*.................'..Oo.Qt.............wr.e.Re....S..#.8.c.......
./. ...a.m'........X.nIs9...s.Zf.../ev/..3.9!....-.].....:.. .....
<<< skipped >>>


GET /staticPub/js/DD_belatedPNG_79c3052.js HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:33 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Keep-Alive: timeout=20
Vary: Accept-Encoding
Last-Modified: Fri, 15 Jan 2016 07:56:53 GMT
Vary: Accept-Encoding
Expires: Sun, 14 Feb 2016 16:40:31 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-42
Kugou-Memory: HIT
Content-Encoding: gzip
Connection: close
a20.............Ymo.F.. ..........u<.N.......I....\....$%......]R$.
..].....pw.....b.........n...m..e=..*Y~T.......O.d..,..[.(.w.E!...$~.'
.c.....TT*K-{.db...rR...Z..gG..*R...........Usp.*R...L..<Q...,..E..
.$f..=...)..#)..........v.2..5.tX......wJY.RU.Z.*i.D..g....).v...Z....
.^G*.......e......-.n}..-.C.....B5w.X6...?.p...7...k...............w7.
V_...2.s..yV*2../.,....-..p......Y.#oU....w.N.TN.....5/.....i..{>..
.,..1......*.B..zr#..2.S.......`..ZS..f^.....).gc..........T....Ho.3..
YQ.i5%..........G...."........{.[....*......,[email protected]..(.A......Y...r).
@.~!".-|.uYd.4`.....5p.m......y.?...o..I.N}Q.......#5b.w..(p...f..Yv."
..W6..Z.@..}E[.:._~xH.uY..e..Y4w....6B=ao.s.P...p...........[...q.....
......<.#.:..5.q...r.(.5b...Z..x...._V....B.y..M.....l>../......
....h......M*...a3...\...9@...... ....#.... :..Df...$..`...@...}-..)..
..........8<0.......L.U4.F#...........c^...,.?.Nw...0.........;.*.p
w.cQ......3..fx.U..4.....*{...`.U^'..P..,..&.\j..M8GU."...)..4.(*...\.
.../..$q....TA0..9...L..l9.....*.(d...m.lU.X..|....e.2Pql9D......E.:.e
.z...q...=..{K..u.@....!E..uK..?..sKA..1...B.....B.l{z..DQ..sm.....K..
7..|a.(&(}....P.. %.#a..uP3[....*.!_.W{..}M..x..6&.kx.gcn^?.......)...
....H{.Z.....MC....=...T.S:...n.....4.......Rg....>A.. 3....t....&l
t;.S.w.6.jM......H...uZ&c.Av D.<?K...T..B..r..!....x=...7..o...W.B/
.......WH.~..N./.j9..g :Y..Y......G.@.))...i.WcF'..^.y...eXuJ.~.. U..X
....hE..|.G..].....0...d:.i....I...........d..F.!!....C.!..r. x $E.NW.
[email protected].|.[.......Dm...;..m.....s.,@...K.zg..N]...X.zX).{D...G.. ./N
<<< skipped >>>


GET /it/u=1856364587,2693382950&fm=76 HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?sz=300x250&rdid=2355443&dc=2&di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=02ff9997d2308bbb&tt=1456737391050.1781.2172.2172
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: t12.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: image/jpeg
Expires: Wed, 30 Mar 2016 19:18:26 GMT
Cache-Control: max-age=2628000
Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT
ETag: a80923335e80c0198b1873baaedd9f47
Content-Length: 59994
Date: Mon, 29 Feb 2016 09:18:26 GMT
Server: lighttpd
......JFIF.............C..............................................
......................C...............................................
............................."........................................
...=.................................!"1.$A.#%2Qa.q..5B...&4Rd........
...........................?.........................!.1."AQ..2aq...#.
BRb.....3Cc.$.Tr...............?..z..=.......'S...7..Z....s._Hj..h....
&.....5..;.g.S..S..}.. ..k3...k..}Y...E....0N.-..[[email protected]:..&.X.....9t
......%.'.#...20Q...7.[.^1.-..0...&../.|<[l.......).rb........_....
.v.Q..._...>Se=.5.z..y...$=.m.kC.......f...\J^[email protected]......
h.....pV.J......G...FY./.9$..<)...$......%..(.........G....;i..w.A.
..v7..y. 2..x.r~..*.^UU...........J.D(B...-.......`.u.G...q....5..., .
.#.....3.5.3H1o"q..J.Y.G_..n.. ..I..j<'..0w...s4.....R.9.>wf...4
.M..7KX.J0..n.D(*3...,.-.....6#..q.......[.s...:......T -..-.H.......U
.Td4....j...).Mb.[.F...k,.Uk.,...G..6..e.T.......KQ:.E<.I....9.vp..
U...2....U.....L..'5.....9!..../.#T....j.p.g.36.F.....G...A..ho......b
..<..]Q1..h.U6.W.......#.w0i\i..1]e...K=q..Y.S.8........CI).L...5.#
...|..~;.e....I.[._Qi..l........x!..zJX..rw...p..N....Y:..qH9..q......
........%@.8..K/ ...^....../...............~s......A.....*<.d."..."
CUO.2... >..|.@.. ........E..-.....-t.yg;FLxMN~....P'......../.9_la
.Q k.:#..%....R4....X...~....C.#.C...!..b1eL.`......YSh..s`.B.z..^...u
\.*.SiU..1..a...J...4.&.4d}.....B.K..R%5....Y.`....V`......}....jJ..eV
.....v.....<c.$zk{..b[c... 7..X .........p...]..c..)....bE.....
<<< skipped >>>


GET /tpl/ac.js HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/wh/o.htm?ltr=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dup.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:50 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: close
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
Expires: Mon, 29 Feb 2016 09:25:36 GMT
Age: 3194
Cache-Control: max-age=3600
Ohc-Content-Crc: 2805665849
Server: hkg01-sys-jorcol03.hkg01.baidu.com
Content-Encoding: gzip
5f7.............V.S.8......7A..L.u{.][email protected]..?Q..%.V.-....$..>..I.
...n2.HzO....g.N ...0yXm.).T..;n..]][email protected]
.....d0H.z..XU.H........T.pJ......q.^/........p..J..S.....%... .......
.4&u.y.........Xe.cl. ifa..t...!.._y....0..:m.=.......N.x.l...w9..~.d_
.p..].m.@)N...t<.K....B..G.`...;.T(.....Uz/..w.{.%C....&Cq.|...8.u.
f....W8.i.j..I..I..j..N-8...t9Cc..Jg.k.{t.....!...G^..bH(.!...f....V..
..h .E.......... .m..c3s.W....8g...B.....w{.}.............,]>.....e
.y...];x,B....*8|;8....,.<.v.t..{......S/......Gh.FpoP.[.C/..E..H..
.pv..Yn........h.qF..=U7.m.(..l...rS[.L./[email protected]|.[
|.............6cn5.E.!H...T..*.:.&._#....-......PX...V51..e.U./s....-.
........R...>.....b;..r...T.$.d......P.......L J..............LL:..
.Zr]y.n.....eI.<....F..:....l.|..![.b..9..`.....P. ..0.wdx....!..h.
.....h.@.,.rI.'...;.e0j..o....QA.Uo.....................%v2?......~..|
<.........D...F.Bd..... G...OI...T....{........'O\\.^....6...6.q...
...z..=.q.B.w......^.k)U..i.i.7.zu..b... p.....1...m.q..|JT%......D..5
..uj..J..O.......'(~..-.>>........0\.-m......JB.Z......%.V\z..N.
..Wz...,.;..^G..0.!Z3...._..O..U=....%;...M.&Onn......\,...........H..
........[.v...X.....[v........4'..... ..._A.w.`p?...aL1.....}%`.....r.
...O.0w....BG9.UTS1.$.E.Q.F.T...4.~....m....J.9...).t.[6.0.Fd...'....b
1...n......#[email protected].,..k,........q...}.\'...>../._vN}~ON.]
^v....'...ho.......<......-(.~{.7.7...[.c|..p..q.z...h..y.#.}.pq.z.
.R.2e..2.q.q(..e/|....hf.Nx..~.`y%-.......!z....sS..........)0M.Ac
<<< skipped >>>


GET /emar?yguid=61b5dd9346a5421099a85a5027961cfc&ver=1 HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?rdid=2480739&dc=2&di=u2480739&dri=0&dis=0&dai=1&ps=74x308&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x896&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737391&qn=bc8e12d50064a9a9&tt=1456737391050.438.1891.1891
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1
Connection: Keep-Alive
Host: cm.pos.baidu.com


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:26 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: keep-alive
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: ng
inx..Date: Mon, 29 Feb 2016 09:18:26 GMT..Content-Type: image/gif..Con
tent-Length: 43..Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT..Connect
ion: keep-alive..GIF89a.............!.......,...........L..;..



GET /fxstatic/images/yellow_warn2_b8d73e7.png HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:29 GMT
Content-Type: image/png
Content-Length: 1124
Keep-Alive: timeout=20
Last-Modified: Sat, 30 Jan 2016 15:11:52 GMT
Expires: Mon, 14 Mar 2016 14:09:57 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-7
Kugou-Memory: HIT
Accept-Ranges: bytes
Connection: close
.PNG........IHDR..............sO/....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:E12878A9A5E211E49D77EC7E91
FBAC91" xmpMM:DocumentID="xmp.did:E12878AAA5E211E49D77EC7E91FBAC91">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E12878A7A5E211E49D77
EC7E91FBAC91" stRef:documentID="xmp.did:E12878A8A5E211E49D77EC7E91FBAC
91"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>L.. ....IDATx.b......p.q.....1..q ^..S....i6.
.u@,...,.8.....>[email protected] ..&
lt;.....f .'.9d.....o..q{..v ....w2.....g.4.,...d.....R]q..w0"..E >
...Dh.%cs.0@.<N@.> ..i....A%..8....i..._...P... ....,.Qu......IE
ND.B`...
<<< skipped >>>


GET /it/u=990497764,1232924695&fm=76 HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?sz=300x250&rdid=2355443&dc=2&di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=02ff9997d2308bbb&tt=1456737391050.1781.2172.2172
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: t11.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: image/jpeg
Expires: Wed, 30 Mar 2016 19:18:26 GMT
Cache-Control: max-age=2628000
Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT
ETag: 1069d53929425e8d1db957548c94542b
Content-Length: 42112
Date: Mon, 29 Feb 2016 09:18:26 GMT
Server: lighttpd
......JFIF.............C..............................................
......................C...............................................
............................."........................................
...A..........................!..1."A.Q.#2a.q...B...$3..%Rr.b...&4C...
...............................I......................!...1.AQa."q..2.
.#....B...$34R....Vbst.CDScdr..............?..S#[email protected].. o.......r
@.R....."............^....K.'y....).X.]..Y .V....:...1..S..4Y.....&. .
[email protected][.e1V...Y.ao....3..,G{...3B...T...]....O.....5>#...M.
...mJ...Oq........8.^.`.T...iq.PTB.N.J....O9&......qKBU.M..&...].....`
..[....ON ....S.=?.\{...cq..o.r....l..X,.:..O..b.2o...i..y=Y..../.V*8.
/....p..9..\".>.B..$..F...'r2..bH........}m........5.....X..l.."4..
>~.! ....NV#.s........*[email protected]....]v.......L..(i....V.#..T"m..
C.Lw.`. Z...".......'&>.s.^k%.....&....g.\...Z..E...x-~...99>F5.
9....;.i$o-.c.T....]|.. MF,W....{......k.g.ejVY.................x..9..
.<;..-^...v,..^P<...E.......R.F.....KF0.....].".l.....I!...<E
.B.f....RV.Lu.9...;.zV.e...B...ROX...q._..9..azk.z.e..l....Q.!..dK!#..
q........R~...I....#....|.xgz..O%...LJ.J.q....L.......*....5..*.,.ZGU.
F~.:O....x.(..Nx.c.ebD.{.".Ti...S'a*...Y.18.'....]..K....W...w5.......
n.W.d..x?K.6.?..x.v$..t....V...nA.k9{.k,lEr.:n.3J...MR.....S..J@0..&..
..M...e....[..cR...3kZ.....,......d...L.V".(K....a.bHK......./...V-.).
.r./`..J.......l<..u..w...hn..../c%..u.KF\...K0(.j...t...0..e..?.Y.
...X.{4..Hj<o.%..c..`.X...Ux]....bh...obbN.k7.......N8....l.L..
<<< skipped >>>


GET /stat.htm?id=1254817266&r=&lg=en-us&ntime=none&cnzz_eid=223312916-1456732646-&showp=1276x846&t=&h=1&rnd=289534767 HTTP/1.1
Accept: */*
Referer: hXXp://show.bianya.cc/gg/huyan.html?s
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: oz.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine/1.4.6
Date: Mon, 29 Feb 2016 09:18:47 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..



GET /fxstatic/images/fx_loading_c785dd3.gif HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:33 GMT
Content-Type: image/gif
Content-Length: 1404
Keep-Alive: timeout=20
Last-Modified: Tue, 27 Oct 2015 12:28:36 GMT
Expires: Sat, 13 Feb 2016 13:58:31 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-42
Kugou-Memory: HIT
Accept-Ranges: bytes
Connection: close
GIF89aH......a....i......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket
 begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x=
"adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/0
6-14:56:27        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/
02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="
hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0
/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp
:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.i
id:146BFF791A8911E2983DF11C711E32A8" xmpMM:DocumentID="xmp.did:146BFF7
A1A8911E2983DF11C711E32A8"> <xmpMM:DerivedFrom stRef:instanceID=
"xmp.iid:146BFF771A8911E2983DF11C711E32A8" stRef:documentID="xmp.did:1
46BFF781A8911E2983DF11C711E32A8"/> </rdf:Description> </rd
f:RDF> </x:xmpmeta> <?xpacket end="r"?>................
......................................................................
............................................~}|{zyxwvutsrqponmlkjihgfe
dcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%
$#"! .................................!.......,[email protected]&*.
...,x........Y....[...........|.^.."..7e...:.F)s5u...!.......,....H...
....o.............{e.G..h....(.....j0.S}.......Z..!.......,...........
.o.....b.By...'-p......b..'....!.......,............o.....b.By...'-p..
....b..'....!......., ...........o.....b.By...'-p......b..'....;..
<<< skipped >>>


GET /fxstatic/images/fxtpl_loading_c785dd3.gif HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:41 GMT
Content-Type: image/gif
Content-Length: 1404
Keep-Alive: timeout=20
Last-Modified: Sat, 30 Jan 2016 15:11:52 GMT
Expires: Mon, 14 Mar 2016 13:08:53 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-7
Kugou-Memory: HIT
Accept-Ranges: bytes
Connection: close
GIF89aH......a....i......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket
 begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x=
"adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/0
6-14:56:27        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/
02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="
hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0
/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp
:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.i
id:146BFF791A8911E2983DF11C711E32A8" xmpMM:DocumentID="xmp.did:146BFF7
A1A8911E2983DF11C711E32A8"> <xmpMM:DerivedFrom stRef:instanceID=
"xmp.iid:146BFF771A8911E2983DF11C711E32A8" stRef:documentID="xmp.did:1
46BFF781A8911E2983DF11C711E32A8"/> </rdf:Description> </rd
f:RDF> </x:xmpmeta> <?xpacket end="r"?>................
......................................................................
............................................~}|{zyxwvutsrqponmlkjihgfe
dcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%
$#"! .................................!.......,[email protected]&*.
...,x........Y....[...........|.^.."..7e...:.F)s5u...!.......,....H...
....o.............{e.G..h....(.....j0.S}.......Z..!.......,...........
.o.....b.By...'-p......b..'....!.......,............o.....b.By...'-p..
....b..'....!......., ...........o.....b.By...'-p......b..'....;..
<<< skipped >>>


GET /fxstatic/images/room/video_6f4f75f.gif?333 HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:39 GMT
Content-Type: image/gif
Content-Length: 7323
Keep-Alive: timeout=20
Last-Modified: Sat, 30 Jan 2016 15:11:52 GMT
Expires: Mon, 14 Mar 2016 13:20:01 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-40
Kugou-Memory: HIT
Accept-Ranges: bytes
Connection: close
GIF87a..0....333..33f3fff.......f3...f333fff3f33f3.3ff33.f???!..NETSCA
PE2.0.....!.......,......0......I..8....`(.di.h..l..p,.tm.x..|....pH,.
...r.l:...tJ.Z...`..t%[..K......\h...6.M/H.v.\r.. xh....'.[jt..}rnxnwy
qt.j..............tZk]{..wp....v.m}.{..syu.u....M..j..........r.......
...mk....>...v.........}Z...].p..........9w........dkQ.0..R.......b
.[s...d....[(.S79."N.@...........*5.....%..[#y..s.....`*].. .F.. C.H.-
v...<Z...|.&~bJ..!jsZI.dm....|...........;.Z.]..| .(.#.n....-.D...&
lt; .....G......3.Q......e..V.....1?.1....O...(....O m...U...c...#.S.9
sh1.(.N......k.>.....1../.........a......._A>z...........\......
..}..` ....@.... .......8....>h.....a..~....R(....8....hb."..a..Bh 
........9..8.X..4.G$.9....I....T.a#.OR.d.5.x#.Fj.f.!..e.hR.%.S..%.W.y.
.[..'.r....O..e.c.Y&...)....ia....$...... ....w....GZZ(......HL...:6..
...h....z....j........f.*..vZ"...:......z.D.7_{..h.x.R.........v..... 
....k.............. ....k.............S...!.......,....y........)..F.]
...wi  Z$...t..y..h.x........%....... !.-.#.<...'.Z.]..&H[.N]\..K..
9k.O.i..xt.*d....^}r:t.{exy7.j_N.Y..>~a.C....B|..F..p.n......q.>
.;]..s.PeO...u.v......6...........8.K...............Qk..Q3</.'1/X .
...".x..!.......,....y......P.I.08.Z....I.%..t..Jr.......=Sy.r.\ .K...
.10$.`.......A).j...^.......^.X..;...b#w..m\....h_{..s.uY~>.B.vgl.8
i.0...j.H.L...x...%.s.9k..A.E....pN...8......7..`....}[email protected]..
..........cx2)1.Z..-'... 4.."...!.......,....y.......H@ ...[E...}S....
.....y.O...a.|o.=.*......2`.,]...v3r........J....x-.(X.~..mt.....2
<<< skipped >>>


GET /KgAck.js HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: serveraddr.serviceweb.kugou.com
Connection: Keep-Alive
Cookie: __fx_union_access__=1-1-1; __fx_union_page__=3-3:5-2-2; __fx_unionId__=111-17614


HTTP/1.1 200 OK
Server: kugou_server/1.2.8.6
Date: Mon, 29 Feb 2016 09:18:27 GMT
Content-Type: application/x-javascript
Last-Modified: Mon, 14 Dec 2015 04:22:58 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Mon, 29 Feb 2016 10:18:27 GMT
Cache-Control: max-age=3600
Content-Encoding: gzip
b4a.............X.o.V.. ..v.......u&n..iY.v.&E.......8..G.'...PQ..U..J
E...!...........m......L.m..v.;.q.9......O6^.o;3K.........,.#M_.`..F..
.'......-............C{..m.P..f}dO...e...{..e.4K..g......T....BA......
..8.-kG_%"[&..[8..2..Z9......W.t.....i.voh.....z.....#....B...m1}X.T.o
k\......tK..4a[N..w.......uF......~C.5}.S..P.).>iis........).[.X..?
Q....5.V#.].u:.&^.r..gu,^."v.. A4>..n.4......"....t....3z.c ...^."L
...x9....9.<.........}...-46...p..5.....4S.9.Z..._...0..........mN.
R..E&.H/v.S....Yl..'c...gaW%...D.6.gX`.b...6X..>...mX..7.R..;zA....
w..3QZ..R.#..w.W,....w.Ox.B...V...N....s,.`{..`..].n.`.4xz.9.&, K.B...
...I..G..<x....<...3../....AJ....iS. .jf.&'./B....k..H7..t8.t...
w..5O$...>E1...*.eS...Q........i...u.sx..6.URmxZTCJ....c}fD..x..u.I
...~.6.hk........_..?.<.t.m3. G.Rkw.(....5kt..c.h....e....:. Z...];
.N..j............J..gr......F4....a"..3o.....1..........T..x....R... .
a.f%4..93C3.z#:{..o..v...s...{..o.... s...IJ.f K........j...3..&...#..
...W.j>.2....HA0..O.cW..`.j.,.....<.v.0F.sz;..d.C..4.04....B7..*
...P..-...:..... .........h..a..A;.C..<%.,TD..R.Kl..... E.$)~.1W).4
hxd.0.G.......c 8E.uR*[email protected]:.J<r..H..;[email protected]..
...2x..4.&-K..I!...F....8.4.2.g".o.fh.?.(w..Y........u.rb.37k3G.N..c..
......g.G..k...........V.....jP...OR..*...dzA..D..q...<.i3.....f$..
.TF...2.........8.B.)O..F. ...=...x..Pd.....~.5...e../....0oE*.p.E..."
....d.........s.*..d.FOA..[.Lo<.p...(...b.[.E*.....Z...d...ms..mN..
o..]C....cwK..h$.&#c.=..}..M....A>.M.N.[..n...C....hLc.1i0....&
<<< skipped >>>


GET /log?type=ssplog&id=-1&error=responseEmpty&status=renderFail&async=-1&from=ssp&tm=1456737392722&.stamp=0.5117792924746438 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: cbjslog.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483B674531893B65DDDF:FG=1


HTTP/1.1 200 OK
Content-Type: image/jpg
ETag: "4281908110"
Accept-Ranges: bytes
Last-Modified: Mon, 10 Jan 2011 10:46:59 GMT
Content-Length: 0
Date: Mon, 29 Feb 2016 09:18:24 GMT
Server: lighttpd
HTTP/1.1 200 OK..Content-Type: image/jpg..ETag: "4281908110"..Accept-R
anges: bytes..Last-Modified: Mon, 10 Jan 2011 10:46:59 GMT..Content-Le
ngth: 0..Date: Mon, 29 Feb 2016 09:18:24 GMT..Server: lighttpd..



GET /fxstatic/images/blank_5307b88.png HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: KugouCDN
Date: Mon, 29 Feb 2016 09:18:32 GMT
Content-Type: image/png
Content-Length: 949
Keep-Alive: timeout=20
Last-Modified: Tue, 27 Oct 2015 12:28:35 GMT
Expires: Sat, 13 Feb 2016 13:11:54 GMT
Cache-Control: max-age=2592000
KG-Via: SW-U-52-42
Kugou-Memory: HIT
Accept-Ranges: bytes
Connection: close
.PNG........IHDR.............(.4.....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:ECCE9351EB5711E18EF4F84FBA
F3F77E" xmpMM:DocumentID="xmp.did:ECCE9352EB5711E18EF4F84FBAF3F77E">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ECCE934FEB5711E18EF4
F84FBAF3F77E" stRef:documentID="xmp.did:ECCE9350EB5711E18EF4F84FBAF3F7
7E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>..)[email protected].
b`..0.....OmY.....IEND.B`...



GET /tpl/ac.js HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/wh/o.htm?ltr=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dup.baidustatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 29 Feb 2016 09:18:50 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: close
Last-Modified: Mon, 29 Feb 2016 07:26:56 GMT
Expires: Mon, 29 Feb 2016 09:25:36 GMT
Age: 3194
Cache-Control: max-age=3600
Ohc-Content-Crc: 2805665849
Server: hkg01-sys-jorcol03.hkg01.baidu.com
Content-Encoding: gzip
5f7.............V.S.8......7A..L.u{.][email protected]..?Q..%.V.-....$..>..I.
...n2.HzO....g.N ...0yXm.).T..;n..]][email protected]
.....d0H.z..XU.H........T.pJ......q.^/........p..J..S.....%... .......
.4&u.y.........Xe.cl. ifa..t...!.._y....0..:m.=.......N.x.l...w9..~.d_
.p..].m.@)N...t<.K....B..G.`...;.T(.....Uz/..w.{.%C....&Cq.|...8.u.
f....W8.i.j..I..I..j..N-8...t9Cc..Jg.k.{t.....!...G^..bH(.!...f....V..
..h .E.......... .m..c3s.W....8g...B.....w{.}.............,]>.....e
.y...];x,B....*8|;8....,.<.v.t..{......S/......Gh.FpoP.[.C/..E..H..
.pv..Yn........h.qF..=U7.m.(..l...rS[.L./[email protected]|.[
|.............6cn5.E.!H...T..*.:.&._#....-......PX...V51..e.U./s....-.
........R...>.....b;..r...T.$.d......P.......L J..............LL:..
.Zr]y.n.....eI.<....F..:....l.|..![.b..9..`.....P. ..0.wdx....!..h.
.....h.@.,.rI.'...;.e0j..o....QA.Uo.....................%v2?......~..|
<.........D...F.Bd..... G...OI...T....{........'O\\.^....6...6.q...
...z..=.q.B.w......^.k)U..i.i.7.zu..b... p.....1...m.q..|JT%......D..5
..uj..J..O.......'(~..-.>>........0\.-m......JB.Z......%.V\z..N.
..Wz...,.;..^G..0.!Z3...._..O..U=....%;...M.&Onn......\,...........H..
........[.v...X.....[v........4'..... ..._A.w.`p?...aL1.....}%`.....r.
...O.0w....BG9.UTS1.$.E.Q.F.T...4.~....m....J.9...).t.[6.0.Fd...'....b
1...n......#[email protected].,..k,........q...}.\'...>../._vN}~ON.]
^v....'...ho.......<......-(.~{.7.7...[.c|..p..q.z...h..y.#.}.pq.z.
.R.2e..2.q.q(..e/|....hf.Nx..~.`y%-.......!z....sS..........)0M.Ac
<<< skipped >>>


GET /default/index.html?v=03AD446F3A574AFE0281630A166E51D7FAB141130AE0C8AAD6E453962939C4CD189605251DC32B837AF9D107201FD8A478B90BD175458A857845A26B90C627E59C5E41535A47A5C2E41FF1EA05222EDE HTTP/1.1
Host: tongji.hiv-hiv.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/plain; charset=utf-8
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Mon, 29 Feb 2016 09:18:08 GMT
Content-Length: 4
100!HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/plain;
 charset=utf-8..Server: Microsoft-IIS/8.5..X-AspNetMvc-Version: 5.0..X
-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Mon, 29 Feb 2
016 09:18:08 GMT..Content-Length: 4..100!..



GET /sspcm/cm?dsp_id=100692&dsp_uid=0 HTTP/1.1
Accept: */*
Referer: hXXp://pos.baidu.com/acom?rdid=2480739&dc=2&di=u2480739&dri=0&dis=0&dai=1&ps=74x308&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x896&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737391&qn=bc8e12d50064a9a9&tt=1456737391050.438.1891.1891
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: cm.yigao.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Server: Tengine
Date: Mon, 29 Feb 2016 09:18:25 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 111
Connection: keep-alive
Location: hXXp://cm.pos.baidu.com/emar?yguid=61b5dd9346a5421099a85a5027961cfc&ver=1
Set-Cookie: uid=61b5dd9346a5421099a85a5027961cfc; domain=yigao.com; path=/; expires=Wed, 28-Feb-2018 09:18:25 GMT
The URL has moved <a href="hXXp://cm.pos.baidu.com/emar?yguid=61b5d
d9346a5421099a85a5027961cfc&ver=1">here</a>.HTTP/1.1 302 Foun
d..Server: Tengine..Date: Mon, 29 Feb 2016 09:18:25 GMT..Content-Type:
 text/html; charset=utf-8..Content-Length: 111..Connection: keep-alive
..Location: hXXp://cm.pos.baidu.com/emar?yguid=61b5dd9346a5421099a85a5
027961cfc&ver=1..Set-Cookie: uid=61b5dd9346a5421099a85a5027961cfc; dom
ain=yigao.com; path=/; expires=Wed, 28-Feb-2018 09:18:25 GMT..The URL 
has moved <a href="hXXp://cm.pos.baidu.com/emar?yguid=61b5dd9346a54
21099a85a5027961cfc&ver=1">here</a>...



GET /acom?di=1172330&dri=0&dis=0&dai=1&ps=794x288&dcb=BAIDU_SSP_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x896&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224<u=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737392 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: pos.baidu.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 536
Content-Type: text/javascript;charset=UTF-8
Date: Mon, 29 Feb 2016 09:18:23 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon Feb 29 17:18:23 2016
P3p: CP=" OTI DSP COR IVA OUR IND COM "
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Pragma: no-cache
Server: nginx
Set-Cookie: BAIDUID=7522433194E1483B674531893B65DDDF:FG=1; expires=Tue, 28-Feb-47 09:18:23 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1
X-Xss-Protection: 0
BAIDU_SSP_define({"tuid" : "1172330_0","queryid" : "eee29b83352566ba",
"placement" : {"basic" : {"cname":"54010049_7_cpr","flowType":1,"group
Id":448404,"rspFormat":1,"sellType":1,"sspId":8,"tuId":1172330,"userId
":5893023}.,"container" : {"anchoredType":1,"height":60,"sizeType":1,"
width":640}.,"fillstyle" : {},"userdefine" : "","complement_type" : 7}
,"extends" : "","pdb_deliv" : {"deliv_id" : "0","deliv_des" : {},"bran
dad" : 0},"order_deliv" : {"deliv_id" : "0","demand_id" : "0"},"rtb_de
liv" : {"deliv_id" : "0","demand_id" : "0"}});HTTP/1.1 200 OK..Cache-C
ontrol: post-check=0, pre-check=0..Connection: keep-alive..Content-Len
gth: 536..Content-Type: text/javascript;charset=UTF-8..Date: Mon, 29 F
eb 2016 09:18:23 GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Last-Mod
ified: Mon Feb 29 17:18:23 2016..P3p: CP=" OTI DSP COR IVA OUR IND COM
 "..P3p: CP=" OTI DSP COR IVA OUR IND COM "..Pragma: no-cache..Server:
 nginx..Set-Cookie: BAIDUID=7522433194E1483B674531893B65DDDF:FG=1; exp
ires=Tue, 28-Feb-47 09:18:23 GMT; max-age=31536000; path=/; domain=.ba
idu.com; version=1..X-Xss-Protection: 0..BAIDU_SSP_define({"tuid" : "1
172330_0","queryid" : "eee29b83352566ba","placement" : {"basic" : {"cn
ame":"54010049_7_cpr","flowType":1,"groupId":448404,"rspFormat":1,"sel
lType":1,"sspId":8,"tuId":1172330,"userId":5893023}.,"container" : {"a
nchoredType":1,"height":60,"sizeType":1,"width":640}.,"fillstyle" : {}
,"userdefine" : "","complement_type" : 7},"extends" : "","pdb_deliv" :
 {"deliv_id" : "0","deliv_des" : {},"brandad" : 0},"order_deliv" :
<<< skipped >>>

GET /acom?di=u2355443&dri=0&dis=0&dai=2&ps=114x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&sz=300x250 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Cache-Control: post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 1010
Content-Type: text/javascript;charset=UTF-8
Date: Mon, 29 Feb 2016 09:18:23 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon Feb 29 17:18:23 2016
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Pragma: no-cache
Server: nginx
X-Xss-Protection: 0
BAIDU_UNION_define({"tuid" : "u2355443_0","queryid" : "02ff9997d2308bb
b","placement" : {"basic" : {"cname":"54010049_cpr","flowType":1,"rspF
ormat":1,"sellType":2,"sspId":1,"tuId":9223372032562163955,"userId":58
93023}.,"container" : {"anchoredType":1,"floated":{},"height":250,"siz
eType":1,"slide":{},"width":300}.,"fillstyle" : {"backgroundColor":"#F
FFFFF","cloudTheme":{"skin":5,"stid":5},"elements":[0,2,1,4,5],"flush"
:0,"layout":[1],"lu":{"borderWidth":0,"number":0},"opacity":100,"searc
h":{},"txt":{"align":1,"cbackground":"#FFFFFF","cborder":"#FFFFFF","cd
esc":"#444444","cflush":"#e10900","ctitle":"#0000ff","curl":"#008000",
"fontName":"......","fontSize":12,"number":3},"video":{}}.,"userdefine
" : "cpro_template=text_default_300_250|cpro_cpro_lu=1,#dfe4f9,#000000
,......|cpro_version=2.0","complement_type" : 2},"extends" : "","pdb_d
eliv" : {"deliv_id" : "0","deliv_des" : {},"brandad" : 0},"order_deliv
" : {"deliv_id" : "0","demand_id" : "0"},"rtb_deliv" : {"deliv_id" : "
0","demand_id" : "2355443"}});....


GET /acom?rdid=2480739&dc=2&di=u2480739&dri=0&dis=0&dai=1&ps=74x308&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x896&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737391&qn=bc8e12d50064a9a9&tt=1456737391050.438.1891.1891 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Cache-Control: post-check=0, pre-check=0
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 2065
Content-Type: text/html
Date: Mon, 29 Feb 2016 09:18:23 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon Feb 29 17:18:23 2016
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Pragma: no-cache
Server: nginx
X-Xss-Protection: 0
...........W.n...}.....,f....-......P.)K6i...F.l.~...Q....y.... ...I.f
3..j...;.$ ......TUWu..nx}...Q.....mo...O..s...r-.$.....lr..s.q..(..*!
\..K}.#.....6L...d}M...\..b....r...........?|......_....z....7oz......
}[email protected].....#.i..$...v..f8s.........(&..MI...u.DM...0.pF...5A]..S..
F..<:.....).F$}H.e....d.uP..>)R.v^k.8y%.q..a..qj..3..S..|m.C....
T..K...............o.f..i.7..../.........c...8.._......8.@^ .....I.A\v
...H..g.u.8"..M....=#........6 :y...l.Y.A.:..}:..K!.U..b...x7...#~..'.
....x.-../da.<.x...#[email protected]..}).Z_.l.0b.:...F..sO.....znh
7hj~...Y.6...Oib.....hr.Z}.~,.....D.5.{.}NH.\........z......PFMH...k..
.6.'...[..d5Dh.*H.i....f....Z.$ .l..f.E.yf9..\eh............3.e.H..&*.
.k.H..A...`~.B..v....ap=;H....4....|7R'f....O....x.^.H.Y....Vwbi...R.V
.k]b..../...R.R...x.^..Y9W5I?p2.e M.|.\...V).b..F..H....n.kH........v.
V...%.pP...?....)%Yg>%s."T&3.z8.~E.......|5..S.....l.y.)....c.t...k
x#...].3...Lf..^y.{_.<4....._ t..'g.....t.....}.<..;U?.o.Yv.....
Y....n]^..$.9...,.....&.-5..o..#-A.~^...X.O.F..e.F..Jvl].#.0......y...
.R..O.Xx"5...?.M..8.^.oG.2.V.........j..w.@........~.(&z4uNW........|.
..X..........E_Xxs....o....)'.._.es7."!.....z..R^....Oo..r....._.U.7..
...$.....K7..q-...%.!..i..D.7Nb....FW..#..].......:...l..G.}U......I#.
..R.Ie.~.....d.m.!...k......}$..SO..U>.......::. .0......T.....q.v.
.:...H..l........A..............;.W...*Z.B..u...uQ]...{n.R.s..4...|.;.
..~....d..Myf7_..-...... Q..P..m..W.i..8a........nDU)'a...b8.....C.!./
.aD].(...1..!.!........G.....m.....j.^.,.u.......o....B. .;.....m.
<<< skipped >>>

GET /acom?sz=300x250&rdid=2355460&dc=2&di=u2355460&dri=0&dis=0&dai=3&ps=1233x988&coa=at=3&rsi0=300&rsi1=250&pat=17&tn=baiduCustNativeAD&rss1=%23FFFFFF&conBW=1&adp=1&ptt=0&titFF=%25E5%25BE%25AE%25E8%25BD%25AF%25E9%259B%2585%25E9%25BB%2591&titFS=&rss2=%23000000&titSU=0&dcb=BAIDU_UNION_define&dtm=BAIDU_DUP_SETJSONADSLOT&dvi=0.0&dci=-1&dpt=none&tsr=0&tpr=1456737391159&ti=别闹！教主的结婚照原来是这么拍的……&ari=1&dbv=0&drs=3&pcs=1580x896&pss=1580x3449&cfv=11&cpl=0&chi=1&cce=true&cec=utf-8&tlm=1454050224&ltu=http://VVV.fafala123.com/article/a/201511/17323.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&qn=3a3da2ebe2e4ff2e&tt=1456737391050.1875.2281.2281 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.fafala123.com/article/a/201511/17323.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
Host: pos.baidu.com
Connection: Keep-Alive
Cookie: BAIDUID=7522433194E1483BE40AA19BC31CFACF:FG=1


HTTP/1.1 200 OK
Cache-Control: post-check=0, pre-check=0
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 7111
Content-Type: text/html
Date: Mon, 29 Feb 2016 09:18:24 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon Feb 29 17:18:24 2016
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Pragma: no-cache
Server: nginx
X-Xss-Protection: 0
...........=i..Fv..  .H."@....F5.gFZst.H.,....$4 A....X.l%..l..#{U6...
.Q...UIE...Ur9..#\:.O..y....G3...Mk8.......^w?...._^..u...............
...E...x......k......s4.YF.O....n..l0j....*c...X....w........\c__Y.8@=
}..m.<. ..... .|.......{...O?.3.X*DZ.......f.&U..&.w4..z.4.......SY
Cyh...:....G......pF&:.;...5.}......74M.6F.c....X......u..,4l..w..=..j
..,..j.V...S&Da...1..F..2"....Nz...a....>-v......P.........ud[y.2..
"..j.Heal...~82l.`.z.)/....kcUo{..mk......e..o.#....w]..F.v.0..2..34y.
5*.....e..-C.-.....s.G..U.i.....c....c.slUa.`.Y.1...^Kw........6..6...
.r.Kn..#h.t,.(P...i..A......:U...E..<..m .;7..a..(.9.N.S..)u.E...yG
....O..........`B.....c..I[.&G~[..4..b..v`..c..L.....Z..W.0y..c.~`..C!
..i.d.....w..wQ;....d.......5.e..e..G..m...(...I8./D!n...D....1...)...
.7..c..{....{..M.5.J...%............C.j..mT6.. k.;....r;.o...B.aK7.uPO
.]....hys.q96.uc..>...N=.;|..=.O..i.&...v...U2..)..M..y.x.[...V~d9.
bA...B.hm<j.Z.H.n.....D..Q..[..."....n<F.1..)o..!...m.C._....2..
.$H.G.I[C.^..W..P..cI..s2.......w..P)k....TR....RYX....._Z.&.E[....(..
C..OP.W...h..q.F4.^.G... ...AI....%..g........./..L...a...>.......?
..*.T..^....[G.w4..y{.-5......l.....{..{.[wW...j..]Ul...Wv.....b..<
._]Q..z.............m^.q[............-.6.M...]s.....k....^..6ol.wol^.,
_[[email protected]... [.n..h]u.....kg...(........ ;WWnI}.h9\....n^...G
.....fy..{....wuoWh57V[;....^.n.^.n..*..u$s.........4....fB.bk}..e..*.
..Y.!.. #.jY...T..x..b2@9<y.^[email protected]!.j.#...#.A..(....ch...o.EkBi.8
..ec..C$.4.D...i.....iU...NZ.*.<..F3.1..WD1m8m....{JY..U..v.z.(
<<< skipped >>>


GET /fxstatic/images/starLevel/pc/18.png HTTP/1.1
Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:32 GMT
Content-Type: image/png
Content-Length: 1580
Connection: keep-alive
Keep-Alive: timeout=20
Last-Modified: Wed, 15 Jul 2015 08:08:41 GMT
Expires: Mon, 14 Mar 2016 13:15:25 GMT
Cache-Control: max-age=2592000
Kugou-Memory: HIT
Accept-Ranges: bytes
.PNG........IHDR...............Db....tEXtSoftware.Adobe ImageReadyq.e&
lt;...qiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:84f25697-8665-8440-ab93-67645edd1a8b" xmpMM:DocumentID="xmp.did:
50AE905A238F11E58460B583C9546F04" xmpMM:InstanceID="xmp.iid:50AE905923
8F11E58460B583C9546F04" xmp:CreatorTool="Adobe Photoshop CC (Windows)"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:a8c04915-e617-c74
e-9c72-cc8383c4a2db" stRef:documentID="xmp.did:84f25697-8665-8440-ab93
-67645edd1a8b"/> </rdf:Description> </rdf:RDF> </x:x
mpmeta> <?xpacket end="r"?>a6.r...QIDATx..T.k.Q....f....M.XA.
j{.Dz.A=. z.?A(b@/B..z.........W.$....x.RA/.K.h.6i.M..y..&&..D.|....7.
|.^.7...:&x*.... .Y'..W....`F0"X....d.a...8...Z0..,.K.. 2....".{....!.
[...... ........K|A...n.E..!.yU.........m.._..<.a{>.w.Dz...E..Q.
.]....d.H.#.o.9.}?..3.R.jT.2.D.........h^!}.>......dlv=Sx d.; 6.Ol.
.&...jD."..A6#6).9.....kR!.c.].;.$......6.I...! b0.8K.Q})I..~^.K..G...
j.:...cQ...z.M..D........R.U....H.....*....N&.a;.,..]...u.Cv.....B$./.
.....~.7U..Y...?.....4.<c.......fh....G..)]...........C.y.ur.#.
<<< skipped >>>

GET /clanBadge/20150807/20150807142332126222.gif HTTP/1.1


Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:32 GMT
Content-Type: image/gif
Content-Length: 239
Connection: keep-alive
Keep-Alive: timeout=20
Last-Modified: Fri, 07 Aug 2015 06:23:32 GMT
Expires: Mon, 14 Mar 2016 13:40:03 GMT
Cache-Control: max-age=2592000
Kugou-Memory: HIT
Accept-Ranges: bytes
GIF89a(..............................$.9.....E.....5......P..!.......,
....([email protected]..@(.di..QL. .H,.$R..A..|...!...c$..b"..N..H......P
.....0H-......}..^[...y.dt..6.."qs|MOE..hij}lDP.w'u.S!Cn".B..</.][R
Oq6#J.-.%...."9.. '..(*........;....


GET /fxstatic/images/blank.png HTTP/1.1


Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:32 GMT
Content-Type: image/png
Content-Length: 949
Connection: keep-alive
Keep-Alive: timeout=20
Last-Modified: Mon, 02 Feb 2015 09:28:17 GMT
Expires: Mon, 14 Mar 2016 13:08:50 GMT
Cache-Control: max-age=2592000
Kugou-Memory: HIT
Accept-Ranges: bytes
.PNG........IHDR.............(.4.....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:ECCE9351EB5711E18EF4F84FBA
F3F77E" xmpMM:DocumentID="xmp.did:ECCE9352EB5711E18EF4F84FBAF3F77E">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ECCE934FEB5711E18EF4
F84FBAF3F77E" stRef:documentID="xmp.did:ECCE9350EB5711E18EF4F84FBAF3F7
7E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>..)[email protected].
b`..0.....OmY.....IEND.B`.....


GET /fxstatic/images/room/2014/icon_original_95e3302.png HTTP/1.1


Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:33 GMT
Content-Type: image/png
Content-Length: 450
Connection: keep-alive
Keep-Alive: timeout=20
Last-Modified: Sat, 30 Jan 2016 15:11:52 GMT
Expires: Mon, 14 Mar 2016 13:14:07 GMT
Cache-Control: max-age=2592000
Kugou-Memory: HIT
Accept-Ranges: bytes
.PNG........IHDR.....................gAMA......a.... cHRM..z&.........
.....u0...`..:....p..Q<....bKGD.......C......pHYs...........~....&I
DAT8.c.o_..a...@X:.....Y[.. ..[......].v...C.'.C.R..=..j.....>c`Xx.
...............3......][.. -...,..p...>......q...."....Q..#.AM.....
rd.....1...F.Kd... A......0....bXp......x.....h!...A....B..20.9..za...
.".K.v:8-....t..^........V!.2f20d..._x.......";... ..K...=.;D..z.. Q..
...B..N......G.jz..#.YOE0......IEND.B`.....


GET /fxstatic/images/footer2_fd36cbe.png HTTP/1.1


Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:33 GMT
Content-Type: image/png
Content-Length: 13389
Connection: keep-alive
Keep-Alive: timeout=20
Last-Modified: Sat, 30 Jan 2016 15:11:52 GMT
Expires: Mon, 14 Mar 2016 13:16:08 GMT
Cache-Control: max-age=2592000
Kugou-Memory: HIT
Accept-Ranges: bytes
.PNG........IHDR...p..........}......tEXtSoftware.Adobe ImageReadyq.e&
lt;...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC (Windows)" xmpMM:InstanceID="xmp.iid:4F7114FC292A11E58E24EAB37
5A74354" xmpMM:DocumentID="xmp.did:4F7114FD292A11E58E24EAB375A74354"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4F7114FA292A11E58E2
4EAB375A74354" stRef:documentID="xmp.did:4F7114FB292A11E58E24EAB375A74
354"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>......0.IDATx.....U...gwY........,...5*.1V,$
j,Q?bL...Q.. .O...4F.b.........PQ..E.-tX.....;....................vf..
6..XkM...BI..[...-.l....%%%.......~~....m.R .....K......\.XI.$.......]
...S.d...9$.iA....G..Q.~..40. [email protected]........%.v.qi..?$
..wB5.E=B^....L..tibL.M..g|...b.XZ$.....uiC.nT.....=.....*."..!...r..2
H............{[email protected]..<S]...Ya.^w.Np._..Z.vrdw."
...fg.J...d....d.L....j..yG.k`.~t.....Y.z..P..w...F.).Z..^_u..^&..Sf..
...\.(..<..8...g..6.Y}."$IV......A....G).63a.J"[email protected].
.{`]....[]....1y>r.X...Im..s...D..............).c.......{`,.>
<<< skipped >>>

GET /fxstatic/images/loading.gif HTTP/1.1


Accept: */*
Referer: hXXp://fanxing.kugou.com/1028630
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.fx.kgimg.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Mon, 29 Feb 2016 09:18:34 GMT
Content-Type: image/gif
Content-Length: 875
Connection: keep-alive
Keep-Alive: timeout=20
Last-Modified: Mon, 02 Feb 2015 09:28:17 GMT
Expires: Mon, 14 Mar 2016 13:20:00 GMT
Cache-Control: max-age=2592000
Kugou-Memory: HIT
Accept-Ranges: bytes
GIF89a..........aaa...................................................
.......................................!..NETSCAPE2.0.....!..Built wit
h GIF Movie Gear 4.0.!..Made by AjaxLoad.info.!.......,..........P  .d
i..0.l!*.`.......5......[..<.i.P.........),.IZ..$b..H..8..5&.x.5k &
lt;...y....B.!.......,..........h  .G..h*.....@$E}..........eh..... @.
.L...cQG..B...P5. <.5UdQ. ."..g.0......Ak..#A..<P70.<...0.Y.8
*...#!.!.......,..........`  .#..(..H*..P..-..1.3..:C.1K.H....H..$..y.
[email protected]...,0.B...k.J...U?5w..|$k.\)...!.!.......,.......
...R  .di.. [email protected]....!B.`?......#E.8zBQX.c.m.v..". ...`.`..U
F..r....p.).f..!.!.......,..........`  [email protected]]....H....(....4.
 .(,..F!aH.XS...m5...bDH.....ab,..%.p3.c.#.'...".467P&*X/.(..$!.!.....
..,.........._  .di..H..@[email protected]"I.....`.>n..I0$....K7..H,...-t.*
..E.....-.`..`[email protected]./1.f.\)..&!.;.........HTTP/1.1 200 OK..
Server: nginx..Date: Mon, 29 Feb 2016 09:18:34 GMT..Content-Type: imag
e/gif..Content-Length: 875..Connection: keep-alive..Keep-Alive: timeou
t=20..Last-Modified: Mon, 02 Feb 2015 09:28:17 GMT..Expires: Mon, 14 M
ar 2016 13:20:00 GMT..Cache-Control: max-age=2592000..Kugou-Memory: HI
T..Accept-Ranges: bytes..GIF89a..........aaa..........................
................................................................!..NET
SCAPE2.0.....!..Built with GIF Movie Gear 4.0.!..Made by AjaxLoad.info
.!.......,..........P  .di..0.l!*.`.......5......[..<.i.P.........)
,.IZ..$b..H..8..5&.x.5k <...y....B.!.......,..........h  .G..h*
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

picview.exe_1064:

.text
`.rdata
@.data
.rsrc
@.reloc
\$4 \$, 
QSSh@
8%u,j
Mj.hl3E
MD5 part of OpenSSL 1.0.2 22 Jan 2015
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
FRegDeleteKeyExW
\Data\tongjiData.ini
adurl
windows936
windows932
windows874
windows1257
windows1256
windows1255
windows1254
windows1253
windows1252
windows1251
windows1250
Invalid or unsupported charset:
kernel32.dll
F:\boost_1_55_0\boost/property_tree/detail/ptree_implementation.hpp
F:\boost_1_55_0\boost/property_tree/detail/json_parser_read.hpp
F:\boost_1_55_0\boost/property_tree/string_path.hpp
0.0.0.0
%s {%s}
d-d-d d:d:d
\\.\PhysicalDrive%d
\\.\Scsi%d:
urllist
D:\common_app\PicView\bin\release\picview.pdb
WINMM.dll
KERNEL32.dll
EnumWindows
USER32.dll
GDI32.dll
COMDLG32.dll
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegCreateKeyW
RegDeleteKeyW
RegOpenKeyW
RegQueryInfoKeyW
RegEnumKeyExW
ADVAPI32.dll
ShellExecuteW
SHELL32.dll
ole32.dll
OLEAUT32.dll
MSVCP100.dll
PathIsURLW
SHLWAPI.dll
gdiplus.dll
?OnKeyDown@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?GetMessageMap@WindowImplBase@DuiLib@@MBEPBUDUI_MSGMAP@2@XZ
?IsKeyboardEnabled@CControlUI@DuiLib@@UBE_NXZ
?SetKeyboardEnabled@CControlUI@DuiLib@@UAEX_N@Z
DuiLib_u.dll
MSVCR100.dll
_amsg_exit
_wcmdln
_crt_debugger_hook
InternetOpenUrlW
HttpQueryInfoW
InternetCrackUrlW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
WININET.dll
SensApi.dll
IPHLPAPI.DLL
GetProcessHeap
.?AVwindows_file_codecvt@@
.?AVCFrmTrayWebAD@@
.?AUDWebBrowserEvents2@@
.?AVCWebBrwoser2EventListener@@
.?AU?$concrete_parser@U?$alternative@V?$action@V?$chset@_W@classic@spirit@boost@@Ua_escape@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@V?$action@U?$uint_parser@K$0BA@$03$03@classic@spirit@boost@@Ua_unicode@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@U?$difference@U?$difference@Uanychar_parser@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@Ua_char@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$positive@U?$contiguous@U?$confix_parser@U?$chlit@D@classic@spirit@boost@@U?$kleene_star@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@U1234@Uunary_parser_category@234@Unon_nested@234@Unon_lexeme@234@@classic@spirit@boost@@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$sequence@U?$optional@U?$chlit@D@classic@spirit@boost@@@classic@spirit@boost@@U?$alternative@U?$chlit@D@classic@spirit@boost@@U?$sequence@U?$range@_W@classic@spirit@boost@@U?$kleene_star@Udigit_parser@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$sequence@V?$chset@_W@classic@spirit@boost@@U?$optional@V?$chset@_W@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@Ua_name@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$chlit@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_s@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$alternative@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$list_parser@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@U?$chlit@D@234@Uno_list_endtoken@234@Uplain_parser_category@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$alternative@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@V1234@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Uend_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@
.?AV?$sp_counted_impl_p@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@detail@boost@@
.?AVHttpContent@@
.?AVCFrmAdvertisementWeb@@
.?AU?$concrete_parser@U?$alternative@V?$action@V?$chset@D@classic@spirit@boost@@Ua_escape@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@V?$action@U?$uint_parser@K$0BA@$03$03@classic@spirit@boost@@Ua_unicode@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@U?$difference@U?$difference@Uanychar_parser@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@Ua_char@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$positive@U?$contiguous@U?$confix_parser@U?$chlit@D@classic@spirit@boost@@U?$kleene_star@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@U1234@Uunary_parser_category@234@Unon_nested@234@Unon_lexeme@234@@classic@spirit@boost@@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$sequence@U?$optional@U?$chlit@D@classic@spirit@boost@@@classic@spirit@boost@@U?$alternative@U?$chlit@D@classic@spirit@boost@@U?$sequence@U?$range@D@classic@spirit@boost@@U?$kleene_star@Udigit_parser@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$sequence@V?$chset@D@classic@spirit@boost@@U?$optional@V?$chset@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@Ua_name@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$chlit@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_s@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$alternative@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$list_parser@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@U?$chlit@D@234@Uno_list_endtoken@234@Uplain_parser_category@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$alternative@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@V1234@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Uend_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AV?$sp_counted_impl_p@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@detail@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@
.?AUIHttpSecurity@@
.?AVCXWebBrowser@@
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
2&2[2`2|2
6-626<6_6
? ?$?(?,?
$0(0,0004080
3*4/444:4
1 1$1(1,101
7%7&858{8
7"767;7~7
; ;$;(;,;0;4;8;<;@;
; ;(;0;<;`;
2$2,242@2
Advapi32.dll
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
\internet explorer\iexplore.exe
%s::%d InitConfig Error
FrmTrayWebAD
iexplore.exe
FrmTrayWebAD.xml
FrmWebPlay
shell.Explorer.2
OKS.exe
picbus.exe
Data\img.ico
PicView.%s
Software\Classes\%s
Software\Classes\%s\DefaultIcon
Software\Classes\%s\Shell
Software\Classes\%s\Shell\Open
Software\Classes\%s\Shell\Open\Command
%s "%%1"
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s\OpenWithList
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s\OpenWithProgids
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s\UserChoice
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s
Dump generation request %s
hXXp://load.hiv-hiv.com/api/tongji2
hXXp://as.hiv-hiv.com/API/GetAdvConfig?param=v1
hXXp://tc.hiv-hiv.com/api/tongji4?param=v1
Software\Microsoft\Windows\CurrentVersion\Run
hXXp://sd.hiv-hiv.com/api/tongji3
firsturl
hXXp://tongji.hiv-hiv.com/default/index.html
%s%s\%d.ico
%s::%d GetTempPath fail.
AhXXp://updatever.hiv-hiv.com/tj2.ashx
hXXp://updatever.hiv-hiv.com/tj4.ashx
hXXp://updatever.hiv-hiv.com/tj1.ashx
hXXp://updatever.hiv-hiv.com/tj7.ashx
WinFileMenu.xml
res.rs
*.jpeg;*.jpg;*.png;*.bmp
WinMainFrame.xml
WinOperMenu.xml
0X:X:X:X:X:X
Data\tongjiData.ini
Software\Microsoft\Windows NT\CurrentVersion
t%s\%s
hXXp://VVV.baidu.com
1.15.0.1
2000-01-01
logger.log
Mozilla/4.0 (Compatible; MSIE6.0;)
hXXp://
HTTP/1.0
FrmAdvert.xml
kF:\boost_1_55_0\boost/smart_ptr/shared_ptr.hpp
F:\boost_1_55_0\boost/optional/optional.hpp
F:\boost_1_55_0\boost/smart_ptr/scoped_ptr.hpp
F:\boost_1_55_0\boost/spirit/home/classic/core/impl/match.ipp
val.is_initialized()
c.stack.size() >= 1
DWebAdWin
AppEvents\Schemes\Apps\Explorer\Navigating\.Current
CWebAdWinClose
360se.exe
TheWorld.exe
UCBrowser.exe
baiduBrowser.exe
SogouExplorer.exe
QQBrowser.exe
Maxthon.exe
chrome.exe
firefox.exe
lvseie.exe
360chrome.exe
liebao.exe
safari.exe
2345Explorer.exe
Juzi.exe
krBrowser.exe
TaoBrowser.exe
dbghelp.dll
rpcrt4.dll
%s\%s.dmp
x-x-x-xx-xxxxxx

OKS.exe_916:

.idata
.rdata
`.rsrc
kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
EInvalidGraphicOperation
USER32.DLL
comctl32.dll
uxtheme.dll
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
TKeyEvent
TKeyPressEvent
HelpKeyword|XA
crSQLWait
%s (%s)
imm32.dll
AutoHotkeys
AutoHotkeys$
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview
WindowState
OnKeyDown
OnKeyPressD
OnKeyUph
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WS2_32.DLL
127.0.0.1
TIdSocketListWindows
TIdStackWindowsU
IdStackWindows
Uh.hE
%s, %.2d %s %.4d %s %s
%s, %d %s %d %s %s
ftpTransfer
ftpReady
ftpAborted
ClientPortMin<
ClientPortMax
Port`
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
saUsernamePassword
Password<
Port
0.0.0.1
TIdTCPConnection
IdTCPConnection
EIdTCPConnectionError
TIdTCPClient
IdTCPClient
BoundPort
PortU
password
Password
IdHTTPHeaderInfo
ProxyPassword<
ProxyPort
Mozilla/3.0 (compatible; Indy Library)
libeay32.dll
ssleay32.dll
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_get_peer_certificate
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_check_private_key
X509_STORE_CTX_get_current_cert
des_set_key
sslvrfFailIfNoPeerCert
TPasswordEvent
Certificate
RootCertFile
CertFile
KeyFileHIF
OnGetPassword
EIdOSSLLoadingRootCertError
EIdOSSLLoadingCertErrorxUF
EIdOSSLLoadingKeyError
CommentURL
TIdHTTPMethod
IdHTTP
TIdHTTPOption
TIdHTTPOptions
TIdHTTPProtocolVersion
TIdHTTPOnHeadersAvailable
TIdHTTPOnRedirectEvent
TIdHTTPResponse
TIdHTTPResponse(
TIdHTTPRequest
TIdHTTPProtocol
TIdCustomHTTP
TIdHTTP
TIdHTTP$
HTTPOptions
PortX
EIdHTTPProtocolException
HTTPS
https
This request method is supported in HTTP 1.1
HTTP/1.0 200 OK
HTTP/
%s, ClassID: %s
ole32.dll
PSAPI.dll
SPHttp
KERNEL32.DLL
\Windows\
iexplore.exe
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
\Rec.DAT
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
hXXp://
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
\SOSAVE.DAT
Data\tongjiData.ini
\SOSAVE.dll
0123456789
picview.exe
TPSC.dll
/db/tpck/db.zip
hXXp://update.yinyue.fm
?456789:;<=
!"#$%&'()* ,-./0123
.Mg*i;
n.pPn$S
w%sWp
npxWnoxßn
KWindows
UrlMon
0IdHTTPHeaderInfo
 IdTCPServer
IdTCPStream
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
Icon.Data
ProxyParams.BasicAuthentication
ProxyParams.ProxyPort
Request.ContentLength
Request.ContentRangeEnd
Request.ContentRangeStart
Request.Accept
Request.BasicAuthentication
Request.UserAgent
7Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
MsgWaitForMultipleObjects
iphlpapi.dll
GetKeyboardType
RegOpenKeyA
version.dll
MapVirtualKeyA
GetKeyboardLayout
EnumThreadWindows
ActivateKeyboardLayout
GetCPInfo
?G*.GKI
SetWindowsHookExA
gdi32.dll
GetKeyState
EnumWindows
user32.dll
UnhookWindowsHookEx
'%XWw
.ip ]
D(%Dn
Jur%uY0
.hR3<
A<%uC
@wAjU%d@]-
r@%DJ
ý]y
(#%4x
w-tu}
.We!@
2*%sM
'.ZL\Qh
@5%dv
LoadKeyboardLayoutA
GetKeyNameTextA
InternetOpenUrlA
GetKeyboardLayoutList
The ordinal %u could not be located in the dynamic link library %s
GetWindowsDirectoryA
wininet.dll
hThe procedure entry point %s could not be located in the dynamic link library %s
RegCloseKey
.GkNZ
advapi32.dll
.eYth
MLkernel32.dll
shell32.dll
,%S&|
RegCreateKeyExA
GetKeyboardState
ShellExecuteA
SetViewportOrgEx
RegOpenKeyExA
SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA
1.0.0.0
1.0.0.20150912
/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
DCOM not installedNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
Error creating SSL context. Could not load root certificate.
Could not load certificate.#Could not load key, check password.
SSL status: "%s"
OLE error %.8x.Method '%s' not supported by automation object
5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Command not supported.
Address type not supported.$Error accepting connection with SSL.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
Chunk StartedDThis authentication method is already registered with class name %s.
%s is not a valid service.
Socket Error # %d
%s is not a valid IP address.
Operation would block.
Operation now in progress.
File "%s" not found1Only one TIdAntiFreeze can exist per application."%d: Circular links are not allowed
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
Max line length exceeded.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
No help keyword specified.
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information.
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Alt  Clipboard does not support Icons/Menu '%s' is already being used by another form
 Cannot focus a disabled or invisible window!Control '%s' has no parent window
Thread creation error: %s
Thread Error: %s (%d)
Unsupported clipboard format
$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Unable to write to %s
Operation not supported
External exception %x
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
I/O error %d

OKS.exe_916_rwx_0049D000_00001000:

EnumWindows
comctl32.dll
user32.dll
UnhookWindowsHookEx

OKS.exe_916_rwx_004D8000_00002000:

LoadKeyboardLayoutA
GetKeyNameTextA
ole32.dll
InternetOpenUrlA
GetKeyboardLayoutList
The ordinal %u could not be located in the dynamic link library %s

picbus.exe_928:

.text
`.rdata
@.data
.rsrc
@.reloc
MD5 part of OpenSSL 1.0.2 22 Jan 2015
windows936
windows932
windows874
windows1257
windows1256
windows1255
windows1254
windows1253
windows1252
windows1251
windows1250
Invalid or unsupported charset:
kernel32.dll
%s {%s}
d-d-d d:d:d
D:\common_app\third_party\libadclick\Release\tqbus.pdb
WINMM.dll
KERNEL32.dll
USER32.dll
RegOpenKeyW
RegCloseKey
ADVAPI32.dll
ole32.dll
OLEAUT32.dll
MSVCP100.dll
MSVCR100.dll
_amsg_exit
_wcmdln
_crt_debugger_hook
PathIsURLW
SHLWAPI.dll
UrlMkSetSessionOption
urlmon.dll
SHELL32.dll
InternetOpenUrlW
InternetCrackUrlW
HttpSendRequestW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpOpenRequestW
WININET.dll
SensApi.dll
.?AUIHttpSecurity@@
.?AVCXWebBrowser@@
.?AVHttpContent@@
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
4$5(5,50545
7 7$7(7,7074787
3 3$3(3,383<3@3
5 5$5(5,5054585
; ;$;(;,;0;4;8;
hXXp://asad.lczchina.com/api/tongji5
%s::%d InitConfig Error
Shcore.dll
\internet explorer\iexplore.exe
document.body.onunload = null;
window.onbeforeonunload = null;
[URL]:%s.[AdID]:%s.[MaxClick]:%d.[InsertPos]:%d.[PopProbability]:%d.[TaskType]:%d.[UserAgent]:%s.[PixelX]:%d.[PixelY]:%d.[Weight]:%d.
AppEvents\Schemes\Apps\Explorer\Navigating\.Current
@logger.log
Mozilla/4.0 (Compatible; MSIE6.0;)
hXXp://
HTTP/1.0


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:1332

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xanimate[2].js (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\u=1875430050,2580979778&fm=76[1].jpg (8719 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tongji5[1].htm (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\details[1].css (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\web_avatar[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAAZOHCX.2281 (667 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mask[2].css (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\a[1].js (477 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAOD4PGZ.2172 (667 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\base[1].js (359 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\web_close[1].jpg (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\u=990497764,1232924695&fm=76[1].jpg (5851 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ie6_png[1].js (198 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\base[2].css (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gac[1].js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\VGX1.tmp (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\u=1315327375,467324658&fm=76[1].jpg (12718 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[2].js (414 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery-1.11.2.min[2].js (3251 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (2988 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\17323[1].htm (921 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\640x107[1].png (1826 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\t00aa2[2].js (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\mask[1].css (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAMRQPAH.htm (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\640x107[1].png (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\autoscroll[2].js (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAZIQH3F.gif (49 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\web_title[1].gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\imgload[2].js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hongbao[1].js (338 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CABIQ7VT.htm (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[1].jpg (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hongb[1].gif (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\content[1].js (1 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@yigao[1].txt (181 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[1].js (820 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\u=3059151468,3543266969&fm=76[1].jpg (479 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\VGX2.tmp (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\u=1516739037,2004201896&fm=76[1].jpg (10060 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\share_icons[1].png (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\content[2].js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\m[1].js (9301 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\u=1856364587,2693382950&fm=76[1].jpg (13084 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CALRZP48.1891 (656 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\u=1568043101,2080188669&fm=76[1].jpg (11912 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\details[1].css (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qr_code[1].jpg (2476 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\a[2].js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\c[1].js (3559 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\VGX4.tmp (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAIDYDQH.htm (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\go[1].htm (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAMB0BF0.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&sz=300x250 (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAVQ0FB1.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737392 (536 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\m[2].js (10413 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\autoscroll[1].js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ewm[1].jpg (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\head[1].jpg (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gac[2].js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ac_placeholder[1].jpg (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\share_icons[1].png (915 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\web_title[1].png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\t00aa2[1].js (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery-1.11.2.min[1].js (2688 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\li_bg[1].png (2066 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\base[2].js (957 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\base[1].css (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA0TQRST.gif (49 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\c[2].js (3960 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hongbao[2].js (329 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\web_bg[1].gif (3890 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\VGX3.tmp (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAAJO1UJ.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&sz=300x250 (599 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\DD_belatedPNG[2].js (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\li_bg[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\imgload[1].js (889 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA9GAD1N.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737391 (863 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\DD_belatedPNG[1].js (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\u=728057772,766315808&fm=76[1].jpg (13117 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@baidu[2].txt (198 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\emar[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xanimate[1].js (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\g[1].png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\btn_hidden[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\17323[1].html (1426 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\to_top_v2[1].jpg (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\excanvas[2].js (1276 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\excanvas[1].js (1322 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA0PUZCT.html#pxxDb9a=1&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737393&sz=300x250 (1 bytes)
    %Program Files%\picview_201602291116\201602291116\data\WinFileMenu.xml (862 bytes)
    %Program Files%\picview_201602291116\201602291116\data\WinOperMenu.xml (1 bytes)
    %Program Files%\picview_201602291116\201602291116\data\6.ico (784 bytes)
    %Program Files%\picview_201602291116\201602291116\data\0.ico (9 bytes)
    %Program Files%\picview_201602291116\201602291116\data\1.ico (784 bytes)
    %Program Files%\picview_201602291116\201602291116\data\window_btn_close.png (2 bytes)
    %Program Files%\picview_201602291116\201602291116\data\window_popup.png (1 bytes)
    %Program Files%\picview_201602291116\201602291116\data\9.ico (784 bytes)
    %Program Files%\picview_201602291116\201602291116\DuiLib_u.dll (14184 bytes)
    %Program Files%\picview_201602291116\201602291116\data\img.ico (9 bytes)
    %Program Files%\picview_201602291116\201602291116\data\4.ico (784 bytes)
    %Program Files%\picview_201602291116\201602291116\data\logo.png (2 bytes)
    %Program Files%\picview_201602291116\201602291116\data\3.ico (784 bytes)
    %Program Files%\picview_201602291116\201602291116\data\7.ico (784 bytes)
    %Program Files%\picview_201602291116\201602291116\data\bar_btn.png (1 bytes)
    %Program Files%\picview_201602291116\201602291116\data\btn_close1.png (2 bytes)
    %Program Files%\picview_201602291116\201602291116\data\8.ico (784 bytes)
    %Program Files%\picview_201602291116\201602291116\data\2.ico (784 bytes)
    %Program Files%\picview_201602291116\201602291116\msvcr100.dll (25824 bytes)
    %Program Files%\picview_201602291116\201602291116\data\popup_s.png (1 bytes)
    %Program Files%\picview_201602291116\201602291116\data\WinMainFrame.xml (2 bytes)
    %Program Files%\picview_201602291116\201602291116\data\window_btn_max.png (1 bytes)
    %Program Files%\picview_201602291116\201602291116\OKS.exe (13368 bytes)
    %Program Files%\picview_201602291116\201602291116\picview.exe (20416 bytes)
    %Program Files%\picview_201602291116\201602291116\data\tongjiData.ini (168 bytes)
    %Program Files%\picview_201602291116\201602291116\data\10.ico (784 bytes)
    %Program Files%\picview_201602291116\201602291116\SysConfig.ini (59 bytes)
    %Program Files%\picview_201602291116\201602291116\data\user2.ini (24 bytes)
    %Program Files%\picview_201602291116\201602291116\data\bar_bg.png (1 bytes)
    %Program Files%\picview_201602291116\201602291116\data\window_popup_pass.png (1 bytes)
    %Program Files%\picview_201602291116\201602291116\data\11.ico (784 bytes)
    %Program Files%\picview_201602291116\201602291116\data\FrmTrayMenu.xml (484 bytes)
    %Program Files%\picview_201602291116\201602291116\TPSC.dll (6360 bytes)
    %Program Files%\picview_201602291116\201602291116\data\window_btn_mini.png (1 bytes)
    %Program Files%\picview_201602291116\201602291116\data\FrmAdvert.xml (185 bytes)
    %Program Files%\picview_201602291116\201602291116\Unins.exe (16288 bytes)
    %Program Files%\picview_201602291116\201602291116\msvcp100.dll (14184 bytes)
    %Program Files%\picview_201602291116\201602291116\data\FrmTrayWebAD.xml (682 bytes)
    %Program Files%\picview_201602291116\201602291116\picbus.exe (6360 bytes)
    %Program Files%\picview_201602291116\201602291116\data\5.ico (784 bytes)
    %Program Files%\picview_201602291116\201602291116\data\window_btn_default.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\c[2].swf (547 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index[1].html (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\blank_5307b88[1].png (949 bytes)
    %Documents and Settings%\%current user%\UserData\2Z89WTQV\oXMLStore[1].xml (106 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ac[1].js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\head_0511e83[1].css (3821 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (763 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\c[1].swf (547 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\oojs[1].js (65 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\room2014_z_4dae78b[1].png (43498 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAMJWHAJ.html?s&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416 (902 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\roomFunction2014_dd2507b[1].js (2553 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wh[4].js (4683 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\head_061c6e7[1].js (3445 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\o[1].htm (1394 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\room2014_72f51c4[1].css (6370 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\yellow_warn_0473de0[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\oojs[1].js (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fp[2].htm (114 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\roomInit_f54bbdd[1].js (22 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (210 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wh[1].js (5629 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\icon_original_95e3302[1].png (450 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\yellow_warn2_b8d73e7[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAS1YFKH.gif (49 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\socket_48ba6f2[1].js (1649 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tj4[1].htm (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].php (1177 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bd-logo5[1].png (1545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\loading[1].gif (875 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\room2014_z_4dae78b[1].png (29281 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wh[3].js (2916 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\anticheat[2].js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\o[1].swf (157 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (211 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAEJOXYR.gif (49 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\20140827184515870962[1].jpg (21919 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\kg_6abcd20[1].js (2779 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\oojs[2].js (928 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (1177 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\fp[2].htm (114 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\roomActivity_059de9b[1].js (1118 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tj7[1].htm (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (763 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tongji3[1].htm (704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bd-logo5[1].png (1545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lab.min_c0c155c[1].js (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wh[2].js (4782 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fp[1].htm (114 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\roomFunction_a35552b[1].js (6437 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\video_6f4f75f[1].gif (575 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tongji2[1].htm (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20151130161134_14413[1].flv (312425 bytes)
    %Documents and Settings%\%current user%\UserData\KTOR0Z81\oXMLStore[1].xml (106 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\footer_logo_16e645b[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA5OWN9L.html&ecd=0&psr=1276x846&par=1276x818&pis=-1x-1&ccd=32&cja=true&cmi=0&col=en-us&cdo=-1&tcn=1456737416 (902 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\o[1].htm (1394 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\kguser[1].js (2569 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[2].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\fla7.tmp (276056 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\DD_belatedPNG_79c3052[1].js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ac[1].js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\KgAck[1].js (461 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\20151130161134_14413[2].flv (244346 bytes)
    %Documents and Settings%\%current user%\UserData\YJM90VAL\CPROID[1].xml (310 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAI7G1AB.htm (1264 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tongji4[1].htm (128 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\blank[1].png (949 bytes)
    %Documents and Settings%\%current user%\Desktop\图片查看器.lnk (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\VGX5.tmp (137 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\footer2_fd36cbe[1].png (3040 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tj2[1].htm (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAGTURWD.htm (1264 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bg2013_2015_f530136[1].png (31813 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1028630[1].htm (55643 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\roombg_3eb04e4[1].png (30481 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (814 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (139 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\fla6.tmp (215120 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\o[1].swf (157 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\successIcon_754795c[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\template.min[1].css (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tj1[1].htm (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\T1vgAyBXJb1RCvBVdK.jpg_85x85[1].jpg (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\template.min[2].css (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ac[2].js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\roomBase_f6883f0[1].js (504 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\fp[1].htm (114 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20150807142332126222[1].gif (239 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\18[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swfobject_dc734ee[1].js (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fx_loading_c785dd3[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\footer1_369dc54[1].png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\0f000nTH6UlUciFfpq-CKs[1].swf (1803 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bigScrollBg_8972341[1].jpg (2386 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ac[1].js (1 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (406 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\template.min[3].css (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\0f000jioG2SODfD3KlS1j6[1].swf (1803 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fxtpl_loading_c785dd3[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery.min_21c00b7[1].js (7330 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\template.min[2].css (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\anticheat[1].js (1 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now